easy-ping 0.5.0 → 0.6.1

package/dist/node.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/handler.ts","../src/node/index.ts"],"names":[],"mappings":";;;AA8BO,IAAM,iBAAiB,EAAA,GAAK,IAAA;AA+BnB,IAAI,WAAA;;;AChDpB,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAC,CAAA;AAEvC,SAAS,QAAA,CAAS,KAAsB,QAAA,EAA+C;AACrF,EAAA,IAAI,GAAA,CAAI,WAAW,KAAA,IAAS,GAAA,CAAI,WAAW,MAAA,EAAQ,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEnF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AACrD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,WAAW,QAAA,EAAU;AACpD,IAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,iBAAA,EAAmB,CAAA;AAAA,EAC/C;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAChC,MAAA,KAAA,IAAS,KAAA,CAAM,MAAA;AACf,MAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,QAAA,GAAA,CAAI,OAAA,EAAQ;AACZ,QAAA,MAAA,CAAO,IAAI,mBAAmB,CAAA;AAC9B,QAAA;AAAA,MACF;AACA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,EAAA,CAAG,KAAA,EAAO,MAAM,OAAA,CAAQ,MAAA,CAAO,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,GAAI,MAAS,CAAC,CAAA;AAC9E,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EACxB,CAAC,CAAA;AACH;AAEO,SAAS,YAAA,CAAa,KAAsB,IAAA,EAAwB;AAEzE,EAAA,MAAM,QAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,mBAAmB,CAAA,IAA4B,MAAA;AAC7E,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,IAAA,IAAQ,WAAA;AAEjC,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAC5B,EAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AACtD,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,KAAA,MAAW,QAAQ,KAAA,EAAO,OAAA,CAAQ,MAAA,CAAO,GAAA,EAAK,IAAI,CAAA;AAAA,SACvE,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EAC7B;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,IAAI,CAAA,EAAG,GAAA,CAAI,GAAA,IAAO,GAAG,CAAA,CAAA,EAAI;AAAA,IAC3D,MAAA,EAAQ,IAAI,MAAA,IAAU,KAAA;AAAA,IACtB,OAAA;AAAA,IACA,GAAI,OAAO,EAAE,IAAA,EAAM,IAAI,UAAA,CAAW,IAAI,CAAA,EAAE,GAAI;AAAC,GAC9C,CAAA;AACH;AAEO,SAAS,aAAA,CACd,OAAA,EACA,OAAA,GAA8B,EAAC,EAClB;AACb,EAAA,MAAM,YAAA,GAAe,QAAQ,YAAA,IAAgB,cAAA;AAC7C,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,KAAY,CAAC,UAAmB,OAAA,CAAQ,KAAA,CAAM,eAAe,KAAK,CAAA,CAAA;AAE1F,EAAA,OAAO,OAAO,KAAK,GAAA,KAAQ;AACzB,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,YAAA,CAAa,GAAA,EAAK,MAAM,QAAA,CAAS,GAAA,EAAK,YAAY,CAAC,CAAC,CAAA;AAEnF,MAAA,GAAA,CAAI,aAAa,QAAA,CAAS,MAAA;AAE1B,MAAA,QAAA,CAAS,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AACvC,QAAA,GAAA,CAAI,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC1B,CAAC,CAAA;AAED,MAAA,MAAM,MAAA,GAAS,SAAS,IAAA,GAAO,MAAA,CAAO,KAAK,MAAM,QAAA,CAAS,WAAA,EAAa,CAAA,GAAI,IAAA;AAC3E,MAAA,GAAA,CAAI,GAAA,CAAI,UAAU,KAAA,CAAS,CAAA;AAAA,IAC7B,SAAS,KAAA,EAAO;AAEd,MAAA,IAAI,CAAC,GAAA,CAAI,WAAA,MAAiB,UAAA,GAAa,KAAA,YAAiB,oBAAoB,GAAA,GAAM,GAAA;AAClF,MAAA,GAAA,CAAI,GAAA,EAAI;AACR,MAAA,IAAI,EAAE,KAAA,YAAiB,iBAAA,CAAA,EAAoB,OAAA,CAAQ,KAAK,CAAA;AAAA,IAC1D;AAAA,EACF,CAAA;AACF","file":"node.cjs","sourcesContent":["import type { DatabaseAdapter } from \"./adapter\";\nimport type { SessionConfig } from \"./config\";\nimport type { Logger } from \"./errors\";\nimport type { Promisable, RouteDefinition } from \"./plugin\";\nimport type { Runner } from \"./runner\";\nimport { verifyToken } from \"./tokens\";\n\nexport type HandlerDeps = {\n  adapter: DatabaseAdapter;\n  session: SessionConfig;\n  runner: Runner;\n  logger: Logger;\n  basePath: string;\n  secret: string;\n  cronSecret?: string | undefined;\n  /** Guards plugin machine routes. The instance defaults it to cronSecret. */\n  machineSecret?: string | undefined;\n  cronMaxSweeps?: number | undefined;\n  pluginRoutes?: readonly RouteDefinition[] | undefined;\n  /** Returns a 429 to send, or null to proceed. Runs after onRequest, before routing. */\n  rateLimit?: ((request: Request) => Response | null) | undefined;\n  /** Origins other than the request's own host that may POST. `*.example.com` allowed. */\n  trustedOrigins?: readonly string[] | undefined;\n  /** Runs before routing. Returning a Response short-circuits; use it for rate limiting. */\n  // biome-ignore lint/suspicious/noConfusingVoidType: a hook that returns nothing is the common case\n  onRequest?: ((request: Request) => Promisable<Response | undefined | void>) | undefined;\n  maxBodyBytes?: number | undefined;\n};\n\n/** Every JSON body is capped here. Nothing legitimate the routes accept is bigger. */\nexport const MAX_BODY_BYTES = 64 * 1024;\n\nconst MAX_READ_IDS = 200;\n\n// Per-user data: no shared caching, no sniffing.\nconst PRIVATE_HEADERS: Record<string, string> = {\n  \"cache-control\": \"private, no-store\",\n  \"x-content-type-options\": \"nosniff\",\n};\n\nconst json = (body: unknown, status = 200) =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { \"content-type\": \"application/json\", ...PRIVATE_HEADERS },\n  });\n\nconst empty = (status: number) => new Response(null, { status, headers: PRIVATE_HEADERS });\n\n/** Plugin responses get the same headers, without touching their body. */\nfunction harden(response: Response): Response {\n  const headers = new Headers(response.headers);\n  for (const [name, value] of Object.entries(PRIVATE_HEADERS)) {\n    if (!headers.has(name)) headers.set(name, value);\n  }\n  return new Response(response.body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n  });\n}\n\nconst encoder = new TextEncoder();\n\n/** Constant time over SHA-256 digests, so neither content nor length leaks. Works on edge runtimes. */\nasync function timingSafeEqual(a: string, b: string): Promise<boolean> {\n  const [left, right] = await Promise.all(\n    [a, b].map(\n      async (value) => new Uint8Array(await crypto.subtle.digest(\"SHA-256\", encoder.encode(value))),\n    ),\n  );\n  let diff = 0;\n  for (let i = 0; i < 32; i += 1) diff |= (left?.[i] ?? 0) ^ (right?.[i] ?? 0);\n  return diff === 0;\n}\n\n/** Anchored at a segment boundary: `/foo/api/notifications/cron` is not a cron request. */\nfunction routePath(url: URL, basePath: string): string {\n  const { pathname } = url;\n  if (pathname === basePath) return \"/\";\n  if (pathname.startsWith(`${basePath}/`)) return pathname.slice(basePath.length);\n  return pathname;\n}\n\nexport type JsonBody = { body: Record<string, unknown> } | { error: Response };\n\n/** Reads a JSON object body with a streaming byte cap. Malformed JSON is 400; an empty body is `{}`. */\nexport async function readJsonBody(\n  request: Request,\n  maxBytes: number = MAX_BODY_BYTES,\n): Promise<JsonBody> {\n  const tooLarge = () => ({ error: json({ error: `body exceeds ${maxBytes} bytes` }, 413) });\n\n  const declared = Number(request.headers.get(\"content-length\"));\n  if (Number.isFinite(declared) && declared > maxBytes) return tooLarge();\n  if (!request.body) return { body: {} };\n\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    total += value.byteLength;\n    if (total > maxBytes) {\n      await reader.cancel();\n      return tooLarge();\n    }\n    chunks.push(value);\n  }\n\n  const bytes = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n\n  const text = new TextDecoder().decode(bytes);\n  if (text.trim() === \"\") return { body: {} };\n\n  try {\n    const parsed: unknown = JSON.parse(text);\n    return {\n      body:\n        parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n          ? (parsed as Record<string, unknown>)\n          : {},\n    };\n  } catch {\n    return { error: json({ error: \"body must be a JSON object\" }, 400) };\n  }\n}\n\nconst isJsonContentType = (request: Request) =>\n  /^application\\/json\\s*(;|$)/i.test((request.headers.get(\"content-type\") ?? \"\").trim());\n\nfunction originAllowed(origin: string, url: URL, request: Request, trusted: readonly string[]) {\n  let host: string;\n  try {\n    host = new URL(origin).host;\n  } catch {\n    return false;\n  }\n\n  if (host === url.host) return true;\n  // Behind a proxy that rewrites Host, the public host arrives here instead.\n  const forwarded = request.headers.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  if (forwarded && host === forwarded) return true;\n\n  return trusted.some((entry) =>\n    entry.startsWith(\"*.\") ? host.endsWith(entry.slice(1)) : entry === origin,\n  );\n}\n\n/** CSRF: a cross-site form can neither send `application/json` without a preflight nor forge `Origin`. */\nfunction csrfCheck(request: Request, url: URL, trusted: readonly string[]): Response | null {\n  if (!isJsonContentType(request)) {\n    return json({ error: \"content-type must be application/json\" }, 415);\n  }\n\n  const origin = request.headers.get(\"origin\");\n  if (origin === null) return null;\n  if (origin === \"null\" || !originAllowed(origin, url, request, trusted)) return empty(403);\n\n  return null;\n}\n\nexport function createHandler(deps: HandlerDeps) {\n  const trustedOrigins = deps.trustedOrigins ?? [];\n  const maxBodyBytes = deps.maxBodyBytes ?? MAX_BODY_BYTES;\n\n  async function resolveUserId(request: Request): Promise<string | null | \"error\"> {\n    try {\n      return await deps.session.getUserId(request);\n    } catch (error) {\n      // A broken session lookup is a 500, never a 401. RFC 0002 §1.\n      deps.logger.error(\"session.getUserId threw\", { error });\n      return \"error\";\n    }\n  }\n\n  async function bearerMatches(request: Request, secret: string | undefined): Promise<boolean> {\n    if (!secret) return false;\n    const header = request.headers.get(\"authorization\") ?? \"\";\n    const presented = header.startsWith(\"Bearer \") ? header.slice(7) : header;\n    return timingSafeEqual(presented, secret);\n  }\n\n  async function handleCron(request: Request): Promise<Response> {\n    if (!deps.cronSecret) return empty(404);\n    if (!(await bearerMatches(request, deps.cronSecret))) return empty(401);\n\n    // Bounded so an overlapping scheduler does not hold a request open for the whole backlog.\n    const result = await deps.runner.drain(\n      deps.cronMaxSweeps === undefined ? {} : { maxSweeps: deps.cronMaxSweeps },\n    );\n    return json(result);\n  }\n\n  /** Plugin routes first; auth is enforced here so a plugin cannot forget it. */\n  async function handlePluginRoute(\n    route: RouteDefinition,\n    request: Request,\n    url: URL,\n  ): Promise<Response> {\n    if (route.scope.type === \"user\") {\n      if (request.method === \"POST\") {\n        const rejected = csrfCheck(request, url, trustedOrigins);\n        if (rejected) return rejected;\n      }\n\n      const userId = await resolveUserId(request);\n      if (userId === \"error\") return empty(500);\n      if (userId === null) return empty(401);\n      return harden(await route.handler({ request, userId, claims: null, params: {} }));\n    }\n\n    if (route.scope.type === \"machine\") {\n      if (!deps.machineSecret) return empty(404);\n      if (!(await bearerMatches(request, deps.machineSecret))) return empty(401);\n      return harden(await route.handler({ request, userId: null, claims: null, params: {} }));\n    }\n\n    if (route.scope.type === \"signed\") {\n      const token =\n        url.searchParams.get(\"token\") ??\n        (request.headers.get(\"authorization\") ?? \"\").replace(/^Bearer /, \"\");\n\n      const claims = await verifyToken(deps.secret, token, route.scope.purpose);\n      // One response for every failure mode. RFC 0002 §5.\n      if (!claims) return empty(400);\n\n      return harden(await route.handler({ request, userId: claims.uid, claims, params: {} }));\n    }\n\n    return harden(await route.handler({ request, userId: null, claims: null, params: {} }));\n  }\n\n  async function route(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    const path = routePath(url, deps.basePath);\n\n    if (deps.onRequest) {\n      const early = await deps.onRequest(request);\n      if (early instanceof Response) return early;\n    }\n\n    if (deps.rateLimit) {\n      const limited = deps.rateLimit(request);\n      if (limited) return limited;\n    }\n\n    if (path === \"/cron\") {\n      if (request.method !== \"POST\") return empty(405);\n      return handleCron(request);\n    }\n\n    const pluginRoute = deps.pluginRoutes?.find(\n      (candidate) => candidate.path === path && candidate.method === request.method,\n    );\n    if (pluginRoute) return handlePluginRoute(pluginRoute, request, url);\n\n    if (request.method === \"POST\") {\n      const rejected = csrfCheck(request, url, trustedOrigins);\n      if (rejected) return rejected;\n    }\n\n    const userId = await resolveUserId(request);\n    if (userId === \"error\") return empty(500);\n    if (userId === null) return empty(401);\n\n    if (request.method === \"GET\" && path === \"/\") {\n      const limitParam = Number(url.searchParams.get(\"limit\") ?? 20);\n      const limit = Number.isFinite(limitParam) ? Math.min(Math.max(limitParam, 1), 100) : 20;\n      const cursor = url.searchParams.get(\"cursor\");\n\n      // unseenCount rides on the first page only: a cursor request is scrollback, not a poll.\n      const [page, unseenCount] = await Promise.all([\n        deps.adapter.listNotifications({\n          userId,\n          limit,\n          ...(cursor ? { cursor } : {}),\n          ...(url.searchParams.get(\"unreadOnly\") === \"true\" ? { unreadOnly: true } : {}),\n        }),\n        cursor ? Promise.resolve(null) : deps.adapter.countUnseen(userId),\n      ]);\n\n      return json(unseenCount === null ? page : { ...page, unseenCount });\n    }\n\n    if (request.method === \"GET\" && path === \"/count\") {\n      return json({ unseen: await deps.adapter.countUnseen(userId) });\n    }\n\n    if (request.method === \"POST\" && path === \"/seen\") {\n      const parsed = await readJsonBody(request, maxBodyBytes);\n      if (\"error\" in parsed) return parsed.error;\n      const before = typeof parsed.body.before === \"string\" ? new Date(parsed.body.before) : null;\n\n      // +1ms: Postgres keeps microseconds, an ISO string milliseconds; without it markSeen misses the newest row.\n      const cutoff =\n        before && !Number.isNaN(before.getTime()) ? new Date(before.getTime() + 1) : new Date();\n\n      await deps.adapter.markSeen(userId, cutoff);\n      return json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && path === \"/read\") {\n      const parsed = await readJsonBody(request, maxBodyBytes);\n      if (\"error\" in parsed) return parsed.error;\n      const ids = Array.isArray(parsed.body.ids)\n        ? parsed.body.ids.filter((id): id is string => typeof id === \"string\")\n        : [];\n      if (ids.length === 0) return json({ error: \"ids must be a non-empty string array\" }, 400);\n\n      if (ids.length > MAX_READ_IDS) {\n        return json({ error: `at most ${MAX_READ_IDS} ids per request` }, 400);\n      }\n\n      // 404, not 403: a 403 confirms the row exists. RFC 0002 §2.\n      const updated = await deps.adapter.markRead(userId, ids);\n      return updated === 0 ? empty(404) : json({ updated });\n    }\n\n    if (request.method === \"POST\" && path === \"/read-all\") {\n      return json({ updated: await deps.adapter.markAllRead(userId) });\n    }\n\n    return empty(404);\n  }\n\n  async function handle(request: Request): Promise<Response> {\n    try {\n      return await route(request);\n    } catch (error) {\n      // A thrown driver error must not escape: unhandled rejection on Node, stack trace elsewhere.\n      deps.logger.error(\"request failed\", { url: request.url, error });\n      return empty(500);\n    }\n  }\n\n  return {\n    handle,\n    GET: handle,\n    POST: handle,\n  };\n}\n","import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { MAX_BODY_BYTES } from \"../core/handler\";\n\n/** Adapts the web-standard handler to Node's http/Express signature. */\nexport type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;\n\nexport type NodeHandlerOptions = {\n  /** Defaults to 64 KiB. Enforced here because this reads the raw stream, bypassing body-parser. */\n  maxBodyBytes?: number;\n  /** Called when the handler itself throws. Defaults to console.error; the response is already a 500. */\n  onError?: (error: unknown) => void;\n};\n\nclass BodyTooLargeError extends Error {}\n\nfunction readBody(req: IncomingMessage, maxBytes: number): Promise<Buffer | undefined> {\n  if (req.method === \"GET\" || req.method === \"HEAD\") return Promise.resolve(undefined);\n\n  const declared = Number(req.headers[\"content-length\"]);\n  if (Number.isFinite(declared) && declared > maxBytes) {\n    return Promise.reject(new BodyTooLargeError());\n  }\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let total = 0;\n    req.on(\"data\", (chunk: Buffer) => {\n      total += chunk.length;\n      if (total > maxBytes) {\n        req.destroy();\n        reject(new BodyTooLargeError());\n        return;\n      }\n      chunks.push(chunk);\n    });\n    req.on(\"end\", () => resolve(chunks.length ? Buffer.concat(chunks) : undefined));\n    req.on(\"error\", reject);\n  });\n}\n\nexport function toWebRequest(req: IncomingMessage, body?: Buffer): Request {\n  // Behind a load balancer this is the only signal that the site is https.\n  const protocol = (req.headers[\"x-forwarded-proto\"] as string | undefined) ?? \"http\";\n  const host = req.headers.host ?? \"localhost\";\n\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (value === undefined) continue;\n    if (Array.isArray(value)) for (const item of value) headers.append(key, item);\n    else headers.set(key, value);\n  }\n\n  return new Request(`${protocol}://${host}${req.url ?? \"/\"}`, {\n    method: req.method ?? \"GET\",\n    headers,\n    ...(body ? { body: new Uint8Array(body) } : {}),\n  });\n}\n\nexport function toNodeHandler(\n  handler: (request: Request) => Promise<Response>,\n  options: NodeHandlerOptions = {},\n): NodeHandler {\n  const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;\n  const onError = options.onError ?? ((error: unknown) => console.error(\"[easy-ping]\", error));\n\n  return async (req, res) => {\n    try {\n      const response = await handler(toWebRequest(req, await readBody(req, maxBodyBytes)));\n\n      res.statusCode = response.status;\n      // forEach: Headers is only iterable with \"DOM.Iterable\" in lib.\n      response.headers.forEach((value, key) => {\n        res.setHeader(key, value);\n      });\n\n      const buffer = response.body ? Buffer.from(await response.arrayBuffer()) : null;\n      res.end(buffer ?? undefined);\n    } catch (error) {\n      // Respond and swallow: a rethrow is an unhandled rejection under Express.\n      if (!res.headersSent) res.statusCode = error instanceof BodyTooLargeError ? 413 : 500;\n      res.end();\n      if (!(error instanceof BodyTooLargeError)) onError(error);\n    }\n  };\n}\n"]}
+{"version":3,"sources":["../src/core/handler.ts","../src/node/index.ts"],"names":[],"mappings":";;;AA+CO,IAAM,iBAAiB,EAAA,GAAK,IAAA;AA+BnB,IAAI,WAAA;;;ACjEpB,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAC,CAAA;AAEvC,SAAS,QAAA,CAAS,KAAsB,QAAA,EAA+C;AACrF,EAAA,IAAI,GAAA,CAAI,WAAW,KAAA,IAAS,GAAA,CAAI,WAAW,MAAA,EAAQ,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEnF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AACrD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,WAAW,QAAA,EAAU;AACpD,IAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,iBAAA,EAAmB,CAAA;AAAA,EAC/C;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAChC,MAAA,KAAA,IAAS,KAAA,CAAM,MAAA;AACf,MAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,QAAA,GAAA,CAAI,OAAA,EAAQ;AACZ,QAAA,MAAA,CAAO,IAAI,mBAAmB,CAAA;AAC9B,QAAA;AAAA,MACF;AACA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,EAAA,CAAG,KAAA,EAAO,MAAM,OAAA,CAAQ,MAAA,CAAO,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,GAAI,MAAS,CAAC,CAAA;AAC9E,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EACxB,CAAC,CAAA;AACH;AAEO,SAAS,YAAA,CAAa,GAAA,EAAsB,IAAA,EAAe,MAAA,EAA+B;AAE/F,EAAA,MAAM,QAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,mBAAmB,CAAA,IAA4B,MAAA;AAC7E,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,IAAA,IAAQ,WAAA;AAEjC,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAC5B,EAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AACtD,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,KAAA,MAAW,QAAQ,KAAA,EAAO,OAAA,CAAQ,MAAA,CAAO,GAAA,EAAK,IAAI,CAAA;AAAA,SACvE,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EAC7B;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,IAAI,CAAA,EAAG,GAAA,CAAI,GAAA,IAAO,GAAG,CAAA,CAAA,EAAI;AAAA,IAC3D,MAAA,EAAQ,IAAI,MAAA,IAAU,KAAA;AAAA,IACtB,OAAA;AAAA,IACA,GAAI,OAAO,EAAE,IAAA,EAAM,IAAI,UAAA,CAAW,IAAI,CAAA,EAAE,GAAI,EAAC;AAAA,IAC7C,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,GAC5B,CAAA;AACH;AAEO,SAAS,aAAA,CACd,OAAA,EACA,OAAA,GAA8B,EAAC,EAClB;AACb,EAAA,MAAM,YAAA,GAAe,QAAQ,YAAA,IAAgB,cAAA;AAC7C,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,KAAY,CAAC,UAAmB,OAAA,CAAQ,KAAA,CAAM,eAAe,KAAK,CAAA,CAAA;AAE1F,EAAA,OAAO,OAAO,KAAK,GAAA,KAAQ;AAEzB,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,GAAA,CAAI,EAAA,CAAG,OAAA,EAAS,MAAM,UAAA,CAAW,OAAO,CAAA;AAExC,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,GAAA,EAAK,YAAY,CAAA;AAC7C,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,YAAA,CAAa,KAAK,IAAA,EAAM,UAAA,CAAW,MAAM,CAAC,CAAA;AAEzE,MAAA,GAAA,CAAI,aAAa,QAAA,CAAS,MAAA;AAE1B,MAAA,QAAA,CAAS,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AACvC,QAAA,GAAA,CAAI,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC1B,CAAC,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,IAAA,EAAM;AAClB,QAAA,GAAA,CAAI,GAAA,EAAI;AACR,QAAA;AAAA,MACF;AAGA,MAAA,GAAA,CAAI,YAAA,EAAa;AACjB,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,MAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,EAAO,CAAE,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AACnD,MAAA,UAAA,CAAW,OAAO,gBAAA,CAAiB,OAAA,EAAS,QAAQ,EAAE,IAAA,EAAM,MAAM,CAAA;AAClE,MAAA,IAAI;AACF,QAAA,WAAS;AACP,UAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,UAAA,IAAI,IAAA,EAAM;AACV,UAAA,IAAI,CAAC,GAAA,CAAI,KAAA,CAAM,KAAK,GAAG,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,GAAA,CAAI,IAAA,CAAK,OAAA,EAAS,OAAO,CAAC,CAAA;AAAA,QAClF;AAAA,MACF,CAAA,SAAE;AACA,QAAA,UAAA,CAAW,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,MAAM,CAAA;AAAA,MACvD;AACA,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACV,SAAS,KAAA,EAAO;AAEd,MAAA,IAAI,CAAC,GAAA,CAAI,WAAA,MAAiB,UAAA,GAAa,KAAA,YAAiB,oBAAoB,GAAA,GAAM,GAAA;AAClF,MAAA,GAAA,CAAI,GAAA,EAAI;AACR,MAAA,IAAI,EAAE,KAAA,YAAiB,iBAAA,CAAA,EAAoB,OAAA,CAAQ,KAAK,CAAA;AAAA,IAC1D;AAAA,EACF,CAAA;AACF","file":"node.cjs","sourcesContent":["import type { DatabaseAdapter } from \"./adapter\";\nimport type { SessionConfig } from \"./config\";\nimport type { Logger } from \"./errors\";\nimport type { Promisable, RouteDefinition } from \"./plugin\";\nimport type { Runner } from \"./runner\";\nimport { inboxChannel, type Signals } from \"./signals\";\nimport { verifyToken } from \"./tokens\";\n\nexport type EventsSettings = {\n  heartbeatMs: number;\n  probeIntervalMs: number;\n  maxDurationMs: number;\n  maxStreamsPerUser: number;\n  maxStreams: number;\n};\n\n/** Unread chunks a stream may hold before it is closed on a consumer that stopped reading. */\nconst STREAM_HIGH_WATER_MARK = 256;\n\nexport type HandlerDeps = {\n  adapter: DatabaseAdapter;\n  session: SessionConfig;\n  runner: Runner;\n  logger: Logger;\n  basePath: string;\n  secret: string;\n  signals: Signals;\n  /** `false` unmounts GET /events. */\n  events: EventsSettings | false;\n  /** Fire-and-forget delivery pass after a request. Rate-limited by the instance. */\n  sweepOnRequest?: (() => void) | undefined;\n  cronSecret?: string | undefined;\n  /** Guards plugin machine routes. The instance defaults it to cronSecret. */\n  machineSecret?: string | undefined;\n  cronMaxSweeps?: number | undefined;\n  pluginRoutes?: readonly RouteDefinition[] | undefined;\n  /** Returns a 429 to send, or null to proceed. Runs after onRequest, before routing. */\n  rateLimit?: ((request: Request) => Response | null) | undefined;\n  /** Origins other than the request's own host that may POST. `*.example.com` allowed. */\n  trustedOrigins?: readonly string[] | undefined;\n  /** Runs before routing. Returning a Response short-circuits; use it for rate limiting. */\n  // biome-ignore lint/suspicious/noConfusingVoidType: a hook that returns nothing is the common case\n  onRequest?: ((request: Request) => Promisable<Response | undefined | void>) | undefined;\n  maxBodyBytes?: number | undefined;\n};\n\n/** Every JSON body is capped here. Nothing legitimate the routes accept is bigger. */\nexport const MAX_BODY_BYTES = 64 * 1024;\n\nconst MAX_READ_IDS = 200;\n\n// Per-user data: no shared caching, no sniffing.\nconst PRIVATE_HEADERS: Record<string, string> = {\n  \"cache-control\": \"private, no-store\",\n  \"x-content-type-options\": \"nosniff\",\n};\n\nconst json = (body: unknown, status = 200, headers: Record<string, string> = {}) =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { \"content-type\": \"application/json\", ...PRIVATE_HEADERS, ...headers },\n  });\n\nconst empty = (status: number) => new Response(null, { status, headers: PRIVATE_HEADERS });\n\n/** Plugin responses get the same headers, without touching their body. */\nfunction harden(response: Response): Response {\n  const headers = new Headers(response.headers);\n  for (const [name, value] of Object.entries(PRIVATE_HEADERS)) {\n    if (!headers.has(name)) headers.set(name, value);\n  }\n  return new Response(response.body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n  });\n}\n\nconst encoder = new TextEncoder();\n\n/** Constant time over SHA-256 digests, so neither content nor length leaks. Works on edge runtimes. */\nasync function timingSafeEqual(a: string, b: string): Promise<boolean> {\n  const [left, right] = await Promise.all(\n    [a, b].map(\n      async (value) => new Uint8Array(await crypto.subtle.digest(\"SHA-256\", encoder.encode(value))),\n    ),\n  );\n  let diff = 0;\n  for (let i = 0; i < 32; i += 1) diff |= (left?.[i] ?? 0) ^ (right?.[i] ?? 0);\n  return diff === 0;\n}\n\n/** Anchored at a segment boundary: `/foo/api/notifications/cron` is not a cron request. */\nfunction routePath(url: URL, basePath: string): string {\n  const { pathname } = url;\n  if (pathname === basePath) return \"/\";\n  if (pathname.startsWith(`${basePath}/`)) return pathname.slice(basePath.length);\n  return pathname;\n}\n\nexport type JsonBody = { body: Record<string, unknown> } | { error: Response };\n\n/** Reads a JSON object body with a streaming byte cap. Malformed JSON is 400; an empty body is `{}`. */\nexport async function readJsonBody(\n  request: Request,\n  maxBytes: number = MAX_BODY_BYTES,\n): Promise<JsonBody> {\n  const tooLarge = () => ({ error: json({ error: `body exceeds ${maxBytes} bytes` }, 413) });\n\n  const declared = Number(request.headers.get(\"content-length\"));\n  if (Number.isFinite(declared) && declared > maxBytes) return tooLarge();\n  if (!request.body) return { body: {} };\n\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    total += value.byteLength;\n    if (total > maxBytes) {\n      await reader.cancel();\n      return tooLarge();\n    }\n    chunks.push(value);\n  }\n\n  const bytes = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n\n  const text = new TextDecoder().decode(bytes);\n  if (text.trim() === \"\") return { body: {} };\n\n  try {\n    const parsed: unknown = JSON.parse(text);\n    return {\n      body:\n        parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n          ? (parsed as Record<string, unknown>)\n          : {},\n    };\n  } catch {\n    return { error: json({ error: \"body must be a JSON object\" }, 400) };\n  }\n}\n\nconst isJsonContentType = (request: Request) =>\n  /^application\\/json\\s*(;|$)/i.test((request.headers.get(\"content-type\") ?? \"\").trim());\n\nfunction originAllowed(origin: string, url: URL, request: Request, trusted: readonly string[]) {\n  let host: string;\n  try {\n    host = new URL(origin).host;\n  } catch {\n    return false;\n  }\n\n  if (host === url.host) return true;\n  // Behind a proxy that rewrites Host, the public host arrives here instead.\n  const forwarded = request.headers.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  if (forwarded && host === forwarded) return true;\n\n  return trusted.some((entry) =>\n    entry.startsWith(\"*.\") ? host.endsWith(entry.slice(1)) : entry === origin,\n  );\n}\n\n/** CSRF: a cross-site form can neither send `application/json` without a preflight nor forge `Origin`. */\nfunction csrfCheck(request: Request, url: URL, trusted: readonly string[]): Response | null {\n  if (!isJsonContentType(request)) {\n    return json({ error: \"content-type must be application/json\" }, 415);\n  }\n\n  const origin = request.headers.get(\"origin\");\n  if (origin === null) return null;\n  if (origin === \"null\" || !originAllowed(origin, url, request, trusted)) return empty(403);\n\n  return null;\n}\n\nexport function createHandler(deps: HandlerDeps) {\n  const trustedOrigins = deps.trustedOrigins ?? [];\n  const maxBodyBytes = deps.maxBodyBytes ?? MAX_BODY_BYTES;\n\n  async function resolveUserId(request: Request): Promise<string | null | \"error\"> {\n    try {\n      return await deps.session.getUserId(request);\n    } catch (error) {\n      // A broken session lookup is a 500, never a 401. RFC 0002 §1.\n      deps.logger.error(\"session.getUserId threw\", { error });\n      return \"error\";\n    }\n  }\n\n  async function bearerMatches(request: Request, secret: string | undefined): Promise<boolean> {\n    if (!secret) return false;\n    const header = request.headers.get(\"authorization\") ?? \"\";\n    const presented = header.startsWith(\"Bearer \") ? header.slice(7) : header;\n    return timingSafeEqual(presented, secret);\n  }\n\n  async function handleCron(request: Request): Promise<Response> {\n    if (!deps.cronSecret) return empty(404);\n    if (!(await bearerMatches(request, deps.cronSecret))) return empty(401);\n\n    // Bounded so an overlapping scheduler does not hold a request open for the whole backlog.\n    const result = await deps.runner.drain(\n      deps.cronMaxSweeps === undefined ? {} : { maxSweeps: deps.cronMaxSweeps },\n    );\n    return json(result);\n  }\n\n  /** Plugin routes first; auth is enforced here so a plugin cannot forget it. */\n  async function handlePluginRoute(\n    route: RouteDefinition,\n    request: Request,\n    url: URL,\n  ): Promise<Response> {\n    if (route.scope.type === \"user\") {\n      if (request.method === \"POST\") {\n        const rejected = csrfCheck(request, url, trustedOrigins);\n        if (rejected) return rejected;\n      }\n\n      const userId = await resolveUserId(request);\n      if (userId === \"error\") return empty(500);\n      if (userId === null) return empty(401);\n      return harden(await route.handler({ request, userId, claims: null, params: {} }));\n    }\n\n    if (route.scope.type === \"machine\") {\n      if (!deps.machineSecret) return empty(404);\n      if (!(await bearerMatches(request, deps.machineSecret))) return empty(401);\n      return harden(await route.handler({ request, userId: null, claims: null, params: {} }));\n    }\n\n    if (route.scope.type === \"signed\") {\n      const token =\n        url.searchParams.get(\"token\") ??\n        (request.headers.get(\"authorization\") ?? \"\").replace(/^Bearer /, \"\");\n\n      const claims = await verifyToken(deps.secret, token, route.scope.purpose);\n      // One response for every failure mode. RFC 0002 §5.\n      if (!claims) return empty(400);\n\n      return harden(await route.handler({ request, userId: claims.uid, claims, params: {} }));\n    }\n\n    return harden(await route.handler({ request, userId: null, claims: null, params: {} }));\n  }\n\n  async function route(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    const path = routePath(url, deps.basePath);\n\n    if (deps.onRequest) {\n      const early = await deps.onRequest(request);\n      if (early instanceof Response) return early;\n    }\n\n    if (deps.rateLimit) {\n      const limited = deps.rateLimit(request);\n      if (limited) return limited;\n    }\n\n    if (path === \"/cron\") {\n      if (request.method !== \"POST\") return empty(405);\n      return handleCron(request);\n    }\n\n    const pluginRoute = deps.pluginRoutes?.find(\n      (candidate) => candidate.path === path && candidate.method === request.method,\n    );\n    if (pluginRoute) return handlePluginRoute(pluginRoute, request, url);\n\n    if (request.method === \"POST\") {\n      const rejected = csrfCheck(request, url, trustedOrigins);\n      if (rejected) return rejected;\n    }\n\n    const userId = await resolveUserId(request);\n    if (userId === \"error\") return empty(500);\n    if (userId === null) return empty(401);\n\n    if (request.method === \"GET\" && path === \"/events\") {\n      if (!deps.events) return empty(404);\n      // A session can open streams for free; without a cap one account can hold every socket.\n      if ((openStreams.get(userId) ?? 0) >= deps.events.maxStreamsPerUser) {\n        return json({ error: \"too many open event streams\" }, 429, { \"retry-after\": \"30\" });\n      }\n      if (totalStreams >= deps.events.maxStreams) {\n        return json({ error: \"event streams unavailable\" }, 503, { \"retry-after\": \"30\" });\n      }\n      return events(request, userId, deps.events);\n    }\n\n    if (request.method === \"GET\" && path === \"/\") {\n      const limitParam = Number(url.searchParams.get(\"limit\") ?? 20);\n      const limit = Number.isFinite(limitParam) ? Math.min(Math.max(limitParam, 1), 100) : 20;\n      const cursor = url.searchParams.get(\"cursor\");\n\n      // unseenCount rides on the first page only: a cursor request is scrollback, not a poll.\n      const [page, unseenCount] = await Promise.all([\n        deps.adapter.listNotifications({\n          userId,\n          limit,\n          ...(cursor ? { cursor } : {}),\n          ...(url.searchParams.get(\"unreadOnly\") === \"true\" ? { unreadOnly: true } : {}),\n        }),\n        cursor ? Promise.resolve(null) : deps.adapter.countUnseen(userId),\n      ]);\n\n      return json(unseenCount === null ? page : { ...page, unseenCount });\n    }\n\n    if (request.method === \"GET\" && path === \"/count\") {\n      return json({ unseen: await deps.adapter.countUnseen(userId) });\n    }\n\n    if (request.method === \"POST\" && path === \"/seen\") {\n      const parsed = await readJsonBody(request, maxBodyBytes);\n      if (\"error\" in parsed) return parsed.error;\n      const before = typeof parsed.body.before === \"string\" ? new Date(parsed.body.before) : null;\n\n      // +1ms: Postgres keeps microseconds, an ISO string milliseconds; without it markSeen misses the newest row.\n      const cutoff =\n        before && !Number.isNaN(before.getTime()) ? new Date(before.getTime() + 1) : new Date();\n\n      await deps.adapter.markSeen(userId, cutoff);\n      deps.signals.publish(inboxChannel(userId));\n      return json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && path === \"/read\") {\n      const parsed = await readJsonBody(request, maxBodyBytes);\n      if (\"error\" in parsed) return parsed.error;\n      const ids = Array.isArray(parsed.body.ids)\n        ? parsed.body.ids.filter((id): id is string => typeof id === \"string\")\n        : [];\n      if (ids.length === 0) return json({ error: \"ids must be a non-empty string array\" }, 400);\n\n      if (ids.length > MAX_READ_IDS) {\n        return json({ error: `at most ${MAX_READ_IDS} ids per request` }, 400);\n      }\n\n      // 404, not 403: a 403 confirms the row exists. RFC 0002 §2.\n      const updated = await deps.adapter.markRead(userId, ids);\n      if (updated > 0) deps.signals.publish(inboxChannel(userId));\n      return updated === 0 ? empty(404) : json({ updated });\n    }\n\n    if (request.method === \"POST\" && path === \"/read-all\") {\n      const updated = await deps.adapter.markAllRead(userId);\n      if (updated > 0) deps.signals.publish(inboxChannel(userId));\n      return json({ updated });\n    }\n\n    return empty(404);\n  }\n\n  const openStreams = new Map<string, number>();\n  let totalStreams = 0;\n\n  const trackStream = (userId: string) => {\n    openStreams.set(userId, (openStreams.get(userId) ?? 0) + 1);\n    totalStreams += 1;\n    return () => {\n      const remaining = (openStreams.get(userId) ?? 1) - 1;\n      if (remaining > 0) openStreams.set(userId, remaining);\n      else openStreams.delete(userId);\n      totalStreams -= 1;\n    };\n  };\n\n  /** A change fingerprint cheap enough to take every probe interval. */\n  async function fingerprint(userId: string): Promise<string> {\n    const [page, unseen] = await Promise.all([\n      deps.adapter.listNotifications({ userId, limit: 1 }),\n      deps.adapter.countUnseen(userId),\n    ]);\n    const newest = page.notifications[0];\n    return `${newest?.id ?? \"\"}|${newest?.readAt ? 1 : 0}|${unseen}`;\n  }\n\n  // One probe per user, however many streams that user holds: N tabs must not mean N queries.\n  type Probe = { listeners: Set<() => void>; timer: ReturnType<typeof setInterval>; last?: string };\n  const probes = new Map<string, Probe>();\n\n  function subscribeProbe(userId: string, onChanged: () => void, intervalMs: number) {\n    let probe = probes.get(userId);\n    if (!probe) {\n      const created: Probe = {\n        listeners: new Set(),\n        timer: setInterval(() => {\n          fingerprint(userId)\n            .then((value) => {\n              if (created.last !== undefined && value !== created.last) {\n                for (const listener of created.listeners) listener();\n              }\n              created.last = value;\n            })\n            .catch((error) => deps.logger.error(\"events probe failed\", { error }));\n        }, intervalMs),\n      };\n      probe = created;\n      probes.set(userId, created);\n      fingerprint(userId)\n        .then((value) => {\n          if (created.last === undefined) created.last = value;\n        })\n        .catch(() => {});\n    }\n    probe.listeners.add(onChanged);\n    return () => {\n      const current = probes.get(userId);\n      if (!current) return;\n      current.listeners.delete(onChanged);\n      if (current.listeners.size === 0) {\n        clearInterval(current.timer);\n        probes.delete(userId);\n      }\n    };\n  }\n\n  /**\n   * Server-Sent Events: `ready` once, `changed` whenever this user's inbox\n   * moves, comments as keepalive. No payload ever travels on the stream; the\n   * client fetches the feed on `changed`. RFC 0006 §4D.\n   */\n  function events(request: Request, userId: string, settings: EventsSettings): Response {\n    const encoder = new TextEncoder();\n    const timers: ReturnType<typeof setInterval>[] = [];\n    const unsubscribes: (() => void)[] = [];\n    let closed = false;\n    let cleanup = () => {};\n\n    const stream = new ReadableStream<Uint8Array>(\n      {\n        start(controller) {\n          const write = (text: string) => {\n            if (closed) return;\n            // A consumer that stopped reading would make this queue grow without bound.\n            if (controller.desiredSize !== null && controller.desiredSize <= 0) {\n              cleanup();\n              return;\n            }\n            try {\n              controller.enqueue(encoder.encode(text));\n            } catch {\n              cleanup();\n            }\n          };\n          cleanup = () => {\n            if (closed) return;\n            closed = true;\n            for (const unsubscribe of unsubscribes) unsubscribe();\n            for (const timer of timers) clearInterval(timer);\n            try {\n              controller.close();\n            } catch {\n              // already closed by the consumer\n            }\n          };\n          const changed = () => write(\"event: changed\\ndata: {}\\n\\n\");\n\n          unsubscribes.push(trackStream(userId));\n          write(\"retry: 3000\\n\\nevent: ready\\ndata: {}\\n\\n\");\n          unsubscribes.push(deps.signals.subscribe(inboxChannel(userId), changed));\n          timers.push(setInterval(() => write(\": keepalive\\n\\n\"), settings.heartbeatMs));\n\n          if (!deps.signals.crossProcess && settings.probeIntervalMs > 0) {\n            unsubscribes.push(subscribeProbe(userId, changed, settings.probeIntervalMs));\n          }\n\n          if (settings.maxDurationMs > 0) {\n            timers.push(\n              setTimeout(cleanup, settings.maxDurationMs) as ReturnType<typeof setInterval>,\n            );\n          }\n          request.signal?.addEventListener(\"abort\", cleanup, { once: true });\n        },\n        cancel() {\n          cleanup();\n        },\n      },\n      { highWaterMark: STREAM_HIGH_WATER_MARK },\n    );\n\n    return new Response(stream, {\n      headers: {\n        \"content-type\": \"text/event-stream; charset=utf-8\",\n        \"cache-control\": \"no-cache, no-store\",\n        connection: \"keep-alive\",\n        \"x-accel-buffering\": \"no\",\n        \"x-content-type-options\": \"nosniff\",\n      },\n    });\n  }\n\n  async function handle(request: Request): Promise<Response> {\n    let response: Response | undefined;\n    try {\n      response = await route(request);\n      return response;\n    } catch (error) {\n      // A thrown driver error must not escape: unhandled rejection on Node, stack trace elsewhere.\n      deps.logger.error(\"request failed\", { url: request.url, error });\n      return empty(500);\n    } finally {\n      // Only a served request earns a sweep; anonymous 401s must not drive database work.\n      if (response && response.status < 400) deps.sweepOnRequest?.();\n    }\n  }\n\n  return {\n    handle,\n    GET: handle,\n    POST: handle,\n  };\n}\n","import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { MAX_BODY_BYTES } from \"../core/handler\";\n\n/** Adapts the web-standard handler to Node's http/Express signature. */\nexport type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;\n\nexport type NodeHandlerOptions = {\n  /** Defaults to 64 KiB. Enforced here because this reads the raw stream, bypassing body-parser. */\n  maxBodyBytes?: number;\n  /** Called when the handler itself throws. Defaults to console.error; the response is already a 500. */\n  onError?: (error: unknown) => void;\n};\n\nclass BodyTooLargeError extends Error {}\n\nfunction readBody(req: IncomingMessage, maxBytes: number): Promise<Buffer | undefined> {\n  if (req.method === \"GET\" || req.method === \"HEAD\") return Promise.resolve(undefined);\n\n  const declared = Number(req.headers[\"content-length\"]);\n  if (Number.isFinite(declared) && declared > maxBytes) {\n    return Promise.reject(new BodyTooLargeError());\n  }\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let total = 0;\n    req.on(\"data\", (chunk: Buffer) => {\n      total += chunk.length;\n      if (total > maxBytes) {\n        req.destroy();\n        reject(new BodyTooLargeError());\n        return;\n      }\n      chunks.push(chunk);\n    });\n    req.on(\"end\", () => resolve(chunks.length ? Buffer.concat(chunks) : undefined));\n    req.on(\"error\", reject);\n  });\n}\n\nexport function toWebRequest(req: IncomingMessage, body?: Buffer, signal?: AbortSignal): Request {\n  // Behind a load balancer this is the only signal that the site is https.\n  const protocol = (req.headers[\"x-forwarded-proto\"] as string | undefined) ?? \"http\";\n  const host = req.headers.host ?? \"localhost\";\n\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (value === undefined) continue;\n    if (Array.isArray(value)) for (const item of value) headers.append(key, item);\n    else headers.set(key, value);\n  }\n\n  return new Request(`${protocol}://${host}${req.url ?? \"/\"}`, {\n    method: req.method ?? \"GET\",\n    headers,\n    ...(body ? { body: new Uint8Array(body) } : {}),\n    ...(signal ? { signal } : {}),\n  });\n}\n\nexport function toNodeHandler(\n  handler: (request: Request) => Promise<Response>,\n  options: NodeHandlerOptions = {},\n): NodeHandler {\n  const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;\n  const onError = options.onError ?? ((error: unknown) => console.error(\"[easy-ping]\", error));\n\n  return async (req, res) => {\n    // A client that goes away aborts the request, so an open event stream cleans up.\n    const disconnect = new AbortController();\n    res.on(\"close\", () => disconnect.abort());\n\n    try {\n      const body = await readBody(req, maxBodyBytes);\n      const response = await handler(toWebRequest(req, body, disconnect.signal));\n\n      res.statusCode = response.status;\n      // forEach: Headers is only iterable with \"DOM.Iterable\" in lib.\n      response.headers.forEach((value, key) => {\n        res.setHeader(key, value);\n      });\n\n      if (!response.body) {\n        res.end();\n        return;\n      }\n\n      // Streamed, never buffered: GET /events stays open and every chunk must reach the client now.\n      res.flushHeaders();\n      const reader = response.body.getReader();\n      const cancel = () => reader.cancel().catch(() => {});\n      disconnect.signal.addEventListener(\"abort\", cancel, { once: true });\n      try {\n        for (;;) {\n          const { done, value } = await reader.read();\n          if (done) break;\n          if (!res.write(value)) await new Promise((resolve) => res.once(\"drain\", resolve));\n        }\n      } finally {\n        disconnect.signal.removeEventListener(\"abort\", cancel);\n      }\n      res.end();\n    } catch (error) {\n      // Respond and swallow: a rethrow is an unhandled rejection under Express.\n      if (!res.headersSent) res.statusCode = error instanceof BodyTooLargeError ? 413 : 500;\n      res.end();\n      if (!(error instanceof BodyTooLargeError)) onError(error);\n    }\n  };\n}\n"]}

package/dist/node.d.cts

@@ -8,7 +8,7 @@ type NodeHandlerOptions = {
     /** Called when the handler itself throws. Defaults to console.error; the response is already a 500. */
     onError?: (error: unknown) => void;
 };
-declare function toWebRequest(req: IncomingMessage, body?: Buffer): Request;
+declare function toWebRequest(req: IncomingMessage, body?: Buffer, signal?: AbortSignal): Request;
 declare function toNodeHandler(handler: (request: Request) => Promise<Response>, options?: NodeHandlerOptions): NodeHandler;
 
 export { type NodeHandler, type NodeHandlerOptions, toNodeHandler, toWebRequest };

package/dist/node.d.ts

@@ -8,7 +8,7 @@ type NodeHandlerOptions = {
     /** Called when the handler itself throws. Defaults to console.error; the response is already a 500. */
     onError?: (error: unknown) => void;
 };
-declare function toWebRequest(req: IncomingMessage, body?: Buffer): Request;
+declare function toWebRequest(req: IncomingMessage, body?: Buffer, signal?: AbortSignal): Request;
 declare function toNodeHandler(handler: (request: Request) => Promise<Response>, options?: NodeHandlerOptions): NodeHandler;
 
 export { type NodeHandler, type NodeHandlerOptions, toNodeHandler, toWebRequest };

package/dist/node.js

@@ -1,4 +1,5 @@
-import { MAX_BODY_BYTES } from './chunk-BECMTNK7.js';
+import { MAX_BODY_BYTES } from './chunk-JOVIZXO6.js';
+import './chunk-ORZKH224.js';
 import './chunk-PTGHMCCG.js';
 
 // src/node/index.ts
@@ -26,7 +27,7 @@ function readBody(req, maxBytes) {
     req.on("error", reject);
   });
 }
-function toWebRequest(req, body) {
+function toWebRequest(req, body, signal) {
   const protocol = req.headers["x-forwarded-proto"] ?? "http";
   const host = req.headers.host ?? "localhost";
   const headers = new Headers();
@@ -38,21 +39,42 @@ function toWebRequest(req, body) {
   return new Request(`${protocol}://${host}${req.url ?? "/"}`, {
     method: req.method ?? "GET",
     headers,
-    ...body ? { body: new Uint8Array(body) } : {}
+    ...body ? { body: new Uint8Array(body) } : {},
+    ...signal ? { signal } : {}
   });
 }
 function toNodeHandler(handler, options = {}) {
   const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;
   const onError = options.onError ?? ((error) => console.error("[easy-ping]", error));
   return async (req, res) => {
+    const disconnect = new AbortController();
+    res.on("close", () => disconnect.abort());
     try {
-      const response = await handler(toWebRequest(req, await readBody(req, maxBodyBytes)));
+      const body = await readBody(req, maxBodyBytes);
+      const response = await handler(toWebRequest(req, body, disconnect.signal));
       res.statusCode = response.status;
       response.headers.forEach((value, key) => {
         res.setHeader(key, value);
       });
-      const buffer = response.body ? Buffer.from(await response.arrayBuffer()) : null;
-      res.end(buffer ?? void 0);
+      if (!response.body) {
+        res.end();
+        return;
+      }
+      res.flushHeaders();
+      const reader = response.body.getReader();
+      const cancel = () => reader.cancel().catch(() => {
+      });
+      disconnect.signal.addEventListener("abort", cancel, { once: true });
+      try {
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          if (!res.write(value)) await new Promise((resolve) => res.once("drain", resolve));
+        }
+      } finally {
+        disconnect.signal.removeEventListener("abort", cancel);
+      }
+      res.end();
     } catch (error) {
       if (!res.headersSent) res.statusCode = error instanceof BodyTooLargeError ? 413 : 500;
       res.end();

package/dist/node.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/node/index.ts"],"names":[],"mappings":";;;;AAaA,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAC,CAAA;AAEvC,SAAS,QAAA,CAAS,KAAsB,QAAA,EAA+C;AACrF,EAAA,IAAI,GAAA,CAAI,WAAW,KAAA,IAAS,GAAA,CAAI,WAAW,MAAA,EAAQ,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEnF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AACrD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,WAAW,QAAA,EAAU;AACpD,IAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,iBAAA,EAAmB,CAAA;AAAA,EAC/C;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAChC,MAAA,KAAA,IAAS,KAAA,CAAM,MAAA;AACf,MAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,QAAA,GAAA,CAAI,OAAA,EAAQ;AACZ,QAAA,MAAA,CAAO,IAAI,mBAAmB,CAAA;AAC9B,QAAA;AAAA,MACF;AACA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,EAAA,CAAG,KAAA,EAAO,MAAM,OAAA,CAAQ,MAAA,CAAO,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,GAAI,MAAS,CAAC,CAAA;AAC9E,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EACxB,CAAC,CAAA;AACH;AAEO,SAAS,YAAA,CAAa,KAAsB,IAAA,EAAwB;AAEzE,EAAA,MAAM,QAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,mBAAmB,CAAA,IAA4B,MAAA;AAC7E,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,IAAA,IAAQ,WAAA;AAEjC,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAC5B,EAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AACtD,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,KAAA,MAAW,QAAQ,KAAA,EAAO,OAAA,CAAQ,MAAA,CAAO,GAAA,EAAK,IAAI,CAAA;AAAA,SACvE,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EAC7B;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,IAAI,CAAA,EAAG,GAAA,CAAI,GAAA,IAAO,GAAG,CAAA,CAAA,EAAI;AAAA,IAC3D,MAAA,EAAQ,IAAI,MAAA,IAAU,KAAA;AAAA,IACtB,OAAA;AAAA,IACA,GAAI,OAAO,EAAE,IAAA,EAAM,IAAI,UAAA,CAAW,IAAI,CAAA,EAAE,GAAI;AAAC,GAC9C,CAAA;AACH;AAEO,SAAS,aAAA,CACd,OAAA,EACA,OAAA,GAA8B,EAAC,EAClB;AACb,EAAA,MAAM,YAAA,GAAe,QAAQ,YAAA,IAAgB,cAAA;AAC7C,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,KAAY,CAAC,UAAmB,OAAA,CAAQ,KAAA,CAAM,eAAe,KAAK,CAAA,CAAA;AAE1F,EAAA,OAAO,OAAO,KAAK,GAAA,KAAQ;AACzB,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,YAAA,CAAa,GAAA,EAAK,MAAM,QAAA,CAAS,GAAA,EAAK,YAAY,CAAC,CAAC,CAAA;AAEnF,MAAA,GAAA,CAAI,aAAa,QAAA,CAAS,MAAA;AAE1B,MAAA,QAAA,CAAS,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AACvC,QAAA,GAAA,CAAI,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC1B,CAAC,CAAA;AAED,MAAA,MAAM,MAAA,GAAS,SAAS,IAAA,GAAO,MAAA,CAAO,KAAK,MAAM,QAAA,CAAS,WAAA,EAAa,CAAA,GAAI,IAAA;AAC3E,MAAA,GAAA,CAAI,GAAA,CAAI,UAAU,KAAA,CAAS,CAAA;AAAA,IAC7B,SAAS,KAAA,EAAO;AAEd,MAAA,IAAI,CAAC,GAAA,CAAI,WAAA,MAAiB,UAAA,GAAa,KAAA,YAAiB,oBAAoB,GAAA,GAAM,GAAA;AAClF,MAAA,GAAA,CAAI,GAAA,EAAI;AACR,MAAA,IAAI,EAAE,KAAA,YAAiB,iBAAA,CAAA,EAAoB,OAAA,CAAQ,KAAK,CAAA;AAAA,IAC1D;AAAA,EACF,CAAA;AACF","file":"node.js","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { MAX_BODY_BYTES } from \"../core/handler\";\n\n/** Adapts the web-standard handler to Node's http/Express signature. */\nexport type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;\n\nexport type NodeHandlerOptions = {\n  /** Defaults to 64 KiB. Enforced here because this reads the raw stream, bypassing body-parser. */\n  maxBodyBytes?: number;\n  /** Called when the handler itself throws. Defaults to console.error; the response is already a 500. */\n  onError?: (error: unknown) => void;\n};\n\nclass BodyTooLargeError extends Error {}\n\nfunction readBody(req: IncomingMessage, maxBytes: number): Promise<Buffer | undefined> {\n  if (req.method === \"GET\" || req.method === \"HEAD\") return Promise.resolve(undefined);\n\n  const declared = Number(req.headers[\"content-length\"]);\n  if (Number.isFinite(declared) && declared > maxBytes) {\n    return Promise.reject(new BodyTooLargeError());\n  }\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let total = 0;\n    req.on(\"data\", (chunk: Buffer) => {\n      total += chunk.length;\n      if (total > maxBytes) {\n        req.destroy();\n        reject(new BodyTooLargeError());\n        return;\n      }\n      chunks.push(chunk);\n    });\n    req.on(\"end\", () => resolve(chunks.length ? Buffer.concat(chunks) : undefined));\n    req.on(\"error\", reject);\n  });\n}\n\nexport function toWebRequest(req: IncomingMessage, body?: Buffer): Request {\n  // Behind a load balancer this is the only signal that the site is https.\n  const protocol = (req.headers[\"x-forwarded-proto\"] as string | undefined) ?? \"http\";\n  const host = req.headers.host ?? \"localhost\";\n\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (value === undefined) continue;\n    if (Array.isArray(value)) for (const item of value) headers.append(key, item);\n    else headers.set(key, value);\n  }\n\n  return new Request(`${protocol}://${host}${req.url ?? \"/\"}`, {\n    method: req.method ?? \"GET\",\n    headers,\n    ...(body ? { body: new Uint8Array(body) } : {}),\n  });\n}\n\nexport function toNodeHandler(\n  handler: (request: Request) => Promise<Response>,\n  options: NodeHandlerOptions = {},\n): NodeHandler {\n  const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;\n  const onError = options.onError ?? ((error: unknown) => console.error(\"[easy-ping]\", error));\n\n  return async (req, res) => {\n    try {\n      const response = await handler(toWebRequest(req, await readBody(req, maxBodyBytes)));\n\n      res.statusCode = response.status;\n      // forEach: Headers is only iterable with \"DOM.Iterable\" in lib.\n      response.headers.forEach((value, key) => {\n        res.setHeader(key, value);\n      });\n\n      const buffer = response.body ? Buffer.from(await response.arrayBuffer()) : null;\n      res.end(buffer ?? undefined);\n    } catch (error) {\n      // Respond and swallow: a rethrow is an unhandled rejection under Express.\n      if (!res.headersSent) res.statusCode = error instanceof BodyTooLargeError ? 413 : 500;\n      res.end();\n      if (!(error instanceof BodyTooLargeError)) onError(error);\n    }\n  };\n}\n"]}
+{"version":3,"sources":["../src/node/index.ts"],"names":[],"mappings":";;;;;AAaA,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAC,CAAA;AAEvC,SAAS,QAAA,CAAS,KAAsB,QAAA,EAA+C;AACrF,EAAA,IAAI,GAAA,CAAI,WAAW,KAAA,IAAS,GAAA,CAAI,WAAW,MAAA,EAAQ,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEnF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,GAAA,CAAI,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AACrD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,QAAQ,CAAA,IAAK,WAAW,QAAA,EAAU;AACpD,IAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,iBAAA,EAAmB,CAAA;AAAA,EAC/C;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAChC,MAAA,KAAA,IAAS,KAAA,CAAM,MAAA;AACf,MAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,QAAA,GAAA,CAAI,OAAA,EAAQ;AACZ,QAAA,MAAA,CAAO,IAAI,mBAAmB,CAAA;AAC9B,QAAA;AAAA,MACF;AACA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,GAAA,CAAI,EAAA,CAAG,KAAA,EAAO,MAAM,OAAA,CAAQ,MAAA,CAAO,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,GAAI,MAAS,CAAC,CAAA;AAC9E,IAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EACxB,CAAC,CAAA;AACH;AAEO,SAAS,YAAA,CAAa,GAAA,EAAsB,IAAA,EAAe,MAAA,EAA+B;AAE/F,EAAA,MAAM,QAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,mBAAmB,CAAA,IAA4B,MAAA;AAC7E,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,IAAA,IAAQ,WAAA;AAEjC,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAC5B,EAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AACtD,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,KAAA,MAAW,QAAQ,KAAA,EAAO,OAAA,CAAQ,MAAA,CAAO,GAAA,EAAK,IAAI,CAAA;AAAA,SACvE,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,EAC7B;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAA,EAAG,QAAQ,CAAA,GAAA,EAAM,IAAI,CAAA,EAAG,GAAA,CAAI,GAAA,IAAO,GAAG,CAAA,CAAA,EAAI;AAAA,IAC3D,MAAA,EAAQ,IAAI,MAAA,IAAU,KAAA;AAAA,IACtB,OAAA;AAAA,IACA,GAAI,OAAO,EAAE,IAAA,EAAM,IAAI,UAAA,CAAW,IAAI,CAAA,EAAE,GAAI,EAAC;AAAA,IAC7C,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,GAC5B,CAAA;AACH;AAEO,SAAS,aAAA,CACd,OAAA,EACA,OAAA,GAA8B,EAAC,EAClB;AACb,EAAA,MAAM,YAAA,GAAe,QAAQ,YAAA,IAAgB,cAAA;AAC7C,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,KAAY,CAAC,UAAmB,OAAA,CAAQ,KAAA,CAAM,eAAe,KAAK,CAAA,CAAA;AAE1F,EAAA,OAAO,OAAO,KAAK,GAAA,KAAQ;AAEzB,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,GAAA,CAAI,EAAA,CAAG,OAAA,EAAS,MAAM,UAAA,CAAW,OAAO,CAAA;AAExC,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,GAAA,EAAK,YAAY,CAAA;AAC7C,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,YAAA,CAAa,KAAK,IAAA,EAAM,UAAA,CAAW,MAAM,CAAC,CAAA;AAEzE,MAAA,GAAA,CAAI,aAAa,QAAA,CAAS,MAAA;AAE1B,MAAA,QAAA,CAAS,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAA,EAAO,GAAA,KAAQ;AACvC,QAAA,GAAA,CAAI,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC1B,CAAC,CAAA;AAED,MAAA,IAAI,CAAC,SAAS,IAAA,EAAM;AAClB,QAAA,GAAA,CAAI,GAAA,EAAI;AACR,QAAA;AAAA,MACF;AAGA,MAAA,GAAA,CAAI,YAAA,EAAa;AACjB,MAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,SAAA,EAAU;AACvC,MAAA,MAAM,SAAS,MAAM,MAAA,CAAO,MAAA,EAAO,CAAE,MAAM,MAAM;AAAA,MAAC,CAAC,CAAA;AACnD,MAAA,UAAA,CAAW,OAAO,gBAAA,CAAiB,OAAA,EAAS,QAAQ,EAAE,IAAA,EAAM,MAAM,CAAA;AAClE,MAAA,IAAI;AACF,QAAA,WAAS;AACP,UAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,UAAA,IAAI,IAAA,EAAM;AACV,UAAA,IAAI,CAAC,GAAA,CAAI,KAAA,CAAM,KAAK,GAAG,MAAM,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,GAAA,CAAI,IAAA,CAAK,OAAA,EAAS,OAAO,CAAC,CAAA;AAAA,QAClF;AAAA,MACF,CAAA,SAAE;AACA,QAAA,UAAA,CAAW,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,MAAM,CAAA;AAAA,MACvD;AACA,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACV,SAAS,KAAA,EAAO;AAEd,MAAA,IAAI,CAAC,GAAA,CAAI,WAAA,MAAiB,UAAA,GAAa,KAAA,YAAiB,oBAAoB,GAAA,GAAM,GAAA;AAClF,MAAA,GAAA,CAAI,GAAA,EAAI;AACR,MAAA,IAAI,EAAE,KAAA,YAAiB,iBAAA,CAAA,EAAoB,OAAA,CAAQ,KAAK,CAAA;AAAA,IAC1D;AAAA,EACF,CAAA;AACF","file":"node.js","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { MAX_BODY_BYTES } from \"../core/handler\";\n\n/** Adapts the web-standard handler to Node's http/Express signature. */\nexport type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;\n\nexport type NodeHandlerOptions = {\n  /** Defaults to 64 KiB. Enforced here because this reads the raw stream, bypassing body-parser. */\n  maxBodyBytes?: number;\n  /** Called when the handler itself throws. Defaults to console.error; the response is already a 500. */\n  onError?: (error: unknown) => void;\n};\n\nclass BodyTooLargeError extends Error {}\n\nfunction readBody(req: IncomingMessage, maxBytes: number): Promise<Buffer | undefined> {\n  if (req.method === \"GET\" || req.method === \"HEAD\") return Promise.resolve(undefined);\n\n  const declared = Number(req.headers[\"content-length\"]);\n  if (Number.isFinite(declared) && declared > maxBytes) {\n    return Promise.reject(new BodyTooLargeError());\n  }\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let total = 0;\n    req.on(\"data\", (chunk: Buffer) => {\n      total += chunk.length;\n      if (total > maxBytes) {\n        req.destroy();\n        reject(new BodyTooLargeError());\n        return;\n      }\n      chunks.push(chunk);\n    });\n    req.on(\"end\", () => resolve(chunks.length ? Buffer.concat(chunks) : undefined));\n    req.on(\"error\", reject);\n  });\n}\n\nexport function toWebRequest(req: IncomingMessage, body?: Buffer, signal?: AbortSignal): Request {\n  // Behind a load balancer this is the only signal that the site is https.\n  const protocol = (req.headers[\"x-forwarded-proto\"] as string | undefined) ?? \"http\";\n  const host = req.headers.host ?? \"localhost\";\n\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (value === undefined) continue;\n    if (Array.isArray(value)) for (const item of value) headers.append(key, item);\n    else headers.set(key, value);\n  }\n\n  return new Request(`${protocol}://${host}${req.url ?? \"/\"}`, {\n    method: req.method ?? \"GET\",\n    headers,\n    ...(body ? { body: new Uint8Array(body) } : {}),\n    ...(signal ? { signal } : {}),\n  });\n}\n\nexport function toNodeHandler(\n  handler: (request: Request) => Promise<Response>,\n  options: NodeHandlerOptions = {},\n): NodeHandler {\n  const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;\n  const onError = options.onError ?? ((error: unknown) => console.error(\"[easy-ping]\", error));\n\n  return async (req, res) => {\n    // A client that goes away aborts the request, so an open event stream cleans up.\n    const disconnect = new AbortController();\n    res.on(\"close\", () => disconnect.abort());\n\n    try {\n      const body = await readBody(req, maxBodyBytes);\n      const response = await handler(toWebRequest(req, body, disconnect.signal));\n\n      res.statusCode = response.status;\n      // forEach: Headers is only iterable with \"DOM.Iterable\" in lib.\n      response.headers.forEach((value, key) => {\n        res.setHeader(key, value);\n      });\n\n      if (!response.body) {\n        res.end();\n        return;\n      }\n\n      // Streamed, never buffered: GET /events stays open and every chunk must reach the client now.\n      res.flushHeaders();\n      const reader = response.body.getReader();\n      const cancel = () => reader.cancel().catch(() => {});\n      disconnect.signal.addEventListener(\"abort\", cancel, { once: true });\n      try {\n        for (;;) {\n          const { done, value } = await reader.read();\n          if (done) break;\n          if (!res.write(value)) await new Promise((resolve) => res.once(\"drain\", resolve));\n        }\n      } finally {\n        disconnect.signal.removeEventListener(\"abort\", cancel);\n      }\n      res.end();\n    } catch (error) {\n      // Respond and swallow: a rethrow is an unhandled rejection under Express.\n      if (!res.headersSent) res.statusCode = error instanceof BodyTooLargeError ? 413 : 500;\n      res.end();\n      if (!(error instanceof BodyTooLargeError)) onError(error);\n    }\n  };\n}\n"]}

package/dist/plugins/preferences.cjs

@@ -43,9 +43,9 @@ var PRIVATE_HEADERS = {
   "cache-control": "private, no-store",
   "x-content-type-options": "nosniff"
 };
-var json = (body, status = 200) => new Response(JSON.stringify(body), {
+var json = (body, status = 200, headers = {}) => new Response(JSON.stringify(body), {
   status,
-  headers: { "content-type": "application/json", ...PRIVATE_HEADERS }
+  headers: { "content-type": "application/json", ...PRIVATE_HEADERS, ...headers }
 });
 new TextEncoder();
 async function readJsonBody(request, maxBytes = MAX_BODY_BYTES) {

package/dist/plugins/preferences.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/base64url.ts","../../src/core/tokens.ts","../../src/core/handler.ts","../../src/plugins/preferences/index.ts"],"names":[],"mappings":";;;AAEO,SAAS,gBAAgB,KAAA,EAAoC;AAClE,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,KAAU,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA,GAAI,KAAA;AAC5E,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;;;ACQA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAGhC,IAAM,QAAA,GAAW,OAAA,CAAQ,MAAA,CAAO,qBAAqB,CAAA;AAGrD,eAAe,OAAA,CAAQ,QAAgB,OAAA,EAAqC;AAC1E,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,EAAG,MAAA,EAAQ,KAAA,EAAO;AAAA,IACzF;AAAA,GACD,CAAA;AACD,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,IACnB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA,EAAE;AAAA,IAC/E,MAAA;AAAA,IACA,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAW,QAAQ,GAAA,EAAI;AAAA,IAC7C,KAAA;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,GACnB;AACF;AAEA,eAAsB,UACpB,MAAA,EACA,MAAA,EACA,GAAA,mBAAY,IAAI,MAAK,EACJ;AACjB,EAAA,MAAM,OAAA,GAAuB,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAK,MAAA,CAAO,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,OAAA,EAAQ,GAAI,GAAI,CAAA,EAAE;AAC9F,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AACpD,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA;AAAA,IACpC,MAAA;AAAA,IACA,MAAM,OAAA,CAAQ,MAAA,EAAQ,MAAA,CAAO,OAAO,CAAA;AAAA,IACpC,OAAA,CAAQ,OAAO,IAAI;AAAA,GACrB;AACA,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,eAAA,CAAgB,IAAI,UAAA,CAAW,SAAS,CAAC,CAAC,CAAA,CAAA;AAC9D;AAoDO,IAAM,yBAAA,GAA4B,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAEjD,IAAM,qBAAA,GAAwB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAE7C,IAAM,SAAA,GAAY,CAAC,OAAA,EAAiB,GAAA,uBAAgB,IAAA,EAAK,KAC9D,KAAK,KAAA,CAAM,GAAA,CAAI,SAAQ,GAAI,GAAI,IAAI,IAAA,CAAK,GAAA,CAAI,KAAK,GAAA,CAAI,OAAA,EAAS,CAAC,CAAA,EAAG,qBAAqB,CAAA;;;AC1ElF,IAAM,iBAAiB,EAAA,GAAK,IAAA;AAKnC,IAAM,eAAA,GAA0C;AAAA,EAC9C,eAAA,EAAiB,mBAAA;AAAA,EACjB,wBAAA,EAA0B;AAC5B,CAAA;AAEA,IAAM,IAAA,GAAO,CAAC,IAAA,EAAe,MAAA,GAAS,GAAA,KACpC,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AAAA,EACjC,MAAA;AAAA,EACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,GAAG,eAAA;AACpD,CAAC,CAAA;AAiBa,IAAI,WAAA;AAyBpB,eAAsB,YAAA,CACpB,OAAA,EACA,QAAA,GAAmB,cAAA,EACA;AACnB,EAAA,MAAM,QAAA,GAAW,OAAO,EAAE,KAAA,EAAO,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,aAAA,EAAgB,QAAQ,CAAA,MAAA,CAAA,EAAS,EAAG,GAAG,CAAA,EAAE,CAAA;AAExF,EAAA,MAAM,WAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAC,CAAA;AAC7D,EAAA,IAAI,OAAO,QAAA,CAAS,QAAQ,KAAK,QAAA,GAAW,QAAA,SAAiB,QAAA,EAAS;AACtE,EAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,SAAa,EAAE,IAAA,EAAM,EAAC,EAAE;AAErC,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,IAAA,CAAK,SAAA,EAAU;AACtC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,WAAS;AACP,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,IAAA,IAAI,IAAA,EAAM;AACV,IAAA,KAAA,IAAS,KAAA,CAAM,UAAA;AACf,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,OAAO,MAAA,EAAO;AACpB,MAAA,OAAO,QAAA,EAAS;AAAA,IAClB;AACA,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,EACnB;AAEA,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,KAAK,CAAA;AAClC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,KAAA,CAAM,GAAA,CAAI,OAAO,MAAM,CAAA;AACvB,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAClB;AAEA,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,KAAK,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,MAAK,KAAM,EAAA,SAAW,EAAE,IAAA,EAAM,EAAC,EAAE;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AACvC,IAAA,OAAO;AAAA,MACL,IAAA,EACE,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GACxD,MAAA,GACD;AAAC,KACT;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,OAAO,IAAA,CAAK,EAAE,OAAO,4BAAA,EAA6B,EAAG,GAAG,CAAA,EAAE;AAAA,EACrE;AACF;;;ACzHO,IAAM,mBAAA,GAAsB;AAEnC,IAAM,KAAA,GAAQ,yBAAA;AAEd,IAAM,WAA+B,CAAC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC9E,IAAM,WAAA,GAAoC,CAAC,SAAA,EAAW,OAAA,EAAS,UAAU,KAAK,CAAA;AAE9E,IAAM,SAAA,GAAY,CAAC,KAAA,KAAqC,QAAA,CAAS,SAAS,KAAgB,CAAA;AAC1F,IAAM,WAAA,GAAc,CAAC,KAAA,KACnB,WAAA,CAAY,SAAS,KAAkB,CAAA;AAoBzC,IAAM,GAAA,GAAM,CAAC,MAAA,EAAgB,IAAA,EAAc,OAAA,KAAoB,GAAG,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAIpF,SAAS,sBACd,MAAA,EACA,MAAA,EACA,IAAA,EACA,OAAA,EACA,aAAa,yBAAA,EACI;AACjB,EAAA,OAAO,UAAU,MAAA,EAAQ;AAAA,IACvB,GAAA,EAAK,MAAA;AAAA,IACL,OAAA,EAAS,mBAAA;AAAA,IACT,GAAA,EAAK,UAAU,UAAU,CAAA;AAAA,IACzB,IAAA,EAAM,EAAE,IAAA,EAAM,OAAA;AAAQ,GACvB,CAAA;AACH;AAEO,SAAS,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAkC;AAC3F,EAAA,MAAM,cAAA,GAAiB,QAAQ,cAAA,IAAkB,IAAA;AACjD,EAAA,MAAM,aAAa,IAAI,GAAA,CAAI,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAA;AAGnD,EAAA,IAAI,GAAA;AAEJ,EAAA,MAAM,SAAA,GAAY,CAAC,MAAA,EAAgB,IAAA,EAAc,SAAkB,IAAA,KAA8B;AAC/F,IAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,IAAI,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAC,CAAA;AAC/C,IAAA,OAAO,GAAA,GAAM,GAAA,CAAI,OAAA,IAAW,GAAA,CAAI,cAAc,KAAA,GAAQ,cAAA;AAAA,EACxD,CAAA;AAEA,EAAA,MAAM,OAAO,CAAC,OAAA,KACZ,GAAA,CAAI,KAAA,CAAM,KAAoB,KAAA,EAAO,EAAE,MAAA,EAAQ,EAAE,IAAI,CAAC,GAAG,OAAO,CAAA,IAAK,CAAA;AAEvE,EAAA,MAAM,OAAO,CAAC,GAAA,KACZ,GAAA,CAAI,KAAA,CAAM,OAAO,KAAA,EAAO,CAAC,EAAE,GAAG,KAAK,SAAA,kBAAW,IAAI,IAAA,EAAK,EAAG,CAAA,EAAG;AAAA,IAC3D,UAAA,EAAY,CAAC,QAAA,EAAU,MAAA,EAAQ,SAAS;AAAA,GACzC,CAAA;AAEH,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,aAAA;AAAA,IAEJ,IAAA,EAAM,CAAC,OAAA,KAAY;AACjB,MAAA,GAAA,GAAM,OAAA;AAAA,IACR,CAAA;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN,sBAAA,EAAwB;AAAA,QACtB,SAAA,EAAW,KAAA;AAAA,QACX,MAAA,EAAQ;AAAA,UACN,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UACzC,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UACvC,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UAC1C,SAAS,EAAE,IAAA,EAAM,WAAW,QAAA,EAAU,IAAA,EAAM,SAAS,IAAA,EAAK;AAAA,UAC1D,WAAW,EAAE,IAAA,EAAM,UAAU,QAAA,EAAU,IAAA,EAAM,SAAS,SAAA,EAAU;AAAA,UAChE,WAAW,EAAE,IAAA,EAAM,QAAQ,QAAA,EAAU,IAAA,EAAM,YAAY,IAAA;AAAK,SAC9D;AAAA,QACA,UAAA,EAAY,CAAC,QAAA,EAAU,MAAA,EAAQ,SAAS;AAAA;AAC1C,KACF;AAAA,IAEA,KAAA,EAAO;AAAA;AAAA,MAEL,OAAA,EAAS,OAAO,OAAA,KAA0D;AACxE,QAAA,IAAI,WAAW,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG,2BAAW,GAAA,EAAI;AAEjD,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAC,SAAA,KAAc,SAAA,CAAU,MAAM,CAAC,CAAA;AAC/E,QAAA,OAAO,IAAI,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,CAAC,QAAQ,CAAC,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,IAAI,IAAA,EAAM,GAAA,CAAI,OAAO,CAAA,EAAG,GAAG,CAAC,CAAC,CAAA;AAAA,MACjF,CAAA;AAAA,MAEA,eAAA,EAAiB,CAAC,OAAA,KAAoC;AACpD,QAAA,IAAI,WAAW,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,SAAU,OAAA,CAAQ,SAAA;AAGjD,QAAA,IAAI,EAAE,OAAA,CAAQ,QAAA,YAAoB,GAAA,CAAA,EAAM;AACtC,UAAA,OAAO,OAAA,CAAQ,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,MAAc,EAAE,GAAG,QAAA,EAAU,MAAA,EAAQ,MAAA,EAAgB,CAAE,CAAA;AAAA,QACvF;AAEA,QAAA,MAAM,OAAO,OAAA,CAAQ,QAAA;AAErB,QAAA,OAAO,QAAQ,SAAA,CAAU,GAAA;AAAA,UAAqB,CAAC,QAAA,KAC7C,SAAA,CAAU,OAAA,CAAQ,SAAA,CAAU,QAAQ,OAAA,CAAQ,IAAA,EAAM,QAAA,CAAS,OAAA,EAAS,IAAI,CAAA,GACpE,QAAA,GACA,EAAE,GAAG,QAAA,EAAU,QAAQ,MAAA;AAAO,SACpC;AAAA,MACF;AAAA,KACF;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,KAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,QACtB,OAAA,EAAS,OAAO,EAAE,MAAA,EAAO,KAAM;AAC7B,UAAA,MAAM,OAAO,MAAM,IAAA,CAAK,CAAC,MAAA,IAAU,EAAE,CAAC,CAAA;AACtC,UAAA,OAAO,SAAS,IAAA,CAAK,EAAE,WAAA,EAAa,IAAA,EAAM,gBAAgB,CAAA;AAAA,QAC5D;AAAA,OACF;AAAA,MAEA;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,MAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,QACtB,OAAA,EAAS,OAAO,EAAE,OAAA,EAAS,QAAO,KAAM;AACtC,UAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAO,CAAA;AACzC,UAAA,IAAI,OAAA,IAAW,MAAA,EAAQ,OAAO,MAAA,CAAO,KAAA;AACrC,UAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AAEpB,UAAA,MAAM,GAAA,GAAM,CAAC,KAAA,KAAkB,QAAA,CAAS,IAAA,CAAK,EAAE,KAAA,EAAM,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAGvE,UAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,IAAY,CAAC,IAAI,iBAAA,CAAkB,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,EAAG;AAC/E,YAAA,OAAO,IAAI,6CAA6C,CAAA;AAAA,UAC1D;AACA,UAAA,IAAI,CAAC,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,GAAA,CAAI,CAAA,uBAAA,EAA0B,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AACxF,UAAA,IAAI,KAAK,OAAA,KAAY,MAAA,IAAa,OAAO,IAAA,CAAK,YAAY,SAAA,EAAW;AACnE,YAAA,OAAO,IAAI,2BAA2B,CAAA;AAAA,UACxC;AACA,UAAA,IAAI,KAAK,SAAA,KAAc,MAAA,IAAa,CAAC,WAAA,CAAY,IAAA,CAAK,SAAS,CAAA,EAAG;AAChE,YAAA,OAAO,IAAI,CAAA,yBAAA,EAA4B,WAAA,CAAY,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,UACjE;AAGA,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,QAAQ,MAAA,IAAU,EAAA;AAAA,YAClB,MAAM,IAAA,CAAK,IAAA;AAAA,YACX,SAAS,IAAA,CAAK,OAAA;AAAA,YACd,OAAA,EAAS,KAAK,OAAA,IAAW,IAAA;AAAA,YACzB,SAAA,EAAW,KAAK,SAAA,IAAa;AAAA,WAC9B,CAAA;AAED,UAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,QACnC;AAAA,OACF;AAAA,MAEA;AAAA;AAAA,QAEE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,MAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,mBAAA,EAAoB;AAAA,QACtD,OAAA,EAAS,OAAO,EAAE,MAAA,EAAO,KAAM;AAC7B,UAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,EAAM,IAAA;AAC3B,UAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,EAAM,OAAA;AAC9B,UAAA,IAAI,CAAC,MAAA,IAAU,CAAC,QAAQ,CAAC,SAAA,CAAU,OAAO,CAAA,EAAG;AAC3C,YAAA,OAAO,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,iBAAgB,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,IAAI,KAAA,CAAM,IAAA;AAAA,YAChC,KAAA;AAAA,YACA,EAAE,MAAA,EAAQ,MAAA,CAAO,GAAA,EAAK,MAAM,OAAA,EAAQ;AAAA,YACpC,EAAE,OAAO,CAAA;AAAE,WACb;AAGA,UAAA,IAAI,WAAW,CAAC,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,cAAc,KAAA,EAAO;AAC9D,YAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,cAAc,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,CAAA;AAAA,UACpE;AAGA,UAAA,IACE,OAAA,EAAS,SAAA,IACT,MAAA,CAAO,GAAA,KAAQ,MAAA,IACf,OAAA,CAAQ,SAAA,CAAU,OAAA,EAAQ,GAAA,CAAK,MAAA,CAAO,GAAA,GAAM,CAAA,IAAK,GAAA,EACjD;AACA,YAAA,OAAO,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,iBAAgB,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,QAAQ,MAAA,CAAO,GAAA;AAAA,YACf,IAAA;AAAA,YACA,OAAA;AAAA,YACA,OAAA,EAAS,KAAA;AAAA,YACT,SAAA,EAAW;AAAA,WACZ,CAAA;AAGD,UAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,cAAc,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,CAAA;AAAA,QACpE;AAAA;AACF;AACF,GACF;AACF","file":"preferences.cjs","sourcesContent":["// Web APIs, not Buffer: this runs on Workers and Vercel Edge.\n\nexport function encodeBase64Url(input: string | Uint8Array): string {\n  const bytes = typeof input === \"string\" ? new TextEncoder().encode(input) : input;\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n// Uint8Array<ArrayBuffer>: bare Uint8Array widens and is not a BufferSource.\nexport function decodeBase64UrlBytes(value: string): Uint8Array<ArrayBuffer> | null {\n  try {\n    const binary = atob(value.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n    return Uint8Array.from(binary, (char) => char.charCodeAt(0));\n  } catch {\n    return null;\n  }\n}\n\nexport function decodeBase64Url(value: string): string | null {\n  const bytes = decodeBase64UrlBytes(value);\n  return bytes ? new TextDecoder().decode(bytes) : null;\n}\n","import { decodeBase64Url, decodeBase64UrlBytes, encodeBase64Url } from \"./base64url\";\n\nexport type TokenClaims = {\n  /** Subject — the user the token acts for. */\n  uid: string;\n  /** What the token is allowed to do. Verification requires an exact match. */\n  purpose: string;\n  /** Expiry, epoch seconds. */\n  exp: number;\n  /** Issued at, epoch seconds. Set by signToken; lets a route refuse a token older than a later change. */\n  iat?: number;\n  /** Free-form, purpose-specific. */\n  data?: Record<string, string>;\n};\n\nconst encoder = new TextEncoder();\n\n// Changing this invalidates every outstanding token. Bump it on purpose only.\nconst KEY_SALT = encoder.encode(\"easy-ping/tokens/v1\");\n\n/** One HMAC key per purpose, derived with HKDF, so an unsubscribe key signs nothing else. */\nasync function hmacKey(secret: string, purpose: string): Promise<CryptoKey> {\n  const master = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), \"HKDF\", false, [\n    \"deriveKey\",\n  ]);\n  return crypto.subtle.deriveKey(\n    { name: \"HKDF\", hash: \"SHA-256\", salt: KEY_SALT, info: encoder.encode(purpose) },\n    master,\n    { name: \"HMAC\", hash: \"SHA-256\", length: 256 },\n    false,\n    [\"sign\", \"verify\"],\n  );\n}\n\nexport async function signToken(\n  secret: string,\n  claims: TokenClaims,\n  now: Date = new Date(),\n): Promise<string> {\n  const stamped: TokenClaims = { ...claims, iat: claims.iat ?? Math.floor(now.getTime() / 1000) };\n  const body = encodeBase64Url(JSON.stringify(stamped));\n  const signature = await crypto.subtle.sign(\n    \"HMAC\",\n    await hmacKey(secret, claims.purpose),\n    encoder.encode(body),\n  );\n  return `${body}.${encodeBase64Url(new Uint8Array(signature))}`;\n}\n\n/** null for every failure mode. Distinguishing them tells an attacker which part to fix. */\nexport async function verifyToken(\n  secret: string,\n  token: string,\n  purpose: string,\n  now: Date = new Date(),\n): Promise<TokenClaims | null> {\n  const separator = token.lastIndexOf(\".\");\n  if (separator <= 0) return null;\n\n  const body = token.slice(0, separator);\n  const signature = decodeBase64UrlBytes(token.slice(separator + 1));\n  if (!signature) return null;\n\n  // Verified under the expected purpose's key before the body is parsed. subtle.verify is constant-time.\n  const valid = await crypto.subtle.verify(\n    \"HMAC\",\n    await hmacKey(secret, purpose),\n    signature,\n    encoder.encode(body),\n  );\n  if (!valid) return null;\n\n  const decoded = decodeBase64Url(body);\n  if (!decoded) return null;\n\n  let claims: TokenClaims;\n  try {\n    claims = JSON.parse(decoded) as TokenClaims;\n  } catch {\n    return null;\n  }\n\n  if (typeof claims?.uid !== \"string\" || typeof claims.exp !== \"number\") return null;\n  if (claims.purpose !== purpose) return null;\n  if (claims.exp * 1000 <= now.getTime()) return null;\n  if (claims.iat !== undefined && typeof claims.iat !== \"number\") return null;\n\n  if (claims.data !== undefined) {\n    if (typeof claims.data !== \"object\" || claims.data === null || Array.isArray(claims.data)) {\n      return null;\n    }\n    for (const value of Object.values(claims.data)) {\n      if (typeof value !== \"string\") return null;\n    }\n  }\n\n  return claims;\n}\n\nexport const DEFAULT_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;\n/** Ninety days. A link that must outlive this should be re-issued, not made immortal. */\nexport const MAX_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;\n\nexport const expiresIn = (seconds: number, now: Date = new Date()): number =>\n  Math.floor(now.getTime() / 1000) + Math.min(Math.max(seconds, 0), MAX_TOKEN_TTL_SECONDS);\n\nexport type SignRequest = {\n  uid: string;\n  purpose: string;\n  data?: Record<string, string>;\n  /** Defaults to 30 days, capped at 90. */\n  ttlSeconds?: number;\n};\n\n/** What a plugin gets instead of the secret: signs only its own declared purposes. */\nexport function createScopedSigner(\n  secret: string,\n  pluginId: string,\n  purposes: ReadonlySet<string>,\n  onViolation: (message: string) => Error,\n): (request: SignRequest) => Promise<string> {\n  return (request) => {\n    if (!purposes.has(request.purpose)) {\n      throw onViolation(\n        `plugin \"${pluginId}\" tried to sign a token for purpose \"${request.purpose}\", ` +\n          \"which none of its signed routes declare.\",\n      );\n    }\n    return signToken(secret, {\n      uid: request.uid,\n      purpose: request.purpose,\n      exp: expiresIn(request.ttlSeconds ?? DEFAULT_TOKEN_TTL_SECONDS),\n      ...(request.data ? { data: request.data } : {}),\n    });\n  };\n}\n","import type { DatabaseAdapter } from \"./adapter\";\nimport type { SessionConfig } from \"./config\";\nimport type { Logger } from \"./errors\";\nimport type { Promisable, RouteDefinition } from \"./plugin\";\nimport type { Runner } from \"./runner\";\nimport { verifyToken } from \"./tokens\";\n\nexport type HandlerDeps = {\n  adapter: DatabaseAdapter;\n  session: SessionConfig;\n  runner: Runner;\n  logger: Logger;\n  basePath: string;\n  secret: string;\n  cronSecret?: string | undefined;\n  /** Guards plugin machine routes. The instance defaults it to cronSecret. */\n  machineSecret?: string | undefined;\n  cronMaxSweeps?: number | undefined;\n  pluginRoutes?: readonly RouteDefinition[] | undefined;\n  /** Returns a 429 to send, or null to proceed. Runs after onRequest, before routing. */\n  rateLimit?: ((request: Request) => Response | null) | undefined;\n  /** Origins other than the request's own host that may POST. `*.example.com` allowed. */\n  trustedOrigins?: readonly string[] | undefined;\n  /** Runs before routing. Returning a Response short-circuits; use it for rate limiting. */\n  // biome-ignore lint/suspicious/noConfusingVoidType: a hook that returns nothing is the common case\n  onRequest?: ((request: Request) => Promisable<Response | undefined | void>) | undefined;\n  maxBodyBytes?: number | undefined;\n};\n\n/** Every JSON body is capped here. Nothing legitimate the routes accept is bigger. */\nexport const MAX_BODY_BYTES = 64 * 1024;\n\nconst MAX_READ_IDS = 200;\n\n// Per-user data: no shared caching, no sniffing.\nconst PRIVATE_HEADERS: Record<string, string> = {\n  \"cache-control\": \"private, no-store\",\n  \"x-content-type-options\": \"nosniff\",\n};\n\nconst json = (body: unknown, status = 200) =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { \"content-type\": \"application/json\", ...PRIVATE_HEADERS },\n  });\n\nconst empty = (status: number) => new Response(null, { status, headers: PRIVATE_HEADERS });\n\n/** Plugin responses get the same headers, without touching their body. */\nfunction harden(response: Response): Response {\n  const headers = new Headers(response.headers);\n  for (const [name, value] of Object.entries(PRIVATE_HEADERS)) {\n    if (!headers.has(name)) headers.set(name, value);\n  }\n  return new Response(response.body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n  });\n}\n\nconst encoder = new TextEncoder();\n\n/** Constant time over SHA-256 digests, so neither content nor length leaks. Works on edge runtimes. */\nasync function timingSafeEqual(a: string, b: string): Promise<boolean> {\n  const [left, right] = await Promise.all(\n    [a, b].map(\n      async (value) => new Uint8Array(await crypto.subtle.digest(\"SHA-256\", encoder.encode(value))),\n    ),\n  );\n  let diff = 0;\n  for (let i = 0; i < 32; i += 1) diff |= (left?.[i] ?? 0) ^ (right?.[i] ?? 0);\n  return diff === 0;\n}\n\n/** Anchored at a segment boundary: `/foo/api/notifications/cron` is not a cron request. */\nfunction routePath(url: URL, basePath: string): string {\n  const { pathname } = url;\n  if (pathname === basePath) return \"/\";\n  if (pathname.startsWith(`${basePath}/`)) return pathname.slice(basePath.length);\n  return pathname;\n}\n\nexport type JsonBody = { body: Record<string, unknown> } | { error: Response };\n\n/** Reads a JSON object body with a streaming byte cap. Malformed JSON is 400; an empty body is `{}`. */\nexport async function readJsonBody(\n  request: Request,\n  maxBytes: number = MAX_BODY_BYTES,\n): Promise<JsonBody> {\n  const tooLarge = () => ({ error: json({ error: `body exceeds ${maxBytes} bytes` }, 413) });\n\n  const declared = Number(request.headers.get(\"content-length\"));\n  if (Number.isFinite(declared) && declared > maxBytes) return tooLarge();\n  if (!request.body) return { body: {} };\n\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    total += value.byteLength;\n    if (total > maxBytes) {\n      await reader.cancel();\n      return tooLarge();\n    }\n    chunks.push(value);\n  }\n\n  const bytes = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n\n  const text = new TextDecoder().decode(bytes);\n  if (text.trim() === \"\") return { body: {} };\n\n  try {\n    const parsed: unknown = JSON.parse(text);\n    return {\n      body:\n        parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n          ? (parsed as Record<string, unknown>)\n          : {},\n    };\n  } catch {\n    return { error: json({ error: \"body must be a JSON object\" }, 400) };\n  }\n}\n\nconst isJsonContentType = (request: Request) =>\n  /^application\\/json\\s*(;|$)/i.test((request.headers.get(\"content-type\") ?? \"\").trim());\n\nfunction originAllowed(origin: string, url: URL, request: Request, trusted: readonly string[]) {\n  let host: string;\n  try {\n    host = new URL(origin).host;\n  } catch {\n    return false;\n  }\n\n  if (host === url.host) return true;\n  // Behind a proxy that rewrites Host, the public host arrives here instead.\n  const forwarded = request.headers.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  if (forwarded && host === forwarded) return true;\n\n  return trusted.some((entry) =>\n    entry.startsWith(\"*.\") ? host.endsWith(entry.slice(1)) : entry === origin,\n  );\n}\n\n/** CSRF: a cross-site form can neither send `application/json` without a preflight nor forge `Origin`. */\nfunction csrfCheck(request: Request, url: URL, trusted: readonly string[]): Response | null {\n  if (!isJsonContentType(request)) {\n    return json({ error: \"content-type must be application/json\" }, 415);\n  }\n\n  const origin = request.headers.get(\"origin\");\n  if (origin === null) return null;\n  if (origin === \"null\" || !originAllowed(origin, url, request, trusted)) return empty(403);\n\n  return null;\n}\n\nexport function createHandler(deps: HandlerDeps) {\n  const trustedOrigins = deps.trustedOrigins ?? [];\n  const maxBodyBytes = deps.maxBodyBytes ?? MAX_BODY_BYTES;\n\n  async function resolveUserId(request: Request): Promise<string | null | \"error\"> {\n    try {\n      return await deps.session.getUserId(request);\n    } catch (error) {\n      // A broken session lookup is a 500, never a 401. RFC 0002 §1.\n      deps.logger.error(\"session.getUserId threw\", { error });\n      return \"error\";\n    }\n  }\n\n  async function bearerMatches(request: Request, secret: string | undefined): Promise<boolean> {\n    if (!secret) return false;\n    const header = request.headers.get(\"authorization\") ?? \"\";\n    const presented = header.startsWith(\"Bearer \") ? header.slice(7) : header;\n    return timingSafeEqual(presented, secret);\n  }\n\n  async function handleCron(request: Request): Promise<Response> {\n    if (!deps.cronSecret) return empty(404);\n    if (!(await bearerMatches(request, deps.cronSecret))) return empty(401);\n\n    // Bounded so an overlapping scheduler does not hold a request open for the whole backlog.\n    const result = await deps.runner.drain(\n      deps.cronMaxSweeps === undefined ? {} : { maxSweeps: deps.cronMaxSweeps },\n    );\n    return json(result);\n  }\n\n  /** Plugin routes first; auth is enforced here so a plugin cannot forget it. */\n  async function handlePluginRoute(\n    route: RouteDefinition,\n    request: Request,\n    url: URL,\n  ): Promise<Response> {\n    if (route.scope.type === \"user\") {\n      if (request.method === \"POST\") {\n        const rejected = csrfCheck(request, url, trustedOrigins);\n        if (rejected) return rejected;\n      }\n\n      const userId = await resolveUserId(request);\n      if (userId === \"error\") return empty(500);\n      if (userId === null) return empty(401);\n      return harden(await route.handler({ request, userId, claims: null, params: {} }));\n    }\n\n    if (route.scope.type === \"machine\") {\n      if (!deps.machineSecret) return empty(404);\n      if (!(await bearerMatches(request, deps.machineSecret))) return empty(401);\n      return harden(await route.handler({ request, userId: null, claims: null, params: {} }));\n    }\n\n    if (route.scope.type === \"signed\") {\n      const token =\n        url.searchParams.get(\"token\") ??\n        (request.headers.get(\"authorization\") ?? \"\").replace(/^Bearer /, \"\");\n\n      const claims = await verifyToken(deps.secret, token, route.scope.purpose);\n      // One response for every failure mode. RFC 0002 §5.\n      if (!claims) return empty(400);\n\n      return harden(await route.handler({ request, userId: claims.uid, claims, params: {} }));\n    }\n\n    return harden(await route.handler({ request, userId: null, claims: null, params: {} }));\n  }\n\n  async function route(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    const path = routePath(url, deps.basePath);\n\n    if (deps.onRequest) {\n      const early = await deps.onRequest(request);\n      if (early instanceof Response) return early;\n    }\n\n    if (deps.rateLimit) {\n      const limited = deps.rateLimit(request);\n      if (limited) return limited;\n    }\n\n    if (path === \"/cron\") {\n      if (request.method !== \"POST\") return empty(405);\n      return handleCron(request);\n    }\n\n    const pluginRoute = deps.pluginRoutes?.find(\n      (candidate) => candidate.path === path && candidate.method === request.method,\n    );\n    if (pluginRoute) return handlePluginRoute(pluginRoute, request, url);\n\n    if (request.method === \"POST\") {\n      const rejected = csrfCheck(request, url, trustedOrigins);\n      if (rejected) return rejected;\n    }\n\n    const userId = await resolveUserId(request);\n    if (userId === \"error\") return empty(500);\n    if (userId === null) return empty(401);\n\n    if (request.method === \"GET\" && path === \"/\") {\n      const limitParam = Number(url.searchParams.get(\"limit\") ?? 20);\n      const limit = Number.isFinite(limitParam) ? Math.min(Math.max(limitParam, 1), 100) : 20;\n      const cursor = url.searchParams.get(\"cursor\");\n\n      // unseenCount rides on the first page only: a cursor request is scrollback, not a poll.\n      const [page, unseenCount] = await Promise.all([\n        deps.adapter.listNotifications({\n          userId,\n          limit,\n          ...(cursor ? { cursor } : {}),\n          ...(url.searchParams.get(\"unreadOnly\") === \"true\" ? { unreadOnly: true } : {}),\n        }),\n        cursor ? Promise.resolve(null) : deps.adapter.countUnseen(userId),\n      ]);\n\n      return json(unseenCount === null ? page : { ...page, unseenCount });\n    }\n\n    if (request.method === \"GET\" && path === \"/count\") {\n      return json({ unseen: await deps.adapter.countUnseen(userId) });\n    }\n\n    if (request.method === \"POST\" && path === \"/seen\") {\n      const parsed = await readJsonBody(request, maxBodyBytes);\n      if (\"error\" in parsed) return parsed.error;\n      const before = typeof parsed.body.before === \"string\" ? new Date(parsed.body.before) : null;\n\n      // +1ms: Postgres keeps microseconds, an ISO string milliseconds; without it markSeen misses the newest row.\n      const cutoff =\n        before && !Number.isNaN(before.getTime()) ? new Date(before.getTime() + 1) : new Date();\n\n      await deps.adapter.markSeen(userId, cutoff);\n      return json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && path === \"/read\") {\n      const parsed = await readJsonBody(request, maxBodyBytes);\n      if (\"error\" in parsed) return parsed.error;\n      const ids = Array.isArray(parsed.body.ids)\n        ? parsed.body.ids.filter((id): id is string => typeof id === \"string\")\n        : [];\n      if (ids.length === 0) return json({ error: \"ids must be a non-empty string array\" }, 400);\n\n      if (ids.length > MAX_READ_IDS) {\n        return json({ error: `at most ${MAX_READ_IDS} ids per request` }, 400);\n      }\n\n      // 404, not 403: a 403 confirms the row exists. RFC 0002 §2.\n      const updated = await deps.adapter.markRead(userId, ids);\n      return updated === 0 ? empty(404) : json({ updated });\n    }\n\n    if (request.method === \"POST\" && path === \"/read-all\") {\n      return json({ updated: await deps.adapter.markAllRead(userId) });\n    }\n\n    return empty(404);\n  }\n\n  async function handle(request: Request): Promise<Response> {\n    try {\n      return await route(request);\n    } catch (error) {\n      // A thrown driver error must not escape: unhandled rejection on Node, stack trace elsewhere.\n      deps.logger.error(\"request failed\", { url: request.url, error });\n      return empty(500);\n    }\n  }\n\n  return {\n    handle,\n    GET: handle,\n    POST: handle,\n  };\n}\n","import { readJsonBody } from \"../../core/handler\";\nimport type {\n  ChannelDecision,\n  EasyPingPlugin,\n  PluginInitContext,\n  PrepareContext,\n  ResolveChannelsContext,\n} from \"../../core/plugin\";\nimport { DEFAULT_TOKEN_TTL_SECONDS, expiresIn, signToken } from \"../../core/tokens\";\nimport type { Channel, Frequency } from \"../../core/types\";\n\nexport const UNSUBSCRIBE_PURPOSE = \"unsubscribe\";\n\nconst TABLE = \"notification_preference\";\n\nconst CHANNELS: readonly Channel[] = [\"inApp\", \"email\", \"push\", \"sms\", \"slack\"];\nconst FREQUENCIES: readonly Frequency[] = [\"instant\", \"daily\", \"weekly\", \"off\"];\n\nconst isChannel = (value: unknown): value is Channel => CHANNELS.includes(value as Channel);\nconst isFrequency = (value: unknown): value is Frequency =>\n  FREQUENCIES.includes(value as Frequency);\n\nexport type PreferenceRow = {\n  userId: string;\n  type: string;\n  channel: Channel;\n  enabled: boolean;\n  frequency: Frequency;\n  /** Last explicit change. An unsubscribe token issued before it is refused. */\n  updatedAt?: Date;\n};\n\nexport type PreferencesOptions = {\n  /** What an absent row means. Flip to false for opt-in-only notifications. */\n  defaultEnabled?: boolean;\n  /** Types that ignore preferences entirely: receipts, security alerts. */\n  alwaysSend?: readonly string[];\n  unsubscribeTtlSeconds?: number;\n};\n\nconst key = (userId: string, type: string, channel: string) => `${userId} ${type} ${channel}`;\n\ntype PreparedPreferences = Map<string, PreferenceRow>;\n\nexport function buildUnsubscribeToken(\n  secret: string,\n  userId: string,\n  type: string,\n  channel: Channel,\n  ttlSeconds = DEFAULT_TOKEN_TTL_SECONDS,\n): Promise<string> {\n  return signToken(secret, {\n    uid: userId,\n    purpose: UNSUBSCRIBE_PURPOSE,\n    exp: expiresIn(ttlSeconds),\n    data: { type, channel },\n  });\n}\n\nexport function preferences(options: PreferencesOptions = {}): EasyPingPlugin<\"preferences\"> {\n  const defaultEnabled = options.defaultEnabled ?? true;\n  const alwaysSend = new Set(options.alwaysSend ?? []);\n\n  // Assigned by init(), which easyPing() runs before any hook or route.\n  let ctx: PluginInitContext;\n\n  const isAllowed = (userId: string, type: string, channel: Channel, rows: PreparedPreferences) => {\n    const row = rows.get(key(userId, type, channel));\n    return row ? row.enabled && row.frequency !== \"off\" : defaultEnabled;\n  };\n\n  const load = (userIds: readonly string[]) =>\n    ctx.store.find<PreferenceRow>(TABLE, { userId: { in: [...userIds] } });\n\n  const save = (row: PreferenceRow) =>\n    ctx.store.upsert(TABLE, [{ ...row, updatedAt: new Date() }], {\n      onConflict: [\"userId\", \"type\", \"channel\"],\n    });\n\n  return {\n    id: \"preferences\",\n\n    init: (context) => {\n      ctx = context;\n    },\n\n    schema: {\n      notificationPreference: {\n        tableName: TABLE,\n        fields: {\n          userId: { type: \"string\", required: true },\n          type: { type: \"string\", required: true },\n          channel: { type: \"string\", required: true },\n          enabled: { type: \"boolean\", required: true, default: true },\n          frequency: { type: \"string\", required: true, default: \"instant\" },\n          updatedAt: { type: \"date\", required: true, defaultNow: true },\n        },\n        primaryKey: [\"userId\", \"type\", \"channel\"],\n      },\n    },\n\n    hooks: {\n      /** One query per send; doing this per recipient would be an N+1. */\n      prepare: async (context: PrepareContext): Promise<PreparedPreferences> => {\n        if (alwaysSend.has(context.type)) return new Map();\n\n        const rows = await load(context.recipients.map((recipient) => recipient.userId));\n        return new Map(rows.map((row) => [key(row.userId, row.type, row.channel), row]));\n      },\n\n      resolveChannels: (context: ResolveChannelsContext) => {\n        if (alwaysSend.has(context.type)) return context.decisions;\n\n        // prepare() failed: fail closed rather than assume everyone opted in.\n        if (!(context.prepared instanceof Map)) {\n          return context.decisions.map((decision) => ({ ...decision, action: \"skip\" as const }));\n        }\n\n        const rows = context.prepared as PreparedPreferences;\n\n        return context.decisions.map<ChannelDecision>((decision) =>\n          isAllowed(context.recipient.userId, context.type, decision.channel, rows)\n            ? decision\n            : { ...decision, action: \"skip\" },\n        );\n      },\n    },\n\n    routes: [\n      {\n        path: \"/preferences\",\n        method: \"GET\",\n        scope: { type: \"user\" },\n        handler: async ({ userId }) => {\n          const rows = await load([userId ?? \"\"]);\n          return Response.json({ preferences: rows, defaultEnabled });\n        },\n      },\n\n      {\n        path: \"/preferences\",\n        method: \"POST\",\n        scope: { type: \"user\" },\n        handler: async ({ request, userId }) => {\n          const parsed = await readJsonBody(request);\n          if (\"error\" in parsed) return parsed.error;\n          const body = parsed.body;\n\n          const bad = (error: string) => Response.json({ error }, { status: 400 });\n\n          // Only configured types, or every invented string becomes a row.\n          if (typeof body.type !== \"string\" || !ctx.notificationTypes.includes(body.type)) {\n            return bad(\"type must be a configured notification type\");\n          }\n          if (!isChannel(body.channel)) return bad(`channel must be one of ${CHANNELS.join(\", \")}`);\n          if (body.enabled !== undefined && typeof body.enabled !== \"boolean\") {\n            return bad(\"enabled must be a boolean\");\n          }\n          if (body.frequency !== undefined && !isFrequency(body.frequency)) {\n            return bad(`frequency must be one of ${FREQUENCIES.join(\", \")}`);\n          }\n\n          // userId comes from the resolved session, never from the body.\n          await save({\n            userId: userId ?? \"\",\n            type: body.type,\n            channel: body.channel,\n            enabled: body.enabled ?? true,\n            frequency: body.frequency ?? \"instant\",\n          });\n\n          return Response.json({ ok: true });\n        },\n      },\n\n      {\n        // No session in a mail client; the link carries the proof.\n        path: \"/unsubscribe\",\n        method: \"POST\",\n        scope: { type: \"signed\", purpose: UNSUBSCRIBE_PURPOSE },\n        handler: async ({ claims }) => {\n          const type = claims?.data?.type;\n          const channel = claims?.data?.channel;\n          if (!claims || !type || !isChannel(channel)) {\n            return Response.json({ error: \"invalid token\" }, { status: 400 });\n          }\n\n          const [current] = await ctx.store.find<PreferenceRow>(\n            TABLE,\n            { userId: claims.uid, type, channel },\n            { limit: 1 },\n          );\n\n          // Already off: a second click, or a mail client retrying, is fine.\n          if (current && !current.enabled && current.frequency === \"off\") {\n            return Response.json({ ok: true, unsubscribed: { type, channel } });\n          }\n\n          // Changed after the email went out: an old link must not undo a newer decision.\n          if (\n            current?.updatedAt &&\n            claims.iat !== undefined &&\n            current.updatedAt.getTime() > (claims.iat + 1) * 1000\n          ) {\n            return Response.json({ error: \"invalid token\" }, { status: 400 });\n          }\n\n          await save({\n            userId: claims.uid,\n            type,\n            channel,\n            enabled: false,\n            frequency: \"off\",\n          });\n\n          // One-click (Gmail, Yahoo) requires the POST itself to unsubscribe.\n          return Response.json({ ok: true, unsubscribed: { type, channel } });\n        },\n      },\n    ],\n  };\n}\n"]}
+{"version":3,"sources":["../../src/core/base64url.ts","../../src/core/tokens.ts","../../src/core/handler.ts","../../src/plugins/preferences/index.ts"],"names":[],"mappings":";;;AAEO,SAAS,gBAAgB,KAAA,EAAoC;AAClE,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,KAAU,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA,GAAI,KAAA;AAC5E,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,KAAA,EAAO,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAC5D,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC/E;;;ACQA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAGhC,IAAM,QAAA,GAAW,OAAA,CAAQ,MAAA,CAAO,qBAAqB,CAAA;AAGrD,eAAe,OAAA,CAAQ,QAAgB,OAAA,EAAqC;AAC1E,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,EAAG,MAAA,EAAQ,KAAA,EAAO;AAAA,IACzF;AAAA,GACD,CAAA;AACD,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA;AAAA,IACnB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAW,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA,EAAE;AAAA,IAC/E,MAAA;AAAA,IACA,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAW,QAAQ,GAAA,EAAI;AAAA,IAC7C,KAAA;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,GACnB;AACF;AAEA,eAAsB,UACpB,MAAA,EACA,MAAA,EACA,GAAA,mBAAY,IAAI,MAAK,EACJ;AACjB,EAAA,MAAM,OAAA,GAAuB,EAAE,GAAG,MAAA,EAAQ,GAAA,EAAK,MAAA,CAAO,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,OAAA,EAAQ,GAAI,GAAI,CAAA,EAAE;AAC9F,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AACpD,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA;AAAA,IACpC,MAAA;AAAA,IACA,MAAM,OAAA,CAAQ,MAAA,EAAQ,MAAA,CAAO,OAAO,CAAA;AAAA,IACpC,OAAA,CAAQ,OAAO,IAAI;AAAA,GACrB;AACA,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,eAAA,CAAgB,IAAI,UAAA,CAAW,SAAS,CAAC,CAAC,CAAA,CAAA;AAC9D;AAoDO,IAAM,yBAAA,GAA4B,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAEjD,IAAM,qBAAA,GAAwB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAE7C,IAAM,SAAA,GAAY,CAAC,OAAA,EAAiB,GAAA,uBAAgB,IAAA,EAAK,KAC9D,KAAK,KAAA,CAAM,GAAA,CAAI,SAAQ,GAAI,GAAI,IAAI,IAAA,CAAK,GAAA,CAAI,KAAK,GAAA,CAAI,OAAA,EAAS,CAAC,CAAA,EAAG,qBAAqB,CAAA;;;ACzDlF,IAAM,iBAAiB,EAAA,GAAK,IAAA;AAKnC,IAAM,eAAA,GAA0C;AAAA,EAC9C,eAAA,EAAiB,mBAAA;AAAA,EACjB,wBAAA,EAA0B;AAC5B,CAAA;AAEA,IAAM,IAAA,GAAO,CAAC,IAAA,EAAe,MAAA,GAAS,GAAA,EAAK,OAAA,GAAkC,EAAC,KAC5E,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AAAA,EACjC,MAAA;AAAA,EACA,SAAS,EAAE,cAAA,EAAgB,oBAAoB,GAAG,eAAA,EAAiB,GAAG,OAAA;AACxE,CAAC,CAAA;AAiBa,IAAI,WAAA;AAyBpB,eAAsB,YAAA,CACpB,OAAA,EACA,QAAA,GAAmB,cAAA,EACA;AACnB,EAAA,MAAM,QAAA,GAAW,OAAO,EAAE,KAAA,EAAO,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,aAAA,EAAgB,QAAQ,CAAA,MAAA,CAAA,EAAS,EAAG,GAAG,CAAA,EAAE,CAAA;AAExF,EAAA,MAAM,WAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAC,CAAA;AAC7D,EAAA,IAAI,OAAO,QAAA,CAAS,QAAQ,KAAK,QAAA,GAAW,QAAA,SAAiB,QAAA,EAAS;AACtE,EAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,SAAa,EAAE,IAAA,EAAM,EAAC,EAAE;AAErC,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,IAAA,CAAK,SAAA,EAAU;AACtC,EAAA,MAAM,SAAuB,EAAC;AAC9B,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,WAAS;AACP,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAM,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,IAAA,IAAI,IAAA,EAAM;AACV,IAAA,KAAA,IAAS,KAAA,CAAM,UAAA;AACf,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,OAAO,MAAA,EAAO;AACpB,MAAA,OAAO,QAAA,EAAS;AAAA,IAClB;AACA,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,EACnB;AAEA,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,KAAK,CAAA;AAClC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,KAAA,CAAM,GAAA,CAAI,OAAO,MAAM,CAAA;AACvB,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAClB;AAEA,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,KAAK,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,MAAK,KAAM,EAAA,SAAW,EAAE,IAAA,EAAM,EAAC,EAAE;AAE1C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AACvC,IAAA,OAAO;AAAA,MACL,IAAA,EACE,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GACxD,MAAA,GACD;AAAC,KACT;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,OAAO,IAAA,CAAK,EAAE,OAAO,4BAAA,EAA6B,EAAG,GAAG,CAAA,EAAE;AAAA,EACrE;AACF;;;AC1IO,IAAM,mBAAA,GAAsB;AAEnC,IAAM,KAAA,GAAQ,yBAAA;AAEd,IAAM,WAA+B,CAAC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC9E,IAAM,WAAA,GAAoC,CAAC,SAAA,EAAW,OAAA,EAAS,UAAU,KAAK,CAAA;AAE9E,IAAM,SAAA,GAAY,CAAC,KAAA,KAAqC,QAAA,CAAS,SAAS,KAAgB,CAAA;AAC1F,IAAM,WAAA,GAAc,CAAC,KAAA,KACnB,WAAA,CAAY,SAAS,KAAkB,CAAA;AAoBzC,IAAM,GAAA,GAAM,CAAC,MAAA,EAAgB,IAAA,EAAc,OAAA,KAAoB,GAAG,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAIpF,SAAS,sBACd,MAAA,EACA,MAAA,EACA,IAAA,EACA,OAAA,EACA,aAAa,yBAAA,EACI;AACjB,EAAA,OAAO,UAAU,MAAA,EAAQ;AAAA,IACvB,GAAA,EAAK,MAAA;AAAA,IACL,OAAA,EAAS,mBAAA;AAAA,IACT,GAAA,EAAK,UAAU,UAAU,CAAA;AAAA,IACzB,IAAA,EAAM,EAAE,IAAA,EAAM,OAAA;AAAQ,GACvB,CAAA;AACH;AAEO,SAAS,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAkC;AAC3F,EAAA,MAAM,cAAA,GAAiB,QAAQ,cAAA,IAAkB,IAAA;AACjD,EAAA,MAAM,aAAa,IAAI,GAAA,CAAI,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAA;AAGnD,EAAA,IAAI,GAAA;AAEJ,EAAA,MAAM,SAAA,GAAY,CAAC,MAAA,EAAgB,IAAA,EAAc,SAAkB,IAAA,KAA8B;AAC/F,IAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,IAAI,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAC,CAAA;AAC/C,IAAA,OAAO,GAAA,GAAM,GAAA,CAAI,OAAA,IAAW,GAAA,CAAI,cAAc,KAAA,GAAQ,cAAA;AAAA,EACxD,CAAA;AAEA,EAAA,MAAM,OAAO,CAAC,OAAA,KACZ,GAAA,CAAI,KAAA,CAAM,KAAoB,KAAA,EAAO,EAAE,MAAA,EAAQ,EAAE,IAAI,CAAC,GAAG,OAAO,CAAA,IAAK,CAAA;AAEvE,EAAA,MAAM,OAAO,CAAC,GAAA,KACZ,GAAA,CAAI,KAAA,CAAM,OAAO,KAAA,EAAO,CAAC,EAAE,GAAG,KAAK,SAAA,kBAAW,IAAI,IAAA,EAAK,EAAG,CAAA,EAAG;AAAA,IAC3D,UAAA,EAAY,CAAC,QAAA,EAAU,MAAA,EAAQ,SAAS;AAAA,GACzC,CAAA;AAEH,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,aAAA;AAAA,IAEJ,IAAA,EAAM,CAAC,OAAA,KAAY;AACjB,MAAA,GAAA,GAAM,OAAA;AAAA,IACR,CAAA;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN,sBAAA,EAAwB;AAAA,QACtB,SAAA,EAAW,KAAA;AAAA,QACX,MAAA,EAAQ;AAAA,UACN,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UACzC,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UACvC,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UAC1C,SAAS,EAAE,IAAA,EAAM,WAAW,QAAA,EAAU,IAAA,EAAM,SAAS,IAAA,EAAK;AAAA,UAC1D,WAAW,EAAE,IAAA,EAAM,UAAU,QAAA,EAAU,IAAA,EAAM,SAAS,SAAA,EAAU;AAAA,UAChE,WAAW,EAAE,IAAA,EAAM,QAAQ,QAAA,EAAU,IAAA,EAAM,YAAY,IAAA;AAAK,SAC9D;AAAA,QACA,UAAA,EAAY,CAAC,QAAA,EAAU,MAAA,EAAQ,SAAS;AAAA;AAC1C,KACF;AAAA,IAEA,KAAA,EAAO;AAAA;AAAA,MAEL,OAAA,EAAS,OAAO,OAAA,KAA0D;AACxE,QAAA,IAAI,WAAW,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG,2BAAW,GAAA,EAAI;AAEjD,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAC,SAAA,KAAc,SAAA,CAAU,MAAM,CAAC,CAAA;AAC/E,QAAA,OAAO,IAAI,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,CAAC,QAAQ,CAAC,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,IAAI,IAAA,EAAM,GAAA,CAAI,OAAO,CAAA,EAAG,GAAG,CAAC,CAAC,CAAA;AAAA,MACjF,CAAA;AAAA,MAEA,eAAA,EAAiB,CAAC,OAAA,KAAoC;AACpD,QAAA,IAAI,WAAW,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,SAAU,OAAA,CAAQ,SAAA;AAGjD,QAAA,IAAI,EAAE,OAAA,CAAQ,QAAA,YAAoB,GAAA,CAAA,EAAM;AACtC,UAAA,OAAO,OAAA,CAAQ,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,MAAc,EAAE,GAAG,QAAA,EAAU,MAAA,EAAQ,MAAA,EAAgB,CAAE,CAAA;AAAA,QACvF;AAEA,QAAA,MAAM,OAAO,OAAA,CAAQ,QAAA;AAErB,QAAA,OAAO,QAAQ,SAAA,CAAU,GAAA;AAAA,UAAqB,CAAC,QAAA,KAC7C,SAAA,CAAU,OAAA,CAAQ,SAAA,CAAU,QAAQ,OAAA,CAAQ,IAAA,EAAM,QAAA,CAAS,OAAA,EAAS,IAAI,CAAA,GACpE,QAAA,GACA,EAAE,GAAG,QAAA,EAAU,QAAQ,MAAA;AAAO,SACpC;AAAA,MACF;AAAA,KACF;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,KAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,QACtB,OAAA,EAAS,OAAO,EAAE,MAAA,EAAO,KAAM;AAC7B,UAAA,MAAM,OAAO,MAAM,IAAA,CAAK,CAAC,MAAA,IAAU,EAAE,CAAC,CAAA;AACtC,UAAA,OAAO,SAAS,IAAA,CAAK,EAAE,WAAA,EAAa,IAAA,EAAM,gBAAgB,CAAA;AAAA,QAC5D;AAAA,OACF;AAAA,MAEA;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,MAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,QACtB,OAAA,EAAS,OAAO,EAAE,OAAA,EAAS,QAAO,KAAM;AACtC,UAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAO,CAAA;AACzC,UAAA,IAAI,OAAA,IAAW,MAAA,EAAQ,OAAO,MAAA,CAAO,KAAA;AACrC,UAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AAEpB,UAAA,MAAM,GAAA,GAAM,CAAC,KAAA,KAAkB,QAAA,CAAS,IAAA,CAAK,EAAE,KAAA,EAAM,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAGvE,UAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,IAAY,CAAC,IAAI,iBAAA,CAAkB,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,EAAG;AAC/E,YAAA,OAAO,IAAI,6CAA6C,CAAA;AAAA,UAC1D;AACA,UAAA,IAAI,CAAC,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,GAAA,CAAI,CAAA,uBAAA,EAA0B,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AACxF,UAAA,IAAI,KAAK,OAAA,KAAY,MAAA,IAAa,OAAO,IAAA,CAAK,YAAY,SAAA,EAAW;AACnE,YAAA,OAAO,IAAI,2BAA2B,CAAA;AAAA,UACxC;AACA,UAAA,IAAI,KAAK,SAAA,KAAc,MAAA,IAAa,CAAC,WAAA,CAAY,IAAA,CAAK,SAAS,CAAA,EAAG;AAChE,YAAA,OAAO,IAAI,CAAA,yBAAA,EAA4B,WAAA,CAAY,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,UACjE;AAGA,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,QAAQ,MAAA,IAAU,EAAA;AAAA,YAClB,MAAM,IAAA,CAAK,IAAA;AAAA,YACX,SAAS,IAAA,CAAK,OAAA;AAAA,YACd,OAAA,EAAS,KAAK,OAAA,IAAW,IAAA;AAAA,YACzB,SAAA,EAAW,KAAK,SAAA,IAAa;AAAA,WAC9B,CAAA;AAED,UAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,QACnC;AAAA,OACF;AAAA,MAEA;AAAA;AAAA,QAEE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,MAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,mBAAA,EAAoB;AAAA,QACtD,OAAA,EAAS,OAAO,EAAE,MAAA,EAAO,KAAM;AAC7B,UAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,EAAM,IAAA;AAC3B,UAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,EAAM,OAAA;AAC9B,UAAA,IAAI,CAAC,MAAA,IAAU,CAAC,QAAQ,CAAC,SAAA,CAAU,OAAO,CAAA,EAAG;AAC3C,YAAA,OAAO,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,iBAAgB,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,IAAI,KAAA,CAAM,IAAA;AAAA,YAChC,KAAA;AAAA,YACA,EAAE,MAAA,EAAQ,MAAA,CAAO,GAAA,EAAK,MAAM,OAAA,EAAQ;AAAA,YACpC,EAAE,OAAO,CAAA;AAAE,WACb;AAGA,UAAA,IAAI,WAAW,CAAC,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,cAAc,KAAA,EAAO;AAC9D,YAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,cAAc,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,CAAA;AAAA,UACpE;AAGA,UAAA,IACE,OAAA,EAAS,SAAA,IACT,MAAA,CAAO,GAAA,KAAQ,MAAA,IACf,OAAA,CAAQ,SAAA,CAAU,OAAA,EAAQ,GAAA,CAAK,MAAA,CAAO,GAAA,GAAM,CAAA,IAAK,GAAA,EACjD;AACA,YAAA,OAAO,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,iBAAgB,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,QAAQ,MAAA,CAAO,GAAA;AAAA,YACf,IAAA;AAAA,YACA,OAAA;AAAA,YACA,OAAA,EAAS,KAAA;AAAA,YACT,SAAA,EAAW;AAAA,WACZ,CAAA;AAGD,UAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,cAAc,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,CAAA;AAAA,QACpE;AAAA;AACF;AACF,GACF;AACF","file":"preferences.cjs","sourcesContent":["// Web APIs, not Buffer: this runs on Workers and Vercel Edge.\n\nexport function encodeBase64Url(input: string | Uint8Array): string {\n  const bytes = typeof input === \"string\" ? new TextEncoder().encode(input) : input;\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n// Uint8Array<ArrayBuffer>: bare Uint8Array widens and is not a BufferSource.\nexport function decodeBase64UrlBytes(value: string): Uint8Array<ArrayBuffer> | null {\n  try {\n    const binary = atob(value.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n    return Uint8Array.from(binary, (char) => char.charCodeAt(0));\n  } catch {\n    return null;\n  }\n}\n\nexport function decodeBase64Url(value: string): string | null {\n  const bytes = decodeBase64UrlBytes(value);\n  return bytes ? new TextDecoder().decode(bytes) : null;\n}\n","import { decodeBase64Url, decodeBase64UrlBytes, encodeBase64Url } from \"./base64url\";\n\nexport type TokenClaims = {\n  /** Subject — the user the token acts for. */\n  uid: string;\n  /** What the token is allowed to do. Verification requires an exact match. */\n  purpose: string;\n  /** Expiry, epoch seconds. */\n  exp: number;\n  /** Issued at, epoch seconds. Set by signToken; lets a route refuse a token older than a later change. */\n  iat?: number;\n  /** Free-form, purpose-specific. */\n  data?: Record<string, string>;\n};\n\nconst encoder = new TextEncoder();\n\n// Changing this invalidates every outstanding token. Bump it on purpose only.\nconst KEY_SALT = encoder.encode(\"easy-ping/tokens/v1\");\n\n/** One HMAC key per purpose, derived with HKDF, so an unsubscribe key signs nothing else. */\nasync function hmacKey(secret: string, purpose: string): Promise<CryptoKey> {\n  const master = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), \"HKDF\", false, [\n    \"deriveKey\",\n  ]);\n  return crypto.subtle.deriveKey(\n    { name: \"HKDF\", hash: \"SHA-256\", salt: KEY_SALT, info: encoder.encode(purpose) },\n    master,\n    { name: \"HMAC\", hash: \"SHA-256\", length: 256 },\n    false,\n    [\"sign\", \"verify\"],\n  );\n}\n\nexport async function signToken(\n  secret: string,\n  claims: TokenClaims,\n  now: Date = new Date(),\n): Promise<string> {\n  const stamped: TokenClaims = { ...claims, iat: claims.iat ?? Math.floor(now.getTime() / 1000) };\n  const body = encodeBase64Url(JSON.stringify(stamped));\n  const signature = await crypto.subtle.sign(\n    \"HMAC\",\n    await hmacKey(secret, claims.purpose),\n    encoder.encode(body),\n  );\n  return `${body}.${encodeBase64Url(new Uint8Array(signature))}`;\n}\n\n/** null for every failure mode. Distinguishing them tells an attacker which part to fix. */\nexport async function verifyToken(\n  secret: string,\n  token: string,\n  purpose: string,\n  now: Date = new Date(),\n): Promise<TokenClaims | null> {\n  const separator = token.lastIndexOf(\".\");\n  if (separator <= 0) return null;\n\n  const body = token.slice(0, separator);\n  const signature = decodeBase64UrlBytes(token.slice(separator + 1));\n  if (!signature) return null;\n\n  // Verified under the expected purpose's key before the body is parsed. subtle.verify is constant-time.\n  const valid = await crypto.subtle.verify(\n    \"HMAC\",\n    await hmacKey(secret, purpose),\n    signature,\n    encoder.encode(body),\n  );\n  if (!valid) return null;\n\n  const decoded = decodeBase64Url(body);\n  if (!decoded) return null;\n\n  let claims: TokenClaims;\n  try {\n    claims = JSON.parse(decoded) as TokenClaims;\n  } catch {\n    return null;\n  }\n\n  if (typeof claims?.uid !== \"string\" || typeof claims.exp !== \"number\") return null;\n  if (claims.purpose !== purpose) return null;\n  if (claims.exp * 1000 <= now.getTime()) return null;\n  if (claims.iat !== undefined && typeof claims.iat !== \"number\") return null;\n\n  if (claims.data !== undefined) {\n    if (typeof claims.data !== \"object\" || claims.data === null || Array.isArray(claims.data)) {\n      return null;\n    }\n    for (const value of Object.values(claims.data)) {\n      if (typeof value !== \"string\") return null;\n    }\n  }\n\n  return claims;\n}\n\nexport const DEFAULT_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;\n/** Ninety days. A link that must outlive this should be re-issued, not made immortal. */\nexport const MAX_TOKEN_TTL_SECONDS = 90 * 24 * 60 * 60;\n\nexport const expiresIn = (seconds: number, now: Date = new Date()): number =>\n  Math.floor(now.getTime() / 1000) + Math.min(Math.max(seconds, 0), MAX_TOKEN_TTL_SECONDS);\n\nexport type SignRequest = {\n  uid: string;\n  purpose: string;\n  data?: Record<string, string>;\n  /** Defaults to 30 days, capped at 90. */\n  ttlSeconds?: number;\n};\n\n/** What a plugin gets instead of the secret: signs only its own declared purposes. */\nexport function createScopedSigner(\n  secret: string,\n  pluginId: string,\n  purposes: ReadonlySet<string>,\n  onViolation: (message: string) => Error,\n): (request: SignRequest) => Promise<string> {\n  return (request) => {\n    if (!purposes.has(request.purpose)) {\n      throw onViolation(\n        `plugin \"${pluginId}\" tried to sign a token for purpose \"${request.purpose}\", ` +\n          \"which none of its signed routes declare.\",\n      );\n    }\n    return signToken(secret, {\n      uid: request.uid,\n      purpose: request.purpose,\n      exp: expiresIn(request.ttlSeconds ?? DEFAULT_TOKEN_TTL_SECONDS),\n      ...(request.data ? { data: request.data } : {}),\n    });\n  };\n}\n","import type { DatabaseAdapter } from \"./adapter\";\nimport type { SessionConfig } from \"./config\";\nimport type { Logger } from \"./errors\";\nimport type { Promisable, RouteDefinition } from \"./plugin\";\nimport type { Runner } from \"./runner\";\nimport { inboxChannel, type Signals } from \"./signals\";\nimport { verifyToken } from \"./tokens\";\n\nexport type EventsSettings = {\n  heartbeatMs: number;\n  probeIntervalMs: number;\n  maxDurationMs: number;\n  maxStreamsPerUser: number;\n  maxStreams: number;\n};\n\n/** Unread chunks a stream may hold before it is closed on a consumer that stopped reading. */\nconst STREAM_HIGH_WATER_MARK = 256;\n\nexport type HandlerDeps = {\n  adapter: DatabaseAdapter;\n  session: SessionConfig;\n  runner: Runner;\n  logger: Logger;\n  basePath: string;\n  secret: string;\n  signals: Signals;\n  /** `false` unmounts GET /events. */\n  events: EventsSettings | false;\n  /** Fire-and-forget delivery pass after a request. Rate-limited by the instance. */\n  sweepOnRequest?: (() => void) | undefined;\n  cronSecret?: string | undefined;\n  /** Guards plugin machine routes. The instance defaults it to cronSecret. */\n  machineSecret?: string | undefined;\n  cronMaxSweeps?: number | undefined;\n  pluginRoutes?: readonly RouteDefinition[] | undefined;\n  /** Returns a 429 to send, or null to proceed. Runs after onRequest, before routing. */\n  rateLimit?: ((request: Request) => Response | null) | undefined;\n  /** Origins other than the request's own host that may POST. `*.example.com` allowed. */\n  trustedOrigins?: readonly string[] | undefined;\n  /** Runs before routing. Returning a Response short-circuits; use it for rate limiting. */\n  // biome-ignore lint/suspicious/noConfusingVoidType: a hook that returns nothing is the common case\n  onRequest?: ((request: Request) => Promisable<Response | undefined | void>) | undefined;\n  maxBodyBytes?: number | undefined;\n};\n\n/** Every JSON body is capped here. Nothing legitimate the routes accept is bigger. */\nexport const MAX_BODY_BYTES = 64 * 1024;\n\nconst MAX_READ_IDS = 200;\n\n// Per-user data: no shared caching, no sniffing.\nconst PRIVATE_HEADERS: Record<string, string> = {\n  \"cache-control\": \"private, no-store\",\n  \"x-content-type-options\": \"nosniff\",\n};\n\nconst json = (body: unknown, status = 200, headers: Record<string, string> = {}) =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: { \"content-type\": \"application/json\", ...PRIVATE_HEADERS, ...headers },\n  });\n\nconst empty = (status: number) => new Response(null, { status, headers: PRIVATE_HEADERS });\n\n/** Plugin responses get the same headers, without touching their body. */\nfunction harden(response: Response): Response {\n  const headers = new Headers(response.headers);\n  for (const [name, value] of Object.entries(PRIVATE_HEADERS)) {\n    if (!headers.has(name)) headers.set(name, value);\n  }\n  return new Response(response.body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n  });\n}\n\nconst encoder = new TextEncoder();\n\n/** Constant time over SHA-256 digests, so neither content nor length leaks. Works on edge runtimes. */\nasync function timingSafeEqual(a: string, b: string): Promise<boolean> {\n  const [left, right] = await Promise.all(\n    [a, b].map(\n      async (value) => new Uint8Array(await crypto.subtle.digest(\"SHA-256\", encoder.encode(value))),\n    ),\n  );\n  let diff = 0;\n  for (let i = 0; i < 32; i += 1) diff |= (left?.[i] ?? 0) ^ (right?.[i] ?? 0);\n  return diff === 0;\n}\n\n/** Anchored at a segment boundary: `/foo/api/notifications/cron` is not a cron request. */\nfunction routePath(url: URL, basePath: string): string {\n  const { pathname } = url;\n  if (pathname === basePath) return \"/\";\n  if (pathname.startsWith(`${basePath}/`)) return pathname.slice(basePath.length);\n  return pathname;\n}\n\nexport type JsonBody = { body: Record<string, unknown> } | { error: Response };\n\n/** Reads a JSON object body with a streaming byte cap. Malformed JSON is 400; an empty body is `{}`. */\nexport async function readJsonBody(\n  request: Request,\n  maxBytes: number = MAX_BODY_BYTES,\n): Promise<JsonBody> {\n  const tooLarge = () => ({ error: json({ error: `body exceeds ${maxBytes} bytes` }, 413) });\n\n  const declared = Number(request.headers.get(\"content-length\"));\n  if (Number.isFinite(declared) && declared > maxBytes) return tooLarge();\n  if (!request.body) return { body: {} };\n\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    total += value.byteLength;\n    if (total > maxBytes) {\n      await reader.cancel();\n      return tooLarge();\n    }\n    chunks.push(value);\n  }\n\n  const bytes = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n\n  const text = new TextDecoder().decode(bytes);\n  if (text.trim() === \"\") return { body: {} };\n\n  try {\n    const parsed: unknown = JSON.parse(text);\n    return {\n      body:\n        parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n          ? (parsed as Record<string, unknown>)\n          : {},\n    };\n  } catch {\n    return { error: json({ error: \"body must be a JSON object\" }, 400) };\n  }\n}\n\nconst isJsonContentType = (request: Request) =>\n  /^application\\/json\\s*(;|$)/i.test((request.headers.get(\"content-type\") ?? \"\").trim());\n\nfunction originAllowed(origin: string, url: URL, request: Request, trusted: readonly string[]) {\n  let host: string;\n  try {\n    host = new URL(origin).host;\n  } catch {\n    return false;\n  }\n\n  if (host === url.host) return true;\n  // Behind a proxy that rewrites Host, the public host arrives here instead.\n  const forwarded = request.headers.get(\"x-forwarded-host\")?.split(\",\")[0]?.trim();\n  if (forwarded && host === forwarded) return true;\n\n  return trusted.some((entry) =>\n    entry.startsWith(\"*.\") ? host.endsWith(entry.slice(1)) : entry === origin,\n  );\n}\n\n/** CSRF: a cross-site form can neither send `application/json` without a preflight nor forge `Origin`. */\nfunction csrfCheck(request: Request, url: URL, trusted: readonly string[]): Response | null {\n  if (!isJsonContentType(request)) {\n    return json({ error: \"content-type must be application/json\" }, 415);\n  }\n\n  const origin = request.headers.get(\"origin\");\n  if (origin === null) return null;\n  if (origin === \"null\" || !originAllowed(origin, url, request, trusted)) return empty(403);\n\n  return null;\n}\n\nexport function createHandler(deps: HandlerDeps) {\n  const trustedOrigins = deps.trustedOrigins ?? [];\n  const maxBodyBytes = deps.maxBodyBytes ?? MAX_BODY_BYTES;\n\n  async function resolveUserId(request: Request): Promise<string | null | \"error\"> {\n    try {\n      return await deps.session.getUserId(request);\n    } catch (error) {\n      // A broken session lookup is a 500, never a 401. RFC 0002 §1.\n      deps.logger.error(\"session.getUserId threw\", { error });\n      return \"error\";\n    }\n  }\n\n  async function bearerMatches(request: Request, secret: string | undefined): Promise<boolean> {\n    if (!secret) return false;\n    const header = request.headers.get(\"authorization\") ?? \"\";\n    const presented = header.startsWith(\"Bearer \") ? header.slice(7) : header;\n    return timingSafeEqual(presented, secret);\n  }\n\n  async function handleCron(request: Request): Promise<Response> {\n    if (!deps.cronSecret) return empty(404);\n    if (!(await bearerMatches(request, deps.cronSecret))) return empty(401);\n\n    // Bounded so an overlapping scheduler does not hold a request open for the whole backlog.\n    const result = await deps.runner.drain(\n      deps.cronMaxSweeps === undefined ? {} : { maxSweeps: deps.cronMaxSweeps },\n    );\n    return json(result);\n  }\n\n  /** Plugin routes first; auth is enforced here so a plugin cannot forget it. */\n  async function handlePluginRoute(\n    route: RouteDefinition,\n    request: Request,\n    url: URL,\n  ): Promise<Response> {\n    if (route.scope.type === \"user\") {\n      if (request.method === \"POST\") {\n        const rejected = csrfCheck(request, url, trustedOrigins);\n        if (rejected) return rejected;\n      }\n\n      const userId = await resolveUserId(request);\n      if (userId === \"error\") return empty(500);\n      if (userId === null) return empty(401);\n      return harden(await route.handler({ request, userId, claims: null, params: {} }));\n    }\n\n    if (route.scope.type === \"machine\") {\n      if (!deps.machineSecret) return empty(404);\n      if (!(await bearerMatches(request, deps.machineSecret))) return empty(401);\n      return harden(await route.handler({ request, userId: null, claims: null, params: {} }));\n    }\n\n    if (route.scope.type === \"signed\") {\n      const token =\n        url.searchParams.get(\"token\") ??\n        (request.headers.get(\"authorization\") ?? \"\").replace(/^Bearer /, \"\");\n\n      const claims = await verifyToken(deps.secret, token, route.scope.purpose);\n      // One response for every failure mode. RFC 0002 §5.\n      if (!claims) return empty(400);\n\n      return harden(await route.handler({ request, userId: claims.uid, claims, params: {} }));\n    }\n\n    return harden(await route.handler({ request, userId: null, claims: null, params: {} }));\n  }\n\n  async function route(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    const path = routePath(url, deps.basePath);\n\n    if (deps.onRequest) {\n      const early = await deps.onRequest(request);\n      if (early instanceof Response) return early;\n    }\n\n    if (deps.rateLimit) {\n      const limited = deps.rateLimit(request);\n      if (limited) return limited;\n    }\n\n    if (path === \"/cron\") {\n      if (request.method !== \"POST\") return empty(405);\n      return handleCron(request);\n    }\n\n    const pluginRoute = deps.pluginRoutes?.find(\n      (candidate) => candidate.path === path && candidate.method === request.method,\n    );\n    if (pluginRoute) return handlePluginRoute(pluginRoute, request, url);\n\n    if (request.method === \"POST\") {\n      const rejected = csrfCheck(request, url, trustedOrigins);\n      if (rejected) return rejected;\n    }\n\n    const userId = await resolveUserId(request);\n    if (userId === \"error\") return empty(500);\n    if (userId === null) return empty(401);\n\n    if (request.method === \"GET\" && path === \"/events\") {\n      if (!deps.events) return empty(404);\n      // A session can open streams for free; without a cap one account can hold every socket.\n      if ((openStreams.get(userId) ?? 0) >= deps.events.maxStreamsPerUser) {\n        return json({ error: \"too many open event streams\" }, 429, { \"retry-after\": \"30\" });\n      }\n      if (totalStreams >= deps.events.maxStreams) {\n        return json({ error: \"event streams unavailable\" }, 503, { \"retry-after\": \"30\" });\n      }\n      return events(request, userId, deps.events);\n    }\n\n    if (request.method === \"GET\" && path === \"/\") {\n      const limitParam = Number(url.searchParams.get(\"limit\") ?? 20);\n      const limit = Number.isFinite(limitParam) ? Math.min(Math.max(limitParam, 1), 100) : 20;\n      const cursor = url.searchParams.get(\"cursor\");\n\n      // unseenCount rides on the first page only: a cursor request is scrollback, not a poll.\n      const [page, unseenCount] = await Promise.all([\n        deps.adapter.listNotifications({\n          userId,\n          limit,\n          ...(cursor ? { cursor } : {}),\n          ...(url.searchParams.get(\"unreadOnly\") === \"true\" ? { unreadOnly: true } : {}),\n        }),\n        cursor ? Promise.resolve(null) : deps.adapter.countUnseen(userId),\n      ]);\n\n      return json(unseenCount === null ? page : { ...page, unseenCount });\n    }\n\n    if (request.method === \"GET\" && path === \"/count\") {\n      return json({ unseen: await deps.adapter.countUnseen(userId) });\n    }\n\n    if (request.method === \"POST\" && path === \"/seen\") {\n      const parsed = await readJsonBody(request, maxBodyBytes);\n      if (\"error\" in parsed) return parsed.error;\n      const before = typeof parsed.body.before === \"string\" ? new Date(parsed.body.before) : null;\n\n      // +1ms: Postgres keeps microseconds, an ISO string milliseconds; without it markSeen misses the newest row.\n      const cutoff =\n        before && !Number.isNaN(before.getTime()) ? new Date(before.getTime() + 1) : new Date();\n\n      await deps.adapter.markSeen(userId, cutoff);\n      deps.signals.publish(inboxChannel(userId));\n      return json({ ok: true });\n    }\n\n    if (request.method === \"POST\" && path === \"/read\") {\n      const parsed = await readJsonBody(request, maxBodyBytes);\n      if (\"error\" in parsed) return parsed.error;\n      const ids = Array.isArray(parsed.body.ids)\n        ? parsed.body.ids.filter((id): id is string => typeof id === \"string\")\n        : [];\n      if (ids.length === 0) return json({ error: \"ids must be a non-empty string array\" }, 400);\n\n      if (ids.length > MAX_READ_IDS) {\n        return json({ error: `at most ${MAX_READ_IDS} ids per request` }, 400);\n      }\n\n      // 404, not 403: a 403 confirms the row exists. RFC 0002 §2.\n      const updated = await deps.adapter.markRead(userId, ids);\n      if (updated > 0) deps.signals.publish(inboxChannel(userId));\n      return updated === 0 ? empty(404) : json({ updated });\n    }\n\n    if (request.method === \"POST\" && path === \"/read-all\") {\n      const updated = await deps.adapter.markAllRead(userId);\n      if (updated > 0) deps.signals.publish(inboxChannel(userId));\n      return json({ updated });\n    }\n\n    return empty(404);\n  }\n\n  const openStreams = new Map<string, number>();\n  let totalStreams = 0;\n\n  const trackStream = (userId: string) => {\n    openStreams.set(userId, (openStreams.get(userId) ?? 0) + 1);\n    totalStreams += 1;\n    return () => {\n      const remaining = (openStreams.get(userId) ?? 1) - 1;\n      if (remaining > 0) openStreams.set(userId, remaining);\n      else openStreams.delete(userId);\n      totalStreams -= 1;\n    };\n  };\n\n  /** A change fingerprint cheap enough to take every probe interval. */\n  async function fingerprint(userId: string): Promise<string> {\n    const [page, unseen] = await Promise.all([\n      deps.adapter.listNotifications({ userId, limit: 1 }),\n      deps.adapter.countUnseen(userId),\n    ]);\n    const newest = page.notifications[0];\n    return `${newest?.id ?? \"\"}|${newest?.readAt ? 1 : 0}|${unseen}`;\n  }\n\n  // One probe per user, however many streams that user holds: N tabs must not mean N queries.\n  type Probe = { listeners: Set<() => void>; timer: ReturnType<typeof setInterval>; last?: string };\n  const probes = new Map<string, Probe>();\n\n  function subscribeProbe(userId: string, onChanged: () => void, intervalMs: number) {\n    let probe = probes.get(userId);\n    if (!probe) {\n      const created: Probe = {\n        listeners: new Set(),\n        timer: setInterval(() => {\n          fingerprint(userId)\n            .then((value) => {\n              if (created.last !== undefined && value !== created.last) {\n                for (const listener of created.listeners) listener();\n              }\n              created.last = value;\n            })\n            .catch((error) => deps.logger.error(\"events probe failed\", { error }));\n        }, intervalMs),\n      };\n      probe = created;\n      probes.set(userId, created);\n      fingerprint(userId)\n        .then((value) => {\n          if (created.last === undefined) created.last = value;\n        })\n        .catch(() => {});\n    }\n    probe.listeners.add(onChanged);\n    return () => {\n      const current = probes.get(userId);\n      if (!current) return;\n      current.listeners.delete(onChanged);\n      if (current.listeners.size === 0) {\n        clearInterval(current.timer);\n        probes.delete(userId);\n      }\n    };\n  }\n\n  /**\n   * Server-Sent Events: `ready` once, `changed` whenever this user's inbox\n   * moves, comments as keepalive. No payload ever travels on the stream; the\n   * client fetches the feed on `changed`. RFC 0006 §4D.\n   */\n  function events(request: Request, userId: string, settings: EventsSettings): Response {\n    const encoder = new TextEncoder();\n    const timers: ReturnType<typeof setInterval>[] = [];\n    const unsubscribes: (() => void)[] = [];\n    let closed = false;\n    let cleanup = () => {};\n\n    const stream = new ReadableStream<Uint8Array>(\n      {\n        start(controller) {\n          const write = (text: string) => {\n            if (closed) return;\n            // A consumer that stopped reading would make this queue grow without bound.\n            if (controller.desiredSize !== null && controller.desiredSize <= 0) {\n              cleanup();\n              return;\n            }\n            try {\n              controller.enqueue(encoder.encode(text));\n            } catch {\n              cleanup();\n            }\n          };\n          cleanup = () => {\n            if (closed) return;\n            closed = true;\n            for (const unsubscribe of unsubscribes) unsubscribe();\n            for (const timer of timers) clearInterval(timer);\n            try {\n              controller.close();\n            } catch {\n              // already closed by the consumer\n            }\n          };\n          const changed = () => write(\"event: changed\\ndata: {}\\n\\n\");\n\n          unsubscribes.push(trackStream(userId));\n          write(\"retry: 3000\\n\\nevent: ready\\ndata: {}\\n\\n\");\n          unsubscribes.push(deps.signals.subscribe(inboxChannel(userId), changed));\n          timers.push(setInterval(() => write(\": keepalive\\n\\n\"), settings.heartbeatMs));\n\n          if (!deps.signals.crossProcess && settings.probeIntervalMs > 0) {\n            unsubscribes.push(subscribeProbe(userId, changed, settings.probeIntervalMs));\n          }\n\n          if (settings.maxDurationMs > 0) {\n            timers.push(\n              setTimeout(cleanup, settings.maxDurationMs) as ReturnType<typeof setInterval>,\n            );\n          }\n          request.signal?.addEventListener(\"abort\", cleanup, { once: true });\n        },\n        cancel() {\n          cleanup();\n        },\n      },\n      { highWaterMark: STREAM_HIGH_WATER_MARK },\n    );\n\n    return new Response(stream, {\n      headers: {\n        \"content-type\": \"text/event-stream; charset=utf-8\",\n        \"cache-control\": \"no-cache, no-store\",\n        connection: \"keep-alive\",\n        \"x-accel-buffering\": \"no\",\n        \"x-content-type-options\": \"nosniff\",\n      },\n    });\n  }\n\n  async function handle(request: Request): Promise<Response> {\n    let response: Response | undefined;\n    try {\n      response = await route(request);\n      return response;\n    } catch (error) {\n      // A thrown driver error must not escape: unhandled rejection on Node, stack trace elsewhere.\n      deps.logger.error(\"request failed\", { url: request.url, error });\n      return empty(500);\n    } finally {\n      // Only a served request earns a sweep; anonymous 401s must not drive database work.\n      if (response && response.status < 400) deps.sweepOnRequest?.();\n    }\n  }\n\n  return {\n    handle,\n    GET: handle,\n    POST: handle,\n  };\n}\n","import { readJsonBody } from \"../../core/handler\";\nimport type {\n  ChannelDecision,\n  EasyPingPlugin,\n  PluginInitContext,\n  PrepareContext,\n  ResolveChannelsContext,\n} from \"../../core/plugin\";\nimport { DEFAULT_TOKEN_TTL_SECONDS, expiresIn, signToken } from \"../../core/tokens\";\nimport type { Channel, Frequency } from \"../../core/types\";\n\nexport const UNSUBSCRIBE_PURPOSE = \"unsubscribe\";\n\nconst TABLE = \"notification_preference\";\n\nconst CHANNELS: readonly Channel[] = [\"inApp\", \"email\", \"push\", \"sms\", \"slack\"];\nconst FREQUENCIES: readonly Frequency[] = [\"instant\", \"daily\", \"weekly\", \"off\"];\n\nconst isChannel = (value: unknown): value is Channel => CHANNELS.includes(value as Channel);\nconst isFrequency = (value: unknown): value is Frequency =>\n  FREQUENCIES.includes(value as Frequency);\n\nexport type PreferenceRow = {\n  userId: string;\n  type: string;\n  channel: Channel;\n  enabled: boolean;\n  frequency: Frequency;\n  /** Last explicit change. An unsubscribe token issued before it is refused. */\n  updatedAt?: Date;\n};\n\nexport type PreferencesOptions = {\n  /** What an absent row means. Flip to false for opt-in-only notifications. */\n  defaultEnabled?: boolean;\n  /** Types that ignore preferences entirely: receipts, security alerts. */\n  alwaysSend?: readonly string[];\n  unsubscribeTtlSeconds?: number;\n};\n\nconst key = (userId: string, type: string, channel: string) => `${userId} ${type} ${channel}`;\n\ntype PreparedPreferences = Map<string, PreferenceRow>;\n\nexport function buildUnsubscribeToken(\n  secret: string,\n  userId: string,\n  type: string,\n  channel: Channel,\n  ttlSeconds = DEFAULT_TOKEN_TTL_SECONDS,\n): Promise<string> {\n  return signToken(secret, {\n    uid: userId,\n    purpose: UNSUBSCRIBE_PURPOSE,\n    exp: expiresIn(ttlSeconds),\n    data: { type, channel },\n  });\n}\n\nexport function preferences(options: PreferencesOptions = {}): EasyPingPlugin<\"preferences\"> {\n  const defaultEnabled = options.defaultEnabled ?? true;\n  const alwaysSend = new Set(options.alwaysSend ?? []);\n\n  // Assigned by init(), which easyPing() runs before any hook or route.\n  let ctx: PluginInitContext;\n\n  const isAllowed = (userId: string, type: string, channel: Channel, rows: PreparedPreferences) => {\n    const row = rows.get(key(userId, type, channel));\n    return row ? row.enabled && row.frequency !== \"off\" : defaultEnabled;\n  };\n\n  const load = (userIds: readonly string[]) =>\n    ctx.store.find<PreferenceRow>(TABLE, { userId: { in: [...userIds] } });\n\n  const save = (row: PreferenceRow) =>\n    ctx.store.upsert(TABLE, [{ ...row, updatedAt: new Date() }], {\n      onConflict: [\"userId\", \"type\", \"channel\"],\n    });\n\n  return {\n    id: \"preferences\",\n\n    init: (context) => {\n      ctx = context;\n    },\n\n    schema: {\n      notificationPreference: {\n        tableName: TABLE,\n        fields: {\n          userId: { type: \"string\", required: true },\n          type: { type: \"string\", required: true },\n          channel: { type: \"string\", required: true },\n          enabled: { type: \"boolean\", required: true, default: true },\n          frequency: { type: \"string\", required: true, default: \"instant\" },\n          updatedAt: { type: \"date\", required: true, defaultNow: true },\n        },\n        primaryKey: [\"userId\", \"type\", \"channel\"],\n      },\n    },\n\n    hooks: {\n      /** One query per send; doing this per recipient would be an N+1. */\n      prepare: async (context: PrepareContext): Promise<PreparedPreferences> => {\n        if (alwaysSend.has(context.type)) return new Map();\n\n        const rows = await load(context.recipients.map((recipient) => recipient.userId));\n        return new Map(rows.map((row) => [key(row.userId, row.type, row.channel), row]));\n      },\n\n      resolveChannels: (context: ResolveChannelsContext) => {\n        if (alwaysSend.has(context.type)) return context.decisions;\n\n        // prepare() failed: fail closed rather than assume everyone opted in.\n        if (!(context.prepared instanceof Map)) {\n          return context.decisions.map((decision) => ({ ...decision, action: \"skip\" as const }));\n        }\n\n        const rows = context.prepared as PreparedPreferences;\n\n        return context.decisions.map<ChannelDecision>((decision) =>\n          isAllowed(context.recipient.userId, context.type, decision.channel, rows)\n            ? decision\n            : { ...decision, action: \"skip\" },\n        );\n      },\n    },\n\n    routes: [\n      {\n        path: \"/preferences\",\n        method: \"GET\",\n        scope: { type: \"user\" },\n        handler: async ({ userId }) => {\n          const rows = await load([userId ?? \"\"]);\n          return Response.json({ preferences: rows, defaultEnabled });\n        },\n      },\n\n      {\n        path: \"/preferences\",\n        method: \"POST\",\n        scope: { type: \"user\" },\n        handler: async ({ request, userId }) => {\n          const parsed = await readJsonBody(request);\n          if (\"error\" in parsed) return parsed.error;\n          const body = parsed.body;\n\n          const bad = (error: string) => Response.json({ error }, { status: 400 });\n\n          // Only configured types, or every invented string becomes a row.\n          if (typeof body.type !== \"string\" || !ctx.notificationTypes.includes(body.type)) {\n            return bad(\"type must be a configured notification type\");\n          }\n          if (!isChannel(body.channel)) return bad(`channel must be one of ${CHANNELS.join(\", \")}`);\n          if (body.enabled !== undefined && typeof body.enabled !== \"boolean\") {\n            return bad(\"enabled must be a boolean\");\n          }\n          if (body.frequency !== undefined && !isFrequency(body.frequency)) {\n            return bad(`frequency must be one of ${FREQUENCIES.join(\", \")}`);\n          }\n\n          // userId comes from the resolved session, never from the body.\n          await save({\n            userId: userId ?? \"\",\n            type: body.type,\n            channel: body.channel,\n            enabled: body.enabled ?? true,\n            frequency: body.frequency ?? \"instant\",\n          });\n\n          return Response.json({ ok: true });\n        },\n      },\n\n      {\n        // No session in a mail client; the link carries the proof.\n        path: \"/unsubscribe\",\n        method: \"POST\",\n        scope: { type: \"signed\", purpose: UNSUBSCRIBE_PURPOSE },\n        handler: async ({ claims }) => {\n          const type = claims?.data?.type;\n          const channel = claims?.data?.channel;\n          if (!claims || !type || !isChannel(channel)) {\n            return Response.json({ error: \"invalid token\" }, { status: 400 });\n          }\n\n          const [current] = await ctx.store.find<PreferenceRow>(\n            TABLE,\n            { userId: claims.uid, type, channel },\n            { limit: 1 },\n          );\n\n          // Already off: a second click, or a mail client retrying, is fine.\n          if (current && !current.enabled && current.frequency === \"off\") {\n            return Response.json({ ok: true, unsubscribed: { type, channel } });\n          }\n\n          // Changed after the email went out: an old link must not undo a newer decision.\n          if (\n            current?.updatedAt &&\n            claims.iat !== undefined &&\n            current.updatedAt.getTime() > (claims.iat + 1) * 1000\n          ) {\n            return Response.json({ error: \"invalid token\" }, { status: 400 });\n          }\n\n          await save({\n            userId: claims.uid,\n            type,\n            channel,\n            enabled: false,\n            frequency: \"off\",\n          });\n\n          // One-click (Gmail, Yahoo) requires the POST itself to unsubscribe.\n          return Response.json({ ok: true, unsubscribed: { type, channel } });\n        },\n      },\n    ],\n  };\n}\n"]}

package/dist/plugins/preferences.js

@@ -1,4 +1,5 @@
-import { DEFAULT_TOKEN_TTL_SECONDS, signToken, expiresIn, readJsonBody } from '../chunk-BECMTNK7.js';
+import { DEFAULT_TOKEN_TTL_SECONDS, signToken, expiresIn, readJsonBody } from '../chunk-JOVIZXO6.js';
+import '../chunk-ORZKH224.js';
 import '../chunk-PTGHMCCG.js';
 
 // src/plugins/preferences/index.ts

package/dist/plugins/preferences.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/plugins/preferences/index.ts"],"names":[],"mappings":";;;;AAWO,IAAM,mBAAA,GAAsB;AAEnC,IAAM,KAAA,GAAQ,yBAAA;AAEd,IAAM,WAA+B,CAAC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC9E,IAAM,WAAA,GAAoC,CAAC,SAAA,EAAW,OAAA,EAAS,UAAU,KAAK,CAAA;AAE9E,IAAM,SAAA,GAAY,CAAC,KAAA,KAAqC,QAAA,CAAS,SAAS,KAAgB,CAAA;AAC1F,IAAM,WAAA,GAAc,CAAC,KAAA,KACnB,WAAA,CAAY,SAAS,KAAkB,CAAA;AAoBzC,IAAM,GAAA,GAAM,CAAC,MAAA,EAAgB,IAAA,EAAc,OAAA,KAAoB,GAAG,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAIpF,SAAS,sBACd,MAAA,EACA,MAAA,EACA,IAAA,EACA,OAAA,EACA,aAAa,yBAAA,EACI;AACjB,EAAA,OAAO,UAAU,MAAA,EAAQ;AAAA,IACvB,GAAA,EAAK,MAAA;AAAA,IACL,OAAA,EAAS,mBAAA;AAAA,IACT,GAAA,EAAK,UAAU,UAAU,CAAA;AAAA,IACzB,IAAA,EAAM,EAAE,IAAA,EAAM,OAAA;AAAQ,GACvB,CAAA;AACH;AAEO,SAAS,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAkC;AAC3F,EAAA,MAAM,cAAA,GAAiB,QAAQ,cAAA,IAAkB,IAAA;AACjD,EAAA,MAAM,aAAa,IAAI,GAAA,CAAI,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAA;AAGnD,EAAA,IAAI,GAAA;AAEJ,EAAA,MAAM,SAAA,GAAY,CAAC,MAAA,EAAgB,IAAA,EAAc,SAAkB,IAAA,KAA8B;AAC/F,IAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,IAAI,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAC,CAAA;AAC/C,IAAA,OAAO,GAAA,GAAM,GAAA,CAAI,OAAA,IAAW,GAAA,CAAI,cAAc,KAAA,GAAQ,cAAA;AAAA,EACxD,CAAA;AAEA,EAAA,MAAM,OAAO,CAAC,OAAA,KACZ,GAAA,CAAI,KAAA,CAAM,KAAoB,KAAA,EAAO,EAAE,MAAA,EAAQ,EAAE,IAAI,CAAC,GAAG,OAAO,CAAA,IAAK,CAAA;AAEvE,EAAA,MAAM,OAAO,CAAC,GAAA,KACZ,GAAA,CAAI,KAAA,CAAM,OAAO,KAAA,EAAO,CAAC,EAAE,GAAG,KAAK,SAAA,kBAAW,IAAI,IAAA,EAAK,EAAG,CAAA,EAAG;AAAA,IAC3D,UAAA,EAAY,CAAC,QAAA,EAAU,MAAA,EAAQ,SAAS;AAAA,GACzC,CAAA;AAEH,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,aAAA;AAAA,IAEJ,IAAA,EAAM,CAAC,OAAA,KAAY;AACjB,MAAA,GAAA,GAAM,OAAA;AAAA,IACR,CAAA;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN,sBAAA,EAAwB;AAAA,QACtB,SAAA,EAAW,KAAA;AAAA,QACX,MAAA,EAAQ;AAAA,UACN,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UACzC,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UACvC,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UAC1C,SAAS,EAAE,IAAA,EAAM,WAAW,QAAA,EAAU,IAAA,EAAM,SAAS,IAAA,EAAK;AAAA,UAC1D,WAAW,EAAE,IAAA,EAAM,UAAU,QAAA,EAAU,IAAA,EAAM,SAAS,SAAA,EAAU;AAAA,UAChE,WAAW,EAAE,IAAA,EAAM,QAAQ,QAAA,EAAU,IAAA,EAAM,YAAY,IAAA;AAAK,SAC9D;AAAA,QACA,UAAA,EAAY,CAAC,QAAA,EAAU,MAAA,EAAQ,SAAS;AAAA;AAC1C,KACF;AAAA,IAEA,KAAA,EAAO;AAAA;AAAA,MAEL,OAAA,EAAS,OAAO,OAAA,KAA0D;AACxE,QAAA,IAAI,WAAW,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG,2BAAW,GAAA,EAAI;AAEjD,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAC,SAAA,KAAc,SAAA,CAAU,MAAM,CAAC,CAAA;AAC/E,QAAA,OAAO,IAAI,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,CAAC,QAAQ,CAAC,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,IAAI,IAAA,EAAM,GAAA,CAAI,OAAO,CAAA,EAAG,GAAG,CAAC,CAAC,CAAA;AAAA,MACjF,CAAA;AAAA,MAEA,eAAA,EAAiB,CAAC,OAAA,KAAoC;AACpD,QAAA,IAAI,WAAW,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,SAAU,OAAA,CAAQ,SAAA;AAGjD,QAAA,IAAI,EAAE,OAAA,CAAQ,QAAA,YAAoB,GAAA,CAAA,EAAM;AACtC,UAAA,OAAO,OAAA,CAAQ,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,MAAc,EAAE,GAAG,QAAA,EAAU,MAAA,EAAQ,MAAA,EAAgB,CAAE,CAAA;AAAA,QACvF;AAEA,QAAA,MAAM,OAAO,OAAA,CAAQ,QAAA;AAErB,QAAA,OAAO,QAAQ,SAAA,CAAU,GAAA;AAAA,UAAqB,CAAC,QAAA,KAC7C,SAAA,CAAU,OAAA,CAAQ,SAAA,CAAU,QAAQ,OAAA,CAAQ,IAAA,EAAM,QAAA,CAAS,OAAA,EAAS,IAAI,CAAA,GACpE,QAAA,GACA,EAAE,GAAG,QAAA,EAAU,QAAQ,MAAA;AAAO,SACpC;AAAA,MACF;AAAA,KACF;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,KAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,QACtB,OAAA,EAAS,OAAO,EAAE,MAAA,EAAO,KAAM;AAC7B,UAAA,MAAM,OAAO,MAAM,IAAA,CAAK,CAAC,MAAA,IAAU,EAAE,CAAC,CAAA;AACtC,UAAA,OAAO,SAAS,IAAA,CAAK,EAAE,WAAA,EAAa,IAAA,EAAM,gBAAgB,CAAA;AAAA,QAC5D;AAAA,OACF;AAAA,MAEA;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,MAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,QACtB,OAAA,EAAS,OAAO,EAAE,OAAA,EAAS,QAAO,KAAM;AACtC,UAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAO,CAAA;AACzC,UAAA,IAAI,OAAA,IAAW,MAAA,EAAQ,OAAO,MAAA,CAAO,KAAA;AACrC,UAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AAEpB,UAAA,MAAM,GAAA,GAAM,CAAC,KAAA,KAAkB,QAAA,CAAS,IAAA,CAAK,EAAE,KAAA,EAAM,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAGvE,UAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,IAAY,CAAC,IAAI,iBAAA,CAAkB,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,EAAG;AAC/E,YAAA,OAAO,IAAI,6CAA6C,CAAA;AAAA,UAC1D;AACA,UAAA,IAAI,CAAC,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,GAAA,CAAI,CAAA,uBAAA,EAA0B,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AACxF,UAAA,IAAI,KAAK,OAAA,KAAY,MAAA,IAAa,OAAO,IAAA,CAAK,YAAY,SAAA,EAAW;AACnE,YAAA,OAAO,IAAI,2BAA2B,CAAA;AAAA,UACxC;AACA,UAAA,IAAI,KAAK,SAAA,KAAc,MAAA,IAAa,CAAC,WAAA,CAAY,IAAA,CAAK,SAAS,CAAA,EAAG;AAChE,YAAA,OAAO,IAAI,CAAA,yBAAA,EAA4B,WAAA,CAAY,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,UACjE;AAGA,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,QAAQ,MAAA,IAAU,EAAA;AAAA,YAClB,MAAM,IAAA,CAAK,IAAA;AAAA,YACX,SAAS,IAAA,CAAK,OAAA;AAAA,YACd,OAAA,EAAS,KAAK,OAAA,IAAW,IAAA;AAAA,YACzB,SAAA,EAAW,KAAK,SAAA,IAAa;AAAA,WAC9B,CAAA;AAED,UAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,QACnC;AAAA,OACF;AAAA,MAEA;AAAA;AAAA,QAEE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,MAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,mBAAA,EAAoB;AAAA,QACtD,OAAA,EAAS,OAAO,EAAE,MAAA,EAAO,KAAM;AAC7B,UAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,EAAM,IAAA;AAC3B,UAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,EAAM,OAAA;AAC9B,UAAA,IAAI,CAAC,MAAA,IAAU,CAAC,QAAQ,CAAC,SAAA,CAAU,OAAO,CAAA,EAAG;AAC3C,YAAA,OAAO,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,iBAAgB,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,IAAI,KAAA,CAAM,IAAA;AAAA,YAChC,KAAA;AAAA,YACA,EAAE,MAAA,EAAQ,MAAA,CAAO,GAAA,EAAK,MAAM,OAAA,EAAQ;AAAA,YACpC,EAAE,OAAO,CAAA;AAAE,WACb;AAGA,UAAA,IAAI,WAAW,CAAC,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,cAAc,KAAA,EAAO;AAC9D,YAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,cAAc,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,CAAA;AAAA,UACpE;AAGA,UAAA,IACE,OAAA,EAAS,SAAA,IACT,MAAA,CAAO,GAAA,KAAQ,MAAA,IACf,OAAA,CAAQ,SAAA,CAAU,OAAA,EAAQ,GAAA,CAAK,MAAA,CAAO,GAAA,GAAM,CAAA,IAAK,GAAA,EACjD;AACA,YAAA,OAAO,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,iBAAgB,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,QAAQ,MAAA,CAAO,GAAA;AAAA,YACf,IAAA;AAAA,YACA,OAAA;AAAA,YACA,OAAA,EAAS,KAAA;AAAA,YACT,SAAA,EAAW;AAAA,WACZ,CAAA;AAGD,UAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,cAAc,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,CAAA;AAAA,QACpE;AAAA;AACF;AACF,GACF;AACF","file":"preferences.js","sourcesContent":["import { readJsonBody } from \"../../core/handler\";\nimport type {\n  ChannelDecision,\n  EasyPingPlugin,\n  PluginInitContext,\n  PrepareContext,\n  ResolveChannelsContext,\n} from \"../../core/plugin\";\nimport { DEFAULT_TOKEN_TTL_SECONDS, expiresIn, signToken } from \"../../core/tokens\";\nimport type { Channel, Frequency } from \"../../core/types\";\n\nexport const UNSUBSCRIBE_PURPOSE = \"unsubscribe\";\n\nconst TABLE = \"notification_preference\";\n\nconst CHANNELS: readonly Channel[] = [\"inApp\", \"email\", \"push\", \"sms\", \"slack\"];\nconst FREQUENCIES: readonly Frequency[] = [\"instant\", \"daily\", \"weekly\", \"off\"];\n\nconst isChannel = (value: unknown): value is Channel => CHANNELS.includes(value as Channel);\nconst isFrequency = (value: unknown): value is Frequency =>\n  FREQUENCIES.includes(value as Frequency);\n\nexport type PreferenceRow = {\n  userId: string;\n  type: string;\n  channel: Channel;\n  enabled: boolean;\n  frequency: Frequency;\n  /** Last explicit change. An unsubscribe token issued before it is refused. */\n  updatedAt?: Date;\n};\n\nexport type PreferencesOptions = {\n  /** What an absent row means. Flip to false for opt-in-only notifications. */\n  defaultEnabled?: boolean;\n  /** Types that ignore preferences entirely: receipts, security alerts. */\n  alwaysSend?: readonly string[];\n  unsubscribeTtlSeconds?: number;\n};\n\nconst key = (userId: string, type: string, channel: string) => `${userId} ${type} ${channel}`;\n\ntype PreparedPreferences = Map<string, PreferenceRow>;\n\nexport function buildUnsubscribeToken(\n  secret: string,\n  userId: string,\n  type: string,\n  channel: Channel,\n  ttlSeconds = DEFAULT_TOKEN_TTL_SECONDS,\n): Promise<string> {\n  return signToken(secret, {\n    uid: userId,\n    purpose: UNSUBSCRIBE_PURPOSE,\n    exp: expiresIn(ttlSeconds),\n    data: { type, channel },\n  });\n}\n\nexport function preferences(options: PreferencesOptions = {}): EasyPingPlugin<\"preferences\"> {\n  const defaultEnabled = options.defaultEnabled ?? true;\n  const alwaysSend = new Set(options.alwaysSend ?? []);\n\n  // Assigned by init(), which easyPing() runs before any hook or route.\n  let ctx: PluginInitContext;\n\n  const isAllowed = (userId: string, type: string, channel: Channel, rows: PreparedPreferences) => {\n    const row = rows.get(key(userId, type, channel));\n    return row ? row.enabled && row.frequency !== \"off\" : defaultEnabled;\n  };\n\n  const load = (userIds: readonly string[]) =>\n    ctx.store.find<PreferenceRow>(TABLE, { userId: { in: [...userIds] } });\n\n  const save = (row: PreferenceRow) =>\n    ctx.store.upsert(TABLE, [{ ...row, updatedAt: new Date() }], {\n      onConflict: [\"userId\", \"type\", \"channel\"],\n    });\n\n  return {\n    id: \"preferences\",\n\n    init: (context) => {\n      ctx = context;\n    },\n\n    schema: {\n      notificationPreference: {\n        tableName: TABLE,\n        fields: {\n          userId: { type: \"string\", required: true },\n          type: { type: \"string\", required: true },\n          channel: { type: \"string\", required: true },\n          enabled: { type: \"boolean\", required: true, default: true },\n          frequency: { type: \"string\", required: true, default: \"instant\" },\n          updatedAt: { type: \"date\", required: true, defaultNow: true },\n        },\n        primaryKey: [\"userId\", \"type\", \"channel\"],\n      },\n    },\n\n    hooks: {\n      /** One query per send; doing this per recipient would be an N+1. */\n      prepare: async (context: PrepareContext): Promise<PreparedPreferences> => {\n        if (alwaysSend.has(context.type)) return new Map();\n\n        const rows = await load(context.recipients.map((recipient) => recipient.userId));\n        return new Map(rows.map((row) => [key(row.userId, row.type, row.channel), row]));\n      },\n\n      resolveChannels: (context: ResolveChannelsContext) => {\n        if (alwaysSend.has(context.type)) return context.decisions;\n\n        // prepare() failed: fail closed rather than assume everyone opted in.\n        if (!(context.prepared instanceof Map)) {\n          return context.decisions.map((decision) => ({ ...decision, action: \"skip\" as const }));\n        }\n\n        const rows = context.prepared as PreparedPreferences;\n\n        return context.decisions.map<ChannelDecision>((decision) =>\n          isAllowed(context.recipient.userId, context.type, decision.channel, rows)\n            ? decision\n            : { ...decision, action: \"skip\" },\n        );\n      },\n    },\n\n    routes: [\n      {\n        path: \"/preferences\",\n        method: \"GET\",\n        scope: { type: \"user\" },\n        handler: async ({ userId }) => {\n          const rows = await load([userId ?? \"\"]);\n          return Response.json({ preferences: rows, defaultEnabled });\n        },\n      },\n\n      {\n        path: \"/preferences\",\n        method: \"POST\",\n        scope: { type: \"user\" },\n        handler: async ({ request, userId }) => {\n          const parsed = await readJsonBody(request);\n          if (\"error\" in parsed) return parsed.error;\n          const body = parsed.body;\n\n          const bad = (error: string) => Response.json({ error }, { status: 400 });\n\n          // Only configured types, or every invented string becomes a row.\n          if (typeof body.type !== \"string\" || !ctx.notificationTypes.includes(body.type)) {\n            return bad(\"type must be a configured notification type\");\n          }\n          if (!isChannel(body.channel)) return bad(`channel must be one of ${CHANNELS.join(\", \")}`);\n          if (body.enabled !== undefined && typeof body.enabled !== \"boolean\") {\n            return bad(\"enabled must be a boolean\");\n          }\n          if (body.frequency !== undefined && !isFrequency(body.frequency)) {\n            return bad(`frequency must be one of ${FREQUENCIES.join(\", \")}`);\n          }\n\n          // userId comes from the resolved session, never from the body.\n          await save({\n            userId: userId ?? \"\",\n            type: body.type,\n            channel: body.channel,\n            enabled: body.enabled ?? true,\n            frequency: body.frequency ?? \"instant\",\n          });\n\n          return Response.json({ ok: true });\n        },\n      },\n\n      {\n        // No session in a mail client; the link carries the proof.\n        path: \"/unsubscribe\",\n        method: \"POST\",\n        scope: { type: \"signed\", purpose: UNSUBSCRIBE_PURPOSE },\n        handler: async ({ claims }) => {\n          const type = claims?.data?.type;\n          const channel = claims?.data?.channel;\n          if (!claims || !type || !isChannel(channel)) {\n            return Response.json({ error: \"invalid token\" }, { status: 400 });\n          }\n\n          const [current] = await ctx.store.find<PreferenceRow>(\n            TABLE,\n            { userId: claims.uid, type, channel },\n            { limit: 1 },\n          );\n\n          // Already off: a second click, or a mail client retrying, is fine.\n          if (current && !current.enabled && current.frequency === \"off\") {\n            return Response.json({ ok: true, unsubscribed: { type, channel } });\n          }\n\n          // Changed after the email went out: an old link must not undo a newer decision.\n          if (\n            current?.updatedAt &&\n            claims.iat !== undefined &&\n            current.updatedAt.getTime() > (claims.iat + 1) * 1000\n          ) {\n            return Response.json({ error: \"invalid token\" }, { status: 400 });\n          }\n\n          await save({\n            userId: claims.uid,\n            type,\n            channel,\n            enabled: false,\n            frequency: \"off\",\n          });\n\n          // One-click (Gmail, Yahoo) requires the POST itself to unsubscribe.\n          return Response.json({ ok: true, unsubscribed: { type, channel } });\n        },\n      },\n    ],\n  };\n}\n"]}
+{"version":3,"sources":["../../src/plugins/preferences/index.ts"],"names":[],"mappings":";;;;;AAWO,IAAM,mBAAA,GAAsB;AAEnC,IAAM,KAAA,GAAQ,yBAAA;AAEd,IAAM,WAA+B,CAAC,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,OAAO,OAAO,CAAA;AAC9E,IAAM,WAAA,GAAoC,CAAC,SAAA,EAAW,OAAA,EAAS,UAAU,KAAK,CAAA;AAE9E,IAAM,SAAA,GAAY,CAAC,KAAA,KAAqC,QAAA,CAAS,SAAS,KAAgB,CAAA;AAC1F,IAAM,WAAA,GAAc,CAAC,KAAA,KACnB,WAAA,CAAY,SAAS,KAAkB,CAAA;AAoBzC,IAAM,GAAA,GAAM,CAAC,MAAA,EAAgB,IAAA,EAAc,OAAA,KAAoB,GAAG,MAAM,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAIpF,SAAS,sBACd,MAAA,EACA,MAAA,EACA,IAAA,EACA,OAAA,EACA,aAAa,yBAAA,EACI;AACjB,EAAA,OAAO,UAAU,MAAA,EAAQ;AAAA,IACvB,GAAA,EAAK,MAAA;AAAA,IACL,OAAA,EAAS,mBAAA;AAAA,IACT,GAAA,EAAK,UAAU,UAAU,CAAA;AAAA,IACzB,IAAA,EAAM,EAAE,IAAA,EAAM,OAAA;AAAQ,GACvB,CAAA;AACH;AAEO,SAAS,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAkC;AAC3F,EAAA,MAAM,cAAA,GAAiB,QAAQ,cAAA,IAAkB,IAAA;AACjD,EAAA,MAAM,aAAa,IAAI,GAAA,CAAI,OAAA,CAAQ,UAAA,IAAc,EAAE,CAAA;AAGnD,EAAA,IAAI,GAAA;AAEJ,EAAA,MAAM,SAAA,GAAY,CAAC,MAAA,EAAgB,IAAA,EAAc,SAAkB,IAAA,KAA8B;AAC/F,IAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,IAAI,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAC,CAAA;AAC/C,IAAA,OAAO,GAAA,GAAM,GAAA,CAAI,OAAA,IAAW,GAAA,CAAI,cAAc,KAAA,GAAQ,cAAA;AAAA,EACxD,CAAA;AAEA,EAAA,MAAM,OAAO,CAAC,OAAA,KACZ,GAAA,CAAI,KAAA,CAAM,KAAoB,KAAA,EAAO,EAAE,MAAA,EAAQ,EAAE,IAAI,CAAC,GAAG,OAAO,CAAA,IAAK,CAAA;AAEvE,EAAA,MAAM,OAAO,CAAC,GAAA,KACZ,GAAA,CAAI,KAAA,CAAM,OAAO,KAAA,EAAO,CAAC,EAAE,GAAG,KAAK,SAAA,kBAAW,IAAI,IAAA,EAAK,EAAG,CAAA,EAAG;AAAA,IAC3D,UAAA,EAAY,CAAC,QAAA,EAAU,MAAA,EAAQ,SAAS;AAAA,GACzC,CAAA;AAEH,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,aAAA;AAAA,IAEJ,IAAA,EAAM,CAAC,OAAA,KAAY;AACjB,MAAA,GAAA,GAAM,OAAA;AAAA,IACR,CAAA;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN,sBAAA,EAAwB;AAAA,QACtB,SAAA,EAAW,KAAA;AAAA,QACX,MAAA,EAAQ;AAAA,UACN,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UACzC,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UACvC,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,UAC1C,SAAS,EAAE,IAAA,EAAM,WAAW,QAAA,EAAU,IAAA,EAAM,SAAS,IAAA,EAAK;AAAA,UAC1D,WAAW,EAAE,IAAA,EAAM,UAAU,QAAA,EAAU,IAAA,EAAM,SAAS,SAAA,EAAU;AAAA,UAChE,WAAW,EAAE,IAAA,EAAM,QAAQ,QAAA,EAAU,IAAA,EAAM,YAAY,IAAA;AAAK,SAC9D;AAAA,QACA,UAAA,EAAY,CAAC,QAAA,EAAU,MAAA,EAAQ,SAAS;AAAA;AAC1C,KACF;AAAA,IAEA,KAAA,EAAO;AAAA;AAAA,MAEL,OAAA,EAAS,OAAO,OAAA,KAA0D;AACxE,QAAA,IAAI,WAAW,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG,2BAAW,GAAA,EAAI;AAEjD,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAC,SAAA,KAAc,SAAA,CAAU,MAAM,CAAC,CAAA;AAC/E,QAAA,OAAO,IAAI,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,CAAC,QAAQ,CAAC,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,IAAI,IAAA,EAAM,GAAA,CAAI,OAAO,CAAA,EAAG,GAAG,CAAC,CAAC,CAAA;AAAA,MACjF,CAAA;AAAA,MAEA,eAAA,EAAiB,CAAC,OAAA,KAAoC;AACpD,QAAA,IAAI,WAAW,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,SAAU,OAAA,CAAQ,SAAA;AAGjD,QAAA,IAAI,EAAE,OAAA,CAAQ,QAAA,YAAoB,GAAA,CAAA,EAAM;AACtC,UAAA,OAAO,OAAA,CAAQ,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,MAAc,EAAE,GAAG,QAAA,EAAU,MAAA,EAAQ,MAAA,EAAgB,CAAE,CAAA;AAAA,QACvF;AAEA,QAAA,MAAM,OAAO,OAAA,CAAQ,QAAA;AAErB,QAAA,OAAO,QAAQ,SAAA,CAAU,GAAA;AAAA,UAAqB,CAAC,QAAA,KAC7C,SAAA,CAAU,OAAA,CAAQ,SAAA,CAAU,QAAQ,OAAA,CAAQ,IAAA,EAAM,QAAA,CAAS,OAAA,EAAS,IAAI,CAAA,GACpE,QAAA,GACA,EAAE,GAAG,QAAA,EAAU,QAAQ,MAAA;AAAO,SACpC;AAAA,MACF;AAAA,KACF;AAAA,IAEA,MAAA,EAAQ;AAAA,MACN;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,KAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,QACtB,OAAA,EAAS,OAAO,EAAE,MAAA,EAAO,KAAM;AAC7B,UAAA,MAAM,OAAO,MAAM,IAAA,CAAK,CAAC,MAAA,IAAU,EAAE,CAAC,CAAA;AACtC,UAAA,OAAO,SAAS,IAAA,CAAK,EAAE,WAAA,EAAa,IAAA,EAAM,gBAAgB,CAAA;AAAA,QAC5D;AAAA,OACF;AAAA,MAEA;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,MAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAO;AAAA,QACtB,OAAA,EAAS,OAAO,EAAE,OAAA,EAAS,QAAO,KAAM;AACtC,UAAA,MAAM,MAAA,GAAS,MAAM,YAAA,CAAa,OAAO,CAAA;AACzC,UAAA,IAAI,OAAA,IAAW,MAAA,EAAQ,OAAO,MAAA,CAAO,KAAA;AACrC,UAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AAEpB,UAAA,MAAM,GAAA,GAAM,CAAC,KAAA,KAAkB,QAAA,CAAS,IAAA,CAAK,EAAE,KAAA,EAAM,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAGvE,UAAA,IAAI,OAAO,IAAA,CAAK,IAAA,KAAS,QAAA,IAAY,CAAC,IAAI,iBAAA,CAAkB,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,EAAG;AAC/E,YAAA,OAAO,IAAI,6CAA6C,CAAA;AAAA,UAC1D;AACA,UAAA,IAAI,CAAC,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,GAAA,CAAI,CAAA,uBAAA,EAA0B,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AACxF,UAAA,IAAI,KAAK,OAAA,KAAY,MAAA,IAAa,OAAO,IAAA,CAAK,YAAY,SAAA,EAAW;AACnE,YAAA,OAAO,IAAI,2BAA2B,CAAA;AAAA,UACxC;AACA,UAAA,IAAI,KAAK,SAAA,KAAc,MAAA,IAAa,CAAC,WAAA,CAAY,IAAA,CAAK,SAAS,CAAA,EAAG;AAChE,YAAA,OAAO,IAAI,CAAA,yBAAA,EAA4B,WAAA,CAAY,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,UACjE;AAGA,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,QAAQ,MAAA,IAAU,EAAA;AAAA,YAClB,MAAM,IAAA,CAAK,IAAA;AAAA,YACX,SAAS,IAAA,CAAK,OAAA;AAAA,YACd,OAAA,EAAS,KAAK,OAAA,IAAW,IAAA;AAAA,YACzB,SAAA,EAAW,KAAK,SAAA,IAAa;AAAA,WAC9B,CAAA;AAED,UAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,MAAM,CAAA;AAAA,QACnC;AAAA,OACF;AAAA,MAEA;AAAA;AAAA,QAEE,IAAA,EAAM,cAAA;AAAA,QACN,MAAA,EAAQ,MAAA;AAAA,QACR,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAU,SAAS,mBAAA,EAAoB;AAAA,QACtD,OAAA,EAAS,OAAO,EAAE,MAAA,EAAO,KAAM;AAC7B,UAAA,MAAM,IAAA,GAAO,QAAQ,IAAA,EAAM,IAAA;AAC3B,UAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,EAAM,OAAA;AAC9B,UAAA,IAAI,CAAC,MAAA,IAAU,CAAC,QAAQ,CAAC,SAAA,CAAU,OAAO,CAAA,EAAG;AAC3C,YAAA,OAAO,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,iBAAgB,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,CAAC,OAAO,CAAA,GAAI,MAAM,IAAI,KAAA,CAAM,IAAA;AAAA,YAChC,KAAA;AAAA,YACA,EAAE,MAAA,EAAQ,MAAA,CAAO,GAAA,EAAK,MAAM,OAAA,EAAQ;AAAA,YACpC,EAAE,OAAO,CAAA;AAAE,WACb;AAGA,UAAA,IAAI,WAAW,CAAC,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,cAAc,KAAA,EAAO;AAC9D,YAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,cAAc,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,CAAA;AAAA,UACpE;AAGA,UAAA,IACE,OAAA,EAAS,SAAA,IACT,MAAA,CAAO,GAAA,KAAQ,MAAA,IACf,OAAA,CAAQ,SAAA,CAAU,OAAA,EAAQ,GAAA,CAAK,MAAA,CAAO,GAAA,GAAM,CAAA,IAAK,GAAA,EACjD;AACA,YAAA,OAAO,QAAA,CAAS,KAAK,EAAE,KAAA,EAAO,iBAAgB,EAAG,EAAE,MAAA,EAAQ,GAAA,EAAK,CAAA;AAAA,UAClE;AAEA,UAAA,MAAM,IAAA,CAAK;AAAA,YACT,QAAQ,MAAA,CAAO,GAAA;AAAA,YACf,IAAA;AAAA,YACA,OAAA;AAAA,YACA,OAAA,EAAS,KAAA;AAAA,YACT,SAAA,EAAW;AAAA,WACZ,CAAA;AAGD,UAAA,OAAO,QAAA,CAAS,IAAA,CAAK,EAAE,EAAA,EAAI,IAAA,EAAM,cAAc,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,CAAA;AAAA,QACpE;AAAA;AACF;AACF,GACF;AACF","file":"preferences.js","sourcesContent":["import { readJsonBody } from \"../../core/handler\";\nimport type {\n  ChannelDecision,\n  EasyPingPlugin,\n  PluginInitContext,\n  PrepareContext,\n  ResolveChannelsContext,\n} from \"../../core/plugin\";\nimport { DEFAULT_TOKEN_TTL_SECONDS, expiresIn, signToken } from \"../../core/tokens\";\nimport type { Channel, Frequency } from \"../../core/types\";\n\nexport const UNSUBSCRIBE_PURPOSE = \"unsubscribe\";\n\nconst TABLE = \"notification_preference\";\n\nconst CHANNELS: readonly Channel[] = [\"inApp\", \"email\", \"push\", \"sms\", \"slack\"];\nconst FREQUENCIES: readonly Frequency[] = [\"instant\", \"daily\", \"weekly\", \"off\"];\n\nconst isChannel = (value: unknown): value is Channel => CHANNELS.includes(value as Channel);\nconst isFrequency = (value: unknown): value is Frequency =>\n  FREQUENCIES.includes(value as Frequency);\n\nexport type PreferenceRow = {\n  userId: string;\n  type: string;\n  channel: Channel;\n  enabled: boolean;\n  frequency: Frequency;\n  /** Last explicit change. An unsubscribe token issued before it is refused. */\n  updatedAt?: Date;\n};\n\nexport type PreferencesOptions = {\n  /** What an absent row means. Flip to false for opt-in-only notifications. */\n  defaultEnabled?: boolean;\n  /** Types that ignore preferences entirely: receipts, security alerts. */\n  alwaysSend?: readonly string[];\n  unsubscribeTtlSeconds?: number;\n};\n\nconst key = (userId: string, type: string, channel: string) => `${userId} ${type} ${channel}`;\n\ntype PreparedPreferences = Map<string, PreferenceRow>;\n\nexport function buildUnsubscribeToken(\n  secret: string,\n  userId: string,\n  type: string,\n  channel: Channel,\n  ttlSeconds = DEFAULT_TOKEN_TTL_SECONDS,\n): Promise<string> {\n  return signToken(secret, {\n    uid: userId,\n    purpose: UNSUBSCRIBE_PURPOSE,\n    exp: expiresIn(ttlSeconds),\n    data: { type, channel },\n  });\n}\n\nexport function preferences(options: PreferencesOptions = {}): EasyPingPlugin<\"preferences\"> {\n  const defaultEnabled = options.defaultEnabled ?? true;\n  const alwaysSend = new Set(options.alwaysSend ?? []);\n\n  // Assigned by init(), which easyPing() runs before any hook or route.\n  let ctx: PluginInitContext;\n\n  const isAllowed = (userId: string, type: string, channel: Channel, rows: PreparedPreferences) => {\n    const row = rows.get(key(userId, type, channel));\n    return row ? row.enabled && row.frequency !== \"off\" : defaultEnabled;\n  };\n\n  const load = (userIds: readonly string[]) =>\n    ctx.store.find<PreferenceRow>(TABLE, { userId: { in: [...userIds] } });\n\n  const save = (row: PreferenceRow) =>\n    ctx.store.upsert(TABLE, [{ ...row, updatedAt: new Date() }], {\n      onConflict: [\"userId\", \"type\", \"channel\"],\n    });\n\n  return {\n    id: \"preferences\",\n\n    init: (context) => {\n      ctx = context;\n    },\n\n    schema: {\n      notificationPreference: {\n        tableName: TABLE,\n        fields: {\n          userId: { type: \"string\", required: true },\n          type: { type: \"string\", required: true },\n          channel: { type: \"string\", required: true },\n          enabled: { type: \"boolean\", required: true, default: true },\n          frequency: { type: \"string\", required: true, default: \"instant\" },\n          updatedAt: { type: \"date\", required: true, defaultNow: true },\n        },\n        primaryKey: [\"userId\", \"type\", \"channel\"],\n      },\n    },\n\n    hooks: {\n      /** One query per send; doing this per recipient would be an N+1. */\n      prepare: async (context: PrepareContext): Promise<PreparedPreferences> => {\n        if (alwaysSend.has(context.type)) return new Map();\n\n        const rows = await load(context.recipients.map((recipient) => recipient.userId));\n        return new Map(rows.map((row) => [key(row.userId, row.type, row.channel), row]));\n      },\n\n      resolveChannels: (context: ResolveChannelsContext) => {\n        if (alwaysSend.has(context.type)) return context.decisions;\n\n        // prepare() failed: fail closed rather than assume everyone opted in.\n        if (!(context.prepared instanceof Map)) {\n          return context.decisions.map((decision) => ({ ...decision, action: \"skip\" as const }));\n        }\n\n        const rows = context.prepared as PreparedPreferences;\n\n        return context.decisions.map<ChannelDecision>((decision) =>\n          isAllowed(context.recipient.userId, context.type, decision.channel, rows)\n            ? decision\n            : { ...decision, action: \"skip\" },\n        );\n      },\n    },\n\n    routes: [\n      {\n        path: \"/preferences\",\n        method: \"GET\",\n        scope: { type: \"user\" },\n        handler: async ({ userId }) => {\n          const rows = await load([userId ?? \"\"]);\n          return Response.json({ preferences: rows, defaultEnabled });\n        },\n      },\n\n      {\n        path: \"/preferences\",\n        method: \"POST\",\n        scope: { type: \"user\" },\n        handler: async ({ request, userId }) => {\n          const parsed = await readJsonBody(request);\n          if (\"error\" in parsed) return parsed.error;\n          const body = parsed.body;\n\n          const bad = (error: string) => Response.json({ error }, { status: 400 });\n\n          // Only configured types, or every invented string becomes a row.\n          if (typeof body.type !== \"string\" || !ctx.notificationTypes.includes(body.type)) {\n            return bad(\"type must be a configured notification type\");\n          }\n          if (!isChannel(body.channel)) return bad(`channel must be one of ${CHANNELS.join(\", \")}`);\n          if (body.enabled !== undefined && typeof body.enabled !== \"boolean\") {\n            return bad(\"enabled must be a boolean\");\n          }\n          if (body.frequency !== undefined && !isFrequency(body.frequency)) {\n            return bad(`frequency must be one of ${FREQUENCIES.join(\", \")}`);\n          }\n\n          // userId comes from the resolved session, never from the body.\n          await save({\n            userId: userId ?? \"\",\n            type: body.type,\n            channel: body.channel,\n            enabled: body.enabled ?? true,\n            frequency: body.frequency ?? \"instant\",\n          });\n\n          return Response.json({ ok: true });\n        },\n      },\n\n      {\n        // No session in a mail client; the link carries the proof.\n        path: \"/unsubscribe\",\n        method: \"POST\",\n        scope: { type: \"signed\", purpose: UNSUBSCRIBE_PURPOSE },\n        handler: async ({ claims }) => {\n          const type = claims?.data?.type;\n          const channel = claims?.data?.channel;\n          if (!claims || !type || !isChannel(channel)) {\n            return Response.json({ error: \"invalid token\" }, { status: 400 });\n          }\n\n          const [current] = await ctx.store.find<PreferenceRow>(\n            TABLE,\n            { userId: claims.uid, type, channel },\n            { limit: 1 },\n          );\n\n          // Already off: a second click, or a mail client retrying, is fine.\n          if (current && !current.enabled && current.frequency === \"off\") {\n            return Response.json({ ok: true, unsubscribed: { type, channel } });\n          }\n\n          // Changed after the email went out: an old link must not undo a newer decision.\n          if (\n            current?.updatedAt &&\n            claims.iat !== undefined &&\n            current.updatedAt.getTime() > (claims.iat + 1) * 1000\n          ) {\n            return Response.json({ error: \"invalid token\" }, { status: 400 });\n          }\n\n          await save({\n            userId: claims.uid,\n            type,\n            channel,\n            enabled: false,\n            frequency: \"off\",\n          });\n\n          // One-click (Gmail, Yahoo) requires the POST itself to unsubscribe.\n          return Response.json({ ok: true, unsubscribed: { type, channel } });\n        },\n      },\n    ],\n  };\n}\n"]}

package/dist/plugins/push.cjs

@@ -16,9 +16,9 @@ var PRIVATE_HEADERS = {
   "cache-control": "private, no-store",
   "x-content-type-options": "nosniff"
 };
-var json = (body, status = 200) => new Response(JSON.stringify(body), {
+var json = (body, status = 200, headers = {}) => new Response(JSON.stringify(body), {
   status,
-  headers: { "content-type": "application/json", ...PRIVATE_HEADERS }
+  headers: { "content-type": "application/json", ...PRIVATE_HEADERS, ...headers }
 });
 new TextEncoder();
 async function readJsonBody(request, maxBytes = MAX_BODY_BYTES) {