notifkit 0.1.2 → 0.1.4

package/src/unsubscribe/index.ts

@@ -0,0 +1,127 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+/**
+ * One-click unsubscribe (RFC 8058).
+ *
+ * Gmail and Yahoo have required `List-Unsubscribe` + `List-Unsubscribe-Post` on
+ * bulk mail since early 2024; without them bulk sends get throttled or junked,
+ * and because deliverability is reputation on the *sending domain*, that
+ * eventually drags transactional mail down with it.
+ *
+ * The link has to work from an inbox, years later, with no session — so the
+ * token carries its own claim and is signed rather than looked up. Nothing is
+ * stored per message, and there is no expiry: an unsubscribe link that has
+ * stopped working is worse than useless, because the recipient's next move is
+ * the spam button.
+ */
+
+export interface UnsubscribeClaim {
+  /** Project the send belonged to. */
+  projectId: string;
+  /** The user's external id, as supplied by the caller. */
+  userId: string;
+  channel: string;
+  /** The address itself — used when there is no topic to opt out of. */
+  target: string;
+  /** Topics the template belonged to. Empty means "suppress the address". */
+  topics: string[];
+}
+
+interface WireClaim {
+  p: string;
+  u: string;
+  c: string;
+  t: string;
+  k: string[];
+}
+
+function b64url(input: Buffer | string): string {
+  return Buffer.from(input).toString("base64url");
+}
+
+/**
+ * Sign a claim into a URL-safe token.
+ *
+ * The signature covers the exact encoded payload rather than a re-serialisation
+ * of it, so a verifier never has to reproduce this function's JSON key order to
+ * get a matching MAC.
+ */
+export function signUnsubscribeToken(claim: UnsubscribeClaim, secret: string): string {
+  const wire: WireClaim = {
+    p: claim.projectId,
+    u: claim.userId,
+    c: claim.channel,
+    t: claim.target,
+    k: claim.topics,
+  };
+  const payload = b64url(JSON.stringify(wire));
+  const mac = b64url(createHmac("sha256", secret).update(payload).digest());
+  return `${payload}.${mac}`;
+}
+
+/**
+ * Verify and decode a token. Returns null for anything not signed by `secret`.
+ *
+ * Every failure returns the same null rather than a reason: the caller is an
+ * unauthenticated endpoint, and distinguishing "malformed" from "bad signature"
+ * hands an attacker a probe.
+ */
+export function verifyUnsubscribeToken(token: string, secret: string): UnsubscribeClaim | null {
+  const dot = token.indexOf(".");
+  if (dot <= 0 || dot === token.length - 1) return null;
+
+  const payload = token.slice(0, dot);
+  const provided = Buffer.from(token.slice(dot + 1), "base64url");
+  const expected = createHmac("sha256", secret).update(payload).digest();
+
+  // timingSafeEqual throws on a length mismatch, which is itself a signal.
+  if (provided.length !== expected.length) return null;
+  if (!timingSafeEqual(provided, expected)) return null;
+
+  try {
+    const wire = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as WireClaim;
+    if (
+      typeof wire.p !== "string" ||
+      typeof wire.u !== "string" ||
+      typeof wire.c !== "string" ||
+      typeof wire.t !== "string" ||
+      !Array.isArray(wire.k)
+    ) {
+      return null;
+    }
+    return {
+      projectId: wire.p,
+      userId: wire.u,
+      channel: wire.c,
+      target: wire.t,
+      topics: wire.k.filter((t): t is string => typeof t === "string"),
+    };
+  } catch {
+    return null;
+  }
+}
+
+export interface UnsubscribeHeaderOptions {
+  claim: UnsubscribeClaim;
+  secret: string;
+  /** Externally reachable base URL of the API, e.g. https://notify.example.com */
+  publicUrl: string;
+}
+
+/**
+ * The two headers that make an inbox render a real unsubscribe button.
+ *
+ * `List-Unsubscribe-Post` is what upgrades the link from "open this URL" to
+ * one-click: the mail client POSTs directly and never shows the recipient a
+ * landing page. Sending the URL without it means the recipient has to click
+ * through and confirm, which mailbox providers do not count as compliant.
+ */
+export function buildUnsubscribeHeaders(options: UnsubscribeHeaderOptions): Record<string, string> {
+  const token = signUnsubscribeToken(options.claim, options.secret);
+  const base = options.publicUrl.replace(/\/$/, "");
+  const url = `${base}/v1/unsubscribe?token=${encodeURIComponent(token)}`;
+  return {
+    "List-Unsubscribe": `<${url}>`,
+    "List-Unsubscribe-Post": "List-Unsubscribe=One-Click",
+  };
+}

package/src/workers/health.ts

@@ -0,0 +1,31 @@
+import type { Logger } from "@/index.js";
+import type { BaseWorker } from "./index.js";
+
+export function startHealthReporter(
+  serviceName: string,
+  worker: BaseWorker,
+  redis: { healthCheck: () => Promise<boolean>; native: any },
+  logger: Logger,
+  intervalMs = 1000,
+): NodeJS.Timeout {
+  return setInterval(() => {
+    void (async () => {
+      try {
+        const redisOk = await redis.healthCheck();
+        await redis.native.set(
+          `notif:health:${serviceName}`,
+          JSON.stringify({
+            service: serviceName,
+            redis: redisOk,
+            ...worker.health(),
+            updatedAt: new Date().toISOString(),
+          }),
+          "EX",
+          15,
+        );
+      } catch {
+        // A failed health write is not worth failing the worker over.
+      }
+    })();
+  }, intervalMs);
+}

package/src/workers/index.ts

@@ -0,0 +1,266 @@
+import type { Logger } from "@/index.js";
+import type { StreamConsumer, PendingMessageScanner, StreamMessage } from "@/index.js";
+import { globalEmitter, AsyncSemaphore } from "@/shared/index.js";
+import { metrics } from "@/metrics/index.js";
+export * from "./health.js";
+
+// ─── Types ─────────────────────────────────────────────────────────────────
+
+export class NonRetryableError extends Error {
+  readonly nonRetryable = true;
+  constructor(message: string) {
+    super(message);
+    this.name = "NonRetryableError";
+  }
+}
+
+export type WorkerState = "idle" | "running" | "stopping" | "stopped" | "error";
+
+export interface WorkerHealth {
+  state: WorkerState;
+  processedCount: number;
+  errorCount: number;
+  lastProcessedAt: string | null;
+  lastErrorAt: string | null;
+  pendingCount: number | null;
+}
+
+export interface WorkerOptions {
+  consumer: StreamConsumer;
+  pendingScanner: PendingMessageScanner;
+  logger: Logger;
+  concurrency?: number;
+  recoveryIntervalMs?: number;
+  maxRetriesBeforeDlq?: number;
+}
+
+// ─── BaseWorker ────────────────────────────────────────────────────────────
+
+export abstract class BaseWorker {
+  protected readonly logger: Logger;
+
+  private readonly consumer: StreamConsumer;
+  private readonly pendingScanner: PendingMessageScanner;
+  private readonly concurrency: number;
+  private readonly recoveryIntervalMs: number;
+  private readonly maxRetriesBeforeDlq: number;
+
+  private state: WorkerState = "idle";
+  private stopping = false;
+  private processedCount = 0;
+  private errorCount = 0;
+  private lastProcessedAt: string | null = null;
+  private lastErrorAt: string | null = null;
+  private recoveryTimer: ReturnType<typeof setInterval> | null = null;
+  private lastPendingCount: number | null = null;
+  private readonly active = new Set<Promise<void>>();
+  private readonly semaphore: AsyncSemaphore;
+  private runLoop?: Promise<void>;
+
+  constructor({
+    consumer,
+    pendingScanner,
+    logger,
+    concurrency = 10,
+    recoveryIntervalMs = 60_000,
+    maxRetriesBeforeDlq = 3,
+  }: WorkerOptions) {
+    this.consumer = consumer;
+    this.pendingScanner = pendingScanner;
+    this.logger = logger.child({ component: this.constructor.name });
+    this.concurrency = concurrency;
+    this.recoveryIntervalMs = recoveryIntervalMs;
+    this.maxRetriesBeforeDlq = maxRetriesBeforeDlq;
+    this.semaphore = new AsyncSemaphore(concurrency);
+  }
+
+  protected abstract process(message: StreamMessage, attempt?: number): Promise<void>;
+
+  async start(): Promise<void> {
+    if (this.state !== "idle") {
+      throw new Error(`Worker cannot start from state: ${this.state}`);
+    }
+
+    this.state = "running";
+    this.logger.info({ concurrency: this.concurrency }, "worker starting");
+
+    await this.consumer.ensureGroup();
+    this.startRecoveryLoop();
+
+    this.runLoop = this.consume();
+  }
+
+  private async consume(): Promise<void> {
+    for await (const batch of this.consumer.readBatch()) {
+      if (this.stopping) break;
+
+      for (const message of batch) {
+        if (this.stopping) break;
+
+        await this.semaphore.acquire();
+
+        const task = this.processWithTracking(message).finally(() => {
+          this.active.delete(task);
+          this.semaphore.release();
+        });
+
+        this.active.add(task);
+      }
+    }
+
+    await Promise.allSettled([...this.active]);
+    this.state = "stopped";
+    this.logger.info("worker stopped");
+  }
+
+  async stop(): Promise<void> {
+    if (this.stopping || this.state !== "running") return;
+
+    this.logger.info("worker stopping");
+    this.stopping = true;
+    this.state = "stopping";
+    await this.consumer.stop();
+    this.stopRecoveryLoop();
+
+    if (this.runLoop) {
+      await Promise.race([
+        this.runLoop,
+        new Promise((_, reject) =>
+          setTimeout(() => reject(new Error("Worker stop timeout")), 30_000),
+        ),
+      ]).catch((err) => this.logger.warn({ err }, "Worker shutdown timeout or error"));
+    }
+
+    this.logger.info("worker shutdown complete");
+  }
+
+  async recover(): Promise<void> {
+    this.logger.debug("scanning for stale pending messages");
+
+    const pendingCount = await this.pendingScanner.getPendingCount();
+    this.lastPendingCount = pendingCount;
+    if (pendingCount === 0) return;
+
+    this.logger.info({ pendingCount }, "found pending messages, attempting autoclaim");
+
+    const BATCH_SIZE = 1000;
+    while (!this.stopping) {
+      const messages = await this.pendingScanner.autoclaim(this.recoveryIntervalMs, BATCH_SIZE);
+      if (messages.length === 0) {
+        break; // No more eligible messages to claim
+      }
+
+      for (const message of messages) {
+        if (this.stopping) break;
+
+        await this.semaphore.acquire();
+
+        const task = this.processWithTracking(message).finally(() => {
+          this.active.delete(task);
+          this.semaphore.release();
+        });
+
+        this.active.add(task);
+      }
+    }
+  }
+
+  health(): WorkerHealth {
+    return {
+      state: this.state,
+      processedCount: this.processedCount,
+      errorCount: this.errorCount,
+      lastProcessedAt: this.lastProcessedAt,
+      lastErrorAt: this.lastErrorAt,
+      // Refreshed by the recovery loop; health() stays synchronous so the
+      // reporter never blocks on Redis.
+      pendingCount: this.lastPendingCount,
+    };
+  }
+
+  private async processWithTracking(message: StreamMessage): Promise<void> {
+    const start = Date.now();
+    const stream = message.stream;
+    const retryKey = `notif:worker:retries:${this.constructor.name}:${stream ?? "default"}:${message.id}`;
+
+    try {
+      const results = await this.consumer.redis
+        .multi()
+        .incr(retryKey)
+        .expire(retryKey, 7200)
+        .exec();
+      const retryCount = (results?.[0]?.[1] as number) ?? 1;
+
+      if (retryCount > this.maxRetriesBeforeDlq) {
+        this.logger.warn(
+          { messageId: message.id, retryCount },
+          "max retries exceeded, moving to dead-letter queue",
+        );
+        await this.consumer.nack(message.id, message.event, stream);
+        await this.consumer.redis.del(retryKey);
+        globalEmitter.emit(
+          "notification:failed",
+          message.id,
+          "Poison pill: max retries exceeded",
+          message.event.type,
+        );
+        return;
+      }
+
+      await this.process(message, retryCount);
+
+      await this.consumer.ack(message.id, stream);
+      await this.consumer.redis.del(retryKey);
+      this.processedCount += 1;
+      this.lastProcessedAt = new Date().toISOString();
+      metrics.messagesProcessed.inc({ worker: this.constructor.name, status: "success" });
+
+      this.logger.debug(
+        { messageId: message.id, eventType: message.event.type, durationMs: Date.now() - start },
+        "message processed",
+      );
+    } catch (err) {
+      this.errorCount += 1;
+      this.lastErrorAt = new Date().toISOString();
+      metrics.messagesProcessed.inc({ worker: this.constructor.name, status: "error" });
+
+      if (err instanceof NonRetryableError || (err as any)?.nonRetryable) {
+        this.logger.warn(
+          { err, messageId: message.id },
+          "non-retryable error encountered, immediately moving to dead-letter queue without retry loop",
+        );
+        await this.consumer.nack(message.id, message.event, stream);
+        await this.consumer.redis.del(retryKey);
+        globalEmitter.emit(
+          "notification:failed",
+          message.id,
+          (err as Error).message,
+          message.event.type,
+        );
+        return;
+      }
+
+      this.logger.error(
+        { err, messageId: message.id, eventType: message.event.type },
+        "failed to process message",
+      );
+    }
+  }
+
+  private startRecoveryLoop(): void {
+    this.recoveryTimer = setInterval(() => {
+      if (this.state === "running") {
+        this.recover().catch((err: unknown) => {
+          this.logger.error({ err }, "recovery loop error");
+        });
+      }
+    }, this.recoveryIntervalMs);
+  }
+
+  private stopRecoveryLoop(): void {
+    if (this.recoveryTimer) {
+      clearInterval(this.recoveryTimer);
+      this.recoveryTimer = null;
+    }
+  }
+}

package/src/workflows/index.ts

@@ -0,0 +1,2 @@
+export * from "./sdk.js";
+export * from "./registry.js";

package/src/workflows/registry.ts

@@ -0,0 +1,21 @@
+import type { WorkflowContext } from "./sdk.js";
+
+type WorkflowHandler = (ctx: WorkflowContext) => Promise<void>;
+
+class WorkflowRegistry {
+  private workflows = new Map<string, WorkflowHandler>();
+
+  register(name: string, handler: WorkflowHandler) {
+    this.workflows.set(name, handler);
+  }
+
+  get(name: string): WorkflowHandler | undefined {
+    return this.workflows.get(name);
+  }
+}
+
+export const workflowRegistry = new WorkflowRegistry();
+
+export function workflow(name: string, handler: WorkflowHandler) {
+  workflowRegistry.register(name, handler);
+}

package/src/workflows/sdk.ts

@@ -0,0 +1,106 @@
+import type { WorkflowNotifyInput } from "@/contracts/sdk.js";
+import type {
+  NotificationRequestedPayload,
+  NotificationTarget,
+} from "@/contracts/events/notification-requested.js";
+
+export class SuspendExecutionError extends Error {
+  constructor(
+    public reason: "wait" | "waitForEvent",
+    public payload: any,
+  ) {
+    super(`Execution suspended for ${reason}`);
+    this.name = "SuspendExecutionError";
+  }
+}
+
+export interface WorkflowEvent {
+  user: { id: string };
+  [key: string]: any;
+}
+
+export interface WorkflowContext {
+  step: WorkflowStepContext;
+  event: WorkflowEvent;
+}
+
+/** What a completed `step.notify()` records and returns. */
+export interface WorkflowNotifyResult {
+  success: boolean;
+  messageId: string;
+  notificationId: string;
+}
+
+export interface WorkflowStepContext {
+  notify(payload: WorkflowNotifyInput): Promise<WorkflowNotifyResult>;
+  wait(duration: string): Promise<void>;
+  waitForEvent(
+    eventName: string,
+    options?: { timeout?: string; match?: Record<string, any> },
+  ): Promise<any | null>;
+  run<T>(name: string, fn: () => Promise<T> | T): Promise<T>;
+}
+
+/**
+ * Works out who a `step.notify()` call is for.
+ *
+ * A target named in the step payload wins. Only when the step names none does
+ * the notification fall back to the instance's own user — the common case, and
+ * the reason most steps carry no target at all.
+ */
+export function resolveStepTarget(
+  args: WorkflowNotifyInput,
+  instanceInput: unknown,
+): NotificationTarget {
+  if (args.segment !== undefined) return { type: "segment", segment: args.segment };
+  if (args.topic !== undefined) return { type: "topic", topic: args.topic };
+
+  if (args.user !== undefined) {
+    if (Array.isArray(args.user)) {
+      throw new Error(
+        "step.notify() takes a single `user`. To reach several people from one workflow, " +
+          "use one notify step each, or target a `segment`.",
+      );
+    }
+    return {
+      type: "user",
+      userId: typeof args.user === "string" ? args.user : args.user.id,
+    };
+  }
+
+  const inherited = (instanceInput as { user?: { id?: string } } | null)?.user?.id;
+  if (!inherited) {
+    throw new Error(
+      "step.notify() has no target: the step payload names no `user`, `segment` or `topic`, " +
+        "and the workflow instance was triggered without `input.user.id`.",
+    );
+  }
+  return { type: "user", userId: inherited };
+}
+
+/**
+ * Maps a `step.notify()` payload onto the wire event the pipeline consumes.
+ *
+ * The field names differ either side of the boundary — `template` becomes
+ * `templateId`, `sendAt` becomes `scheduledAt` — so this translation is
+ * deliberate rather than a spread, and the return type keeps it honest.
+ */
+export function buildStepNotifyPayload(
+  args: WorkflowNotifyInput,
+  instanceInput: unknown,
+  projectId: string,
+  idempotencyKey?: string,
+): NotificationRequestedPayload {
+  return {
+    projectId,
+    target: resolveStepTarget(args, instanceInput),
+    templateId: args.template,
+    priority: args.priority ?? "normal",
+    channels: args.channels,
+    data: args.data ?? {},
+    aiPrompts: args.aiPrompts,
+    fallback: args.fallback ?? false,
+    scheduledAt: args.sendAt,
+    idempotencyKey,
+  };
+}

package/dist/main-CAH0_Q6d.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"main-CAH0_Q6d.mjs","names":[],"sources":["../src/services/ai/main.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { loadEnv, readBaseConfig } from \"@/index.js\";\nimport { createLogger } from \"@/index.js\";\nimport { RedisClient, type Redis } from \"@/index.js\";\nimport {\n  StreamConsumer,\n  PendingMessageScanner,\n  StreamProducer,\n  type StreamMessage,\n} from \"@/index.js\";\nimport { BaseWorker } from \"@/index.js\";\nimport {\n  STREAMS,\n  CONSUMER_GROUPS,\n  registry,\n  buildStreamEvent,\n  type NotificationAiPendingPayload,\n  type NotificationDispatchedPayload,\n  getAiConfig,\n  AI_DEFAULTS,\n} from \"@/index.js\";\nimport { generateText } from \"ai\";\nimport { type StreamName } from \"@/contracts/streams.js\";\nimport { IdempotencyGuard } from \"@/index.js\";\nimport { TemplateRepository } from \"@/index.js\";\nimport { createDatabase } from \"@/db/index.js\";\nimport { scheduledPayloads } from \"@/db/schema.js\";\nimport { getPriorityBucket, globalEmitter, type WorkerOptions } from \"@/shared/index.js\";\nimport { renderWithTemplate, TemplateCache } from \"@/templates/index.js\";\nimport { startHealthReporter } from \"@/workers/index.js\";\n\n// ─── Bootstrap ─────────────────────────────────────────────────────────────\n\nloadEnv();\nconst config = readBaseConfig();\n\nlet logger: ReturnType<typeof createLogger>;\nlet redis: RedisClient;\nlet sql: any;\nlet db: any;\nlet templateRepo: TemplateRepository;\n\nlet templateCache: TemplateCache;\n\nlet consumer: StreamConsumer;\nlet pendingScanner: PendingMessageScanner;\nlet worker: BaseWorker;\nlet healthInterval: NodeJS.Timeout | null = null;\nlet subscriber: any = null;\n\n/**\n * A model failure that retrying cannot fix (bad prompt, rejected request,\n * unsupported model). Thrown so the notification fails once instead of being\n * re-billed on every retry.\n */\nexport class PermanentAiError extends Error {\n  constructor(message: string, options?: ErrorOptions) {\n    super(message, options);\n    this.name = \"PermanentAiError\";\n  }\n}\n\n/** Timeouts, rate limits and 5xx are worth another attempt; 4xx are not. */\nexport function isRetryableAiError(err: unknown): boolean {\n  if (err instanceof PermanentAiError) return false;\n\n  const e = err as { name?: string; statusCode?: number; status?: number } | null;\n  if (!e) return false;\n\n  if (e.name === \"TimeoutError\" || e.name === \"AbortError\") return true;\n\n  const status = e.statusCode ?? e.status;\n  if (typeof status === \"number\") {\n    return status === 408 || status === 409 || status === 429 || status >= 500;\n  }\n\n  // Unclassifiable (network errors, transport failures) — assume transient.\n  return true;\n}\n\nexport interface AiWorkerOptions extends WorkerOptions {\n  registry: any;\n  idempotency: any;\n  redis: Redis;\n  generateAiContent: any;\n  templateCache: TemplateCache;\n  scheduledProducer: any;\n  outboundProducers: any;\n  db: any;\n}\n\nexport class AiWorker extends BaseWorker {\n  private readonly registry: any;\n  private readonly idempotency: any;\n  private readonly redisCli: Redis;\n  private readonly generateAiContent: any;\n  private readonly templateCache: TemplateCache;\n  private readonly scheduledProducer: any;\n  private readonly outboundProducers: any;\n  private readonly db: any;\n\n  constructor(options: AiWorkerOptions) {\n    super(options);\n    this.registry = options.registry;\n    this.idempotency = options.idempotency;\n    this.redisCli = options.redis;\n    this.generateAiContent = options.generateAiContent;\n    this.templateCache = options.templateCache;\n    this.scheduledProducer = options.scheduledProducer;\n    this.outboundProducers = options.outboundProducers;\n    this.db = options.db;\n  }\n  async process(message: StreamMessage): Promise<void> {\n    const { event } = message;\n\n    const payloadResult = this.registry.safeParsePayload(\"notification.ai_pending\", event.payload);\n    if (!payloadResult.success) {\n      this.logger.warn(\n        { messageId: message.id, issues: payloadResult.error.issues },\n        \"invalid notification.ai_pending payload — skipping\",\n      );\n      return;\n    }\n\n    const pending = payloadResult.data as NotificationAiPendingPayload;\n\n    // Idempotency\n    const idempotencyKey = `${pending.enrichedEventId}:${pending.recipientId}:${pending.channel}:ai`;\n    if (!(await this.idempotency.checkAndMark(idempotencyKey))) {\n      this.logger.debug(\n        { messageId: message.id, eventId: event.id },\n        \"duplicate ai task — skipping\",\n      );\n      return;\n    }\n    try {\n      // Execute AI prompts. Each key is a separate billed model call, so the\n      // count is capped rather than being driven by whatever the caller sent.\n      const promptEntries = Object.entries(pending.aiPrompts);\n      const maxPrompts =\n        getAiConfig().maxPromptsPerNotification ?? AI_DEFAULTS.maxPromptsPerNotification;\n      if (promptEntries.length > maxPrompts) {\n        this.logger.warn(\n          { messageId: message.id, requested: promptEntries.length, maxPrompts },\n          \"aiPrompts exceeds the per-notification cap — extra prompts ignored\",\n        );\n      }\n\n      const generatedVars: Record<string, string> = {};\n      for (const [key, prompt] of promptEntries.slice(0, maxPrompts)) {\n        generatedVars[key] = await this.generateAiContent(prompt, pending.templateVariables);\n      }\n\n      // Merge generated vars with original template vars\n      const finalVars = { ...pending.templateVariables, ...generatedVars };\n\n      const dbTemplate = pending.templateId\n        ? await this.templateCache.getCachedTemplate(pending.projectId, pending.templateId)\n        : null;\n\n      const rendered = renderWithTemplate(dbTemplate, finalVars);\n\n      const taskId = randomUUID();\n      const destination =\n        pending.channel === \"email\"\n          ? pending.recipient.email\n          : pending.channel === \"sms\"\n            ? pending.recipient.phone\n            : pending.channel === \"webhook\"\n              ? pending.recipient.webhook\n              : pending.channel === \"push\"\n                ? (pending.recipient.pushTokens?.[0] ?? pending.recipient.pushToken)\n                : undefined;\n      const resolvedDestination =\n        destination ?? (pending.channel === \"push\" ? undefined : pending.recipientId);\n\n      const taskPayload: NotificationDispatchedPayload = {\n        projectId: pending.projectId,\n        taskId,\n        enrichedEventId: pending.enrichedEventId,\n        recipientId: pending.recipientId,\n        channel: pending.channel,\n        priority: pending.priority,\n        templateId: pending.templateId,\n        templateVariables: pending.templateVariables,\n        aiPrompts: pending.aiPrompts,\n        recipient: pending.recipient,\n        renderedContent: rendered,\n        destination: resolvedDestination,\n        deliveryOptions: {\n          maxAttempts: 3,\n          timeoutMs: 10_000,\n        },\n        fallbackChain: pending.fallbackChain,\n      };\n\n      const envelope = buildStreamEvent(\n        \"notification.dispatched\",\n        taskPayload as Record<string, unknown>,\n        \"ai-worker\",\n        event.metadata.traceId,\n      );\n\n      // Route by scheduledAt\n      const now = Date.now();\n      const scheduledAt = pending.scheduledAt ? new Date(pending.scheduledAt).getTime() : now;\n\n      if (scheduledAt > now) {\n        await this.db.insert(scheduledPayloads).values({\n          taskId,\n          payload: taskPayload,\n        });\n\n        const scheduledEnvelope = buildStreamEvent(\n          \"notification.scheduled\",\n          {\n            projectId: pending.projectId,\n            enrichedEventId: pending.enrichedEventId,\n            taskId,\n            scheduledAt: pending.scheduledAt!,\n          },\n          \"ai-worker\",\n          event.metadata.traceId,\n        );\n\n        await this.scheduledProducer.publish(scheduledEnvelope);\n        this.logger.info(\n          {\n            messageId: message.id,\n            taskId,\n            scheduledAt: pending.scheduledAt,\n            traceId: event.metadata.traceId,\n          },\n          \"task scheduled and payload cached after AI generation\",\n        );\n      } else {\n        const p = getPriorityBucket(pending.priority);\n        const outboundProducer = this.outboundProducers[p] ?? this.outboundProducers[\"normal\"]!;\n\n        await outboundProducer.publish(envelope);\n        this.logger.info(\n          {\n            messageId: message.id,\n            taskId,\n            recipientId: pending.recipientId,\n            traceId: event.metadata.traceId,\n          },\n          \"task dispatched after AI generation\",\n        );\n      }\n    } catch (err) {\n      await this.idempotency.unmark(idempotencyKey);\n      if (err instanceof PermanentAiError || (err as Error)?.name === \"PermanentAiError\") {\n        // Retrying re-bills the same failing prompt. Fail the notification once.\n        this.logger.error(\n          { err, messageId: message.id, recipientId: pending.recipientId },\n          \"AI generation failed permanently — dropping notification without retry\",\n        );\n        globalEmitter.emit(\n          \"notification:failed\",\n          pending.enrichedEventId,\n          (err as Error).message,\n          pending.channel,\n        );\n        return;\n      }\n      throw err;\n    }\n  }\n}\n\nexport async function startAiWorker() {\n  logger = createLogger({ name: \"ai\", level: config.LOG_LEVEL });\n  redis = new RedisClient({ url: config.REDIS_URL, name: \"ai\", logger });\n  const dbData = createDatabase({ url: config.DATABASE_URL, applicationName: \"ai\", logger });\n  sql = dbData.sql;\n  db = dbData.db;\n  templateRepo = new TemplateRepository(db);\n  templateCache = new TemplateCache(templateRepo);\n  consumer = new StreamConsumer({\n    redis: redis.native,\n    stream: STREAMS.AI_PENDING as StreamName,\n    group: CONSUMER_GROUPS.AI,\n    consumer: `ai-${process.pid}`,\n    dlqStream: STREAMS.DEAD_LETTER,\n    batchSize: config.WORKER_CONCURRENCY,\n    logger,\n  });\n\n  pendingScanner = new PendingMessageScanner({\n    redis: redis.native,\n    stream: STREAMS.AI_PENDING as StreamName,\n    group: CONSUMER_GROUPS.AI,\n    consumer: `ai-${process.pid}`,\n    logger,\n  });\n\n  const outboundProducers = {\n    critical: new StreamProducer({\n      redis: redis.native,\n      stream: STREAMS.OUTBOUND_CRITICAL,\n      logger,\n    }),\n    normal: new StreamProducer({ redis: redis.native, stream: STREAMS.OUTBOUND_NORMAL, logger }),\n    low: new StreamProducer({ redis: redis.native, stream: STREAMS.OUTBOUND_LOW, logger }),\n  };\n\n  const scheduledProducer = new StreamProducer({\n    redis: redis.native,\n    stream: STREAMS.SCHEDULED,\n    logger,\n  });\n\n  const idempotency = new IdempotencyGuard({\n    redis: redis.native,\n    keyPrefix: \"notif:processed:ai\",\n    ttlSeconds: 86_400,\n  });\n\n  // AI generation\n  async function generateAiContent(prompt: string, vars: Record<string, unknown>): Promise<string> {\n    const aiConfig = getAiConfig();\n    const interpolated = prompt.replace(/\\{\\{(\\w+)\\}\\}/g, (_, k: string) => String(vars[k] ?? \"\"));\n\n    if (!aiConfig || !aiConfig.aiModel) {\n      logger.warn(\"AI worker called but no AI model was provided to NotifkitServer\");\n      return `[AI Disabled] ${interpolated}`;\n    }\n\n    const maxOutputTokens = aiConfig.maxOutputTokens ?? AI_DEFAULTS.maxOutputTokens;\n    const timeoutMs = aiConfig.timeoutMs ?? AI_DEFAULTS.timeoutMs;\n\n    try {\n      const { text } = await generateText({\n        model: aiConfig.aiModel,\n        prompt: interpolated,\n        maxOutputTokens,\n        abortSignal: AbortSignal.timeout(timeoutMs),\n      });\n\n      return text;\n    } catch (err) {\n      // BaseWorker retries a throw up to maxRetriesBeforeDlq, and every retry is\n      // another billed call. Only re-throw for failures a retry could actually\n      // fix; a malformed prompt or a rejected request must not be re-billed.\n      if (isRetryableAiError(err)) {\n        logger.error({ err }, \"AI generation failed (transient) — will retry\");\n        throw err;\n      }\n      throw new PermanentAiError(err instanceof Error ? err.message : String(err), { cause: err });\n    }\n  }\n\n  worker = new AiWorker({\n    consumer,\n    pendingScanner,\n    logger,\n    concurrency: config.WORKER_CONCURRENCY,\n    registry,\n    idempotency,\n    redis: redis.native,\n    generateAiContent,\n    templateCache,\n    scheduledProducer,\n    outboundProducers,\n    db,\n  });\n\n  subscriber = redis.native.duplicate();\n  await subscriber.subscribe(\"template.invalidated\");\n  subscriber.on(\"message\", (channel: string, message: string) => {\n    if (channel === \"template.invalidated\") {\n      templateCache.invalidateKey(message);\n      logger.info({ cacheKey: message }, \"invalidated template cache\");\n    }\n  });\n\n  healthInterval = startHealthReporter(\"ai\", worker, redis, logger);\n\n  logger.info({ env: config.NODE_ENV, redis: config.REDIS_URL }, \"ai starting\");\n  await worker.start();\n}\n\nexport async function stopAiWorker(): Promise<void> {\n  logger?.info(\"shutdown initiated\");\n  if (healthInterval) {\n    clearInterval(healthInterval);\n    healthInterval = null;\n  }\n  if (subscriber) {\n    subscriber.disconnect();\n    subscriber = null;\n  }\n  if (worker) await worker.stop();\n  if (sql) await sql.end();\n  if (redis) await redis.disconnect();\n  logger?.info(\"ai stopped\");\n}\n"],"mappings":";;;;AAiCA,QAAQ;AACR,MAAM,SAAS,eAAe;AAE9B,IAAI;AACJ,IAAI;AACJ,IAAI;AACJ,IAAI;AACJ,IAAI;AAEJ,IAAI;AAEJ,IAAI;AACJ,IAAI;AACJ,IAAI;AACJ,IAAI,iBAAwC;AAC5C,IAAI,aAAkB;;;;;;AAOtB,IAAa,mBAAb,cAAsC,MAAM;CAC1C,YAAY,SAAiB,SAAwB;EACnD,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;CACd;AACF;;AAGA,SAAgB,mBAAmB,KAAuB;CACxD,IAAI,eAAe,kBAAkB,OAAO;CAE5C,MAAM,IAAI;CACV,IAAI,CAAC,GAAG,OAAO;CAEf,IAAI,EAAE,SAAS,kBAAkB,EAAE,SAAS,cAAc,OAAO;CAEjE,MAAM,SAAS,EAAE,cAAc,EAAE;CACjC,IAAI,OAAO,WAAW,UACpB,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,UAAU;CAIzE,OAAO;AACT;AAaA,IAAa,WAAb,cAA8B,WAAW;CACvC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAA0B;EACpC,MAAM,OAAO;EACb,KAAK,WAAW,QAAQ;EACxB,KAAK,cAAc,QAAQ;EAC3B,KAAK,WAAW,QAAQ;EACxB,KAAK,oBAAoB,QAAQ;EACjC,KAAK,gBAAgB,QAAQ;EAC7B,KAAK,oBAAoB,QAAQ;EACjC,KAAK,oBAAoB,QAAQ;EACjC,KAAK,KAAK,QAAQ;CACpB;CACA,MAAM,QAAQ,SAAuC;EACnD,MAAM,EAAE,UAAU;EAElB,MAAM,gBAAgB,KAAK,SAAS,iBAAiB,2BAA2B,MAAM,OAAO;EAC7F,IAAI,CAAC,cAAc,SAAS;GAC1B,KAAK,OAAO,KACV;IAAE,WAAW,QAAQ;IAAI,QAAQ,cAAc,MAAM;GAAO,GAC5D,oDACF;GACA;EACF;EAEA,MAAM,UAAU,cAAc;EAG9B,MAAM,iBAAiB,GAAG,QAAQ,gBAAgB,GAAG,QAAQ,YAAY,GAAG,QAAQ,QAAQ;EAC5F,IAAI,CAAE,MAAM,KAAK,YAAY,aAAa,cAAc,GAAI;GAC1D,KAAK,OAAO,MACV;IAAE,WAAW,QAAQ;IAAI,SAAS,MAAM;GAAG,GAC3C,8BACF;GACA;EACF;EACA,IAAI;GAGF,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,SAAS;GACtD,MAAM,aACJ,YAAY,CAAC,CAAC,6BAA6B,YAAY;GACzD,IAAI,cAAc,SAAS,YACzB,KAAK,OAAO,KACV;IAAE,WAAW,QAAQ;IAAI,WAAW,cAAc;IAAQ;GAAW,GACrE,oEACF;GAGF,MAAM,gBAAwC,CAAC;GAC/C,KAAK,MAAM,CAAC,KAAK,WAAW,cAAc,MAAM,GAAG,UAAU,GAC3D,cAAc,OAAO,MAAM,KAAK,kBAAkB,QAAQ,QAAQ,iBAAiB;GAIrF,MAAM,YAAY;IAAE,GAAG,QAAQ;IAAmB,GAAG;GAAc;GAEnE,MAAM,aAAa,QAAQ,aACvB,MAAM,KAAK,cAAc,kBAAkB,QAAQ,WAAW,QAAQ,UAAU,IAChF;GAEJ,MAAM,WAAW,mBAAmB,YAAY,SAAS;GAEzD,MAAM,SAAS,WAAW;GAW1B,MAAM,uBATJ,QAAQ,YAAY,UAChB,QAAQ,UAAU,QAClB,QAAQ,YAAY,QAClB,QAAQ,UAAU,QAClB,QAAQ,YAAY,YAClB,QAAQ,UAAU,UAClB,QAAQ,YAAY,SACjB,QAAQ,UAAU,aAAa,MAAM,QAAQ,UAAU,YACxD,KAAA,OAEM,QAAQ,YAAY,SAAS,KAAA,IAAY,QAAQ;GAEnE,MAAM,cAA6C;IACjD,WAAW,QAAQ;IACnB;IACA,iBAAiB,QAAQ;IACzB,aAAa,QAAQ;IACrB,SAAS,QAAQ;IACjB,UAAU,QAAQ;IAClB,YAAY,QAAQ;IACpB,mBAAmB,QAAQ;IAC3B,WAAW,QAAQ;IACnB,WAAW,QAAQ;IACnB,iBAAiB;IACjB,aAAa;IACb,iBAAiB;KACf,aAAa;KACb,WAAW;IACb;IACA,eAAe,QAAQ;GACzB;GAEA,MAAM,WAAW,iBACf,2BACA,aACA,aACA,MAAM,SAAS,OACjB;GAGA,MAAM,MAAM,KAAK,IAAI;GAGrB,KAFoB,QAAQ,cAAc,IAAI,KAAK,QAAQ,WAAW,CAAC,CAAC,QAAQ,IAAI,OAElE,KAAK;IACrB,MAAM,KAAK,GAAG,OAAO,iBAAiB,CAAC,CAAC,OAAO;KAC7C;KACA,SAAS;IACX,CAAC;IAED,MAAM,oBAAoB,iBACxB,0BACA;KACE,WAAW,QAAQ;KACnB,iBAAiB,QAAQ;KACzB;KACA,aAAa,QAAQ;IACvB,GACA,aACA,MAAM,SAAS,OACjB;IAEA,MAAM,KAAK,kBAAkB,QAAQ,iBAAiB;IACtD,KAAK,OAAO,KACV;KACE,WAAW,QAAQ;KACnB;KACA,aAAa,QAAQ;KACrB,SAAS,MAAM,SAAS;IAC1B,GACA,uDACF;GACF,OAAO;IACL,MAAM,IAAI,kBAAkB,QAAQ,QAAQ;IAG5C,OAFyB,KAAK,kBAAkB,MAAM,KAAK,kBAAkB,UAAA,CAEtD,QAAQ,QAAQ;IACvC,KAAK,OAAO,KACV;KACE,WAAW,QAAQ;KACnB;KACA,aAAa,QAAQ;KACrB,SAAS,MAAM,SAAS;IAC1B,GACA,qCACF;GACF;EACF,SAAS,KAAK;GACZ,MAAM,KAAK,YAAY,OAAO,cAAc;GAC5C,IAAI,eAAe,oBAAqB,KAAe,SAAS,oBAAoB;IAElF,KAAK,OAAO,MACV;KAAE;KAAK,WAAW,QAAQ;KAAI,aAAa,QAAQ;IAAY,GAC/D,wEACF;IACA,cAAc,KACZ,uBACA,QAAQ,iBACP,IAAc,SACf,QAAQ,OACV;IACA;GACF;GACA,MAAM;EACR;CACF;AACF;AAEA,eAAsB,gBAAgB;CACpC,SAAS,aAAa;EAAE,MAAM;EAAM,OAAO,OAAO;CAAU,CAAC;CAC7D,QAAQ,IAAI,YAAY;EAAE,KAAK,OAAO;EAAW,MAAM;EAAM;CAAO,CAAC;CACrE,MAAM,SAAS,eAAe;EAAE,KAAK,OAAO;EAAc,iBAAiB;EAAM;CAAO,CAAC;CACzF,MAAM,OAAO;CACb,KAAK,OAAO;CACZ,eAAe,IAAI,mBAAmB,EAAE;CACxC,gBAAgB,IAAI,cAAc,YAAY;CAC9C,WAAW,IAAI,eAAe;EAC5B,OAAO,MAAM;EACb,QAAQ,QAAQ;EAChB,OAAO,gBAAgB;EACvB,UAAU,MAAM,QAAQ;EACxB,WAAW,QAAQ;EACnB,WAAW,OAAO;EAClB;CACF,CAAC;CAED,iBAAiB,IAAI,sBAAsB;EACzC,OAAO,MAAM;EACb,QAAQ,QAAQ;EAChB,OAAO,gBAAgB;EACvB,UAAU,MAAM,QAAQ;EACxB;CACF,CAAC;CAED,MAAM,oBAAoB;EACxB,UAAU,IAAI,eAAe;GAC3B,OAAO,MAAM;GACb,QAAQ,QAAQ;GAChB;EACF,CAAC;EACD,QAAQ,IAAI,eAAe;GAAE,OAAO,MAAM;GAAQ,QAAQ,QAAQ;GAAiB;EAAO,CAAC;EAC3F,KAAK,IAAI,eAAe;GAAE,OAAO,MAAM;GAAQ,QAAQ,QAAQ;GAAc;EAAO,CAAC;CACvF;CAEA,MAAM,oBAAoB,IAAI,eAAe;EAC3C,OAAO,MAAM;EACb,QAAQ,QAAQ;EAChB;CACF,CAAC;CAED,MAAM,cAAc,IAAI,iBAAiB;EACvC,OAAO,MAAM;EACb,WAAW;EACX,YAAY;CACd,CAAC;CAGD,eAAe,kBAAkB,QAAgB,MAAgD;EAC/F,MAAM,WAAW,YAAY;EAC7B,MAAM,eAAe,OAAO,QAAQ,mBAAmB,GAAG,MAAc,OAAO,KAAK,MAAM,EAAE,CAAC;EAE7F,IAAI,CAAC,YAAY,CAAC,SAAS,SAAS;GAClC,OAAO,KAAK,iEAAiE;GAC7E,OAAO,iBAAiB;EAC1B;EAEA,MAAM,kBAAkB,SAAS,mBAAmB,YAAY;EAChE,MAAM,YAAY,SAAS,aAAa,YAAY;EAEpD,IAAI;GACF,MAAM,EAAE,SAAS,MAAM,aAAa;IAClC,OAAO,SAAS;IAChB,QAAQ;IACR;IACA,aAAa,YAAY,QAAQ,SAAS;GAC5C,CAAC;GAED,OAAO;EACT,SAAS,KAAK;GAIZ,IAAI,mBAAmB,GAAG,GAAG;IAC3B,OAAO,MAAM,EAAE,IAAI,GAAG,+CAA+C;IACrE,MAAM;GACR;GACA,MAAM,IAAI,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,EAAE,OAAO,IAAI,CAAC;EAC7F;CACF;CAEA,SAAS,IAAI,SAAS;EACpB;EACA;EACA;EACA,aAAa,OAAO;EACpB;EACA;EACA,OAAO,MAAM;EACb;EACA;EACA;EACA;EACA;CACF,CAAC;CAED,aAAa,MAAM,OAAO,UAAU;CACpC,MAAM,WAAW,UAAU,sBAAsB;CACjD,WAAW,GAAG,YAAY,SAAiB,YAAoB;EAC7D,IAAI,YAAY,wBAAwB;GACtC,cAAc,cAAc,OAAO;GACnC,OAAO,KAAK,EAAE,UAAU,QAAQ,GAAG,4BAA4B;EACjE;CACF,CAAC;CAED,iBAAiB,oBAAoB,MAAM,QAAQ,OAAO,MAAM;CAEhE,OAAO,KAAK;EAAE,KAAK,OAAO;EAAU,OAAO,OAAO;CAAU,GAAG,aAAa;CAC5E,MAAM,OAAO,MAAM;AACrB;AAEA,eAAsB,eAA8B;CAClD,QAAQ,KAAK,oBAAoB;CACjC,IAAI,gBAAgB;EAClB,cAAc,cAAc;EAC5B,iBAAiB;CACnB;CACA,IAAI,YAAY;EACd,WAAW,WAAW;EACtB,aAAa;CACf;CACA,IAAI,QAAQ,MAAM,OAAO,KAAK;CAC9B,IAAI,KAAK,MAAM,IAAI,IAAI;CACvB,IAAI,OAAO,MAAM,MAAM,WAAW;CAClC,QAAQ,KAAK,YAAY;AAC3B"}