okengine 0.6.0 → 0.7.0

package/src/drivers/channel-webpush.ts

@@ -1,9 +1,12 @@
 /**
- * `webpush` channel driver — RFC 8030 (Web Push) + VAPID (RFC 8292).
+ * `webpush` channel driver — RFC 8030 + VAPID via sently.
  *
- * Implemented natively with Web Crypto. No third-party push library.
+ * Call path: ChannelTransport.send → createPushSender → WebPushTransport.
  */
 
+import { createPushSender } from "sently/push";
+import { WebPushTransport } from "sently/transports/webpush";
+import { mapSentlySendError, mapSentlySendResult } from "./channel-sently-map.ts";
 import type {
   ChannelDriver,
   ChannelMessage,
@@ -12,263 +15,60 @@ import type {
   ChannelTransport,
 } from "./channel-types.ts";
 
-/**
- * Decode a URL-safe base64 string.
- *
- * @param input - Base64url text
- */
-function b64urlDecode(input: string): Uint8Array<ArrayBuffer> {
-  const pad = "=".repeat((4 - (input.length % 4)) % 4);
-  const b64 = (input + pad).replace(/-/g, "+").replace(/_/g, "/");
-  const bin = atob(b64);
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
-  return out;
-}
-
-/** Fresh buffer for Web Crypto `BufferSource` typing. */
-function asBufferSource(bytes: Uint8Array): Uint8Array<ArrayBuffer> {
-  return new Uint8Array(bytes);
-}
-
-/**
- * Encode bytes as base64url (no padding).
- *
- * @param bytes - Input
- */
-function b64urlEncode(bytes: Uint8Array): string {
-  let s = "";
-  for (const b of bytes) s += String.fromCharCode(b);
-  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-
-/**
- * Import a VAPID ECDSA P-256 private key from base64url raw or PKCS8.
- *
- * @param privateKeyB64 - Base64url private key
- */
-async function importVapidPrivateKey(privateKeyB64: string): Promise<CryptoKey> {
-  const raw = b64urlDecode(privateKeyB64);
-  // Prefer PKCS8; fall back to raw JWK construction for 32-byte seeds.
-  if (raw.length > 32) {
-    return crypto.subtle.importKey(
-      "pkcs8",
-      asBufferSource(raw),
-      { name: "ECDSA", namedCurve: "P-256" },
-      false,
-      ["sign"],
-    );
-  }
-  // Build a minimal JWK from d (and a synthetic public x/y via derive is hard);
-  // tests inject fetch and only need Authorization header shape — use ECDSA
-  // with a generated key when raw seed is provided without full PKCS8.
-  const pair = await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, [
-    "sign",
-    "verify",
-  ]);
-  return pair.privateKey;
-}
-
-/**
- * Build a VAPID JWT (RFC 8292) for the push audience.
- *
- * @param audience - Origin of the push service
- * @param subject - `mailto:` or HTTPS contact
- * @param privateKey - ECDSA P-256 key
- */
-async function buildVapidJwt(
-  audience: string,
-  subject: string,
-  privateKey: CryptoKey,
-): Promise<string> {
-  const header = b64urlEncode(
-    new TextEncoder().encode(JSON.stringify({ typ: "JWT", alg: "ES256" })),
-  );
-  const exp = Math.floor(Date.now() / 1000) + 12 * 60 * 60;
-  const payload = b64urlEncode(
-    new TextEncoder().encode(JSON.stringify({ aud: audience, exp, sub: subject })),
-  );
-  const data = new TextEncoder().encode(`${header}.${payload}`);
-  const sig = new Uint8Array(
-    await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, privateKey, data),
-  );
-  // Convert DER → raw r||s if needed; Web Crypto in Bun returns raw P-1363.
-  return `${header}.${payload}.${b64urlEncode(sig)}`;
-}
-
-/**
- * Minimal RFC 8030 encrypted body: salt + rs + server public + ciphertext.
- * For tests with injected fetch we send a well-formed envelope; production
- * should use full ece (aes128gcm). Here we implement aes128gcm content-coding
- * with Web Crypto ECDH + HKDF as specified.
- *
- * @param plaintext - Push payload bytes
- * @param p256dh - Subscriber public key (base64url)
- * @param auth - Subscriber auth secret (base64url)
- */
-async function encryptPushBody(
-  plaintext: Uint8Array,
-  p256dh: string,
-  auth: string,
-): Promise<{ body: Uint8Array; salt: Uint8Array; localPublic: Uint8Array }> {
-  const userPublic = await crypto.subtle.importKey(
-    "raw",
-    asBufferSource(b64urlDecode(p256dh)),
-    { name: "ECDH", namedCurve: "P-256" },
-    true,
-    [],
-  );
-  const local = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, [
-    "deriveBits",
-  ]);
-  const shared = new Uint8Array(
-    await crypto.subtle.deriveBits({ name: "ECDH", public: userPublic }, local.privateKey, 256),
-  );
-  const salt = crypto.getRandomValues(new Uint8Array(16));
-  const authSecret = b64urlDecode(auth);
-
-  // HKDF-SHA-256 as in RFC 8291
-  const ikmKey = await crypto.subtle.importKey("raw", asBufferSource(shared), "HKDF", false, [
-    "deriveBits",
-  ]);
-  const prk = new Uint8Array(
-    await crypto.subtle.deriveBits(
-      {
-        name: "HKDF",
-        hash: "SHA-256",
-        salt: asBufferSource(authSecret),
-        info: new TextEncoder().encode("WebPush: info\0"),
-      },
-      ikmKey,
-      256,
-    ),
-  );
-  // Simplified content encryption key / nonce derivation for aes128gcm
-  const prkKey = await crypto.subtle.importKey("raw", prk, "HKDF", false, ["deriveBits"]);
-  const cek = new Uint8Array(
-    await crypto.subtle.deriveBits(
-      {
-        name: "HKDF",
-        hash: "SHA-256",
-        salt,
-        info: new TextEncoder().encode("Content-Encoding: aes128gcm\0"),
-      },
-      prkKey,
-      128,
-    ),
-  );
-  const nonce = new Uint8Array(
-    await crypto.subtle.deriveBits(
-      {
-        name: "HKDF",
-        hash: "SHA-256",
-        salt,
-        info: new TextEncoder().encode("Content-Encoding: nonce\0"),
-      },
-      prkKey,
-      96,
-    ),
-  );
-  const aes = await crypto.subtle.importKey("raw", cek, { name: "AES-GCM" }, false, ["encrypt"]);
-  // Add RFC 8188 padding delimiter (0x02) then encrypt
-  const padded = new Uint8Array(plaintext.length + 1);
-  padded.set(plaintext, 0);
-  padded[plaintext.length] = 2;
-  const ciphertext = new Uint8Array(
-    await crypto.subtle.encrypt({ name: "AES-GCM", iv: nonce }, aes, padded),
-  );
-  const localPublic = new Uint8Array(await crypto.subtle.exportKey("raw", local.publicKey));
-
-  // Body = salt (16) || rs (4) || idlen (1) || keyid || ciphertext
-  const rs = new Uint8Array(4);
-  new DataView(rs.buffer).setUint32(0, 4096);
-  const idlen = new Uint8Array([localPublic.length]);
-  const body = new Uint8Array(16 + 4 + 1 + localPublic.length + ciphertext.length);
-  body.set(salt, 0);
-  body.set(rs, 16);
-  body.set(idlen, 20);
-  body.set(localPublic, 21);
-  body.set(ciphertext, 21 + localPublic.length);
-  return { body, salt, localPublic };
-}
-
 /**
  * Open a Web Push driver (RFC 8030 + VAPID).
  *
  * @param options - VAPID keys + subject
  */
 export function openWebPushChannel(options: ChannelOpenOptions = {}): ChannelDriver {
-  const vapidPublic = options.vapidPublicKey;
-  const vapidPrivate = options.vapidPrivateKey;
+  const vapidPublicKey = options.vapidPublicKey;
+  const vapidPrivateKey = options.vapidPrivateKey;
   const subject = options.vapidSubject ?? "mailto:ops@oke.local";
-  const fetchFn = options.fetch ?? globalThis.fetch;
+  if (!vapidPublicKey || !vapidPrivateKey) {
+    throw new Error("webpush: vapidPublicKey and vapidPrivateKey are required");
+  }
+
+  const transport = new WebPushTransport({
+    vapidPublicKey,
+    vapidPrivateKey,
+    subject,
+  });
+  const sender = createPushSender({ transport });
 
   const channel: ChannelTransport = {
     provider: "webpush",
     mediums: ["push"],
     async send(message: ChannelMessage): Promise<ChannelSendResult> {
-      if (!vapidPrivate || !vapidPublic) {
-        throw new Error("webpush: vapidPublicKey and vapidPrivateKey are required");
-      }
       const sub = message.pushSubscription;
       const endpoint = sub?.endpoint ?? message.to;
-      if (!endpoint.startsWith("http")) {
-        throw new Error("webpush: pushSubscription.endpoint (or https to) required");
-      }
-      const audience = new URL(endpoint).origin;
-      const privateKey = await importVapidPrivateKey(vapidPrivate);
-      const jwt = await buildVapidJwt(audience, subject, privateKey);
-
-      const plaintext = new TextEncoder().encode(
-        message.text ?? JSON.stringify(message.data ?? {}),
-      );
-      let body: Uint8Array = plaintext;
-      const headers: Record<string, string> = {
-        Authorization: `vapid t=${jwt}, k=${vapidPublic}`,
-        TTL: "86400",
-        Urgency: "normal",
-      };
-
-      if (sub?.keys?.p256dh && sub.keys.auth) {
-        const enc = await encryptPushBody(plaintext, sub.keys.p256dh, sub.keys.auth);
-        body = enc.body;
-        headers["Content-Encoding"] = "aes128gcm";
-        headers["Content-Type"] = "application/octet-stream";
-      } else {
-        headers["Content-Type"] = "text/plain;charset=utf-8";
+      if (!endpoint.startsWith("http") || !sub?.keys?.p256dh || !sub.keys.auth) {
+        throw new Error("webpush: pushSubscription with endpoint + keys is required");
       }
 
-      const res = await fetchFn(endpoint, {
-        method: "POST",
-        headers,
-        body: body as unknown as ArrayBuffer,
-      });
-      const id = res.headers.get("location") ?? crypto.randomUUID();
-      if (!res.ok && res.status !== 201) {
-        return {
-          ok: false,
-          messageId: id,
-          driverId: "webpush",
-          attempts: [
-            {
-              driverId: "webpush",
-              ok: false,
-              error: `HTTP ${res.status}`,
-              at: Date.now(),
-            },
-          ],
-        };
+      try {
+        const title =
+          message.subject ??
+          (typeof message.data?.title === "string" ? message.data.title : "Notification");
+        const body = message.text ?? JSON.stringify(message.data ?? {});
+        const result = await sender.send({
+          subscription: {
+            endpoint,
+            keys: { p256dh: sub.keys.p256dh, auth: sub.keys.auth },
+          },
+          title,
+          body,
+          ...(message.data ? { data: { ...message.data } } : {}),
+        });
+        return mapSentlySendResult("webpush", result);
+      } catch (err) {
+        return mapSentlySendError("webpush", err);
       }
-      return {
-        ok: true,
-        messageId: id,
-        driverId: "webpush",
-        attempts: [{ driverId: "webpush", ok: true, at: Date.now(), messageId: id }],
-      };
     },
+    verify: () => sender.verify(),
+    close: () => sender.close(),
   };
 
-  return { id: "webpush", channel };
+  return { id: "webpush", channel, pushTransport: transport };
 }
 
 /** Web Push driver factory. */

package/src/drivers/index.ts

@@ -41,6 +41,7 @@ export type {
   SignalDriver,
   SignalBus,
   SignalMessage,
+  SignalEmitOptions,
   SignalFailureReason,
   DeadLetter,
   SignalTransaction,
@@ -55,6 +56,8 @@ export type {
   SignalDiscardOptions,
 } from "./signal-types.ts";
 
+export { SIGNAL_DEFAULT_LEASE_MS } from "./signal-types.ts";
+
 export {
   memorySqlDriver,
   memoryKvDriver,
@@ -139,10 +142,14 @@ export { createChannelInbox } from "./channel-types.ts";
 export { consoleChannelDriver, openConsoleChannel } from "./channel-console.ts";
 export { smtpChannelDriver, openSmtpChannel } from "./channel-smtp.ts";
 export { resendChannelDriver, openResendChannel } from "./channel-resend.ts";
+export { sndrChannelDriver, openSndrChannel } from "./channel-sndr.ts";
+export { taqnyatChannelDriver, openTaqnyatChannel } from "./channel-taqnyat.ts";
+export { msegatChannelDriver, openMsegatChannel } from "./channel-msegat.ts";
 export { unifonicChannelDriver, openUnifonicChannel } from "./channel-unifonic.ts";
 export { waCloudChannelDriver, openWaCloudChannel } from "./channel-wa-cloud.ts";
 export { fcmChannelDriver, openFcmChannel } from "./channel-fcm.ts";
 export { webpushChannelDriver, openWebPushChannel } from "./channel-webpush.ts";
+export { mapSentlySendResult, mapSentlySendError } from "./channel-sently-map.ts";
 
 export type {
   AiDriverId,

package/src/drivers/signal-engine.ts

@@ -11,21 +11,25 @@ import { dirname } from "node:path";
 import type { SignalDecl } from "../elements/signal/declare.ts";
 import type { SignalDelivery } from "../manifest/types.ts";
 import { DryRunWriteIsolationError, setDryRunMessageId, withDryRun } from "../kernel/dry-run.ts";
-import type {
-  DeadLetter,
-  LiveHandler,
-  SignalBus,
-  SignalDiscardOptions,
-  SignalDriverId,
-  SignalFailureReason,
-  SignalHandler,
-  SignalMessage,
-  SignalOpenOptions,
-  SignalReplayOptions,
-  SignalReplayResult,
-  SignalStats,
-  SignalTransaction,
-  SignalUnsubscribe,
+import { OkeError, OKE_ERRORS } from "../kernel/errors.ts";
+import {
+  SIGNAL_DEFAULT_LEASE_MS,
+  validateSignalEmitPayload,
+  type DeadLetter,
+  type LiveHandler,
+  type SignalBus,
+  type SignalDiscardOptions,
+  type SignalDriverId,
+  type SignalEmitOptions,
+  type SignalFailureReason,
+  type SignalHandler,
+  type SignalMessage,
+  type SignalOpenOptions,
+  type SignalReplayOptions,
+  type SignalReplayResult,
+  type SignalStats,
+  type SignalTransaction,
+  type SignalUnsubscribe,
 } from "./signal-types.ts";
 
 /** Internal mutable message. */
@@ -33,6 +37,8 @@ interface MutMessage {
   id: string;
   signal: string;
   payload: unknown;
+  /** Optional per-key ordering token (`once` serialization). */
+  key: string | null;
   delivery: SignalDelivery;
   attempts: number;
   failures: SignalFailureReason[];
@@ -41,6 +47,8 @@ interface MutMessage {
   status: "pending" | "inflight" | "delivered" | "dead";
   /** For once: which consumer holds the claim. */
   lockedBy: string | null;
+  /** For once: when the claim lease expires (epoch ms); null when unlocked. */
+  leaseExpiresAt: number | null;
   /** For broadcast: subscriber ids that already received. */
   deliveredTo: Set<string>;
 }
@@ -48,9 +56,10 @@ interface MutMessage {
 /** Persisted snapshot for chaos recovery. */
 interface Snapshot {
   messages: Array<
-    Omit<MutMessage, "deliveredTo" | "lockedBy"> & {
+    Omit<MutMessage, "deliveredTo" | "lockedBy" | "leaseExpiresAt"> & {
       deliveredTo: string[];
       lockedBy: string | null;
+      leaseExpiresAt: number | null;
     }
   >;
   writes: Array<[string, unknown]>;
@@ -76,6 +85,7 @@ export async function createSignalEngine(
   const now = options.now ?? (() => Date.now());
   const signals = options.signals;
   const durablePath = options.durablePath;
+  const leaseMs = options.leaseMs ?? SIGNAL_DEFAULT_LEASE_MS;
 
   let messages: MutMessage[] = [];
   let writes = new Map<string, unknown>();
@@ -152,7 +162,9 @@ export async function createSignalEngine(
     if (snap) {
       messages = snap.messages.map((m) => ({
         ...m,
+        key: m.key ?? null,
         lockedBy: m.lockedBy,
+        leaseExpiresAt: m.leaseExpiresAt ?? null,
         deliveredTo: new Set(m.deliveredTo),
       }));
       writes = new Map(snap.writes);
@@ -166,6 +178,7 @@ export async function createSignalEngine(
         id: m.id,
         signal: m.signal,
         payload: m.payload,
+        key: m.key,
         delivery: m.delivery,
         attempts: m.attempts,
         failures: m.failures,
@@ -173,6 +186,7 @@ export async function createSignalEngine(
         availableAt: m.availableAt,
         status: m.status,
         lockedBy: m.lockedBy,
+        leaseExpiresAt: m.leaseExpiresAt,
         deliveredTo: [...m.deliveredTo],
       })),
       writes: [...writes.entries()],
@@ -189,13 +203,38 @@ export async function createSignalEngine(
     return decl;
   }
 
-  function stageEmit(stagedMessages: MutMessage[], name: string, payload: unknown): void {
+  function hasSubscriber(name: string): boolean {
+    if (consumers.some((c) => c.signal === name)) return true;
+    const live = liveHandlers.get(name);
+    return live !== undefined && live.size > 0;
+  }
+
+  function assertEmitAllowed(name: string): void {
+    const decl = requireDecl(name);
+    if (decl.optional) return;
+    if (hasSubscriber(name)) return;
+    throw new OkeError(OKE_ERRORS.ORPHAN_EMIT, {
+      flow: "unknown",
+      resource: name,
+    });
+  }
+
+  async function stageEmit(
+    stagedMessages: MutMessage[],
+    name: string,
+    payload: unknown,
+    options?: SignalEmitOptions,
+  ): Promise<void> {
     const decl = requireDecl(name);
+    assertEmitAllowed(name);
+    const value = await validateSignalEmitPayload(name, decl, payload);
     const t = now();
+    const key = typeof options?.key === "string" && options.key.length > 0 ? options.key : null;
     stagedMessages.push({
       id: crypto.randomUUID(),
       signal: name,
-      payload: payload ?? null,
+      payload: value,
+      key,
       delivery: decl.delivery,
       attempts: 0,
       failures: [],
@@ -203,6 +242,7 @@ export async function createSignalEngine(
       availableAt: t,
       status: "pending",
       lockedBy: null,
+      leaseExpiresAt: null,
       deliveredTo: new Set(),
     });
   }
@@ -218,9 +258,9 @@ export async function createSignalEngine(
         if (done) throw new Error("transaction finished");
         stagedWrites.set(key, value);
       },
-      async emit(signal, payload) {
+      async emit(signal, payload, options) {
         if (done) throw new Error("transaction finished");
-        stageEmit(stagedMessages, signal, payload);
+        await stageEmit(stagedMessages, signal, payload, options);
       },
       async commit() {
         if (done) throw new Error("transaction finished");
@@ -240,9 +280,13 @@ export async function createSignalEngine(
     return Promise.resolve(tx);
   }
 
-  async function emit(signal: string, payload?: unknown): Promise<void> {
+  async function emit(
+    signal: string,
+    payload?: unknown,
+    options?: SignalEmitOptions,
+  ): Promise<void> {
     const tx = await begin();
-    await tx.emit(signal, payload);
+    await tx.emit(signal, payload, options);
     await tx.commit();
   }
 
@@ -287,6 +331,7 @@ export async function createSignalEngine(
       id: m.id,
       signal: m.signal,
       payload: m.payload,
+      ...(m.key !== null ? { key: m.key } : {}),
       delivery: m.delivery,
       attempts: m.attempts,
       failures: [...m.failures],
@@ -296,18 +341,40 @@ export async function createSignalEngine(
     };
   }
 
+  /** True when another same-(signal, key) message holds an unexpired lease. */
+  function keyHeldByOther(candidate: MutMessage, t: number): boolean {
+    if (candidate.key === null) return false;
+    return messages.some(
+      (other) =>
+        other !== candidate &&
+        other.signal === candidate.signal &&
+        other.key === candidate.key &&
+        other.status === "inflight" &&
+        other.leaseExpiresAt !== null &&
+        other.leaseExpiresAt > t,
+    );
+  }
+
   /**
-   * Claim the next `once` message with SKIP LOCKED semantics.
+   * Claim the next `once` message with SKIP LOCKED + lazy lease reclaim.
+   *
+   * Eligible: pending/unlocked, or inflight whose `leaseExpiresAt` has passed,
+   * and not blocked by a same-key unexpired inflight (per-key serialization).
+   * No background sweeper — reclaim happens only at claim time.
    */
   function claimOnce(signal: string, consumerId: string): MutMessage | null {
     const t = now();
     for (const m of messages) {
       if (m.signal !== signal || m.delivery !== "once") continue;
-      if (m.status !== "pending") continue;
       if (m.availableAt > t) continue;
-      if (m.lockedBy !== null) continue;
+      const pendingOk = m.status === "pending" && m.lockedBy === null;
+      const leaseExpired =
+        m.status === "inflight" && m.leaseExpiresAt !== null && m.leaseExpiresAt <= t;
+      if (!pendingOk && !leaseExpired) continue;
+      if (keyHeldByOther(m, t)) continue;
       m.status = "inflight";
       m.lockedBy = consumerId;
+      m.leaseExpiresAt = t + leaseMs;
       m.attempts += 1;
       return m;
     }
@@ -320,10 +387,12 @@ export async function createSignalEngine(
       await consumer.handler(toPublic(m));
       m.status = "delivered";
       m.lockedBy = null;
+      m.leaseExpiresAt = null;
       noteDelivered();
     } catch (err) {
       m.failures.push(failureFromError(err, m.attempts));
       m.lockedBy = null;
+      m.leaseExpiresAt = null;
       if (m.attempts > decl.retries) {
         if (decl.deadLetter) {
           m.status = "dead";
@@ -348,6 +417,9 @@ export async function createSignalEngine(
       const m = claimOnce(consumer.signal, consumer.subscriberId);
       if (!m) continue;
       progress = true;
+      // Persist claim + lease before the handler runs so a crash mid-handler
+      // leaves a reclaimable inflight row (not a silent pending that never locked).
+      await persist();
       await deliverOnce(m, consumer);
     }
     return progress;
@@ -571,6 +643,7 @@ export async function createSignalEngine(
         if (!options.dryRun) {
           m.status = "pending";
           m.lockedBy = null;
+          m.leaseExpiresAt = null;
           m.availableAt = now();
           m.attempts = 0;
           if (m.delivery === "broadcast") {

package/src/drivers/signal-nats.ts

@@ -87,8 +87,8 @@ export async function openNatsSignal(options: SignalOpenOptions): Promise<Signal
 
   return {
     driverId: "nats",
-    async emit(signal, payload) {
-      await outbox.emit(signal, payload);
+    async emit(signal, payload, options) {
+      await outbox.emit(signal, payload, options);
       await relayToNats(signal, payload);
     },
     async begin() {
@@ -96,9 +96,9 @@ export async function openNatsSignal(options: SignalOpenOptions): Promise<Signal
       const tx = await outbox.begin();
       return {
         write: (k, v) => tx.write(k, v),
-        async emit(signal, payload) {
+        async emit(signal, payload, options) {
           staged.push({ signal, payload });
-          await tx.emit(signal, payload);
+          await tx.emit(signal, payload, options);
         },
         async commit() {
           await tx.commit();