@aglyn/tenant-data-admin 1.0.0-beta.229 → 1.0.0-beta.231

package/src/lib/server/push-apns.js

@@ -0,0 +1,225 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Apple Push Notification service, sent directly (AGL-3651): HTTP/2 to
+ * `api.push.apple.com` (or `api.sandbox.push.apple.com` for a development
+ * build's token), authenticated with a provider token, an ES256 JWT signed
+ * with the team's APNs key.
+ *
+ *   APNS_KEY_P8   the `.p8` key: PEM text, or that PEM (or its DER) base64-encoded
+ *   APNS_KEY_ID   the key's 10-character id
+ *   APNS_TEAM_ID  the Apple Developer team id
+ *
+ * Without all three the transport is off: a device on APNs is skipped and
+ * that is logged once per process. A provider token is reused for up to 50
+ * minutes (Apple refuses one older than an hour, and one refreshed more often
+ * than every 20). A `410`, `BadDeviceToken` or `Unregistered` answer means the
+ * token is gone, and the row is pruned.
+ *
+ * Server-only, imported by `push-delivery.ts` only when a device is on APNs.
+ */ import { createPrivateKey, sign } from "node:crypto";
+import { connect } from "node:http2";
+export const APNS_HOSTS = {
+    production: 'https://api.push.apple.com',
+    sandbox: 'https://api.sandbox.push.apple.com'
+};
+/** A provider token is reused for at most this long. */ export const APNS_TOKEN_TTL_MS = 50 * 60 * 1000;
+/** Requests in flight at once on one connection. */ const CONCURRENCY = 20;
+const base64url = (input)=>Buffer.from(input).toString('base64url');
+/** The `.p8` key from `APNS_KEY_P8`: PEM, base64 of the PEM, or base64 of the DER. */ export function parseApnsKey(raw) {
+    const text = raw.trim().replace(/\\n/g, '\n');
+    if (text.includes('-----BEGIN')) return createPrivateKey(text);
+    const decoded = Buffer.from(text, 'base64');
+    const asText = decoded.toString('utf8');
+    if (asText.includes('-----BEGIN')) return createPrivateKey(asText);
+    return createPrivateKey({
+        key: decoded,
+        format: 'der',
+        type: 'pkcs8'
+    });
+}
+export function apnsCredentials(env) {
+    var _env_APNS_KEY_P8, _env_APNS_KEY_ID, _env_APNS_TEAM_ID;
+    const raw = (_env_APNS_KEY_P8 = env['APNS_KEY_P8']) == null ? void 0 : _env_APNS_KEY_P8.trim();
+    const keyId = (_env_APNS_KEY_ID = env['APNS_KEY_ID']) == null ? void 0 : _env_APNS_KEY_ID.trim();
+    const teamId = (_env_APNS_TEAM_ID = env['APNS_TEAM_ID']) == null ? void 0 : _env_APNS_TEAM_ID.trim();
+    if (!raw || !keyId || !teamId) return null;
+    return {
+        key: parseApnsKey(raw),
+        keyId,
+        teamId
+    };
+}
+/** An ES256 provider token: `{alg, kid}.{iss, iat}`, signed raw (r‖s), as APNs requires. */ export function apnsProviderToken(credentials, nowMs) {
+    const header = base64url(JSON.stringify({
+        alg: 'ES256',
+        kid: credentials.keyId
+    }));
+    const claims = base64url(JSON.stringify({
+        iss: credentials.teamId,
+        iat: Math.floor(nowMs / 1000)
+    }));
+    const signature = sign('sha256', Buffer.from(`${header}.${claims}`), {
+        key: credentials.key,
+        dsaEncoding: 'ieee-p1363'
+    });
+    return `${header}.${claims}.${base64url(signature)}`;
+}
+/** The APNs payload: the alert, the default sound, and the tap data beside `aps`. */ export function apnsPayload(message) {
+    return JSON.stringify(_extends({
+        aps: {
+            alert: _extends({
+                title: message.title
+            }, message.body ? {
+                body: message.body
+            } : {}),
+            sound: 'default'
+        }
+    }, message.data));
+}
+const GONE = new Set([
+    'BadDeviceToken',
+    'Unregistered',
+    'DeviceTokenNotForTopic'
+]);
+export function apnsOutcome(response) {
+    if (response.status === 200) return 'sent';
+    if (response.status === 410) return 'prune';
+    let reason = '';
+    try {
+        var _ref;
+        var _JSON_parse;
+        reason = String((_ref = (_JSON_parse = JSON.parse(response.body)) == null ? void 0 : _JSON_parse.reason) != null ? _ref : '');
+    } catch (unused) {
+    // An unreadable body is a failure, not a verdict on the token.
+    }
+    return GONE.has(reason) ? 'prune' : 'failed';
+}
+/** The default request: one HTTP/2 session per origin for the life of a send. */ function http2Requester() {
+    const sessions = new Map();
+    const session = (origin)=>{
+        let open = sessions.get(origin);
+        if (!open || open.closed || open.destroyed) {
+            open = connect(origin);
+            open.on('error', ()=>undefined);
+            sessions.set(origin, open);
+        }
+        return open;
+    };
+    const request = (origin, headers, body)=>new Promise((resolve, reject)=>{
+            const stream = session(origin).request(_extends({
+                ':method': 'POST'
+            }, headers));
+            let status = 0;
+            let text = '';
+            stream.setEncoding('utf8');
+            stream.setTimeout(15000, ()=>stream.close());
+            stream.on('response', (head)=>{
+                var _head_status;
+                status = Number((_head_status = head[':status']) != null ? _head_status : 0);
+            });
+            stream.on('data', (chunk)=>{
+                text += chunk;
+            });
+            stream.on('end', ()=>resolve({
+                    status,
+                    body: text
+                }));
+            stream.on('error', reject);
+            stream.end(body);
+        });
+    return {
+        request,
+        close: ()=>{
+            for (const open of sessions.values())open.close();
+            sessions.clear();
+        }
+    };
+}
+export function createApnsTransport(options) {
+    var _options_now;
+    const now = (_options_now = options.now) != null ? _options_now : Date.now;
+    let cached = null;
+    const providerToken = ()=>{
+        const at = now();
+        if (!cached || at - cached.at >= APNS_TOKEN_TTL_MS) cached = {
+            token: apnsProviderToken(options.credentials, at),
+            at
+        };
+        return cached.token;
+    };
+    return {
+        async send (targets, message) {
+            const { request, close } = options.request ? {
+                request: options.request,
+                close: ()=>undefined
+            } : http2Requester();
+            const body = apnsPayload(message);
+            const outcomes = new Array(targets.length).fill('failed');
+            try {
+                for(let start = 0; start < targets.length; start += CONCURRENCY){
+                    const batch = targets.slice(start, start + CONCURRENCY);
+                    await Promise.all(batch.map(async (target, offset)=>{
+                        try {
+                            var _target_apnsEnvironment;
+                            const response = await request(APNS_HOSTS[(_target_apnsEnvironment = target.apnsEnvironment) != null ? _target_apnsEnvironment : 'production'], {
+                                ':path': `/3/device/${target.token}`,
+                                authorization: `bearer ${providerToken()}`,
+                                'apns-topic': target.topic,
+                                'apns-push-type': 'alert',
+                                'apns-priority': message.urgent ? '10' : '5',
+                                'content-type': 'application/json'
+                            }, body);
+                            // An expired or refused provider token is ours to mint again, not the device's fault.
+                            if (response.status === 403) cached = null;
+                            outcomes[start + offset] = apnsOutcome(response);
+                        } catch (unused) {
+                            outcomes[start + offset] = 'failed';
+                        }
+                    }));
+                }
+            } finally{
+                close();
+            }
+            return outcomes;
+        }
+    };
+}
+let warnedMissingKey = false;
+let configured = null;
+/**
+ * The deployment's APNs transport from `APNS_*`, or null — logged once —
+ * when they are not set.
+ */ export function apnsTransport(env = process.env) {
+    if (configured) return configured.transport;
+    const credentials = apnsCredentials(env);
+    if (!credentials) {
+        if (!warnedMissingKey) {
+            warnedMissingKey = true;
+            console.warn('push: APNS_KEY_P8, APNS_KEY_ID and APNS_TEAM_ID are not all set; iOS and macOS devices are skipped');
+        }
+        return null;
+    }
+    configured = {
+        transport: createApnsTransport({
+            credentials
+        })
+    };
+    return configured.transport;
+}
+
+//# sourceMappingURL=push-apns.js.map

package/src/lib/server/push-apns.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/push-apns.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Apple Push Notification service, sent directly (AGL-3651): HTTP/2 to\n * `api.push.apple.com` (or `api.sandbox.push.apple.com` for a development\n * build's token), authenticated with a provider token, an ES256 JWT signed\n * with the team's APNs key.\n *\n *   APNS_KEY_P8   the `.p8` key: PEM text, or that PEM (or its DER) base64-encoded\n *   APNS_KEY_ID   the key's 10-character id\n *   APNS_TEAM_ID  the Apple Developer team id\n *\n * Without all three the transport is off: a device on APNs is skipped and\n * that is logged once per process. A provider token is reused for up to 50\n * minutes (Apple refuses one older than an hour, and one refreshed more often\n * than every 20). A `410`, `BadDeviceToken` or `Unregistered` answer means the\n * token is gone, and the row is pruned.\n *\n * Server-only, imported by `push-delivery.ts` only when a device is on APNs.\n */\n\nimport { createPrivateKey, sign, type KeyObject } from 'node:crypto'\nimport { connect, type ClientHttp2Session } from 'node:http2'\nimport type { PushMessage, PushOutcome, PushTarget, PushTransport } from './push-delivery'\n\nexport const APNS_HOSTS = {\n  production: 'https://api.push.apple.com',\n  sandbox: 'https://api.sandbox.push.apple.com',\n} as const\n\n/** A provider token is reused for at most this long. */\nexport const APNS_TOKEN_TTL_MS = 50 * 60 * 1000\n\n/** Requests in flight at once on one connection. */\nconst CONCURRENCY = 20\n\nexport interface ApnsCredentials {\n  key: KeyObject\n  keyId: string\n  teamId: string\n}\n\nexport interface ApnsResponse {\n  status: number\n  body: string\n}\n\n/** One HTTP/2 POST to an APNs origin; injectable for tests. */\nexport type ApnsRequest = (origin: string, headers: Record<string, string>, body: string) => Promise<ApnsResponse>\n\nconst base64url = (input: Buffer | string) => Buffer.from(input).toString('base64url')\n\n/** The `.p8` key from `APNS_KEY_P8`: PEM, base64 of the PEM, or base64 of the DER. */\nexport function parseApnsKey(raw: string): KeyObject {\n  const text = raw.trim().replace(/\\\\n/g, '\\n')\n  if (text.includes('-----BEGIN')) return createPrivateKey(text)\n  const decoded = Buffer.from(text, 'base64')\n  const asText = decoded.toString('utf8')\n  if (asText.includes('-----BEGIN')) return createPrivateKey(asText)\n  return createPrivateKey({ key: decoded, format: 'der', type: 'pkcs8' })\n}\n\nexport function apnsCredentials(env: Record<string, string | undefined>): ApnsCredentials | null {\n  const raw = env['APNS_KEY_P8']?.trim()\n  const keyId = env['APNS_KEY_ID']?.trim()\n  const teamId = env['APNS_TEAM_ID']?.trim()\n  if (!raw || !keyId || !teamId) return null\n  return { key: parseApnsKey(raw), keyId, teamId }\n}\n\n/** An ES256 provider token: `{alg, kid}.{iss, iat}`, signed raw (r‖s), as APNs requires. */\nexport function apnsProviderToken(credentials: ApnsCredentials, nowMs: number): string {\n  const header = base64url(JSON.stringify({ alg: 'ES256', kid: credentials.keyId }))\n  const claims = base64url(JSON.stringify({ iss: credentials.teamId, iat: Math.floor(nowMs / 1000) }))\n  const signature = sign('sha256', Buffer.from(`${header}.${claims}`), {\n    key: credentials.key,\n    dsaEncoding: 'ieee-p1363',\n  })\n  return `${header}.${claims}.${base64url(signature)}`\n}\n\n/** The APNs payload: the alert, the default sound, and the tap data beside `aps`. */\nexport function apnsPayload(message: PushMessage): string {\n  return JSON.stringify({\n    aps: {\n      alert: { title: message.title, ...(message.body ? { body: message.body } : {}) },\n      sound: 'default',\n    },\n    ...message.data,\n  })\n}\n\nconst GONE = new Set(['BadDeviceToken', 'Unregistered', 'DeviceTokenNotForTopic'])\n\nexport function apnsOutcome(response: ApnsResponse): PushOutcome {\n  if (response.status === 200) return 'sent'\n  if (response.status === 410) return 'prune'\n  let reason = ''\n  try {\n    reason = String(JSON.parse(response.body)?.reason ?? '')\n  } catch {\n    // An unreadable body is a failure, not a verdict on the token.\n  }\n  return GONE.has(reason) ? 'prune' : 'failed'\n}\n\n/** The default request: one HTTP/2 session per origin for the life of a send. */\nfunction http2Requester(): { request: ApnsRequest; close: () => void } {\n  const sessions = new Map<string, ClientHttp2Session>()\n  const session = (origin: string) => {\n    let open = sessions.get(origin)\n    if (!open || open.closed || open.destroyed) {\n      open = connect(origin)\n      open.on('error', () => undefined)\n      sessions.set(origin, open)\n    }\n    return open\n  }\n  const request: ApnsRequest = (origin, headers, body) =>\n    new Promise((resolve, reject) => {\n      const stream = session(origin).request({ ':method': 'POST', ...headers })\n      let status = 0\n      let text = ''\n      stream.setEncoding('utf8')\n      stream.setTimeout(15_000, () => stream.close())\n      stream.on('response', (head) => {\n        status = Number(head[':status'] ?? 0)\n      })\n      stream.on('data', (chunk: string) => {\n        text += chunk\n      })\n      stream.on('end', () => resolve({ status, body: text }))\n      stream.on('error', reject)\n      stream.end(body)\n    })\n  return {\n    request,\n    close: () => {\n      for (const open of sessions.values()) open.close()\n      sessions.clear()\n    },\n  }\n}\n\nexport interface ApnsTransportOptions {\n  credentials: ApnsCredentials\n  /** Injected in tests; the default opens HTTP/2 sessions per send. */\n  request?: ApnsRequest\n  now?: () => number\n}\n\nexport function createApnsTransport(options: ApnsTransportOptions): PushTransport {\n  const now = options.now ?? Date.now\n  let cached: { token: string; at: number } | null = null\n  const providerToken = () => {\n    const at = now()\n    if (!cached || at - cached.at >= APNS_TOKEN_TTL_MS) cached = { token: apnsProviderToken(options.credentials, at), at }\n    return cached.token\n  }\n  return {\n    async send(targets: readonly PushTarget[], message: PushMessage): Promise<PushOutcome[]> {\n      const { request, close } = options.request\n        ? { request: options.request, close: () => undefined }\n        : http2Requester()\n      const body = apnsPayload(message)\n      const outcomes: PushOutcome[] = new Array(targets.length).fill('failed')\n      try {\n        for (let start = 0; start < targets.length; start += CONCURRENCY) {\n          const batch = targets.slice(start, start + CONCURRENCY)\n          await Promise.all(\n            batch.map(async (target, offset) => {\n              try {\n                const response = await request(\n                  APNS_HOSTS[target.apnsEnvironment ?? 'production'],\n                  {\n                    ':path': `/3/device/${target.token}`,\n                    authorization: `bearer ${providerToken()}`,\n                    'apns-topic': target.topic,\n                    'apns-push-type': 'alert',\n                    'apns-priority': message.urgent ? '10' : '5',\n                    'content-type': 'application/json',\n                  },\n                  body,\n                )\n                // An expired or refused provider token is ours to mint again, not the device's fault.\n                if (response.status === 403) cached = null\n                outcomes[start + offset] = apnsOutcome(response)\n              } catch {\n                outcomes[start + offset] = 'failed'\n              }\n            }),\n          )\n        }\n      } finally {\n        close()\n      }\n      return outcomes\n    },\n  }\n}\n\nlet warnedMissingKey = false\nlet configured: { transport: PushTransport } | null = null\n\n/**\n * The deployment's APNs transport from `APNS_*`, or null — logged once —\n * when they are not set.\n */\nexport function apnsTransport(env: Record<string, string | undefined> = process.env): PushTransport | null {\n  if (configured) return configured.transport\n  const credentials = apnsCredentials(env)\n  if (!credentials) {\n    if (!warnedMissingKey) {\n      warnedMissingKey = true\n      console.warn('push: APNS_KEY_P8, APNS_KEY_ID and APNS_TEAM_ID are not all set; iOS and macOS devices are skipped')\n    }\n    return null\n  }\n  configured = { transport: createApnsTransport({ credentials }) }\n  return configured.transport\n}\n"],"names":["createPrivateKey","sign","connect","APNS_HOSTS","production","sandbox","APNS_TOKEN_TTL_MS","CONCURRENCY","base64url","input","Buffer","from","toString","parseApnsKey","raw","text","trim","replace","includes","decoded","asText","key","format","type","apnsCredentials","env","keyId","teamId","apnsProviderToken","credentials","nowMs","header","JSON","stringify","alg","kid","claims","iss","iat","Math","floor","signature","dsaEncoding","apnsPayload","message","aps","alert","title","body","sound","data","GONE","Set","apnsOutcome","response","status","reason","String","parse","has","http2Requester","sessions","Map","session","origin","open","get","closed","destroyed","on","undefined","set","request","headers","Promise","resolve","reject","stream","setEncoding","setTimeout","close","head","Number","chunk","end","values","clear","createApnsTransport","options","now","Date","cached","providerToken","at","token","send","targets","outcomes","Array","length","fill","start","batch","slice","all","map","target","offset","apnsEnvironment","authorization","topic","urgent","warnedMissingKey","configured","apnsTransport","process","transport","console","warn"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;CAiBC,GAED,SAASA,gBAAgB,EAAEC,IAAI,QAAwB,cAAa;AACpE,SAASC,OAAO,QAAiC,aAAY;AAG7D,OAAO,MAAMC,aAAa;IACxBC,YAAY;IACZC,SAAS;AACX,EAAU;AAEV,sDAAsD,GACtD,OAAO,MAAMC,oBAAoB,KAAK,KAAK,KAAI;AAE/C,kDAAkD,GAClD,MAAMC,cAAc;AAgBpB,MAAMC,YAAY,CAACC,QAA2BC,OAAOC,IAAI,CAACF,OAAOG,QAAQ,CAAC;AAE1E,oFAAoF,GACpF,OAAO,SAASC,aAAaC,GAAW;IACtC,MAAMC,OAAOD,IAAIE,IAAI,GAAGC,OAAO,CAAC,QAAQ;IACxC,IAAIF,KAAKG,QAAQ,CAAC,eAAe,OAAOlB,iBAAiBe;IACzD,MAAMI,UAAUT,OAAOC,IAAI,CAACI,MAAM;IAClC,MAAMK,SAASD,QAAQP,QAAQ,CAAC;IAChC,IAAIQ,OAAOF,QAAQ,CAAC,eAAe,OAAOlB,iBAAiBoB;IAC3D,OAAOpB,iBAAiB;QAAEqB,KAAKF;QAASG,QAAQ;QAAOC,MAAM;IAAQ;AACvE;AAEA,OAAO,SAASC,gBAAgBC,GAAuC;QACzDA,kBACEA,kBACCA;IAFf,MAAMX,OAAMW,mBAAAA,GAAG,CAAC,cAAc,qBAAlBA,iBAAoBT,IAAI;IACpC,MAAMU,SAAQD,mBAAAA,GAAG,CAAC,cAAc,qBAAlBA,iBAAoBT,IAAI;IACtC,MAAMW,UAASF,oBAAAA,GAAG,CAAC,eAAe,qBAAnBA,kBAAqBT,IAAI;IACxC,IAAI,CAACF,OAAO,CAACY,SAAS,CAACC,QAAQ,OAAO;IACtC,OAAO;QAAEN,KAAKR,aAAaC;QAAMY;QAAOC;IAAO;AACjD;AAEA,0FAA0F,GAC1F,OAAO,SAASC,kBAAkBC,WAA4B,EAAEC,KAAa;IAC3E,MAAMC,SAASvB,UAAUwB,KAAKC,SAAS,CAAC;QAAEC,KAAK;QAASC,KAAKN,YAAYH,KAAK;IAAC;IAC/E,MAAMU,SAAS5B,UAAUwB,KAAKC,SAAS,CAAC;QAAEI,KAAKR,YAAYF,MAAM;QAAEW,KAAKC,KAAKC,KAAK,CAACV,QAAQ;IAAM;IACjG,MAAMW,YAAYxC,KAAK,UAAUS,OAAOC,IAAI,CAAC,GAAGoB,OAAO,CAAC,EAAEK,QAAQ,GAAG;QACnEf,KAAKQ,YAAYR,GAAG;QACpBqB,aAAa;IACf;IACA,OAAO,GAAGX,OAAO,CAAC,EAAEK,OAAO,CAAC,EAAE5B,UAAUiC,YAAY;AACtD;AAEA,mFAAmF,GACnF,OAAO,SAASE,YAAYC,OAAoB;IAC9C,OAAOZ,KAAKC,SAAS,CAAC;QACpBY,KAAK;YACHC,OAAO;gBAAEC,OAAOH,QAAQG,KAAK;eAAMH,QAAQI,IAAI,GAAG;gBAAEA,MAAMJ,QAAQI,IAAI;YAAC,IAAI,CAAC;YAC5EC,OAAO;QACT;OACGL,QAAQM,IAAI;AAEnB;AAEA,MAAMC,OAAO,IAAIC,IAAI;IAAC;IAAkB;IAAgB;CAAyB;AAEjF,OAAO,SAASC,YAAYC,QAAsB;IAChD,IAAIA,SAASC,MAAM,KAAK,KAAK,OAAO;IACpC,IAAID,SAASC,MAAM,KAAK,KAAK,OAAO;IACpC,IAAIC,SAAS;IACb,IAAI;;YACcxB;QAAhBwB,SAASC,gBAAOzB,cAAAA,KAAK0B,KAAK,CAACJ,SAASN,IAAI,sBAAxBhB,YAA2BwB,MAAM,mBAAI;IACvD,EAAE,eAAM;IACN,+DAA+D;IACjE;IACA,OAAOL,KAAKQ,GAAG,CAACH,UAAU,UAAU;AACtC;AAEA,+EAA+E,GAC/E,SAASI;IACP,MAAMC,WAAW,IAAIC;IACrB,MAAMC,UAAU,CAACC;QACf,IAAIC,OAAOJ,SAASK,GAAG,CAACF;QACxB,IAAI,CAACC,QAAQA,KAAKE,MAAM,IAAIF,KAAKG,SAAS,EAAE;YAC1CH,OAAO/D,QAAQ8D;YACfC,KAAKI,EAAE,CAAC,SAAS,IAAMC;YACvBT,SAASU,GAAG,CAACP,QAAQC;QACvB;QACA,OAAOA;IACT;IACA,MAAMO,UAAuB,CAACR,QAAQS,SAASzB,OAC7C,IAAI0B,QAAQ,CAACC,SAASC;YACpB,MAAMC,SAASd,QAAQC,QAAQQ,OAAO,CAAC;gBAAE,WAAW;eAAWC;YAC/D,IAAIlB,SAAS;YACb,IAAIxC,OAAO;YACX8D,OAAOC,WAAW,CAAC;YACnBD,OAAOE,UAAU,CAAC,OAAQ,IAAMF,OAAOG,KAAK;YAC5CH,OAAOR,EAAE,CAAC,YAAY,CAACY;oBACLA;gBAAhB1B,SAAS2B,QAAOD,eAAAA,IAAI,CAAC,UAAU,YAAfA,eAAmB;YACrC;YACAJ,OAAOR,EAAE,CAAC,QAAQ,CAACc;gBACjBpE,QAAQoE;YACV;YACAN,OAAOR,EAAE,CAAC,OAAO,IAAMM,QAAQ;oBAAEpB;oBAAQP,MAAMjC;gBAAK;YACpD8D,OAAOR,EAAE,CAAC,SAASO;YACnBC,OAAOO,GAAG,CAACpC;QACb;IACF,OAAO;QACLwB;QACAQ,OAAO;YACL,KAAK,MAAMf,QAAQJ,SAASwB,MAAM,GAAIpB,KAAKe,KAAK;YAChDnB,SAASyB,KAAK;QAChB;IACF;AACF;AASA,OAAO,SAASC,oBAAoBC,OAA6B;QACnDA;IAAZ,MAAMC,OAAMD,eAAAA,QAAQC,GAAG,YAAXD,eAAeE,KAAKD,GAAG;IACnC,IAAIE,SAA+C;IACnD,MAAMC,gBAAgB;QACpB,MAAMC,KAAKJ;QACX,IAAI,CAACE,UAAUE,KAAKF,OAAOE,EAAE,IAAIvF,mBAAmBqF,SAAS;YAAEG,OAAOlE,kBAAkB4D,QAAQ3D,WAAW,EAAEgE;YAAKA;QAAG;QACrH,OAAOF,OAAOG,KAAK;IACrB;IACA,OAAO;QACL,MAAMC,MAAKC,OAA8B,EAAEpD,OAAoB;YAC7D,MAAM,EAAE4B,OAAO,EAAEQ,KAAK,EAAE,GAAGQ,QAAQhB,OAAO,GACtC;gBAAEA,SAASgB,QAAQhB,OAAO;gBAAEQ,OAAO,IAAMV;YAAU,IACnDV;YACJ,MAAMZ,OAAOL,YAAYC;YACzB,MAAMqD,WAA0B,IAAIC,MAAMF,QAAQG,MAAM,EAAEC,IAAI,CAAC;YAC/D,IAAI;gBACF,IAAK,IAAIC,QAAQ,GAAGA,QAAQL,QAAQG,MAAM,EAAEE,SAAS9F,YAAa;oBAChE,MAAM+F,QAAQN,QAAQO,KAAK,CAACF,OAAOA,QAAQ9F;oBAC3C,MAAMmE,QAAQ8B,GAAG,CACfF,MAAMG,GAAG,CAAC,OAAOC,QAAQC;wBACvB,IAAI;gCAEWD;4BADb,MAAMpD,WAAW,MAAMkB,QACrBrE,UAAU,EAACuG,0BAAAA,OAAOE,eAAe,YAAtBF,0BAA0B,aAAa,EAClD;gCACE,SAAS,CAAC,UAAU,EAAEA,OAAOZ,KAAK,EAAE;gCACpCe,eAAe,CAAC,OAAO,EAAEjB,iBAAiB;gCAC1C,cAAcc,OAAOI,KAAK;gCAC1B,kBAAkB;gCAClB,iBAAiBlE,QAAQmE,MAAM,GAAG,OAAO;gCACzC,gBAAgB;4BAClB,GACA/D;4BAEF,sFAAsF;4BACtF,IAAIM,SAASC,MAAM,KAAK,KAAKoC,SAAS;4BACtCM,QAAQ,CAACI,QAAQM,OAAO,GAAGtD,YAAYC;wBACzC,EAAE,eAAM;4BACN2C,QAAQ,CAACI,QAAQM,OAAO,GAAG;wBAC7B;oBACF;gBAEJ;YACF,SAAU;gBACR3B;YACF;YACA,OAAOiB;QACT;IACF;AACF;AAEA,IAAIe,mBAAmB;AACvB,IAAIC,aAAkD;AAEtD;;;CAGC,GACD,OAAO,SAASC,cAAczF,MAA0C0F,QAAQ1F,GAAG;IACjF,IAAIwF,YAAY,OAAOA,WAAWG,SAAS;IAC3C,MAAMvF,cAAcL,gBAAgBC;IACpC,IAAI,CAACI,aAAa;QAChB,IAAI,CAACmF,kBAAkB;YACrBA,mBAAmB;YACnBK,QAAQC,IAAI,CAAC;QACf;QACA,OAAO;IACT;IACAL,aAAa;QAAEG,WAAW7B,oBAAoB;YAAE1D;QAAY;IAAG;IAC/D,OAAOoF,WAAWG,SAAS;AAC7B"}

package/src/lib/server/push-delivery.d.ts

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The native apps' push delivery (AGL-3651): a notification the fan-out
+ * wrote goes to each recipient's registered devices, grouped by transport —
+ * APNs for iOS and macOS (`push-apns.ts`), FCM for Android (`push-fcm.ts`).
+ *
+ * Server-only. `registerNativePushSenders` (`native-push.ts`) registers
+ * `nativePushSender` with the fan-out and imports this file only when a
+ * notification has push recipients, and this file imports each transport
+ * only when a device needs it.
+ *
+ * A row the registry no longer accepts is pruned here: an Expo row from the
+ * React Native app, a row with no transport, a token that does not fit its
+ * transport, and a device not seen for `MOBILE_DEVICE_STALE_MS`. A token a
+ * transport reports as gone is pruned after the send.
+ */
+import { type ApnsEnvironment, type MobileDeviceApp, type MobilePushData, type MobilePushTransport } from '@aglyn/aglyn/app-utils/notification-push';
+import type { Firestore } from 'firebase-admin/firestore';
+import type { MobilePushPayload, MobilePushSender } from './mobile-push-switch';
+/** One device a transport sends to. */
+export interface PushTarget {
+    token: string;
+    app: MobileDeviceApp;
+    /** APNs: the app's bundle id, which is the push topic. */
+    topic: string;
+    apnsEnvironment?: ApnsEnvironment;
+}
+/** What every device of one notification is sent. */
+export interface PushMessage {
+    title: string;
+    body?: string;
+    data: MobilePushData;
+    /** Critical and warning notifications ask the platform to deliver now. */
+    urgent: boolean;
+}
+/** A transport's verdict for each target, in order. `prune`: the token is gone; forget the row. */
+export type PushOutcome = 'sent' | 'prune' | 'failed';
+export interface PushTransport {
+    send(targets: readonly PushTarget[], message: PushMessage): Promise<PushOutcome[]>;
+}
+export interface PushDeliveryDeps {
+    db: Firestore;
+    /** Each transport, or null when the deployment has none configured. Resolved only when a device needs it. */
+    transport: (kind: MobilePushTransport) => Promise<PushTransport | null>;
+    now?: () => number;
+}
+export interface PushDeliveryResult {
+    sent: number;
+    /** Rows removed: stale, Expo or malformed rows, and tokens a transport reported gone. */
+    pruned: number;
+    failed: number;
+    /** Devices not sent to because their transport is not configured. */
+    skipped: number;
+}
+export declare function pushMessage(payload: MobilePushPayload, link: string | undefined): PushMessage;
+/**
+ * Sends one notification to every live device of `uids`, each through its
+ * own transport. Never throws: the console notification is the record, and a
+ * push is a courtesy beside it.
+ */
+export declare function deliverNativePush(uids: readonly string[], payload: MobilePushPayload, deps: PushDeliveryDeps): Promise<PushDeliveryResult>;
+/** The sender `registerNativePushSenders` hands the fan-out. */
+export declare const nativePushSender: MobilePushSender;

package/src/lib/server/push-delivery.js

@@ -0,0 +1,176 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The native apps' push delivery (AGL-3651): a notification the fan-out
+ * wrote goes to each recipient's registered devices, grouped by transport —
+ * APNs for iOS and macOS (`push-apns.ts`), FCM for Android (`push-fcm.ts`).
+ *
+ * Server-only. `registerNativePushSenders` (`native-push.ts`) registers
+ * `nativePushSender` with the fan-out and imports this file only when a
+ * notification has push recipients, and this file imports each transport
+ * only when a device needs it.
+ *
+ * A row the registry no longer accepts is pruned here: an Expo row from the
+ * React Native app, a row with no transport, a token that does not fit its
+ * transport, and a device not seen for `MOBILE_DEVICE_STALE_MS`. A token a
+ * transport reports as gone is pruned after the send.
+ */ import { isMobilePushToken, MOBILE_APP_BUNDLES, MOBILE_DEVICE_STALE_MS, MOBILE_DEVICES_COLLECTION, MOBILE_DEVICES_PER_USER, mobilePushData } from "@aglyn/aglyn/app-utils/notification-push";
+import { normalizeNotificationLink } from "@aglyn/aglyn/server";
+/** The most devices one notification is sent to, whatever the audience. */ const MAX_DEVICES = 1000;
+/** A stored timestamp as epoch millis, or null when there is none. */ function millis(value) {
+    if (!value) return null;
+    if (typeof value === 'number') return value;
+    const withMillis = value;
+    return typeof withMillis.toMillis === 'function' ? withMillis.toMillis() : null;
+}
+export function pushMessage(payload, link) {
+    return _extends({
+        title: payload.title
+    }, payload.body ? {
+        body: payload.body
+    } : {}, {
+        data: mobilePushData(_extends({}, payload, {
+            link
+        })),
+        urgent: payload.level === 'critical' || payload.level === 'warning'
+    });
+}
+/** The link the app opens: the stored one, rewritten onto today's console routes. */ async function pushLink(db, payload) {
+    if (!payload.link) return undefined;
+    if (!payload.orgId) return normalizeNotificationLink(payload.link, {});
+    try {
+        var _payload_hostId;
+        const [org, host] = await Promise.all([
+            db.collection('orgs').doc(payload.orgId).get(),
+            payload.hostId ? db.collection('hosts').doc(payload.hostId).get() : Promise.resolve(null)
+        ]);
+        const slug = org.get('slug');
+        const subdomain = host == null ? void 0 : host.get('subdomain');
+        return normalizeNotificationLink(payload.link, {
+            orgSlug: typeof slug === 'string' ? slug : null,
+            hostId: (_payload_hostId = payload.hostId) != null ? _payload_hostId : null,
+            hostSubdomain: typeof subdomain === 'string' ? subdomain : null
+        });
+    } catch (unused) {
+        return normalizeNotificationLink(payload.link, {});
+    }
+}
+const isApp = (value)=>value === 'aglyn' || value === 'aglyn-pos';
+/**
+ * Sends one notification to every live device of `uids`, each through its
+ * own transport. Never throws: the console notification is the record, and a
+ * push is a courtesy beside it.
+ */ export async function deliverNativePush(uids, payload, deps) {
+    var _deps_now;
+    const result = {
+        sent: 0,
+        pruned: 0,
+        failed: 0,
+        skipped: 0
+    };
+    if (!uids.length) return result;
+    const now = ((_deps_now = deps.now) != null ? _deps_now : Date.now)();
+    const prune = async (ref)=>{
+        await ref.delete().catch(()=>undefined);
+        result.pruned += 1;
+    };
+    try {
+        const { db } = deps;
+        const groups = new Map();
+        const seen = new Set();
+        let total = 0;
+        for (const uid of uids){
+            const devices = await db.collection('users').doc(uid).collection(MOBILE_DEVICES_COLLECTION).limit(MOBILE_DEVICES_PER_USER).get();
+            for (const device of devices.docs){
+                var _groups_get;
+                const transport = device.get('transport');
+                const token = device.get('token');
+                const app = device.get('app');
+                if (!isMobilePushToken(transport, token) || !isApp(app)) {
+                    await prune(device.ref);
+                    continue;
+                }
+                const lastSeen = millis(device.get('lastSeen'));
+                if (lastSeen !== null && now - lastSeen > MOBILE_DEVICE_STALE_MS) {
+                    await prune(device.ref);
+                    continue;
+                }
+                if (seen.has(token) || total >= MAX_DEVICES) continue;
+                seen.add(token);
+                total += 1;
+                const environment = device.get('apnsEnvironment');
+                const target = _extends({
+                    token,
+                    app,
+                    topic: MOBILE_APP_BUNDLES[app]
+                }, transport === 'apns' && (environment === 'sandbox' || environment === 'production') ? {
+                    apnsEnvironment: environment
+                } : {});
+                const group = (_groups_get = groups.get(transport)) != null ? _groups_get : [];
+                group.push({
+                    target,
+                    ref: device.ref
+                });
+                groups.set(transport, group);
+            }
+        }
+        if (!groups.size) return result;
+        const message = pushMessage(payload, await pushLink(db, payload));
+        for (const [kind, entries] of groups){
+            let transport = null;
+            try {
+                transport = await deps.transport(kind);
+            } catch (error) {
+                console.error(`push transport ${kind} failed to load`, error);
+            }
+            if (!transport) {
+                result.skipped += entries.length;
+                continue;
+            }
+            let outcomes;
+            try {
+                outcomes = await transport.send(entries.map((entry)=>entry.target), message);
+            } catch (error) {
+                console.error(`push transport ${kind} failed`, error);
+                result.failed += entries.length;
+                continue;
+            }
+            for (const [index, entry] of entries.entries()){
+                var _outcomes_index;
+                const outcome = (_outcomes_index = outcomes[index]) != null ? _outcomes_index : 'failed';
+                if (outcome === 'sent') result.sent += 1;
+                else if (outcome === 'prune') await prune(entry.ref);
+                else result.failed += 1;
+            }
+        }
+    } catch (error) {
+        console.error('push delivery failed', error);
+    }
+    return result;
+}
+/** The deployment's transports, each imported the first time a device needs it. */ async function deploymentTransport(kind) {
+    if (kind === 'apns') return (await import("./push-apns.js")).apnsTransport();
+    return (await import("./push-fcm.js")).fcmTransport();
+}
+/** The sender `registerNativePushSenders` hands the fan-out. */ export const nativePushSender = async (uids, payload, { db })=>{
+    await deliverNativePush(uids, payload, {
+        db,
+        transport: deploymentTransport
+    });
+};
+
+//# sourceMappingURL=push-delivery.js.map

package/src/lib/server/push-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/push-delivery.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The native apps' push delivery (AGL-3651): a notification the fan-out\n * wrote goes to each recipient's registered devices, grouped by transport —\n * APNs for iOS and macOS (`push-apns.ts`), FCM for Android (`push-fcm.ts`).\n *\n * Server-only. `registerNativePushSenders` (`native-push.ts`) registers\n * `nativePushSender` with the fan-out and imports this file only when a\n * notification has push recipients, and this file imports each transport\n * only when a device needs it.\n *\n * A row the registry no longer accepts is pruned here: an Expo row from the\n * React Native app, a row with no transport, a token that does not fit its\n * transport, and a device not seen for `MOBILE_DEVICE_STALE_MS`. A token a\n * transport reports as gone is pruned after the send.\n */\n\nimport {\n  isMobilePushToken,\n  MOBILE_APP_BUNDLES,\n  MOBILE_DEVICE_STALE_MS,\n  MOBILE_DEVICES_COLLECTION,\n  MOBILE_DEVICES_PER_USER,\n  mobilePushData,\n  type ApnsEnvironment,\n  type MobileDeviceApp,\n  type MobilePushData,\n  type MobilePushTransport,\n} from '@aglyn/aglyn/app-utils/notification-push'\nimport { normalizeNotificationLink } from '@aglyn/aglyn/server'\nimport type { DocumentReference, Firestore } from 'firebase-admin/firestore'\nimport type { MobilePushPayload, MobilePushSender } from './mobile-push-switch'\n\n/** The most devices one notification is sent to, whatever the audience. */\nconst MAX_DEVICES = 1000\n\n/** One device a transport sends to. */\nexport interface PushTarget {\n  token: string\n  app: MobileDeviceApp\n  /** APNs: the app's bundle id, which is the push topic. */\n  topic: string\n  apnsEnvironment?: ApnsEnvironment\n}\n\n/** What every device of one notification is sent. */\nexport interface PushMessage {\n  title: string\n  body?: string\n  data: MobilePushData\n  /** Critical and warning notifications ask the platform to deliver now. */\n  urgent: boolean\n}\n\n/** A transport's verdict for each target, in order. `prune`: the token is gone; forget the row. */\nexport type PushOutcome = 'sent' | 'prune' | 'failed'\n\nexport interface PushTransport {\n  send(targets: readonly PushTarget[], message: PushMessage): Promise<PushOutcome[]>\n}\n\nexport interface PushDeliveryDeps {\n  db: Firestore\n  /** Each transport, or null when the deployment has none configured. Resolved only when a device needs it. */\n  transport: (kind: MobilePushTransport) => Promise<PushTransport | null>\n  now?: () => number\n}\n\nexport interface PushDeliveryResult {\n  sent: number\n  /** Rows removed: stale, Expo or malformed rows, and tokens a transport reported gone. */\n  pruned: number\n  failed: number\n  /** Devices not sent to because their transport is not configured. */\n  skipped: number\n}\n\n/** A stored timestamp as epoch millis, or null when there is none. */\nfunction millis(value: unknown): number | null {\n  if (!value) return null\n  if (typeof value === 'number') return value\n  const withMillis = value as { toMillis?: () => number }\n  return typeof withMillis.toMillis === 'function' ? withMillis.toMillis() : null\n}\n\nexport function pushMessage(payload: MobilePushPayload, link: string | undefined): PushMessage {\n  return {\n    title: payload.title,\n    ...(payload.body ? { body: payload.body } : {}),\n    data: mobilePushData({ ...payload, link }),\n    urgent: payload.level === 'critical' || payload.level === 'warning',\n  }\n}\n\n/** The link the app opens: the stored one, rewritten onto today's console routes. */\nasync function pushLink(db: Firestore, payload: MobilePushPayload): Promise<string | undefined> {\n  if (!payload.link) return undefined\n  if (!payload.orgId) return normalizeNotificationLink(payload.link, {})\n  try {\n    const [org, host] = await Promise.all([\n      db.collection('orgs').doc(payload.orgId).get(),\n      payload.hostId ? db.collection('hosts').doc(payload.hostId).get() : Promise.resolve(null),\n    ])\n    const slug = org.get('slug')\n    const subdomain = host?.get('subdomain')\n    return normalizeNotificationLink(payload.link, {\n      orgSlug: typeof slug === 'string' ? slug : null,\n      hostId: payload.hostId ?? null,\n      hostSubdomain: typeof subdomain === 'string' ? subdomain : null,\n    })\n  } catch {\n    return normalizeNotificationLink(payload.link, {})\n  }\n}\n\nconst isApp = (value: unknown): value is MobileDeviceApp => value === 'aglyn' || value === 'aglyn-pos'\n\n/**\n * Sends one notification to every live device of `uids`, each through its\n * own transport. Never throws: the console notification is the record, and a\n * push is a courtesy beside it.\n */\nexport async function deliverNativePush(\n  uids: readonly string[],\n  payload: MobilePushPayload,\n  deps: PushDeliveryDeps,\n): Promise<PushDeliveryResult> {\n  const result: PushDeliveryResult = { sent: 0, pruned: 0, failed: 0, skipped: 0 }\n  if (!uids.length) return result\n  const now = (deps.now ?? Date.now)()\n  const prune = async (ref: DocumentReference) => {\n    await ref.delete().catch(() => undefined)\n    result.pruned += 1\n  }\n  try {\n    const { db } = deps\n    const groups = new Map<MobilePushTransport, Array<{ target: PushTarget; ref: DocumentReference }>>()\n    const seen = new Set<string>()\n    let total = 0\n    for (const uid of uids) {\n      const devices = await db\n        .collection('users')\n        .doc(uid)\n        .collection(MOBILE_DEVICES_COLLECTION)\n        .limit(MOBILE_DEVICES_PER_USER)\n        .get()\n      for (const device of devices.docs) {\n        const transport = device.get('transport')\n        const token = device.get('token')\n        const app = device.get('app')\n        if (!isMobilePushToken(transport, token) || !isApp(app)) {\n          await prune(device.ref)\n          continue\n        }\n        const lastSeen = millis(device.get('lastSeen'))\n        if (lastSeen !== null && now - lastSeen > MOBILE_DEVICE_STALE_MS) {\n          await prune(device.ref)\n          continue\n        }\n        if (seen.has(token) || total >= MAX_DEVICES) continue\n        seen.add(token)\n        total += 1\n        const environment = device.get('apnsEnvironment')\n        const target: PushTarget = {\n          token,\n          app,\n          topic: MOBILE_APP_BUNDLES[app],\n          ...(transport === 'apns' && (environment === 'sandbox' || environment === 'production')\n            ? { apnsEnvironment: environment }\n            : {}),\n        }\n        const group = groups.get(transport) ?? []\n        group.push({ target, ref: device.ref })\n        groups.set(transport, group)\n      }\n    }\n    if (!groups.size) return result\n    const message = pushMessage(payload, await pushLink(db, payload))\n    for (const [kind, entries] of groups) {\n      let transport: PushTransport | null = null\n      try {\n        transport = await deps.transport(kind)\n      } catch (error) {\n        console.error(`push transport ${kind} failed to load`, error)\n      }\n      if (!transport) {\n        result.skipped += entries.length\n        continue\n      }\n      let outcomes: PushOutcome[]\n      try {\n        outcomes = await transport.send(\n          entries.map((entry) => entry.target),\n          message,\n        )\n      } catch (error) {\n        console.error(`push transport ${kind} failed`, error)\n        result.failed += entries.length\n        continue\n      }\n      for (const [index, entry] of entries.entries()) {\n        const outcome = outcomes[index] ?? 'failed'\n        if (outcome === 'sent') result.sent += 1\n        else if (outcome === 'prune') await prune(entry.ref)\n        else result.failed += 1\n      }\n    }\n  } catch (error) {\n    console.error('push delivery failed', error)\n  }\n  return result\n}\n\n/** The deployment's transports, each imported the first time a device needs it. */\nasync function deploymentTransport(kind: MobilePushTransport): Promise<PushTransport | null> {\n  if (kind === 'apns') return (await import('./push-apns')).apnsTransport()\n  return (await import('./push-fcm')).fcmTransport()\n}\n\n/** The sender `registerNativePushSenders` hands the fan-out. */\nexport const nativePushSender: MobilePushSender = async (uids, payload, { db }) => {\n  await deliverNativePush(uids, payload, { db, transport: deploymentTransport })\n}\n"],"names":["isMobilePushToken","MOBILE_APP_BUNDLES","MOBILE_DEVICE_STALE_MS","MOBILE_DEVICES_COLLECTION","MOBILE_DEVICES_PER_USER","mobilePushData","normalizeNotificationLink","MAX_DEVICES","millis","value","withMillis","toMillis","pushMessage","payload","link","title","body","data","urgent","level","pushLink","db","undefined","orgId","org","host","Promise","all","collection","doc","get","hostId","resolve","slug","subdomain","orgSlug","hostSubdomain","isApp","deliverNativePush","uids","deps","result","sent","pruned","failed","skipped","length","now","Date","prune","ref","delete","catch","groups","Map","seen","Set","total","uid","devices","limit","device","docs","transport","token","app","lastSeen","has","add","environment","target","topic","apnsEnvironment","group","push","set","size","message","kind","entries","error","console","outcomes","send","map","entry","index","outcome","deploymentTransport","apnsTransport","fcmTransport","nativePushSender"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;CAcC,GAED,SACEA,iBAAiB,EACjBC,kBAAkB,EAClBC,sBAAsB,EACtBC,yBAAyB,EACzBC,uBAAuB,EACvBC,cAAc,QAKT,2CAA0C;AACjD,SAASC,yBAAyB,QAAQ,sBAAqB;AAI/D,yEAAyE,GACzE,MAAMC,cAAc;AA2CpB,oEAAoE,GACpE,SAASC,OAAOC,KAAc;IAC5B,IAAI,CAACA,OAAO,OAAO;IACnB,IAAI,OAAOA,UAAU,UAAU,OAAOA;IACtC,MAAMC,aAAaD;IACnB,OAAO,OAAOC,WAAWC,QAAQ,KAAK,aAAaD,WAAWC,QAAQ,KAAK;AAC7E;AAEA,OAAO,SAASC,YAAYC,OAA0B,EAAEC,IAAwB;IAC9E,OAAO;QACLC,OAAOF,QAAQE,KAAK;OAChBF,QAAQG,IAAI,GAAG;QAAEA,MAAMH,QAAQG,IAAI;IAAC,IAAI,CAAC;QAC7CC,MAAMZ,eAAe,aAAKQ;YAASC;;QACnCI,QAAQL,QAAQM,KAAK,KAAK,cAAcN,QAAQM,KAAK,KAAK;;AAE9D;AAEA,mFAAmF,GACnF,eAAeC,SAASC,EAAa,EAAER,OAA0B;IAC/D,IAAI,CAACA,QAAQC,IAAI,EAAE,OAAOQ;IAC1B,IAAI,CAACT,QAAQU,KAAK,EAAE,OAAOjB,0BAA0BO,QAAQC,IAAI,EAAE,CAAC;IACpE,IAAI;YASQD;QARV,MAAM,CAACW,KAAKC,KAAK,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACpCN,GAAGO,UAAU,CAAC,QAAQC,GAAG,CAAChB,QAAQU,KAAK,EAAEO,GAAG;YAC5CjB,QAAQkB,MAAM,GAAGV,GAAGO,UAAU,CAAC,SAASC,GAAG,CAAChB,QAAQkB,MAAM,EAAED,GAAG,KAAKJ,QAAQM,OAAO,CAAC;SACrF;QACD,MAAMC,OAAOT,IAAIM,GAAG,CAAC;QACrB,MAAMI,YAAYT,wBAAAA,KAAMK,GAAG,CAAC;QAC5B,OAAOxB,0BAA0BO,QAAQC,IAAI,EAAE;YAC7CqB,SAAS,OAAOF,SAAS,WAAWA,OAAO;YAC3CF,MAAM,GAAElB,kBAAAA,QAAQkB,MAAM,YAAdlB,kBAAkB;YAC1BuB,eAAe,OAAOF,cAAc,WAAWA,YAAY;QAC7D;IACF,EAAE,eAAM;QACN,OAAO5B,0BAA0BO,QAAQC,IAAI,EAAE,CAAC;IAClD;AACF;AAEA,MAAMuB,QAAQ,CAAC5B,QAA6CA,UAAU,WAAWA,UAAU;AAE3F;;;;CAIC,GACD,OAAO,eAAe6B,kBACpBC,IAAuB,EACvB1B,OAA0B,EAC1B2B,IAAsB;QAITA;IAFb,MAAMC,SAA6B;QAAEC,MAAM;QAAGC,QAAQ;QAAGC,QAAQ;QAAGC,SAAS;IAAE;IAC/E,IAAI,CAACN,KAAKO,MAAM,EAAE,OAAOL;IACzB,MAAMM,MAAM,EAACP,YAAAA,KAAKO,GAAG,YAARP,YAAYQ,KAAKD,GAAG;IACjC,MAAME,QAAQ,OAAOC;QACnB,MAAMA,IAAIC,MAAM,GAAGC,KAAK,CAAC,IAAM9B;QAC/BmB,OAAOE,MAAM,IAAI;IACnB;IACA,IAAI;QACF,MAAM,EAAEtB,EAAE,EAAE,GAAGmB;QACf,MAAMa,SAAS,IAAIC;QACnB,MAAMC,OAAO,IAAIC;QACjB,IAAIC,QAAQ;QACZ,KAAK,MAAMC,OAAOnB,KAAM;YACtB,MAAMoB,UAAU,MAAMtC,GACnBO,UAAU,CAAC,SACXC,GAAG,CAAC6B,KACJ9B,UAAU,CAACzB,2BACXyD,KAAK,CAACxD,yBACN0B,GAAG;YACN,KAAK,MAAM+B,UAAUF,QAAQG,IAAI,CAAE;oBAyBnBT;gBAxBd,MAAMU,YAAYF,OAAO/B,GAAG,CAAC;gBAC7B,MAAMkC,QAAQH,OAAO/B,GAAG,CAAC;gBACzB,MAAMmC,MAAMJ,OAAO/B,GAAG,CAAC;gBACvB,IAAI,CAAC9B,kBAAkB+D,WAAWC,UAAU,CAAC3B,MAAM4B,MAAM;oBACvD,MAAMhB,MAAMY,OAAOX,GAAG;oBACtB;gBACF;gBACA,MAAMgB,WAAW1D,OAAOqD,OAAO/B,GAAG,CAAC;gBACnC,IAAIoC,aAAa,QAAQnB,MAAMmB,WAAWhE,wBAAwB;oBAChE,MAAM+C,MAAMY,OAAOX,GAAG;oBACtB;gBACF;gBACA,IAAIK,KAAKY,GAAG,CAACH,UAAUP,SAASlD,aAAa;gBAC7CgD,KAAKa,GAAG,CAACJ;gBACTP,SAAS;gBACT,MAAMY,cAAcR,OAAO/B,GAAG,CAAC;gBAC/B,MAAMwC,SAAqB;oBACzBN;oBACAC;oBACAM,OAAOtE,kBAAkB,CAACgE,IAAI;mBAC1BF,cAAc,UAAWM,CAAAA,gBAAgB,aAAaA,gBAAgB,YAAW,IACjF;oBAAEG,iBAAiBH;gBAAY,IAC/B,CAAC;gBAEP,MAAMI,SAAQpB,cAAAA,OAAOvB,GAAG,CAACiC,sBAAXV,cAAyB,EAAE;gBACzCoB,MAAMC,IAAI,CAAC;oBAAEJ;oBAAQpB,KAAKW,OAAOX,GAAG;gBAAC;gBACrCG,OAAOsB,GAAG,CAACZ,WAAWU;YACxB;QACF;QACA,IAAI,CAACpB,OAAOuB,IAAI,EAAE,OAAOnC;QACzB,MAAMoC,UAAUjE,YAAYC,SAAS,MAAMO,SAASC,IAAIR;QACxD,KAAK,MAAM,CAACiE,MAAMC,QAAQ,IAAI1B,OAAQ;YACpC,IAAIU,YAAkC;YACtC,IAAI;gBACFA,YAAY,MAAMvB,KAAKuB,SAAS,CAACe;YACnC,EAAE,OAAOE,OAAO;gBACdC,QAAQD,KAAK,CAAC,CAAC,eAAe,EAAEF,KAAK,eAAe,CAAC,EAAEE;YACzD;YACA,IAAI,CAACjB,WAAW;gBACdtB,OAAOI,OAAO,IAAIkC,QAAQjC,MAAM;gBAChC;YACF;YACA,IAAIoC;YACJ,IAAI;gBACFA,WAAW,MAAMnB,UAAUoB,IAAI,CAC7BJ,QAAQK,GAAG,CAAC,CAACC,QAAUA,MAAMf,MAAM,GACnCO;YAEJ,EAAE,OAAOG,OAAO;gBACdC,QAAQD,KAAK,CAAC,CAAC,eAAe,EAAEF,KAAK,OAAO,CAAC,EAAEE;gBAC/CvC,OAAOG,MAAM,IAAImC,QAAQjC,MAAM;gBAC/B;YACF;YACA,KAAK,MAAM,CAACwC,OAAOD,MAAM,IAAIN,QAAQA,OAAO,GAAI;oBAC9BG;gBAAhB,MAAMK,WAAUL,kBAAAA,QAAQ,CAACI,MAAM,YAAfJ,kBAAmB;gBACnC,IAAIK,YAAY,QAAQ9C,OAAOC,IAAI,IAAI;qBAClC,IAAI6C,YAAY,SAAS,MAAMtC,MAAMoC,MAAMnC,GAAG;qBAC9CT,OAAOG,MAAM,IAAI;YACxB;QACF;IACF,EAAE,OAAOoC,OAAO;QACdC,QAAQD,KAAK,CAAC,wBAAwBA;IACxC;IACA,OAAOvC;AACT;AAEA,iFAAiF,GACjF,eAAe+C,oBAAoBV,IAAyB;IAC1D,IAAIA,SAAS,QAAQ,OAAO,AAAC,CAAA,MAAM,MAAM,CAAC,iBAAa,EAAGW,aAAa;IACvE,OAAO,AAAC,CAAA,MAAM,MAAM,CAAC,gBAAY,EAAGC,YAAY;AAClD;AAEA,8DAA8D,GAC9D,OAAO,MAAMC,mBAAqC,OAAOpD,MAAM1B,SAAS,EAAEQ,EAAE,EAAE;IAC5E,MAAMiB,kBAAkBC,MAAM1B,SAAS;QAAEQ;QAAI0C,WAAWyB;IAAoB;AAC9E,EAAC"}

package/src/lib/server/push-fcm.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type BatchResponse, type TokenMessage } from 'firebase-admin/messaging';
+import './firebase-admin';
+import type { PushMessage, PushTransport } from './push-delivery';
+/** `sendEach` takes at most 500 messages. */
+export declare const FCM_BATCH = 500;
+/** The slice of firebase-admin's Messaging this transport uses; injected in tests. */
+export interface FcmMessaging {
+    sendEach(messages: TokenMessage[]): Promise<BatchResponse>;
+}
+export declare function fcmMessage(token: string, message: PushMessage): TokenMessage;
+export declare function createFcmTransport(messaging: FcmMessaging): PushTransport;
+/** The deployment's FCM transport, on the firebase-admin default app. */
+export declare function fcmTransport(): PushTransport;

package/src/lib/server/push-fcm.js

@@ -0,0 +1,83 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Firebase Cloud Messaging for the Android app (AGL-3651), through
+ * firebase-admin's `getMessaging().sendEach` with the project credentials
+ * the server already holds, so it needs no secret of its own. The
+ * notification is shown by the system; the tap data rides in `data`, and
+ * Android delivers it at high priority.
+ *
+ * A token FCM reports unregistered or invalid is gone, and the row is pruned.
+ *
+ * Server-only, imported by `push-delivery.ts` only when a device is on FCM.
+ */ import { getApp } from "firebase-admin/app";
+import { getMessaging } from "firebase-admin/messaging";
+import "./firebase-admin.js";
+/** `sendEach` takes at most 500 messages. */ export const FCM_BATCH = 500;
+const GONE = new Set([
+    'messaging/registration-token-not-registered',
+    'messaging/invalid-registration-token',
+    'messaging/invalid-argument'
+]);
+export function fcmMessage(token, message) {
+    return {
+        token,
+        notification: _extends({
+            title: message.title
+        }, message.body ? {
+            body: message.body
+        } : {}),
+        // FCM data values are strings; MobilePushData's are.
+        data: _extends({}, message.data),
+        android: {
+            priority: 'high',
+            notification: {
+                sound: 'default'
+            }
+        }
+    };
+}
+export function createFcmTransport(messaging) {
+    return {
+        async send (targets, message) {
+            const outcomes = [];
+            for(let start = 0; start < targets.length; start += FCM_BATCH){
+                const batch = targets.slice(start, start + FCM_BATCH);
+                try {
+                    const { responses } = await messaging.sendEach(batch.map((target)=>fcmMessage(target.token, message)));
+                    for (const [index] of batch.entries()){
+                        var _ref;
+                        var _response_error;
+                        const response = responses[index];
+                        if (response == null ? void 0 : response.success) outcomes.push('sent');
+                        else outcomes.push(GONE.has((_ref = response == null ? void 0 : (_response_error = response.error) == null ? void 0 : _response_error.code) != null ? _ref : '') ? 'prune' : 'failed');
+                    }
+                } catch (unused) {
+                    outcomes.push(...batch.map(()=>'failed'));
+                }
+            }
+            return outcomes;
+        }
+    };
+}
+let configured = null;
+/** The deployment's FCM transport, on the firebase-admin default app. */ export function fcmTransport() {
+    configured != null ? configured : configured = createFcmTransport(getMessaging(getApp()));
+    return configured;
+}
+
+//# sourceMappingURL=push-fcm.js.map