@cloudsignal/pwa-sdk 2.1.0 → 2.1.3

package/dist/index.js

@@ -1,5 +1,5 @@
-import { isValidUUID } from './chunk-IQHSODT4.js';
-export { generateAuthHeaders, generateHMACSignature, isValidUUID, makeAuthenticatedRequest } from './chunk-IQHSODT4.js';
+import { isValidUUID } from './chunk-NSF32IGO.js';
+export { generateAuthHeaders, generateHMACSignature, isValidUUID, makeAuthenticatedRequest } from './chunk-NSF32IGO.js';
 
 /**
  * CloudSignal PWA SDK v1.0.0
@@ -960,7 +960,7 @@ async function makeAuthenticatedRequestWithContext(authContext, method, url, bod
       body
     );
   }
-  const { makeAuthenticatedRequest: makeAuthenticatedRequest4 } = await import('./hmac-WITZIX2O.js');
+  const { makeAuthenticatedRequest: makeAuthenticatedRequest4 } = await import('./hmac-YQQ5XQWC.js');
   if (!authContext.organizationPublishableKey) {
     throw new Error("organizationPublishableKey required for HMAC auth mode");
   }
@@ -1038,6 +1038,14 @@ function markInstallationRegistered(organizationId, serviceId, registrationId) {
   setStorageItem(`install_id_${organizationId}_${serviceId}`, registrationId);
   return setStorageItem(key, true);
 }
+function getLastRegisteredIdentity(organizationId, serviceId) {
+  const key = `last_identity_${organizationId}_${serviceId}`;
+  return getStorageItem(key);
+}
+function setLastRegisteredIdentity(organizationId, serviceId, identity) {
+  const key = `last_identity_${organizationId}_${serviceId}`;
+  return setStorageItem(key, identity);
+}
 var IndexedDBStorage = class {
   constructor(dbName = "CloudSignalPWA", dbVersion = 1) {
     this.db = null;
@@ -1308,6 +1316,27 @@ var PushNotificationManager = class {
         this.onPermissionDenied?.();
         return null;
       }
+      const incomingEmail = options.userEmail ?? null;
+      const incomingUserId = options.userId ?? null;
+      const stored = getLastRegisteredIdentity(this.organizationId, this.serviceId);
+      if (stored) {
+        const emailChanged = stored.email !== null && incomingEmail !== null && stored.email !== incomingEmail;
+        const userIdChanged = stored.userId !== null && incomingUserId !== null && stored.userId !== incomingUserId;
+        if (emailChanged || userIdChanged) {
+          this.log(
+            `Identity changed on this device (was ${stored.email || stored.userId}, now ${incomingEmail || incomingUserId}); dropping stale push subscription`
+          );
+          try {
+            const stale = await this.serviceWorkerRegistration.pushManager.getSubscription();
+            if (stale) {
+              await stale.unsubscribe();
+              this.pushSubscription = null;
+            }
+          } catch (err) {
+            this.log(`Stale subscription unsubscribe failed: ${err}`, "error");
+          }
+        }
+      }
       const subscription = await this.subscribeToPush();
       if (!subscription) {
         throw new Error("Failed to subscribe to push notifications");
@@ -1348,12 +1377,23 @@ var PushNotificationManager = class {
         this.onTokenExpired
       );
       if (!response.ok) {
+        if (response.status === 422) {
+          const body = await response.clone().json().catch(() => null);
+          if (body?.detail?.code === "user_identity_required") {
+            this.log("Skipping push registration: service requires user identity");
+            return null;
+          }
+        }
         const errorText = await response.text();
         throw new Error(`Registration failed: ${response.status} - ${errorText}`);
       }
       const result = await response.json();
       this.registrationId = result.registration_id;
       setRegistrationId(this.organizationId, this.serviceId, this.registrationId);
+      setLastRegisteredIdentity(this.organizationId, this.serviceId, {
+        email: incomingEmail,
+        userId: incomingUserId
+      });
       const registration = {
         registrationId: result.registration_id,
         status: result.status || "active",
@@ -1414,6 +1454,13 @@ var PushNotificationManager = class {
         this.onTokenExpired
       );
       if (!response.ok) {
+        if (response.status === 422) {
+          const body = await response.clone().json().catch(() => null);
+          if (body?.detail?.code === "user_identity_required") {
+            this.log("Skipping install-only registration: service requires user identity");
+            return null;
+          }
+        }
         const errorText = await response.text();
         throw new Error(`Installation registration failed: ${response.status} - ${errorText}`);
       }
@@ -4099,5 +4146,3 @@ var NotificationPermissionPrompt = class {
 var VERSION = "1.2.0";
 
 export { CloudSignalPWA, DeviceDetector, HeartbeatManager, IOSInstallBanner, IOS_BANNER_TRANSLATIONS, IndexedDBStorage, InstallationManager, NOTIFICATION_PROMPT_TRANSLATIONS, NotificationPermissionPrompt, OfflineQueueManager, PushNotificationManager, ServiceWorkerManager, VERSION, WakeLockManager, createAuthContext, CloudSignalPWA_default as default, detectBrowserLanguage, deviceDetector, generateBrowserFingerprint, generateJWTHeaders, generateTrackingId, getRegistrationId, getStorageItem, makeAuthenticatedRequestWithContext, makeJWTAuthenticatedRequest, removeRegistrationId, removeStorageItem, setRegistrationId, setStorageItem, updateAuthToken };
-//# sourceMappingURL=index.js.map
-//# sourceMappingURL=index.js.map

package/dist/service-worker.js

@@ -452,5 +452,3 @@
   console.log(`[CloudSignal SW] Service worker loaded ${CACHE_VERSION}`);
 
 })();
-//# sourceMappingURL=service-worker.js.map
-//# sourceMappingURL=service-worker.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudsignal/pwa-sdk",
-  "version": "2.1.0",
+  "version": "2.1.3",
   "description": "CloudSignal PWA SDK - Progressive Web App features with push notifications, JWT/HMAC authentication, installation management, device tracking, offline queue, wake lock, and notification analytics",
   "main": "dist/index.cjs",
   "module": "dist/index.js",
@@ -31,7 +31,7 @@
     "build:watch": "tsup --watch",
     "typecheck": "tsc --noEmit",
     "clean": "rm -rf dist",
-    "prepublishOnly": "npm run clean && npm run build",
+    "prepublishOnly": "npm run clean && npm run build && bash ../scripts/check-publish-safe.sh .",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage"

package/dist/chunk-IQHSODT4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/utils/hmac.ts"],"names":[],"mappings":";;;;;;;AAQA,SAAS,MAAM,MAAA,EAA6B;AAC1C,EAAA,OAAO,MAAM,IAAA,CAAK,IAAI,WAAW,MAAM,CAAC,EACrC,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CACxC,KAAK,EAAE,CAAA;AACZ;AAKA,SAAS,SAAS,MAAA,EAA6B;AAC7C,EAAA,OAAO,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,IAAI,UAAA,CAAW,MAAM,CAAC,CAAC,CAAA;AAC5D;AAaA,eAAsB,sBACpB,MAAA,EACA,cAAA,EACA,WACA,MAAA,EACA,GAAA,EACA,OAAe,EAAA,EACE;AACjB,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAGhC,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,KAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,GAChC,IAAI,GAAA,CAAI,GAAG,CAAA,GACX,IAAI,GAAA,CAAI,GAAA,EAAK,6BAA6B,CAAA;AAC9C,IAAA,IAAA,GAAO,MAAA,CAAO,QAAA;AACd,IAAA,KAAA,GAAQ,OAAO,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,GAAI,EAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AAEN,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAClC,IAAA,IAAI,aAAa,EAAA,EAAI;AACnB,MAAA,IAAA,GAAO,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAC9B,MAAA,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,UAAA,GAAa,CAAC,CAAA;AAAA,IAClC,CAAA,MAAO;AACL,MAAA,IAAA,GAAO,GAAA;AACP,MAAA,KAAA,GAAQ,EAAA;AAAA,IACV;AAAA,EACF;AAGA,EAAA,MAAM,cAAA,GAAiB;AAAA,IACrB,OAAO,WAAA,EAAY;AAAA,IACnB,IAAA;AAAA,IACA,KAAA;AAAA,IACA,cAAA;AAAA,IACA;AAAA,GACF;AAGA,EAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG;AAC3B,IAAA,MAAM,cAAA,GAAiB,MAAM,MAAA,CAAO,MAAA,CAAO,OAAO,SAAA,EAAW,OAAA,CAAQ,MAAA,CAAO,IAAI,CAAC,CAAA;AACjF,IAAA,MAAM,WAAA,GAAc,MAAM,cAAc,CAAA;AACxC,IAAA,cAAA,CAAe,KAAK,WAAW,CAAA;AAAA,EACjC;AAGA,EAAA,MAAM,eAAA,GAAkB,cAAA,CAAe,IAAA,CAAK,IAAI,CAAA;AAGhD,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA;AAAA,IAC9B,KAAA;AAAA,IACA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,IACrB,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,SAAA,EAAU;AAAA,IAChC,KAAA;AAAA,IACA,CAAC,MAAM;AAAA,GACT;AAGA,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,GAAA,EAAK,OAAA,CAAQ,MAAA,CAAO,eAAe,CAAC,CAAA;AAEvF,EAAA,OAAO,SAAS,SAAS,CAAA;AAC3B;AAYA,eAAsB,mBAAA,CACpB,cAAA,EACA,0BAAA,EACA,MAAA,EACA,KACA,IAAA,EACiC;AACjC,EAAA,MAAM,SAAA,GAAY,KAAK,KAAA,CAAM,IAAA,CAAK,KAAI,GAAI,GAAI,EAAE,QAAA,EAAS;AAEzD,EAAA,MAAM,YAAY,MAAM,qBAAA;AAAA,IACtB,0BAAA;AAAA,IACA,cAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,GAAA;AAAA,IACA,IAAA,IAAQ;AAAA,GACV;AAEA,EAAA,OAAO;AAAA,IACL,+BAAA,EAAiC,cAAA;AAAA,IACjC,yBAAA,EAA2B,SAAA;AAAA,IAC3B,yBAAA,EAA2B,SAAA;AAAA,IAC3B,cAAA,EAAgB;AAAA,GAClB;AACF;AAYA,eAAsB,wBAAA,CACpB,cAAA,EACA,0BAAA,EACA,MAAA,EACA,KACA,IAAA,EACmB;AACnB,EAAA,MAAM,OAAA,GAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,GAAI,MAAA;AAE9C,EAAA,MAAM,UAAU,MAAM,mBAAA;AAAA,IACpB,cAAA;AAAA,IACA,0BAAA;AAAA,IACA,MAAA;AAAA,IACA,GAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,MAAM,OAAA,GAAuB;AAAA,IAC3B,MAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,OAAA,CAAQ,IAAA,GAAO,OAAA;AAAA,EACjB;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,OAAO,CAAA;AAC3B;AAQO,SAAS,YAAY,KAAA,EAA2C;AACrE,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,UAAU,OAAO,KAAA;AAChD,EAAA,OAAO,4EAAA,CAA6E,KAAK,KAAK,CAAA;AAChG","file":"chunk-IQHSODT4.js","sourcesContent":["/**\n * HMAC Authentication Utilities\n * Implements CloudSignal's HMAC signature scheme for API authentication\n */\n\n/**\n * Convert ArrayBuffer to hex string\n */\nfunction toHex(buffer: ArrayBuffer): string {\n  return Array.from(new Uint8Array(buffer))\n    .map(b => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/**\n * Convert ArrayBuffer to base64 string\n */\nfunction toBase64(buffer: ArrayBuffer): string {\n  return btoa(String.fromCharCode(...new Uint8Array(buffer)))\n}\n\n/**\n * Generate HMAC signature for CloudSignal API requests\n *\n * @param secret - Signing key (organization publishable key, pk_*)\n * @param organizationId - Organization UUID\n * @param timestamp - Unix timestamp string\n * @param method - HTTP method (GET, POST, etc.)\n * @param url - Full URL or path\n * @param body - Request body (optional)\n * @returns Base64-encoded HMAC signature\n */\nexport async function generateHMACSignature(\n  secret: string,\n  organizationId: string,\n  timestamp: string,\n  method: string,\n  url: string,\n  body: string = ''\n): Promise<string> {\n  const encoder = new TextEncoder()\n\n  // Parse URL to extract path and query\n  let path: string\n  let query: string\n\n  try {\n    const urlObj = url.startsWith('http')\n      ? new URL(url)\n      : new URL(url, 'https://pwa.cloudsignal.app')\n    path = urlObj.pathname\n    query = urlObj.search ? urlObj.search.slice(1) : ''\n  } catch {\n    // Fallback for simple paths\n    const queryIndex = url.indexOf('?')\n    if (queryIndex > -1) {\n      path = url.slice(0, queryIndex)\n      query = url.slice(queryIndex + 1)\n    } else {\n      path = url\n      query = ''\n    }\n  }\n\n  // Build canonical string parts\n  const canonicalParts = [\n    method.toUpperCase(),\n    path,\n    query,\n    organizationId,\n    timestamp,\n  ]\n\n  // Add body hash if body is present\n  if (body && body.length > 0) {\n    const bodyHashBuffer = await crypto.subtle.digest('SHA-256', encoder.encode(body))\n    const bodyHashHex = toHex(bodyHashBuffer)\n    canonicalParts.push(bodyHashHex)\n  }\n\n  // Join parts with newlines\n  const canonicalString = canonicalParts.join('\\n')\n\n  // Import secret as HMAC key\n  const key = await crypto.subtle.importKey(\n    'raw',\n    encoder.encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign']\n  )\n\n  // Sign the canonical string\n  const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(canonicalString))\n\n  return toBase64(signature)\n}\n\n/**\n * Generate authentication headers for CloudSignal API requests\n *\n * @param organizationId - Organization UUID\n * @param organizationPublishableKey - Organization publishable key (pk_*)\n * @param method - HTTP method\n * @param url - Request URL\n * @param body - Request body (optional)\n * @returns Headers object with authentication headers\n */\nexport async function generateAuthHeaders(\n  organizationId: string,\n  organizationPublishableKey: string,\n  method: string,\n  url: string,\n  body?: string\n): Promise<Record<string, string>> {\n  const timestamp = Math.floor(Date.now() / 1000).toString()\n\n  const signature = await generateHMACSignature(\n    organizationPublishableKey,\n    organizationId,\n    timestamp,\n    method,\n    url,\n    body || ''\n  )\n\n  return {\n    'X-CloudSignal-Organization-ID': organizationId,\n    'X-CloudSignal-Timestamp': timestamp,\n    'X-CloudSignal-Signature': signature,\n    'Content-Type': 'application/json',\n  }\n}\n\n/**\n * Make an authenticated request to CloudSignal API\n *\n * @param organizationId - Organization UUID\n * @param organizationPublishableKey - Organization publishable key (pk_*)\n * @param method - HTTP method\n * @param url - Request URL\n * @param body - Request body (optional)\n * @returns Fetch Response\n */\nexport async function makeAuthenticatedRequest(\n  organizationId: string,\n  organizationPublishableKey: string,\n  method: string,\n  url: string,\n  body?: Record<string, any>\n): Promise<Response> {\n  const bodyStr = body ? JSON.stringify(body) : undefined\n\n  const headers = await generateAuthHeaders(\n    organizationId,\n    organizationPublishableKey,\n    method,\n    url,\n    bodyStr\n  )\n\n  const options: RequestInit = {\n    method,\n    headers,\n  }\n\n  if (bodyStr) {\n    options.body = bodyStr\n  }\n\n  return fetch(url, options)\n}\n\n/**\n * Validate UUID format\n * \n * @param value - String to validate\n * @returns Whether the string is a valid UUID\n */\nexport function isValidUUID(value: string | null | undefined): boolean {\n  if (!value || typeof value !== 'string') return false\n  return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)\n}\n"]}

package/dist/hmac-WITZIX2O.js

@@ -1,3 +0,0 @@
-export { generateAuthHeaders, generateHMACSignature, isValidUUID, makeAuthenticatedRequest } from './chunk-IQHSODT4.js';
-//# sourceMappingURL=hmac-WITZIX2O.js.map
-//# sourceMappingURL=hmac-WITZIX2O.js.map

package/dist/hmac-WITZIX2O.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"hmac-WITZIX2O.js"}