@growth-labs/push 0.4.0 → 0.4.1

package/dist/db/schema.d.ts

@@ -18,7 +18,9 @@ export declare const pushSubscriptions: import("drizzle-orm/sqlite-core").SQLite
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, object>;
+        }, {}, {
+            length: number | undefined;
+        }>;
         endpoint: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "endpoint";
             tableName: "gl_push_subscriptions";
@@ -35,7 +37,9 @@ export declare const pushSubscriptions: import("drizzle-orm/sqlite-core").SQLite
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, object>;
+        }, {}, {
+            length: number | undefined;
+        }>;
         keyP256dh: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "key_p256dh";
             tableName: "gl_push_subscriptions";
@@ -52,7 +56,9 @@ export declare const pushSubscriptions: import("drizzle-orm/sqlite-core").SQLite
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, object>;
+        }, {}, {
+            length: number | undefined;
+        }>;
         keyAuth: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "key_auth";
             tableName: "gl_push_subscriptions";
@@ -69,7 +75,9 @@ export declare const pushSubscriptions: import("drizzle-orm/sqlite-core").SQLite
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, object>;
+        }, {}, {
+            length: number | undefined;
+        }>;
         topics: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "topics";
             tableName: "gl_push_subscriptions";
@@ -86,7 +94,9 @@ export declare const pushSubscriptions: import("drizzle-orm/sqlite-core").SQLite
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, object>;
+        }, {}, {
+            length: number | undefined;
+        }>;
         createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "created_at";
             tableName: "gl_push_subscriptions";
@@ -103,7 +113,7 @@ export declare const pushSubscriptions: import("drizzle-orm/sqlite-core").SQLite
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, object>;
+        }, {}, {}>;
         lastDeliveryAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "last_delivery_at";
             tableName: "gl_push_subscriptions";
@@ -120,7 +130,7 @@ export declare const pushSubscriptions: import("drizzle-orm/sqlite-core").SQLite
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, object>;
+        }, {}, {}>;
         failureCount: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "failure_count";
             tableName: "gl_push_subscriptions";
@@ -137,7 +147,7 @@ export declare const pushSubscriptions: import("drizzle-orm/sqlite-core").SQLite
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, object>;
+        }, {}, {}>;
         userAgent: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "user_agent";
             tableName: "gl_push_subscriptions";
@@ -154,7 +164,9 @@ export declare const pushSubscriptions: import("drizzle-orm/sqlite-core").SQLite
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, object>;
+        }, {}, {
+            length: number | undefined;
+        }>;
         country: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "country";
             tableName: "gl_push_subscriptions";
@@ -171,7 +183,9 @@ export declare const pushSubscriptions: import("drizzle-orm/sqlite-core").SQLite
             baseColumn: never;
             identity: undefined;
             generated: undefined;
-        }, object>;
+        }, {}, {
+            length: number | undefined;
+        }>;
     };
     dialect: "sqlite";
 }>;

package/dist/db/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW5B,CAAA"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW5B,CAAA"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAA;AAC7C,OAAO,EAAE,KAAK,WAAW,EAAqB,MAAM,cAAc,CAAA;AAElE,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,gBAAgB,CA0DnE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAA;AAC7C,OAAO,EAAE,KAAK,WAAW,EAAqB,MAAM,cAAc,CAAA;AAQlE,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,gBAAgB,CA0DnE"}

package/dist/index.js

@@ -1,4 +1,9 @@
+import { fileURLToPath } from 'node:url';
 import { pushOptionsSchema } from './options.js';
+const ENTRYPOINT_EXTENSION = import.meta.url.endsWith('.ts') ? '.ts' : '.js';
+function resolveEntrypoint(path) {
+    return fileURLToPath(new URL(`${path}${ENTRYPOINT_EXTENSION}`, import.meta.url));
+}
 export default function push(options) {
     const resolved = pushOptionsSchema.parse(options);
     const virtualConfig = {
@@ -36,17 +41,17 @@ export default function push(options) {
                     },
                 });
                 addMiddleware({
-                    entrypoint: '@growth-labs/push/middleware',
+                    entrypoint: resolveEntrypoint('./middleware/push'),
                     order: 'pre',
                 });
                 injectRoute({
                     pattern: resolved.routes.subscribe,
-                    entrypoint: '@growth-labs/push/routes/subscribe',
+                    entrypoint: resolveEntrypoint('./routes/subscribe'),
                     prerender: false,
                 });
                 injectRoute({
                     pattern: resolved.routes.unsubscribe,
-                    entrypoint: '@growth-labs/push/routes/unsubscribe',
+                    entrypoint: resolveEntrypoint('./routes/unsubscribe'),
                     prerender: false,
                 });
             },

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAElE,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,OAAoB;IAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEjD,MAAM,aAAa,GAAG;QACrB,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;KACzB,CAAA;IAED,MAAM,eAAe,GAAG,iCAAiC,CAAA;IACzD,MAAM,uBAAuB,GAAG,KAAK,eAAe,EAAE,CAAA;IAEtD,OAAO;QACN,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE;YACN,oBAAoB,EAAE,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE;gBACtE,YAAY,CAAC;oBACZ,IAAI,EAAE;wBACL,OAAO,EAAE;4BACR;gCACC,IAAI,EAAE,yBAAyB;gCAC/B,SAAS,CAAC,EAAE;oCACX,IAAI,EAAE,KAAK,eAAe;wCAAE,OAAO,uBAAuB,CAAA;gCAC3D,CAAC;gCACD,IAAI,CAAC,EAAE;oCACN,IAAI,EAAE,KAAK,uBAAuB,EAAE,CAAC;wCACpC,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAA;oCACzD,CAAC;gCACF,CAAC;6BACD;yBACD;qBACD;iBACD,CAAC,CAAA;gBAEF,aAAa,CAAC;oBACb,UAAU,EAAE,8BAA8B;oBAC1C,KAAK,EAAE,KAAK;iBACZ,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;oBAClC,UAAU,EAAE,oCAAoC;oBAChD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW;oBACpC,UAAU,EAAE,sCAAsC;oBAClD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;YACH,CAAC;SACD;KACD,CAAA;AACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAoB,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAElE,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAA;AAE5E,SAAS,iBAAiB,CAAC,IAAY;IACtC,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,oBAAoB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,OAAoB;IAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEjD,MAAM,aAAa,GAAG;QACrB,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;KACzB,CAAA;IAED,MAAM,eAAe,GAAG,iCAAiC,CAAA;IACzD,MAAM,uBAAuB,GAAG,KAAK,eAAe,EAAE,CAAA;IAEtD,OAAO;QACN,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE;YACN,oBAAoB,EAAE,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,EAAE;gBACtE,YAAY,CAAC;oBACZ,IAAI,EAAE;wBACL,OAAO,EAAE;4BACR;gCACC,IAAI,EAAE,yBAAyB;gCAC/B,SAAS,CAAC,EAAE;oCACX,IAAI,EAAE,KAAK,eAAe;wCAAE,OAAO,uBAAuB,CAAA;gCAC3D,CAAC;gCACD,IAAI,CAAC,EAAE;oCACN,IAAI,EAAE,KAAK,uBAAuB,EAAE,CAAC;wCACpC,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAA;oCACzD,CAAC;gCACF,CAAC;6BACD;yBACD;qBACD;iBACD,CAAC,CAAA;gBAEF,aAAa,CAAC;oBACb,UAAU,EAAE,iBAAiB,CAAC,mBAAmB,CAAC;oBAClD,KAAK,EAAE,KAAK;iBACZ,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;oBAClC,UAAU,EAAE,iBAAiB,CAAC,oBAAoB,CAAC;oBACnD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;gBAEF,WAAW,CAAC;oBACX,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW;oBACpC,UAAU,EAAE,iBAAiB,CAAC,sBAAsB,CAAC;oBACrD,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAA;YACH,CAAC;SACD;KACD,CAAA;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growth-labs/push",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "type": "module",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -52,9 +52,11 @@
   },
   "files": [
     "dist",
-    "src/components",
-    "src/client",
-    "src/virtual.d.ts",
+    "src/**/*.ts",
+    "src/**/*.astro",
+    "src/**/*.css",
+    "src/**/*.md",
+    "src/**/*.sql",
     "README.md"
   ],
   "publishConfig": {
@@ -62,16 +64,16 @@
     "registry": "https://registry.npmjs.org/"
   },
   "peerDependencies": {
-    "astro": "^6.0.0"
+    "astro": "^6.1.10"
   },
   "dependencies": {
     "@block65/webcrypto-web-push": "^1.0.0",
-    "drizzle-orm": "^0.36.0",
+    "drizzle-orm": "^0.45.2",
     "zod": "^3.23.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.0.0",
-    "astro": "^6.0.0",
+    "astro": "^6.1.10",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"
   },

package/src/db/schema.ts

@@ -0,0 +1,14 @@
+import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
+
+export const pushSubscriptions = sqliteTable('gl_push_subscriptions', {
+	id: text('id').primaryKey(),
+	endpoint: text('endpoint').notNull().unique(),
+	keyP256dh: text('key_p256dh').notNull(),
+	keyAuth: text('key_auth').notNull(),
+	topics: text('topics'),
+	createdAt: integer('created_at', { mode: 'timestamp' }).notNull(),
+	lastDeliveryAt: integer('last_delivery_at', { mode: 'timestamp' }),
+	failureCount: integer('failure_count').notNull().default(0),
+	userAgent: text('user_agent'),
+	country: text('country'),
+})

package/src/index.ts

@@ -0,0 +1,69 @@
+import { fileURLToPath } from 'node:url'
+import type { AstroIntegration } from 'astro'
+import { type PushOptions, pushOptionsSchema } from './options.js'
+
+const ENTRYPOINT_EXTENSION = import.meta.url.endsWith('.ts') ? '.ts' : '.js'
+
+function resolveEntrypoint(path: string): string {
+	return fileURLToPath(new URL(`${path}${ENTRYPOINT_EXTENSION}`, import.meta.url))
+}
+
+export default function push(options: PushOptions): AstroIntegration {
+	const resolved = pushOptionsSchema.parse(options)
+
+	const virtualConfig = {
+		vapidPublicKey: resolved.vapidPublicKey,
+		d1Binding: resolved.d1Binding,
+		queueBinding: resolved.queueBinding,
+		defaults: resolved.defaults,
+		queue: resolved.queue,
+		turnstile: resolved.turnstile,
+		routes: resolved.routes,
+		cleanup: resolved.cleanup,
+	}
+
+	const virtualModuleId = 'virtual:growth-labs/push/config'
+	const resolvedVirtualModuleId = `\0${virtualModuleId}`
+
+	return {
+		name: '@growth-labs/push',
+		hooks: {
+			'astro:config:setup': ({ addMiddleware, injectRoute, updateConfig }) => {
+				updateConfig({
+					vite: {
+						plugins: [
+							{
+								name: 'growth-labs-push-config',
+								resolveId(id) {
+									if (id === virtualModuleId) return resolvedVirtualModuleId
+								},
+								load(id) {
+									if (id === resolvedVirtualModuleId) {
+										return `export default ${JSON.stringify(virtualConfig)}`
+									}
+								},
+							},
+						],
+					},
+				})
+
+				addMiddleware({
+					entrypoint: resolveEntrypoint('./middleware/push'),
+					order: 'pre',
+				})
+
+				injectRoute({
+					pattern: resolved.routes.subscribe,
+					entrypoint: resolveEntrypoint('./routes/subscribe'),
+					prerender: false,
+				})
+
+				injectRoute({
+					pattern: resolved.routes.unsubscribe,
+					entrypoint: resolveEntrypoint('./routes/unsubscribe'),
+					prerender: false,
+				})
+			},
+		},
+	}
+}

package/src/middleware/push.ts

@@ -0,0 +1,10 @@
+import config from 'virtual:growth-labs/push/config'
+import { defineMiddleware } from 'astro/middleware'
+
+export const onRequest = defineMiddleware(async (context, next) => {
+	;(context.locals as Record<string, unknown>).push = {
+		vapidPublicKey: config.vapidPublicKey,
+	}
+
+	return next()
+})

package/src/options.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod'
+
+export const pushOptionsSchema = z.object({
+	vapidPublicKey: z.string().min(1),
+	vapidPrivateKey: z.string().min(1),
+	vapidSubject: z.string().min(1),
+
+	d1Binding: z.string().default('SITE_DB'),
+	queueBinding: z.string().default('PUSH_QUEUE'),
+
+	defaults: z
+		.object({
+			icon: z.string().optional(),
+			ttl: z.number().int().positive().default(86400),
+			urgency: z.enum(['very-low', 'low', 'normal', 'high']).default('normal'),
+		})
+		.default({}),
+
+	queue: z
+		.object({
+			batchSize: z.number().int().positive().default(100),
+			maxRetries: z.number().int().nonnegative().default(3),
+		})
+		.default({}),
+
+	turnstile: z.object({
+		secretKey: z.string().min(1),
+	}),
+
+	routes: z
+		.object({
+			subscribe: z.string().default('/api/push/subscribe'),
+			unsubscribe: z.string().default('/api/push/unsubscribe'),
+		})
+		.default({}),
+
+	cleanup: z
+		.object({
+			staleAfterDays: z.number().int().positive().default(90),
+		})
+		.default({}),
+})
+
+export type PushOptions = z.input<typeof pushOptionsSchema>
+export type ResolvedPushOptions = z.output<typeof pushOptionsSchema>

package/src/routes/subscribe.ts

@@ -0,0 +1,82 @@
+import { env } from 'cloudflare:workers'
+import config from 'virtual:growth-labs/push/config'
+import type { APIRoute } from 'astro'
+import { trackPushSubscription } from '../utils/analytics.js'
+import { findSubscriptionByEndpoint, saveSubscription } from '../utils/subscriptions.js'
+import { verifyTurnstile } from '../utils/turnstile.js'
+
+export const POST: APIRoute = async ({ request }) => {
+	const body = (await request.json()) as Record<string, unknown>
+
+	const turnstileToken = body.turnstileToken as string | undefined
+	if (!turnstileToken) {
+		return new Response(JSON.stringify({ error: 'Missing Turnstile token' }), {
+			status: 400,
+			headers: { 'Content-Type': 'application/json' },
+		})
+	}
+
+	const envMap = env as Record<string, unknown>
+	const turnstileSecret =
+		(envMap[config.turnstile.secretKey] as string) ?? (envMap.TURNSTILE_SECRET as string)
+	const turnstileValid = await verifyTurnstile(
+		turnstileToken,
+		turnstileSecret,
+		request.headers.get('CF-Connecting-IP'),
+	)
+	if (!turnstileValid) {
+		return new Response(JSON.stringify({ error: 'Bot detected' }), {
+			status: 403,
+			headers: { 'Content-Type': 'application/json' },
+		})
+	}
+
+	const sub = (body.subscription ?? {}) as Record<string, unknown>
+	const endpoint = sub.endpoint as string | undefined
+	const keys = sub.keys as Record<string, string> | undefined
+	if (!endpoint || !keys?.p256dh || !keys?.auth) {
+		return new Response(JSON.stringify({ error: 'Invalid subscription' }), {
+			status: 400,
+			headers: { 'Content-Type': 'application/json' },
+		})
+	}
+
+	const db = envMap[config.d1Binding] as D1Database
+	const existing = await findSubscriptionByEndpoint(db, endpoint)
+	if (existing) {
+		await saveSubscription(db, {
+			...existing,
+			keyP256dh: keys.p256dh,
+			keyAuth: keys.auth,
+			failureCount: 0,
+			lastDeliveryAt: null,
+		})
+		return new Response(JSON.stringify({ ok: true, updated: true }), {
+			status: 200,
+			headers: { 'Content-Type': 'application/json' },
+		})
+	}
+
+	await saveSubscription(db, {
+		id: crypto.randomUUID(),
+		endpoint,
+		keyP256dh: keys.p256dh,
+		keyAuth: keys.auth,
+		topics: null,
+		createdAt: Math.floor(Date.now() / 1000),
+		lastDeliveryAt: null,
+		failureCount: 0,
+		userAgent: request.headers.get('User-Agent'),
+		country: request.headers.get('CF-IPCountry') ?? null,
+	})
+
+	trackPushSubscription('subscribed', {
+		country: request.headers.get('CF-IPCountry') ?? undefined,
+		userAgent: request.headers.get('User-Agent') ?? undefined,
+	}).catch(() => {})
+
+	return new Response(JSON.stringify({ ok: true, created: true }), {
+		status: 201,
+		headers: { 'Content-Type': 'application/json' },
+	})
+}

package/src/routes/unsubscribe.ts

@@ -0,0 +1,29 @@
+import { env } from 'cloudflare:workers'
+import config from 'virtual:growth-labs/push/config'
+import type { APIRoute } from 'astro'
+import { trackPushSubscription } from '../utils/analytics.js'
+import { deleteSubscriptionByEndpoint } from '../utils/subscriptions.js'
+
+export const POST: APIRoute = async ({ request }) => {
+	const body = (await request.json()) as Record<string, unknown>
+	const endpoint = body.endpoint as string | undefined
+
+	if (!endpoint) {
+		return new Response(JSON.stringify({ error: 'Missing endpoint' }), {
+			status: 400,
+			headers: { 'Content-Type': 'application/json' },
+		})
+	}
+
+	const db = (env as Record<string, unknown>)[config.d1Binding] as D1Database
+	const deleted = await deleteSubscriptionByEndpoint(db, endpoint)
+
+	if (deleted) {
+		trackPushSubscription('unsubscribed').catch(() => {})
+	}
+
+	return new Response(JSON.stringify({ ok: true, deleted }), {
+		status: 200,
+		headers: { 'Content-Type': 'application/json' },
+	})
+}

package/src/types.ts

@@ -0,0 +1,129 @@
+/** Push notification payload — what the user sees */
+export interface PushPayload {
+	title: string
+	body: string
+	icon?: string
+	image?: string
+	url: string
+	action?: {
+		title: string
+		url: string
+	}
+	tag?: string
+}
+
+/** Per-notification delivery options */
+export interface PushSendOptions {
+	ttl?: number
+	urgency?: 'very-low' | 'low' | 'normal' | 'high'
+}
+
+/** A push subscription as stored in D1 / received from the browser */
+export interface PushSubscriptionRecord {
+	id: string
+	endpoint: string
+	keyP256dh: string
+	keyAuth: string
+	topics: string | null
+	createdAt: number
+	lastDeliveryAt: number | null
+	failureCount: number
+	userAgent: string | null
+	country: string | null
+}
+
+/**
+ * Queue message shape for batch sends.
+ *
+ * VAPID credentials are NOT included. The Queue consumer Worker reads them
+ * from its own env bindings (Cloudflare Secrets). This keeps the private key
+ * in exactly one place and avoids serializing it into every Queue message.
+ *
+ * `siteId` identifies which site enqueued the message. The realm consumer
+ * uses it with `siteConfigLookup` to apply per-site overrides (icon URL,
+ * VAPID identity, etc.). Sites in single-tenant mode can pass any string.
+ */
+export interface PushQueueMessage {
+	siteId: string
+	subscriptions: PushSubscriptionRecord[]
+	payload: PushPayload
+	options: PushSendOptions
+}
+
+/**
+ * Per-site config override applied at consumer time. Returned from
+ * SitePushConfigLookup. All fields are optional — only the ones present
+ * will override the consumer context for that message.
+ */
+export interface SitePushConfig {
+	defaults?: {
+		icon?: string
+		ttl?: number
+		urgency?: 'very-low' | 'low' | 'normal' | 'high'
+	}
+	vapid?: {
+		subject?: string
+		publicKey?: string
+		privateKey?: string
+	}
+}
+
+/**
+ * Per-message lookup. The realm consumer calls it with the message's
+ * `siteId`. Returns the per-site config to apply, or `null` to skip the
+ * override and use the consumer's context as-is.
+ */
+export type SitePushConfigLookup = (
+	siteId: string,
+	env: Record<string, unknown>,
+) => Promise<SitePushConfig | null>
+
+/** Result of a single push send attempt */
+export interface PushSendResult {
+	subscriptionId: string
+	success: boolean
+	statusCode?: number
+	error?: string
+	expired?: boolean
+}
+
+/** Batch send result */
+export interface PushBatchResult {
+	sent: number
+	failed: number
+	expired: number
+	results: PushSendResult[]
+}
+
+/** What the middleware puts on context.locals */
+export interface PushLocals {
+	push: {
+		vapidPublicKey: string
+	}
+}
+
+/** Serializable config exported by the virtual module */
+export interface PushConfig {
+	vapidPublicKey: string
+	d1Binding: string
+	queueBinding: string
+	defaults: {
+		icon?: string
+		ttl: number
+		urgency: 'very-low' | 'low' | 'normal' | 'high'
+	}
+	queue: {
+		batchSize: number
+		maxRetries: number
+	}
+	turnstile: {
+		secretKey: string
+	}
+	routes: {
+		subscribe: string
+		unsubscribe: string
+	}
+	cleanup: {
+		staleAfterDays: number
+	}
+}

package/src/utils/analytics.ts

@@ -0,0 +1,96 @@
+import type { PushBatchResult, PushPayload } from '../types.js'
+
+/** Module name kept in a variable so TypeScript doesn't try to resolve it at compile time */
+const ANALYTICS_MODULE = '@growth-labs/analytics'
+
+/**
+ * Server-side analytics helper for push events.
+ *
+ * Uses optional peer dependency on @growth-labs/analytics.
+ * If analytics is not installed, events are silently dropped.
+ * This follows the project convention: optional peer dependency + dynamic import with try/catch.
+ */
+export async function trackPushEvent(
+	eventName: string,
+	data: Record<string, unknown>,
+): Promise<void> {
+	try {
+		const analytics = (await import(/* @vite-ignore */ ANALYTICS_MODULE)) as Record<string, unknown>
+		if (analytics && typeof analytics.trackServerEvent === 'function') {
+			await (
+				analytics.trackServerEvent as (name: string, data: Record<string, unknown>) => Promise<void>
+			)(eventName, data)
+		}
+	} catch {
+		// @growth-labs/analytics not installed — silently skip
+	}
+}
+
+/**
+ * Track a push notification send completion.
+ * Call after a batch send completes (in queue consumer or direct send).
+ */
+export async function trackPushSend(payload: PushPayload, result: PushBatchResult): Promise<void> {
+	await trackPushEvent('push_notification_sent', {
+		title: payload.title,
+		tag: payload.tag,
+		url: payload.url,
+		sent: result.sent,
+		failed: result.failed,
+		expired: result.expired,
+	})
+}
+
+/**
+ * Track a push subscription event (subscribe or unsubscribe).
+ * Call from route handlers after successful subscription changes.
+ */
+export async function trackPushSubscription(
+	action: 'subscribed' | 'unsubscribed',
+	metadata: { endpoint?: string; country?: string; userAgent?: string } = {},
+): Promise<void> {
+	await trackPushEvent(`push_${action}`, {
+		country: metadata.country,
+		userAgent: metadata.userAgent,
+	})
+}
+
+/**
+ * Track a push cleanup event.
+ * Call after subscription cleanup runs.
+ */
+export async function trackPushCleanup(removed: number): Promise<void> {
+	await trackPushEvent('push_cleanup', { removed })
+}
+
+/**
+ * Emit a client-side analytics event using the gl:* CustomEvent pattern.
+ * This is meant to be called from browser-side code (service worker or page).
+ *
+ * Packages emit CustomEvent on document with gl: prefix. These are local
+ * browser signals; consumers call window.glAnalytics.track(...) when an event
+ * should be persisted to WAE.
+ *
+ * Usage in service worker notificationclick handler:
+ * ```javascript
+ * // In the page after notification click navigation
+ * document.dispatchEvent(new CustomEvent('gl:push_notification_clicked', {
+ *   detail: { tag: 'article-123', url: '/articles/123' }
+ * }))
+ * ```
+ *
+ * This function is a convenience wrapper for use in page scripts.
+ */
+export function emitPushAnalyticsEvent(
+	eventName: string,
+	detail: Record<string, unknown> = {},
+): void {
+	// Check for browser environment — this function is a no-op on the server
+	const doc =
+		typeof globalThis !== 'undefined'
+			? (globalThis as unknown as { document?: { dispatchEvent(event: Event): boolean } }).document
+			: undefined
+	if (doc) {
+		doc.dispatchEvent(new CustomEvent(`gl:${eventName}`, { detail }))
+	}
+}