@hatk/hatk 0.0.1-alpha.78 → 0.0.1-alpha.79

package/dist/config.d.ts

@@ -52,8 +52,21 @@ export interface ApnsPushConfig {
     bundleId: string;
     production?: boolean;
 }
+/**
+ * Firebase Cloud Messaging, for Android devices.
+ *
+ * `keyFile` is a Google service-account JSON carrying the Firebase Messaging
+ * role, resolved relative to the config file like the APNs key. The project id
+ * comes from that file unless it's overridden here.
+ */
+export interface FcmPushConfig {
+    keyFile: string;
+    projectId?: string;
+}
+/** Either transport may stand alone; a platform without one simply isn't sent to. */
 export interface PushConfig {
-    apns: ApnsPushConfig;
+    apns?: ApnsPushConfig;
+    fcm?: FcmPushConfig;
 }
 export interface CdnConfig {
     url: string;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAA;IACrC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACnC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAA;IAC1C,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,sBAAsB,EAAE,CAAA;CAC7C;AAED,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,WAAW,EAAE,OAAO,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,CAAA;CACrB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;;OAOG;IACH,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,SAAS,GAAG,IAAI,CAAA;IACrB,cAAc,EAAE,QAAQ,GAAG,QAAQ,CAAA;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,QAAQ,EAAE,cAAc,CAAA;IACxB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,4EAA4E;AAC5E,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC,CAAC,GAAG;IAC7G,GAAG,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IACtB,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG;QAAE,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC,GAAG,IAAI,CAAA;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAClC,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;CACnC,CAAA;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAErE;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgExE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAA;IACrC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACnC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAA;IAC1C,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,OAAO,EAAE,iBAAiB,EAAE,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,sBAAsB,EAAE,CAAA;CAC7C;AAED,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,WAAW,EAAE,OAAO,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,cAAc,CAAA;IACrB,GAAG,CAAC,EAAE,aAAa,CAAA;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;;OAOG;IACH,SAAS,EAAE,eAAe,GAAG,IAAI,CAAA;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,SAAS,GAAG,IAAI,CAAA;IACrB,cAAc,EAAE,QAAQ,GAAG,QAAQ,CAAA;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,QAAQ,EAAE,cAAc,CAAA;IACxB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;IACzB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,4EAA4E;AAC5E,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC,CAAC,GAAG;IAC7G,GAAG,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IACtB,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG;QAAE,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC,GAAG,IAAI,CAAA;IACxE,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAClC,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;CACnC,CAAA;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAErE;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgExE"}

package/dist/main.js

@@ -34,7 +34,7 @@ import { runBackfill } from "./backfill.js";
 import { initOAuth } from "./oauth/server.js";
 import { parseSessionCookie, getSessionCookieName } from "./oauth/session.js";
 import { loadOnLoginHook } from "./hooks.js";
-import { initPush, isPushEnabled } from "./push.js";
+import { enabledPushTransports, initPush, isPushEnabled } from "./push.js";
 import { initSetup } from "./setup.js";
 import { initServer } from "./server-init.js";
 const configPath = process.argv[2] || 'hatk.config.ts';
@@ -140,10 +140,10 @@ if (config.oauth) {
 if (config.push) {
     initPush(config.push, configDir);
     if (isPushEnabled()) {
-        log(`[main] Push initialized (APNs bundle: ${config.push.apns.bundleId})`);
+        log(`[main] Push initialized (${enabledPushTransports().join(', ')})`);
     }
     else {
-        log(`[main] Push configured but key file missing — push disabled`);
+        log(`[main] Push configured but no usable credential — push disabled`);
     }
 }
 // 5. Start server immediately (don't wait for backfill)

package/dist/push.d.ts

@@ -5,8 +5,20 @@ export interface ApnsConfig {
     bundleId: string;
     production?: boolean;
 }
+/**
+ * Firebase Cloud Messaging, for Android devices.
+ *
+ * `keyFile` is a Google service-account JSON with the Firebase Messaging role,
+ * resolved like the APNs key: relative to the config file. The project id is
+ * read from that file unless overridden here.
+ */
+export interface FcmConfig {
+    keyFile: string;
+    projectId?: string;
+}
 export interface PushConfig {
-    apns: ApnsConfig;
+    apns?: ApnsConfig;
+    fcm?: FcmConfig;
 }
 export interface PushPayload {
     did: string;
@@ -19,10 +31,18 @@ export interface PushPayload {
 export interface PushInterface {
     send: (payload: PushPayload) => Promise<void>;
 }
-/** Initialize push with config. Must be called before send(). */
+/**
+ * Initialize push with config. Must be called before send().
+ *
+ * Each transport is loaded on its own: a missing or malformed credential
+ * disables that platform and leaves the other one sending, rather than taking
+ * push down entirely.
+ */
 export declare function initPush(config: PushConfig, configDir: string): void;
-/** Check if push is configured and available. */
+/** Check if push is configured and at least one transport is usable. */
 export declare function isPushEnabled(): boolean;
+/** Which platforms this process can actually deliver to, for startup logging. */
+export declare function enabledPushTransports(): string[];
 /** Build the push interface injected into hook contexts. */
 export declare function buildPushInterface(): PushInterface;
 /** Register a push token for a DID. Upserts on conflict. */

package/dist/push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../src/push.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,CAAA;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAOD,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASpE;AAED,iDAAiD;AACjD,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,4DAA4D;AAC5D,wBAAgB,kBAAkB,IAAI,aAAa,CAElD;AA0JD,4DAA4D;AAC5D,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO/F;AAED,2BAA2B;AAC3B,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAED,6CAA6C;AAC7C,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/E"}
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../src/push.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,GAAG,CAAC,EAAE,SAAS,CAAA;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9C;AAsBD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CA4CpE;AAED,wEAAwE;AACxE,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,iFAAiF;AACjF,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAKhD;AAED,4DAA4D;AAC5D,wBAAgB,kBAAkB,IAAI,aAAa,CAElD;AAmSD,4DAA4D;AAC5D,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO/F;AAED,2BAA2B;AAC3B,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAED,6CAA6C;AAC7C,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/E"}

package/dist/push.js

@@ -1,10 +1,15 @@
 /**
- * Push notification delivery via APNs HTTP/2.
+ * Push notification delivery via APNs HTTP/2 and FCM HTTP v1.
  *
  * Provides `push.send()` for use in on-commit hook context. Looks up device
- * tokens, builds APNs payloads, and sends via HTTP/2. Self-cleans invalid
- * tokens on Apple 410 responses. Fire-and-forget — failures are logged via
+ * tokens, builds a payload per platform, and sends over the transport that
+ * platform's tokens belong to. Self-cleans tokens the vendor reports as dead —
+ * Apple's 410, Google's UNREGISTERED. Fire-and-forget — failures are logged via
  * `emit()` but never throw.
+ *
+ * Either transport can be configured alone. A deployment with only an APNs key
+ * still sends to iOS, and Android tokens simply sit unused until an FCM service
+ * account is supplied.
  */
 import { connect } from 'node:http2';
 import { readFileSync } from 'node:fs';
@@ -16,21 +21,71 @@ let pushConfig = null;
 let apnsKey = null;
 let cachedJwt = null;
 let http2Session = null;
-/** Initialize push with config. Must be called before send(). */
+let fcmCredentials = null;
+let cachedFcmToken = null;
+/** Where a service account trades its signed JWT for a bearer token. */
+const GOOGLE_TOKEN_URI = 'https://oauth2.googleapis.com/token';
+/** The only scope FCM sending needs. */
+const FCM_SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';
+/**
+ * Initialize push with config. Must be called before send().
+ *
+ * Each transport is loaded on its own: a missing or malformed credential
+ * disables that platform and leaves the other one sending, rather than taking
+ * push down entirely.
+ */
 export function initPush(config, configDir) {
     pushConfig = config;
-    const keyPath = resolve(configDir, config.apns.keyFile);
-    try {
-        apnsKey = readFileSync(keyPath, 'utf8');
+    apnsKey = null;
+    fcmCredentials = null;
+    cachedJwt = null;
+    cachedFcmToken = null;
+    if (config.apns) {
+        const keyPath = resolve(configDir, config.apns.keyFile);
+        try {
+            apnsKey = readFileSync(keyPath, 'utf8');
+        }
+        catch {
+            emit('push', 'init_error', { transport: 'apns', error: `APNs key file not found: ${keyPath}` });
+        }
     }
-    catch {
-        emit('push', 'init_error', { error: `APNs key file not found: ${keyPath}` });
-        pushConfig = null;
+    if (config.fcm) {
+        const keyPath = resolve(configDir, config.fcm.keyFile);
+        try {
+            const account = JSON.parse(readFileSync(keyPath, 'utf8'));
+            const projectId = config.fcm.projectId ?? account.project_id;
+            if (!account.client_email || !account.private_key || !projectId) {
+                throw new Error('needs client_email, private_key and a project id');
+            }
+            fcmCredentials = {
+                clientEmail: account.client_email,
+                privateKey: account.private_key,
+                projectId,
+                tokenUri: account.token_uri ?? GOOGLE_TOKEN_URI,
+            };
+        }
+        catch (err) {
+            emit('push', 'init_error', {
+                transport: 'fcm',
+                error: `FCM service account unusable (${keyPath}): ${err.message}`,
+            });
+        }
     }
+    if (!apnsKey && !fcmCredentials)
+        pushConfig = null;
 }
-/** Check if push is configured and available. */
+/** Check if push is configured and at least one transport is usable. */
 export function isPushEnabled() {
-    return pushConfig !== null && apnsKey !== null;
+    return pushConfig !== null && (apnsKey !== null || fcmCredentials !== null);
+}
+/** Which platforms this process can actually deliver to, for startup logging. */
+export function enabledPushTransports() {
+    const transports = [];
+    if (apnsKey)
+        transports.push('apns');
+    if (fcmCredentials)
+        transports.push('fcm');
+    return transports;
 }
 /** Build the push interface injected into hook contexts. */
 export function buildPushInterface() {
@@ -40,15 +95,16 @@ export function buildPushInterface() {
 function getApnsJwt() {
     if (cachedJwt && Date.now() < cachedJwt.expires)
         return cachedJwt.token;
-    if (!pushConfig || !apnsKey)
-        throw new Error('Push not initialized');
+    const apns = pushConfig?.apns;
+    if (!apns || !apnsKey)
+        throw new Error('APNs not initialized');
     const header = Buffer.from(JSON.stringify({
         alg: 'ES256',
-        kid: pushConfig.apns.keyId,
+        kid: apns.keyId,
     })).toString('base64url');
     const now = Math.floor(Date.now() / 1000);
     const claims = Buffer.from(JSON.stringify({
-        iss: pushConfig.apns.teamId,
+        iss: apns.teamId,
         iat: now,
     })).toString('base64url');
     const signer = createSign('SHA256');
@@ -63,7 +119,7 @@ function getHttp2Session() {
     if (http2Session && !http2Session.closed && !http2Session.destroyed) {
         return http2Session;
     }
-    const host = pushConfig?.apns.production !== false ? 'https://api.push.apple.com' : 'https://api.sandbox.push.apple.com';
+    const host = pushConfig?.apns?.production !== false ? 'https://api.push.apple.com' : 'https://api.sandbox.push.apple.com';
     emit('push', 'connecting', { host });
     http2Session = connect(host, {
         peerMaxConcurrentStreams: 100,
@@ -82,41 +138,60 @@ function getHttp2Session() {
 }
 /** Send a push notification to all devices registered for a DID. */
 async function send(payload) {
-    if (!pushConfig || !apnsKey)
+    if (!isPushEnabled())
         return;
     const tokens = (await querySQL(`SELECT token, platform FROM _push_tokens WHERE did = $1`, [payload.did]));
     if (tokens.length === 0)
         return;
-    const jwt = getApnsJwt();
-    const aps = {
-        alert: { title: payload.title, body: payload.body },
-        sound: 'default',
-        // Run the client's notification service extension before the alert is
-        // shown, so it can enrich the payload (Grain attaches the actor's avatar
-        // from `data.avatar`). Ignored by clients that don't ship one.
-        'mutable-content': 1,
-    };
-    if (payload.badge !== undefined) {
-        aps.badge = payload.badge;
+    // A device is reachable over exactly one transport, named by the platform it
+    // registered under. An unrecognized platform is left alone rather than
+    // guessed at — the row may belong to a client this build doesn't serve yet.
+    const apnsTokens = tokens.filter((t) => t.platform === 'apns');
+    const fcmTokens = tokens.filter((t) => t.platform === 'fcm');
+    if (apnsKey && apnsTokens.length > 0) {
+        const jwt = getApnsJwt();
+        const aps = {
+            alert: { title: payload.title, body: payload.body },
+            sound: 'default',
+        };
+        if (payload.badge !== undefined) {
+            aps.badge = payload.badge;
+        }
+        const apnsPayload = JSON.stringify({
+            aps,
+            ...(payload.data || {}),
+        });
+        for (const { token } of apnsTokens) {
+            sendToApns(token, apnsPayload, jwt, payload).catch(() => { });
+        }
     }
-    const apnsPayload = JSON.stringify({
-        aps,
-        ...(payload.data || {}),
-    });
-    for (const { token, platform } of tokens) {
-        if (platform !== 'apns')
-            continue;
-        sendToApns(token, apnsPayload, jwt, payload).catch(() => { });
+    if (fcmCredentials && fcmTokens.length > 0) {
+        // One access token serves every device in this fan-out; it's minted once
+        // and cached for the hour Google grants it.
+        let accessToken;
+        try {
+            accessToken = await getFcmAccessToken();
+        }
+        catch (err) {
+            emit('push', 'send_error', { did: payload.did, transport: 'fcm', error: err.message });
+            return;
+        }
+        for (const { token } of fcmTokens) {
+            sendToFcm(token, accessToken, payload).catch(() => { });
+        }
     }
 }
 /** Send a single APNs push and handle the response. */
 async function sendToApns(token, payload, jwt, original) {
+    const apns = pushConfig?.apns;
+    if (!apns)
+        return;
     const session = getHttp2Session();
     const headers = {
         ':method': 'POST',
         ':path': `/3/device/${token}`,
         authorization: `bearer ${jwt}`,
-        'apns-topic': pushConfig.apns.bundleId,
+        'apns-topic': apns.bundleId,
         'apns-push-type': 'alert',
     };
     if (original.collapseId) {
@@ -174,6 +249,108 @@ async function sendToApns(token, payload, jwt, original) {
         req.end();
     });
 }
+/**
+ * Mint an OAuth2 access token for the FCM HTTP v1 API.
+ *
+ * The service account signs a JWT asserting the messaging scope, and Google
+ * trades it for a bearer token good for an hour. Cached with a minute of
+ * headroom so one can't expire between minting and the send that uses it.
+ */
+async function getFcmAccessToken() {
+    if (cachedFcmToken && Date.now() < cachedFcmToken.expires)
+        return cachedFcmToken.token;
+    if (!fcmCredentials)
+        throw new Error('FCM not initialized');
+    const now = Math.floor(Date.now() / 1000);
+    const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');
+    const claims = Buffer.from(JSON.stringify({
+        iss: fcmCredentials.clientEmail,
+        scope: FCM_SCOPE,
+        aud: fcmCredentials.tokenUri,
+        iat: now,
+        exp: now + 3600,
+    })).toString('base64url');
+    const signer = createSign('RSA-SHA256');
+    signer.update(`${header}.${claims}`);
+    const assertion = `${header}.${claims}.${signer.sign(fcmCredentials.privateKey, 'base64url')}`;
+    const res = await fetch(fcmCredentials.tokenUri, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+            assertion,
+        }),
+        signal: AbortSignal.timeout(15_000),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        throw new Error(`FCM token exchange failed: ${res.status} ${body.slice(0, 200)}`);
+    }
+    const granted = (await res.json());
+    if (!granted.access_token)
+        throw new Error('FCM token exchange returned no access_token');
+    cachedFcmToken = {
+        token: granted.access_token,
+        expires: Date.now() + ((granted.expires_in ?? 3600) - 60) * 1000,
+    };
+    return cachedFcmToken.token;
+}
+/** Send a single FCM push and handle the response. */
+async function sendToFcm(token, accessToken, original) {
+    // Data-only, deliberately: a `notification` block has the Android SDK draw
+    // the alert itself while the app is backgrounded, which skips the client's
+    // handler and with it the tap destination it derives from `type` and `uri`.
+    // FCM only carries strings in `data`, so everything is sent as one.
+    const data = { title: original.title, body: original.body };
+    for (const [key, value] of Object.entries(original.data ?? {})) {
+        data[key] = String(value);
+    }
+    const message = {
+        token,
+        data,
+        android: {
+            // Data-only messages are "normal" priority by default, which lets Doze
+            // hold one until the device next wakes. These are alerts somebody is
+            // waiting on, so they go high, the way APNs alert pushes do.
+            priority: 'HIGH',
+            ...(original.collapseId ? { collapse_key: original.collapseId } : {}),
+        },
+        // `badge` has no FCM equivalent — an Android launcher badges from the
+        // notification the client posts, not from the payload.
+    };
+    const res = await fetch(`https://fcm.googleapis.com/v1/projects/${fcmCredentials.projectId}/messages:send`, {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${accessToken}`,
+            'content-type': 'application/json',
+        },
+        body: JSON.stringify({ message }),
+        signal: AbortSignal.timeout(15_000),
+    });
+    if (res.ok) {
+        emit('push', 'sent', { did: original.did, transport: 'fcm', token: token.slice(0, 8) + '...' });
+        return;
+    }
+    const body = await res.text().catch(() => '');
+    // Google's word for a token that no longer belongs to an install — the same
+    // fact Apple reports as a 410.
+    if (res.status === 404 || body.includes('UNREGISTERED')) {
+        await removeToken(token).catch(() => { });
+        emit('push', 'token_removed', { did: original.did, transport: 'fcm', reason: 'unregistered' });
+        return;
+    }
+    // The bearer token was refused: drop it so the next send mints a fresh one
+    // rather than replaying a credential Google has already rejected.
+    if (res.status === 401 || res.status === 403) {
+        cachedFcmToken = null;
+    }
+    emit('push', 'send_error', {
+        did: original.did,
+        transport: 'fcm',
+        status: res.status,
+        body: body.slice(0, 200),
+    });
+}
 /** Register a push token for a DID. Upserts on conflict. */
 export async function registerToken(did, token, platform) {
     await runSQL(`INSERT INTO _push_tokens (did, token, platform, created_at)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hatk/hatk",
-  "version": "0.0.1-alpha.78",
+  "version": "0.0.1-alpha.79",
   "license": "MIT",
   "bin": {
     "hatk": "dist/cli.js"