@hyperdrive.bot/paseo-server 0.2.6

package/dist/server/server/push/push-service.js

@@ -0,0 +1,66 @@
+const EXPO_PUSH_URL = "https://exp.host/--/api/v2/push/send";
+const MAX_BATCH_SIZE = 100;
+/**
+ * Service for sending Expo push notifications.
+ * Handles batching and invalid token removal.
+ */
+export class PushService {
+    constructor(logger, tokenStore) {
+        this.logger = logger.child({ component: "push-service" });
+        this.tokenStore = tokenStore;
+    }
+    async sendPush(tokens, payload) {
+        if (tokens.length === 0) {
+            return;
+        }
+        const messages = tokens.map((token) => ({
+            to: token,
+            title: payload.title,
+            body: payload.body,
+            data: payload.data,
+            sound: "default",
+        }));
+        // Batch tokens (max 100 per request per Expo limits)
+        const batches = [];
+        for (let i = 0; i < messages.length; i += MAX_BATCH_SIZE) {
+            batches.push(messages.slice(i, i + MAX_BATCH_SIZE));
+        }
+        await Promise.all(batches.map((batch) => this.sendBatch(batch)));
+    }
+    async sendBatch(messages) {
+        try {
+            const response = await fetch(EXPO_PUSH_URL, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    Accept: "application/json",
+                },
+                body: JSON.stringify(messages),
+            });
+            if (!response.ok) {
+                this.logger.error({ status: response.status, statusText: response.statusText }, "Expo push API error");
+                return;
+            }
+            const result = (await response.json());
+            this.handleTickets(messages, result.data);
+        }
+        catch (error) {
+            this.logger.error({ err: error }, "Failed to send push notifications");
+        }
+    }
+    handleTickets(messages, tickets) {
+        for (let i = 0; i < tickets.length; i++) {
+            const ticket = tickets[i];
+            const message = messages[i];
+            if (ticket.status === "error") {
+                this.logger.error({ token: message.to, message: ticket.message, details: ticket.details }, "Push failed for token");
+                // Remove invalid tokens
+                if (ticket.details?.error === "DeviceNotRegistered" ||
+                    ticket.details?.error === "InvalidCredentials") {
+                    this.tokenStore.removeToken(message.to);
+                }
+            }
+        }
+    }
+}
+//# sourceMappingURL=push-service.js.map

package/dist/server/server/push/routes.d.ts

@@ -0,0 +1,28 @@
+import type express from "express";
+import type pino from "pino";
+import type { PushSubscription, PushSubscriptionStore } from "./subscriptions.js";
+/**
+ * Registers `POST /push/subscribe` on the daemon's Express app.
+ *
+ * Story PASEO-CHAT-ACTIONS-V1-story-1.002. Loopback-bound, no auth (single-user
+ * trust model — see Architectural Notes in the story). Accepts either an Expo
+ * push token or a W3C Web Push subscription, persists it via the provided
+ * {@link PushSubscriptionStore} (idempotent), and returns `{ ok: true }`.
+ */
+export interface RegisterPushRoutesOptions {
+    /**
+     * Story 1.4 — VAPID public key exposed via `GET /push/vapid-public-key`.
+     * Optional so legacy callers (story 1.2 only) keep compiling; when omitted,
+     * the GET endpoint is not registered.
+     */
+    vapidPublicKey?: string;
+}
+export declare function registerPushRoutes(app: express.Express, store: PushSubscriptionStore, logger: pino.Logger, options?: RegisterPushRoutesOptions): void;
+type ValidationResult = {
+    subscription: PushSubscription;
+} | {
+    error: string;
+};
+export declare function validateSubscribeBody(body: unknown): ValidationResult;
+export {};
+//# sourceMappingURL=routes.d.ts.map

package/dist/server/server/push/routes.js

@@ -0,0 +1,74 @@
+export function registerPushRoutes(app, store, logger, options = {}) {
+    const routeLogger = logger.child({ component: "push-routes" });
+    if (options.vapidPublicKey) {
+        const publicKey = options.vapidPublicKey;
+        app.get("/push/vapid-public-key", (_req, res) => {
+            res.status(200).json({ publicKey });
+        });
+        routeLogger.info("Registered GET /push/vapid-public-key");
+    }
+    app.post("/push/subscribe", (req, res) => {
+        const body = req.body;
+        const parsed = validateSubscribeBody(body);
+        if ("error" in parsed) {
+            res.status(400).json({ error: parsed.error });
+            return;
+        }
+        try {
+            store.upsert(parsed.subscription);
+        }
+        catch (err) {
+            routeLogger.error({ err }, "Failed to persist push subscription");
+            res.status(500).json({ error: "failed to persist subscription" });
+            return;
+        }
+        res.status(200).json({ ok: true });
+    });
+    routeLogger.info("Registered POST /push/subscribe");
+}
+export function validateSubscribeBody(body) {
+    if (!body || typeof body !== "object") {
+        return { error: "invalid json" };
+    }
+    const b = body;
+    if (b.type !== "expo" && b.type !== "web") {
+        return { error: "invalid type" };
+    }
+    if (b.type === "expo") {
+        if (typeof b.token !== "string" || b.token.length === 0) {
+            return { error: "missing token" };
+        }
+        return { subscription: { type: "expo", token: b.token } };
+    }
+    // type === "web"
+    const sub = b.subscription;
+    if (!sub || typeof sub !== "object") {
+        return { error: "missing subscription" };
+    }
+    if (typeof sub.endpoint !== "string" || sub.endpoint.length === 0) {
+        return { error: "missing subscription.endpoint" };
+    }
+    const keys = sub.keys;
+    if (!keys || typeof keys !== "object") {
+        return { error: "missing subscription.keys" };
+    }
+    if (typeof keys.p256dh !== "string" || keys.p256dh.length === 0) {
+        return { error: "missing subscription.keys.p256dh" };
+    }
+    if (typeof keys.auth !== "string" || keys.auth.length === 0) {
+        return { error: "missing subscription.keys.auth" };
+    }
+    return {
+        subscription: {
+            type: "web",
+            subscription: {
+                endpoint: sub.endpoint,
+                keys: { p256dh: keys.p256dh, auth: keys.auth },
+                expirationTime: typeof sub.expirationTime === "number" || sub.expirationTime === null
+                    ? sub.expirationTime
+                    : undefined,
+            },
+        },
+    };
+}
+//# sourceMappingURL=routes.js.map

package/dist/server/server/push/subscriptions.d.ts

@@ -0,0 +1,42 @@
+import type pino from "pino";
+export interface WebPushSubscriptionJSON {
+    endpoint: string;
+    keys: {
+        p256dh: string;
+        auth: string;
+    };
+    expirationTime?: number | null;
+}
+export interface ExpoSubscription {
+    type: "expo";
+    token: string;
+}
+export interface WebSubscription {
+    type: "web";
+    subscription: WebPushSubscriptionJSON;
+}
+export type PushSubscription = ExpoSubscription | WebSubscription;
+/**
+ * Persistence store for push delivery subscriptions (Expo + Web Push).
+ *
+ * Story PASEO-CHAT-ACTIONS-V1-story-1.002: file is `$PASEO_HOME/push-subscriptions.json`,
+ * persisted with mode 0600 (subscriptions are credential-equivalent — a leaked
+ * Expo token or Web Push endpoint lets an attacker spam the user). Idempotent
+ * on dedup key: `token` for expo, `subscription.endpoint` for web.
+ *
+ * Mirrors the read/write idiom used by {@link PushTokenStore} (write-temp-then-rename).
+ */
+export declare class PushSubscriptionStore {
+    private readonly logger;
+    private readonly filePath;
+    private subs;
+    constructor(logger: pino.Logger, filePath: string);
+    upsert(sub: PushSubscription): void;
+    list(): PushSubscription[];
+    listExpoTokens(): string[];
+    removeExpoToken(token: string): void;
+    removeWebSubscription(endpoint: string): void;
+    private loadFromDisk;
+    private persist;
+}
+//# sourceMappingURL=subscriptions.d.ts.map

package/dist/server/server/push/subscriptions.js

@@ -0,0 +1,112 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+/**
+ * Persistence store for push delivery subscriptions (Expo + Web Push).
+ *
+ * Story PASEO-CHAT-ACTIONS-V1-story-1.002: file is `$PASEO_HOME/push-subscriptions.json`,
+ * persisted with mode 0600 (subscriptions are credential-equivalent — a leaked
+ * Expo token or Web Push endpoint lets an attacker spam the user). Idempotent
+ * on dedup key: `token` for expo, `subscription.endpoint` for web.
+ *
+ * Mirrors the read/write idiom used by {@link PushTokenStore} (write-temp-then-rename).
+ */
+export class PushSubscriptionStore {
+    constructor(logger, filePath) {
+        this.subs = [];
+        this.logger = logger.child({ component: "push-subscription-store" });
+        this.filePath = filePath;
+        this.loadFromDisk();
+    }
+    upsert(sub) {
+        const key = dedupKey(sub);
+        const idx = this.subs.findIndex((s) => dedupKey(s) === key);
+        if (idx >= 0) {
+            this.subs[idx] = sub;
+        }
+        else {
+            this.subs.push(sub);
+        }
+        this.persist();
+        this.logger.debug({ total: this.subs.length, type: sub.type }, "Upserted subscription");
+    }
+    list() {
+        return this.subs.slice();
+    }
+    listExpoTokens() {
+        return this.subs.filter((s) => s.type === "expo").map((s) => s.token);
+    }
+    removeExpoToken(token) {
+        const before = this.subs.length;
+        this.subs = this.subs.filter((s) => !(s.type === "expo" && s.token === token));
+        if (this.subs.length === before)
+            return;
+        this.persist();
+        this.logger.debug({ total: this.subs.length }, "Removed expo subscription");
+    }
+    removeWebSubscription(endpoint) {
+        const before = this.subs.length;
+        this.subs = this.subs.filter((s) => !(s.type === "web" && s.subscription.endpoint === endpoint));
+        if (this.subs.length === before)
+            return;
+        this.persist();
+        this.logger.debug({ total: this.subs.length }, "Removed web subscription");
+    }
+    loadFromDisk() {
+        try {
+            if (!existsSync(this.filePath))
+                return;
+            const raw = readFileSync(this.filePath, "utf-8");
+            const parsed = JSON.parse(raw);
+            if (!Array.isArray(parsed)) {
+                this.logger.warn("push-subscriptions.json is not an array — ignoring");
+                return;
+            }
+            this.subs = parsed.filter(isPushSubscription);
+            this.logger.info({ total: this.subs.length }, "Loaded push subscriptions");
+        }
+        catch (error) {
+            const err = error instanceof Error ? error : new Error(String(error));
+            this.logger.warn({ err }, "Failed to load push subscriptions");
+            this.subs = [];
+        }
+    }
+    persist() {
+        try {
+            mkdirSync(dirname(this.filePath), { recursive: true });
+            const tmpPath = `${this.filePath}.tmp`;
+            const payload = JSON.stringify(this.subs, null, 2) + "\n";
+            writeFileSync(tmpPath, payload, { mode: 0o600 });
+            renameSync(tmpPath, this.filePath);
+            // Enforce 0600 on the live file too (rename preserves source mode, but be defensive).
+            chmodSync(this.filePath, 0o600);
+        }
+        catch (error) {
+            const err = error instanceof Error ? error : new Error(String(error));
+            this.logger.warn({ err }, "Failed to persist push subscriptions");
+        }
+    }
+}
+function dedupKey(sub) {
+    return sub.type === "expo" ? `expo:${sub.token}` : `web:${sub.subscription.endpoint}`;
+}
+function isPushSubscription(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    if (v.type === "expo") {
+        return typeof v.token === "string" && v.token.length > 0;
+    }
+    if (v.type === "web") {
+        const s = v.subscription;
+        if (!s || typeof s !== "object")
+            return false;
+        if (typeof s.endpoint !== "string" || s.endpoint.length === 0)
+            return false;
+        const k = s.keys;
+        if (!k || typeof k !== "object")
+            return false;
+        return typeof k.p256dh === "string" && typeof k.auth === "string";
+    }
+    return false;
+}
+//# sourceMappingURL=subscriptions.js.map

package/dist/server/server/push/token-store.d.ts

@@ -0,0 +1,29 @@
+import type pino from "pino";
+/**
+ * Store for Expo push tokens.
+ *
+ * Tokens are persisted to disk so pushes still work after daemon restarts.
+ */
+export interface PushTokenStoreSink {
+    /** Called whenever a token is successfully added. Errors are swallowed. */
+    onTokenAdded?: (token: string) => void;
+}
+export declare class PushTokenStore {
+    private readonly logger;
+    private tokens;
+    private readonly filePath;
+    private sink;
+    constructor(logger: pino.Logger, filePath: string);
+    /**
+     * Attach an optional sink that gets notified on each successful addToken.
+     * Used by bootstrap to bridge legacy WebSocket-registered Expo tokens into
+     * the new PushSubscriptionStore the Expo worker (Story 1.3) reads from.
+     */
+    setSink(sink: PushTokenStoreSink | null): void;
+    addToken(token: string): void;
+    removeToken(token: string): void;
+    getAllTokens(): string[];
+    private loadFromDisk;
+    private persist;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/dist/server/server/push/token-store.js

@@ -0,0 +1,78 @@
+import { existsSync, readFileSync } from "node:fs";
+import { ensurePrivateFile, writePrivateFileAtomicSync } from "../private-files.js";
+export class PushTokenStore {
+    constructor(logger, filePath) {
+        this.tokens = new Set();
+        this.sink = null;
+        this.logger = logger.child({ component: "token-store" });
+        this.filePath = filePath;
+        this.loadFromDisk();
+    }
+    /**
+     * Attach an optional sink that gets notified on each successful addToken.
+     * Used by bootstrap to bridge legacy WebSocket-registered Expo tokens into
+     * the new PushSubscriptionStore the Expo worker (Story 1.3) reads from.
+     */
+    setSink(sink) {
+        this.sink = sink;
+    }
+    addToken(token) {
+        const normalized = token.trim();
+        if (!normalized)
+            return;
+        if (this.tokens.has(normalized))
+            return;
+        this.tokens.add(normalized);
+        this.persist();
+        this.logger.debug({ total: this.tokens.size }, "Added token");
+        try {
+            this.sink?.onTokenAdded?.(normalized);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "push-token-store sink threw");
+        }
+    }
+    removeToken(token) {
+        const normalized = token.trim();
+        if (!normalized)
+            return;
+        const deleted = this.tokens.delete(normalized);
+        if (deleted) {
+            this.persist();
+            this.logger.debug({ total: this.tokens.size }, "Removed token");
+        }
+    }
+    getAllTokens() {
+        return Array.from(this.tokens);
+    }
+    loadFromDisk() {
+        try {
+            if (!existsSync(this.filePath)) {
+                return;
+            }
+            ensurePrivateFile(this.filePath);
+            const raw = readFileSync(this.filePath, "utf-8");
+            const parsed = JSON.parse(raw);
+            const tokens = Array.isArray(parsed.tokens)
+                ? parsed.tokens.filter((t) => typeof t === "string" && t.trim().length > 0)
+                : [];
+            this.tokens = new Set(tokens.map((t) => t.trim()));
+            this.logger.info({ total: this.tokens.size }, "Loaded push tokens");
+        }
+        catch (error) {
+            const err = error instanceof Error ? error : new Error(String(error));
+            this.logger.warn({ err }, "Failed to load push tokens");
+        }
+    }
+    persist() {
+        try {
+            const payload = JSON.stringify({ tokens: Array.from(this.tokens) }, null, 2) + "\n";
+            writePrivateFileAtomicSync(this.filePath, payload);
+        }
+        catch (error) {
+            const err = error instanceof Error ? error : new Error(String(error));
+            this.logger.warn({ err }, "Failed to persist push tokens");
+        }
+    }
+}
+//# sourceMappingURL=token-store.js.map

package/dist/server/server/push/triggers.d.ts

@@ -0,0 +1,68 @@
+import type { Logger } from "pino";
+import type { AgentAttentionCallback, AgentManager } from "../agent/agent-manager.js";
+import type { AgentAttentionReason } from "@hyperdrive.bot/paseo-protocol/agent-attention-notification";
+export type PushTriggerKind = "completed" | "permission_needed" | "input_required";
+export interface PushTriggerPayload {
+    agentId: string;
+    agentTitle: string;
+    kind: PushTriggerKind;
+    sessionId: string;
+    /** Mobile / native scheme — `paseo://agent/{sessionId}`. */
+    deepLink: string;
+    /**
+     * Web-shell equivalent of {@link deepLink}, used by the service worker's
+     * `notificationclick` handler (Story 1.5). Browsers cannot
+     * `clients.openWindow()` a custom-scheme URL, so we ship both.
+     */
+    webPath: string;
+    /**
+     * Origin daemon's serverId — lets the mobile resolver short-circuit the
+     * sessionId → host lookup when the device is paired with multiple daemons
+     * (Story 1.5).
+     */
+    serverId: string;
+    reason: AgentAttentionReason;
+    timestamp: string;
+    /**
+     * D.1 (FR4.1) — for `permission_needed` triggers, the id of the pending
+     * permission request the Lock-Screen Approve/Reject actions resolve. Optional
+     * + additive: absent for non-permission kinds and tolerated by older clients
+     * (NFR1). Derived from the agent's latest pending permission at emit time.
+     */
+    requestId?: string;
+}
+export interface PushTriggerEmitter {
+    /**
+     * Register a subscriber for `pushTrigger` events. Returns an unsubscribe function.
+     */
+    on(listener: (payload: PushTriggerPayload) => void): () => void;
+    /**
+     * Wire the emitter into the AgentManager attention bus. Returns an unsubscribe handle.
+     * Safe to call multiple times — each call returns its own unsubscribe.
+     */
+    subscribeToAttention(): () => void;
+    /**
+     * Number of registered `pushTrigger` listeners. Test helper.
+     */
+    listenerCount(): number;
+    /**
+     * Manually fire the underlying attention callback. Test helper — production code
+     * should rely on {@link subscribeToAttention}.
+     */
+    readonly attentionCallback: AgentAttentionCallback;
+}
+export interface CreatePushTriggerEmitterOptions {
+    agentManager: Pick<AgentManager, "getAgent" | "addAgentAttentionListener">;
+    serverId: string;
+    logger: Logger;
+    /**
+     * Override for `process.env.PASEO_PUSH_ENABLED`. Used in tests.
+     */
+    pushEnabledOverride?: string;
+    /**
+     * Override clock. Used in tests for deterministic timestamps.
+     */
+    now?: () => Date;
+}
+export declare function createPushTriggerEmitter(options: CreatePushTriggerEmitterOptions): PushTriggerEmitter;
+//# sourceMappingURL=triggers.d.ts.map

package/dist/server/server/push/triggers.js

@@ -0,0 +1,103 @@
+import { EventEmitter } from "node:events";
+const PUSH_TRIGGER_EVENT = "pushTrigger";
+/**
+ * Map the daemon's existing attention vocabulary onto the push trigger vocabulary.
+ *
+ * Per Story PASEO-CHAT-ACTIONS-V1-story-1.001 AC2:
+ *  - `finished`   → `completed`
+ *  - `permission` → `permission_needed`
+ *  - `error`      → NOT emitted (errors are in-app only per agent-attention-policy.ts)
+ *
+ * `input_required` is reserved for a future daemon signal so that Story 1.5
+ * (deep-link routing) can target it without re-touching this file. There is
+ * currently no `AgentAttentionReason` value that produces it.
+ */
+function mapReasonToKind(reason) {
+    if (reason === "finished") {
+        return "completed";
+    }
+    if (reason === "permission") {
+        return "permission_needed";
+    }
+    // `error` is dropped — surfaced in-app per the existing notification plan.
+    return null;
+}
+export function createPushTriggerEmitter(options) {
+    const { agentManager, logger, now } = options;
+    const triggerLogger = logger.child({ module: "push", component: "trigger-emitter" });
+    const clock = now ?? (() => new Date());
+    const pushEnabledRaw = options.pushEnabledOverride ?? process.env.PASEO_PUSH_ENABLED;
+    const pushDisabled = pushEnabledRaw === "false";
+    if (pushDisabled) {
+        triggerLogger.info({ serverId: options.serverId }, "PASEO_PUSH_ENABLED=false — push trigger emitter is dormant");
+    }
+    const bus = new EventEmitter();
+    function emitTrigger(payload) {
+        bus.emit(PUSH_TRIGGER_EVENT, payload);
+    }
+    const attentionCallback = (params) => {
+        const kind = mapReasonToKind(params.reason);
+        if (kind === null) {
+            triggerLogger.debug({ agentId: params.agentId, reason: params.reason }, "Attention reason dropped — not a push-eligible kind");
+            return;
+        }
+        const agent = agentManager.getAgent(params.agentId);
+        if (!agent) {
+            // Race: agent was deleted between callback and lookup. Don't emit.
+            triggerLogger.warn({ agentId: params.agentId, reason: params.reason }, "Push trigger skipped — agent not found in manager (likely deleted)");
+            return;
+        }
+        // paseo's agent identifier IS the session identifier — agent state lives at
+        // $PASEO_HOME/agents/{cwd-with-dashes}/{agent-id}.json and the mobile Kanban
+        // card is keyed by agentId. Story 1.5 deep-links land on `paseo://agent/{id}`.
+        const sessionId = agent.id;
+        const agentTitle = agent.config.title ?? agent.id;
+        // D.1 — for a permission trigger, attach the latest pending permission's id
+        // (the map key IS the requestId) so the device can resolve it from the
+        // Lock-Screen action without live session state. Best-effort: undefined if
+        // the pending set raced empty.
+        let requestId;
+        if (kind === "permission_needed") {
+            for (const key of agent.pendingPermissions?.keys() ?? []) {
+                requestId = key;
+            }
+        }
+        const payload = {
+            agentId: agent.id,
+            agentTitle,
+            kind,
+            sessionId,
+            deepLink: `paseo://agent/${sessionId}`,
+            webPath: `/agent/${sessionId}`,
+            serverId: options.serverId,
+            reason: params.reason,
+            timestamp: clock().toISOString(),
+            ...(requestId ? { requestId } : {}),
+        };
+        emitTrigger(payload);
+    };
+    function subscribeToAttention() {
+        if (pushDisabled) {
+            // Kill-switch: do not register the listener at all so downstream workers
+            // (Stories 1.3/1.4) inherit the disable without touching the env var.
+            return () => { };
+        }
+        return agentManager.addAgentAttentionListener(attentionCallback);
+    }
+    function on(listener) {
+        bus.on(PUSH_TRIGGER_EVENT, listener);
+        return () => {
+            bus.off(PUSH_TRIGGER_EVENT, listener);
+        };
+    }
+    function listenerCount() {
+        return bus.listenerCount(PUSH_TRIGGER_EVENT);
+    }
+    return {
+        on,
+        subscribeToAttention,
+        listenerCount,
+        attentionCallback,
+    };
+}
+//# sourceMappingURL=triggers.js.map

package/dist/server/server/push/vapid-keys.d.ts

@@ -0,0 +1,15 @@
+import type pino from "pino";
+/**
+ * Story PASEO-CHAT-ACTIONS-V1-story-1.004 — VAPID key pair persistence.
+ *
+ * On first daemon start the key pair is generated and written to disk with
+ * mode 0600; subsequent reads reuse the persisted material. Single-user trust
+ * model — the daemon is loopback-bound, the file lives under `$PASEO_HOME`.
+ */
+export interface VapidKeys {
+    publicKey: string;
+    privateKey: string;
+    subject: string;
+}
+export declare function loadOrGenerateVapidKeys(filePath: string, logger?: pino.Logger): VapidKeys;
+//# sourceMappingURL=vapid-keys.d.ts.map

package/dist/server/server/push/vapid-keys.js

@@ -0,0 +1,52 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import webpush from "web-push";
+const DEFAULT_SUBJECT = "mailto:paseo@local";
+export function loadOrGenerateVapidKeys(filePath, logger) {
+    const persisted = readPersistedKeys(filePath);
+    if (persisted) {
+        return {
+            publicKey: persisted.publicKey,
+            privateKey: persisted.privateKey,
+            subject: persisted.subject ?? DEFAULT_SUBJECT,
+        };
+    }
+    const generated = webpush.generateVAPIDKeys();
+    const keys = {
+        publicKey: generated.publicKey,
+        privateKey: generated.privateKey,
+        subject: DEFAULT_SUBJECT,
+    };
+    writeKeys(filePath, keys);
+    logger?.info({ filePath }, "Generated new VAPID key pair");
+    return keys;
+}
+function readPersistedKeys(filePath) {
+    if (!existsSync(filePath))
+        return null;
+    try {
+        const raw = readFileSync(filePath, "utf-8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.publicKey !== "string" || parsed.publicKey.length === 0)
+            return null;
+        if (typeof parsed.privateKey !== "string" || parsed.privateKey.length === 0)
+            return null;
+        return {
+            publicKey: parsed.publicKey,
+            privateKey: parsed.privateKey,
+            subject: typeof parsed.subject === "string" ? parsed.subject : undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function writeKeys(filePath, keys) {
+    mkdirSync(dirname(filePath), { recursive: true });
+    const tmpPath = `${filePath}.tmp`;
+    const payload = JSON.stringify({ ...keys }, null, 2) + "\n";
+    writeFileSync(tmpPath, payload, { mode: 0o600 });
+    renameSync(tmpPath, filePath);
+    chmodSync(filePath, 0o600);
+}
+//# sourceMappingURL=vapid-keys.js.map