@meshwhisper/push-service 0.1.0

package/dist/apns.js

@@ -0,0 +1,111 @@
+// ============================================================
+// APNs dispatch
+// Uses the HTTP/2 APNs provider API with a .p8 auth key.
+//
+// Required env vars:
+//   APNS_KEY_ID      — 10-char key ID from Apple Developer Portal
+//   APNS_TEAM_ID     — 10-char team ID from Apple Developer Portal
+//   APNS_KEY_PATH    — path to the .p8 private key file
+//   APNS_BUNDLE_ID   — app bundle ID (used as topic if not provided per-push)
+//   APNS_PRODUCTION  — set to "true" for production, omit for sandbox
+// ============================================================
+import * as http2 from 'node:http2';
+import * as fs from 'node:fs';
+import * as crypto from 'node:crypto';
+const APNS_HOST_SANDBOX = 'api.sandbox.push.apple.com';
+const APNS_HOST_PRODUCTION = 'api.push.apple.com';
+// ---- JWT token generation ----
+let cachedToken = null;
+function generateApnsJwt(keyId, teamId, privateKeyPem) {
+    // Reuse the token for up to 55 minutes (APNs tokens expire after 60)
+    if (cachedToken && Date.now() - cachedToken.generatedAt < 55 * 60 * 1000) {
+        return cachedToken.jwt;
+    }
+    const header = Buffer.from(JSON.stringify({ alg: 'ES256', kid: keyId })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify({
+        iss: teamId,
+        iat: Math.floor(Date.now() / 1000),
+    })).toString('base64url');
+    const signingInput = `${header}.${payload}`;
+    const sign = crypto.createSign('SHA256');
+    sign.update(signingInput);
+    const signature = sign.sign({ key: privateKeyPem, dsaEncoding: 'ieee-p1363' })
+        .toString('base64url');
+    const jwt = `${signingInput}.${signature}`;
+    cachedToken = { jwt, generatedAt: Date.now() };
+    return jwt;
+}
+// ---- HTTP/2 session pool (one per host) ----
+let h2Session = null;
+let h2Host = null;
+function getH2Session(host) {
+    if (h2Session && !h2Session.destroyed && h2Host === host)
+        return h2Session;
+    h2Session?.destroy();
+    h2Session = http2.connect(`https://${host}`);
+    h2Session.on('error', () => { h2Session = null; });
+    h2Host = host;
+    return h2Session;
+}
+export function loadApnsConfig() {
+    const keyId = process.env.APNS_KEY_ID;
+    const teamId = process.env.APNS_TEAM_ID;
+    const keyPath = process.env.APNS_KEY_PATH;
+    const bundleId = process.env.APNS_BUNDLE_ID;
+    if (!keyId || !teamId || !keyPath || !bundleId)
+        return null;
+    if (!fs.existsSync(keyPath)) {
+        console.warn(`[APNs] Key file not found: ${keyPath}`);
+        return null;
+    }
+    return {
+        keyId,
+        teamId,
+        keyPath,
+        bundleId,
+        production: process.env.APNS_PRODUCTION === 'true',
+    };
+}
+/**
+ * Send a silent background push to an APNs device token.
+ * Resolves when APNs accepts the request. Throws on rejection.
+ */
+export async function sendApns(config, token, topic) {
+    const privateKey = fs.readFileSync(config.keyPath, 'utf-8');
+    const jwt = generateApnsJwt(config.keyId, config.teamId, privateKey);
+    const host = config.production ? APNS_HOST_PRODUCTION : APNS_HOST_SANDBOX;
+    const session = getH2Session(host);
+    return new Promise((resolve, reject) => {
+        const req = session.request({
+            ':method': 'POST',
+            ':path': `/3/device/${token}`,
+            ':scheme': 'https',
+            ':authority': host,
+            'authorization': `bearer ${jwt}`,
+            'apns-push-type': 'background',
+            'apns-priority': '5', // 5 = low priority, required for background
+            'apns-topic': topic,
+            'content-type': 'application/json',
+        });
+        const body = JSON.stringify({ aps: { 'content-available': 1 } });
+        req.end(body);
+        let statusCode = 0;
+        let responseBody = '';
+        req.on('response', (headers) => {
+            statusCode = headers[':status'];
+        });
+        req.on('data', (chunk) => {
+            responseBody += chunk.toString();
+        });
+        req.on('end', () => {
+            if (statusCode === 200) {
+                resolve();
+            }
+            else {
+                reject(new Error(`APNs error ${statusCode}: ${responseBody}`));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+//# sourceMappingURL=apns.js.map

package/dist/apns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apns.js","sourceRoot":"","sources":["../src/apns.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,gBAAgB;AAChB,yDAAyD;AACzD,EAAE;AACF,qBAAqB;AACrB,kEAAkE;AAClE,mEAAmE;AACnE,wDAAwD;AACxD,8EAA8E;AAC9E,sEAAsE;AACtE,+DAA+D;AAE/D,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,MAAM,iBAAiB,GAAM,4BAA4B,CAAC;AAC1D,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAElD,iCAAiC;AAEjC,IAAI,WAAW,GAAgD,IAAI,CAAC;AAEpE,SAAS,eAAe,CAAC,KAAa,EAAE,MAAc,EAAE,aAAqB;IAC3E,qEAAqE;IACrE,IAAI,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACzE,OAAO,WAAW,CAAC,GAAG,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACzC,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACnC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE1B,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;SAC3E,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEzB,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;IAC3C,WAAW,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC/C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+CAA+C;AAE/C,IAAI,SAAS,GAAoC,IAAI,CAAC;AACtD,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3E,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC7C,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,SAAS,CAAC;AACnB,CAAC;AAYD,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAC1C,MAAM,MAAM,GAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC3C,MAAM,OAAO,GAAK,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC5C,MAAM,QAAQ,GAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC7C,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,KAAK;QACL,MAAM;QACN,OAAO;QACP,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,MAAM;KACnD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAkB,EAClB,KAAa,EACb,KAAa;IAEb,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC1E,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEnC,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;YAC1B,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,aAAa,KAAK,EAAE;YAC7B,SAAS,EAAE,OAAO;YAClB,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,UAAU,GAAG,EAAE;YAChC,gBAAgB,EAAE,YAAY;YAC9B,eAAe,EAAE,GAAG,EAAQ,4CAA4C;YACxE,YAAY,EAAE,KAAK;YACnB,cAAc,EAAE,kBAAkB;SACnC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEd,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,YAAY,GAAG,EAAE,CAAC;QAEtB,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE;YAC7B,UAAU,GAAG,OAAO,CAAC,SAAS,CAAW,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,YAAY,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,UAAU,KAAK,YAAY,EAAE,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/fcm.js

@@ -0,0 +1,73 @@
+// ============================================================
+// FCM v1 API dispatch (Firebase Cloud Messaging)
+//
+// Required env vars:
+//   FCM_SERVICE_ACCOUNT_PATH — path to the Firebase service account JSON file
+//   FCM_PROJECT_ID           — Firebase project ID (also in the service account file)
+// ============================================================
+import * as fs from 'node:fs';
+import * as https from 'node:https';
+import { GoogleAuth } from 'google-auth-library';
+const FCM_ENDPOINT = 'https://fcm.googleapis.com/v1/projects';
+export function loadFcmConfig() {
+    const serviceAccountPath = process.env.FCM_SERVICE_ACCOUNT_PATH;
+    const projectId = process.env.FCM_PROJECT_ID;
+    if (!serviceAccountPath || !projectId)
+        return null;
+    if (!fs.existsSync(serviceAccountPath)) {
+        console.warn(`[FCM] Service account file not found: ${serviceAccountPath}`);
+        return null;
+    }
+    const auth = new GoogleAuth({
+        keyFile: serviceAccountPath,
+        scopes: ['https://www.googleapis.com/auth/firebase.messaging'],
+    });
+    return { projectId, auth };
+}
+/**
+ * Send a silent data-only push to an FCM registration token.
+ * Resolves when FCM accepts the request. Throws on rejection.
+ */
+export async function sendFcm(config, token) {
+    const accessToken = await config.auth.getAccessToken();
+    if (!accessToken)
+        throw new Error('FCM: failed to obtain access token');
+    const url = `${FCM_ENDPOINT}/${config.projectId}/messages:send`;
+    const payload = JSON.stringify({
+        message: {
+            token,
+            // Data-only message — no notification key means no visible alert
+            data: { source: 'meshwhisper' },
+            android: { priority: 'normal' },
+            apns: {
+                headers: { 'apns-priority': '5' },
+                payload: { aps: { 'content-available': 1 } },
+            },
+        },
+    });
+    return new Promise((resolve, reject) => {
+        const req = https.request(url, {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${accessToken}`,
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(payload),
+            },
+        }, (res) => {
+            let body = '';
+            res.on('data', (chunk) => { body += chunk.toString(); });
+            res.on('end', () => {
+                if (res.statusCode === 200) {
+                    resolve();
+                }
+                else {
+                    reject(new Error(`FCM error ${res.statusCode}: ${body}`));
+                }
+            });
+        });
+        req.on('error', reject);
+        req.write(payload);
+        req.end();
+    });
+}
+//# sourceMappingURL=fcm.js.map

package/dist/fcm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fcm.js","sourceRoot":"","sources":["../src/fcm.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,iDAAiD;AACjD,EAAE;AACF,qBAAqB;AACrB,8EAA8E;AAC9E,sFAAsF;AACtF,+DAA+D;AAE/D,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjD,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAO9D,MAAM,UAAU,aAAa;IAC3B,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC7C,IAAI,CAAC,kBAAkB,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,yCAAyC,kBAAkB,EAAE,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC;QAC1B,OAAO,EAAE,kBAAkB;QAC3B,MAAM,EAAE,CAAC,oDAAoD,CAAC;KAC/D,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAiB,EACjB,KAAa;IAEb,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;IACvD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAExE,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,MAAM,CAAC,SAAS,gBAAgB,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,OAAO,EAAE;YACP,KAAK;YACL,iEAAiE;YACjE,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;YAC/B,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC/B,IAAI,EAAE;gBACJ,OAAO,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE;gBACjC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,EAAE;aAC7C;SACF;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,WAAW,EAAE;gBACxC,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;aAC7C;SACF,EAAE,CAAC,GAAG,EAAE,EAAE;YACT,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAC3B,OAAO,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.js

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+// ============================================================
+// MeshWhisper Push Service
+// Accepts webhook POSTs from the MeshWhisper Node and dispatches
+// silent wake notifications via APNs and/or FCM.
+//
+// Usage:
+//   PUSH_PORT=4000 \
+//   APNS_KEY_ID=XXXXXXXXXX \
+//   APNS_TEAM_ID=YYYYYYYYYY \
+//   APNS_KEY_PATH=./AuthKey_XXXXXXXXXX.p8 \
+//   APNS_BUNDLE_ID=com.example.myapp \
+//   FCM_SERVICE_ACCOUNT_PATH=./firebase-service-account.json \
+//   FCM_PROJECT_ID=my-firebase-project \
+//   node dist/index.js
+//
+// Configure the MeshWhisper Node to point at this service:
+//   PUSH_WEBHOOK_URL=http://localhost:4000/notify
+//
+// Webhook payload (from Node):
+//   { token: string, platform: "apns" | "fcm", topic?: string, destHash: string }
+// ============================================================
+import * as http from 'node:http';
+import { loadApnsConfig, sendApns } from './apns.js';
+import { loadFcmConfig, sendFcm } from './fcm.js';
+import { loadWebPushConfig, sendWebPush } from './webpush.js';
+// ============================================================
+// Configuration
+// ============================================================
+const PORT = parseInt(process.env.PUSH_PORT ?? '4000', 10);
+const apnsConfig = loadApnsConfig();
+const fcmConfig = loadFcmConfig();
+const webPushConfig = loadWebPushConfig();
+if (!apnsConfig && !fcmConfig && !webPushConfig) {
+    console.warn('[push-service] WARNING: No push provider configured.');
+    console.warn('[push-service] Set APNS_*, FCM_*, or VAPID_* environment variables to enable push delivery.');
+}
+async function handleNotify(req, res) {
+    // Read body
+    const chunks = [];
+    await new Promise((resolve, reject) => {
+        req.on('data', (c) => chunks.push(c));
+        req.on('end', resolve);
+        req.on('error', reject);
+    });
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.concat(chunks).toString('utf-8'));
+    }
+    catch {
+        res.writeHead(400).end('Invalid JSON');
+        return;
+    }
+    const { token, platform, topic, destHash } = payload;
+    if (!token || !platform || !destHash) {
+        res.writeHead(400).end('Missing required fields: token, platform, destHash');
+        return;
+    }
+    // Dispatch — best effort
+    try {
+        if (platform === 'apns') {
+            if (!apnsConfig) {
+                console.warn(`[push-service] APNs not configured — dropping push for ${destHash}`);
+            }
+            else {
+                const apnsTopic = topic ?? apnsConfig.bundleId;
+                await sendApns(apnsConfig, token, apnsTopic);
+                console.log(`[push-service] APNs sent for destHash=${destHash}`);
+            }
+        }
+        else if (platform === 'fcm') {
+            if (!fcmConfig) {
+                console.warn(`[push-service] FCM not configured — dropping push for ${destHash}`);
+            }
+            else {
+                await sendFcm(fcmConfig, token);
+                console.log(`[push-service] FCM sent for destHash=${destHash}`);
+            }
+        }
+        else if (platform === 'webpush') {
+            if (!webPushConfig) {
+                console.warn(`[push-service] Web Push not configured — dropping push for ${destHash}`);
+            }
+            else {
+                // Subscription may arrive as a pre-parsed object or as a JSON string in token
+                let subscription = payload.pushSubscription ?? null;
+                if (!subscription && token) {
+                    try {
+                        subscription = JSON.parse(token);
+                    }
+                    catch { /* bad token */ }
+                }
+                if (!subscription) {
+                    console.warn(`[push-service] webpush: no valid subscription for ${destHash}`);
+                }
+                else {
+                    await sendWebPush(webPushConfig, subscription, destHash);
+                    console.log(`[push-service] Web Push sent for destHash=${destHash}`);
+                }
+            }
+        }
+        else {
+            console.warn(`[push-service] Unknown platform: ${platform}`);
+        }
+    }
+    catch (err) {
+        console.error(`[push-service] Push failed for destHash=${destHash}:`, err);
+        // Still return 200 — the Node shouldn't retry on push failures
+    }
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true }));
+}
+// ============================================================
+// HTTP server
+// ============================================================
+const server = http.createServer((req, res) => {
+    if (req.method === 'POST' && req.url === '/notify') {
+        handleNotify(req, res).catch((err) => {
+            console.error('[push-service] Handler error:', err);
+            res.writeHead(500).end();
+        });
+        return;
+    }
+    if (req.method === 'GET' && req.url === '/health') {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            status: 'ok',
+            apns: !!apnsConfig,
+            fcm: !!fcmConfig,
+            webpush: !!webPushConfig,
+        }));
+        return;
+    }
+    res.writeHead(404).end();
+});
+server.listen(PORT, () => {
+    console.log(`MeshWhisper Push Service listening on port ${PORT}`);
+    console.log(`  APNs:     ${apnsConfig ? `enabled (${apnsConfig.production ? 'production' : 'sandbox'})` : 'disabled'}`);
+    console.log(`  FCM:      ${fcmConfig ? `enabled (project: ${fcmConfig.projectId})` : 'disabled'}`);
+    console.log(`  Web Push: ${webPushConfig ? 'enabled' : 'disabled (set VAPID_* to enable)'}`);
+    console.log(`  Webhook endpoint: POST http://localhost:${PORT}/notify`);
+});
+function shutdown() {
+    console.log('\nShutting down...');
+    server.close(() => process.exit(0));
+    setTimeout(() => process.exit(1), 3000).unref();
+}
+process.on('SIGINT', shutdown);
+process.on('SIGTERM', shutdown);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,+DAA+D;AAC/D,2BAA2B;AAC3B,iEAAiE;AACjE,iDAAiD;AACjD,EAAE;AACF,SAAS;AACT,qBAAqB;AACrB,6BAA6B;AAC7B,8BAA8B;AAC9B,4CAA4C;AAC5C,uCAAuC;AACvC,+DAA+D;AAC/D,yCAAyC;AACzC,uBAAuB;AACvB,EAAE;AACF,2DAA2D;AAC3D,kDAAkD;AAClD,EAAE;AACF,+BAA+B;AAC/B,kFAAkF;AAClF,+DAA+D;AAE/D,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAA4B,MAAM,cAAc,CAAC;AAExF,+DAA+D;AAC/D,gBAAgB;AAChB,+DAA+D;AAE/D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AAE3D,MAAM,UAAU,GAAM,cAAc,EAAE,CAAC;AACvC,MAAM,SAAS,GAAO,aAAa,EAAE,CAAC;AACtC,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;AAE1C,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,EAAE,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACrE,OAAO,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;AAC9G,CAAC;AAgBD,KAAK,UAAU,YAAY,CAAC,GAAoB,EAAE,GAAmB;IACnE,YAAY;IACZ,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACrD,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,0DAA0D,QAAQ,EAAE,CAAC,CAAC;YACrF,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC;gBAC/C,MAAM,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,yDAAyD,QAAQ,EAAE,CAAC,CAAC;YACpF,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,8DAA8D,QAAQ,EAAE,CAAC,CAAC;YACzF,CAAC;iBAAM,CAAC;gBACN,8EAA8E;gBAC9E,IAAI,YAAY,GAA+B,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC;gBAChF,IAAI,CAAC,YAAY,IAAI,KAAK,EAAE,CAAC;oBAC3B,IAAI,CAAC;wBAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAwB,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;gBAC5F,CAAC;gBACD,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,OAAO,CAAC,IAAI,CAAC,qDAAqD,QAAQ,EAAE,CAAC,CAAC;gBAChF,CAAC;qBAAM,CAAC;oBACN,MAAM,WAAW,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;oBACzD,OAAO,CAAC,GAAG,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3E,+DAA+D;IACjE,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,+DAA+D;AAC/D,cAAc;AACd,+DAA+D;AAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACnD,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnC,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;YACpD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACrB,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,UAAU;YAClB,GAAG,EAAE,CAAC,CAAC,SAAS;YAChB,OAAO,EAAE,CAAC,CAAC,aAAa;SACzB,CAAC,CAAC,CAAC;QACJ,OAAO;IACT,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;AAC3B,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;IACvB,OAAO,CAAC,GAAG,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,eAAe,UAAU,CAAI,CAAC,CAAC,YAAY,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3H,OAAO,CAAC,GAAG,CAAC,eAAe,SAAS,CAAK,CAAC,CAAC,qBAAqB,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACvG,OAAO,CAAC,GAAG,CAAC,eAAe,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kCAAkC,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,6CAA6C,IAAI,SAAS,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC;AAEH,SAAS,QAAQ;IACf,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC"}

package/dist/webpush.js

@@ -0,0 +1,46 @@
+// ============================================================
+// MeshWhisper Push Service — Web Push (VAPID)
+// Sends silent wake notifications to browser/PWA subscribers
+// using the Web Push Protocol (RFC 8030) with VAPID auth.
+//
+// Environment variables:
+//   VAPID_PUBLIC_KEY   — Base64url VAPID public key
+//   VAPID_PRIVATE_KEY  — Base64url VAPID private key
+//   VAPID_SUBJECT      — mailto: or https: contact URI (required by spec)
+//
+// Generate VAPID keys once and store them:
+//   node -e "const wp = require('web-push'); console.log(wp.generateVAPIDKeys())"
+// ============================================================
+import webpush from 'web-push';
+// ---- Config loading ----
+export function loadWebPushConfig() {
+    const pub = process.env.VAPID_PUBLIC_KEY;
+    const priv = process.env.VAPID_PRIVATE_KEY;
+    const subject = process.env.VAPID_SUBJECT;
+    if (!pub || !priv || !subject)
+        return null;
+    webpush.setVapidDetails(subject, pub, priv);
+    return { vapidPublicKey: pub, vapidPrivateKey: priv, subject };
+}
+// ---- Send ----
+/**
+ * Sends a silent data push to the subscriber's browser/PWA.
+ * The payload is intentionally minimal — the app reconnects on wake
+ * and pulls queued messages. E2EE content never passes through the
+ * push service.
+ */
+export async function sendWebPush(_config, subscription, destHash) {
+    // Silent data message — just enough for the service worker to know
+    // there is something to fetch. No E2EE content here.
+    const payload = JSON.stringify({ type: 'meshwhisper:wake', destHash });
+    await webpush.sendNotification({
+        endpoint: subscription.endpoint,
+        expirationTime: subscription.expirationTime ?? null,
+        keys: subscription.keys,
+    }, payload, {
+        // TTL in seconds — keep alive for 24h so the device receives it
+        // when it next comes online.
+        TTL: 86400,
+    });
+}
+//# sourceMappingURL=webpush.js.map

package/dist/webpush.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webpush.js","sourceRoot":"","sources":["../src/webpush.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,8CAA8C;AAC9C,6DAA6D;AAC7D,0DAA0D;AAC1D,EAAE;AACF,yBAAyB;AACzB,oDAAoD;AACpD,qDAAqD;AACrD,0EAA0E;AAC1E,EAAE;AACF,2CAA2C;AAC3C,kFAAkF;AAClF,+DAA+D;AAE/D,OAAO,OAAO,MAAM,UAAU,CAAC;AAmB/B,2BAA2B;AAE3B,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAE1C,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE3C,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAE5C,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACjE,CAAC;AAED,iBAAiB;AAEjB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAsB,EACtB,YAAiC,EACjC,QAAgB;IAEhB,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEvE,MAAM,OAAO,CAAC,gBAAgB,CAC5B;QACE,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,cAAc,EAAE,YAAY,CAAC,cAAc,IAAI,IAAI;QACnD,IAAI,EAAE,YAAY,CAAC,IAAI;KACxB,EACD,OAAO,EACP;QACE,gEAAgE;QAChE,6BAA6B;QAC7B,GAAG,EAAE,KAAK;KACX,CACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@meshwhisper/push-service",
+  "version": "0.1.0",
+  "description": "MeshWhisper push notification service — dispatches APNs and FCM wake signals",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "meshwhisper-push": "dist/index.js"
+  },
+  "files": ["dist"],
+  "publishConfig": { "access": "public" },
+  "scripts": {
+    "prepublishOnly": "npm run build",
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "dev": "tsx src/index.ts"
+  },
+  "dependencies": {
+    "google-auth-library": "^9.0.0",
+    "web-push": "^3.6.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/web-push": "^3.6.0",
+    "tsx": "^4.21.0",
+    "typescript": "^5.7.0"
+  },
+  "license": "MIT"
+}