@phoenix-iq/notifications 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,70 @@
-# Temporary Holding Version
+# @phoenix-iq/notifications (web SDK)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Browser push for apps on `notifications.phnx-iq.com`, our replacement for OneSignal's web SDK. It subscribes the browser
+(standard Web Push with the app's VAPID key), binds it to your signed-in user with an identity token your backend signs,
+and hands notification clicks to your app. TypeScript, no dependencies.
+
+How the whole service works, the server API and the identity tokens: [docs/notifications.md](../../docs/notifications.md).
+
+```bash
+npm install @phoenix-iq/notifications
+```
+
+## 1. Serve the service worker
+
+Serve `phoenix-notifications-sw.js` (in this package) at your site's root, so it is reachable at
+`https://your-site/phoenix-notifications-sw.js`. It must be on your own site: a service worker only controls its own origin.
+Copy it from `node_modules/@phoenix-iq/notifications/phoenix-notifications-sw.js` in your build, or with Vite emit it from a
+small plugin (HQ's dashboard `vite.config.ts` does).
+
+## 2. Initialise and log in
+
+```ts
+import { Notifications } from '@phoenix-iq/notifications';
+
+await Notifications.init({ appId: '<app id from HQ: Push apps>' });
+
+// from a click ("Get notifications"): browsers only show the prompt on a user gesture
+const permission = await Notifications.requestPermission(); // 'granted' | 'denied' | 'default' | 'unsupported'
+
+// after your own sign-in, with the identity token your backend returned
+await Notifications.login(identityToken);
+
+// on sign-out: the browser keeps your broadcasts as a guest, but not that user's notifications
+await Notifications.logout();
+```
+
+`init` subscribes quietly when the person already allowed notifications. `login` before the permission is granted is kept
+and applied once it is. Nothing throws on an unsupported browser; check `Notifications.isSupported()` and
+`Notifications.permission()` to decide what to show.
+
+## 3. Handle clicks
+
+```ts
+Notifications.onClick(({ url, data }) => router.navigate(new URL(url ?? '/', location.origin).pathname));
+```
+
+A click on a notification focuses an open tab of your site and calls your handler; without a handler the SDK opens the link.
+With no tab open, the browser opens the link directly.
+
+## Options
+
+| Option | Default | |
+|---|---|---|
+| `appId` | (required) | The app's id: HQ → Push apps → the app |
+| `serverUrl` | `https://notifications.phnx-iq.com` | `''` uses your own origin (development behind a proxy) |
+| `serviceWorkerPath` | `/phoenix-notifications-sw.js` | |
+| `serviceWorkerScope` | `/` | |
+| `language` | the browser's | Picks the Arabic or English text of a notification |
+| `appVersion` | none | Stored with the device; in-app messages can target versions below one |
+
+## Notes
+
+- iPhone and iPad: web push works only for a site added to the home screen (iOS 16.4+), as with any web push provider.
+- The device secret the server gives the browser is kept in IndexedDB; it only lets this browser manage its own subscription.
+- Your site must be in the app's sites (the app → Settings → Web push), or registration is refused.
+
+## Publishing
+
+`npm run build` compiles `src` to `dist` (ES modules and type declarations). To release, raise `version` in
+`package.json` and run `npm publish` here (it builds first); the package is public on npmjs.com under `@phoenix-iq`.

package/dist/index.d.ts

@@ -0,0 +1,55 @@
+import { type StoredDevice } from './store.js';
+/**
+ * Phoenix Notifications web SDK: subscribes the browser to web push for an app on notifications.phnx-iq.com, binds it to
+ * the signed-in user with an identity token from the app's own backend, and hands notification clicks to the app.
+ *
+ * Nothing here throws for an unsupported browser or a denied permission: check `isSupported()` / `permission()`.
+ * The service worker file (phoenix-notifications-sw.js) must be served from the site, at `serviceWorkerPath`.
+ */
+export declare const DEFAULT_SERVER_URL = "https://notifications.phnx-iq.com";
+export declare const DEFAULT_SERVICE_WORKER_PATH = "/phoenix-notifications-sw.js";
+export interface InitOptions {
+    /** The app id from the dashboard (App notifications → the app → Settings). */
+    appId: string;
+    /** Where the notifications API is. '' means this site's own origin (development through a proxy). */
+    serverUrl?: string;
+    serviceWorkerPath?: string;
+    serviceWorkerScope?: string;
+    /** Language the device reports (picks Arabic or English text); defaults to the browser's. */
+    language?: string;
+    appVersion?: string;
+}
+export type PushPermission = 'granted' | 'denied' | 'default' | 'unsupported';
+export interface NotificationClick {
+    url?: string;
+    data: Record<string, string>;
+    messageId?: string;
+}
+export declare class NotificationsError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export declare const Notifications: {
+    /** True when this browser can receive web push here (a secure context with service workers and the Push API). */
+    isSupported(): boolean;
+    /** Registers the service worker. When the person already allowed notifications, subscribes quietly. */
+    init(init: InitOptions): Promise<void>;
+    permission(): PushPermission;
+    /** Asks the person (call it from a click) and subscribes when they allow. */
+    requestPermission(): Promise<PushPermission>;
+    /**
+     * Binds this browser to the user an identity token from the app's backend vouches for. Before the person allows
+     * notifications there is no device yet: the token is kept and used once they do.
+     */
+    login(identityToken: string): Promise<void>;
+    /** The browser keeps receiving the app's broadcasts as a guest, but no longer this user's notifications. */
+    logout(): Promise<void>;
+    /** Stops notifications in this browser altogether. */
+    unsubscribe(): Promise<void>;
+    /** A notification was clicked while the site was open. Without a handler the SDK opens its link. Returns an unsubscribe function. */
+    onClick(handler: (click: NotificationClick) => void): () => void;
+    /** Re-runs the subscription check now (e.g. after the person changed the site's permission). */
+    refresh(): Promise<void>;
+};
+export type { StoredDevice };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,YAAY,EAA2B,MAAM,YAAY,CAAC;AAEjG;;;;;;GAMG;AAEH,eAAO,MAAM,kBAAkB,sCAAsC,CAAC;AACtE,eAAO,MAAM,2BAA2B,iCAAiC,CAAC;AAE1E,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAE9E,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAqBD,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK5C;AA+KD,eAAO,MAAM,aAAa;IACxB,iHAAiH;mBAClG,OAAO;IAItB,uGAAuG;eACtF,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;kBAmB9B,cAAc;IAI5B,6EAA6E;yBAClD,OAAO,CAAC,cAAc,CAAC;IAUlD;;;OAGG;yBACwB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAejD,4GAA4G;cAC5F,OAAO,CAAC,IAAI,CAAC;IAO7B,sDAAsD;mBACjC,OAAO,CAAC,IAAI,CAAC;IAYlC,qIAAqI;qBACpH,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,GAAG,MAAM,IAAI;IAKhE,gGAAgG;eAC/E,OAAO,CAAC,IAAI,CAAC;CAK/B,CAAC;AAEF,YAAY,EAAE,YAAY,EAAE,CAAC"}

package/dist/index.js

@@ -0,0 +1,289 @@
+import { keys, store } from './store.js';
+/**
+ * Phoenix Notifications web SDK: subscribes the browser to web push for an app on notifications.phnx-iq.com, binds it to
+ * the signed-in user with an identity token from the app's own backend, and hands notification clicks to the app.
+ *
+ * Nothing here throws for an unsupported browser or a denied permission: check `isSupported()` / `permission()`.
+ * The service worker file (phoenix-notifications-sw.js) must be served from the site, at `serviceWorkerPath`.
+ */
+export const DEFAULT_SERVER_URL = 'https://notifications.phnx-iq.com';
+export const DEFAULT_SERVICE_WORKER_PATH = '/phoenix-notifications-sw.js';
+export class NotificationsError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.name = 'NotificationsError';
+        this.status = status;
+    }
+}
+const CLICK_MESSAGE = 'phoenix-notifications:click';
+const RESYNC_AFTER_MS = 24 * 60 * 60 * 1000;
+let options = {
+    appId: '',
+    serverUrl: DEFAULT_SERVER_URL,
+    serviceWorkerPath: DEFAULT_SERVICE_WORKER_PATH,
+    serviceWorkerScope: '/',
+    language: '',
+};
+let registration = null;
+let ready = null;
+let syncing = null;
+/** The last successful sync of this page, so init and login on the same load ask the server once. */
+let synced = null;
+const SYNC_REUSE_MS = 5 * 60 * 1000;
+const clickHandlers = new Set();
+let listening = false;
+function supported() {
+    return (typeof window !== 'undefined' &&
+        window.isSecureContext &&
+        'serviceWorker' in navigator &&
+        'PushManager' in window &&
+        'Notification' in window &&
+        'indexedDB' in window);
+}
+function url(path) {
+    return `${options.serverUrl.replace(/\/+$/, '')}${path}`;
+}
+async function call(method, path, body, deviceSecret) {
+    const headers = {};
+    if (body !== undefined)
+        headers['Content-Type'] = 'application/json';
+    if (deviceSecret)
+        headers.Authorization = `Device ${deviceSecret}`;
+    const response = await fetch(url(path), { method, headers, body: body === undefined ? undefined : JSON.stringify(body) });
+    if (response.status === 204)
+        return undefined;
+    let payload;
+    try {
+        payload = (await response.json());
+    }
+    catch {
+        payload = undefined;
+    }
+    if (!response.ok)
+        throw new NotificationsError(response.status, payload?.errors?.join(' ') || `Request failed with ${response.status}`);
+    return payload?.result;
+}
+function toBytes(base64Url) {
+    const padded = base64Url.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (base64Url.length % 4)) % 4);
+    const raw = atob(padded);
+    const bytes = new Uint8Array(new ArrayBuffer(raw.length));
+    for (let i = 0; i < raw.length; i++)
+        bytes[i] = raw.charCodeAt(i);
+    return bytes;
+}
+function toBase64Url(buffer) {
+    if (!buffer)
+        return '';
+    let raw = '';
+    for (const byte of new Uint8Array(buffer))
+        raw += String.fromCharCode(byte);
+    return btoa(raw).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function sameKey(subscription, vapidKey) {
+    return toBase64Url(subscription.options.applicationServerKey) === vapidKey.replace(/=+$/, '');
+}
+function subscriptionBody(subscription, vapidKey) {
+    return {
+        endpoint: subscription.endpoint,
+        p256dh: toBase64Url(subscription.getKey('p256dh')),
+        auth: toBase64Url(subscription.getKey('auth')),
+        applicationServerKey: vapidKey,
+    };
+}
+function deviceInfo() {
+    return {
+        language: options.language || navigator.language,
+        timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+        appVersion: options.appVersion,
+        os: navigator.platform || undefined,
+        deviceModel: navigator.userAgent.slice(0, 200),
+    };
+}
+function listenForClicks() {
+    if (listening)
+        return;
+    listening = true;
+    navigator.serviceWorker.addEventListener('message', (event) => {
+        const message = event.data;
+        if (message?.type !== CLICK_MESSAGE)
+            return;
+        const click = { url: message.url, data: message.data ?? {}, messageId: message.messageId };
+        if (clickHandlers.size === 0) {
+            if (click.url)
+                window.location.assign(click.url);
+            return;
+        }
+        for (const handler of clickHandlers)
+            handler(click);
+    });
+    // messages from the worker wait in a queue until the page says it is listening
+    navigator.serviceWorker.startMessages();
+}
+/** Subscribes (or renews the subscription) and registers or updates the device. Needs the permission granted. */
+async function sync() {
+    if (!registration || Notification.permission !== 'granted')
+        return null;
+    const config = await call('GET', `/v1/apps/${options.appId}/web`);
+    if (!config)
+        return null;
+    const vapidKey = config.vapidPublicKey;
+    await store.set(keys.config, { appId: options.appId, serverUrl: options.serverUrl, vapidKey });
+    let subscription = await registration.pushManager.getSubscription();
+    // a subscription made with another key (an earlier key of this app, or another push provider) cannot receive our pushes
+    if (subscription && !sameKey(subscription, vapidKey)) {
+        await subscription.unsubscribe();
+        subscription = null;
+    }
+    subscription ??= await registration.pushManager.subscribe({ userVisibleOnly: true, applicationServerKey: toBytes(vapidKey) });
+    const stored = await store.get(keys.device(options.appId));
+    const body = { subscription: subscriptionBody(subscription, vapidKey), ...deviceInfo() };
+    if (stored) {
+        const changed = stored.endpoint !== subscription.endpoint || stored.vapidKey !== vapidKey;
+        if (!changed && Date.now() - stored.syncedAt < RESYNC_AFTER_MS)
+            return stored;
+        try {
+            await call('PUT', `/v1/devices/${stored.id}`, changed ? body : deviceInfo(), stored.secret);
+            const updated = { ...stored, endpoint: subscription.endpoint, vapidKey, syncedAt: Date.now() };
+            await store.set(keys.device(options.appId), updated);
+            return updated;
+        }
+        catch (error) {
+            // the server no longer knows this device (or another record owns the subscription): register it again
+            if (!(error instanceof NotificationsError) || ![401, 404, 409].includes(error.status))
+                throw error;
+        }
+    }
+    const registered = await call('POST', `/v1/apps/${options.appId}/devices`, body);
+    if (!registered)
+        return null;
+    const device = {
+        appId: options.appId,
+        id: registered.deviceId,
+        secret: registered.deviceSecret,
+        endpoint: subscription.endpoint,
+        vapidKey,
+        syncedAt: Date.now(),
+    };
+    await store.set(keys.device(options.appId), device);
+    await store.remove(keys.login(options.appId));
+    return device;
+}
+function syncOnce(force = false) {
+    if (!force && synced && synced.device.appId === options.appId && Date.now() - synced.at < SYNC_REUSE_MS)
+        return Promise.resolve(synced.device);
+    syncing ??= sync()
+        .then((device) => {
+        synced = device ? { device, at: Date.now() } : null;
+        return device;
+    })
+        .finally(() => {
+        syncing = null;
+    });
+    return syncing;
+}
+/** A login made before the person allowed notifications is applied once there is a device. */
+async function applyPendingLogin(device) {
+    if (!device)
+        return;
+    const pending = await store.get(keys.login(options.appId));
+    if (pending && pending.at === 0)
+        await Notifications.login(pending.token);
+}
+export const Notifications = {
+    /** True when this browser can receive web push here (a secure context with service workers and the Push API). */
+    isSupported() {
+        return supported();
+    },
+    /** Registers the service worker. When the person already allowed notifications, subscribes quietly. */
+    async init(init) {
+        if (!supported())
+            return;
+        if (!init.appId)
+            throw new Error('Notifications.init needs the appId.');
+        options = {
+            appId: init.appId,
+            serverUrl: init.serverUrl ?? DEFAULT_SERVER_URL,
+            serviceWorkerPath: init.serviceWorkerPath ?? DEFAULT_SERVICE_WORKER_PATH,
+            serviceWorkerScope: init.serviceWorkerScope ?? '/',
+            language: init.language ?? '',
+            appVersion: init.appVersion,
+        };
+        ready = (async () => {
+            registration = await navigator.serviceWorker.register(options.serviceWorkerPath, { scope: options.serviceWorkerScope });
+            listenForClicks();
+        })();
+        await ready;
+        if (Notification.permission === 'granted')
+            await applyPendingLogin(await syncOnce(true));
+    },
+    permission() {
+        return supported() ? Notification.permission : 'unsupported';
+    },
+    /** Asks the person (call it from a click) and subscribes when they allow. */
+    async requestPermission() {
+        if (!supported())
+            return 'unsupported';
+        const result = await Notification.requestPermission();
+        if (result === 'granted') {
+            await ready;
+            await applyPendingLogin(await syncOnce(true));
+        }
+        return result;
+    },
+    /**
+     * Binds this browser to the user an identity token from the app's backend vouches for. Before the person allows
+     * notifications there is no device yet: the token is kept and used once they do.
+     */
+    async login(identityToken) {
+        if (!supported())
+            return;
+        await ready;
+        const loginKey = keys.login(options.appId);
+        const previous = await store.get(loginKey);
+        const device = await syncOnce();
+        if (!device) {
+            await store.set(loginKey, { appId: options.appId, token: identityToken, at: 0 });
+            return;
+        }
+        if (previous && previous.token === identityToken && previous.at > 0 && Date.now() - previous.at < RESYNC_AFTER_MS)
+            return;
+        await call('POST', `/v1/devices/${device.id}/login`, { identityToken }, device.secret);
+        await store.set(loginKey, { appId: options.appId, token: identityToken, at: Date.now() });
+    },
+    /** The browser keeps receiving the app's broadcasts as a guest, but no longer this user's notifications. */
+    async logout() {
+        if (!supported() || !options.appId)
+            return;
+        await store.remove(keys.login(options.appId));
+        const device = await store.get(keys.device(options.appId));
+        if (device)
+            await call('POST', `/v1/devices/${device.id}/logout`, undefined, device.secret);
+    },
+    /** Stops notifications in this browser altogether. */
+    async unsubscribe() {
+        if (!supported() || !options.appId)
+            return;
+        const device = await store.get(keys.device(options.appId));
+        if (device) {
+            await call('DELETE', `/v1/devices/${device.id}`, undefined, device.secret);
+            await store.remove(keys.device(options.appId));
+        }
+        await store.remove(keys.login(options.appId));
+        const subscription = await registration?.pushManager.getSubscription();
+        await subscription?.unsubscribe();
+    },
+    /** A notification was clicked while the site was open. Without a handler the SDK opens its link. Returns an unsubscribe function. */
+    onClick(handler) {
+        clickHandlers.add(handler);
+        return () => clickHandlers.delete(handler);
+    },
+    /** Re-runs the subscription check now (e.g. after the person changed the site's permission). */
+    async refresh() {
+        if (!supported())
+            return;
+        await ready;
+        await applyPendingLogin(await syncOnce(true));
+    },
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAA0D,KAAK,EAAE,MAAM,YAAY,CAAC;AAEjG;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,mCAAmC,CAAC;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,8BAA8B,CAAC;AAyC1E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,CAAS;IAExB,YAAY,MAAc,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,aAAa,GAAG,6BAA6B,CAAC;AACpD,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C,IAAI,OAAO,GAAwE;IACjF,KAAK,EAAE,EAAE;IACT,SAAS,EAAE,kBAAkB;IAC7B,iBAAiB,EAAE,2BAA2B;IAC9C,kBAAkB,EAAE,GAAG;IACvB,QAAQ,EAAE,EAAE;CACb,CAAC;AACF,IAAI,YAAY,GAAqC,IAAI,CAAC;AAC1D,IAAI,KAAK,GAAyB,IAAI,CAAC;AACvC,IAAI,OAAO,GAAwC,IAAI,CAAC;AACxD,qGAAqG;AACrG,IAAI,MAAM,GAAgD,IAAI,CAAC;AAC/D,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsC,CAAC;AACpE,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB,SAAS,SAAS;IAChB,OAAO,CACL,OAAO,MAAM,KAAK,WAAW;QAC7B,MAAM,CAAC,eAAe;QACtB,eAAe,IAAI,SAAS;QAC5B,aAAa,IAAI,MAAM;QACvB,cAAc,IAAI,MAAM;QACxB,WAAW,IAAI,MAAM,CACtB,CAAC;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACvB,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc,EAAE,YAAqB;IACxF,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IACrE,IAAI,YAAY;QAAE,OAAO,CAAC,aAAa,GAAG,UAAU,YAAY,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1H,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgB,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACxI,OAAO,OAAO,EAAE,MAAM,CAAC;AACzB,CAAC;AAED,SAAS,OAAO,CAAC,SAAiB;IAChC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9G,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,MAA0B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,OAAO,CAAC,YAA8B,EAAE,QAAgB;IAC/D,OAAO,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,oBAAoB,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,gBAAgB,CAAC,YAA8B,EAAE,QAAgB;IACxE,OAAO;QACL,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,MAAM,EAAE,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,EAAE,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,oBAAoB,EAAE,QAAQ;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ;QAChD,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ;QAC1D,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,EAAE,EAAE,SAAS,CAAC,QAAQ,IAAI,SAAS;QACnC,WAAW,EAAE,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,SAAS;QAAE,OAAO;IACtB,SAAS,GAAG,IAAI,CAAC;IACjB,SAAS,CAAC,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAmB,EAAE,EAAE;QAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAsG,CAAC;QAC7H,IAAI,OAAO,EAAE,IAAI,KAAK,aAAa;YAAE,OAAO;QAC5C,MAAM,KAAK,GAAsB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9G,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,GAAG;gBAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,aAAa;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,+EAA+E;IAC/E,SAAS,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED,iHAAiH;AACjH,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAExE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAY,KAAK,EAAE,YAAY,OAAO,CAAC,KAAK,MAAM,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC;IACvC,MAAM,KAAK,CAAC,GAAG,CAAe,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE7G,IAAI,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;IACpE,wHAAwH;IACxH,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,YAAY,CAAC,WAAW,EAAE,CAAC;QACjC,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,YAAY,KAAK,MAAM,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAE9H,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAe,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,YAAY,EAAE,gBAAgB,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,GAAG,UAAU,EAAE,EAAE,CAAC;IACzF,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC1F,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,eAAe;YAAE,OAAO,MAAM,CAAC;QAC9E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,EAAE,eAAe,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5F,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC/F,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACrD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sGAAsG;YACtG,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,MAAM,KAAK,CAAC;QACrG,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAmB,MAAM,EAAE,YAAY,OAAO,CAAC,KAAK,UAAU,EAAE,IAAI,CAAC,CAAC;IACnG,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAiB;QAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,EAAE,EAAE,UAAU,CAAC,QAAQ;QACvB,MAAM,EAAE,UAAU,CAAC,YAAY;QAC/B,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,QAAQ;QACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;IACF,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAK,GAAG,KAAK;IAC7B,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,aAAa;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/I,OAAO,KAAK,IAAI,EAAE;SACf,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACf,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC,CAAC;IACL,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,iBAAiB,CAAC,MAA2B;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAc,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,iHAAiH;IACjH,WAAW;QACT,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;IAED,uGAAuG;IACvG,KAAK,CAAC,IAAI,CAAC,IAAiB;QAC1B,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QACzB,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACxE,OAAO,GAAG;YACR,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB;YAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,2BAA2B;YACxE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,GAAG;YAClD,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;QACF,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;YAClB,YAAY,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;YACxH,eAAe,EAAE,CAAC;QACpB,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,KAAK,CAAC;QACZ,IAAI,YAAY,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,UAAU;QACR,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/D,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO,aAAa,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC;YACZ,MAAM,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,aAAqB;QAC/B,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QACzB,MAAM,KAAK,CAAC;QACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAc,QAAQ,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,GAAG,CAAc,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,aAAa,IAAI,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,EAAE,GAAG,eAAe;YAAE,OAAO;QAC1H,MAAM,IAAI,CAAC,MAAM,EAAE,eAAe,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,aAAa,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvF,MAAM,KAAK,CAAC,GAAG,CAAc,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,4GAA4G;IAC5G,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,OAAO;QAC3C,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAe,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,IAAI,MAAM;YAAE,MAAM,IAAI,CAAC,MAAM,EAAE,eAAe,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9F,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,OAAO;QAC3C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAe,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,QAAQ,EAAE,eAAe,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3E,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,YAAY,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC;QACvE,MAAM,YAAY,EAAE,WAAW,EAAE,CAAC;IACpC,CAAC;IAED,qIAAqI;IACrI,OAAO,CAAC,OAA2C;QACjD,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,SAAS,EAAE;YAAE,OAAO;QACzB,MAAM,KAAK,CAAC;QACZ,MAAM,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;CACF,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The SDK's state in IndexedDB, shared with the service worker (which reads `config` to report clicks and to renew a
+ * subscription). Keep the database name, store and keys in step with phoenix-notifications-sw.js.
+ */
+/** What the service worker needs: where to report clicks and the key to subscribe with. */
+export interface StoredConfig {
+    appId: string;
+    serverUrl: string;
+    vapidKey: string;
+}
+/** This browser's device record on the server. The secret authenticates every later call for the device. */
+export interface StoredDevice {
+    appId: string;
+    id: string;
+    secret: string;
+    endpoint: string;
+    vapidKey: string;
+    /** When the server last heard from this device (ms), to refresh it about once a day. */
+    syncedAt: number;
+}
+/** The user the device was last bound to, so a page load does not log in again with the same token. */
+export interface StoredLogin {
+    appId: string;
+    token: string;
+    at: number;
+}
+export declare const store: {
+    get<T>(key: string): Promise<T | undefined>;
+    set<T>(key: string, value: T): Promise<void>;
+    remove(key: string): Promise<void>;
+};
+export declare const keys: {
+    config: string;
+    device: (appId: string) => string;
+    login: (appId: string) => string;
+};
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,2FAA2F;AAC3F,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,4GAA4G;AAC5G,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,uGAAuG;AACvG,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ;AA0BD,eAAO,MAAM,KAAK;QACZ,CAAC,OAAO,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;QAGvC,CAAC,OAAO,MAAM,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;gBAGhC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGnC,CAAC;AAEF,eAAO,MAAM,IAAI;;oBAEC,MAAM;mBACP,MAAM;CACtB,CAAC"}

package/dist/store.js

@@ -0,0 +1,47 @@
+/**
+ * The SDK's state in IndexedDB, shared with the service worker (which reads `config` to report clicks and to renew a
+ * subscription). Keep the database name, store and keys in step with phoenix-notifications-sw.js.
+ */
+const DB_NAME = 'phoenix-notifications';
+const STORE = 'state';
+function open() {
+    return new Promise((resolve, reject) => {
+        const request = indexedDB.open(DB_NAME, 1);
+        request.onupgradeneeded = () => {
+            if (!request.result.objectStoreNames.contains(STORE))
+                request.result.createObjectStore(STORE);
+        };
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error);
+    });
+}
+async function run(mode, action) {
+    const db = await open();
+    try {
+        return await new Promise((resolve, reject) => {
+            const request = action(db.transaction(STORE, mode).objectStore(STORE));
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(request.error);
+        });
+    }
+    finally {
+        db.close();
+    }
+}
+export const store = {
+    get(key) {
+        return run('readonly', (s) => s.get(key));
+    },
+    set(key, value) {
+        return run('readwrite', (s) => s.put(value, key));
+    },
+    remove(key) {
+        return run('readwrite', (s) => s.delete(key));
+    },
+};
+export const keys = {
+    config: 'config',
+    device: (appId) => `device:${appId}`,
+    login: (appId) => `login:${appId}`,
+};
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,OAAO,GAAG,uBAAuB,CAAC;AACxC,MAAM,KAAK,GAAG,OAAO,CAAC;AA2BtB,SAAS,IAAI;IACX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE;YAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAChG,CAAC,CAAC;QACF,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,GAAG,CAAI,IAAwB,EAAE,MAA6C;IAC3F,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YACvE,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAW,CAAC,CAAC;YACvD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,GAAG,CAAI,GAAW;QAChB,OAAO,GAAG,CAAgB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,GAAG,CAAI,GAAW,EAAE,KAAQ;QAC1B,OAAO,GAAG,CAAO,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,CAAC,GAAW;QAChB,OAAO,GAAG,CAAO,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,KAAK,EAAE;IAC5C,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,SAAS,KAAK,EAAE;CAC3C,CAAC"}

package/package.json

@@ -1,6 +1,39 @@
 {
   "name": "@phoenix-iq/notifications",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Phoenix Notifications web SDK: browser push subscriptions, verified sign-in and click handling for apps on notifications.phnx-iq.com.",
+  "type": "module",
+  "license": "UNLICENSED",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./phoenix-notifications-sw.js": "./phoenix-notifications-sw.js"
+  },
+  "files": [
+    "dist",
+    "src",
+    "phoenix-notifications-sw.js",
+    "README.md"
+  ],
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Phoenix-IQ/phoenix-notifications.git",
+    "directory": "sdk/web"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3"
+  }
+}

package/phoenix-notifications-sw.js

@@ -0,0 +1,148 @@
+/*
+ * Phoenix Notifications service worker. Serve it from the site's root (default path /phoenix-notifications-sw.js) so it
+ * controls the whole site. Plain JavaScript on purpose: copy it as it is, no build step.
+ *
+ * It shows the pushes the site receives, reports clicks to the notifications API, focuses an open tab of the site (and tells
+ * the page, which routes the click) or opens the link, and renews the subscription when the browser replaces it.
+ * Its state is shared with the SDK through IndexedDB ("phoenix-notifications" / "state"); keep the two in step.
+ */
+
+const DB_NAME = 'phoenix-notifications';
+const STORE = 'state';
+const CLICK_MESSAGE = 'phoenix-notifications:click';
+
+function openDb() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(DB_NAME, 1);
+    request.onupgradeneeded = () => {
+      if (!request.result.objectStoreNames.contains(STORE)) request.result.createObjectStore(STORE);
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error);
+  });
+}
+
+async function read(key) {
+  const db = await openDb();
+  try {
+    return await new Promise((resolve, reject) => {
+      const request = db.transaction(STORE, 'readonly').objectStore(STORE).get(key);
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error);
+    });
+  } finally {
+    db.close();
+  }
+}
+
+async function write(key, value) {
+  const db = await openDb();
+  try {
+    await new Promise((resolve, reject) => {
+      const request = db.transaction(STORE, 'readwrite').objectStore(STORE).put(value, key);
+      request.onsuccess = () => resolve();
+      request.onerror = () => reject(request.error);
+    });
+  } finally {
+    db.close();
+  }
+}
+
+function apiUrl(config, path) {
+  return new URL(`${(config.serverUrl || '').replace(/\/+$/, '')}${path}`, self.location.origin).toString();
+}
+
+function toBytes(base64Url) {
+  const padded = base64Url.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (base64Url.length % 4)) % 4);
+  const raw = atob(padded);
+  const bytes = new Uint8Array(raw.length);
+  for (let i = 0; i < raw.length; i++) bytes[i] = raw.charCodeAt(i);
+  return bytes;
+}
+
+function toBase64Url(buffer) {
+  if (!buffer) return '';
+  let raw = '';
+  for (const byte of new Uint8Array(buffer)) raw += String.fromCharCode(byte);
+  return btoa(raw).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+self.addEventListener('install', () => self.skipWaiting());
+
+self.addEventListener('activate', (event) => event.waitUntil(self.clients.claim()));
+
+self.addEventListener('push', (event) => {
+  let payload = {};
+  try {
+    payload = event.data ? event.data.json() : {};
+  } catch {
+    payload = { title: event.data ? event.data.text() : '' };
+  }
+
+  const options = {
+    body: payload.body || '',
+    icon: payload.icon || undefined,
+    image: payload.image || undefined,
+    lang: payload.lang || undefined,
+    dir: payload.dir || 'auto',
+    // the same message never shows twice
+    tag: payload.m || undefined,
+    data: { id: payload.id, m: payload.m, url: payload.url, data: payload.data || {} },
+  };
+  event.waitUntil(self.registration.showNotification(payload.title || '', options));
+});
+
+self.addEventListener('notificationclick', (event) => {
+  event.notification.close();
+  const details = event.notification.data || {};
+
+  event.waitUntil(
+    (async () => {
+      if (details.id) {
+        try {
+          const config = await read('config');
+          if (config) await fetch(apiUrl(config, `/v1/opened/${details.id}`), { method: 'POST', keepalive: true });
+        } catch {
+          // counting the click must never stop it from opening
+        }
+      }
+
+      const windows = await self.clients.matchAll({ type: 'window', includeUncontrolled: true });
+      const open = windows.find((client) => new URL(client.url).origin === self.location.origin);
+      if (open) {
+        await open.focus();
+        open.postMessage({ type: CLICK_MESSAGE, url: details.url, data: details.data || {}, messageId: details.m });
+        return;
+      }
+      await self.clients.openWindow(details.url || self.registration.scope);
+    })(),
+  );
+});
+
+self.addEventListener('pushsubscriptionchange', (event) => {
+  event.waitUntil(
+    (async () => {
+      const config = await read('config');
+      if (!config || !config.vapidKey) return;
+      const device = await read(`device:${config.appId}`);
+      const subscription =
+        event.newSubscription ||
+        (await self.registration.pushManager.subscribe({ userVisibleOnly: true, applicationServerKey: toBytes(config.vapidKey) }));
+      if (!device) return;
+
+      const response = await fetch(apiUrl(config, `/v1/devices/${device.id}`), {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json', Authorization: `Device ${device.secret}` },
+        body: JSON.stringify({
+          subscription: {
+            endpoint: subscription.endpoint,
+            p256dh: toBase64Url(subscription.getKey('p256dh')),
+            auth: toBase64Url(subscription.getKey('auth')),
+            applicationServerKey: config.vapidKey,
+          },
+        }),
+      });
+      if (response.ok) await write(`device:${config.appId}`, { ...device, endpoint: subscription.endpoint, syncedAt: Date.now() });
+    })(),
+  );
+});

package/src/index.ts

@@ -0,0 +1,331 @@
+import { keys, type StoredConfig, type StoredDevice, type StoredLogin, store } from './store.js';
+
+/**
+ * Phoenix Notifications web SDK: subscribes the browser to web push for an app on notifications.phnx-iq.com, binds it to
+ * the signed-in user with an identity token from the app's own backend, and hands notification clicks to the app.
+ *
+ * Nothing here throws for an unsupported browser or a denied permission: check `isSupported()` / `permission()`.
+ * The service worker file (phoenix-notifications-sw.js) must be served from the site, at `serviceWorkerPath`.
+ */
+
+export const DEFAULT_SERVER_URL = 'https://notifications.phnx-iq.com';
+export const DEFAULT_SERVICE_WORKER_PATH = '/phoenix-notifications-sw.js';
+
+export interface InitOptions {
+  /** The app id from the dashboard (App notifications → the app → Settings). */
+  appId: string;
+  /** Where the notifications API is. '' means this site's own origin (development through a proxy). */
+  serverUrl?: string;
+  serviceWorkerPath?: string;
+  serviceWorkerScope?: string;
+  /** Language the device reports (picks Arabic or English text); defaults to the browser's. */
+  language?: string;
+  appVersion?: string;
+}
+
+export type PushPermission = 'granted' | 'denied' | 'default' | 'unsupported';
+
+export interface NotificationClick {
+  url?: string;
+  data: Record<string, string>;
+  messageId?: string;
+}
+
+interface Envelope<T> {
+  result?: T;
+  errors?: string[];
+}
+
+interface WebConfig {
+  appId: string;
+  name: string;
+  vapidPublicKey: string;
+  iconUrl?: string | null;
+  defaultUrl?: string | null;
+}
+
+interface RegisteredDevice {
+  deviceId: string;
+  deviceSecret: string;
+  vapidPublicKey: string;
+}
+
+export class NotificationsError extends Error {
+  readonly status: number;
+
+  constructor(status: number, message: string) {
+    super(message);
+    this.name = 'NotificationsError';
+    this.status = status;
+  }
+}
+
+const CLICK_MESSAGE = 'phoenix-notifications:click';
+const RESYNC_AFTER_MS = 24 * 60 * 60 * 1000;
+
+let options: Required<Omit<InitOptions, 'appVersion'>> & { appVersion?: string } = {
+  appId: '',
+  serverUrl: DEFAULT_SERVER_URL,
+  serviceWorkerPath: DEFAULT_SERVICE_WORKER_PATH,
+  serviceWorkerScope: '/',
+  language: '',
+};
+let registration: ServiceWorkerRegistration | null = null;
+let ready: Promise<void> | null = null;
+let syncing: Promise<StoredDevice | null> | null = null;
+/** The last successful sync of this page, so init and login on the same load ask the server once. */
+let synced: { device: StoredDevice; at: number } | null = null;
+const SYNC_REUSE_MS = 5 * 60 * 1000;
+const clickHandlers = new Set<(click: NotificationClick) => void>();
+let listening = false;
+
+function supported(): boolean {
+  return (
+    typeof window !== 'undefined' &&
+    window.isSecureContext &&
+    'serviceWorker' in navigator &&
+    'PushManager' in window &&
+    'Notification' in window &&
+    'indexedDB' in window
+  );
+}
+
+function url(path: string): string {
+  return `${options.serverUrl.replace(/\/+$/, '')}${path}`;
+}
+
+async function call<T>(method: string, path: string, body?: unknown, deviceSecret?: string): Promise<T | undefined> {
+  const headers: Record<string, string> = {};
+  if (body !== undefined) headers['Content-Type'] = 'application/json';
+  if (deviceSecret) headers.Authorization = `Device ${deviceSecret}`;
+  const response = await fetch(url(path), { method, headers, body: body === undefined ? undefined : JSON.stringify(body) });
+  if (response.status === 204) return undefined;
+  let payload: Envelope<T> | undefined;
+  try {
+    payload = (await response.json()) as Envelope<T>;
+  } catch {
+    payload = undefined;
+  }
+  if (!response.ok) throw new NotificationsError(response.status, payload?.errors?.join(' ') || `Request failed with ${response.status}`);
+  return payload?.result;
+}
+
+function toBytes(base64Url: string): Uint8Array<ArrayBuffer> {
+  const padded = base64Url.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (base64Url.length % 4)) % 4);
+  const raw = atob(padded);
+  const bytes = new Uint8Array(new ArrayBuffer(raw.length));
+  for (let i = 0; i < raw.length; i++) bytes[i] = raw.charCodeAt(i);
+  return bytes;
+}
+
+function toBase64Url(buffer: ArrayBuffer | null): string {
+  if (!buffer) return '';
+  let raw = '';
+  for (const byte of new Uint8Array(buffer)) raw += String.fromCharCode(byte);
+  return btoa(raw).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+function sameKey(subscription: PushSubscription, vapidKey: string): boolean {
+  return toBase64Url(subscription.options.applicationServerKey) === vapidKey.replace(/=+$/, '');
+}
+
+function subscriptionBody(subscription: PushSubscription, vapidKey: string) {
+  return {
+    endpoint: subscription.endpoint,
+    p256dh: toBase64Url(subscription.getKey('p256dh')),
+    auth: toBase64Url(subscription.getKey('auth')),
+    applicationServerKey: vapidKey,
+  };
+}
+
+function deviceInfo() {
+  return {
+    language: options.language || navigator.language,
+    timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+    appVersion: options.appVersion,
+    os: navigator.platform || undefined,
+    deviceModel: navigator.userAgent.slice(0, 200),
+  };
+}
+
+function listenForClicks(): void {
+  if (listening) return;
+  listening = true;
+  navigator.serviceWorker.addEventListener('message', (event: MessageEvent) => {
+    const message = event.data as { type?: string; url?: string; data?: Record<string, string>; messageId?: string } | undefined;
+    if (message?.type !== CLICK_MESSAGE) return;
+    const click: NotificationClick = { url: message.url, data: message.data ?? {}, messageId: message.messageId };
+    if (clickHandlers.size === 0) {
+      if (click.url) window.location.assign(click.url);
+      return;
+    }
+    for (const handler of clickHandlers) handler(click);
+  });
+  // messages from the worker wait in a queue until the page says it is listening
+  navigator.serviceWorker.startMessages();
+}
+
+/** Subscribes (or renews the subscription) and registers or updates the device. Needs the permission granted. */
+async function sync(): Promise<StoredDevice | null> {
+  if (!registration || Notification.permission !== 'granted') return null;
+
+  const config = await call<WebConfig>('GET', `/v1/apps/${options.appId}/web`);
+  if (!config) return null;
+  const vapidKey = config.vapidPublicKey;
+  await store.set<StoredConfig>(keys.config, { appId: options.appId, serverUrl: options.serverUrl, vapidKey });
+
+  let subscription = await registration.pushManager.getSubscription();
+  // a subscription made with another key (an earlier key of this app, or another push provider) cannot receive our pushes
+  if (subscription && !sameKey(subscription, vapidKey)) {
+    await subscription.unsubscribe();
+    subscription = null;
+  }
+  subscription ??= await registration.pushManager.subscribe({ userVisibleOnly: true, applicationServerKey: toBytes(vapidKey) });
+
+  const stored = await store.get<StoredDevice>(keys.device(options.appId));
+  const body = { subscription: subscriptionBody(subscription, vapidKey), ...deviceInfo() };
+  if (stored) {
+    const changed = stored.endpoint !== subscription.endpoint || stored.vapidKey !== vapidKey;
+    if (!changed && Date.now() - stored.syncedAt < RESYNC_AFTER_MS) return stored;
+    try {
+      await call('PUT', `/v1/devices/${stored.id}`, changed ? body : deviceInfo(), stored.secret);
+      const updated = { ...stored, endpoint: subscription.endpoint, vapidKey, syncedAt: Date.now() };
+      await store.set(keys.device(options.appId), updated);
+      return updated;
+    } catch (error) {
+      // the server no longer knows this device (or another record owns the subscription): register it again
+      if (!(error instanceof NotificationsError) || ![401, 404, 409].includes(error.status)) throw error;
+    }
+  }
+
+  const registered = await call<RegisteredDevice>('POST', `/v1/apps/${options.appId}/devices`, body);
+  if (!registered) return null;
+  const device: StoredDevice = {
+    appId: options.appId,
+    id: registered.deviceId,
+    secret: registered.deviceSecret,
+    endpoint: subscription.endpoint,
+    vapidKey,
+    syncedAt: Date.now(),
+  };
+  await store.set(keys.device(options.appId), device);
+  await store.remove(keys.login(options.appId));
+  return device;
+}
+
+function syncOnce(force = false): Promise<StoredDevice | null> {
+  if (!force && synced && synced.device.appId === options.appId && Date.now() - synced.at < SYNC_REUSE_MS) return Promise.resolve(synced.device);
+  syncing ??= sync()
+    .then((device) => {
+      synced = device ? { device, at: Date.now() } : null;
+      return device;
+    })
+    .finally(() => {
+      syncing = null;
+    });
+  return syncing;
+}
+
+/** A login made before the person allowed notifications is applied once there is a device. */
+async function applyPendingLogin(device: StoredDevice | null): Promise<void> {
+  if (!device) return;
+  const pending = await store.get<StoredLogin>(keys.login(options.appId));
+  if (pending && pending.at === 0) await Notifications.login(pending.token);
+}
+
+export const Notifications = {
+  /** True when this browser can receive web push here (a secure context with service workers and the Push API). */
+  isSupported(): boolean {
+    return supported();
+  },
+
+  /** Registers the service worker. When the person already allowed notifications, subscribes quietly. */
+  async init(init: InitOptions): Promise<void> {
+    if (!supported()) return;
+    if (!init.appId) throw new Error('Notifications.init needs the appId.');
+    options = {
+      appId: init.appId,
+      serverUrl: init.serverUrl ?? DEFAULT_SERVER_URL,
+      serviceWorkerPath: init.serviceWorkerPath ?? DEFAULT_SERVICE_WORKER_PATH,
+      serviceWorkerScope: init.serviceWorkerScope ?? '/',
+      language: init.language ?? '',
+      appVersion: init.appVersion,
+    };
+    ready = (async () => {
+      registration = await navigator.serviceWorker.register(options.serviceWorkerPath, { scope: options.serviceWorkerScope });
+      listenForClicks();
+    })();
+    await ready;
+    if (Notification.permission === 'granted') await applyPendingLogin(await syncOnce(true));
+  },
+
+  permission(): PushPermission {
+    return supported() ? Notification.permission : 'unsupported';
+  },
+
+  /** Asks the person (call it from a click) and subscribes when they allow. */
+  async requestPermission(): Promise<PushPermission> {
+    if (!supported()) return 'unsupported';
+    const result = await Notification.requestPermission();
+    if (result === 'granted') {
+      await ready;
+      await applyPendingLogin(await syncOnce(true));
+    }
+    return result;
+  },
+
+  /**
+   * Binds this browser to the user an identity token from the app's backend vouches for. Before the person allows
+   * notifications there is no device yet: the token is kept and used once they do.
+   */
+  async login(identityToken: string): Promise<void> {
+    if (!supported()) return;
+    await ready;
+    const loginKey = keys.login(options.appId);
+    const previous = await store.get<StoredLogin>(loginKey);
+    const device = await syncOnce();
+    if (!device) {
+      await store.set<StoredLogin>(loginKey, { appId: options.appId, token: identityToken, at: 0 });
+      return;
+    }
+    if (previous && previous.token === identityToken && previous.at > 0 && Date.now() - previous.at < RESYNC_AFTER_MS) return;
+    await call('POST', `/v1/devices/${device.id}/login`, { identityToken }, device.secret);
+    await store.set<StoredLogin>(loginKey, { appId: options.appId, token: identityToken, at: Date.now() });
+  },
+
+  /** The browser keeps receiving the app's broadcasts as a guest, but no longer this user's notifications. */
+  async logout(): Promise<void> {
+    if (!supported() || !options.appId) return;
+    await store.remove(keys.login(options.appId));
+    const device = await store.get<StoredDevice>(keys.device(options.appId));
+    if (device) await call('POST', `/v1/devices/${device.id}/logout`, undefined, device.secret);
+  },
+
+  /** Stops notifications in this browser altogether. */
+  async unsubscribe(): Promise<void> {
+    if (!supported() || !options.appId) return;
+    const device = await store.get<StoredDevice>(keys.device(options.appId));
+    if (device) {
+      await call('DELETE', `/v1/devices/${device.id}`, undefined, device.secret);
+      await store.remove(keys.device(options.appId));
+    }
+    await store.remove(keys.login(options.appId));
+    const subscription = await registration?.pushManager.getSubscription();
+    await subscription?.unsubscribe();
+  },
+
+  /** A notification was clicked while the site was open. Without a handler the SDK opens its link. Returns an unsubscribe function. */
+  onClick(handler: (click: NotificationClick) => void): () => void {
+    clickHandlers.add(handler);
+    return () => clickHandlers.delete(handler);
+  },
+
+  /** Re-runs the subscription check now (e.g. after the person changed the site's permission). */
+  async refresh(): Promise<void> {
+    if (!supported()) return;
+    await ready;
+    await applyPendingLogin(await syncOnce(true));
+  },
+};
+
+export type { StoredDevice };

package/src/store.ts

@@ -0,0 +1,74 @@
+/**
+ * The SDK's state in IndexedDB, shared with the service worker (which reads `config` to report clicks and to renew a
+ * subscription). Keep the database name, store and keys in step with phoenix-notifications-sw.js.
+ */
+
+const DB_NAME = 'phoenix-notifications';
+const STORE = 'state';
+
+/** What the service worker needs: where to report clicks and the key to subscribe with. */
+export interface StoredConfig {
+  appId: string;
+  serverUrl: string;
+  vapidKey: string;
+}
+
+/** This browser's device record on the server. The secret authenticates every later call for the device. */
+export interface StoredDevice {
+  appId: string;
+  id: string;
+  secret: string;
+  endpoint: string;
+  vapidKey: string;
+  /** When the server last heard from this device (ms), to refresh it about once a day. */
+  syncedAt: number;
+}
+
+/** The user the device was last bound to, so a page load does not log in again with the same token. */
+export interface StoredLogin {
+  appId: string;
+  token: string;
+  at: number;
+}
+
+function open(): Promise<IDBDatabase> {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(DB_NAME, 1);
+    request.onupgradeneeded = () => {
+      if (!request.result.objectStoreNames.contains(STORE)) request.result.createObjectStore(STORE);
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error);
+  });
+}
+
+async function run<T>(mode: IDBTransactionMode, action: (store: IDBObjectStore) => IDBRequest): Promise<T> {
+  const db = await open();
+  try {
+    return await new Promise<T>((resolve, reject) => {
+      const request = action(db.transaction(STORE, mode).objectStore(STORE));
+      request.onsuccess = () => resolve(request.result as T);
+      request.onerror = () => reject(request.error);
+    });
+  } finally {
+    db.close();
+  }
+}
+
+export const store = {
+  get<T>(key: string): Promise<T | undefined> {
+    return run<T | undefined>('readonly', (s) => s.get(key));
+  },
+  set<T>(key: string, value: T): Promise<void> {
+    return run<void>('readwrite', (s) => s.put(value, key));
+  },
+  remove(key: string): Promise<void> {
+    return run<void>('readwrite', (s) => s.delete(key));
+  },
+};
+
+export const keys = {
+  config: 'config',
+  device: (appId: string) => `device:${appId}`,
+  login: (appId: string) => `login:${appId}`,
+};