@rei-standard/amsg-client 2.8.0 → 2.9.0-next.1

package/dist/index.cjs

@@ -97,6 +97,7 @@ var ReiClient = class {
     this._userKey = null;
     this._instantEncryption = instantEncryption;
     this._instantClientToken = typeof config.instantClientToken === "string" && config.instantClientToken ? config.instantClientToken : "";
+    this._serverToken = typeof config.serverToken === "string" && config.serverToken ? config.serverToken : "";
     this._maxPayloadBytes = normalizeMaxPayloadBytes(config.maxPayloadBytes);
     this._lowLevelWarned = /* @__PURE__ */ new Set();
   }
@@ -110,6 +111,17 @@ var ReiClient = class {
   _resolveBaseUrl(endpointName) {
     return this._customBaseUrls[endpointName] || this._baseUrl;
   }
+  /**
+   * Attach the single-user shared secret to amsg-server endpoint requests.
+   * Never applied to the instant path (that uses instantClientToken).
+   * @private
+   * @param {Record<string, string>} headers
+   * @returns {Record<string, string>}
+   */
+  _withServerToken(headers) {
+    if (this._serverToken) headers["X-Client-Token"] = this._serverToken;
+    return headers;
+  }
   // ─── Initialisation ─────────────────────────────────────────────
   /**
    * Fetch the user-specific encryption key.
@@ -128,7 +140,7 @@ var ReiClient = class {
     }
     const res = await fetch(`${this._baseUrl}/get-user-key`, {
       method: "GET",
-      headers: { "X-User-Id": this._userId }
+      headers: this._withServerToken({ "X-User-Id": this._userId })
     });
     const json = await res.json();
     if (!json.success) throw new Error(json.error?.message || "Failed to fetch user key");
@@ -138,6 +150,26 @@ var ReiClient = class {
     }
     this._userKey = this._hexToUint8Array(userKey);
   }
+  /**
+   * Fetch the amsg-server worker's own VAPID public key.
+   *
+   * A browser needs this as `applicationServerKey` when creating a Web Push
+   * subscription. Each self-hosted worker owns its VAPID keypair, so pull the
+   * key at runtime rather than baking it into the frontend. Sends
+   * `X-Client-Token` when a `serverToken` is configured.
+   *
+   * @returns {Promise<string>} The base64url VAPID public key.
+   * @throws {Error} When the worker has no VAPID public key configured (503).
+   */
+  async getVapidPublicKey() {
+    const res = await fetch(`${this._baseUrl}/vapid-public-key`, {
+      method: "GET",
+      headers: this._withServerToken({})
+    });
+    const json = await res.json();
+    if (!json.success) throw new Error(json.error?.message || "Failed to fetch VAPID public key");
+    return json.publicKey;
+  }
   // ─── Public API ─────────────────────────────────────────────────
   /**
    * Schedule a message.
@@ -165,12 +197,12 @@ var ReiClient = class {
     const encrypted = await this._encrypt(json);
     const res = await fetch(`${this._baseUrl}/schedule-message`, {
       method: "POST",
-      headers: {
+      headers: this._withServerToken({
         "Content-Type": "application/json",
         "X-User-Id": this._userId,
         "X-Payload-Encrypted": "true",
         "X-Encryption-Version": "1"
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
     return res.json();
@@ -508,12 +540,12 @@ var ReiClient = class {
     const encrypted = await this._encrypt(json);
     const res = await fetch(`${this._baseUrl}/update-message?id=${encodeURIComponent(uuid)}`, {
       method: "PUT",
-      headers: {
+      headers: this._withServerToken({
         "Content-Type": "application/json",
         "X-User-Id": this._userId,
         "X-Payload-Encrypted": "true",
         "X-Encryption-Version": "1"
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
     return res.json();
@@ -527,7 +559,7 @@ var ReiClient = class {
   async cancelMessage(uuid) {
     const res = await fetch(`${this._baseUrl}/cancel-message?id=${encodeURIComponent(uuid)}`, {
       method: "DELETE",
-      headers: { "X-User-Id": this._userId }
+      headers: this._withServerToken({ "X-User-Id": this._userId })
     });
     return res.json();
   }
@@ -549,11 +581,11 @@ var ReiClient = class {
     const url = `${this._baseUrl}/messages${qs ? "?" + qs : ""}`;
     const res = await fetch(url, {
       method: "GET",
-      headers: {
+      headers: this._withServerToken({
         "X-User-Id": this._userId,
         "X-Response-Encrypted": "true",
         "X-Encryption-Version": "1"
-      }
+      })
     });
     const json = await res.json();
     if (!json?.success || json?.encrypted !== true) return json;

package/dist/index.d.cts

@@ -75,6 +75,11 @@ const TEXT_ENCODER = new TextEncoder();
  *                                                         inside any frontend bundle that uses it, so
  *                                                         devtools can read it. Use for casual URL-direct
  *                                                         abuse only.
+ * @property {string} [serverToken]                       - Optional shared secret for a single-user amsg-server.
+ *                                                         When set, sent as the `X-Client-Token` header on
+ *                                                         amsg-server endpoints (schedule / messages / update /
+ *                                                         cancel / user-key / init). Not applied to the instant
+ *                                                         path (that uses `instantClientToken`).
  * @property {number|null} [maxPayloadBytes=null]        - Optional local UTF-8 byte cap for outgoing request
  *                                                         payloads before encryption. `null` / omitted means
  *                                                         no SDK-level request-size limit.
@@ -367,6 +372,10 @@ class ReiClient {
       ? config.instantClientToken
       : '';
     /** @private */
+    this._serverToken = typeof config.serverToken === 'string' && config.serverToken
+      ? config.serverToken
+      : '';
+    /** @private */
     this._maxPayloadBytes = normalizeMaxPayloadBytes(config.maxPayloadBytes);
     /**
      * Per-instance latch (set of method names already warned). The
@@ -387,6 +396,18 @@ class ReiClient {
     return this._customBaseUrls[endpointName] || this._baseUrl;
   }
 
+  /**
+   * Attach the single-user shared secret to amsg-server endpoint requests.
+   * Never applied to the instant path (that uses instantClientToken).
+   * @private
+   * @param {Record<string, string>} headers
+   * @returns {Record<string, string>}
+   */
+  _withServerToken(headers) {
+    if (this._serverToken) headers['X-Client-Token'] = this._serverToken;
+    return headers;
+  }
+
   // ─── Initialisation ─────────────────────────────────────────────
 
   /**
@@ -407,7 +428,7 @@ class ReiClient {
 
     const res = await fetch(`${this._baseUrl}/get-user-key`, {
       method: 'GET',
-      headers: { 'X-User-Id': this._userId }
+      headers: this._withServerToken({ 'X-User-Id': this._userId })
     });
 
     const json = await res.json();
@@ -421,6 +442,28 @@ class ReiClient {
     this._userKey = this._hexToUint8Array(userKey);
   }
 
+  /**
+   * Fetch the amsg-server worker's own VAPID public key.
+   *
+   * A browser needs this as `applicationServerKey` when creating a Web Push
+   * subscription. Each self-hosted worker owns its VAPID keypair, so pull the
+   * key at runtime rather than baking it into the frontend. Sends
+   * `X-Client-Token` when a `serverToken` is configured.
+   *
+   * @returns {Promise<string>} The base64url VAPID public key.
+   * @throws {Error} When the worker has no VAPID public key configured (503).
+   */
+  async getVapidPublicKey() {
+    const res = await fetch(`${this._baseUrl}/vapid-public-key`, {
+      method: 'GET',
+      headers: this._withServerToken({})
+    });
+
+    const json = await res.json();
+    if (!json.success) throw new Error(json.error?.message || 'Failed to fetch VAPID public key');
+    return json.publicKey;
+  }
+
   // ─── Public API ─────────────────────────────────────────────────
 
   /**
@@ -450,12 +493,12 @@ class ReiClient {
 
     const res = await fetch(`${this._baseUrl}/schedule-message`, {
       method: 'POST',
-      headers: {
+      headers: this._withServerToken({
         'Content-Type': 'application/json',
         'X-User-Id': this._userId,
         'X-Payload-Encrypted': 'true',
         'X-Encryption-Version': '1'
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
 
@@ -883,12 +926,12 @@ class ReiClient {
 
     const res = await fetch(`${this._baseUrl}/update-message?id=${encodeURIComponent(uuid)}`, {
       method: 'PUT',
-      headers: {
+      headers: this._withServerToken({
         'Content-Type': 'application/json',
         'X-User-Id': this._userId,
         'X-Payload-Encrypted': 'true',
         'X-Encryption-Version': '1'
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
 
@@ -904,7 +947,7 @@ class ReiClient {
   async cancelMessage(uuid) {
     const res = await fetch(`${this._baseUrl}/cancel-message?id=${encodeURIComponent(uuid)}`, {
       method: 'DELETE',
-      headers: { 'X-User-Id': this._userId }
+      headers: this._withServerToken({ 'X-User-Id': this._userId })
     });
 
     return res.json();
@@ -930,11 +973,11 @@ class ReiClient {
 
     const res = await fetch(url, {
       method: 'GET',
-      headers: {
+      headers: this._withServerToken({
         'X-User-Id': this._userId,
         'X-Response-Encrypted': 'true',
         'X-Encryption-Version': '1'
-      }
+      })
     });
 
     const json = await res.json();

package/dist/index.d.ts

@@ -75,6 +75,11 @@ const TEXT_ENCODER = new TextEncoder();
  *                                                         inside any frontend bundle that uses it, so
  *                                                         devtools can read it. Use for casual URL-direct
  *                                                         abuse only.
+ * @property {string} [serverToken]                       - Optional shared secret for a single-user amsg-server.
+ *                                                         When set, sent as the `X-Client-Token` header on
+ *                                                         amsg-server endpoints (schedule / messages / update /
+ *                                                         cancel / user-key / init). Not applied to the instant
+ *                                                         path (that uses `instantClientToken`).
  * @property {number|null} [maxPayloadBytes=null]        - Optional local UTF-8 byte cap for outgoing request
  *                                                         payloads before encryption. `null` / omitted means
  *                                                         no SDK-level request-size limit.
@@ -367,6 +372,10 @@ class ReiClient {
       ? config.instantClientToken
       : '';
     /** @private */
+    this._serverToken = typeof config.serverToken === 'string' && config.serverToken
+      ? config.serverToken
+      : '';
+    /** @private */
     this._maxPayloadBytes = normalizeMaxPayloadBytes(config.maxPayloadBytes);
     /**
      * Per-instance latch (set of method names already warned). The
@@ -387,6 +396,18 @@ class ReiClient {
     return this._customBaseUrls[endpointName] || this._baseUrl;
   }
 
+  /**
+   * Attach the single-user shared secret to amsg-server endpoint requests.
+   * Never applied to the instant path (that uses instantClientToken).
+   * @private
+   * @param {Record<string, string>} headers
+   * @returns {Record<string, string>}
+   */
+  _withServerToken(headers) {
+    if (this._serverToken) headers['X-Client-Token'] = this._serverToken;
+    return headers;
+  }
+
   // ─── Initialisation ─────────────────────────────────────────────
 
   /**
@@ -407,7 +428,7 @@ class ReiClient {
 
     const res = await fetch(`${this._baseUrl}/get-user-key`, {
       method: 'GET',
-      headers: { 'X-User-Id': this._userId }
+      headers: this._withServerToken({ 'X-User-Id': this._userId })
     });
 
     const json = await res.json();
@@ -421,6 +442,28 @@ class ReiClient {
     this._userKey = this._hexToUint8Array(userKey);
   }
 
+  /**
+   * Fetch the amsg-server worker's own VAPID public key.
+   *
+   * A browser needs this as `applicationServerKey` when creating a Web Push
+   * subscription. Each self-hosted worker owns its VAPID keypair, so pull the
+   * key at runtime rather than baking it into the frontend. Sends
+   * `X-Client-Token` when a `serverToken` is configured.
+   *
+   * @returns {Promise<string>} The base64url VAPID public key.
+   * @throws {Error} When the worker has no VAPID public key configured (503).
+   */
+  async getVapidPublicKey() {
+    const res = await fetch(`${this._baseUrl}/vapid-public-key`, {
+      method: 'GET',
+      headers: this._withServerToken({})
+    });
+
+    const json = await res.json();
+    if (!json.success) throw new Error(json.error?.message || 'Failed to fetch VAPID public key');
+    return json.publicKey;
+  }
+
   // ─── Public API ─────────────────────────────────────────────────
 
   /**
@@ -450,12 +493,12 @@ class ReiClient {
 
     const res = await fetch(`${this._baseUrl}/schedule-message`, {
       method: 'POST',
-      headers: {
+      headers: this._withServerToken({
         'Content-Type': 'application/json',
         'X-User-Id': this._userId,
         'X-Payload-Encrypted': 'true',
         'X-Encryption-Version': '1'
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
 
@@ -883,12 +926,12 @@ class ReiClient {
 
     const res = await fetch(`${this._baseUrl}/update-message?id=${encodeURIComponent(uuid)}`, {
       method: 'PUT',
-      headers: {
+      headers: this._withServerToken({
         'Content-Type': 'application/json',
         'X-User-Id': this._userId,
         'X-Payload-Encrypted': 'true',
         'X-Encryption-Version': '1'
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
 
@@ -904,7 +947,7 @@ class ReiClient {
   async cancelMessage(uuid) {
     const res = await fetch(`${this._baseUrl}/cancel-message?id=${encodeURIComponent(uuid)}`, {
       method: 'DELETE',
-      headers: { 'X-User-Id': this._userId }
+      headers: this._withServerToken({ 'X-User-Id': this._userId })
     });
 
     return res.json();
@@ -930,11 +973,11 @@ class ReiClient {
 
     const res = await fetch(url, {
       method: 'GET',
-      headers: {
+      headers: this._withServerToken({
         'X-User-Id': this._userId,
         'X-Response-Encrypted': 'true',
         'X-Encryption-Version': '1'
-      }
+      })
     });
 
     const json = await res.json();

package/dist/index.mjs

@@ -75,6 +75,7 @@ var ReiClient = class {
     this._userKey = null;
     this._instantEncryption = instantEncryption;
     this._instantClientToken = typeof config.instantClientToken === "string" && config.instantClientToken ? config.instantClientToken : "";
+    this._serverToken = typeof config.serverToken === "string" && config.serverToken ? config.serverToken : "";
     this._maxPayloadBytes = normalizeMaxPayloadBytes(config.maxPayloadBytes);
     this._lowLevelWarned = /* @__PURE__ */ new Set();
   }
@@ -88,6 +89,17 @@ var ReiClient = class {
   _resolveBaseUrl(endpointName) {
     return this._customBaseUrls[endpointName] || this._baseUrl;
   }
+  /**
+   * Attach the single-user shared secret to amsg-server endpoint requests.
+   * Never applied to the instant path (that uses instantClientToken).
+   * @private
+   * @param {Record<string, string>} headers
+   * @returns {Record<string, string>}
+   */
+  _withServerToken(headers) {
+    if (this._serverToken) headers["X-Client-Token"] = this._serverToken;
+    return headers;
+  }
   // ─── Initialisation ─────────────────────────────────────────────
   /**
    * Fetch the user-specific encryption key.
@@ -106,7 +118,7 @@ var ReiClient = class {
     }
     const res = await fetch(`${this._baseUrl}/get-user-key`, {
       method: "GET",
-      headers: { "X-User-Id": this._userId }
+      headers: this._withServerToken({ "X-User-Id": this._userId })
     });
     const json = await res.json();
     if (!json.success) throw new Error(json.error?.message || "Failed to fetch user key");
@@ -116,6 +128,26 @@ var ReiClient = class {
     }
     this._userKey = this._hexToUint8Array(userKey);
   }
+  /**
+   * Fetch the amsg-server worker's own VAPID public key.
+   *
+   * A browser needs this as `applicationServerKey` when creating a Web Push
+   * subscription. Each self-hosted worker owns its VAPID keypair, so pull the
+   * key at runtime rather than baking it into the frontend. Sends
+   * `X-Client-Token` when a `serverToken` is configured.
+   *
+   * @returns {Promise<string>} The base64url VAPID public key.
+   * @throws {Error} When the worker has no VAPID public key configured (503).
+   */
+  async getVapidPublicKey() {
+    const res = await fetch(`${this._baseUrl}/vapid-public-key`, {
+      method: "GET",
+      headers: this._withServerToken({})
+    });
+    const json = await res.json();
+    if (!json.success) throw new Error(json.error?.message || "Failed to fetch VAPID public key");
+    return json.publicKey;
+  }
   // ─── Public API ─────────────────────────────────────────────────
   /**
    * Schedule a message.
@@ -143,12 +175,12 @@ var ReiClient = class {
     const encrypted = await this._encrypt(json);
     const res = await fetch(`${this._baseUrl}/schedule-message`, {
       method: "POST",
-      headers: {
+      headers: this._withServerToken({
         "Content-Type": "application/json",
         "X-User-Id": this._userId,
         "X-Payload-Encrypted": "true",
         "X-Encryption-Version": "1"
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
     return res.json();
@@ -486,12 +518,12 @@ var ReiClient = class {
     const encrypted = await this._encrypt(json);
     const res = await fetch(`${this._baseUrl}/update-message?id=${encodeURIComponent(uuid)}`, {
       method: "PUT",
-      headers: {
+      headers: this._withServerToken({
         "Content-Type": "application/json",
         "X-User-Id": this._userId,
         "X-Payload-Encrypted": "true",
         "X-Encryption-Version": "1"
-      },
+      }),
       body: JSON.stringify(encrypted)
     });
     return res.json();
@@ -505,7 +537,7 @@ var ReiClient = class {
   async cancelMessage(uuid) {
     const res = await fetch(`${this._baseUrl}/cancel-message?id=${encodeURIComponent(uuid)}`, {
       method: "DELETE",
-      headers: { "X-User-Id": this._userId }
+      headers: this._withServerToken({ "X-User-Id": this._userId })
     });
     return res.json();
   }
@@ -527,11 +559,11 @@ var ReiClient = class {
     const url = `${this._baseUrl}/messages${qs ? "?" + qs : ""}`;
     const res = await fetch(url, {
       method: "GET",
-      headers: {
+      headers: this._withServerToken({
         "X-User-Id": this._userId,
         "X-Response-Encrypted": "true",
         "X-Encryption-Version": "1"
-      }
+      })
     });
     const json = await res.json();
     if (!json?.success || json?.encrypted !== true) return json;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rei-standard/amsg-client",
-  "version": "2.8.0",
+  "version": "2.9.0-next.1",
   "description": "ReiStandard Active Messaging browser client SDK — also re-exports shared push types, builders, and guards from @rei-standard/amsg-shared",
   "repository": {
     "type": "git",