@serfab/cadre-core 0.7.1 → 0.9.0

package/dist/push-node.js

@@ -0,0 +1,48 @@
+/**
+ * push-node.ts — Node-only subpath entry for platform push **construction**.
+ *
+ * Import from the dedicated subpath, never the package root:
+ *
+ * ```ts
+ * import { createPushNotifier } from '@serfab/cadre-core/push-node';
+ * ```
+ *
+ * The FCM/APNs implementations reach for `node:crypto` / `node:http2`, so they
+ * are quarantined here — unreachable from the cross-platform `./index.js` graph
+ * (same isolation pattern as `./key-store-file`). A React Native / browser entry
+ * never resolves this path, so the Node builtins never reach a bundler that
+ * cannot satisfy them. The core references only the {@link PushNotifier}
+ * *interface* (`push-notifier.ts`) and a Node host injects the instance built
+ * here into `CadreNodeConfig.push.notifier`.
+ */
+import { createFcmPushNotifier } from './push-notifier-fcm.js';
+import { createApnsPushNotifier } from './push-notifier-apns.js';
+/**
+ * Build a {@link PushNotifier} router over the configured credentials. Only the
+ * platforms whose credentials are present get a backing implementation; a `send`
+ * for an unconfigured platform returns a best-effort `no <platform> credentials`
+ * failure rather than throwing.
+ */
+export function createPushNotifier(creds, deps = {}) {
+    const fcm = creds.fcm ? createFcmPushNotifier(creds.fcm, deps.fcm) : undefined;
+    const apns = creds.apns ? createApnsPushNotifier(creds.apns, deps.apns) : undefined;
+    async function send(msg) {
+        if (msg.platform === 'fcm')
+            return fcm ? fcm.send(msg) : noCreds('fcm');
+        if (msg.platform === 'apns')
+            return apns ? apns.send(msg) : noCreds('apns');
+        return { ok: false, unregistered: false, error: `unknown platform ${String(msg.platform)}` };
+    }
+    async function close() {
+        await Promise.all([fcm?.close(), apns?.close()]);
+    }
+    return { send, close };
+}
+/** Best-effort no-op result for a platform with no configured credentials. */
+function noCreds(platform) {
+    return { ok: false, unregistered: false, error: `no ${platform} credentials` };
+}
+// Per-platform builders + their injected-dep types, for a host that wants a
+// single-platform notifier or to inject a fake transport directly.
+export { createFcmPushNotifier, createApnsPushNotifier };
+//# sourceMappingURL=push-node.js.map

package/dist/push-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-node.js","sourceRoot":"","sources":["../src/push-node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAqB,MAAM,yBAAyB,CAAC;AAWpF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAE,OAAyB,EAAE;IACpF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpF,KAAK,UAAU,IAAI,CAAC,GAAgB;QAClC,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC/F,CAAC;IAED,KAAK,UAAU,KAAK;QAClB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,8EAA8E;AAC9E,SAAS,OAAO,CAAC,QAAsB;IACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,cAAc,EAAE,CAAC;AACjF,CAAC;AAED,4EAA4E;AAC5E,mEAAmE;AACnE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/push-notifier-apns.d.ts

@@ -0,0 +1,61 @@
+/**
+ * push-notifier-apns.ts — APNs HTTP/2 strand-wake delivery.
+ *
+ * Node-only: signs a provider JWT (ES256, JOSE raw r‖s via `node:crypto`) and
+ * sends a background data push over an HTTP/2 session to Apple's gateway. APNs
+ * mandates HTTP/2, so `node:http2` is unavoidable here — one reason the push
+ * path is injected rather than rebuilt on WebCrypto/`fetch`.
+ *
+ * Reachable only through the `@serfab/cadre-core/push-node` subpath — never from
+ * the cross-platform `./index.js` graph — so the `node:crypto` / `node:http2`
+ * imports below are safe: no RN/browser bundler ever resolves this module. (Plain
+ * named imports; the old namespace-import-to-only-warn dance is obsolete now that
+ * the module is unreachable from a browser build by construction.)
+ *
+ * The HTTP/2 call is behind an injected `Http2Requester` seam (bundled with a
+ * `close` into an {@link ApnsTransport}) so unit tests assert the request shape
+ * and map every documented response code with no real network and no credentials.
+ * The default transport owns a single lazily-(re)established `node:http2` session.
+ *
+ * Two single-shot retries guard transient failure without a retry storm: a
+ * thrown transport error (session death / GOAWAY mid-send) re-establishes the
+ * session and retries the one request once; a 403 `ExpiredProviderToken`
+ * re-mints the provider JWT and retries once. A second failure is returned as-is.
+ *
+ * Secret hygiene: the `.p8` `privateKey`, the minted JWT, and full device tokens
+ * are never logged — failure log lines carry only a status/reason and a redacted
+ * token prefix.
+ */
+import type { ApnsCredentials } from './types.js';
+import type { PushNotifier } from './push-notifier.js';
+/** Raw HTTP/2 response: APNs `:status` and the (possibly empty) JSON body. */
+export interface ApnsResponse {
+    status: number;
+    body: string;
+}
+/** A single APNs HTTP/2 request — `:path`, headers, and the JSON body. */
+export interface ApnsRequest {
+    /** `:path`, e.g. `/3/device/{token}`. */
+    path: string;
+    headers: Record<string, string>;
+    body: string;
+}
+/**
+ * Low-level HTTP/2 request seam. Resolves with the `(status, body)` pair; rejects
+ * (throws) on a session/transport failure so the caller can re-establish + retry.
+ */
+export type Http2Requester = (req: ApnsRequest) => Promise<ApnsResponse>;
+/** The HTTP/2 request seam plus its session-teardown. */
+export interface ApnsTransport {
+    request: Http2Requester;
+    close(): Promise<void>;
+}
+export interface ApnsPushDeps {
+    /** HTTP/2 transport. Defaults to a real `node:http2` session manager. */
+    transport?: ApnsTransport;
+    /** Monotonic clock (ms). Defaults to `Date.now`. Injected for token-cache tests. */
+    now?: () => number;
+    /** Failure log seam (default: `debug('sereus:cadre:push:apns')`). */
+    log?: (line: string) => void;
+}
+export declare function createApnsPushNotifier(creds: ApnsCredentials, deps?: ApnsPushDeps): PushNotifier;

package/dist/push-notifier-apns.js

@@ -0,0 +1,199 @@
+/**
+ * push-notifier-apns.ts — APNs HTTP/2 strand-wake delivery.
+ *
+ * Node-only: signs a provider JWT (ES256, JOSE raw r‖s via `node:crypto`) and
+ * sends a background data push over an HTTP/2 session to Apple's gateway. APNs
+ * mandates HTTP/2, so `node:http2` is unavoidable here — one reason the push
+ * path is injected rather than rebuilt on WebCrypto/`fetch`.
+ *
+ * Reachable only through the `@serfab/cadre-core/push-node` subpath — never from
+ * the cross-platform `./index.js` graph — so the `node:crypto` / `node:http2`
+ * imports below are safe: no RN/browser bundler ever resolves this module. (Plain
+ * named imports; the old namespace-import-to-only-warn dance is obsolete now that
+ * the module is unreachable from a browser build by construction.)
+ *
+ * The HTTP/2 call is behind an injected `Http2Requester` seam (bundled with a
+ * `close` into an {@link ApnsTransport}) so unit tests assert the request shape
+ * and map every documented response code with no real network and no credentials.
+ * The default transport owns a single lazily-(re)established `node:http2` session.
+ *
+ * Two single-shot retries guard transient failure without a retry storm: a
+ * thrown transport error (session death / GOAWAY mid-send) re-establishes the
+ * session and retries the one request once; a 403 `ExpiredProviderToken`
+ * re-mints the provider JWT and retries once. A second failure is returned as-is.
+ *
+ * Secret hygiene: the `.p8` `privateKey`, the minted JWT, and full device tokens
+ * are never logged — failure log lines carry only a status/reason and a redacted
+ * token prefix.
+ */
+import { sign } from 'node:crypto';
+import { connect } from 'node:http2';
+import debug from 'debug';
+import { MAX_REASON_LEN, b64urlJson, errText, redact } from './push-notifier-shared.js';
+const APNS_PROD_HOST = 'https://api.push.apple.com';
+const APNS_SANDBOX_HOST = 'https://api.sandbox.push.apple.com';
+/** Apple requires the provider token be 20–60 min old; refresh well inside that. */
+const PROVIDER_TOKEN_TTL_MS = 45 * 60000;
+const debugApns = debug('sereus:cadre:push:apns');
+export function createApnsPushNotifier(creds, deps = {}) {
+    const host = creds.production ? APNS_PROD_HOST : APNS_SANDBOX_HOST;
+    const transport = deps.transport ?? createHttp2Transport(host);
+    const now = deps.now ?? (() => Date.now());
+    const log = deps.log ?? ((line) => debugApns(line));
+    let cached = null;
+    async function send(msg) {
+        let jwt;
+        try {
+            jwt = providerToken(false);
+        }
+        catch (err) {
+            log(`provider-token mint failed: ${errText(err)}`);
+            return { ok: false, unregistered: false, error: `apns jwt mint failed: ${errText(err)}` };
+        }
+        let res = await tryRequest(msg, jwt);
+        if (!res)
+            return { ok: false, unregistered: false, error: `apns transport failed (token=${redact(msg.token)})` };
+        // Provider token expired mid-flight — re-mint once and retry the single send.
+        if (res.status === 403 && /ExpiredProviderToken/i.test(res.body)) {
+            try {
+                jwt = providerToken(true);
+            }
+            catch (err) {
+                log(`provider-token re-mint failed: ${errText(err)}`);
+                return { ok: false, unregistered: false, error: `apns jwt re-mint failed: ${errText(err)}` };
+            }
+            res = await tryRequest(msg, jwt);
+            if (!res)
+                return { ok: false, unregistered: false, error: `apns transport failed (token=${redact(msg.token)})` };
+        }
+        return mapResult(res, msg.token);
+    }
+    /**
+     * Send one request with a single re-establish-on-throw retry. A thrown error is
+     * a session death / GOAWAY; the default transport recreates its session lazily
+     * on the next call, so a second attempt rides a fresh session. Returns `null`
+     * when both attempts throw.
+     */
+    async function tryRequest(msg, jwt) {
+        const req = buildRequest(msg, jwt);
+        try {
+            return await transport.request(req);
+        }
+        catch (err1) {
+            log(`http2 request failed, re-establishing once: ${errText(err1)}`);
+            try {
+                return await transport.request(req);
+            }
+            catch (err2) {
+                log(`http2 request failed after re-establish: ${errText(err2)}`);
+                return null;
+            }
+        }
+    }
+    function mapResult(res, deviceToken) {
+        if (res.status === 200)
+            return { ok: true };
+        const reason = apnsReason(res.body);
+        const summary = `apns ${res.status}${reason ? ` ${reason}` : ''}`;
+        if (res.status === 410 || reason === 'Unregistered' || (res.status === 400 && reason === 'BadDeviceToken')) {
+            log(`unregistered token=${redact(deviceToken)} (${summary})`);
+            return { ok: false, unregistered: true, error: summary };
+        }
+        log(`send failed token=${redact(deviceToken)} (${summary})`);
+        return { ok: false, unregistered: false, error: summary };
+    }
+    function buildRequest(msg, jwt) {
+        const body = JSON.stringify({
+            aps: { 'content-available': 1 },
+            type: msg.payload.type,
+            strandId: msg.payload.strandId,
+            reason: msg.payload.reason.slice(0, MAX_REASON_LEN),
+        });
+        return {
+            path: `/3/device/${msg.token}`,
+            headers: {
+                authorization: `bearer ${jwt}`,
+                'apns-topic': creds.bundleId,
+                'apns-push-type': 'background',
+                'apns-priority': '5',
+                'apns-expiration': '0',
+            },
+            body,
+        };
+    }
+    function providerToken(forceRefresh) {
+        if (!forceRefresh && cached && cached.expiresAt > now())
+            return cached.value;
+        const iat = Math.floor(now() / 1000);
+        const header = { alg: 'ES256', kid: creds.keyId };
+        const claims = { iss: creds.teamId, iat };
+        const signingInput = `${b64urlJson(header)}.${b64urlJson(claims)}`;
+        const sig = sign('SHA256', Buffer.from(signingInput), {
+            key: creds.privateKey,
+            dsaEncoding: 'ieee-p1363',
+        }).toString('base64url');
+        const jwt = `${signingInput}.${sig}`;
+        cached = { value: jwt, expiresAt: now() + PROVIDER_TOKEN_TTL_MS };
+        return jwt;
+    }
+    async function close() {
+        cached = null;
+        await transport.close();
+    }
+    return { send, close };
+}
+/**
+ * Default {@link ApnsTransport}: a single lazily-(re)established `node:http2`
+ * session to Apple's gateway. A session that errors / receives GOAWAY / closes is
+ * dropped so the next request re-establishes it. Not exercised by unit tests (no
+ * network) — tests inject a fake transport; the real path is validated out-of-band.
+ */
+function createHttp2Transport(host) {
+    let session = null;
+    function ensureSession() {
+        if (session && !session.closed && !session.destroyed)
+            return session;
+        const s = connect(host);
+        // Drop a dead session so ensureSession recreates it on the next request.
+        s.on('error', () => { if (session === s)
+            session = null; });
+        s.on('goaway', () => { s.destroy(); });
+        s.on('close', () => { if (session === s)
+            session = null; });
+        session = s;
+        return s;
+    }
+    async function request(req) {
+        const s = ensureSession();
+        return await new Promise((resolve, reject) => {
+            const stream = s.request({ ':method': 'POST', ':path': req.path, ...req.headers });
+            const chunks = [];
+            let status = 0;
+            stream.on('response', (headers) => { status = Number(headers[':status'] ?? 0); });
+            stream.on('data', (chunk) => chunks.push(chunk));
+            stream.on('end', () => resolve({ status, body: Buffer.concat(chunks).toString('utf8') }));
+            stream.on('error', (err) => reject(err));
+            stream.end(req.body);
+        });
+    }
+    async function close() {
+        const s = session;
+        session = null;
+        if (s)
+            await new Promise((resolve) => s.close(() => resolve()));
+    }
+    return { request, close };
+}
+/** Extract the APNs error `reason` field from a response body, if present. */
+function apnsReason(body) {
+    if (!body)
+        return null;
+    try {
+        const parsed = JSON.parse(body);
+        return typeof parsed.reason === 'string' ? parsed.reason : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=push-notifier-apns.js.map

package/dist/push-notifier-apns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-notifier-apns.js","sourceRoot":"","sources":["../src/push-notifier-apns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,OAAO,EAA2B,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAExF,MAAM,cAAc,GAAG,4BAA4B,CAAC;AACpD,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAC/D,oFAAoF;AACpF,MAAM,qBAAqB,GAAG,EAAE,GAAG,KAAM,CAAC;AAE1C,MAAM,SAAS,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;AA2ClD,MAAM,UAAU,sBAAsB,CAAC,KAAsB,EAAE,OAAqB,EAAE;IACpF,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,IAAI,MAAM,GAA+B,IAAI,CAAC;IAE9C,KAAK,UAAU,IAAI,CAAC,GAAgB;QAClC,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,+BAA+B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC5F,CAAC;QAED,IAAI,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAEjH,8EAA8E;QAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC;gBACH,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,kCAAkC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAC/F,CAAC;YACD,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnH,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,UAAU,CAAC,GAAgB,EAAE,GAAW;QACrD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,+CAA+C,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC;gBACH,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,IAAI,EAAE,CAAC;gBACd,GAAG,CAAC,4CAA4C,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,SAAS,CAAC,GAAiB,EAAE,WAAmB;QACvD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAClE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,cAAc,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,gBAAgB,CAAC,EAAE,CAAC;YAC3G,GAAG,CAAC,sBAAsB,MAAM,CAAC,WAAW,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC3D,CAAC;QACD,GAAG,CAAC,qBAAqB,MAAM,CAAC,WAAW,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED,SAAS,YAAY,CAAC,GAAgB,EAAE,GAAW;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,GAAG,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE;YAC/B,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;YACtB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;YAC9B,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC;SACpD,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,aAAa,GAAG,CAAC,KAAK,EAAE;YAC9B,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,EAAE;gBAC9B,YAAY,EAAE,KAAK,CAAC,QAAQ;gBAC5B,gBAAgB,EAAE,YAAY;gBAC9B,eAAe,EAAE,GAAG;gBACpB,iBAAiB,EAAE,GAAG;aACvB;YACD,IAAI;SACL,CAAC;IACJ,CAAC;IAED,SAAS,aAAa,CAAC,YAAqB;QAC1C,IAAI,CAAC,YAAY,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE;YACpD,GAAG,EAAE,KAAK,CAAC,UAAU;YACrB,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,GAAG,EAAE,CAAC;QACrC,MAAM,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,qBAAqB,EAAE,CAAC;QAClE,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,UAAU,KAAK;QAClB,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,OAAO,GAA8B,IAAI,CAAC;IAE9C,SAAS,aAAa;QACpB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC;QACrE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxB,yEAAyE;QACzE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,OAAO,GAAG,CAAC,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,GAAgB;QACrC,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;QAC1B,OAAO,MAAM,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1F,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,KAAK;QAClB,MAAM,CAAC,GAAG,OAAO,CAAC;QAClB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;QACxD,OAAO,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/push-notifier-fcm.d.ts

@@ -0,0 +1,44 @@
+/**
+ * push-notifier-fcm.ts — FCM HTTP v1 strand-wake delivery.
+ *
+ * Node-only: mints a Google OAuth2 access token (RS256 JWT bearer grant signed
+ * with `node:crypto`) and POSTs a data message to the FCM v1 endpoint. The legacy
+ * server-key `fcm.googleapis.com/fcm/send` API is deprecated, so we use HTTP v1.
+ *
+ * Reachable only through the `@serfab/cadre-core/push-node` subpath — never from
+ * the cross-platform `./index.js` graph — so the `node:crypto` import below is
+ * safe: no RN/browser bundler ever resolves this module. (Plain named import;
+ * the old namespace-import-to-only-warn dance is obsolete now that the module is
+ * unreachable from a browser build by construction.)
+ *
+ * The network call is behind an injected `fetch`-like seam so unit tests assert
+ * the request shape and map every documented response code with no real network
+ * and no credentials. Failures are returned as {@link PushSendResult} values.
+ *
+ * Secret hygiene: the service-account `privateKey`, the minted JWT, and full
+ * device tokens are never logged — failure log lines carry only a status/error
+ * code and a redacted token prefix.
+ */
+import type { FcmCredentials } from './types.js';
+import type { PushNotifier } from './push-notifier.js';
+/** Minimal `fetch` Response shape the FCM sender consumes. */
+export interface FcmResponseLike {
+    status: number;
+    json(): Promise<unknown>;
+    text(): Promise<string>;
+}
+/** Injected `fetch`-like transport (default: global `fetch`). */
+export type FcmFetch = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+}) => Promise<FcmResponseLike>;
+export interface FcmPushDeps {
+    /** Network transport. Defaults to global `fetch`. */
+    fetch?: FcmFetch;
+    /** Monotonic clock (ms). Defaults to `Date.now`. Injected for cache tests. */
+    now?: () => number;
+    /** Failure log seam (default: `debug('sereus:cadre:push:fcm')`). */
+    log?: (line: string) => void;
+}
+export declare function createFcmPushNotifier(creds: FcmCredentials, deps?: FcmPushDeps): PushNotifier;

package/dist/push-notifier-fcm.js

@@ -0,0 +1,182 @@
+/**
+ * push-notifier-fcm.ts — FCM HTTP v1 strand-wake delivery.
+ *
+ * Node-only: mints a Google OAuth2 access token (RS256 JWT bearer grant signed
+ * with `node:crypto`) and POSTs a data message to the FCM v1 endpoint. The legacy
+ * server-key `fcm.googleapis.com/fcm/send` API is deprecated, so we use HTTP v1.
+ *
+ * Reachable only through the `@serfab/cadre-core/push-node` subpath — never from
+ * the cross-platform `./index.js` graph — so the `node:crypto` import below is
+ * safe: no RN/browser bundler ever resolves this module. (Plain named import;
+ * the old namespace-import-to-only-warn dance is obsolete now that the module is
+ * unreachable from a browser build by construction.)
+ *
+ * The network call is behind an injected `fetch`-like seam so unit tests assert
+ * the request shape and map every documented response code with no real network
+ * and no credentials. Failures are returned as {@link PushSendResult} values.
+ *
+ * Secret hygiene: the service-account `privateKey`, the minted JWT, and full
+ * device tokens are never logged — failure log lines carry only a status/error
+ * code and a redacted token prefix.
+ */
+import { sign } from 'node:crypto';
+import debug from 'debug';
+import { MAX_REASON_LEN, b64urlJson, errText, redact } from './push-notifier-shared.js';
+const TOKEN_ENDPOINT = 'https://oauth2.googleapis.com/token';
+const FCM_SCOPE = 'https://www.googleapis.com/auth/firebase.messaging';
+const JWT_BEARER_GRANT = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
+/** Re-mint the access token this many ms before its stated expiry. */
+const TOKEN_REFRESH_SKEW_MS = 60000;
+/** OAuth2 access tokens are short-lived (≤1h); assume 1h when unstated. */
+const DEFAULT_TOKEN_TTL_MS = 3600000;
+const debugFcm = debug('sereus:cadre:push:fcm');
+export function createFcmPushNotifier(creds, deps = {}) {
+    const doFetch = deps.fetch ?? ((url, init) => fetch(url, init));
+    const now = deps.now ?? (() => Date.now());
+    const log = deps.log ?? ((line) => debugFcm(line));
+    const sendUrl = `https://fcm.googleapis.com/v1/projects/${creds.projectId}/messages:send`;
+    let cached = null;
+    async function send(msg) {
+        let token;
+        try {
+            token = await accessToken(false);
+        }
+        catch (err) {
+            log(`oauth mint failed: ${errText(err)}`);
+            return { ok: false, unregistered: false, error: `fcm oauth mint failed: ${errText(err)}` };
+        }
+        const first = await postSend(msg, token);
+        if (first.status !== 401)
+            return mapResult(first, msg.token);
+        // The cached access token was rejected (expired/revoked mid-flight). Re-mint
+        // once and retry the single send; a second failure is returned as-is.
+        let retryToken;
+        try {
+            retryToken = await accessToken(true);
+        }
+        catch (err) {
+            log(`oauth re-mint failed: ${errText(err)}`);
+            return { ok: false, unregistered: false, error: `fcm oauth re-mint failed: ${errText(err)}` };
+        }
+        return mapResult(await postSend(msg, retryToken), msg.token);
+    }
+    async function postSend(msg, token) {
+        const body = JSON.stringify({
+            message: {
+                token: msg.token,
+                data: {
+                    type: msg.payload.type,
+                    strandId: msg.payload.strandId,
+                    reason: msg.payload.reason.slice(0, MAX_REASON_LEN),
+                },
+                android: { priority: 'high' },
+            },
+        });
+        const res = await doFetch(sendUrl, {
+            method: 'POST',
+            headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
+            body,
+        });
+        return { status: res.status, body: await safeText(res) };
+    }
+    function mapResult(res, deviceToken) {
+        if (res.status === 200)
+            return { ok: true };
+        const summary = errorSummary(res.status, res.body);
+        if (isUnregistered(res.status, res.body)) {
+            log(`unregistered token=${redact(deviceToken)} (${summary})`);
+            return { ok: false, unregistered: true, error: summary };
+        }
+        log(`send failed token=${redact(deviceToken)} (${summary})`);
+        return { ok: false, unregistered: false, error: summary };
+    }
+    async function accessToken(forceRefresh) {
+        if (!forceRefresh && cached && cached.expiresAt > now())
+            return cached.value;
+        cached = null;
+        const minted = await mintAccessToken();
+        cached = { value: minted.value, expiresAt: now() + minted.ttlMs - TOKEN_REFRESH_SKEW_MS };
+        return minted.value;
+    }
+    async function mintAccessToken() {
+        const jwt = signOauthJwt();
+        const res = await doFetch(TOKEN_ENDPOINT, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: `grant_type=${encodeURIComponent(JWT_BEARER_GRANT)}&assertion=${encodeURIComponent(jwt)}`,
+        });
+        if (res.status !== 200) {
+            throw new Error(`token endpoint ${res.status}: ${await safeText(res)}`);
+        }
+        const parsed = (await res.json());
+        if (typeof parsed.access_token !== 'string') {
+            throw new Error('token endpoint returned no access_token');
+        }
+        const ttlMs = typeof parsed.expires_in === 'number' ? parsed.expires_in * 1000 : DEFAULT_TOKEN_TTL_MS;
+        return { value: parsed.access_token, ttlMs };
+    }
+    function signOauthJwt() {
+        const iat = Math.floor(now() / 1000);
+        const header = { alg: 'RS256', typ: 'JWT' };
+        const claims = {
+            iss: creds.clientEmail,
+            sub: creds.clientEmail,
+            scope: FCM_SCOPE,
+            aud: TOKEN_ENDPOINT,
+            iat,
+            exp: iat + 3600,
+        };
+        const signingInput = `${b64urlJson(header)}.${b64urlJson(claims)}`;
+        const sig = sign('RSA-SHA256', Buffer.from(signingInput), creds.privateKey).toString('base64url');
+        return `${signingInput}.${sig}`;
+    }
+    async function close() {
+        cached = null;
+    }
+    return { send, close };
+}
+/**
+ * Whether an FCM v1 error response names a permanently-invalid registration
+ * token: a 404 (`UNREGISTERED`), or a 400 `INVALID_ARGUMENT` whose message names
+ * the registration token. A generic 400 (malformed message) is NOT unregistered.
+ */
+function isUnregistered(status, body) {
+    if (status === 404)
+        return true;
+    if (status !== 400)
+        return false;
+    const code = fcmErrorCode(body);
+    if (code === 'UNREGISTERED')
+        return true;
+    if (code === 'INVALID_ARGUMENT' && /registration[ -]token|not a valid fcm registration/i.test(body))
+        return true;
+    return false;
+}
+/** Pull the FCM `errorCode` (FcmError detail) or RPC `status` out of the body. */
+function fcmErrorCode(body) {
+    try {
+        const parsed = JSON.parse(body);
+        const err = parsed.error;
+        if (!err)
+            return null;
+        const detailCode = err.details?.find((d) => typeof d.errorCode === 'string')?.errorCode;
+        return detailCode ?? err.status ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** A secret-free one-line error summary (status + error code, never the token). */
+function errorSummary(status, body) {
+    const code = fcmErrorCode(body);
+    return code ? `fcm ${status} ${code}` : `fcm ${status}`;
+}
+async function safeText(res) {
+    try {
+        return await res.text();
+    }
+    catch {
+        return '';
+    }
+}
+//# sourceMappingURL=push-notifier-fcm.js.map

package/dist/push-notifier-fcm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-notifier-fcm.js","sourceRoot":"","sources":["../src/push-notifier-fcm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAExF,MAAM,cAAc,GAAG,qCAAqC,CAAC;AAC7D,MAAM,SAAS,GAAG,oDAAoD,CAAC;AACvE,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AACvE,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,KAAM,CAAC;AACrC,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,OAAS,CAAC;AAEvC,MAAM,QAAQ,GAAG,KAAK,CAAC,uBAAuB,CAAC,CAAC;AA8BhD,MAAM,UAAU,qBAAqB,CAAC,KAAqB,EAAE,OAAoB,EAAE;IACjF,MAAM,OAAO,GAAa,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,0CAA0C,KAAK,CAAC,SAAS,gBAAgB,CAAC;IAE1F,IAAI,MAAM,GAA6B,IAAI,CAAC;IAE5C,KAAK,UAAU,IAAI,CAAC,GAAgB;QAClC,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,sBAAsB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC7F,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAE7D,6EAA6E;QAC7E,sEAAsE;QACtE,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,yBAAyB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAChG,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,GAAgB,EAAE,KAAa;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,OAAO,EAAE;gBACP,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE;oBACJ,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;oBACtB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;oBAC9B,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC;iBACpD;gBACD,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;aAC9B;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjF,IAAI;SACL,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3D,CAAC;IAED,SAAS,SAAS,CAAC,GAAqC,EAAE,WAAmB;QAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,sBAAsB,MAAM,CAAC,WAAW,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC3D,CAAC;QACD,GAAG,CAAC,qBAAqB,MAAM,CAAC,WAAW,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,YAAqB;QAC9C,IAAI,CAAC,YAAY,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAC7E,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;QACvC,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,GAAG,qBAAqB,EAAE,CAAC;QAC1F,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,KAAK,UAAU,eAAe;QAC5B,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,cAAc,kBAAkB,CAAC,gBAAgB,CAAC,cAAc,kBAAkB,CAAC,GAAG,CAAC,EAAE;SAChG,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,MAAM,KAAK,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqD,CAAC;QACtF,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACtG,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;IAED,SAAS,YAAY;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG;YACb,GAAG,EAAE,KAAK,CAAC,WAAW;YACtB,GAAG,EAAE,KAAK,CAAC,WAAW;YACtB,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,cAAc;YACnB,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,IAAI;SAChB,CAAC;QACF,MAAM,YAAY,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClG,OAAO,GAAG,YAAY,IAAI,GAAG,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,UAAU,KAAK;QAClB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAc,EAAE,IAAY;IAClD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,KAAK,kBAAkB,IAAI,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAE7B,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,EAAE,SAAS,CAAC;QACxF,OAAO,UAAU,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY;IAChD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/push-notifier-shared.d.ts

@@ -0,0 +1,18 @@
+/**
+ * push-notifier-shared.ts — internal helpers shared by the FCM and APNs
+ * push-notifier implementations. Server-only (used only by modules that already
+ * reach for `node:crypto` / `node:http2`); never re-exported from the package
+ * entry. Centralized so the secret-redaction and payload-bounding rules have a
+ * single, hardenable source rather than drifting between the two transports.
+ */
+/** Defensive cap on the free-form `reason` carried in a strand-wake payload. */
+export declare const MAX_REASON_LEN = 256;
+/** Base64url-encode the JSON form of an object (JWT header/claims segments). */
+export declare function b64urlJson(obj: unknown): string;
+/** A short, secret-free string for an unknown thrown value. */
+export declare function errText(err: unknown): string;
+/**
+ * Redact a device token to a short, non-reversible prefix for debug lines — the
+ * full FCM/APNs token is a secret and must never reach a log.
+ */
+export declare function redact(token: string): string;

package/dist/push-notifier-shared.js

@@ -0,0 +1,25 @@
+/**
+ * push-notifier-shared.ts — internal helpers shared by the FCM and APNs
+ * push-notifier implementations. Server-only (used only by modules that already
+ * reach for `node:crypto` / `node:http2`); never re-exported from the package
+ * entry. Centralized so the secret-redaction and payload-bounding rules have a
+ * single, hardenable source rather than drifting between the two transports.
+ */
+/** Defensive cap on the free-form `reason` carried in a strand-wake payload. */
+export const MAX_REASON_LEN = 256;
+/** Base64url-encode the JSON form of an object (JWT header/claims segments). */
+export function b64urlJson(obj) {
+    return Buffer.from(JSON.stringify(obj)).toString('base64url');
+}
+/** A short, secret-free string for an unknown thrown value. */
+export function errText(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Redact a device token to a short, non-reversible prefix for debug lines — the
+ * full FCM/APNs token is a secret and must never reach a log.
+ */
+export function redact(token) {
+    return token.length <= 8 ? '…' : `${token.slice(0, 6)}…`;
+}
+//# sourceMappingURL=push-notifier-shared.js.map

package/dist/push-notifier-shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-notifier-shared.js","sourceRoot":"","sources":["../src/push-notifier-shared.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,OAAO,CAAC,GAAY;IAClC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;AAC3D,CAAC"}