@takosjp/yurucommu-core 3.0.2 → 3.2.0

package/packages/api/src/lib/api/browser-push.ts

@@ -0,0 +1,534 @@
+import type {
+  NotificationPusherProduct,
+  NotificationPusherRegistration,
+} from "../../types/index.ts";
+import {
+  registerNotificationPusher,
+  unregisterNotificationPusher,
+} from "./notifications.ts";
+
+export type BrowserNotificationPushState =
+  "unsupported" | "unconfigured" | "denied" | "disabled" | "enabled";
+
+export interface BrowserNotificationPushConfig {
+  readonly product: NotificationPusherProduct;
+  readonly appId: string;
+  readonly appDisplayName: string;
+  /** Origin of the yurucommu-compatible API that owns this registration. */
+  readonly serverOrigin: string;
+  /** Public stateless gateway notify endpoint. */
+  readonly gatewayUrl: string;
+  /** Public uncompressed P-256 VAPID key, base64url encoded. */
+  readonly vapidPublicKey: string;
+  readonly serviceWorkerPath: string;
+  readonly scope?: string;
+  readonly lang?: string;
+}
+
+interface BrowserPushSubscriptionLike {
+  readonly endpoint: string;
+  readonly options?: {
+    readonly applicationServerKey: ArrayBuffer | null;
+  };
+  unsubscribe(): Promise<boolean>;
+}
+
+interface BrowserPushManagerLike {
+  getSubscription(): Promise<BrowserPushSubscriptionLike | null>;
+  subscribe(options: {
+    readonly userVisibleOnly: true;
+    readonly applicationServerKey: BufferSource;
+  }): Promise<BrowserPushSubscriptionLike>;
+}
+
+interface BrowserServiceWorkerRegistrationLike {
+  readonly pushManager: BrowserPushManagerLike;
+}
+
+interface BrowserServiceWorkerContainerLike {
+  register(
+    scriptURL: string,
+    options?: RegistrationOptions,
+  ): Promise<BrowserServiceWorkerRegistrationLike>;
+  getRegistration(
+    clientURL?: string,
+  ): Promise<BrowserServiceWorkerRegistrationLike | undefined>;
+}
+
+interface BrowserNotificationApiLike {
+  readonly permission: NotificationPermission;
+  requestPermission(): Promise<NotificationPermission>;
+}
+
+interface BrowserPushStorageLike {
+  getItem(key: string): string | null;
+  setItem(key: string, value: string): void;
+  removeItem(key: string): void;
+}
+
+export interface BrowserNotificationPushRuntime {
+  readonly serviceWorker?: BrowserServiceWorkerContainerLike;
+  readonly notification?: BrowserNotificationApiLike;
+  readonly storage?: BrowserPushStorageLike;
+}
+
+export async function getBrowserNotificationPushState(
+  config: BrowserNotificationPushConfig | null | undefined,
+  runtime: BrowserNotificationPushRuntime = browserPushRuntime(),
+): Promise<BrowserNotificationPushState> {
+  if (!runtime.serviceWorker || !runtime.notification) return "unsupported";
+  const normalized = normalizeBrowserPushConfig(config);
+  if (!normalized) return "unconfigured";
+  if (runtime.notification.permission === "denied") return "denied";
+  const registration = await runtime.serviceWorker.getRegistration();
+  const subscription = await registration?.pushManager.getSubscription();
+  return subscription &&
+    subscriptionMatchesConfig(normalized, subscription, runtime)
+    ? "enabled"
+    : "disabled";
+}
+
+export async function enableBrowserNotificationPush(
+  config: BrowserNotificationPushConfig,
+  runtime: BrowserNotificationPushRuntime = browserPushRuntime(),
+): Promise<{
+  readonly state: BrowserNotificationPushState;
+  readonly registration?: NotificationPusherRegistration;
+}> {
+  if (!runtime.serviceWorker || !runtime.notification) {
+    return { state: "unsupported" };
+  }
+  const normalized = requireBrowserPushConfig(config);
+  const permission =
+    runtime.notification.permission === "default"
+      ? await runtime.notification.requestPermission()
+      : runtime.notification.permission;
+  if (permission !== "granted") {
+    return { state: permission === "denied" ? "denied" : "disabled" };
+  }
+
+  const serviceWorker = await runtime.serviceWorker.register(
+    normalized.serviceWorkerPath,
+    { scope: "/" },
+  );
+  let existing = await serviceWorker.pushManager.getSubscription();
+  if (existing && !subscriptionMatchesConfig(normalized, existing, runtime)) {
+    await retireBrowserSubscription(normalized, existing, runtime);
+    existing = null;
+  }
+  const subscription =
+    existing ??
+    (await serviceWorker.pushManager.subscribe({
+      userVisibleOnly: true,
+      applicationServerKey: normalized.applicationServerKey,
+    }));
+  const registration = await registerBrowserSubscription(
+    normalized,
+    subscription,
+  );
+  storeBrowserPushBinding(normalized, subscription, runtime);
+  return { state: "enabled", registration };
+}
+
+/**
+ * Rebind an existing browser subscription to the current signed-in actor.
+ * This never requests permission and never creates a new subscription.
+ */
+export async function refreshBrowserNotificationPush(
+  config: BrowserNotificationPushConfig | null | undefined,
+  runtime: BrowserNotificationPushRuntime = browserPushRuntime(),
+): Promise<BrowserNotificationPushState> {
+  if (!runtime.serviceWorker || !runtime.notification) return "unsupported";
+  const normalized = normalizeBrowserPushConfig(config);
+  if (!normalized) return "unconfigured";
+  if (runtime.notification.permission !== "granted") {
+    return runtime.notification.permission === "denied" ? "denied" : "disabled";
+  }
+  const serviceWorker = await runtime.serviceWorker.register(
+    normalized.serviceWorkerPath,
+    { scope: "/" },
+  );
+  const subscription = await serviceWorker.pushManager.getSubscription();
+  if (!subscription) return "disabled";
+  if (!subscriptionMatchesConfig(normalized, subscription, runtime)) {
+    await retireBrowserSubscription(normalized, subscription, runtime);
+    return "disabled";
+  }
+  await registerBrowserSubscription(normalized, subscription);
+  storeBrowserPushBinding(normalized, subscription, runtime);
+  return "enabled";
+}
+
+export async function disableBrowserNotificationPush(
+  config: BrowserNotificationPushConfig,
+  runtime: BrowserNotificationPushRuntime = browserPushRuntime(),
+): Promise<BrowserNotificationPushState> {
+  if (!runtime.serviceWorker || !runtime.notification) return "unsupported";
+  const normalized = requireBrowserPushConfig(config);
+  const serviceWorker = await runtime.serviceWorker.getRegistration();
+  const subscription = await serviceWorker?.pushManager.getSubscription();
+  if (!subscription) {
+    clearBrowserPushBinding(normalized, runtime);
+    return "disabled";
+  }
+
+  // Explicit disable is privacy-first: always invalidate the local endpoint,
+  // even when the host cannot remove its row. The next rejected delivery lets
+  // the host clean that stale row.
+  await retireBrowserSubscription(normalized, subscription, runtime, true);
+  return "disabled";
+}
+
+/**
+ * Invalidate this product's browser endpoint without requiring runtime push
+ * configuration. Use this during logout/account teardown so a removed or
+ * temporarily unavailable server cannot keep waking a signed-out device.
+ */
+export async function clearBrowserNotificationPush(
+  identity: Pick<
+    BrowserNotificationPushConfig,
+    "product" | "appId" | "serviceWorkerPath"
+  >,
+  runtime: BrowserNotificationPushRuntime = browserPushRuntime(),
+): Promise<BrowserNotificationPushState> {
+  if (!runtime.serviceWorker) return "unsupported";
+  const registration = await runtime.serviceWorker.getRegistration();
+  const subscription = await registration?.pushManager.getSubscription();
+  if (subscription) await subscription.unsubscribe();
+  clearBrowserPushBindingForIdentity(identity, runtime);
+  return "disabled";
+}
+
+function browserPushRuntime(): BrowserNotificationPushRuntime {
+  const navigatorValue = globalThis.navigator as Navigator | undefined;
+  const notificationValue = globalThis.Notification;
+  let storage: BrowserPushStorageLike | undefined;
+  try {
+    storage = globalThis.localStorage;
+  } catch {
+    storage = undefined;
+  }
+  return {
+    ...(navigatorValue?.serviceWorker
+      ? {
+          serviceWorker:
+            navigatorValue.serviceWorker as unknown as BrowserServiceWorkerContainerLike,
+        }
+      : {}),
+    ...(notificationValue
+      ? {
+          notification:
+            notificationValue as unknown as BrowserNotificationApiLike,
+        }
+      : {}),
+    ...(storage ? { storage } : {}),
+  };
+}
+
+type NormalizedBrowserPushConfig = BrowserNotificationPushConfig & {
+  readonly applicationServerKey: BufferSource;
+};
+
+function requireBrowserPushConfig(
+  config: BrowserNotificationPushConfig,
+): NormalizedBrowserPushConfig {
+  const normalized = normalizeBrowserPushConfig(config);
+  if (!normalized) {
+    throw new Error(
+      "Browser notification push requires a valid HTTPS gateway URL, VAPID public key, app id, and root-relative service worker path.",
+    );
+  }
+  return normalized;
+}
+
+function normalizeBrowserPushConfig(
+  config: BrowserNotificationPushConfig | null | undefined,
+): NormalizedBrowserPushConfig | null {
+  if (!config) return null;
+  const appId = config.appId.trim();
+  const appDisplayName = config.appDisplayName.trim();
+  const serverOrigin = normalizeServerOrigin(config.serverOrigin);
+  const gatewayUrl = normalizeGatewayUrl(config.gatewayUrl);
+  const vapidPublicKey = config.vapidPublicKey.trim();
+  const applicationServerKey = decodeVapidPublicKey(vapidPublicKey);
+  const serviceWorkerPath = config.serviceWorkerPath.trim();
+  if (
+    !/^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$/.test(appId) ||
+    !appDisplayName ||
+    appDisplayName.length > 255 ||
+    !serverOrigin ||
+    !gatewayUrl ||
+    !applicationServerKey ||
+    !serviceWorkerPath.startsWith("/") ||
+    serviceWorkerPath.startsWith("//") ||
+    serviceWorkerPath.length > 512
+  ) {
+    return null;
+  }
+  return {
+    ...config,
+    appId,
+    appDisplayName,
+    serverOrigin,
+    gatewayUrl,
+    vapidPublicKey,
+    serviceWorkerPath,
+    applicationServerKey,
+  };
+}
+
+function normalizeServerOrigin(value: string): string | null {
+  try {
+    const url = new URL(value.trim());
+    if (url.username || url.password || url.hash) return null;
+    const loopback =
+      url.hostname === "localhost" ||
+      url.hostname === "127.0.0.1" ||
+      url.hostname === "[::1]";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+      return null;
+    }
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+
+function normalizeGatewayUrl(value: string): string | null {
+  try {
+    const url = new URL(value.trim());
+    if (url.username || url.password || url.hash) return null;
+    if (url.protocol === "https:") {
+      if (url.port && url.port !== "443") return null;
+      if (!isPublicHttpsHostname(url.hostname)) return null;
+      return url.toString();
+    }
+    if (url.protocol !== "http:" || !isLoopbackHostname(url.hostname)) {
+      return null;
+    }
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+
+function isLoopbackHostname(hostname: string): boolean {
+  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (
+    normalized === "localhost" ||
+    normalized.endsWith(".localhost") ||
+    normalized === "::1"
+  ) {
+    return true;
+  }
+  const octets = normalized.split(".").map(Number);
+  return (
+    octets.length === 4 &&
+    octets.every(
+      (part) => Number.isInteger(part) && part >= 0 && part <= 255,
+    ) &&
+    octets[0] === 127
+  );
+}
+
+function isPublicHttpsHostname(hostname: string): boolean {
+  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (
+    !normalized.includes(".") ||
+    normalized.endsWith(".localhost") ||
+    normalized.endsWith(".local") ||
+    normalized.endsWith(".internal") ||
+    normalized.endsWith(".home") ||
+    normalized.endsWith(".lan")
+  ) {
+    return false;
+  }
+  const ipv4 = normalized.split(".").map(Number);
+  if (
+    ipv4.length === 4 &&
+    ipv4.every((part) => Number.isInteger(part) && part >= 0 && part <= 255)
+  ) {
+    return false;
+  }
+  return !normalized.includes(":");
+}
+
+function decodeVapidPublicKey(value: string): BufferSource | null {
+  const normalized = value.trim().replace(/-/g, "+").replace(/_/g, "/");
+  if (!normalized || normalized.length > 256) return null;
+  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+  try {
+    const binary = globalThis.atob(padded);
+    const bytes = Uint8Array.from(binary, (character) =>
+      character.charCodeAt(0),
+    );
+    // Web Push uses an uncompressed P-256 public key.
+    return bytes.byteLength === 65 && bytes[0] === 0x04 ? bytes : null;
+  } catch {
+    return null;
+  }
+}
+
+async function registerBrowserSubscription(
+  config: NormalizedBrowserPushConfig,
+  subscription: BrowserPushSubscriptionLike,
+): Promise<NotificationPusherRegistration> {
+  const registration = await registerNotificationPusher({
+    product: config.product,
+    ...(config.scope ? { scope: config.scope } : {}),
+    pusher: {
+      kind: "http",
+      app_id: config.appId,
+      app_display_name: config.appDisplayName,
+      pushkey: subscription.endpoint,
+      ...(config.lang ? { lang: config.lang } : {}),
+      data: {
+        url: config.gatewayUrl,
+        format: "event_id_only",
+        provider: "webpush",
+        ttl: 60,
+        urgency: "normal",
+      },
+    },
+  });
+  return registration;
+}
+
+type StoredBrowserPushBinding = {
+  readonly endpoint: string;
+  readonly serverOrigin: string;
+  readonly vapidPublicKey: string;
+};
+
+function browserPushBindingKey(
+  identity: Pick<BrowserNotificationPushConfig, "product" | "appId">,
+): string {
+  return `yurucommu.browser-push.v1.${identity.product}.${identity.appId}`;
+}
+
+function readBrowserPushBinding(
+  config: NormalizedBrowserPushConfig,
+  runtime: BrowserNotificationPushRuntime,
+): StoredBrowserPushBinding | null {
+  try {
+    const value = runtime.storage?.getItem(browserPushBindingKey(config));
+    if (!value || value.length > 4096) return null;
+    const parsed = JSON.parse(value) as Partial<StoredBrowserPushBinding>;
+    return typeof parsed.endpoint === "string" &&
+      typeof parsed.serverOrigin === "string" &&
+      typeof parsed.vapidPublicKey === "string"
+      ? {
+          endpoint: parsed.endpoint,
+          serverOrigin: parsed.serverOrigin,
+          vapidPublicKey: parsed.vapidPublicKey,
+        }
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function storeBrowserPushBinding(
+  config: NormalizedBrowserPushConfig,
+  subscription: BrowserPushSubscriptionLike,
+  runtime: BrowserNotificationPushRuntime,
+): void {
+  try {
+    runtime.storage?.setItem(
+      browserPushBindingKey(config),
+      JSON.stringify({
+        endpoint: subscription.endpoint,
+        serverOrigin: config.serverOrigin,
+        vapidPublicKey: config.vapidPublicKey,
+      } satisfies StoredBrowserPushBinding),
+    );
+  } catch {
+    // Storage can be disabled independently of Push. The subscription's own
+    // applicationServerKey still protects key rotation in that case.
+  }
+}
+
+function clearBrowserPushBinding(
+  config: NormalizedBrowserPushConfig,
+  runtime: BrowserNotificationPushRuntime,
+): void {
+  clearBrowserPushBindingForIdentity(config, runtime);
+}
+
+function clearBrowserPushBindingForIdentity(
+  identity: Pick<BrowserNotificationPushConfig, "product" | "appId">,
+  runtime: BrowserNotificationPushRuntime,
+): void {
+  try {
+    runtime.storage?.removeItem(browserPushBindingKey(identity));
+  } catch {
+    // Best-effort metadata cleanup; the Push endpoint itself is authoritative.
+  }
+}
+
+function subscriptionMatchesConfig(
+  config: NormalizedBrowserPushConfig,
+  subscription: BrowserPushSubscriptionLike,
+  runtime: BrowserNotificationPushRuntime,
+): boolean {
+  const binding = readBrowserPushBinding(config, runtime);
+  if (
+    binding &&
+    (binding.endpoint !== subscription.endpoint ||
+      binding.serverOrigin !== config.serverOrigin ||
+      binding.vapidPublicKey !== config.vapidPublicKey)
+  ) {
+    return false;
+  }
+
+  const existingKey = subscription.options?.applicationServerKey;
+  if (!existingKey) return binding !== null;
+  return equalBufferSources(existingKey, config.applicationServerKey);
+}
+
+function equalBufferSources(left: BufferSource, right: BufferSource): boolean {
+  const leftBytes = bufferSourceBytes(left);
+  const rightBytes = bufferSourceBytes(right);
+  if (leftBytes.byteLength !== rightBytes.byteLength) return false;
+  for (let index = 0; index < leftBytes.byteLength; index += 1) {
+    if (leftBytes[index] !== rightBytes[index]) return false;
+  }
+  return true;
+}
+
+function bufferSourceBytes(value: BufferSource): Uint8Array {
+  return ArrayBuffer.isView(value)
+    ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength)
+    : new Uint8Array(value);
+}
+
+async function retireBrowserSubscription(
+  config: NormalizedBrowserPushConfig,
+  subscription: BrowserPushSubscriptionLike,
+  runtime: BrowserNotificationPushRuntime,
+  unregisterCurrentServer = false,
+): Promise<void> {
+  const binding = readBrowserPushBinding(config, runtime);
+  const canUnregisterCurrentServer =
+    unregisterCurrentServer ||
+    !binding ||
+    binding.serverOrigin === config.serverOrigin;
+  if (canUnregisterCurrentServer) {
+    try {
+      await unregisterNotificationPusher({
+        product: config.product,
+        ...(config.scope ? { scope: config.scope } : {}),
+        app_id: config.appId,
+        pushkey: subscription.endpoint,
+      });
+    } catch {
+      // Local invalidation below is the privacy boundary. A rejected delivery
+      // lets the old server remove a stale row when it becomes reachable.
+    }
+  }
+  try {
+    await subscription.unsubscribe();
+  } finally {
+    clearBrowserPushBinding(config, runtime);
+  }
+}

package/packages/api/src/lib/api/communities.ts

@@ -1,3 +1,4 @@
+import type { MediaAttachment } from "../../types/index.ts";
 import { normalizeActor } from "./normalize.ts";
 import {
   apiDelete,
@@ -47,9 +48,20 @@ export interface CommunityMessage {
     icon_url: string | null;
   };
   content: string;
+  /** Media attachments (image/video), same shape as post attachments. */
+  attachments?: MediaAttachment[];
   created_at: string;
 }
 
+/**
+ * A member's chat read position (LOCAL-ONLY read receipt). Only local members
+ * that opened the chat appear; remote members never report read state.
+ */
+export interface CommunityReadState {
+  actor_ap_id: string;
+  last_read_at: string;
+}
+
 export interface JoinCommunityResult {
   status: "joined" | "pending" | "invite_required";
 }
@@ -160,7 +172,12 @@ export async function leaveCommunity(identifier: string): Promise<void> {
 export async function fetchCommunityMessages(
   identifier: string,
   options?: { limit?: number; before?: string },
-): Promise<{ messages: CommunityMessage[]; hasMore: boolean }> {
+): Promise<{
+  messages: CommunityMessage[];
+  hasMore: boolean;
+  /** Per-member read positions (local members only; see CommunityReadState). */
+  readStates: CommunityReadState[];
+}> {
   const params = new URLSearchParams();
   if (options?.limit) params.set("limit", String(options.limit));
   if (options?.before) params.set("before", options.before);
@@ -172,20 +189,26 @@ export async function fetchCommunityMessages(
   const data = (await res.json()) as {
     messages?: CommunityMessage[];
     has_more?: boolean;
+    read_states?: CommunityReadState[];
   };
   return {
     messages: (data.messages || []).map(normalizeCommunityMessage),
     hasMore: data.has_more ?? false,
+    readStates: data.read_states ?? [],
   };
 }
 
 export async function sendCommunityMessage(
   identifier: string,
   content: string,
+  attachments?: MediaAttachment[],
 ): Promise<CommunityMessage> {
   const res = await apiPost(
     `/api/communities/${encodeURIComponent(identifier)}/messages`,
-    { content },
+    {
+      content,
+      ...(attachments && attachments.length > 0 ? { attachments } : {}),
+    },
   );
   await assertOk(res, "Failed to send message");
   const data = (await res.json()) as { message: CommunityMessage };

package/packages/api/src/lib/api/dm.ts

@@ -1,4 +1,4 @@
-import type { DMMessage } from "../../types/index.ts";
+import type { DMMessage, MediaAttachment } from "../../types/index.ts";
 import { normalizeActor } from "./normalize.ts";
 import { apiDelete, apiFetch, apiPost, assertOk } from "./fetch.ts";
 
@@ -110,6 +110,12 @@ export async function fetchUserDMMessages(
   messages: DMMessage[];
   conversation_id: string | null;
   hasMore: boolean;
+  /**
+   * The partner's last-read time (LOCAL-ONLY read receipt), or null when
+   * unknown — a remote partner never reports read state, so null must render
+   * as "no receipt", not "unread".
+   */
+  partnerLastReadAt: string | null;
 }> {
   const params = new URLSearchParams();
   if (options?.limit) params.set("limit", String(options.limit));
@@ -122,21 +128,27 @@ export async function fetchUserDMMessages(
     messages?: DMMessage[];
     conversation_id?: string | null;
     has_more?: boolean;
+    partner_last_read_at?: string | null;
   };
   return {
     messages: (data.messages || []).map(normalizeDmMessage),
     conversation_id: data.conversation_id ?? null,
     hasMore: data.has_more ?? false,
+    partnerLastReadAt: data.partner_last_read_at ?? null,
   };
 }
 
 export async function sendUserDMMessage(
   userApId: string,
   content: string,
+  attachments?: MediaAttachment[],
 ): Promise<{ message: DMMessage; conversation_id: string }> {
   const res = await apiPost(
     `/api/dm/user/${encodeURIComponent(userApId)}/messages`,
-    { content },
+    {
+      content,
+      ...(attachments && attachments.length > 0 ? { attachments } : {}),
+    },
   );
   await assertOk(res, "Failed to send message");
   const data = (await res.json()) as {

package/packages/api/src/lib/api/notifications.ts

@@ -1,4 +1,9 @@
-import type { Notification } from "../../types/index.ts";
+import type {
+  Notification,
+  NotificationPusherInput,
+  NotificationPusherProduct,
+  NotificationPusherRegistration,
+} from "../../types/index.ts";
 import { normalizeNotification } from "./normalize.ts";
 import { apiDelete, apiFetch, apiPost, assertOk } from "./fetch.ts";
 
@@ -59,3 +64,50 @@ export async function archiveAllNotifications(): Promise<number> {
   const data = (await res.json()) as { archived_count?: number };
   return data.archived_count ?? 0;
 }
+
+export async function registerNotificationPusher(input: {
+  product: NotificationPusherProduct;
+  scope?: string;
+  pusher: NotificationPusherInput;
+}): Promise<NotificationPusherRegistration> {
+  const res = await apiPost("/api/notifications/pushers", input);
+  await assertOk(res, "Failed to register notification pusher");
+  const data = (await res.json()) as {
+    pusher: NotificationPusherRegistration;
+  };
+  return data.pusher;
+}
+
+export async function unregisterNotificationPusher(input: {
+  product: NotificationPusherProduct;
+  scope?: string;
+  app_id: string;
+  pushkey: string;
+}): Promise<void> {
+  const res = await apiDelete("/api/notifications/pushers", input);
+  await assertOk(res, "Failed to unregister notification pusher");
+}
+
+export interface NotificationPusherPublicConfig {
+  readonly enabled: boolean;
+  readonly gateway_url: string | null;
+  readonly web_push_public_key: string | null;
+}
+
+/** Non-secret runtime configuration used by browser/PWA clients. */
+export async function fetchNotificationPusherPublicConfig(): Promise<NotificationPusherPublicConfig> {
+  const res = await apiFetch("/api/notifications/pushers/config");
+  await assertOk(res, "Failed to load notification pusher configuration");
+  const value = (await res.json()) as Partial<NotificationPusherPublicConfig>;
+  const gatewayUrl =
+    typeof value.gateway_url === "string" ? value.gateway_url : null;
+  const publicKey =
+    typeof value.web_push_public_key === "string"
+      ? value.web_push_public_key
+      : null;
+  return {
+    enabled: Boolean(gatewayUrl && publicKey),
+    gateway_url: gatewayUrl,
+    web_push_public_key: publicKey,
+  };
+}