@usepapier/browser 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,49 @@
+Papier SDK License
+
+Copyright (c) 2026 Papier. All rights reserved.
+
+This license applies to the Papier software packages that carry it, including
+@usepapier/client, @usepapier/browser and @usepapier/cli (the "Software").
+
+1. Grant. Subject to these terms, Papier grants you a non-exclusive,
+   non-transferable, revocable, royalty-free license to install and use the
+   Software, and to include unmodified copies of it in applications you build,
+   solely to access and use the Papier service (https://usepapier.io) under a
+   valid Papier account and the Papier terms of service.
+
+2. Redistribution in your applications. You may distribute the Software as part
+   of your own application, in object or bundled form, provided the application
+   is not itself a software development kit, library or service that exposes or
+   substitutes for the Software or the Papier service.
+
+3. Restrictions. You may not: (a) copy, modify, or create derivative works of
+   the Software, except to the extent applicable law grants that right
+   regardless of this restriction; (b) use the Software, or any interface it
+   documents, to build or operate a product or service that competes with
+   Papier or that emulates the Papier service; (c) sell, sublicense, rent, or
+   offer the Software as a standalone product; (d) remove or alter copyright,
+   license or attribution notices; (e) use the Software to circumvent Papier
+   plan limits, quotas, authentication, or other access controls.
+
+4. Third-party components. The Software may include or depend on third-party
+   components that are licensed under their own terms. Those terms apply to
+   those components, and nothing in this license restricts rights granted by
+   them.
+
+5. Ownership. Papier and its licensors retain all right, title and interest in
+   the Software. No rights are granted except those expressly stated here.
+
+6. Termination. This license ends automatically if you breach it or when your
+   right to use the Papier service ends. On termination you must stop using the
+   Software and delete your copies.
+
+7. No warranty. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+   EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+   PARTICULAR PURPOSE AND NON-INFRINGEMENT.
+
+8. Limitation of liability. TO THE MAXIMUM EXTENT PERMITTED BY LAW, PAPIER IS
+   NOT LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES, OR FOR
+   LOSS OF DATA OR PROFITS, ARISING FROM USE OF THE SOFTWARE. Use of the Papier
+   service is governed separately by the Papier terms of service.
+
+Questions: https://usepapier.io

package/README.md

@@ -1,3 +1,71 @@
-# Temporary Holding Version
+# @usepapier/browser
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Web Push for the browser, using a **publishable key**. It registers and removes push subscriptions
+from the origins you allow and cannot send anything. Sending happens on your server with
+[`@usepapier/client`](https://www.npmjs.com/package/@usepapier/client).
+
+- No credentials in the page: the key is public and limited to one project, one environment and your
+  allowed origins.
+- Binds a device to a signed-in user only with a short-lived token your server issues.
+- Handles permission, subscription, push-key rotation and unsupported browsers with an explicit state.
+- Small, dependency-free, ESM.
+
+Documentation: <https://usepapier.io/docs/>
+
+## Install
+
+```sh
+pnpm add @usepapier/browser
+```
+
+## Usage
+
+```ts
+import { createPapierBrowser } from "@usepapier/browser";
+
+const papier = createPapierBrowser({ publishableKey: "papier_pk_..." });
+
+// 1. Ask your server for a short-lived token that binds this browser to the signed-in user.
+//    (Server: `await papier.push.issueUserToken({ userId })`.)
+// 2. Subscribe from a user gesture, such as a button click.
+button.addEventListener("click", async () => {
+  const { token } = await fetch("/api/papier/push-token", { method: "POST" }).then((r) => r.json());
+  await papier.push.subscribe({ userToken: token });
+});
+
+// 3. Keep the subscription current on page load (handles push key rotation).
+await papier.push.refresh();
+```
+
+## Service worker
+
+Copy `node_modules/@usepapier/browser/build/service-worker.iife.js` to a file served from your
+site's root as `/papier-sw.js` (or pass `serviceWorkerPath`). It shows the notification and opens
+only same-origin links.
+
+## Setup in Papier
+
+1. Create a **Browser (publishable)** API key for one project and environment, and list your site's
+   origins (`https://app.example.com`; `http://localhost:3000` for development).
+2. Enable push delivery through Papier for that environment.
+3. Send from your server with a secret key.
+
+## Security model
+
+- The key is public. It is accepted only from the allowlisted origins and only for subscription
+  registration. Never use a secret key (`papier_...`) in a browser; the SDK refuses it.
+- Without a user token a device is anonymous. Papier will not let a page bind a device to a user ID
+  the server did not authorise.
+- No cookies are sent and nothing is stored in `localStorage`; state is read from the browser.
+- iOS and iPadOS only deliver Web Push to sites added to the Home Screen.
+
+## States and errors
+
+`getState()` returns `unsupported`, `denied`, `prompt`, `unsubscribed` or `subscribed`. Failures are
+`PapierBrowserError` with a `code`: `unsupported`, `permission-denied`, `invalid-key`,
+`origin-not-allowed`, `invalid-user-token`, `rate-limited`, `service-unavailable`,
+`service-worker`, `network`, `rejected`.
+
+## License
+
+Use of this package is governed by the Papier SDK License in `LICENSE` and your Papier terms of service.

package/build/index.d.ts

@@ -0,0 +1,55 @@
+//#region src/push.d.ts
+type PushState =
+/** No service worker, Push API or Notification API. */
+"unsupported" | "denied" |
+/** Permission has not been requested yet. */
+"prompt" | "unsubscribed" | "subscribed";
+interface SubscribeOptions {
+  /**
+   * Binds this device to an end user. Mint it on your server with `issueUserToken`; pass the string,
+   * or a function that fetches it, so a stale token is never reused.
+   */
+  userToken?: string | (() => string | Promise<string>);
+  /** Where your site serves the Papier service worker. Defaults to `/papier-sw.js`. */
+  serviceWorkerPath?: string;
+}
+/** `bound` is true once the device is tied to an end user through a user token. */
+interface RegisteredDevice {
+  id: string;
+  bound: boolean;
+}
+interface PapierPush {
+  isSupported(): boolean;
+  getState(): Promise<PushState>;
+  /** Asks for permission, subscribes and registers the device. Call it from a user gesture. */
+  subscribe(options?: SubscribeOptions): Promise<RegisteredDevice>;
+  /** Re-registers an existing subscription and resubscribes when Papier rotated its push key. */
+  refresh(options?: SubscribeOptions): Promise<PushState>;
+  unsubscribe(): Promise<void>;
+}
+//#endregion
+//#region src/errors.d.ts
+type PapierBrowserErrorCode = "unsupported" | "permission-denied" | "invalid-key" | "origin-not-allowed" | "invalid-user-token" | "rate-limited" | "service-unavailable" | "service-worker" | "network" | "rejected";
+/** Every failure the SDK reports. `message` never contains keys, endpoints or tokens. */
+export declare class PapierBrowserError extends Error {
+  readonly code: PapierBrowserErrorCode;
+  readonly status?: number | undefined;
+  readonly name = "PapierBrowserError";
+  constructor(code: PapierBrowserErrorCode, message: string, status?: number | undefined);
+}
+//#endregion
+//#region src/index.d.ts
+export interface PapierBrowserOptions {
+  /** A `papier_pk_...` key. Secret keys are rejected: they must never run in a browser. */
+  publishableKey: string;
+  /** Defaults to Papier's hosted API. */
+  apiUrl?: string;
+  fetch?: typeof fetch;
+}
+export interface PapierBrowser {
+  push: PapierPush;
+}
+export declare function createPapierBrowser(options: PapierBrowserOptions): PapierBrowser;
+//#endregion
+export type { PapierBrowserErrorCode, PapierPush, PushState, RegisteredDevice, SubscribeOptions };
+//# sourceMappingURL=index.d.ts.map

package/build/index.js

@@ -0,0 +1,139 @@
+//#region src/errors.ts
+/** Every failure the SDK reports. `message` never contains keys, endpoints or tokens. */
+var PapierBrowserError = class extends Error {
+	code;
+	status;
+	name = "PapierBrowserError";
+	constructor(code, message, status) {
+		super(message);
+		this.code = code;
+		this.status = status;
+	}
+};
+
+//#endregion
+//#region src/vapid.ts
+/** Web Push expects the VAPID public key as bytes, but the API serves it as base64url. */
+function base64UrlToBytes(value) {
+	const padded = value.replace(/-/gu, "+").replace(/_/gu, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+	const binary = atob(padded);
+	const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+	return bytes;
+}
+function bytesEqual(a, b) {
+	if (!a || a.byteLength !== b.byteLength) return false;
+	return new Uint8Array(a).every((byte, index) => byte === b[index]);
+}
+
+//#endregion
+//#region src/push.ts
+const DEFAULT_WORKER_PATH = "/papier-sw.js";
+function createPush({ publishableKey, apiUrl, fetch: request }) {
+	const supported = () => typeof navigator !== "undefined" && "serviceWorker" in navigator && typeof PushManager !== "undefined" && typeof Notification !== "undefined";
+	async function call(path, init = {}) {
+		let response;
+		try {
+			response = await request(`${apiUrl}/api/public${path}`, {
+				method: init.method ?? "GET",
+				headers: {
+					authorization: `Bearer ${publishableKey}`,
+					...init.body ? { "content-type": "application/json" } : {}
+				},
+				...init.body ? { body: JSON.stringify(init.body) } : {},
+				credentials: "omit"
+			});
+		} catch {
+			throw new PapierBrowserError("network", "Could not reach Papier");
+		}
+		if (response.ok) return response;
+		const message = (await response.json().catch(() => ({}))).message ?? `Papier request failed (HTTP ${response.status})`;
+		if (response.status === 401) throw new PapierBrowserError("invalid-key", message, 401);
+		if (response.status === 403) throw new PapierBrowserError(/origin/iu.test(message) ? "origin-not-allowed" : "invalid-user-token", message, 403);
+		if (response.status === 429) throw new PapierBrowserError("rate-limited", message, 429);
+		if (response.status === 503) throw new PapierBrowserError("service-unavailable", message, 503);
+		throw new PapierBrowserError("rejected", message, response.status);
+	}
+	async function registration(path) {
+		try {
+			await navigator.serviceWorker.register(path);
+			return await navigator.serviceWorker.ready;
+		} catch {
+			throw new PapierBrowserError("service-worker", `Could not register the service worker at ${path}`);
+		}
+	}
+	/** The page's registration is found by scope, so it does not depend on the worker's file name. */
+	async function existing() {
+		return (await navigator.serviceWorker.getRegistration())?.pushManager.getSubscription() ?? null;
+	}
+	async function userToken(option) {
+		return typeof option === "function" ? option() : option;
+	}
+	async function register(subscription, options) {
+		const token = await userToken(options?.userToken);
+		return await (await call("/push/subscriptions", {
+			method: "POST",
+			body: {
+				subscription: subscription.toJSON(),
+				...token ? { userToken: token } : {}
+			}
+		})).json();
+	}
+	async function subscription(registered) {
+		const key = base64UrlToBytes((await (await call("/push/config")).json()).vapidPublicKey);
+		const current = await registered.pushManager.getSubscription();
+		if (current && bytesEqual(current.options.applicationServerKey, key)) return current;
+		await current?.unsubscribe();
+		return registered.pushManager.subscribe({
+			userVisibleOnly: true,
+			applicationServerKey: key
+		});
+	}
+	return {
+		isSupported: supported,
+		async getState() {
+			if (!supported()) return "unsupported";
+			if (Notification.permission === "denied") return "denied";
+			if (Notification.permission === "default") return "prompt";
+			return await existing() ? "subscribed" : "unsubscribed";
+		},
+		async subscribe(options) {
+			if (!supported()) throw new PapierBrowserError("unsupported", "This browser does not support Web Push");
+			if ((Notification.permission === "default" ? await Notification.requestPermission() : Notification.permission) !== "granted") throw new PapierBrowserError("permission-denied", "Notification permission was not granted");
+			return register(await subscription(await registration(options?.serviceWorkerPath ?? DEFAULT_WORKER_PATH)), options);
+		},
+		async refresh(options) {
+			if (!supported()) return "unsupported";
+			if (Notification.permission !== "granted") return this.getState();
+			if (!await existing()) return "unsubscribed";
+			await register(await subscription(await registration(options?.serviceWorkerPath ?? DEFAULT_WORKER_PATH)), options);
+			return "subscribed";
+		},
+		async unsubscribe() {
+			if (!supported()) return;
+			const current = await existing();
+			if (!current) return;
+			await call("/push/subscriptions", {
+				method: "DELETE",
+				body: { endpoint: current.endpoint }
+			});
+			await current.unsubscribe();
+		}
+	};
+}
+
+//#endregion
+//#region src/index.ts
+function createPapierBrowser(options) {
+	const key = options.publishableKey;
+	if (!key.startsWith("papier_pk_")) throw new PapierBrowserError("invalid-key", key.startsWith("papier_") ? "Secret API keys must never be used in a browser. Use a publishable key (papier_pk_...)." : "Expected a publishable key starting with papier_pk_");
+	return { push: createPush({
+		publishableKey: key,
+		apiUrl: (options.apiUrl ?? "https://api.usepapier.io").replace(/\/+$/u, ""),
+		fetch: options.fetch ?? globalThis.fetch.bind(globalThis)
+	}) };
+}
+
+//#endregion
+export { PapierBrowserError, createPapierBrowser };
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/errors.ts","../src/vapid.ts","../src/push.ts","../src/index.ts"],"sourcesContent":["export type PapierBrowserErrorCode =\n  | \"unsupported\"\n  | \"permission-denied\"\n  | \"invalid-key\"\n  | \"origin-not-allowed\"\n  | \"invalid-user-token\"\n  | \"rate-limited\"\n  | \"service-unavailable\"\n  | \"service-worker\"\n  | \"network\"\n  | \"rejected\";\n\n/** Every failure the SDK reports. `message` never contains keys, endpoints or tokens. */\nexport class PapierBrowserError extends Error {\n  readonly name = \"PapierBrowserError\";\n  constructor(\n    readonly code: PapierBrowserErrorCode,\n    message: string,\n    readonly status?: number,\n  ) {\n    super(message);\n  }\n}\n","/** Web Push expects the VAPID public key as bytes, but the API serves it as base64url. */\nexport function base64UrlToBytes(value: string): Uint8Array<ArrayBuffer> {\n  const padded = value\n    .replace(/-/gu, \"+\")\n    .replace(/_/gu, \"/\")\n    .padEnd(Math.ceil(value.length / 4) * 4, \"=\");\n  const binary = atob(padded);\n  const bytes = new Uint8Array(new ArrayBuffer(binary.length));\n  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);\n  return bytes;\n}\n\nexport function bytesEqual(a: ArrayBuffer | null | undefined, b: Uint8Array): boolean {\n  if (!a || a.byteLength !== b.byteLength) return false;\n  const view = new Uint8Array(a);\n  return view.every((byte, index) => byte === b[index]);\n}\n","import { PapierBrowserError } from \"./errors\";\nimport { base64UrlToBytes, bytesEqual } from \"./vapid\";\n\nexport type PushState =\n  /** No service worker, Push API or Notification API. */\n  | \"unsupported\"\n  | \"denied\"\n  /** Permission has not been requested yet. */\n  | \"prompt\"\n  | \"unsubscribed\"\n  | \"subscribed\";\n\nexport interface SubscribeOptions {\n  /**\n   * Binds this device to an end user. Mint it on your server with `issueUserToken`; pass the string,\n   * or a function that fetches it, so a stale token is never reused.\n   */\n  userToken?: string | (() => string | Promise<string>);\n  /** Where your site serves the Papier service worker. Defaults to `/papier-sw.js`. */\n  serviceWorkerPath?: string;\n}\n\n/** `bound` is true once the device is tied to an end user through a user token. */\nexport interface RegisteredDevice {\n  id: string;\n  bound: boolean;\n}\n\nexport interface PapierPush {\n  isSupported(): boolean;\n  getState(): Promise<PushState>;\n  /** Asks for permission, subscribes and registers the device. Call it from a user gesture. */\n  subscribe(options?: SubscribeOptions): Promise<RegisteredDevice>;\n  /** Re-registers an existing subscription and resubscribes when Papier rotated its push key. */\n  refresh(options?: SubscribeOptions): Promise<PushState>;\n  unsubscribe(): Promise<void>;\n}\n\nexport interface PushDependencies {\n  publishableKey: string;\n  apiUrl: string;\n  fetch: typeof fetch;\n}\n\nconst DEFAULT_WORKER_PATH = \"/papier-sw.js\";\n\ninterface ApiFailure {\n  code?: string;\n  message?: string;\n}\n\nexport function createPush({\n  publishableKey,\n  apiUrl,\n  fetch: request,\n}: PushDependencies): PapierPush {\n  const supported = () =>\n    typeof navigator !== \"undefined\" &&\n    \"serviceWorker\" in navigator &&\n    typeof PushManager !== \"undefined\" &&\n    typeof Notification !== \"undefined\";\n\n  async function call(path: string, init: { method?: string; body?: unknown } = {}) {\n    let response: Response;\n    try {\n      response = await request(`${apiUrl}/api/public${path}`, {\n        method: init.method ?? \"GET\",\n        headers: {\n          authorization: `Bearer ${publishableKey}`,\n          ...(init.body ? { \"content-type\": \"application/json\" } : {}),\n        },\n        ...(init.body ? { body: JSON.stringify(init.body) } : {}),\n        // The key is the credential: never send or accept cookies.\n        credentials: \"omit\",\n      });\n    } catch {\n      throw new PapierBrowserError(\"network\", \"Could not reach Papier\");\n    }\n    if (response.ok) return response;\n\n    const failure = (await response.json().catch(() => ({}))) as ApiFailure;\n    const message = failure.message ?? `Papier request failed (HTTP ${response.status})`;\n    if (response.status === 401) throw new PapierBrowserError(\"invalid-key\", message, 401);\n    if (response.status === 403) {\n      throw new PapierBrowserError(\n        /origin/iu.test(message) ? \"origin-not-allowed\" : \"invalid-user-token\",\n        message,\n        403,\n      );\n    }\n    if (response.status === 429) throw new PapierBrowserError(\"rate-limited\", message, 429);\n    if (response.status === 503) throw new PapierBrowserError(\"service-unavailable\", message, 503);\n    throw new PapierBrowserError(\"rejected\", message, response.status);\n  }\n\n  async function registration(path: string) {\n    try {\n      await navigator.serviceWorker.register(path);\n      return await navigator.serviceWorker.ready;\n    } catch {\n      throw new PapierBrowserError(\n        \"service-worker\",\n        `Could not register the service worker at ${path}`,\n      );\n    }\n  }\n\n  /** The page's registration is found by scope, so it does not depend on the worker's file name. */\n  async function existing() {\n    const found = await navigator.serviceWorker.getRegistration();\n    return found?.pushManager.getSubscription() ?? null;\n  }\n\n  async function userToken(option: SubscribeOptions[\"userToken\"]) {\n    return typeof option === \"function\" ? option() : option;\n  }\n\n  async function register(\n    subscription: PushSubscription,\n    options: SubscribeOptions | undefined,\n  ): Promise<RegisteredDevice> {\n    const token = await userToken(options?.userToken);\n    const response = await call(\"/push/subscriptions\", {\n      method: \"POST\",\n      body: {\n        subscription: subscription.toJSON(),\n        ...(token ? { userToken: token } : {}),\n      },\n    });\n    return (await response.json()) as RegisteredDevice;\n  }\n\n  async function subscription(registered: ServiceWorkerRegistration) {\n    const config = (await (await call(\"/push/config\")).json()) as { vapidPublicKey: string };\n    const key = base64UrlToBytes(config.vapidPublicKey);\n    const current = await registered.pushManager.getSubscription();\n    if (current && bytesEqual(current.options.applicationServerKey, key)) return current;\n    // A subscription made with a retired push key can never receive messages again.\n    await current?.unsubscribe();\n    return registered.pushManager.subscribe({ userVisibleOnly: true, applicationServerKey: key });\n  }\n\n  return {\n    isSupported: supported,\n\n    async getState() {\n      if (!supported()) return \"unsupported\";\n      if (Notification.permission === \"denied\") return \"denied\";\n      if (Notification.permission === \"default\") return \"prompt\";\n      return (await existing()) ? \"subscribed\" : \"unsubscribed\";\n    },\n\n    async subscribe(options) {\n      if (!supported()) {\n        throw new PapierBrowserError(\"unsupported\", \"This browser does not support Web Push\");\n      }\n      const permission =\n        Notification.permission === \"default\"\n          ? await Notification.requestPermission()\n          : Notification.permission;\n      if (permission !== \"granted\") {\n        throw new PapierBrowserError(\n          \"permission-denied\",\n          \"Notification permission was not granted\",\n        );\n      }\n      const registered = await registration(options?.serviceWorkerPath ?? DEFAULT_WORKER_PATH);\n      return register(await subscription(registered), options);\n    },\n\n    async refresh(options) {\n      if (!supported()) return \"unsupported\";\n      if (Notification.permission !== \"granted\") return this.getState();\n      if (!(await existing())) return \"unsubscribed\";\n      const registered = await registration(options?.serviceWorkerPath ?? DEFAULT_WORKER_PATH);\n      await register(await subscription(registered), options);\n      return \"subscribed\";\n    },\n\n    async unsubscribe() {\n      if (!supported()) return;\n      const current = await existing();\n      if (!current) return;\n      // Tell Papier first: if the network fails the device must not be silently orphaned server-side.\n      await call(\"/push/subscriptions\", { method: \"DELETE\", body: { endpoint: current.endpoint } });\n      await current.unsubscribe();\n    },\n  };\n}\n","import { PapierBrowserError } from \"./errors\";\nimport { createPush, type PapierPush } from \"./push\";\n\nexport { PapierBrowserError, type PapierBrowserErrorCode } from \"./errors\";\nexport type { PapierPush, PushState, RegisteredDevice, SubscribeOptions } from \"./push\";\n\nexport interface PapierBrowserOptions {\n  /** A `papier_pk_...` key. Secret keys are rejected: they must never run in a browser. */\n  publishableKey: string;\n  /** Defaults to Papier's hosted API. */\n  apiUrl?: string;\n  fetch?: typeof fetch;\n}\n\nexport interface PapierBrowser {\n  push: PapierPush;\n}\n\nexport function createPapierBrowser(options: PapierBrowserOptions): PapierBrowser {\n  const key = options.publishableKey;\n  if (!key.startsWith(\"papier_pk_\")) {\n    throw new PapierBrowserError(\n      \"invalid-key\",\n      key.startsWith(\"papier_\")\n        ? \"Secret API keys must never be used in a browser. Use a publishable key (papier_pk_...).\"\n        : \"Expected a publishable key starting with papier_pk_\",\n    );\n  }\n  return {\n    push: createPush({\n      publishableKey: key,\n      apiUrl: (options.apiUrl ?? \"https://api.usepapier.io\").replace(/\\/+$/u, \"\"),\n      fetch: options.fetch ?? globalThis.fetch.bind(globalThis),\n    }),\n  };\n}\n"],"mappings":";;AAaA,IAAa,qBAAb,cAAwC,MAAM;CAGjC;CAEA;CAJX,AAAS,OAAO;CAChB,YACE,AAAS,MACT,SACA,AAAS,QACT;EACA,MAAM,OAAO;EAJJ;EAEA;CAGX;AACF;;;;;ACrBA,SAAgB,iBAAiB,OAAwC;CACvE,MAAM,SAAS,MACZ,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC,IAAI,GAAG,GAAG;CAC9C,MAAM,SAAS,KAAK,MAAM;CAC1B,MAAM,QAAQ,IAAI,WAAW,IAAI,YAAY,OAAO,MAAM,CAAC;CAC3D,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG,MAAM,SAAS,OAAO,WAAW,KAAK;CAC7F,OAAO;AACT;AAEA,SAAgB,WAAW,GAAmC,GAAwB;CACpF,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,YAAY,OAAO;CAEhD,OAAO,IADU,WAAW,CAClB,CAAC,CAAC,OAAO,MAAM,UAAU,SAAS,EAAE,MAAM;AACtD;;;;AC4BA,MAAM,sBAAsB;AAO5B,SAAgB,WAAW,EACzB,gBACA,QACA,OAAO,WACwB;CAC/B,MAAM,kBACJ,OAAO,cAAc,eACrB,mBAAmB,aACnB,OAAO,gBAAgB,eACvB,OAAO,iBAAiB;CAE1B,eAAe,KAAK,MAAc,OAA4C,CAAC,GAAG;EAChF,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,QAAQ,GAAG,OAAO,aAAa,QAAQ;IACtD,QAAQ,KAAK,UAAU;IACvB,SAAS;KACP,eAAe,UAAU;KACzB,GAAI,KAAK,OAAO,EAAE,gBAAgB,mBAAmB,IAAI,CAAC;IAC5D;IACA,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,UAAU,KAAK,IAAI,EAAE,IAAI,CAAC;IAEvD,aAAa;GACf,CAAC;EACH,QAAQ;GACN,MAAM,IAAI,mBAAmB,WAAW,wBAAwB;EAClE;EACA,IAAI,SAAS,IAAI,OAAO;EAGxB,MAAM,WAAU,MADO,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE,EAChC,CAAC,WAAW,+BAA+B,SAAS,OAAO;EAClF,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,mBAAmB,eAAe,SAAS,GAAG;EACrF,IAAI,SAAS,WAAW,KACtB,MAAM,IAAI,mBACR,WAAW,KAAK,OAAO,IAAI,uBAAuB,sBAClD,SACA,GACF;EAEF,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,mBAAmB,gBAAgB,SAAS,GAAG;EACtF,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,mBAAmB,uBAAuB,SAAS,GAAG;EAC7F,MAAM,IAAI,mBAAmB,YAAY,SAAS,SAAS,MAAM;CACnE;CAEA,eAAe,aAAa,MAAc;EACxC,IAAI;GACF,MAAM,UAAU,cAAc,SAAS,IAAI;GAC3C,OAAO,MAAM,UAAU,cAAc;EACvC,QAAQ;GACN,MAAM,IAAI,mBACR,kBACA,4CAA4C,MAC9C;EACF;CACF;;CAGA,eAAe,WAAW;EAExB,QAAO,MADa,UAAU,cAAc,gBAAgB,EAChD,EAAE,YAAY,gBAAgB,KAAK;CACjD;CAEA,eAAe,UAAU,QAAuC;EAC9D,OAAO,OAAO,WAAW,aAAa,OAAO,IAAI;CACnD;CAEA,eAAe,SACb,cACA,SAC2B;EAC3B,MAAM,QAAQ,MAAM,UAAU,SAAS,SAAS;EAQhD,OAAQ,OAAM,MAPS,KAAK,uBAAuB;GACjD,QAAQ;GACR,MAAM;IACJ,cAAc,aAAa,OAAO;IAClC,GAAI,QAAQ,EAAE,WAAW,MAAM,IAAI,CAAC;GACtC;EACF,CAAC,EACqB,CAAC,KAAK;CAC9B;CAEA,eAAe,aAAa,YAAuC;EAEjE,MAAM,MAAM,kBAAiB,OADN,MAAM,KAAK,cAAc,EAAC,CAAE,KAAK,EACrB,CAAC,cAAc;EAClD,MAAM,UAAU,MAAM,WAAW,YAAY,gBAAgB;EAC7D,IAAI,WAAW,WAAW,QAAQ,QAAQ,sBAAsB,GAAG,GAAG,OAAO;EAE7E,MAAM,SAAS,YAAY;EAC3B,OAAO,WAAW,YAAY,UAAU;GAAE,iBAAiB;GAAM,sBAAsB;EAAI,CAAC;CAC9F;CAEA,OAAO;EACL,aAAa;EAEb,MAAM,WAAW;GACf,IAAI,CAAC,UAAU,GAAG,OAAO;GACzB,IAAI,aAAa,eAAe,UAAU,OAAO;GACjD,IAAI,aAAa,eAAe,WAAW,OAAO;GAClD,OAAQ,MAAM,SAAS,IAAK,eAAe;EAC7C;EAEA,MAAM,UAAU,SAAS;GACvB,IAAI,CAAC,UAAU,GACb,MAAM,IAAI,mBAAmB,eAAe,wCAAwC;GAMtF,KAHE,aAAa,eAAe,YACxB,MAAM,aAAa,kBAAkB,IACrC,aAAa,gBACA,WACjB,MAAM,IAAI,mBACR,qBACA,yCACF;GAGF,OAAO,SAAS,MAAM,aAAa,MADV,aAAa,SAAS,qBAAqB,mBAAmB,CAC1C,GAAG,OAAO;EACzD;EAEA,MAAM,QAAQ,SAAS;GACrB,IAAI,CAAC,UAAU,GAAG,OAAO;GACzB,IAAI,aAAa,eAAe,WAAW,OAAO,KAAK,SAAS;GAChE,IAAI,CAAE,MAAM,SAAS,GAAI,OAAO;GAEhC,MAAM,SAAS,MAAM,aAAa,MADT,aAAa,SAAS,qBAAqB,mBAAmB,CAC3C,GAAG,OAAO;GACtD,OAAO;EACT;EAEA,MAAM,cAAc;GAClB,IAAI,CAAC,UAAU,GAAG;GAClB,MAAM,UAAU,MAAM,SAAS;GAC/B,IAAI,CAAC,SAAS;GAEd,MAAM,KAAK,uBAAuB;IAAE,QAAQ;IAAU,MAAM,EAAE,UAAU,QAAQ,SAAS;GAAE,CAAC;GAC5F,MAAM,QAAQ,YAAY;EAC5B;CACF;AACF;;;;AC1KA,SAAgB,oBAAoB,SAA8C;CAChF,MAAM,MAAM,QAAQ;CACpB,IAAI,CAAC,IAAI,WAAW,YAAY,GAC9B,MAAM,IAAI,mBACR,eACA,IAAI,WAAW,SAAS,IACpB,4FACA,qDACN;CAEF,OAAO,EACL,MAAM,WAAW;EACf,gBAAgB;EAChB,SAAS,QAAQ,UAAU,2BAA0B,CAAE,QAAQ,SAAS,EAAE;EAC1E,OAAO,QAAQ,SAAS,WAAW,MAAM,KAAK,UAAU;CAC1D,CAAC,EACH;AACF"}

package/build/service-worker.iife.js

@@ -0,0 +1 @@
+(function(){function e(e){let t;try{t=e.data?.json()}catch{return}if(!t||typeof t!=`object`)return;let{title:n,body:r}=t;if(!(typeof n!=`string`||!n.trim()||typeof r!=`string`))return t}self.addEventListener(`push`,t=>{let n=e(t);if(!n)return;let r=n.data&&typeof n.data==`object`&&!Array.isArray(n.data)?n.data:{};t.waitUntil(self.registration.showNotification(n.title,{body:n.body,...typeof n.image==`string`&&n.image.startsWith(`https://`)?{image:n.image}:{},...typeof r.notificationId==`string`?{tag:r.notificationId}:{},data:{...r,url:typeof n.url==`string`?n.url:`/`}}))}),self.addEventListener(`notificationclick`,e=>{e.notification.close(),e.waitUntil((async()=>{let t;try{t=new URL(String(e.notification.data?.url??`/`),self.location.origin)}catch{return}if(t.origin!==self.location.origin||![`https:`,`http:`].includes(t.protocol))return;let n=await self.clients.matchAll({type:`window`,includeUncontrolled:!0});for(let e of n)if(new URL(e.url).origin===t.origin){let n=await e.navigate(t.href);if(n){await n.focus();return}}await self.clients.openWindow(t.href)})())})})();

package/package.json

@@ -1,6 +1,53 @@
 {
   "name": "@usepapier/browser",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Papier browser SDK: Web Push subscriptions with a publishable key",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./build/index.d.ts",
+      "default": "./build/index.js"
+    },
+    "./service-worker": "./build/service-worker.iife.js"
+  },
+  "files": [
+    "build",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "pack": "NODE_ENV=production tsdown",
+    "tsc": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.worker.json",
+    "lint": "oxlint . --type-aware",
+    "lint:fix": "oxlint . --fix --type-aware",
+    "format": "oxfmt \"**/*.{mjs,ts,md,json}\" --check",
+    "format:fix": "oxfmt \"**/*.{mjs,ts,md,json}\" --write",
+    "test": "vitest run --config vitest.unit.config.ts",
+    "clean": "rimraf build tsconfig.tsbuildinfo"
+  },
+  "keywords": [
+    "papier",
+    "web-push",
+    "push-notifications",
+    "service-worker",
+    "browser",
+    "vapid",
+    "notifications",
+    "sdk",
+    "typescript"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@papier/tsconfig": "workspace:*",
+    "@types/node": "^26.6.5",
+    "rimraf": "^6.1.3",
+    "tsdown": "^0.23.1",
+    "vitest": "^5.0.5"
+  },
+  "author": "Papier",
+  "homepage": "https://usepapier.io/docs/"
+}