@voltro/plugin-notifications 0.85.0 → 0.86.0

package/dist/webPush.js

@@ -0,0 +1,161 @@
+import { sendWebPush as e, vapidPublicKeyFor as t } from "./webPushProtocol.js";
+import { and as n, eq as r, generateId as i, id as a, table as o, text as s, timestamp as c } from "@voltro/database";
+import { createHash as l, randomBytes as u } from "node:crypto";
+//#region src/webPush.ts
+var d = o("_voltro_notification_push_subscriptions", {
+	id: a({ prefix: "notifpush" }),
+	subjectId: s(),
+	endpointHash: s(),
+	endpoint: s(),
+	p256dh: s(),
+	auth: s(),
+	ua: s().nullable(),
+	createdAt: c().default("now"),
+	tenantId: s().nullable()
+}).unique("byPushEndpointHash", ["endpointHash"]).index("byPushSubject", ["subjectId"]), f = (e) => l("sha256").update(e).digest("hex"), p = () => {
+	let e = /* @__PURE__ */ new Map();
+	return {
+		upsert: async (t) => {
+			e.set(t.endpointHash, t);
+		},
+		listForSubject: async (t) => [...e.values()].filter((e) => e.subjectId === t),
+		removeForSubject: async (t, n) => {
+			let r = e.get(t);
+			return !r || r.subjectId !== n ? !1 : (e.delete(t), !0);
+		},
+		removeByHash: async (t) => {
+			e.delete(t);
+		},
+		countForSubject: async (t) => [...e.values()].filter((e) => e.subjectId === t).length
+	};
+}, m = "_voltro_notification_push_subscriptions", h = (e) => {
+	let t = async (t, n) => e.query({
+		table: m,
+		predicate: t,
+		order: [],
+		take: n,
+		skip: void 0,
+		projection: void 0
+	}), a = (e) => ({
+		subjectId: String(e.subjectId),
+		endpoint: String(e.endpoint),
+		endpointHash: String(e.endpointHash),
+		p256dh: String(e.p256dh),
+		auth: String(e.auth),
+		ua: e.ua == null ? null : String(e.ua),
+		tenantId: e.tenantId == null ? null : String(e.tenantId)
+	});
+	return {
+		upsert: async (t) => {
+			let n = i({
+				kind: "typeid",
+				prefix: "notifpush"
+			}, m);
+			await e.upsert(m, {
+				id: n,
+				subjectId: t.subjectId,
+				endpointHash: t.endpointHash,
+				endpoint: t.endpoint,
+				p256dh: t.p256dh,
+				auth: t.auth,
+				ua: t.ua,
+				tenantId: t.tenantId
+			}, {
+				conflictColumns: ["endpointHash"],
+				update: [
+					"subjectId",
+					"p256dh",
+					"auth",
+					"ua",
+					"tenantId"
+				]
+			});
+		},
+		listForSubject: async (e) => (await t(r("subjectId", e))).map(a),
+		removeForSubject: async (i, a) => {
+			let o = await t(n(r("endpointHash", i), r("subjectId", a)), 1);
+			return o[0] ? (await e.delete(m, String(o[0].id)), !0) : !1;
+		},
+		removeByHash: async (n) => {
+			let i = await t(r("endpointHash", n), 1);
+			i[0] && await e.delete(m, String(i[0].id));
+		},
+		countForSubject: async (e) => (await t(r("subjectId", e))).length
+	};
+}, g = Symbol.for("@voltro/plugin-notifications:web-push"), _ = () => {
+	let e = globalThis;
+	return e[g] ??= {
+		store: p(),
+		bound: !1
+	};
+}, v = (e) => {
+	let t = _();
+	t.store = h(e), t.bound = !0;
+}, y = () => {
+	let e = _();
+	e.store = p(), e.bound = !1;
+}, b = (e) => {
+	let t = e ?? process.env.VOLTRO_VAPID_PRIVATE_KEY;
+	if (t === void 0 || t.trim() === "") throw Error("web push needs VOLTRO_VAPID_PRIVATE_KEY (a base64url P-256 scalar). `voltro dev` mints one into .env.local; for production generate one and set it in the deployment environment. There is deliberately no default.");
+	return t;
+}, x = 3800, S = (e, t) => {
+	let n = typeof e.data?.url == "string" ? e.data.url : void 0, r = {
+		title: e.title,
+		body: e.body,
+		category: e.category,
+		clickToken: t,
+		...n === void 0 ? {} : { url: n },
+		...e.data === void 0 ? {} : { data: e.data }
+	}, i = Buffer.from(JSON.stringify(r));
+	if (i.length <= x) return i;
+	let { data: a, ...o } = r;
+	if (i = Buffer.from(JSON.stringify(o)), i.length <= x) return i;
+	let s = i.length - Buffer.byteLength(o.body), c = Math.max(0, x - s - Buffer.byteLength("…")), l = Buffer.from(o.body).subarray(0, c).toString("utf8").replace(/�+$/u, "");
+	return Buffer.from(JSON.stringify({
+		...o,
+		body: `${l}…`
+	}));
+}, C = (e = {}) => (_().channelOptions = e, T(e)), w = () => {
+	let e = _().channelOptions;
+	t(b(e?.privateKey));
+}, T = (e) => ({
+	id: e.id ?? "webPush",
+	deliver: async (t) => {
+		let n = await E(t, e), r = n.filter((e) => e.status === "failed");
+		if (n.length > 0 && r.length === n.length) throw Error(`web push failed for all ${r.length} endpoint(s): ${r[0].error ?? "unknown"}`);
+	},
+	deliverDetailed: (t) => E(t, e)
+}), E = async (t, n) => {
+	let r = b(n.privateKey), i = await _().store.listForSubject(t.to), a = [];
+	for (let o of i) {
+		let i = u(16).toString("base64url"), s = {
+			privateKey: r,
+			...n.contact === void 0 ? {} : { contact: n.contact },
+			...n.ttl === void 0 ? {} : { ttl: n.ttl },
+			...n.fetchImpl === void 0 ? {} : { fetchImpl: n.fetchImpl }
+		}, c = await e({
+			endpoint: o.endpoint,
+			keys: {
+				p256dh: o.p256dh,
+				auth: o.auth
+			}
+		}, S(t, i), s);
+		c.kind === "delivered" ? a.push({
+			endpoint: o.endpoint,
+			status: "sent",
+			clickToken: i
+		}) : c.kind === "gone" ? (await _().store.removeByHash(o.endpointHash), a.push({
+			endpoint: o.endpoint,
+			status: "failed",
+			error: `endpoint gone (${c.status}) — pruned`,
+			pruned: !0
+		})) : a.push({
+			endpoint: o.endpoint,
+			status: "failed",
+			error: `${c.status}: ${c.detail}`
+		});
+	}
+	return a;
+}, D = (e) => t(b(e));
+//#endregion
+export { w as assertWebPushConfigured, v as bindWebPushStore, S as buildPushPayload, h as dataStorePushSubscriptionStore, f as endpointHashOf, p as memoryPushSubscriptionStore, d as pushSubscriptionsTable, y as resetWebPushStoreForTest, b as resolveVapidPrivateKey, _ as webPushCell, C as webPushChannel, D as webPushPublicKey };

package/dist/webPushProtocol.js

@@ -0,0 +1,117 @@
+import { createCipheriv as e, createDecipheriv as t, createECDH as n, createHmac as r, createPrivateKey as i, randomBytes as a, sign as o, timingSafeEqual as s } from "node:crypto";
+//#region src/webPushProtocol.ts
+var c = (e) => e.toString("base64url"), l = (e) => Buffer.from(e, "base64url"), u = (e, t) => r("sha256", e).update(t).digest(), d = (e, t, n) => u(e, Buffer.concat([t, Buffer.from([1])])).subarray(0, n), f = () => {
+	let e = n("prime256v1");
+	return e.generateKeys(), c(p(e.getPrivateKey()));
+}, p = (e) => {
+	if (e.length === 32) return e;
+	if (e.length > 32) throw Error(`P-256 scalar must be at most 32 bytes (got ${e.length})`);
+	return Buffer.concat([Buffer.alloc(32 - e.length), e]);
+}, m = (e) => {
+	let t = l(e);
+	if (t.length !== 32) throw Error(`VOLTRO_VAPID_PRIVATE_KEY must be a base64url 32-byte P-256 scalar (got ${t.length} bytes)`);
+	return t;
+}, h = (e) => {
+	let t = m(e), r = n("prime256v1");
+	return r.setPrivateKey(t), c(r.getPublicKey());
+}, g = (e) => {
+	let t = m(e), r = n("prime256v1");
+	r.setPrivateKey(t);
+	let a = r.getPublicKey();
+	return i({
+		key: {
+			kty: "EC",
+			crv: "P-256",
+			d: c(t),
+			x: c(a.subarray(1, 33)),
+			y: c(a.subarray(33, 65))
+		},
+		format: "jwk"
+	});
+}, _ = (e, t, n, r = Date.now()) => {
+	let i = new URL(e), a = {
+		aud: `${i.protocol}//${i.host}`,
+		exp: Math.floor(r / 1e3) + 43200,
+		...n === void 0 ? {} : { sub: n }
+	}, s = `${c(Buffer.from(JSON.stringify({
+		typ: "JWT",
+		alg: "ES256"
+	})))}.${c(Buffer.from(JSON.stringify(a)))}`;
+	return `vapid t=${s}.${c(o("sha256", Buffer.from(s), {
+		key: g(t),
+		dsaEncoding: "ieee-p1363"
+	}))}, k=${h(t)}`;
+}, v = Buffer.from("WebPush: info\0"), y = Buffer.from("Content-Encoding: aes128gcm\0"), b = Buffer.from("Content-Encoding: nonce\0"), x = 4096, S = (t, r, i = {}) => {
+	let o = l(t.p256dh), s = l(t.auth);
+	if (o.length !== 65 || o[0] !== 4) throw Error("push subscription p256dh must be a 65-byte uncompressed P-256 point");
+	if (s.length !== 16) throw Error("push subscription auth must be 16 bytes");
+	let c = n("prime256v1");
+	i.asPrivate ? c.setPrivateKey(i.asPrivate) : c.generateKeys();
+	let f = c.getPublicKey(), p = d(u(s, c.computeSecret(o)), Buffer.concat([
+		v,
+		o,
+		f
+	]), 32), m = i.salt ?? a(16), h = u(m, p), g = d(h, y, 16), _ = d(h, b, 12), S = e("aes-128-gcm", g, _), C = Buffer.concat([
+		S.update(Buffer.concat([r, Buffer.from([2])])),
+		S.final(),
+		S.getAuthTag()
+	]), w = Buffer.alloc(21);
+	return m.copy(w, 0), w.writeUInt32BE(x, 16), w.writeUInt8(f.length, 20), Buffer.concat([
+		w,
+		f,
+		C
+	]);
+}, C = (e, r) => {
+	let i = e.subarray(0, 16), a = e.readUInt8(20), o = e.subarray(21, 21 + a), s = e.subarray(21 + a), c = n("prime256v1");
+	c.setPrivateKey(r.uaPrivate);
+	let l = c.getPublicKey(), f = c.computeSecret(o), p = u(i, d(u(r.authSecret, f), Buffer.concat([
+		v,
+		l,
+		o
+	]), 32)), m = d(p, y, 16), h = d(p, b, 12), g = t("aes-128-gcm", m, h);
+	g.setAuthTag(s.subarray(s.length - 16));
+	let _ = Buffer.concat([g.update(s.subarray(0, s.length - 16)), g.final()]), x = _.length - 1;
+	for (; x >= 0 && _[x] === 0;) x--;
+	if (_[x] !== 2) throw Error("web-push record missing the last-record delimiter");
+	return _.subarray(0, x);
+}, w = async (e, t, n) => {
+	let r = S(e.keys, t), i = n.fetchImpl ?? fetch, a;
+	try {
+		a = await i(e.endpoint, {
+			method: "POST",
+			headers: {
+				"content-encoding": "aes128gcm",
+				"content-type": "application/octet-stream",
+				ttl: String(n.ttl ?? 86400),
+				urgency: "normal",
+				authorization: _(e.endpoint, n.privateKey, n.contact)
+			},
+			body: new Uint8Array(r)
+		});
+	} catch (e) {
+		return {
+			kind: "failed",
+			status: 0,
+			detail: e instanceof Error ? e.message : String(e)
+		};
+	}
+	if (a.status === 404 || a.status === 410) return {
+		kind: "gone",
+		status: a.status
+	};
+	if (a.status >= 200 && a.status < 300) return {
+		kind: "delivered",
+		status: a.status
+	};
+	let o = await a.text().catch(() => "");
+	return {
+		kind: "failed",
+		status: a.status,
+		detail: o.slice(0, 200)
+	};
+}, T = (e, t) => {
+	let n = Buffer.from(e), r = Buffer.from(t);
+	return n.length === r.length && s(n, r);
+};
+//#endregion
+export { T as clickTokenMatches, C as decryptWebPushPayload, S as encryptWebPushPayload, f as generateVapidPrivateKey, w as sendWebPush, _ as vapidAuthorization, h as vapidPublicKeyFor };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-notifications",
-  "version": "0.85.0",
+  "version": "0.86.0",
   "description": "One unified notification surface — email, Slack/webhook, SMS, push, in-app — with per-subject preference routing, an in-app inbox, and a delivery log. NotificationService + typed routes + useInbox/useUnreadCount hooks.",
   "keywords": [
     "voltro",
@@ -49,9 +49,9 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/client": "0.85.0",
-    "@voltro/database": "0.85.0",
-    "@voltro/protocol": "0.85.0"
+    "@voltro/client": "0.86.0",
+    "@voltro/database": "0.86.0",
+    "@voltro/protocol": "0.86.0"
   },
   "peerDependencies": {
     "effect": "4.0.1",