@xenide-io/suite-client 0.2.0 → 0.4.0

package/dist/index.d.mts

@@ -45,6 +45,9 @@ declare function normalizeThrown(input: unknown, capability?: string): AppError;
 /** Display string for a failure surface: capability copy plus the code. */
 declare function formatAppError(error: AppError): string;
 
+type ApiFetchInit = RequestInit & {
+    skipAuth?: boolean;
+};
 interface ApiClientConfig {
     /** localStorage key namespace, e.g. `tt` or `tides`. */
     storagePrefix: string;
@@ -61,10 +64,17 @@ interface ApiClientConfig {
     workspaceCookieDomain?: string;
     /** Fired when the active workspace changes in this tab. */
     onWorkspaceChange?: (id: string | null) => void;
+    /** Fired during sign-out before storage is cleared. */
+    onSignOut?: () => void;
+    /** Clear the workspace key on sign-out (default `true`). */
+    clearWorkspaceOnSignOut?: boolean;
+    /** Extra localStorage keys removed on sign-out (e.g. portal app tokens). */
+    extraStorageKeysOnClear?: string[];
     /** sessionStorage key prefixes to clear on sign-out. */
     sessionStorageClearPrefixes?: string[];
+    /** Refuse to send the session to an unexpected absolute origin. */
+    enforceSameOrigin?: boolean;
 }
-type ApiFetch = (path: string, options?: RequestInit) => Promise<Response>;
 /**
  * Build a browser API client scoped to one ShellStack app. Every app shares the
  * same fetch/refresh/workspace behaviour; only the storage namespace and
@@ -73,9 +83,10 @@ type ApiFetch = (path: string, options?: RequestInit) => Promise<Response>;
 declare function createApiClient(config: ApiClientConfig): {
     API_URL: string;
     onAuthFailure: (handler: () => void) => void;
-    setTokens: (access: string, refresh: string) => void;
+    setTokens: (access: string, refresh?: string | null) => void;
     getAccessToken: () => string | null;
     getRefreshToken: () => string | null;
+    hasAccessToken: () => boolean;
     setActiveWorkspaceId: (id: string | null, options?: {
         share?: boolean;
     }) => void;
@@ -86,12 +97,14 @@ declare function createApiClient(config: ApiClientConfig): {
     refreshAccessToken: () => Promise<boolean>;
     parseApiError: (res: Response) => Promise<string>;
     api: {
-        get: (path: string) => Promise<Response>;
-        post: (path: string, body?: unknown, options?: RequestInit) => Promise<Response>;
-        put: (path: string, body?: unknown) => Promise<Response>;
-        patch: (path: string, body?: unknown) => Promise<Response>;
-        delete: (path: string) => Promise<Response>;
+        get: (path: string, init?: ApiFetchInit) => Promise<Response>;
+        post: (path: string, body?: unknown, init?: ApiFetchInit) => Promise<Response>;
+        put: (path: string, body?: unknown, init?: ApiFetchInit) => Promise<Response>;
+        patch: (path: string, body?: unknown, init?: ApiFetchInit) => Promise<Response>;
+        delete: (path: string, init?: ApiFetchInit) => Promise<Response>;
     };
+    restoreSession: () => void;
+    clearSession: () => void;
 };
 type ApiClient = ReturnType<typeof createApiClient>;
 type Api = ApiClient['api'];
@@ -313,6 +326,36 @@ declare function createNotificationsClient(config: NotificationsClientConfig): {
     markAllSuiteNotificationsRead: () => Promise<void>;
 };
 
+/** Browser push state surfaced to settings UI. */
+type WebPushState = 'unsupported' | 'unconfigured' | 'default' | 'granted' | 'denied' | 'subscribed';
+interface WebPushConfig {
+    enabled: boolean;
+    public_key: string;
+}
+interface WebPushClientConfig {
+    api: Api;
+    parseApiError: (res: Response) => Promise<string>;
+    publicKeyPath?: string;
+    subscribePath?: string;
+    unsubscribePath?: string;
+    serviceWorkerPath?: string;
+    serviceWorkerScope?: string;
+}
+type WebPushClient = ReturnType<typeof createWebPushClient>;
+/**
+ * Browser Web Push client shared across ShellStack apps.
+ *
+ * Registration is per origin: each app ships its own `/sw.js` and manifest,
+ * but all talk to the same suite endpoints, so a subscription made in one app
+ * receives notifications for the whole suite.
+ */
+declare function createWebPushClient(config: WebPushClientConfig): {
+    supported: () => boolean;
+    getState: () => Promise<WebPushState>;
+    enable: () => Promise<void>;
+    disable: () => Promise<void>;
+};
+
 type SuiteAiJobEvent = {
     sequence: number;
     event_type: 'queued' | 'started' | 'progress' | 'tool' | 'completed' | 'failed' | 'cancelled';
@@ -373,4 +416,4 @@ declare function createJsonLd(config: JsonLdConfig): string;
 
 declare function useIsNight(): boolean;
 
-export { type Api, type ApiClient, type ApiClientConfig, type ApiFetch, type AppError, type AuthReturnPath, type AuthReturnPathConfig, type BrandSettings, type BrandSettingsConfig, type CrossAppSync, type CrossAppSyncConfig, type CrossAppSyncTopic, DEFAULT_ERROR_CODE, ERROR_CODES, ERROR_COPY, ERROR_RETRYABLE, type ErrorCode, FREE_PLAN_SEAT_HELP, type JsonLdConfig, type LiveRefresh, type LiveRefreshOptions, type NotificationsClient, type NotificationsClientConfig, ORGANISATION_SEAT_HELP, type PortalHandoffPayload, type PortalHandoffRead, type SeatType, type SubscriptionTier, type SuiteAiJob, type SuiteAiJobEvent, type SuiteNotification, type SuiteNotificationsResponse, TIDES_ACCESS_HELP, TURTLETIME_ACCESS_HELP, WEBHOOK_ACTIVITY_ACTIONS, WORKSPACE_SEAT_HELP, type WorkspaceAppearance, type WorkspaceAppearanceApiConfig, type WorkspaceAppearanceConfig, WorkspaceAppearanceError, type WorkspaceAppearanceHelpers, type WorkspaceAppearancePatch, type WorkspaceBrandPayload, type WorkspaceSubscription, type WorkspaceTheme, activeSuiteAiJobs, appErrorFromResponse, canDisableAppAccess, codeForStatus, copyFor, createApiClient, createAuthReturnPath, createBrandSettings, createCrossAppSync, createJsonLd, createLiveRefresh, createNotificationsClient, createWorkspaceAppearance, createWorkspaceAppearanceApi, defaultInviteSeatType, flagsFromSeatType, formatAppError, hasAppAccess, isErrorCode, normalizeError, normalizeThrown, planSeatSummary, resolveSubscriptionTier, seatTypeDescription, seatTypeFromFlags, seatTypeLabel, selectedToWebhookActions, sortedSuiteAiEvents, suiteAiEventSummary, tierAllowsTidesOnlySeats, tierAllowsTurtletime, tierLabel, useIsNight, webhookActionsToSelected };
+export { type Api, type ApiClient, type ApiClientConfig, type ApiFetchInit, type AppError, type AuthReturnPath, type AuthReturnPathConfig, type BrandSettings, type BrandSettingsConfig, type CrossAppSync, type CrossAppSyncConfig, type CrossAppSyncTopic, DEFAULT_ERROR_CODE, ERROR_CODES, ERROR_COPY, ERROR_RETRYABLE, type ErrorCode, FREE_PLAN_SEAT_HELP, type JsonLdConfig, type LiveRefresh, type LiveRefreshOptions, type NotificationsClient, type NotificationsClientConfig, ORGANISATION_SEAT_HELP, type PortalHandoffPayload, type PortalHandoffRead, type SeatType, type SubscriptionTier, type SuiteAiJob, type SuiteAiJobEvent, type SuiteNotification, type SuiteNotificationsResponse, TIDES_ACCESS_HELP, TURTLETIME_ACCESS_HELP, WEBHOOK_ACTIVITY_ACTIONS, WORKSPACE_SEAT_HELP, type WebPushClient, type WebPushClientConfig, type WebPushConfig, type WebPushState, type WorkspaceAppearance, type WorkspaceAppearanceApiConfig, type WorkspaceAppearanceConfig, WorkspaceAppearanceError, type WorkspaceAppearanceHelpers, type WorkspaceAppearancePatch, type WorkspaceBrandPayload, type WorkspaceSubscription, type WorkspaceTheme, activeSuiteAiJobs, appErrorFromResponse, canDisableAppAccess, codeForStatus, copyFor, createApiClient, createAuthReturnPath, createBrandSettings, createCrossAppSync, createJsonLd, createLiveRefresh, createNotificationsClient, createWebPushClient, createWorkspaceAppearance, createWorkspaceAppearanceApi, defaultInviteSeatType, flagsFromSeatType, formatAppError, hasAppAccess, isErrorCode, normalizeError, normalizeThrown, planSeatSummary, resolveSubscriptionTier, seatTypeDescription, seatTypeFromFlags, seatTypeLabel, selectedToWebhookActions, sortedSuiteAiEvents, suiteAiEventSummary, tierAllowsTidesOnlySeats, tierAllowsTurtletime, tierLabel, useIsNight, webhookActionsToSelected };

package/dist/index.d.ts

@@ -45,6 +45,9 @@ declare function normalizeThrown(input: unknown, capability?: string): AppError;
 /** Display string for a failure surface: capability copy plus the code. */
 declare function formatAppError(error: AppError): string;
 
+type ApiFetchInit = RequestInit & {
+    skipAuth?: boolean;
+};
 interface ApiClientConfig {
     /** localStorage key namespace, e.g. `tt` or `tides`. */
     storagePrefix: string;
@@ -61,10 +64,17 @@ interface ApiClientConfig {
     workspaceCookieDomain?: string;
     /** Fired when the active workspace changes in this tab. */
     onWorkspaceChange?: (id: string | null) => void;
+    /** Fired during sign-out before storage is cleared. */
+    onSignOut?: () => void;
+    /** Clear the workspace key on sign-out (default `true`). */
+    clearWorkspaceOnSignOut?: boolean;
+    /** Extra localStorage keys removed on sign-out (e.g. portal app tokens). */
+    extraStorageKeysOnClear?: string[];
     /** sessionStorage key prefixes to clear on sign-out. */
     sessionStorageClearPrefixes?: string[];
+    /** Refuse to send the session to an unexpected absolute origin. */
+    enforceSameOrigin?: boolean;
 }
-type ApiFetch = (path: string, options?: RequestInit) => Promise<Response>;
 /**
  * Build a browser API client scoped to one ShellStack app. Every app shares the
  * same fetch/refresh/workspace behaviour; only the storage namespace and
@@ -73,9 +83,10 @@ type ApiFetch = (path: string, options?: RequestInit) => Promise<Response>;
 declare function createApiClient(config: ApiClientConfig): {
     API_URL: string;
     onAuthFailure: (handler: () => void) => void;
-    setTokens: (access: string, refresh: string) => void;
+    setTokens: (access: string, refresh?: string | null) => void;
     getAccessToken: () => string | null;
     getRefreshToken: () => string | null;
+    hasAccessToken: () => boolean;
     setActiveWorkspaceId: (id: string | null, options?: {
         share?: boolean;
     }) => void;
@@ -86,12 +97,14 @@ declare function createApiClient(config: ApiClientConfig): {
     refreshAccessToken: () => Promise<boolean>;
     parseApiError: (res: Response) => Promise<string>;
     api: {
-        get: (path: string) => Promise<Response>;
-        post: (path: string, body?: unknown, options?: RequestInit) => Promise<Response>;
-        put: (path: string, body?: unknown) => Promise<Response>;
-        patch: (path: string, body?: unknown) => Promise<Response>;
-        delete: (path: string) => Promise<Response>;
+        get: (path: string, init?: ApiFetchInit) => Promise<Response>;
+        post: (path: string, body?: unknown, init?: ApiFetchInit) => Promise<Response>;
+        put: (path: string, body?: unknown, init?: ApiFetchInit) => Promise<Response>;
+        patch: (path: string, body?: unknown, init?: ApiFetchInit) => Promise<Response>;
+        delete: (path: string, init?: ApiFetchInit) => Promise<Response>;
     };
+    restoreSession: () => void;
+    clearSession: () => void;
 };
 type ApiClient = ReturnType<typeof createApiClient>;
 type Api = ApiClient['api'];
@@ -313,6 +326,36 @@ declare function createNotificationsClient(config: NotificationsClientConfig): {
     markAllSuiteNotificationsRead: () => Promise<void>;
 };
 
+/** Browser push state surfaced to settings UI. */
+type WebPushState = 'unsupported' | 'unconfigured' | 'default' | 'granted' | 'denied' | 'subscribed';
+interface WebPushConfig {
+    enabled: boolean;
+    public_key: string;
+}
+interface WebPushClientConfig {
+    api: Api;
+    parseApiError: (res: Response) => Promise<string>;
+    publicKeyPath?: string;
+    subscribePath?: string;
+    unsubscribePath?: string;
+    serviceWorkerPath?: string;
+    serviceWorkerScope?: string;
+}
+type WebPushClient = ReturnType<typeof createWebPushClient>;
+/**
+ * Browser Web Push client shared across ShellStack apps.
+ *
+ * Registration is per origin: each app ships its own `/sw.js` and manifest,
+ * but all talk to the same suite endpoints, so a subscription made in one app
+ * receives notifications for the whole suite.
+ */
+declare function createWebPushClient(config: WebPushClientConfig): {
+    supported: () => boolean;
+    getState: () => Promise<WebPushState>;
+    enable: () => Promise<void>;
+    disable: () => Promise<void>;
+};
+
 type SuiteAiJobEvent = {
     sequence: number;
     event_type: 'queued' | 'started' | 'progress' | 'tool' | 'completed' | 'failed' | 'cancelled';
@@ -373,4 +416,4 @@ declare function createJsonLd(config: JsonLdConfig): string;
 
 declare function useIsNight(): boolean;
 
-export { type Api, type ApiClient, type ApiClientConfig, type ApiFetch, type AppError, type AuthReturnPath, type AuthReturnPathConfig, type BrandSettings, type BrandSettingsConfig, type CrossAppSync, type CrossAppSyncConfig, type CrossAppSyncTopic, DEFAULT_ERROR_CODE, ERROR_CODES, ERROR_COPY, ERROR_RETRYABLE, type ErrorCode, FREE_PLAN_SEAT_HELP, type JsonLdConfig, type LiveRefresh, type LiveRefreshOptions, type NotificationsClient, type NotificationsClientConfig, ORGANISATION_SEAT_HELP, type PortalHandoffPayload, type PortalHandoffRead, type SeatType, type SubscriptionTier, type SuiteAiJob, type SuiteAiJobEvent, type SuiteNotification, type SuiteNotificationsResponse, TIDES_ACCESS_HELP, TURTLETIME_ACCESS_HELP, WEBHOOK_ACTIVITY_ACTIONS, WORKSPACE_SEAT_HELP, type WorkspaceAppearance, type WorkspaceAppearanceApiConfig, type WorkspaceAppearanceConfig, WorkspaceAppearanceError, type WorkspaceAppearanceHelpers, type WorkspaceAppearancePatch, type WorkspaceBrandPayload, type WorkspaceSubscription, type WorkspaceTheme, activeSuiteAiJobs, appErrorFromResponse, canDisableAppAccess, codeForStatus, copyFor, createApiClient, createAuthReturnPath, createBrandSettings, createCrossAppSync, createJsonLd, createLiveRefresh, createNotificationsClient, createWorkspaceAppearance, createWorkspaceAppearanceApi, defaultInviteSeatType, flagsFromSeatType, formatAppError, hasAppAccess, isErrorCode, normalizeError, normalizeThrown, planSeatSummary, resolveSubscriptionTier, seatTypeDescription, seatTypeFromFlags, seatTypeLabel, selectedToWebhookActions, sortedSuiteAiEvents, suiteAiEventSummary, tierAllowsTidesOnlySeats, tierAllowsTurtletime, tierLabel, useIsNight, webhookActionsToSelected };
+export { type Api, type ApiClient, type ApiClientConfig, type ApiFetchInit, type AppError, type AuthReturnPath, type AuthReturnPathConfig, type BrandSettings, type BrandSettingsConfig, type CrossAppSync, type CrossAppSyncConfig, type CrossAppSyncTopic, DEFAULT_ERROR_CODE, ERROR_CODES, ERROR_COPY, ERROR_RETRYABLE, type ErrorCode, FREE_PLAN_SEAT_HELP, type JsonLdConfig, type LiveRefresh, type LiveRefreshOptions, type NotificationsClient, type NotificationsClientConfig, ORGANISATION_SEAT_HELP, type PortalHandoffPayload, type PortalHandoffRead, type SeatType, type SubscriptionTier, type SuiteAiJob, type SuiteAiJobEvent, type SuiteNotification, type SuiteNotificationsResponse, TIDES_ACCESS_HELP, TURTLETIME_ACCESS_HELP, WEBHOOK_ACTIVITY_ACTIONS, WORKSPACE_SEAT_HELP, type WebPushClient, type WebPushClientConfig, type WebPushConfig, type WebPushState, type WorkspaceAppearance, type WorkspaceAppearanceApiConfig, type WorkspaceAppearanceConfig, WorkspaceAppearanceError, type WorkspaceAppearanceHelpers, type WorkspaceAppearancePatch, type WorkspaceBrandPayload, type WorkspaceSubscription, type WorkspaceTheme, activeSuiteAiJobs, appErrorFromResponse, canDisableAppAccess, codeForStatus, copyFor, createApiClient, createAuthReturnPath, createBrandSettings, createCrossAppSync, createJsonLd, createLiveRefresh, createNotificationsClient, createWebPushClient, createWorkspaceAppearance, createWorkspaceAppearanceApi, defaultInviteSeatType, flagsFromSeatType, formatAppError, hasAppAccess, isErrorCode, normalizeError, normalizeThrown, planSeatSummary, resolveSubscriptionTier, seatTypeDescription, seatTypeFromFlags, seatTypeLabel, selectedToWebhookActions, sortedSuiteAiEvents, suiteAiEventSummary, tierAllowsTidesOnlySeats, tierAllowsTurtletime, tierLabel, useIsNight, webhookActionsToSelected };

package/dist/index.js

@@ -43,6 +43,7 @@ __export(index_exports, {
   createJsonLd: () => createJsonLd,
   createLiveRefresh: () => createLiveRefresh,
   createNotificationsClient: () => createNotificationsClient,
+  createWebPushClient: () => createWebPushClient,
   createWorkspaceAppearance: () => createWorkspaceAppearance,
   createWorkspaceAppearanceApi: () => createWorkspaceAppearanceApi,
   defaultInviteSeatType: () => defaultInviteSeatType,
@@ -211,6 +212,7 @@ function createApiClient(config) {
   const ACCESS_KEY = config.accessTokenKey ?? `${config.storagePrefix}_access_token`;
   const REFRESH_KEY = config.refreshTokenKey ?? `${config.storagePrefix}_refresh_token`;
   const WORKSPACE_KEY = config.workspaceKey ?? `${config.storagePrefix}_active_workspace_id`;
+  const CLEAR_WORKSPACE = config.clearWorkspaceOnSignOut ?? true;
   let accessToken = null;
   let refreshToken = null;
   let activeWorkspaceId = null;
@@ -248,10 +250,12 @@ function createApiClient(config) {
   }
   function setTokens(access, refresh) {
     accessToken = access;
-    refreshToken = refresh;
+    authFailureFired = false;
+    if (refresh !== void 0) refreshToken = refresh;
     if (typeof window !== "undefined") {
       window.localStorage.setItem(ACCESS_KEY, access);
-      window.localStorage.setItem(REFRESH_KEY, refresh);
+      if (refresh) window.localStorage.setItem(REFRESH_KEY, refresh);
+      else if (refresh !== void 0) window.localStorage.removeItem(REFRESH_KEY);
     }
   }
   function getAccessToken() {
@@ -268,6 +272,9 @@ function createApiClient(config) {
     }
     return refreshToken;
   }
+  function hasAccessToken() {
+    return Boolean(getAccessToken());
+  }
   function setActiveWorkspaceId(id, options) {
     const changed = activeWorkspaceId !== id;
     activeWorkspaceId = id;
@@ -294,13 +301,17 @@ function createApiClient(config) {
     }
   }
   function clearAuth() {
+    config.onSignOut?.();
     accessToken = null;
     refreshToken = null;
     activeWorkspaceId = null;
     if (typeof window !== "undefined") {
       window.localStorage.removeItem(ACCESS_KEY);
       window.localStorage.removeItem(REFRESH_KEY);
-      window.localStorage.removeItem(WORKSPACE_KEY);
+      if (CLEAR_WORKSPACE) window.localStorage.removeItem(WORKSPACE_KEY);
+      for (const key of config.extraStorageKeysOnClear ?? []) {
+        window.localStorage.removeItem(key);
+      }
       const prefixes = config.sessionStorageClearPrefixes ?? [];
       if (prefixes.length > 0) {
         try {
@@ -359,36 +370,43 @@ function createApiClient(config) {
       return false;
     }
   }
-  async function apiFetch(path, options = {}) {
+  async function apiFetch(path, init = {}) {
+    const { skipAuth, ...requestInit } = init;
     const token = getAccessToken();
     const headers = {
       Accept: "application/json",
-      ...options.headers
+      ...requestInit.headers
     };
-    const body = options.body;
+    const body = requestInit.body;
     const isFormData = typeof FormData !== "undefined" && body instanceof FormData;
     if (!isFormData) {
       headers["Content-Type"] = "application/json";
     }
-    if (token) {
+    if (token && !skipAuth) {
       headers["Authorization"] = `Bearer ${token}`;
     }
     const wsId = getActiveWorkspaceId();
-    if (wsId) {
+    if (wsId && !skipAuth) {
       headers["X-Active-Workspace-Id"] = wsId;
     }
     const url = path.startsWith("http") ? path : `${API_URL}${path}`;
+    if (config.enforceSameOrigin && !skipAuth && path.startsWith("http") && !url.startsWith(API_URL)) {
+      throw new Error("Refusing to send the session to an unexpected origin.");
+    }
     async function doFetch() {
       try {
-        return await fetch(url, { ...options, headers });
-      } catch {
+        return await fetch(url, { ...requestInit, headers });
+      } catch (error) {
+        if (init.signal?.aborted || error instanceof DOMException && error.name === "AbortError") {
+          throw error;
+        }
         throw new Error(
           `Could not reach the API at ${API_URL}. Is the Django backend running?`
         );
       }
     }
     let res = await doFetch();
-    if (res.status === 401 && token) {
+    if (res.status === 401 && token && !skipAuth) {
       const refreshed = await refreshAccessToken();
       if (refreshed) {
         const newToken = getAccessToken();
@@ -396,9 +414,10 @@ function createApiClient(config) {
           headers["Authorization"] = `Bearer ${newToken}`;
         }
         res = await doFetch();
-        if (res.status === 401) {
-          triggerAuthFailure();
-        }
+      }
+      if (res.status === 401) {
+        clearAuth();
+        triggerAuthFailure();
       }
     }
     return res;
@@ -407,21 +426,23 @@ function createApiClient(config) {
     return formatAppError(await appErrorFromResponse(res));
   }
   const api = {
-    get: (path) => apiFetch(path),
-    post: (path, body, options = {}) => apiFetch(path, {
-      ...options,
+    get: (path, init) => apiFetch(path, init),
+    post: (path, body, init = {}) => apiFetch(path, {
+      ...init,
       method: "POST",
       body: body instanceof FormData ? body : body ? JSON.stringify(body) : void 0
     }),
-    put: (path, body) => apiFetch(path, {
+    put: (path, body, init = {}) => apiFetch(path, {
+      ...init,
       method: "PUT",
       body: body instanceof FormData ? body : body ? JSON.stringify(body) : void 0
     }),
-    patch: (path, body) => apiFetch(path, {
+    patch: (path, body, init = {}) => apiFetch(path, {
+      ...init,
       method: "PATCH",
       body: body instanceof FormData ? body : body ? JSON.stringify(body) : void 0
     }),
-    delete: (path) => apiFetch(path, { method: "DELETE" })
+    delete: (path, init = {}) => apiFetch(path, { ...init, method: "DELETE" })
   };
   return {
     API_URL,
@@ -429,6 +450,7 @@ function createApiClient(config) {
     setTokens,
     getAccessToken,
     getRefreshToken,
+    hasAccessToken,
     setActiveWorkspaceId,
     getActiveWorkspaceId,
     restoreWorkspace,
@@ -436,7 +458,10 @@ function createApiClient(config) {
     restoreTokens,
     refreshAccessToken,
     parseApiError,
-    api
+    api,
+    // Aliases used by Kraken/Shelly.
+    restoreSession: restoreTokens,
+    clearSession: clearAuth
   };
 }
 
@@ -1028,6 +1053,105 @@ function createNotificationsClient(config) {
   };
 }
 
+// src/notifications/create-web-push-client.ts
+function createWebPushClient(config) {
+  const { api, parseApiError } = config;
+  const PUBLIC_KEY_PATH = config.publicKeyPath ?? "/api/notifications/push/public-key/";
+  const SUBSCRIBE_PATH = config.subscribePath ?? "/api/notifications/push/subscribe/";
+  const UNSUBSCRIBE_PATH = config.unsubscribePath ?? "/api/notifications/push/unsubscribe/";
+  const SW_PATH = config.serviceWorkerPath ?? "/sw.js";
+  const SW_SCOPE = config.serviceWorkerScope ?? "/";
+  function supported() {
+    return typeof window !== "undefined" && "serviceWorker" in navigator && "PushManager" in window && "Notification" in window;
+  }
+  async function fetchConfig() {
+    const res = await api.get(PUBLIC_KEY_PATH);
+    if (!res.ok) throw new Error(await parseApiError(res));
+    return await res.json();
+  }
+  async function getRegistration() {
+    const existing = await navigator.serviceWorker.getRegistration(SW_SCOPE);
+    return existing ?? null;
+  }
+  function urlBase64ToUint8Array(base64) {
+    const padding = "=".repeat((4 - base64.length % 4) % 4);
+    const normalized = (base64 + padding).replace(/-/g, "+").replace(/_/g, "/");
+    const raw = atob(normalized);
+    const output = new Uint8Array(raw.length);
+    for (let i = 0; i < raw.length; i += 1) {
+      output[i] = raw.charCodeAt(i);
+    }
+    return output;
+  }
+  async function getState() {
+    if (!supported()) return "unsupported";
+    let cfg;
+    try {
+      cfg = await fetchConfig();
+    } catch {
+      return "unconfigured";
+    }
+    if (!cfg.enabled || !cfg.public_key) return "unconfigured";
+    if (Notification.permission === "denied") return "denied";
+    const registration = await getRegistration();
+    const subscription = await registration?.pushManager.getSubscription();
+    if (subscription && Notification.permission === "granted") {
+      return "subscribed";
+    }
+    if (Notification.permission === "granted") return "granted";
+    return "default";
+  }
+  async function enable() {
+    if (!supported()) {
+      throw new Error("This browser does not support notifications.");
+    }
+    const permission = await Notification.requestPermission();
+    if (permission !== "granted") {
+      throw new Error("Notification permission was not granted.");
+    }
+    const cfg = await fetchConfig();
+    if (!cfg.enabled || !cfg.public_key) {
+      throw new Error("Push notifications are not configured on the server.");
+    }
+    let registration = await getRegistration();
+    if (!registration) {
+      registration = await navigator.serviceWorker.register(SW_PATH, {
+        scope: SW_SCOPE
+      });
+    }
+    await navigator.serviceWorker.ready;
+    const existing = await registration.pushManager.getSubscription();
+    const subscription = existing ?? await registration.pushManager.subscribe({
+      userVisibleOnly: true,
+      applicationServerKey: urlBase64ToUint8Array(cfg.public_key)
+    });
+    const json = subscription.toJSON();
+    if (!json.endpoint || !json.keys?.p256dh || !json.keys?.auth) {
+      throw new Error("The browser returned an incomplete push subscription.");
+    }
+    const res = await api.post(SUBSCRIBE_PATH, {
+      endpoint: json.endpoint,
+      keys: { p256dh: json.keys.p256dh, auth: json.keys.auth },
+      user_agent: typeof navigator !== "undefined" ? navigator.userAgent : ""
+    });
+    if (!res.ok) throw new Error(await parseApiError(res));
+  }
+  async function disable() {
+    if (!supported()) return;
+    const registration = await getRegistration();
+    const subscription = await registration?.pushManager.getSubscription();
+    if (!subscription) return;
+    const endpoint = subscription.endpoint;
+    try {
+      await subscription.unsubscribe();
+    } catch {
+    }
+    const res = await api.post(UNSUBSCRIBE_PATH, { endpoint });
+    if (!res.ok) throw new Error(await parseApiError(res));
+  }
+  return { supported, getState, enable, disable };
+}
+
 // src/ai/suite-ai-job.ts
 function activeSuiteAiJobs(jobs) {
   return jobs.filter(
@@ -1156,6 +1280,7 @@ function useIsNight() {
   createJsonLd,
   createLiveRefresh,
   createNotificationsClient,
+  createWebPushClient,
   createWorkspaceAppearance,
   createWorkspaceAppearanceApi,
   defaultInviteSeatType,