node-webpush 1.0.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,298 @@
+# Node WebPush (Node.js + TypeScript)
+
+[![npm version](https://img.shields.io/npm/v/@alexanderslaa/node-webpush?logo=npm)](https://www.npmjs.com/package/@alexanderslaa/node-webpush)
+[![License](https://img.shields.io/npm/l/@alexanderslaa/node-webpush)](https://github.com/alexanderslaa/node-webpush/blob/main/LICENSE)
+[![CI](https://github.com/alexanderslaa/node-webpush/actions/workflows/test.yml/badge.svg)](https://github.com/alexanderslaa/node-webpush/actions)
+[![Codecov](https://img.shields.io/codecov/c/github/alexanderslaa/node-webpush)](https://codecov.io/gh/alexanderslaa/node-webpush)
+
+A dependency-free Web Push implementation for Node.js (TypeScript-first).
+
+This library focuses on **standards-compliant payload encryption + VAPID authentication**, and produces request details
+that can be sent with Node’s built-in `fetch()`.
+
+## Features
+
+### ✅ Standards & compatibility
+
+- **RFC 8188**: HTTP Encrypted Content Encoding (record-based framing, per-record nonce derivation).
+- **RFC 8291**: Web Push message encryption (ECDH + auth secret, “WebPush: info” key schedule, `aes128gcm`).
+- **RFC 8292**: VAPID (JWT ES256) authentication headers.
+- Supports both encodings:
+    - **`aes128gcm` (recommended)**: modern Web Push encoding (RFC 8291 + RFC 8188).
+    - **`aesgcm` (legacy)**: kept for interoperability with older endpoints.
+
+### 🔐 Encryption
+
+- Pure Node.js `crypto` (no external libs).
+- RFC8188 record framing:
+    - delimiter rules (`0x01` for non-last, `0x02` for last)
+    - optional final-record padding
+    - nonce = `baseNonce XOR SEQ` per record
+
+### 🪪 VAPID
+
+- Native ES256 JWT signing using Node’s `crypto` (JWK-based key objects).
+- Key generation (`VAPID.GenerateKeys()`).
+- Full validation helpers (`VAPID.Validate.*`).
+
+### 🧰 Request building
+
+- `generateRequestDetails()` produces `{ endpoint, init }` for `fetch(endpoint, init)`.
+- Sets required headers:
+    - `TTL`, `Urgency`, optional `Topic`
+    - `Content-Encoding`, `Content-Type`, `Content-Length`
+    - `Authorization` (VAPID or GCM/FCM key when applicable)
+
+### ⚠️ GCM / FCM edge cases
+
+- Detects legacy **GCM** endpoints:
+    - Uses `Authorization: key=<apiKey>` (VAPID not supported on legacy GCM).
+- Supports **FCM** endpoints:
+    - Uses VAPID by default when configured.
+    - Can fall back to `Authorization: key=<apiKey>` if VAPID is disabled and a key is provided.
+
+---
+
+## Installation
+
+> (Adjust package name once published)
+
+```bash
+npm install <your-package-name>
+````
+
+TypeScript is supported out of the box (the package emits `.d.ts`).
+
+---
+
+## Quick start
+
+### 1) Create a `WebPush` instance
+
+```ts
+import {WebPush} from "<your-package-name>";
+
+const webpush = new WebPush({
+    vapid: {
+        subject: "mailto:admin@example.com",
+        publicKey: process.env.VAPID_PUBLIC_KEY!,
+        privateKey: process.env.VAPID_PRIVATE_KEY!,
+    },
+    // Optional: used for legacy GCM/FCM key-based auth fallback
+    gcm: {apiKey: process.env.GCM_API_KEY ?? null},
+});
+```
+
+### 2) Send a notification
+
+```ts
+const subscription = {
+    endpoint: "https://push-service.example/...",
+    keys: {
+        p256dh: "<base64url>",
+        auth: "<base64url>",
+    },
+};
+
+const res = await webpush.sendNotification(subscription, "Hello from WebPush!", {
+    TTL: 60,
+});
+
+console.log("Status:", res.status);
+```
+
+---
+
+## Generate VAPID keys
+
+```ts
+import {VAPID} from "<your-package-name>";
+
+const keys = VAPID.GenerateKeys();
+console.log(keys.publicKey);
+console.log(keys.privateKey);
+```
+
+You typically store these as environment variables:
+
+* `VAPID_PUBLIC_KEY`
+* `VAPID_PRIVATE_KEY`
+
+---
+
+## API Reference (high level)
+
+### `new WebPush(config)`
+
+```ts
+type WebPushConfig = {
+    vapid: {
+        publicKey: string;
+        privateKey: string;
+        subject: string | URL; // must be https: or mailto:
+    };
+    gcm?: { apiKey?: string | null };
+};
+```
+
+Constructing `WebPush` validates:
+
+* VAPID subject format (`https:` or `mailto:`)
+* VAPID key sizes and base64url encoding
+* GCM/FCM key if provided (must be non-empty)
+
+---
+
+### `webpush.generateRequestDetails(subscription, payload?, options?)`
+
+Returns the request parameters to call `fetch()` yourself.
+
+```ts
+const {endpoint, init} = webpush.generateRequestDetails(subscription, "payload", {
+    TTL: 60,
+});
+
+const res = await fetch(endpoint, init);
+```
+
+This is useful if you want to:
+
+* inspect headers
+* plug into your own HTTP stack
+* retry logic / circuit breakers
+* log request metadata
+
+---
+
+### `webpush.sendNotification(subscription, payload?, options?)`
+
+Sends the request using `fetch()`.
+
+```ts
+const res = await webpush.sendNotification(subscription, "hello");
+```
+
+Throws `WebPushError` when the push service returns a non-2xx response.
+
+---
+
+## Options
+
+```ts
+type GenerateRequestOptions = {
+    headers?: Record<string, string>;
+
+    TTL?: number; // seconds
+    urgency?: "very-low" | "low" | "normal" | "high";
+    topic?: string; // base64url <= 32 chars
+
+    contentEncoding?: "aes128gcm" | "aesgcm";
+
+    // RFC8188 knobs (primarily for advanced use/testing)
+    rs?: number; // default 4096, must be >= 18
+    allowMultipleRecords?: boolean; // default false (Web Push wants single record)
+    finalRecordPadding?: number; // default 0
+
+    // Override authentication behavior:
+    vapidDetails?: WebPushConfig["vapid"] | null;
+    gcmAPIKey?: string | null;
+};
+```
+
+### Notes
+
+* **`aes128gcm` is recommended** for Web Push.
+* For Web Push interoperability, leave `allowMultipleRecords` at `false` (default).
+* `topic` must use URL-safe base64 characters and be <= 32 chars.
+
+---
+
+## Choosing auth method (VAPID vs key)
+
+This library follows typical push-service rules:
+
+1. **Legacy GCM endpoint** (`https://android.googleapis.com/gcm/send...`)
+
+* Uses `Authorization: key=<gcmAPIKey>`
+* VAPID is ignored (not supported)
+
+2. **Everything else**
+
+* If `vapidDetails` is present: uses VAPID
+* Else if endpoint is FCM and a key is present: uses `Authorization: key=<gcmAPIKey>`
+
+If you want to disable VAPID for a call:
+
+```ts
+await webpush.sendNotification(subscription, "hello", {
+    vapidDetails: null,
+    gcmAPIKey: process.env.GCM_API_KEY!,
+});
+```
+
+---
+
+## Minimal example with manual fetch
+
+```ts
+import {WebPush} from "<your-package-name>";
+
+const webpush = new WebPush({
+    vapid: {
+        subject: "https://example.com/contact",
+        publicKey: process.env.VAPID_PUBLIC_KEY!,
+        privateKey: process.env.VAPID_PRIVATE_KEY!,
+    },
+});
+
+const {endpoint, init} = webpush.generateRequestDetails(subscription, "ping", {
+    TTL: 120,
+    urgency: "high",
+});
+
+console.log(init.headers); // inspect headers
+
+const res = await fetch(endpoint, init);
+console.log(res.status);
+```
+
+---
+
+## Error handling
+
+```ts
+import {WebPush, WebPushError} from "<your-package-name>";
+
+try {
+    await webpush.sendNotification(subscription, "hello");
+} catch (e) {
+    if (e instanceof WebPushError) {
+        console.error("Push service rejected request:", e.response.status);
+        console.error("Response body:", await e.response.text());
+    } else {
+        console.error("Unexpected error:", e);
+    }
+}
+```
+
+---
+
+## Runtime requirements
+
+* Node.js with global `fetch` (Node 18+ recommended).
+* TypeScript `target: ES2020` works.
+
+---
+
+## Security notes
+
+* Keep your **VAPID private key secret**.
+* Always validate subscriptions server-side before storing or using them.
+* Avoid sending sensitive data in payloads; push payloads can be stored/forwarded by push services.
+
+---
+
+## License
+
+Apache 2.0 See [LICENSE](./LICENSE)
+

package/dist/constants.d.ts

@@ -0,0 +1,19 @@
+export declare enum SupportedContentEncoding {
+    AES_GCM = "aesgcm",
+    AES_128_GCM = "aes128gcm"
+}
+export declare enum SupportedUrgency {
+    VERY_LOW = "very-low",
+    LOW = "low",
+    NORMAL = "normal",
+    HIGH = "high"
+}
+/** Default TTL is 4 weeks (seconds). */
+export declare const DEFAULT_TTL = 2419200;
+/**
+ * Default record size (RFC8188 `rs`) for aes128gcm.
+ * For Web Push (RFC8291), a single record is required, but `rs` still appears in the body header.
+ */
+export declare const DEFAULT_RS = 4096;
+/** Minimum valid `rs` for aes128gcm per RFC8188 (must be >= 18). */
+export declare const MIN_RS = 18;

package/dist/crypto/rfc8188.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Build RFC8188 plaintext records from message bytes.
+ *
+ * Record plaintext length for full records is `rs - 16` because AES-GCM adds a 16-byte tag.
+ * The padding delimiter must be present in every record:
+ * - 0x01 for all non-last records
+ * - 0x02 for the last record
+ */
+export declare function buildPlaintextRecords(params: {
+    message: Buffer;
+    rs: number;
+    allowMultipleRecords: boolean;
+    finalRecordPadding: number;
+}): Buffer[];
+/**
+ * Encrypt RFC8188 plaintext records using AES-128-GCM.
+ *
+ * Nonce per record: nonce = baseNonce XOR SEQ (96-bit big-endian SEQ starting at 0).
+ * AAD is empty.
+ */
+export declare function encryptRecords(params: {
+    cek: Buffer;
+    baseNonce: Buffer;
+    plaintextRecords: Buffer[];
+}): Buffer;

package/dist/crypto/webpush-encryption.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Encrypt a push payload using RFC8291 + RFC8188 with aes128gcm.
+ *
+ * Returns the full RFC8188 body:
+ *   salt(16) || rs(4) || idlen(1) || keyid(=sender pubkey) || encryptedRecords
+ */
+export declare function encryptAes128GcmBody(params: {
+    p256dh: string;
+    auth: string;
+    payload: Buffer;
+    rs: number;
+    allowMultipleRecords: boolean;
+    finalRecordPadding: number;
+}): Buffer;
+/**
+ * Legacy aesgcm encryption for interop.
+ * Returns ciphertext plus values needed for headers: Encryption (salt) and Crypto-Key (dh).
+ */
+export declare function encryptAesGcmLegacy(params: {
+    p256dh: string;
+    auth: string;
+    payload: Buffer;
+}): {
+    saltB64Url: string;
+    localPublicKey: Buffer;
+    ciphertext: Buffer;
+};

package/dist/index.cjs.js

@@ -0,0 +1,2 @@
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const m=require("crypto");var w=(e=>(e.AES_GCM="aesgcm",e.AES_128_GCM="aes128gcm",e))(w||{}),A=(e=>(e.VERY_LOW="very-low",e.LOW="low",e.NORMAL="normal",e.HIGH="high",e))(A||{});const T=2419200,D=4096,P=18,f={validate(e){return/^[A-Za-z0-9\-_]+$/.test(e)},toBuffer(e){return Buffer.from(e,"base64url")},toString(e){return(typeof e=="string"?Buffer.from(e,"utf8"):Buffer.from(e)).toString("base64url")},toJSON(e){return this.toString(Buffer.from(JSON.stringify(e),"utf8"))}},M=720*60,$=1440*60;function L(e){const t=new Date;return t.setSeconds(t.getSeconds()+e),Math.floor(t.getTime()/1e3)}const E={subject(e){if(!e)throw new Error("No subject set in VAPID details.");const t=typeof e=="string"?new URL(e):e;if(!["https:","mailto:"].includes(t.protocol))throw new Error(`VAPID subject must be https: or mailto:. Got: ${t.toString()}`);t.hostname==="localhost"&&console.warn("VAPID subject points to localhost; some push services may reject this.")},publicKey(e){if(!e)throw new Error("No VAPID public key set.");if(typeof e!="string"||!f.validate(e))throw new Error('VAPID public key must be base64url without "=" padding.');const t=f.toBuffer(e);if(t.length!==65||t[0]!==4)throw new Error("VAPID public key must decode to 65-byte uncompressed P-256.")},privateKey(e){if(!e)throw new Error("No VAPID private key set.");if(typeof e!="string"||!f.validate(e))throw new Error('VAPID private key must be base64url without "=" padding.');if(f.toBuffer(e).length!==32)throw new Error("VAPID private key must decode to 32 bytes.")},expiration(e){if(!Number.isInteger(e))throw new Error("VAPID expiration must be an integer.");if(e<0)throw new Error("VAPID expiration must be positive.");const t=L($);if(e>=t)throw new Error("VAPID expiration exceeds 24 hours.")},audience(e){if(!e)throw new Error("No audience set for VAPID.");const t=typeof e=="string"?new URL(e):e;if(!t.origin||t.origin==="null")throw new Error(`VAPID audience must be an origin. Got: ${t.toString()}`)}};function G(){const e=m.createECDH("prime256v1");e.generateKeys();let t=e.getPublicKey(),r=e.getPrivateKey();return r.length<32&&(r=Buffer.concat([Buffer.alloc(32-r.length,0),r])),t.length<65&&(t=Buffer.concat([Buffer.alloc(65-t.length,0),t])),{publicKey:f.toString(t),privateKey:f.toString(r)}}function U(e){const t=f.toBuffer(e);if(t.length!==65||t[0]!==4)throw new Error("Invalid uncompressed P-256 public key.");return{x:f.toString(t.subarray(1,33)),y:f.toString(t.subarray(33,65))}}function j(e){const t=f.toBuffer(e);if(t.length!==32)throw new Error("Invalid P-256 private key scalar.");return f.toString(t)}function O(e,t=32){let r=0;if(e[r++]!==48)throw new Error("Invalid DER signature (expected SEQUENCE).");let n=e[r++];if(n&128){const l=n&127;r+=l}if(e[r++]!==2)throw new Error("Invalid DER signature (expected INTEGER r).");const c=e[r++];let o=e.subarray(r,r+c);if(r+=c,e[r++]!==2)throw new Error("Invalid DER signature (expected INTEGER s).");const i=e[r++];let s=e.subarray(r,r+i);if(o[0]===0&&(o=o.subarray(1)),s[0]===0&&(s=s.subarray(1)),o.length>t||s.length>t)throw new Error("Invalid DER signature size.");const u=Buffer.concat([Buffer.alloc(t-o.length,0),o]),d=Buffer.concat([Buffer.alloc(t-s.length,0),s]);return Buffer.concat([u,d])}function V(e,t,r){const n={typ:"JWT",alg:"ES256"},c=f.toJSON(n),o=f.toJSON(e),i=`${c}.${o}`,{x:s,y:u}=U(r),d=j(t),l=m.createPrivateKey({key:{kty:"EC",crv:"P-256",x:s,y:u,d},format:"jwk"}),y=m.sign("sha256",Buffer.from(i,"utf8"),{key:l,dsaEncoding:"der"}),h=O(y,32),g=f.toString(h);return`${i}.${g}`}function _(e){E.audience(e.audience),E.subject(e.subject),E.publicKey(e.publicKey),E.privateKey(e.privateKey);const t=(typeof e.audience=="string"?new URL(e.audience):e.audience).origin,r=(typeof e.subject=="string"?new URL(e.subject):e.subject).toString(),n=e.expiration??L(M);E.expiration(n);const c=V({aud:t,exp:n,sub:r},e.privateKey,e.publicKey),o=new Headers;if(e.contentEncoding===w.AES_128_GCM)o.set("Authorization",`vapid t=${c}, k=${e.publicKey}`);else if(e.contentEncoding===w.AES_GCM)o.set("Authorization",`WebPush ${c}`),o.set("Crypto-Key",`p256ecdsa=${e.publicKey}`);else throw new Error(`Unsupported content encoding: ${e.contentEncoding}`);return o}const F=Object.freeze(Object.defineProperty({__proto__:null,GenerateHeaders:_,GenerateKeys:G,Validate:E},Symbol.toStringTag,{value:"Module"}));function W(e){const t=Buffer.alloc(2);return t.writeUInt16BE(e,0),t}function H(e){const t=Buffer.alloc(4);return t.writeUInt32BE(e>>>0,0),t}function J(e,t){if(e.length!==t.length)throw new Error("xorBytes: length mismatch");const r=Buffer.alloc(e.length);for(let n=0;n<e.length;n++)r[n]=e[n]^t[n];return r}function z(e){if(!Number.isSafeInteger(e)||e<0)throw new Error("SEQ must be a non-negative safe integer");const t=Buffer.alloc(12,0),r=Math.floor(e/4294967296),n=e>>>0;return t.writeUInt32BE(r>>>0,4),t.writeUInt32BE(n,8),t}function X(e){const{message:t,rs:r,allowMultipleRecords:n,finalRecordPadding:c}=e;if(!Number.isInteger(r)||r<P)throw new Error(`Invalid rs; must be an integer >= ${P}.`);const o=r-16;if(o<=1)throw new Error("Invalid rs (too small)");const i=o-1;if(!n&&t.length>i)throw new Error(`Payload too large for a single RFC8188 record: ${t.length} bytes. Max is ${i} bytes for rs=${r}.`);if(!Number.isInteger(c)||c<0)throw new Error("finalRecordPadding must be a non-negative integer");const s=[];let u=0;for(;u<t.length;){const d=t.length-u,l=d<=i,y=l?d:i,h=t.subarray(u,u+y);u+=y;const g=Buffer.from([l?2:1]);if(l)s.push(Buffer.concat([h,g,Buffer.alloc(c,0)]));else{const a=o-(h.length+1);s.push(Buffer.concat([h,g,Buffer.alloc(a,0)]))}}return t.length===0&&s.push(Buffer.from([2])),s}function q(e){const{cek:t,baseNonce:r,plaintextRecords:n}=e;if(t.length!==16)throw new Error("CEK must be 16 bytes");if(r.length!==12)throw new Error("baseNonce must be 12 bytes");const c=[];for(let o=0;o<n.length;o++){const i=J(r,z(o)),s=m.createCipheriv("aes-128-gcm",t,i),u=Buffer.concat([s.update(n[o]),s.final()]);c.push(Buffer.concat([u,s.getAuthTag()]))}return Buffer.concat(c)}function b(e,t){return m.createHmac("sha256",e).update(t).digest()}function x(e,t){if(!e||typeof e!="string")throw new Error("subscription.keys.p256dh must be a string");if(!t||typeof t!="string")throw new Error("subscription.keys.auth must be a string");const r=f.toBuffer(e);if(r.length!==65||r[0]!==4)throw new Error("subscription.keys.p256dh must decode to a 65-byte uncompressed P-256 public key");if(f.toBuffer(t).length<16)throw new Error("subscription.keys.auth must decode to at least 16 bytes")}function Q(e){x(e.p256dh,e.auth);const t=f.toBuffer(e.p256dh),r=f.toBuffer(e.auth),n=m.createECDH("prime256v1");n.generateKeys();const c=n.getPublicKey(),o=n.computeSecret(t),i=m.randomBytes(16),s=b(r,o),u=Buffer.concat([Buffer.from("WebPush: info","utf8"),Buffer.from([0]),t,c]),d=b(s,Buffer.concat([u,Buffer.from([1])])),l=b(i,d),y=Buffer.concat([Buffer.from("Content-Encoding: aes128gcm","utf8"),Buffer.from([0])]),h=Buffer.concat([Buffer.from("Content-Encoding: nonce","utf8"),Buffer.from([0])]),g=b(l,Buffer.concat([y,Buffer.from([1])])).subarray(0,16),a=b(l,Buffer.concat([h,Buffer.from([1])])).subarray(0,12),B=X({message:e.payload,rs:e.rs,allowMultipleRecords:e.allowMultipleRecords,finalRecordPadding:e.finalRecordPadding}),S=q({cek:g,baseNonce:a,plaintextRecords:B});if(c.length!==65)throw new Error("Sender public key must be 65 bytes");return Buffer.concat([i,H(e.rs),Buffer.from([c.length]),c,S])}function Y(e){x(e.p256dh,e.auth);const t=f.toBuffer(e.p256dh),r=f.toBuffer(e.auth),n=m.createECDH("prime256v1");n.generateKeys();const c=n.getPublicKey(),o=n.computeSecret(t),i=m.randomBytes(16),s=b(r,o),u=Buffer.concat([Buffer.from("WebPush: info","utf8"),Buffer.from([0]),t,c]),d=b(s,Buffer.concat([u,Buffer.from([1])])),l=b(i,d),y=Buffer.concat([Buffer.from("Content-Encoding: aesgcm","utf8"),Buffer.from([0])]),h=Buffer.concat([Buffer.from("Content-Encoding: nonce","utf8"),Buffer.from([0])]),g=b(l,Buffer.concat([y,Buffer.from([1])])).subarray(0,16),a=b(l,Buffer.concat([h,Buffer.from([1])])).subarray(0,12),B=0,S=Buffer.concat([W(B),Buffer.alloc(B,0),e.payload]),v=m.createCipheriv("aes-128-gcm",g,a),k=Buffer.concat([v.update(S),v.final()]),K=v.getAuthTag();return{saltB64Url:f.toString(i),localPublicKey:c,ciphertext:Buffer.concat([k,K])}}class N extends Error{constructor(t,r){super(t),this.response=r}}function Z(e){if(!f.validate(e))throw new Error("Topic contains invalid characters; must be URL-safe base64 chars.");if(e.length>32)throw new Error("Topic must be <= 32 characters.")}function ee(e){return e.startsWith("https://android.googleapis.com/gcm/send")}function te(e){return e.startsWith("https://fcm.googleapis.com/fcm/send")||e.includes("fcm.googleapis.com")}function re(e){return new URL(e).origin}function ne(e){if(!Object.values(w).includes(e))throw new Error(`Unsupported content encoding: ${e}`)}function oe(e){if(!Object.values(A).includes(e))throw new Error(`Unsupported urgency: ${e}`)}class ce{constructor(t){if(this.config=t,E.subject(t.vapid.subject),E.privateKey(t.vapid.privateKey),E.publicKey(t.vapid.publicKey),t.gcm?.apiKey!=null&&t.gcm.apiKey.length===0)throw new Error("The GCM/FCM API Key should be a non-empty string, null, or undefined.")}generateRequestDetails(t,r,n){if(!t?.endpoint||typeof t.endpoint!="string"||t.endpoint.length===0)throw new Error("You must pass a subscription with a valid endpoint URL.");const c=n?.TTL??T;if(!Number.isFinite(c)||c<0)throw new Error("TTL must be a number >= 0.");const o=n?.contentEncoding??w.AES_128_GCM;ne(o);const i=n?.urgency??A.NORMAL;oe(i);const s=n?.topic;s&&Z(s);const u=n?.allowMultipleRecords??!1,d=n?.rs??D;if(!Number.isInteger(d)||d<P)throw new Error(`rs must be an integer >= ${P}.`);const l=n?.finalRecordPadding??0,y=n?.headers??{},h=n?.gcmAPIKey??this.config.gcm?.apiKey??null,g=n?.vapidDetails===void 0?this.config.vapid:n.vapidDetails,a={TTL:String(c),Urgency:i,...y};s&&(a.Topic=s);let B;if(r!=null&&r!==""){if(!t.keys?.p256dh||!t.keys?.auth)throw new Error("To send a payload, the subscription must include 'keys.p256dh' and 'keys.auth'.");const I=Buffer.isBuffer(r)?r:r instanceof Uint8Array?Buffer.from(r):Buffer.from(r,"utf8");if(a["Content-Type"]="application/octet-stream",o===w.AES_128_GCM){const p=Q({p256dh:t.keys.p256dh,auth:t.keys.auth,payload:I,rs:d,allowMultipleRecords:u,finalRecordPadding:l});B=p,a["Content-Encoding"]=w.AES_128_GCM,a["Content-Length"]=String(p.length)}else{const p=Y({p256dh:t.keys.p256dh,auth:t.keys.auth,payload:I});B=p.ciphertext,a["Content-Encoding"]=w.AES_GCM,a["Content-Length"]=String(p.ciphertext.length),a.Encryption=`salt=${p.saltB64Url}`,a["Crypto-Key"]=`dh=${f.toString(p.localPublicKey)}`}}else a["Content-Length"]="0";const v=t.endpoint,k=ee(v),K=te(v);if(k)h?a.Authorization=`key=${h}`:console.warn("GCM endpoint detected but no GCM API key provided.");else if(g){const I=re(v),p=_({audience:I,subject:g.subject,publicKey:g.publicKey,privateKey:g.privateKey,contentEncoding:o}),C=p.get("Authorization");C&&(a.Authorization=C);const R=p.get("Crypto-Key");R&&o===w.AES_GCM&&(a["Crypto-Key"]=a["Crypto-Key"]?`${a["Crypto-Key"]}; ${R}`:R)}else K&&h&&(a.Authorization=`key=${h}`);return{endpoint:v,init:{method:"POST",headers:a,body:B}}}async sendNotification(t,r,n){const{endpoint:c,init:o}=this.generateRequestDetails(t,r,n),i=await fetch(c,o);if(!i.ok)throw new N("Received unexpected response code",i);return i}}exports.DEFAULT_RS=D;exports.DEFAULT_TTL=T;exports.MIN_RS=P;exports.SupportedContentEncoding=w;exports.SupportedUrgency=A;exports.VAPID=F;exports.WebPush=ce;exports.WebPushError=N;
+//# sourceMappingURL=index.cjs.js.map