feat!: 2.0, RFC 8291 aes128gcm and RFC 8292 vapid

[maxholman]

Supersedes #18, whose two remaining checklist items are done here.

The encoding

Messages now use aes128gcm from RFC 8291 and the vapid authorization scheme from RFC 8292, replacing the draft-04 aesgcm encoding and the WebPush scheme.

Apple accepts neither of the old ones, so Safari and iOS never worked with this library. That is the reason for the major.

Verified against the RFC 8291 section 5 worked example, which the implementation reproduces byte for byte, and by decrypting the payload the way a subscriber does.

Breaking

• encryptNotification returns the complete RFC 8188 body rather than { ciphertext, salt, localPublicKeyBytes }, and takes an options argument
• the crypto-key and encryption headers are gone
• maximum payload is 3993 bytes
• buildPushPayload is otherwise unchanged, so fetch(subscription.endpoint, payload) still works as documented

Anything that needs the aesgcm encoding should stay on 1.x.

Security

A Fable security review found nothing exploitable, and a second pass re-verified the crypto after the review's own recommendations were applied. Its HKDF check compared the implementation against Node's native hkdfSync and a hand written RFC 5869 loop across 417 input combinations with no mismatches.

Applied from it:

• every message is padded to a constant 4096 octets, so ciphertext length does not disclose plaintext length. This also keeps the body inside the size a push service is obliged to accept under RFC 8030 section 7.2, which the previous 4182 byte maximum did not
• p256dh is validated as a 65 byte uncompressed P-256 point, auth as 16 octets, and the endpoint as https
• ephemeral and HMAC keys import non-extractable, and the private JWK is no longer materialised as a string

Tests

The tests that posted to real FCM and WNS endpoints are gone. They asserted a 201, which says the push service accepted the request and nothing about whether a subscriber can read it, and they relied on fake subscriptions that expire.

In their place:

• the RFC 8291 section 5 vector
• a decrypt round trip over four payload sizes with freshly generated keys
• constant-size padding assertions, and the oversize, p256dh, auth and non-https rejections
• a new e2e package that subscribes real Chrome and real Firefox to their real push services, sends a notification, and asserts the service worker decrypted it. It is not in CI and not part of make test

17 unit tests and 2 e2e tests.

Closes the #18 checklist

remove triple slash references, to avoid a repeat of #15 and #16. Done, and checked rather than assumed: a consumer with lib: ["es2022"], types: [] and skipLibCheck: false typechecks against the packed tarball. That took dropping type-fest, which reintroduced the #16 class through Float16Array. Jsonifiable and RequireAtLeastOne are now about ten lines in types.ts, and the package ships one dependency.

better integration tests that do not involve fake subscriptions. Done, see above.

Everything else

pnpm 11, typescript 7, vitest 4, node 26 for development on a node 22 floor. Biome replaced with oxlint and oxfmt. Shared versions move through a pnpm catalog. Tailwind 4, wrangler 4 with wrangler.jsonc, drizzle 1.0 rc in the examples. CI tests node 22, 24 and 26 and runs lint.

The nodejs example never created its table on a clean checkout: the journal indexing its migration was gitignored. Fixed.