@hansjm10/volt-coding-agent 0.0.0-bootstrap.0 → 0.1.0

package/dist/core/remote/iroh/push.d.ts

@@ -0,0 +1,179 @@
+import type { RpcRegisterPushTargetArgs, RpcRegisterPushTargetResponse } from "../../rpc/types.ts";
+import type { IrohRemoteAuditLogger } from "./audit.ts";
+import type { IrohRemoteClient, IrohRemotePushTokenEnvironment } from "./state.ts";
+import type { IrohRemoteHostStateManager } from "./state-manager.ts";
+export declare const DEFAULT_IROH_REMOTE_PUSH_RELAY_RETRY_ATTEMPTS = 3;
+export declare const DEFAULT_IROH_REMOTE_PUSH_RELAY_RETRY_DELAY_MS = 250;
+export declare const DEFAULT_IROH_REMOTE_PUSH_RELAY_TIMEOUT_MS = 10000;
+export declare const DEFAULT_IROH_REMOTE_PUSH_RELAY_URL = "https://us-central1-volt-3fae7.cloudfunctions.net/pushRelay";
+export type IrohRemotePushTargetRegistrationRequest = RpcRegisterPushTargetArgs;
+export type IrohRemotePushTargetRegistrationResult = RpcRegisterPushTargetResponse;
+export interface IrohRemotePushNotificationIntent {
+    eventId: string;
+    kind: string;
+    title: string;
+    body: string;
+    sessionId?: string;
+    workspace?: string;
+}
+export interface IrohRemoteLiveActivityToolGlyph {
+    name: string;
+    symbolName: string;
+    status: "started" | "completed" | "failed";
+}
+export interface IrohRemoteLiveActivityContentState {
+    status: "running" | "completed" | "failed" | "waiting";
+    statusText: string;
+    currentTool?: IrohRemoteLiveActivityToolGlyph;
+    recentTools: IrohRemoteLiveActivityToolGlyph[];
+    sessionID?: string;
+    workspaceName?: string;
+    updatedAtEpochSeconds: number;
+}
+export interface IrohRemoteLiveActivityUpdateIntent {
+    eventId: string;
+    kind: string;
+    activityEvent?: "update" | "end";
+    contentState: IrohRemoteLiveActivityContentState;
+    staleDateEpochSeconds?: number;
+    dismissalDateEpochSeconds?: number;
+}
+export interface IrohRemotePushRelayNotificationRequest {
+    pushTargetId: string;
+    pushTargetAuthToken: string;
+    eventId: string;
+    kind: string;
+    title: string;
+    body: string;
+    workspace?: string;
+    data: {
+        eventId: string;
+        kind: string;
+        sessionId?: string;
+        workspace?: string;
+    };
+}
+export interface IrohRemotePushRelayLiveActivityRequest {
+    pushTargetId: string;
+    pushTargetAuthToken: string;
+    activityId: string;
+    activityPushToken: string;
+    /** APNs environment of the activity push token, when the client reported one. */
+    tokenEnvironment?: IrohRemotePushTokenEnvironment;
+    eventId: string;
+    kind: string;
+    contentState: IrohRemoteLiveActivityContentState;
+    activityEvent?: "update" | "end";
+    staleDateEpochSeconds?: number;
+    dismissalDateEpochSeconds?: number;
+}
+export interface IrohRemotePushRelayRevocationRequest {
+    pushTargetId: string;
+    pushTargetAuthToken: string;
+}
+export type IrohRemotePushRelayNotificationResult = {
+    status: "sent";
+} | {
+    status: "invalid_target";
+};
+export type IrohRemotePushRelayRevocationResult = {
+    status: "revoked";
+} | {
+    status: "already_absent";
+};
+export interface IrohRemotePushRelayClient {
+    sendNotification(request: IrohRemotePushRelayNotificationRequest): Promise<IrohRemotePushRelayNotificationResult>;
+    sendLiveActivityUpdate?(request: IrohRemotePushRelayLiveActivityRequest): Promise<IrohRemotePushRelayNotificationResult>;
+    revokePushTarget?(request: IrohRemotePushRelayRevocationRequest): Promise<IrohRemotePushRelayRevocationResult>;
+}
+export interface IrohRemotePushTargetRevocationSummary {
+    attempted: number;
+    revoked: number;
+    alreadyAbsent: number;
+    failed: number;
+    skipped: number;
+}
+export type IrohRemotePushNotificationDeliveryStatus = "sent" | "no_push_target" | "duplicate" | "failed" | "invalid_target";
+export interface IrohRemotePushNotificationDelivery {
+    deliverNotification(notification: IrohRemotePushNotificationIntent): Promise<IrohRemotePushNotificationDeliveryStatus>;
+    deliverLiveActivityUpdate?(update: IrohRemoteLiveActivityUpdateIntent): Promise<IrohRemotePushNotificationDeliveryStatus>;
+}
+export interface IrohRemotePushNotificationDeduper {
+    tryMark(clientNodeId: string, eventId: string): boolean;
+    /** Release a mark claimed by tryMark when the corresponding delivery did not succeed. */
+    unmark(clientNodeId: string, eventId: string): void;
+}
+export interface IrohRemotePushNotificationDispatcherOptions {
+    auditLogger?: IrohRemoteAuditLogger;
+    clientNodeId: string;
+    deduper?: IrohRemotePushNotificationDeduper;
+    now?: () => number;
+    relayClient: IrohRemotePushRelayClient;
+    retryAttempts?: number;
+    retryDelayMs?: number;
+    stateManager: IrohRemoteHostStateManager;
+    workspace?: string;
+}
+export interface IrohRemotePushRelayHttpClientOptions {
+    authToken?: string;
+    baseUrl?: string;
+    fetcher?: (input: string, init: RequestInit) => Promise<Response>;
+    timeoutMs?: number;
+}
+export declare const MAX_IROH_REMOTE_PUSH_TARGET_REVOCATIONS_PER_CLIENT = 8;
+export declare const MAX_IROH_REMOTE_PUSH_TARGET_REVOCATION_CONCURRENCY = 4;
+export declare class IrohRemoteInMemoryPushNotificationDeduper implements IrohRemotePushNotificationDeduper {
+    private readonly sentEventIdsByClient;
+    tryMark(clientNodeId: string, eventId: string): boolean;
+    unmark(clientNodeId: string, eventId: string): void;
+}
+export declare class IrohRemotePushRelayHttpError extends Error {
+    readonly status: number;
+    readonly transient: boolean;
+    constructor(status: number, transient: boolean, detail?: string);
+}
+export declare class IrohRemotePushRelayHttpClient implements IrohRemotePushRelayClient {
+    private readonly authToken;
+    private readonly baseUrl;
+    private readonly fetcher;
+    private readonly timeoutMs;
+    constructor(options: IrohRemotePushRelayHttpClientOptions);
+    sendNotification(request: IrohRemotePushRelayNotificationRequest): Promise<IrohRemotePushRelayNotificationResult>;
+    sendLiveActivityUpdate(request: IrohRemotePushRelayLiveActivityRequest): Promise<IrohRemotePushRelayNotificationResult>;
+    revokePushTarget(request: IrohRemotePushRelayRevocationRequest): Promise<IrohRemotePushRelayRevocationResult>;
+    private sendRelayRequest;
+    private createHeaders;
+}
+/**
+ * Best-effort cleanup after local client revocation. Local authority is already
+ * gone before this runs, so relay failures are summarized rather than thrown.
+ * The call count is capped to keep a corrupted or malicious state file from
+ * turning one control request into unbounded outbound work; relay TTL bounds any
+ * skipped or failed credential's remaining lifetime.
+ */
+export declare function revokeIrohRemoteClientPushTargets(client: Pick<IrohRemoteClient, "pushTargets"> | undefined, relayClient: IrohRemotePushRelayClient): Promise<IrohRemotePushTargetRevocationSummary>;
+export declare class IrohRemotePushNotificationDispatcher implements IrohRemotePushNotificationDelivery {
+    private readonly auditLogger;
+    private readonly clientNodeId;
+    private readonly deduper;
+    private readonly now;
+    private readonly relayClient;
+    private readonly retryAttempts;
+    private readonly retryDelayMs;
+    private readonly stateManager;
+    private readonly workspace;
+    constructor(options: IrohRemotePushNotificationDispatcherOptions);
+    registerPushTarget(args: unknown): Promise<RpcRegisterPushTargetResponse>;
+    deliverNotification(notification: IrohRemotePushNotificationIntent): Promise<IrohRemotePushNotificationDeliveryStatus>;
+    deliverLiveActivityUpdate(update: IrohRemoteLiveActivityUpdateIntent): Promise<IrohRemotePushNotificationDeliveryStatus>;
+    private markDeliveryIntent;
+    private logPushFallback;
+    private sendNotificationWithRetry;
+    private sendLiveActivityUpdateWithRetry;
+    private sendWithRetry;
+    private logPushDelivery;
+    private log;
+}
+export declare function hashIrohRemotePushToken(token: string): string;
+export declare function parseRegisterPushTargetArgs(value: unknown): RpcRegisterPushTargetArgs;
+//# sourceMappingURL=push.d.ts.map

package/dist/core/remote/iroh/push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../../../src/core/remote/iroh/push.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnG,OAAO,KAAK,EAA6B,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnF,OAAO,KAAK,EACX,gBAAgB,EAKhB,8BAA8B,EAC9B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAErE,eAAO,MAAM,6CAA6C,IAAI,CAAC;AAC/D,eAAO,MAAM,6CAA6C,MAAM,CAAC;AACjE,eAAO,MAAM,yCAAyC,QAAS,CAAC;AAChE,eAAO,MAAM,kCAAkC,gEAAgE,CAAC;AAEhH,MAAM,MAAM,uCAAuC,GAAG,yBAAyB,CAAC;AAChF,MAAM,MAAM,sCAAsC,GAAG,6BAA6B,CAAC;AAEnF,MAAM,WAAW,gCAAgC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,+BAA+B;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;CAC3C;AAED,MAAM,WAAW,kCAAkC;IAClD,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,+BAA+B,CAAC;IAC9C,WAAW,EAAE,+BAA+B,EAAE,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,kCAAkC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IACjC,YAAY,EAAE,kCAAkC,CAAC;IACjD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,sCAAsC;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE;QACL,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACF;AAED,MAAM,WAAW,sCAAsC;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,kCAAkC,CAAC;IACjD,aAAa,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,oCAAoC;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,qCAAqC,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AACtG,MAAM,MAAM,mCAAmC,GAAG;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEvG,MAAM,WAAW,yBAAyB;IACzC,gBAAgB,CAAC,OAAO,EAAE,sCAAsC,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAClH,sBAAsB,CAAC,CACtB,OAAO,EAAE,sCAAsC,GAC7C,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAClD,gBAAgB,CAAC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;CAC/G;AAED,MAAM,WAAW,qCAAqC;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,wCAAwC,GACjD,MAAM,GACN,gBAAgB,GAChB,WAAW,GACX,QAAQ,GACR,gBAAgB,CAAC;AAEpB,MAAM,WAAW,kCAAkC;IAClD,mBAAmB,CAClB,YAAY,EAAE,gCAAgC,GAC5C,OAAO,CAAC,wCAAwC,CAAC,CAAC;IACrD,yBAAyB,CAAC,CACzB,MAAM,EAAE,kCAAkC,GACxC,OAAO,CAAC,wCAAwC,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,iCAAiC;IACjD,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACxD,yFAAyF;IACzF,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,2CAA2C;IAC3D,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,iCAAiC,CAAC;IAC5C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,EAAE,yBAAyB,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,0BAA0B,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oCAAoC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAKD,eAAO,MAAM,kDAAkD,IAAI,CAAC;AACpE,eAAO,MAAM,kDAAkD,IAAI,CAAC;AAGpE,qBAAa,yCAA0C,YAAW,iCAAiC;IAClG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IAEvE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAmBtD;IAED,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAElD;CACD;AAED,qBAAa,4BAA6B,SAAQ,KAAK;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAE5B,YAAY,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAK9D;CACD;AAwBD,qBAAa,6BAA8B,YAAW,yBAAyB;IAC9E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0D;IAClF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,OAAO,EAAE,oCAAoC,EAMxD;IAEK,gBAAgB,CACrB,OAAO,EAAE,sCAAsC,GAC7C,OAAO,CAAC,qCAAqC,CAAC,CAEhD;IAEK,sBAAsB,CAC3B,OAAO,EAAE,sCAAsC,GAC7C,OAAO,CAAC,qCAAqC,CAAC,CAEhD;IAEK,gBAAgB,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAqBlH;YAEa,gBAAgB;IA8B9B,OAAO,CAAC,aAAa;CAMrB;AAiFD;;;;;;GAMG;AACH,wBAAsB,iCAAiC,CACtD,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,GAAG,SAAS,EACzD,WAAW,EAAE,yBAAyB,GACpC,OAAO,CAAC,qCAAqC,CAAC,CAqChD;AAED,qBAAa,oCAAqC,YAAW,kCAAkC;IAC9F,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAE/C,YAAY,OAAO,EAAE,2CAA2C,EAgB/D;IAEK,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAmE9E;IAEK,mBAAmB,CACxB,YAAY,EAAE,gCAAgC,GAC5C,OAAO,CAAC,wCAAwC,CAAC,CAmCnD;IAEK,yBAAyB,CAC9B,MAAM,EAAE,kCAAkC,GACxC,OAAO,CAAC,wCAAwC,CAAC,CA4CnD;YAEa,kBAAkB;YAclB,eAAe;YAUf,yBAAyB;YAMzB,+BAA+B;YAU/B,aAAa;YAkBb,eAAe;YAyBf,GAAG;CAUjB;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,yBAAyB,CAYrF","sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { RpcRegisterPushTargetArgs, RpcRegisterPushTargetResponse } from \"../../rpc/types.ts\";\nimport type { IrohRemoteAuditEventInput, IrohRemoteAuditLogger } from \"./audit.ts\";\nimport type {\n\tIrohRemoteClient,\n\tIrohRemoteLiveActivityRegistration,\n\tIrohRemotePushTarget,\n\tIrohRemotePushTargetPlatform,\n\tIrohRemotePushTargetProvider,\n\tIrohRemotePushTokenEnvironment,\n} from \"./state.ts\";\nimport type { IrohRemoteHostStateManager } from \"./state-manager.ts\";\n\nexport const DEFAULT_IROH_REMOTE_PUSH_RELAY_RETRY_ATTEMPTS = 3;\nexport const DEFAULT_IROH_REMOTE_PUSH_RELAY_RETRY_DELAY_MS = 250;\nexport const DEFAULT_IROH_REMOTE_PUSH_RELAY_TIMEOUT_MS = 10_000;\nexport const DEFAULT_IROH_REMOTE_PUSH_RELAY_URL = \"https://us-central1-volt-3fae7.cloudfunctions.net/pushRelay\";\n\nexport type IrohRemotePushTargetRegistrationRequest = RpcRegisterPushTargetArgs;\nexport type IrohRemotePushTargetRegistrationResult = RpcRegisterPushTargetResponse;\n\nexport interface IrohRemotePushNotificationIntent {\n\teventId: string;\n\tkind: string;\n\ttitle: string;\n\tbody: string;\n\tsessionId?: string;\n\tworkspace?: string;\n}\n\nexport interface IrohRemoteLiveActivityToolGlyph {\n\tname: string;\n\tsymbolName: string;\n\tstatus: \"started\" | \"completed\" | \"failed\";\n}\n\nexport interface IrohRemoteLiveActivityContentState {\n\tstatus: \"running\" | \"completed\" | \"failed\" | \"waiting\";\n\tstatusText: string;\n\tcurrentTool?: IrohRemoteLiveActivityToolGlyph;\n\trecentTools: IrohRemoteLiveActivityToolGlyph[];\n\tsessionID?: string;\n\tworkspaceName?: string;\n\tupdatedAtEpochSeconds: number;\n}\n\nexport interface IrohRemoteLiveActivityUpdateIntent {\n\teventId: string;\n\tkind: string;\n\tactivityEvent?: \"update\" | \"end\";\n\tcontentState: IrohRemoteLiveActivityContentState;\n\tstaleDateEpochSeconds?: number;\n\tdismissalDateEpochSeconds?: number;\n}\n\nexport interface IrohRemotePushRelayNotificationRequest {\n\tpushTargetId: string;\n\tpushTargetAuthToken: string;\n\teventId: string;\n\tkind: string;\n\ttitle: string;\n\tbody: string;\n\tworkspace?: string;\n\tdata: {\n\t\teventId: string;\n\t\tkind: string;\n\t\tsessionId?: string;\n\t\tworkspace?: string;\n\t};\n}\n\nexport interface IrohRemotePushRelayLiveActivityRequest {\n\tpushTargetId: string;\n\tpushTargetAuthToken: string;\n\tactivityId: string;\n\tactivityPushToken: string;\n\t/** APNs environment of the activity push token, when the client reported one. */\n\ttokenEnvironment?: IrohRemotePushTokenEnvironment;\n\teventId: string;\n\tkind: string;\n\tcontentState: IrohRemoteLiveActivityContentState;\n\tactivityEvent?: \"update\" | \"end\";\n\tstaleDateEpochSeconds?: number;\n\tdismissalDateEpochSeconds?: number;\n}\n\nexport interface IrohRemotePushRelayRevocationRequest {\n\tpushTargetId: string;\n\tpushTargetAuthToken: string;\n}\n\nexport type IrohRemotePushRelayNotificationResult = { status: \"sent\" } | { status: \"invalid_target\" };\nexport type IrohRemotePushRelayRevocationResult = { status: \"revoked\" } | { status: \"already_absent\" };\n\nexport interface IrohRemotePushRelayClient {\n\tsendNotification(request: IrohRemotePushRelayNotificationRequest): Promise<IrohRemotePushRelayNotificationResult>;\n\tsendLiveActivityUpdate?(\n\t\trequest: IrohRemotePushRelayLiveActivityRequest,\n\t): Promise<IrohRemotePushRelayNotificationResult>;\n\trevokePushTarget?(request: IrohRemotePushRelayRevocationRequest): Promise<IrohRemotePushRelayRevocationResult>;\n}\n\nexport interface IrohRemotePushTargetRevocationSummary {\n\tattempted: number;\n\trevoked: number;\n\talreadyAbsent: number;\n\tfailed: number;\n\tskipped: number;\n}\n\nexport type IrohRemotePushNotificationDeliveryStatus =\n\t| \"sent\"\n\t| \"no_push_target\"\n\t| \"duplicate\"\n\t| \"failed\"\n\t| \"invalid_target\";\n\nexport interface IrohRemotePushNotificationDelivery {\n\tdeliverNotification(\n\t\tnotification: IrohRemotePushNotificationIntent,\n\t): Promise<IrohRemotePushNotificationDeliveryStatus>;\n\tdeliverLiveActivityUpdate?(\n\t\tupdate: IrohRemoteLiveActivityUpdateIntent,\n\t): Promise<IrohRemotePushNotificationDeliveryStatus>;\n}\n\nexport interface IrohRemotePushNotificationDeduper {\n\ttryMark(clientNodeId: string, eventId: string): boolean;\n\t/** Release a mark claimed by tryMark when the corresponding delivery did not succeed. */\n\tunmark(clientNodeId: string, eventId: string): void;\n}\n\nexport interface IrohRemotePushNotificationDispatcherOptions {\n\tauditLogger?: IrohRemoteAuditLogger;\n\tclientNodeId: string;\n\tdeduper?: IrohRemotePushNotificationDeduper;\n\tnow?: () => number;\n\trelayClient: IrohRemotePushRelayClient;\n\tretryAttempts?: number;\n\tretryDelayMs?: number;\n\tstateManager: IrohRemoteHostStateManager;\n\tworkspace?: string;\n}\n\nexport interface IrohRemotePushRelayHttpClientOptions {\n\tauthToken?: string;\n\tbaseUrl?: string;\n\tfetcher?: (input: string, init: RequestInit) => Promise<Response>;\n\ttimeoutMs?: number;\n}\n\n// The deduper lives for the daemon's whole lifetime, so the per-client id set is\n// bounded. Re-marking an evicted id at most re-sends one very old notification.\nconst MAX_SENT_EVENT_IDS_PER_CLIENT = 1000;\nexport const MAX_IROH_REMOTE_PUSH_TARGET_REVOCATIONS_PER_CLIENT = 8;\nexport const MAX_IROH_REMOTE_PUSH_TARGET_REVOCATION_CONCURRENCY = 4;\nconst MAX_IROH_REMOTE_PUSH_RELAY_RESPONSE_BYTES = 1024;\n\nexport class IrohRemoteInMemoryPushNotificationDeduper implements IrohRemotePushNotificationDeduper {\n\tprivate readonly sentEventIdsByClient = new Map<string, Set<string>>();\n\n\ttryMark(clientNodeId: string, eventId: string): boolean {\n\t\tlet sentEventIds = this.sentEventIdsByClient.get(clientNodeId);\n\t\tif (!sentEventIds) {\n\t\t\tsentEventIds = new Set();\n\t\t\tthis.sentEventIdsByClient.set(clientNodeId, sentEventIds);\n\t\t}\n\t\tif (sentEventIds.has(eventId)) {\n\t\t\treturn false;\n\t\t}\n\t\tsentEventIds.add(eventId);\n\t\t// Evict oldest ids (Sets preserve insertion order) once over the cap.\n\t\twhile (sentEventIds.size > MAX_SENT_EVENT_IDS_PER_CLIENT) {\n\t\t\tconst oldest = sentEventIds.values().next().value;\n\t\t\tif (oldest === undefined) {\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tsentEventIds.delete(oldest);\n\t\t}\n\t\treturn true;\n\t}\n\n\tunmark(clientNodeId: string, eventId: string): void {\n\t\tthis.sentEventIdsByClient.get(clientNodeId)?.delete(eventId);\n\t}\n}\n\nexport class IrohRemotePushRelayHttpError extends Error {\n\treadonly status: number;\n\treadonly transient: boolean;\n\n\tconstructor(status: number, transient: boolean, detail?: string) {\n\t\tsuper(`Push relay request failed with HTTP ${status}${detail ? ` (${detail})` : \"\"}`);\n\t\tthis.name = \"IrohRemotePushRelayHttpError\";\n\t\tthis.status = status;\n\t\tthis.transient = transient;\n\t}\n}\n\nconst MAX_RELAY_ERROR_DETAIL_LENGTH = 200;\n\n/** Best-effort extraction of the relay's `{ error, code }` body for audit logs. */\nasync function readRelayErrorDetail(response: Response): Promise<string | undefined> {\n\ttry {\n\t\tconst body: unknown = await readBoundedRelayJson(response);\n\t\tif (typeof body !== \"object\" || body === null) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst record = body as Record<string, unknown>;\n\t\tconst parts = [record.error, record.code].filter(\n\t\t\t(part): part is string => typeof part === \"string\" && part.length > 0,\n\t\t);\n\t\tif (parts.length === 0) {\n\t\t\treturn undefined;\n\t\t}\n\t\treturn parts.join(\": \").slice(0, MAX_RELAY_ERROR_DETAIL_LENGTH);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nexport class IrohRemotePushRelayHttpClient implements IrohRemotePushRelayClient {\n\tprivate readonly authToken: string | undefined;\n\tprivate readonly baseUrl: string;\n\tprivate readonly fetcher: (input: string, init: RequestInit) => Promise<Response>;\n\tprivate readonly timeoutMs: number;\n\n\tconstructor(options: IrohRemotePushRelayHttpClientOptions) {\n\t\tthis.authToken = options.authToken;\n\t\tconst baseUrl = options.baseUrl ?? DEFAULT_IROH_REMOTE_PUSH_RELAY_URL;\n\t\tthis.baseUrl = baseUrl.endsWith(\"/\") ? baseUrl : `${baseUrl}/`;\n\t\tthis.fetcher = options.fetcher ?? ((input, init) => fetch(input, init));\n\t\tthis.timeoutMs = options.timeoutMs ?? DEFAULT_IROH_REMOTE_PUSH_RELAY_TIMEOUT_MS;\n\t}\n\n\tasync sendNotification(\n\t\trequest: IrohRemotePushRelayNotificationRequest,\n\t): Promise<IrohRemotePushRelayNotificationResult> {\n\t\treturn this.sendRelayRequest(\"v1/notifications\", createRelayNotificationBody(request));\n\t}\n\n\tasync sendLiveActivityUpdate(\n\t\trequest: IrohRemotePushRelayLiveActivityRequest,\n\t): Promise<IrohRemotePushRelayNotificationResult> {\n\t\treturn this.sendRelayRequest(\"v1/live-activities\", createRelayLiveActivityBody(request));\n\t}\n\n\tasync revokePushTarget(request: IrohRemotePushRelayRevocationRequest): Promise<IrohRemotePushRelayRevocationResult> {\n\t\tconst response = await this.fetcher(new URL(\"v1/push-targets/revoke\", this.baseUrl).toString(), {\n\t\t\tbody: JSON.stringify(createRelayRevocationBody(request)),\n\t\t\theaders: this.createHeaders(),\n\t\t\tmethod: \"POST\",\n\t\t\tsignal: AbortSignal.timeout(this.timeoutMs),\n\t\t});\n\t\tif (response.status === 404 || response.status === 410) {\n\t\t\treturn { status: \"already_absent\" };\n\t\t}\n\t\tif (!response.ok) {\n\t\t\tthrow new IrohRemotePushRelayHttpError(\n\t\t\t\tresponse.status,\n\t\t\t\tisTransientHttpStatus(response.status),\n\t\t\t\tawait readRelayErrorDetail(response),\n\t\t\t);\n\t\t}\n\t\tconst body = await readBoundedRelayJson(response);\n\t\tif (body.status === \"revoked\") return { status: \"revoked\" };\n\t\tif (body.status === \"already_revoked\") return { status: \"already_absent\" };\n\t\tthrow new IrohRemotePushRelayHttpError(502, true, \"invalid revoke response\");\n\t}\n\n\tprivate async sendRelayRequest(\n\t\tpath: string,\n\t\tbody:\n\t\t\t| IrohRemotePushRelayNotificationRequest\n\t\t\t| IrohRemotePushRelayLiveActivityRequest\n\t\t\t| IrohRemotePushRelayRevocationRequest,\n\t): Promise<IrohRemotePushRelayNotificationResult> {\n\t\tconst response = await this.fetcher(new URL(path, this.baseUrl).toString(), {\n\t\t\tbody: JSON.stringify(body),\n\t\t\theaders: this.createHeaders(),\n\t\t\tmethod: \"POST\",\n\t\t\tsignal: AbortSignal.timeout(this.timeoutMs),\n\t\t});\n\t\tif (response.ok) {\n\t\t\treturn { status: \"sent\" };\n\t\t}\n\t\t// 404/410: target unknown or disabled. 422: the relay cannot deliver to\n\t\t// this target at all (e.g. a development-environment Live Activity token,\n\t\t// which FCM cannot reach) — treat as invalid so the caller prunes the\n\t\t// registration instead of retrying a permanently undeliverable channel.\n\t\tif (response.status === 404 || response.status === 410 || response.status === 422) {\n\t\t\treturn { status: \"invalid_target\" };\n\t\t}\n\t\tthrow new IrohRemotePushRelayHttpError(\n\t\t\tresponse.status,\n\t\t\tisTransientHttpStatus(response.status),\n\t\t\tawait readRelayErrorDetail(response),\n\t\t);\n\t}\n\n\tprivate createHeaders(): Record<string, string> {\n\t\treturn {\n\t\t\t\"content-type\": \"application/json\",\n\t\t\t...(this.authToken ? { authorization: `Bearer ${this.authToken}` } : {}),\n\t\t};\n\t}\n}\n\nfunction createRelayNotificationBody(\n\trequest: IrohRemotePushRelayNotificationRequest,\n): IrohRemotePushRelayNotificationRequest {\n\treturn {\n\t\tpushTargetId: request.pushTargetId,\n\t\tpushTargetAuthToken: request.pushTargetAuthToken,\n\t\teventId: request.eventId,\n\t\tkind: request.kind,\n\t\ttitle: request.title,\n\t\tbody: request.body,\n\t\t...(request.workspace === undefined ? {} : { workspace: request.workspace }),\n\t\tdata: request.data,\n\t};\n}\n\nfunction createRelayLiveActivityBody(\n\trequest: IrohRemotePushRelayLiveActivityRequest,\n): IrohRemotePushRelayLiveActivityRequest {\n\treturn {\n\t\tpushTargetId: request.pushTargetId,\n\t\tpushTargetAuthToken: request.pushTargetAuthToken,\n\t\tactivityId: request.activityId,\n\t\tactivityPushToken: request.activityPushToken,\n\t\t...(request.tokenEnvironment === undefined ? {} : { tokenEnvironment: request.tokenEnvironment }),\n\t\teventId: request.eventId,\n\t\tkind: request.kind,\n\t\tcontentState: request.contentState,\n\t\t...(request.activityEvent === undefined ? {} : { activityEvent: request.activityEvent }),\n\t\t...(request.staleDateEpochSeconds === undefined ? {} : { staleDateEpochSeconds: request.staleDateEpochSeconds }),\n\t\t...(request.dismissalDateEpochSeconds === undefined\n\t\t\t? {}\n\t\t\t: { dismissalDateEpochSeconds: request.dismissalDateEpochSeconds }),\n\t};\n}\n\nfunction createRelayRevocationBody(\n\trequest: IrohRemotePushRelayRevocationRequest,\n): IrohRemotePushRelayRevocationRequest {\n\treturn {\n\t\tpushTargetId: request.pushTargetId,\n\t\tpushTargetAuthToken: request.pushTargetAuthToken,\n\t};\n}\n\nasync function readBoundedRelayJson(response: Response): Promise<Record<string, unknown>> {\n\tconst reader = response.body?.getReader();\n\tif (!reader) return {};\n\tconst chunks: Uint8Array[] = [];\n\tlet totalBytes = 0;\n\ttry {\n\t\twhile (true) {\n\t\t\tconst chunk = await reader.read();\n\t\t\tif (chunk.done) break;\n\t\t\ttotalBytes += chunk.value.byteLength;\n\t\t\tif (totalBytes > MAX_IROH_REMOTE_PUSH_RELAY_RESPONSE_BYTES) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\tthrow new IrohRemotePushRelayHttpError(502, true, \"relay response too large\");\n\t\t\t}\n\t\t\tchunks.push(chunk.value);\n\t\t}\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\tconst bytes = new Uint8Array(totalBytes);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tbytes.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes));\n\t\treturn typeof parsed === \"object\" && parsed !== null && !Array.isArray(parsed)\n\t\t\t? (parsed as Record<string, unknown>)\n\t\t\t: {};\n\t} catch {\n\t\treturn {};\n\t}\n}\n\n/**\n * Best-effort cleanup after local client revocation. Local authority is already\n * gone before this runs, so relay failures are summarized rather than thrown.\n * The call count is capped to keep a corrupted or malicious state file from\n * turning one control request into unbounded outbound work; relay TTL bounds any\n * skipped or failed credential's remaining lifetime.\n */\nexport async function revokeIrohRemoteClientPushTargets(\n\tclient: Pick<IrohRemoteClient, \"pushTargets\"> | undefined,\n\trelayClient: IrohRemotePushRelayClient,\n): Promise<IrohRemotePushTargetRevocationSummary> {\n\tconst uniqueTargets = new Map<string, IrohRemotePushRelayRevocationRequest>();\n\tfor (const target of client?.pushTargets ?? []) {\n\t\tif (target.id.length === 0 || target.pushTargetAuthToken.length === 0) continue;\n\t\tuniqueTargets.set(`${target.id}\\0${target.pushTargetAuthToken}`, {\n\t\t\tpushTargetId: target.id,\n\t\t\tpushTargetAuthToken: target.pushTargetAuthToken,\n\t\t});\n\t}\n\tconst targets = Array.from(uniqueTargets.values());\n\tconst selectedTargets = targets.slice(0, MAX_IROH_REMOTE_PUSH_TARGET_REVOCATIONS_PER_CLIENT);\n\tconst summary: IrohRemotePushTargetRevocationSummary = {\n\t\tattempted: selectedTargets.length,\n\t\trevoked: 0,\n\t\talreadyAbsent: 0,\n\t\tfailed: 0,\n\t\tskipped: targets.length - selectedTargets.length,\n\t};\n\tconst revokePushTarget = relayClient.revokePushTarget?.bind(relayClient);\n\tif (!revokePushTarget) {\n\t\tsummary.failed = selectedTargets.length;\n\t\treturn summary;\n\t}\n\tfor (let offset = 0; offset < selectedTargets.length; offset += MAX_IROH_REMOTE_PUSH_TARGET_REVOCATION_CONCURRENCY) {\n\t\tconst batch = selectedTargets.slice(offset, offset + MAX_IROH_REMOTE_PUSH_TARGET_REVOCATION_CONCURRENCY);\n\t\tconst results = await Promise.allSettled(batch.map((target) => revokePushTarget(target)));\n\t\tfor (const result of results) {\n\t\t\tif (result.status === \"rejected\") {\n\t\t\t\tsummary.failed += 1;\n\t\t\t} else if (result.value.status === \"revoked\") {\n\t\t\t\tsummary.revoked += 1;\n\t\t\t} else {\n\t\t\t\tsummary.alreadyAbsent += 1;\n\t\t\t}\n\t\t}\n\t}\n\treturn summary;\n}\n\nexport class IrohRemotePushNotificationDispatcher implements IrohRemotePushNotificationDelivery {\n\tprivate readonly auditLogger: IrohRemoteAuditLogger | undefined;\n\tprivate readonly clientNodeId: string;\n\tprivate readonly deduper: IrohRemotePushNotificationDeduper;\n\tprivate readonly now: () => number;\n\tprivate readonly relayClient: IrohRemotePushRelayClient;\n\tprivate readonly retryAttempts: number;\n\tprivate readonly retryDelayMs: number;\n\tprivate readonly stateManager: IrohRemoteHostStateManager;\n\tprivate readonly workspace: string | undefined;\n\n\tconstructor(options: IrohRemotePushNotificationDispatcherOptions) {\n\t\tthis.auditLogger = options.auditLogger;\n\t\tthis.clientNodeId = options.clientNodeId;\n\t\tthis.deduper = options.deduper ?? new IrohRemoteInMemoryPushNotificationDeduper();\n\t\tthis.now = options.now ?? Date.now;\n\t\tthis.relayClient = options.relayClient;\n\t\tthis.retryAttempts = Math.max(\n\t\t\t1,\n\t\t\tMath.trunc(options.retryAttempts ?? DEFAULT_IROH_REMOTE_PUSH_RELAY_RETRY_ATTEMPTS),\n\t\t);\n\t\tthis.retryDelayMs = Math.max(\n\t\t\t0,\n\t\t\tMath.trunc(options.retryDelayMs ?? DEFAULT_IROH_REMOTE_PUSH_RELAY_RETRY_DELAY_MS),\n\t\t);\n\t\tthis.stateManager = options.stateManager;\n\t\tthis.workspace = options.workspace;\n\t}\n\n\tasync registerPushTarget(args: unknown): Promise<RpcRegisterPushTargetResponse> {\n\t\tconst registration = parseRegisterPushTargetArgs(args);\n\t\ttry {\n\t\t\tconst now = this.now();\n\t\t\tconst pushTarget: IrohRemotePushTarget = {\n\t\t\t\tid: registration.pushTargetId,\n\t\t\t\tprovider: registration.provider,\n\t\t\t\tplatform: registration.platform,\n\t\t\t\tpushTargetAuthToken: registration.pushTargetAuthToken,\n\t\t\t\t...(registration.relayUrl === undefined ? {} : { relayUrl: registration.relayUrl }),\n\t\t\t\t...(registration.tokenHash === undefined ? {} : { tokenHash: registration.tokenHash }),\n\t\t\t\t...(registration.liveActivity === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tliveActivity: {\n\t\t\t\t\t\t\t\tactivityId: registration.liveActivity.activityId,\n\t\t\t\t\t\t\t\tpushToken: registration.liveActivity.pushToken,\n\t\t\t\t\t\t\t\t...(registration.liveActivity.tokenHash === undefined\n\t\t\t\t\t\t\t\t\t? {}\n\t\t\t\t\t\t\t\t\t: { tokenHash: registration.liveActivity.tokenHash }),\n\t\t\t\t\t\t\t\t...(registration.liveActivity.tokenEnvironment === undefined\n\t\t\t\t\t\t\t\t\t? {}\n\t\t\t\t\t\t\t\t\t: { tokenEnvironment: registration.liveActivity.tokenEnvironment }),\n\t\t\t\t\t\t\t\tupdatedAt: now,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t\tenabled: registration.enabled,\n\t\t\t\tcreatedAt: now,\n\t\t\t\tupdatedAt: now,\n\t\t\t};\n\t\t\tconst client = await this.stateManager.upsertClientPushTarget(this.clientNodeId, pushTarget);\n\t\t\tif (!client) {\n\t\t\t\tthrow new Error(\"paired client not found\");\n\t\t\t}\n\t\t\tawait this.log({\n\t\t\t\ttype: \"push_target_registered\",\n\t\t\t\tclientNodeId: this.clientNodeId,\n\t\t\t\tworkspace: this.workspace,\n\t\t\t\tsuccess: true,\n\t\t\t\tdetails: getPushTargetAuditDetails(pushTarget),\n\t\t\t});\n\t\t\treturn { status: \"registered\", pushTargetId: registration.pushTargetId };\n\t\t} catch (error: unknown) {\n\t\t\tconst errorMessage = toErrorMessage(error);\n\t\t\tconst redactedError =\n\t\t\t\tregistration.pushTargetAuthToken.length === 0\n\t\t\t\t\t? errorMessage\n\t\t\t\t\t: errorMessage.split(registration.pushTargetAuthToken).join(\"[redacted-push-target-auth-token]\");\n\t\t\tawait this.log({\n\t\t\t\ttype: \"push_target_registered\",\n\t\t\t\tclientNodeId: this.clientNodeId,\n\t\t\t\tworkspace: this.workspace,\n\t\t\t\tsuccess: false,\n\t\t\t\terror: redactedError,\n\t\t\t\tdetails: {\n\t\t\t\t\tpushTargetId: registration.pushTargetId,\n\t\t\t\t\tprovider: registration.provider,\n\t\t\t\t\tplatform: registration.platform,\n\t\t\t\t\trelayUrl: registration.relayUrl,\n\t\t\t\t\ttokenHash: registration.tokenHash,\n\t\t\t\t\tliveActivityTokenHash: registration.liveActivity?.tokenHash,\n\t\t\t\t\tliveActivityTokenEnvironment: registration.liveActivity?.tokenEnvironment,\n\t\t\t\t\tenabled: registration.enabled,\n\t\t\t\t},\n\t\t\t});\n\t\t\tthrow new Error(redactedError);\n\t\t}\n\t}\n\n\tasync deliverNotification(\n\t\tnotification: IrohRemotePushNotificationIntent,\n\t): Promise<IrohRemotePushNotificationDeliveryStatus> {\n\t\tif (!(await this.markDeliveryIntent(notification.eventId, notification.kind))) {\n\t\t\treturn \"duplicate\";\n\t\t}\n\n\t\tconst client = await this.stateManager.getClient(this.clientNodeId);\n\t\tconst pushTarget = selectEnabledPushTarget(client?.pushTargets ?? []);\n\t\tif (!pushTarget) {\n\t\t\tawait this.logPushFallback(notification.eventId, notification.kind, \"no_push_target\");\n\t\t\treturn \"no_push_target\";\n\t\t}\n\n\t\tconst relayRequest = createRelayNotificationRequest(pushTarget, notification);\n\t\ttry {\n\t\t\tconst relayResult = await this.sendNotificationWithRetry(relayRequest);\n\t\t\tif (relayResult.status === \"invalid_target\") {\n\t\t\t\tawait this.stateManager.disableClientPushTarget(this.clientNodeId, pushTarget.id, this.now());\n\t\t\t\tawait this.logPushDelivery(\n\t\t\t\t\tpushTarget,\n\t\t\t\t\tnotification.eventId,\n\t\t\t\t\tnotification.kind,\n\t\t\t\t\tfalse,\n\t\t\t\t\t\"push target is invalid or unregistered\",\n\t\t\t\t);\n\t\t\t\treturn \"invalid_target\";\n\t\t\t}\n\t\t\tawait this.logPushDelivery(pushTarget, notification.eventId, notification.kind, true);\n\t\t\treturn \"sent\";\n\t\t} catch (error: unknown) {\n\t\t\t// Release the dedup claim so a transient relay failure can be retried on a\n\t\t\t// later re-emission instead of being permanently suppressed as delivered.\n\t\t\tthis.deduper.unmark(this.clientNodeId, notification.eventId);\n\t\t\tawait this.logPushDelivery(pushTarget, notification.eventId, notification.kind, false, toErrorMessage(error));\n\t\t\treturn \"failed\";\n\t\t}\n\t}\n\n\tasync deliverLiveActivityUpdate(\n\t\tupdate: IrohRemoteLiveActivityUpdateIntent,\n\t): Promise<IrohRemotePushNotificationDeliveryStatus> {\n\t\tif (!(await this.markDeliveryIntent(update.eventId, update.kind))) {\n\t\t\treturn \"duplicate\";\n\t\t}\n\n\t\tconst client = await this.stateManager.getClient(this.clientNodeId);\n\t\tconst registration = selectLiveActivityRegistration(client, update.contentState);\n\t\tconst pushTarget = registration ? findRegisteredLiveActivityPushTarget(client, registration) : undefined;\n\t\tif (!registration || !pushTarget?.liveActivity) {\n\t\t\tawait this.logPushFallback(update.eventId, update.kind, \"no_live_activity_target\");\n\t\t\treturn \"no_push_target\";\n\t\t}\n\n\t\tconst relayRequest = createRelayLiveActivityRequest(pushTarget, update, registration.activityId);\n\t\ttry {\n\t\t\tconst relayResult = await this.sendLiveActivityUpdateWithRetry(relayRequest);\n\t\t\tif (relayResult.status === \"invalid_target\") {\n\t\t\t\tawait this.stateManager.pruneClientLiveActivityDeliveryChannel(this.clientNodeId, registration, this.now());\n\t\t\t\tawait this.logPushDelivery(\n\t\t\t\t\tpushTarget,\n\t\t\t\t\tupdate.eventId,\n\t\t\t\t\tupdate.kind,\n\t\t\t\t\tfalse,\n\t\t\t\t\t\"live activity target is invalid or unregistered\",\n\t\t\t\t\tregistration.tokenHash,\n\t\t\t\t);\n\t\t\t\treturn \"invalid_target\";\n\t\t\t}\n\t\t\tawait this.logPushDelivery(pushTarget, update.eventId, update.kind, true, undefined, registration.tokenHash);\n\t\t\treturn \"sent\";\n\t\t} catch (error: unknown) {\n\t\t\t// Release the dedup claim so a transient relay failure can be retried on a\n\t\t\t// later re-emission instead of being permanently suppressed as delivered.\n\t\t\tthis.deduper.unmark(this.clientNodeId, update.eventId);\n\t\t\tawait this.logPushDelivery(\n\t\t\t\tpushTarget,\n\t\t\t\tupdate.eventId,\n\t\t\t\tupdate.kind,\n\t\t\t\tfalse,\n\t\t\t\ttoErrorMessage(error),\n\t\t\t\tregistration.tokenHash,\n\t\t\t);\n\t\t\treturn \"failed\";\n\t\t}\n\t}\n\n\tprivate async markDeliveryIntent(eventId: string, kind: string): Promise<boolean> {\n\t\tif (this.deduper.tryMark(this.clientNodeId, eventId)) {\n\t\t\treturn true;\n\t\t}\n\t\tawait this.log({\n\t\t\ttype: \"push_notification_deduplicated\",\n\t\t\tclientNodeId: this.clientNodeId,\n\t\t\tworkspace: this.workspace,\n\t\t\tsuccess: true,\n\t\t\tdetails: { eventId, kind },\n\t\t});\n\t\treturn false;\n\t}\n\n\tprivate async logPushFallback(eventId: string, kind: string, reason: string): Promise<void> {\n\t\tawait this.log({\n\t\t\ttype: \"push_notification_fallback\",\n\t\t\tclientNodeId: this.clientNodeId,\n\t\t\tworkspace: this.workspace,\n\t\t\tsuccess: true,\n\t\t\tdetails: { eventId, kind, reason },\n\t\t});\n\t}\n\n\tprivate async sendNotificationWithRetry(\n\t\trequest: IrohRemotePushRelayNotificationRequest,\n\t): Promise<IrohRemotePushRelayNotificationResult> {\n\t\treturn this.sendWithRetry(() => this.relayClient.sendNotification(request));\n\t}\n\n\tprivate async sendLiveActivityUpdateWithRetry(\n\t\trequest: IrohRemotePushRelayLiveActivityRequest,\n\t): Promise<IrohRemotePushRelayNotificationResult> {\n\t\tconst sendLiveActivityUpdate = this.relayClient.sendLiveActivityUpdate?.bind(this.relayClient);\n\t\tif (!sendLiveActivityUpdate) {\n\t\t\tthrow new Error(\"push relay does not support live activity updates\");\n\t\t}\n\t\treturn this.sendWithRetry(() => sendLiveActivityUpdate(request));\n\t}\n\n\tprivate async sendWithRetry(\n\t\tsend: () => Promise<IrohRemotePushRelayNotificationResult>,\n\t): Promise<IrohRemotePushRelayNotificationResult> {\n\t\tlet lastError: unknown;\n\t\tfor (let attempt = 1; attempt <= this.retryAttempts; attempt += 1) {\n\t\t\ttry {\n\t\t\t\treturn await send();\n\t\t\t} catch (error: unknown) {\n\t\t\t\tlastError = error;\n\t\t\t\tif (attempt >= this.retryAttempts || !isTransientPushRelayError(error)) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tawait delay(this.retryDelayMs * attempt);\n\t\t\t}\n\t\t}\n\t\tthrow lastError;\n\t}\n\n\tprivate async logPushDelivery(\n\t\tpushTarget: IrohRemotePushTarget,\n\t\teventId: string,\n\t\tkind: string,\n\t\tsuccess: boolean,\n\t\terror?: string,\n\t\tdeliveredTokenHash?: string,\n\t): Promise<void> {\n\t\tawait this.log({\n\t\t\ttype: \"push_notification_delivered\",\n\t\t\tclientNodeId: this.clientNodeId,\n\t\t\tworkspace: this.workspace,\n\t\t\tsuccess,\n\t\t\terror,\n\t\t\tdetails: {\n\t\t\t\teventId,\n\t\t\t\tkind,\n\t\t\t\tpushTargetId: pushTarget.id,\n\t\t\t\tprovider: pushTarget.provider,\n\t\t\t\tplatform: pushTarget.platform,\n\t\t\t\ttokenHash: deliveredTokenHash ?? pushTarget.tokenHash,\n\t\t\t},\n\t\t});\n\t}\n\n\tprivate async log(event: IrohRemoteAuditEventInput): Promise<void> {\n\t\tif (!this.auditLogger) {\n\t\t\treturn;\n\t\t}\n\t\ttry {\n\t\t\tawait this.auditLogger.log(event);\n\t\t} catch {\n\t\t\t// Push relay side effects should not be reinterpreted as RPC failures if audit I/O fails.\n\t\t}\n\t}\n}\n\nexport function hashIrohRemotePushToken(token: string): string {\n\treturn `sha256:${createHash(\"sha256\").update(token, \"utf8\").digest(\"base64url\")}`;\n}\n\nexport function parseRegisterPushTargetArgs(value: unknown): RpcRegisterPushTargetArgs {\n\tconst args = expectRecord(value, \"register_push_target args\");\n\treturn {\n\t\tprovider: expectPushProvider(args.provider),\n\t\tplatform: expectPushPlatform(args.platform),\n\t\tpushTargetId: expectString(args.pushTargetId, \"push target id\"),\n\t\tpushTargetAuthToken: expectString(args.pushTargetAuthToken, \"push target auth token\"),\n\t\trelayUrl: expectOptionalString(args.relayUrl, \"push relay URL\"),\n\t\ttokenHash: expectOptionalString(args.tokenHash, \"push token hash\"),\n\t\tliveActivity: parseOptionalLiveActivityRegistration(args.liveActivity, \"push liveActivity\"),\n\t\tenabled: expectBoolean(args.enabled, \"push enabled\"),\n\t};\n}\n\nfunction parseOptionalLiveActivityRegistration(\n\tvalue: unknown,\n\tlabel: string,\n): RpcRegisterPushTargetArgs[\"liveActivity\"] {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\tconst liveActivity = expectRecord(value, label);\n\treturn {\n\t\tactivityId: expectString(liveActivity.activityId, `${label} activityId`),\n\t\tpushToken: expectString(liveActivity.pushToken, `${label} pushToken`),\n\t\ttokenHash: expectOptionalString(liveActivity.tokenHash, `${label} tokenHash`),\n\t\ttokenEnvironment: expectOptionalPushTokenEnvironment(liveActivity.tokenEnvironment, `${label} tokenEnvironment`),\n\t};\n}\n\nfunction selectEnabledPushTarget(pushTargets: IrohRemotePushTarget[]): IrohRemotePushTarget | undefined {\n\treturn pushTargets\n\t\t.filter((target) => target.enabled)\n\t\t.sort((a, b) => b.updatedAt - a.updatedAt || b.createdAt - a.createdAt)[0];\n}\n\nfunction createRelayNotificationRequest(\n\tpushTarget: IrohRemotePushTarget,\n\tnotification: IrohRemotePushNotificationIntent,\n): IrohRemotePushRelayNotificationRequest {\n\tconst workspace = getSafeNotificationWorkspace(notification.workspace);\n\treturn {\n\t\tpushTargetId: pushTarget.id,\n\t\tpushTargetAuthToken: pushTarget.pushTargetAuthToken,\n\t\teventId: notification.eventId,\n\t\tkind: notification.kind,\n\t\ttitle: notification.title,\n\t\tbody: notification.body,\n\t\t...(workspace === undefined ? {} : { workspace }),\n\t\tdata: {\n\t\t\teventId: notification.eventId,\n\t\t\tkind: notification.kind,\n\t\t\t...(notification.sessionId === undefined ? {} : { sessionId: notification.sessionId }),\n\t\t\t...(workspace === undefined ? {} : { workspace }),\n\t\t},\n\t};\n}\n\nfunction getSafeNotificationWorkspace(workspace: string | undefined): string | undefined {\n\tif (workspace === undefined) {\n\t\treturn undefined;\n\t}\n\tconst trimmed = workspace.trim();\n\tif (trimmed.length === 0 || trimmed.includes(\"/\") || trimmed.includes(\"\\\\\") || trimmed.includes(\"\\0\")) {\n\t\treturn undefined;\n\t}\n\treturn trimmed;\n}\n\nfunction createRelayLiveActivityRequest(\n\tpushTarget: IrohRemotePushTarget,\n\tupdate: IrohRemoteLiveActivityUpdateIntent,\n\tactivityId = pushTarget.liveActivity?.activityId,\n): IrohRemotePushRelayLiveActivityRequest {\n\tif (!pushTarget.liveActivity) {\n\t\tthrow new Error(\"push target has no live activity token\");\n\t}\n\tif (!activityId) {\n\t\tthrow new Error(\"live activity registration has no activity id\");\n\t}\n\treturn {\n\t\tpushTargetId: pushTarget.id,\n\t\tpushTargetAuthToken: pushTarget.pushTargetAuthToken,\n\t\tactivityId,\n\t\tactivityPushToken: pushTarget.liveActivity.pushToken,\n\t\t...(pushTarget.liveActivity.tokenEnvironment === undefined\n\t\t\t? {}\n\t\t\t: { tokenEnvironment: pushTarget.liveActivity.tokenEnvironment }),\n\t\teventId: update.eventId,\n\t\tkind: update.kind,\n\t\tcontentState: update.contentState,\n\t\t...(update.activityEvent === undefined ? {} : { activityEvent: update.activityEvent }),\n\t\t...(update.staleDateEpochSeconds === undefined ? {} : { staleDateEpochSeconds: update.staleDateEpochSeconds }),\n\t\t...(update.dismissalDateEpochSeconds === undefined\n\t\t\t? {}\n\t\t\t: { dismissalDateEpochSeconds: update.dismissalDateEpochSeconds }),\n\t};\n}\n\nfunction getPushTargetAuditDetails(pushTarget: IrohRemotePushTarget): Record<string, unknown> {\n\treturn {\n\t\tpushTargetId: pushTarget.id,\n\t\tprovider: pushTarget.provider,\n\t\tplatform: pushTarget.platform,\n\t\trelayUrl: pushTarget.relayUrl,\n\t\ttokenHash: pushTarget.tokenHash,\n\t\tliveActivityTokenHash: pushTarget.liveActivity?.tokenHash,\n\t\tliveActivityTokenEnvironment: pushTarget.liveActivity?.tokenEnvironment,\n\t\tenabled: pushTarget.enabled,\n\t\tcreatedAt: pushTarget.createdAt,\n\t\tupdatedAt: pushTarget.updatedAt,\n\t};\n}\n\nfunction selectLiveActivityRegistration(\n\tclient: IrohRemoteClient | undefined,\n\tcontentState: IrohRemoteLiveActivityContentState,\n): IrohRemoteLiveActivityRegistration | undefined {\n\tconst workspaceName = contentState.workspaceName;\n\tconst sessionId = contentState.sessionID;\n\tif (!workspaceName || !sessionId) {\n\t\treturn undefined;\n\t}\n\treturn (client?.liveActivities ?? [])\n\t\t.filter((registration) => {\n\t\t\treturn registration.workspaceName === workspaceName && registration.sessionId === sessionId;\n\t\t})\n\t\t.sort((a, b) => b.updatedAt - a.updatedAt || b.createdAt - a.createdAt)[0];\n}\n\nfunction findRegisteredLiveActivityPushTarget(\n\tclient: IrohRemoteClient | undefined,\n\tregistration: IrohRemoteLiveActivityRegistration,\n): IrohRemotePushTarget | undefined {\n\treturn client?.pushTargets?.find((target) => {\n\t\treturn (\n\t\t\ttarget.id === registration.pushTargetId &&\n\t\t\ttarget.platform === registration.platform &&\n\t\t\ttarget.liveActivity?.tokenHash === registration.tokenHash &&\n\t\t\ttarget.liveActivity.tokenEnvironment === registration.tokenEnvironment\n\t\t);\n\t});\n}\n\nfunction isTransientPushRelayError(error: unknown): boolean {\n\tif (error instanceof IrohRemotePushRelayHttpError) {\n\t\treturn error.transient;\n\t}\n\treturn true;\n}\n\nfunction isTransientHttpStatus(status: number): boolean {\n\treturn status === 408 || status === 409 || status === 425 || status === 429 || status >= 500;\n}\n\nfunction toErrorMessage(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nfunction expectRecord(value: unknown, label: string): Record<string, unknown> {\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\tthrow new Error(`${label} must be an object`);\n\t}\n\treturn value as Record<string, unknown>;\n}\n\nfunction expectString(value: unknown, label: string): string {\n\tif (typeof value !== \"string\" || value.length === 0) {\n\t\tthrow new Error(`${label} must be a non-empty string`);\n\t}\n\treturn value;\n}\n\nfunction expectOptionalString(value: unknown, label: string): string | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\treturn expectString(value, label);\n}\n\nfunction expectBoolean(value: unknown, label: string): boolean {\n\tif (typeof value !== \"boolean\") {\n\t\tthrow new Error(`${label} must be a boolean`);\n\t}\n\treturn value;\n}\n\nfunction expectPushProvider(value: unknown): IrohRemotePushTargetProvider {\n\tif (value === \"fcm\") {\n\t\treturn value;\n\t}\n\tthrow new Error(\"push provider must be fcm\");\n}\n\nfunction expectPushPlatform(value: unknown): IrohRemotePushTargetPlatform {\n\tif (value === \"ios\") {\n\t\treturn value;\n\t}\n\tthrow new Error(\"push platform must be ios\");\n}\n\nfunction expectOptionalPushTokenEnvironment(value: unknown, label: string): IrohRemotePushTokenEnvironment | undefined {\n\tif (value === undefined) {\n\t\treturn undefined;\n\t}\n\tif (value === \"development\" || value === \"production\") {\n\t\treturn value;\n\t}\n\tthrow new Error(`${label} must be development or production`);\n}\n\nfunction delay(ms: number): Promise<void> {\n\tif (ms === 0) {\n\t\treturn Promise.resolve();\n\t}\n\treturn new Promise((resolve) => {\n\t\tsetTimeout(resolve, ms);\n\t});\n}\n"]}