@ours.network/messenger-server 1.0.21 → 1.0.23

package/dist/chunks/{server-QLWLPQHE.js → server-TX7WLV64.js}

@@ -7,7 +7,7 @@ import {
   publicEngineError,
   publicInternalError,
   reportFailure
-} from "./chunk-7KB5SIFJ.js";
+} from "./chunk-G4IVQ6I4.js";
 
 // node_modules/bn.js/lib/bn.js
 var require_bn = __commonJS({
@@ -9676,7 +9676,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash4 } = __require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash5 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -10344,7 +10344,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash4("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -10716,7 +10716,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash4 } = __require("crypto");
+    var { createHash: createHash5 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -11023,7 +11023,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash4("sha1").update(key + GUID).digest("base64");
+        const digest = createHash5("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -20621,11 +20621,24 @@ var ROUTES = {
       const current = await within(client.currentIdentity(), deps.healthTimeoutMs ?? 1500);
       const identity = publicIdentity(current);
       if (identity.cid !== deps.identityCid) throw new Error("bound identity mismatch");
+      const pushQueue = deps.push.queueStats();
+      if (pushQueue.healthy === false) {
+        sendJson(res, 503, {
+          status: "degraded",
+          message: "Push queue saturated",
+          version: deps.buildInfo.version,
+          sha: deps.buildInfo.sha,
+          identityCid: deps.identityCid,
+          pushQueue
+        });
+        return void 0;
+      }
       sendJson(res, 200, {
         status: "ok",
         version: deps.buildInfo.version,
         sha: deps.buildInfo.sha,
-        identityCid: deps.identityCid
+        identityCid: deps.identityCid,
+        pushQueue
       });
     } catch {
       sendJson(res, 503, unavailable);
@@ -21195,6 +21208,34 @@ var require9 = createRequire8(import.meta.url);
 var require10 = createRequire9(import.meta.url);
 
 // src/daemon.ts
+function daemonNotificationReader(leaseToken) {
+  let selected;
+  return async (identity, since, signal) => {
+    selected ??= _2();
+    const url = `${selected.baseUrl.value}/identities/${encodeURIComponent(identity)}/notifications?since=${encodeURIComponent(String(since))}&kinds=inbound`;
+    const response = await fetch(url, {
+      headers: {
+        "x-ours-lease-token": leaseToken,
+        "x-ours-client-pid": String(process.pid),
+        ...selected.token ? { "x-ours-api-token": selected.token.value } : {}
+      },
+      signal
+    });
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new Error(`daemon notification page returned HTTP ${response.status} with invalid JSON`);
+    }
+    if (!response.ok) throw new Error(`daemon notification page returned HTTP ${response.status}`);
+    if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("daemon notification page is malformed");
+    const page = body;
+    if (!Number.isSafeInteger(page.cursor) || page.cursor < 0 || !Array.isArray(page.events)) {
+      throw new Error("daemon notification page is malformed");
+    }
+    return { cursor: page.cursor, events: page.events };
+  };
+}
 function hasCode(error, code) {
   return error instanceof Error && "code" in error && error.code === code;
 }
@@ -21219,6 +21260,7 @@ async function startRuntime(_cfg, buildInfo, attach = j) {
       apiVisibility: "daemon-configured",
       mcp: false
     }),
+    readNotificationPage: daemonNotificationReader(leaseToken),
     async close() {
       if (closed) return;
       closed = true;
@@ -21247,10 +21289,23 @@ import { dirname as dirname2, join as join2 } from "node:path";
 var MAX_BINDINGS = 32;
 var MAX_ENDPOINT_LENGTH = 2048;
 var MAX_LABEL_LENGTH = 160;
-var MAX_JOBS_PER_IDENTITY = 4096;
+var MAX_RECORDS_PER_IDENTITY = 4096;
+var MAX_TOMBSTONES_PER_IDENTITY = 256;
 var JOB_EXPIRY_MS = 24 * 60 * 60 * 1e3;
-var TERMINAL_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
+var TOMBSTONE_RETENTION_MS = 15 * 60 * 1e3;
 var MAX_ATTEMPTS = 6;
+var emptyMetrics = () => ({
+  admitted: 0,
+  delivered: 0,
+  suppressed: 0,
+  retries: 0,
+  dropped: 0,
+  permanentFailures: 0,
+  prunedBindings: 0,
+  admissionFailures: 0,
+  tombstonesPruned: 0,
+  migratedTerminal: 0
+});
 function nonEmpty2(value, max = Number.MAX_SAFE_INTEGER) {
   return typeof value === "string" && value.length > 0 && value.length <= max;
 }
@@ -21298,10 +21353,44 @@ function validBinding(value) {
   }
   return nonEmpty2(row.bindingId, 128) && nonEmpty2(row.createdAt, 64) && nonEmpty2(row.updatedAt, 64) && nonEmpty2(row.vapidFingerprint, 128) && Number.isSafeInteger(row.configEpoch) && row.configEpoch > 0 && (row.label === void 0 || nonEmpty2(row.label, MAX_LABEL_LENGTH));
 }
+function validJobBase(row) {
+  return nonEmpty2(row.id, 2048) && nonEmpty2(row.identityCid, 512) && nonEmpty2(row.wireId, 1024) && (row.kind === "message" || row.kind === "file" || row.kind === "photo" || row.kind === "voice") && nonEmpty2(row.contactId, 512) && (row.senderName === void 0 || nonEmpty2(row.senderName, 512)) && Number.isFinite(row.createdAt) && Number.isFinite(row.expiresAt) && Number.isSafeInteger(row.attempts) && row.attempts >= 0 && Number.isFinite(row.nextAttemptAt) && Array.isArray(row.targetBindingIds) && row.targetBindingIds.length <= MAX_BINDINGS && row.targetBindingIds.every((id) => nonEmpty2(id, 128)) && Array.isArray(row.deliveredBindingIds) && row.deliveredBindingIds.length <= MAX_BINDINGS && row.deliveredBindingIds.every((id) => nonEmpty2(id, 128)) && Number.isSafeInteger(row.sentCount) && row.sentCount >= 0;
+}
 function validJob(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const row = value;
-  return nonEmpty2(row.id, 2048) && nonEmpty2(row.identityCid, 512) && nonEmpty2(row.wireId, 1024) && (row.kind === "message" || row.kind === "file" || row.kind === "photo" || row.kind === "voice") && nonEmpty2(row.contactId, 512) && (row.senderName === void 0 || nonEmpty2(row.senderName, 512)) && Number.isFinite(row.createdAt) && Number.isFinite(row.expiresAt) && Number.isSafeInteger(row.attempts) && row.attempts >= 0 && Number.isFinite(row.nextAttemptAt) && Array.isArray(row.targetBindingIds) && row.targetBindingIds.length <= MAX_BINDINGS && row.targetBindingIds.every((id) => nonEmpty2(id, 128)) && Array.isArray(row.deliveredBindingIds) && row.deliveredBindingIds.length <= MAX_BINDINGS && row.deliveredBindingIds.every((id) => nonEmpty2(id, 128)) && (row.status === "pending" || row.status === "sent" || row.status === "dropped") && Number.isSafeInteger(row.sentCount) && row.sentCount >= 0 && (row.completedAt === void 0 || Number.isFinite(row.completedAt));
+  return validJobBase(row) && (row.status === "pending" || row.status === "in_flight") && (row.inFlightAt === void 0 || Number.isFinite(row.inFlightAt));
+}
+function validLegacyJob(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const row = value;
+  return validJobBase(row) && (row.status === "pending" || row.status === "sent" || row.status === "dropped") && (row.completedAt === void 0 || Number.isFinite(row.completedAt));
+}
+function validTombstone(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const row = value;
+  return nonEmpty2(row.id, 2048) && Number.isFinite(row.completedAt) && Number.isFinite(row.expiresAt);
+}
+function validMetrics(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const row = value;
+  return [
+    "admitted",
+    "delivered",
+    "suppressed",
+    "retries",
+    "dropped",
+    "permanentFailures",
+    "prunedBindings",
+    "admissionFailures",
+    "tombstonesPruned",
+    "migratedTerminal"
+  ].every((key) => Number.isSafeInteger(row[key]) && Number(row[key]) >= 0) && (row.lastSaturationAt === void 0 || Number.isFinite(row.lastSaturationAt));
+}
+function validPageCheckpoint(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const row = value;
+  return Number.isSafeInteger(row.fromCursor) && row.fromCursor >= 0 && Number.isSafeInteger(row.cursor) && row.cursor >= row.fromCursor && Number.isSafeInteger(row.eventCount) && row.eventCount >= 0 && Number.isSafeInteger(row.nextIndex) && row.nextIndex >= 0 && row.nextIndex <= row.eventCount && nonEmpty2(row.digest, 128) && /^[A-Za-z0-9_-]+$/.test(row.digest);
 }
 function validVapid(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
@@ -21316,11 +21405,17 @@ function validVapid(value) {
     return false;
   }
 }
+function validV3(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const state = value;
+  if (state.version !== 3 || !validVapid(state.vapid) || !nonEmpty2(state.vapidFingerprint, 128) || !Number.isSafeInteger(state.configEpoch) || state.configEpoch < 1 || !state.identities || typeof state.identities !== "object" || Array.isArray(state.identities)) return false;
+  return Object.entries(state.identities).every(([cid, identity]) => nonEmpty2(cid, 512) && !!identity && typeof identity === "object" && Array.isArray(identity.bindings) && identity.bindings.length <= MAX_BINDINGS && identity.bindings.every(validBinding) && Array.isArray(identity.jobs) && Array.isArray(identity.tombstones) && identity.jobs.length + identity.tombstones.length <= MAX_RECORDS_PER_IDENTITY && identity.tombstones.length <= MAX_TOMBSTONES_PER_IDENTITY && identity.jobs.every((job) => validJob(job) && job.identityCid === cid) && identity.tombstones.every(validTombstone) && (identity.notificationCursor === null || Number.isSafeInteger(identity.notificationCursor) && identity.notificationCursor >= 0) && (identity.notificationPage === void 0 || validPageCheckpoint(identity.notificationPage) && identity.notificationCursor !== null && identity.notificationPage.fromCursor === identity.notificationCursor) && validMetrics(identity.metrics) && typeof identity.saturated === "boolean");
+}
 function validV2(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const state = value;
   if (state.version !== 2 || !validVapid(state.vapid) || !nonEmpty2(state.vapidFingerprint, 128) || !Number.isSafeInteger(state.configEpoch) || state.configEpoch < 1 || !state.identities || typeof state.identities !== "object" || Array.isArray(state.identities)) return false;
-  return Object.entries(state.identities).every(([cid, identity]) => nonEmpty2(cid, 512) && !!identity && typeof identity === "object" && Array.isArray(identity.bindings) && identity.bindings.length <= MAX_BINDINGS && identity.bindings.every(validBinding) && Array.isArray(identity.jobs) && identity.jobs.length <= MAX_JOBS_PER_IDENTITY && identity.jobs.every((job) => validJob(job) && job.identityCid === cid));
+  return Object.entries(state.identities).every(([cid, identity]) => nonEmpty2(cid, 512) && !!identity && typeof identity === "object" && Array.isArray(identity.bindings) && identity.bindings.length <= MAX_BINDINGS && identity.bindings.every(validBinding) && Array.isArray(identity.jobs) && identity.jobs.length <= MAX_RECORDS_PER_IDENTITY && identity.jobs.every((job) => validLegacyJob(job) && job.identityCid === cid));
 }
 function validLegacy(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
@@ -21341,13 +21436,22 @@ function preservedStateError(file, reason) {
     `Existing push state ${file} is ${reason}; it was left unchanged. Restore valid push.json contents, or move the file aside explicitly before restarting.`
   );
 }
+function newIdentityState() {
+  return { bindings: [], jobs: [], tombstones: [], notificationCursor: null, metrics: emptyMetrics(), saturated: false };
+}
 function identityState(state, cid) {
-  return state.identities[cid] ??= { bindings: [], jobs: [] };
+  return state.identities[cid] ??= newIdentityState();
 }
 function privateEvent(event) {
   const body = event.kind === "message" ? "New message" : event.kind === "voice" ? "New voice message" : event.kind === "photo" ? "New photo" : "New file";
   return { ...event, title: "ours messenger", body };
 }
+function invalidDeviceToken(error) {
+  if (!error || typeof error !== "object") return false;
+  const raw = error.reason ?? error.body;
+  const body = typeof raw === "string" ? raw.slice(0, 2048) : Buffer.isBuffer(raw) ? raw.subarray(0, 2048).toString("utf8") : "";
+  return /\b(?:BadDeviceToken|DeviceTokenNotForTopic|Unregistered)\b/.test(body);
+}
 var LEGACY_LOCAL_VAPID_SUBJECT = "mailto:admin@localhost";
 var DEFAULT_VAPID_SUBJECT = "https://ours.network";
 function defaultVapidSubject(env) {
@@ -21389,7 +21493,7 @@ var PushStore = class _PushStore {
       } catch (error) {
         throw preservedStateError(file, `corrupt or unreadable (${error instanceof Error ? error.message : String(error)})`);
       }
-      if (validV2(value) || validLegacy(value)) parsed = value;
+      if (validV3(value) || validV2(value) || validLegacy(value)) parsed = value;
       else throw preservedStateError(file, "schema-invalid");
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
@@ -21407,7 +21511,7 @@ var PushStore = class _PushStore {
     }
     const selectedFingerprint = fingerprint(selected.publicKey);
     let state;
-    if (parsed && validV2(parsed)) {
+    if (parsed && validV3(parsed)) {
       const rotated = parsed.vapidFingerprint !== selectedFingerprint;
       state = {
         ...parsed,
@@ -21415,16 +21519,53 @@ var PushStore = class _PushStore {
         vapidFingerprint: selectedFingerprint,
         configEpoch: rotated ? parsed.configEpoch + 1 : parsed.configEpoch
       };
+    } else if (parsed && validV2(parsed)) {
+      const rotated = parsed.vapidFingerprint !== selectedFingerprint;
+      const now = Date.now();
+      state = {
+        version: 3,
+        vapid: selected,
+        vapidFingerprint: selectedFingerprint,
+        configEpoch: rotated ? parsed.configEpoch + 1 : parsed.configEpoch,
+        identities: Object.fromEntries(Object.entries(parsed.identities).map(([cid, old]) => {
+          const pending = old.jobs.filter((row) => row.status === "pending").map((row) => ({
+            id: row.id,
+            identityCid: row.identityCid,
+            wireId: row.wireId,
+            kind: row.kind,
+            contactId: row.contactId,
+            senderName: row.senderName,
+            createdAt: row.createdAt,
+            expiresAt: row.expiresAt,
+            attempts: row.attempts,
+            nextAttemptAt: row.nextAttemptAt,
+            targetBindingIds: [...row.targetBindingIds],
+            deliveredBindingIds: [...row.deliveredBindingIds],
+            status: "pending",
+            sentCount: row.sentCount
+          }));
+          const terminal = old.jobs.filter((row) => row.status !== "pending");
+          const tombstones = terminal.filter((row) => row.completedAt !== void 0 && now - row.completedAt <= TOMBSTONE_RETENTION_MS).sort((a4, b3) => (b3.completedAt ?? 0) - (a4.completedAt ?? 0)).slice(0, MAX_TOMBSTONES_PER_IDENTITY).map((row) => ({ id: row.id, completedAt: row.completedAt, expiresAt: row.completedAt + TOMBSTONE_RETENTION_MS }));
+          const metrics = emptyMetrics();
+          metrics.admitted = old.jobs.length;
+          metrics.delivered = terminal.reduce((sum, row) => sum + (row.status === "sent" ? row.sentCount : 0), 0);
+          metrics.dropped = terminal.filter((row) => row.status === "dropped").length;
+          metrics.migratedTerminal = terminal.length;
+          metrics.tombstonesPruned = terminal.length - tombstones.length;
+          return [cid, { bindings: old.bindings, jobs: pending, tombstones, notificationCursor: null, metrics, saturated: false }];
+        }))
+      };
     } else {
       const oldFingerprint = parsed ? fingerprint(parsed.vapid.publicKey) : selectedFingerprint;
       const now = (/* @__PURE__ */ new Date()).toISOString();
       state = {
-        version: 2,
+        version: 3,
         vapid: selected,
         vapidFingerprint: selectedFingerprint,
         configEpoch: 1,
         identities: {
           [identityCid]: {
+            ...newIdentityState(),
             bindings: (parsed?.subscriptions ?? []).map((row) => ({
               bindingId: randomUUID(),
               endpoint: row.endpoint,
@@ -21435,14 +21576,13 @@ var PushStore = class _PushStore {
               vapidFingerprint: oldFingerprint,
               configEpoch: 1,
               preview: "full"
-            })),
-            jobs: []
+            }))
           }
         }
       };
     }
     const store = new _PushStore(file, identityCid, state, deps);
-    store.pruneTerminal(Date.now());
+    store.recoverAndPrune(Date.now());
     store.persist();
     return store;
   }
@@ -21534,17 +21674,90 @@ var PushStore = class _PushStore {
     if (removed) this.persist();
     return removed;
   }
-  enqueueJob(input, now = Date.now()) {
+  get notificationCursor() {
+    return identityState(this.state, this.identityCid).notificationCursor;
+  }
+  commitNotificationCursor(cursor) {
+    if (!Number.isSafeInteger(cursor) || cursor < 0) throw new Error("push notification cursor must be a non-negative safe integer");
+    const owner = identityState(this.state, this.identityCid);
+    if (owner.notificationCursor === cursor && owner.notificationPage === void 0) return;
+    owner.notificationCursor = cursor;
+    delete owner.notificationPage;
+    this.persist();
+  }
+  get notificationPageProgress() {
+    const page = identityState(this.state, this.identityCid).notificationPage;
+    return page ? { ...page } : null;
+  }
+  beginNotificationPage(input) {
+    if (!validPageCheckpoint({ ...input, nextIndex: 0 })) throw new Error("push notification page checkpoint is invalid");
+    const owner = identityState(this.state, this.identityCid);
+    if (owner.notificationCursor !== input.fromCursor) {
+      throw new Error("push notification page does not start at the committed cursor");
+    }
+    if (owner.notificationPage) return { ...owner.notificationPage };
+    owner.notificationPage = { ...input, nextIndex: 0 };
+    this.persist();
+    return { ...owner.notificationPage };
+  }
+  advanceNotificationPage(nextIndex, durable = false) {
+    const owner = identityState(this.state, this.identityCid);
+    const page = owner.notificationPage;
+    if (!page || !Number.isSafeInteger(nextIndex) || nextIndex !== page.nextIndex + 1 || nextIndex > page.eventCount) {
+      throw new Error("push notification page progress is invalid");
+    }
+    page.nextIndex = nextIndex;
+    if (durable) this.persist();
+  }
+  checkpointNotificationPage() {
+    if (!identityState(this.state, this.identityCid).notificationPage) {
+      throw new Error("push notification page checkpoint is missing");
+    }
+    this.persist();
+  }
+  commitNotificationPage() {
+    const owner = identityState(this.state, this.identityCid);
+    const page = owner.notificationPage;
+    if (!page || page.nextIndex !== page.eventCount) throw new Error("push notification page is incomplete");
+    owner.notificationCursor = page.cursor;
+    delete owner.notificationPage;
+    owner.saturated = false;
+    this.persist();
+  }
+  admitJob(input, now = Date.now(), notificationPageNextIndex) {
     if (!nonEmpty2(input.wireId, 1024) || !nonEmpty2(input.contactId, 512) || input.senderName !== void 0 && !nonEmpty2(input.senderName, 512)) {
       throw new Error("push job correlation metadata is invalid or too long");
     }
     const targets = this.list().map((row) => row.bindingId);
-    if (targets.length === 0) return false;
+    if (targets.length === 0) return { status: "no_targets" };
     const id = `${this.identityCid}:${input.wireId}:${input.kind}`;
     const owner = identityState(this.state, this.identityCid);
-    this.pruneTerminal(now);
-    if (owner.jobs.some((job) => job.id === id)) return false;
-    if (owner.jobs.length >= MAX_JOBS_PER_IDENTITY) return false;
+    const checkpointAdmission = () => {
+      if (notificationPageNextIndex === void 0) return false;
+      const page = owner.notificationPage;
+      if (!page || notificationPageNextIndex !== page.nextIndex + 1 || notificationPageNextIndex > page.eventCount) {
+        throw new Error("push notification page admission checkpoint is invalid");
+      }
+      page.nextIndex = notificationPageNextIndex;
+      return true;
+    };
+    this.pruneTombstones(owner, now);
+    if (owner.jobs.some((job) => job.id === id) || owner.tombstones.some((row) => row.id === id)) {
+      const checkpointed2 = checkpointAdmission();
+      if (checkpointed2) this.persist();
+      return { status: "duplicate", jobId: id, ...checkpointed2 ? { checkpointed: true } : {} };
+    }
+    while (owner.jobs.length + owner.tombstones.length >= MAX_RECORDS_PER_IDENTITY && owner.tombstones.length > 0) {
+      owner.tombstones.shift();
+      owner.metrics.tombstonesPruned++;
+    }
+    if (owner.jobs.length + owner.tombstones.length >= MAX_RECORDS_PER_IDENTITY) {
+      owner.saturated = true;
+      owner.metrics.admissionFailures++;
+      owner.metrics.lastSaturationAt = now;
+      this.persist();
+      return { status: "saturated", jobId: id };
+    }
     owner.jobs.push({
       id,
       identityCid: this.identityCid,
@@ -21561,41 +21774,55 @@ var PushStore = class _PushStore {
       status: "pending",
       sentCount: 0
     });
+    owner.metrics.admitted++;
+    if (owner.notificationPage === void 0) owner.saturated = false;
+    const checkpointed = checkpointAdmission();
     this.persist();
-    return true;
+    return { status: "queued", jobId: id, ...checkpointed ? { checkpointed: true } : {} };
+  }
+  enqueueJob(input, now = Date.now()) {
+    return this.admitJob(input, now).status === "queued";
   }
   dueJobs(now = Date.now()) {
     return identityState(this.state, this.identityCid).jobs.filter((job) => job.status === "pending" && job.nextAttemptAt <= now).map((job) => ({ ...job, targetBindingIds: [...job.targetBindingIds], deliveredBindingIds: [...job.deliveredBindingIds] }));
   }
+  claimJob(jobId, now = Date.now()) {
+    const job = identityState(this.state, this.identityCid).jobs.find((row) => row.id === jobId);
+    if (!job || job.status !== "pending" || job.nextAttemptAt > now) return false;
+    Object.assign(job, { status: "in_flight", inFlightAt: now });
+    this.persist();
+    return true;
+  }
   nextJobDelay(now = Date.now()) {
     const pending = identityState(this.state, this.identityCid).jobs.filter((job) => job.status === "pending");
     if (pending.length === 0) return null;
     return Math.max(0, Math.min(...pending.map((job) => job.nextAttemptAt)) - now);
   }
   retryJob(jobId, now = Date.now(), random = Math.random) {
-    const job = identityState(this.state, this.identityCid).jobs.find((row) => row.id === jobId);
-    if (!job || job.status !== "pending") return false;
+    const owner = identityState(this.state, this.identityCid);
+    const job = owner.jobs.find((row) => row.id === jobId);
+    if (!job || job.status !== "pending" && job.status !== "in_flight") return false;
     const attempts = job.attempts + 1;
     if (attempts >= MAX_ATTEMPTS || now >= job.expiresAt) {
-      Object.assign(job, { attempts, status: "dropped", completedAt: now });
+      owner.metrics.dropped++;
+      this.finishJob(owner, job, now);
       this.persist();
       return false;
     }
     const base = Math.min(6e4, 1e3 * 2 ** (attempts - 1));
     const jitter = Math.floor(base * 0.25 * Math.max(0, Math.min(1, random())));
-    Object.assign(job, { attempts, nextAttemptAt: Math.min(job.expiresAt, now + base + jitter) });
+    Object.assign(job, { attempts, nextAttemptAt: Math.min(job.expiresAt, now + base + jitter), status: "pending" });
+    delete job.inFlightAt;
+    owner.metrics.retries++;
     this.persist();
     return true;
   }
   suppressJob(jobId, now = Date.now()) {
-    const job = identityState(this.state, this.identityCid).jobs.find((row) => row.id === jobId);
+    const owner = identityState(this.state, this.identityCid);
+    const job = owner.jobs.find((row) => row.id === jobId);
     if (!job || job.status !== "pending") return false;
-    Object.assign(job, {
-      status: "sent",
-      completedAt: now,
-      deliveredBindingIds: [...job.targetBindingIds],
-      sentCount: 0
-    });
+    owner.metrics.suppressed++;
+    this.finishJob(owner, job, now);
     this.persist();
     return true;
   }
@@ -21614,14 +21841,17 @@ var PushStore = class _PushStore {
     if (suppressed === 0) return 0;
     Object.assign(job, { deliveredBindingIds: [...completed] });
     const outstanding = job.targetBindingIds.some((id) => !completed.has(id) && owner.bindings.some((binding) => binding.bindingId === id));
-    if (!outstanding) Object.assign(job, { status: "sent", completedAt: now });
+    if (!outstanding) {
+      owner.metrics.suppressed++;
+      this.finishJob(owner, job, now);
+    }
     this.persist();
     return suppressed;
   }
   async dispatchJob(jobId, event, now = Date.now(), random = Math.random) {
     const owner = identityState(this.state, this.identityCid);
     const job = owner.jobs.find((row) => row.id === jobId);
-    if (!job || job.status !== "pending") return { sent: 0, pruned: 0, retried: 0, dropped: 0 };
+    if (!job || job.status !== "in_flight") return { sent: 0, pruned: 0, retried: 0, dropped: 0 };
     const completed = new Set(job.deliveredBindingIds);
     const targets = job.targetBindingIds.map((id) => owner.bindings.find((binding) => binding.bindingId === id)).filter((binding) => !!binding && !completed.has(binding.bindingId) && binding.vapidFingerprint === this.state.vapidFingerprint && binding.configEpoch === this.state.configEpoch);
     let sent = 0;
@@ -21641,7 +21871,7 @@ var PushStore = class _PushStore {
         sent++;
       } catch (error) {
         const status = error.statusCode;
-        if (status === 404 || status === 410) {
+        if (status === 404 || status === 410 || invalidDeviceToken(error)) {
           completed.add(binding.bindingId);
           dead.add(binding.bindingId);
           pruned++;
@@ -21655,28 +21885,66 @@ var PushStore = class _PushStore {
     }));
     if (dead.size) owner.bindings = owner.bindings.filter((binding) => !dead.has(binding.bindingId));
     Object.assign(job, { deliveredBindingIds: [...completed], sentCount: job.sentCount + sent });
+    owner.metrics.delivered += sent;
+    owner.metrics.permanentFailures += dropped;
+    owner.metrics.prunedBindings += pruned;
     const outstanding = job.targetBindingIds.some((id) => !completed.has(id) && owner.bindings.some((binding) => binding.bindingId === id));
     if (outstanding && transient) {
       this.persist();
       const retried = this.retryJob(job.id, now, random) ? transient : 0;
       return { sent, pruned, retried, dropped: dropped + (retried ? 0 : transient) };
     }
-    Object.assign(job, { status: job.sentCount > 0 ? "sent" : "dropped", completedAt: now });
+    if (dropped > 0 && job.sentCount === 0) owner.metrics.dropped++;
+    this.finishJob(owner, job, now);
     this.persist();
     return { sent, pruned, retried: 0, dropped };
   }
   queueStats() {
-    const jobs = identityState(this.state, this.identityCid).jobs;
+    const owner = identityState(this.state, this.identityCid);
+    const jobs = owner.jobs;
     return {
-      pending: jobs.filter((job) => job.status === "pending").length,
-      sent: jobs.filter((job) => job.status === "sent").length,
-      dropped: jobs.filter((job) => job.status === "dropped").length,
-      depth: jobs.length
+      pending: jobs.length,
+      inFlight: jobs.filter((job) => job.status === "in_flight").length,
+      sent: owner.metrics.delivered + owner.metrics.suppressed,
+      dropped: owner.metrics.dropped,
+      depth: jobs.length + owner.tombstones.length,
+      tombstones: owner.tombstones.length,
+      capacity: MAX_RECORDS_PER_IDENTITY,
+      saturated: owner.saturated,
+      healthy: !owner.saturated,
+      admissionFailures: owner.metrics.admissionFailures,
+      delivered: owner.metrics.delivered,
+      retries: owner.metrics.retries,
+      permanentFailures: owner.metrics.permanentFailures,
+      prunedBindings: owner.metrics.prunedBindings,
+      ...owner.metrics.lastSaturationAt === void 0 ? {} : { lastSaturationAt: owner.metrics.lastSaturationAt }
     };
   }
-  pruneTerminal(now) {
-    for (const identity of Object.values(this.state.identities)) {
-      identity.jobs = identity.jobs.filter((job) => job.status === "pending" || job.completedAt === void 0 || now - job.completedAt <= TERMINAL_RETENTION_MS);
+  finishJob(owner, job, now) {
+    owner.jobs = owner.jobs.filter((row) => row.id !== job.id);
+    owner.tombstones.push({ id: job.id, completedAt: now, expiresAt: now + TOMBSTONE_RETENTION_MS });
+    this.pruneTombstones(owner, now);
+  }
+  pruneTombstones(owner, now) {
+    const before = owner.tombstones.length;
+    owner.tombstones = owner.tombstones.filter((row) => row.expiresAt > now).sort((a4, b3) => a4.completedAt - b3.completedAt);
+    if (owner.tombstones.length > MAX_TOMBSTONES_PER_IDENTITY) {
+      owner.tombstones.splice(0, owner.tombstones.length - MAX_TOMBSTONES_PER_IDENTITY);
+    }
+    owner.metrics.tombstonesPruned += before - owner.tombstones.length;
+  }
+  recoverAndPrune(now) {
+    for (const owner of Object.values(this.state.identities)) {
+      for (const job of owner.jobs) {
+        if (job.status === "in_flight") {
+          Object.assign(job, { status: "pending", nextAttemptAt: Math.min(job.nextAttemptAt, now) });
+          delete job.inFlightAt;
+        }
+      }
+      this.pruneTombstones(owner, now);
+      if (owner.jobs.length < MAX_RECORDS_PER_IDENTITY && owner.notificationPage === void 0) {
+        owner.saturated = false;
+      }
     }
   }
   /** Compatibility for tests/old callers; durable production delivery uses jobs. */
@@ -21684,6 +21952,7 @@ var PushStore = class _PushStore {
     const wire = `compat-${randomUUID()}`;
     this.enqueueJob({ wireId: wire, kind: event.kind, contactId: event.contact_id });
     const id = `${this.identityCid}:${wire}:${event.kind}`;
+    this.claimJob(id);
     const result = await this.dispatchJob(id, event);
     return { sent: result.sent, pruned: result.pruned, failed: result.retried + result.dropped, errors: [] };
   }
@@ -21692,6 +21961,7 @@ var PushStore = class _PushStore {
 // src/push-delivery.ts
 init_define_MESSENGER_BUILD_INFO();
 var nonEmpty3 = (value) => typeof value === "string" && value.length > 0;
+var bounded = (value, max) => nonEmpty3(value) && value.length <= max;
 function notificationKind(record) {
   if (record.event === "message_received") return "message";
   if (record.event !== "file_received") return null;
@@ -21699,7 +21969,7 @@ function notificationKind(record) {
   if (record.kind === "photo") return "photo";
   return "file";
 }
-async function projectFromSdk(client, job) {
+async function projectPushEvent(client, job) {
   const url = `/chats/${encodeURIComponent(job.contactId)}#chat-message-${encodeURIComponent(job.wireId)}`;
   if (job.kind === "message") {
     if (!client.getHistoryItem) throw new Error("message projection is unavailable");
@@ -21736,7 +22006,15 @@ async function projectFromSdk(client, job) {
   };
 }
 var PushDeliveryQueue = class {
-  stats = { queued: 0, sent: 0, pruned: 0, retried: 0, dropped: 0, suppressed: 0 };
+  stats = {
+    queued: 0,
+    sent: 0,
+    pruned: 0,
+    retried: 0,
+    dropped: 0,
+    suppressed: 0,
+    saturationEvents: 0
+  };
   store;
   client;
   identityCid;
@@ -21757,39 +22035,50 @@ var PushDeliveryQueue = class {
     this.log = options.log;
     this.now = options.now ?? Date.now;
     this.random = options.random ?? Math.random;
-    this.project = options.project ?? ((job) => projectFromSdk(this.client, job));
+    this.project = options.project ?? ((job) => projectPushEvent(this.client, job));
     this.isForeground = options.isForeground ?? (() => false);
     this.foregroundBindingIds = options.foregroundBindingIds ?? (() => /* @__PURE__ */ new Set());
     this.automatic = options.autoStart !== false;
     if (this.automatic) this.schedule(0);
   }
   enqueue(record) {
-    if (!nonEmpty3(record.sender_id) || !nonEmpty3(record.wire_id)) return false;
+    return this.admit(record).status === "queued";
+  }
+  admit(record, notificationPageNextIndex) {
+    if (!bounded(record.sender_id, 512) || !bounded(record.wire_id, 1024)) return { status: "no_targets" };
     const kind = notificationKind(record);
-    if (!kind || !this.store.hasBindings()) return false;
-    const queued = this.store.enqueueJob({
+    if (!kind || !this.store.hasBindings()) return { status: "no_targets" };
+    const admission = this.store.admitJob({
       wireId: record.wire_id,
       kind,
       contactId: record.sender_id,
-      senderName: nonEmpty3(record.sender_name) ? record.sender_name : void 0
-    }, this.now());
-    if (queued) {
+      senderName: bounded(record.sender_name, 512) ? record.sender_name : void 0
+    }, this.now(), notificationPageNextIndex);
+    if (admission.status === "saturated") {
+      this.stats.saturationEvents++;
+      const state = this.store.queueStats();
+      this.log.warn(
+        `event=push_queue_saturated status=saturated wire=${record.wire_id} kind=${kind} pending=${state.pending} depth=${state.depth} capacity=${state.capacity} admission_failures=${state.admissionFailures}`
+      );
+      return admission;
+    }
+    if (admission.status === "queued") {
       this.stats.queued++;
       const jobId = `${this.identityCid}:${record.wire_id}:${kind}`;
       const suppressedBindings = this.store.suppressBindings(jobId, this.foregroundBindingIds(), this.now());
       if (suppressedBindings > 0) {
         this.stats.suppressed += suppressedBindings;
         this.log.info(`push queue: suppressed ${suppressedBindings} foreground binding(s) kind=${kind} wire=${record.wire_id}`);
-        if (this.store.queueStats().pending === 0) return true;
+        if (this.store.queueStats().pending === 0) return admission;
       } else if (this.isForeground() && this.store.suppressJob(jobId, this.now())) {
         this.stats.suppressed++;
         this.log.info(`push queue: suppressed foreground kind=${kind} wire=${record.wire_id}`);
-        return true;
+        return admission;
       }
       this.log.info(`push queue: queued kind=${kind} wire=${record.wire_id} depth=${this.store.queueStats().pending}`);
       if (this.automatic) this.schedule(0);
     }
-    return queued;
+    return admission;
   }
   async drainDue() {
     if (this.draining) return this.draining;
@@ -21805,6 +22094,7 @@ var PushDeliveryQueue = class {
   async drainOnce() {
     for (const job of this.store.dueJobs(this.now())) {
       if (this.stopped) return;
+      if (!this.store.claimJob(job.id, this.now())) continue;
       let event;
       try {
         event = await this.project(job);
@@ -21851,77 +22141,51 @@ var PushDeliveryQueue = class {
 
 // src/watch.ts
 init_define_MESSENGER_BUILD_INFO();
-var nonEmpty4 = (value) => typeof value === "string" && value.length > 0;
-async function pushEventFor(client, record) {
-  if (!nonEmpty4(record.sender_id) || !nonEmpty4(record.wire_id)) return null;
-  const contactId = record.sender_id;
-  const wireId = record.wire_id;
-  const url = `/chats/${encodeURIComponent(contactId)}`;
-  if (record.event === "message_received") {
-    let message;
-    for (const delay of [0, 50, 200, 500]) {
-      if (delay) await new Promise((resolve2) => setTimeout(resolve2, delay));
-      message = await client.getHistoryItem({ wire_id: wireId }) ?? void 0;
-      if (message?.direction !== "in" || message.peer.id !== contactId) message = void 0;
-      if (message) break;
-    }
-    if (!message) throw new Error("canonical message was not available for push projection");
-    const announcedSender = nonEmpty4(record.sender_name) ? record.sender_name : "New message";
-    const sender = contactDisplayName(announcedSender);
-    const body = contactMessagePreview(announcedSender, message.text);
-    return { v: 1, kind: "message", title: sender, body, contact_id: contactId, wire_id: wireId, url };
+import { createHash as createHash4 } from "node:crypto";
+function pageDigest(events) {
+  return createHash4("sha256").update(JSON.stringify(events)).digest("base64url");
+}
+function applyNotificationPage(page, push, delivery, events, stats, log2) {
+  if (!Number.isSafeInteger(page.cursor) || page.cursor < 0 || !Array.isArray(page.events)) {
+    throw new Error("daemon notification page is malformed");
+  }
+  const fromCursor = push.notificationCursor;
+  if (fromCursor === null) {
+    if (page.events.length > 0) throw new Error("daemon notification tip page unexpectedly contained events");
+    push.commitNotificationCursor(page.cursor);
+    stats.cursorCommits++;
+    return true;
   }
-  if (record.event === "file_received") {
-    let file;
-    for (const delay of [0, 50, 200, 500]) {
-      if (delay) await new Promise((resolve2) => setTimeout(resolve2, delay));
-      file = await client.getFileInfo({ wire_id: wireId }) ?? void 0;
-      if (file?.direction !== "in" || file.peer.id !== contactId) file = void 0;
-      if (file) break;
-    }
-    if (!file) throw new Error("canonical file metadata was not available for push projection");
-    const kind = file.kind === "voice_message" ? "voice" : file.mime.toLowerCase().startsWith("image/") ? "photo" : "file";
-    const label = kind === "voice" ? "Voice message" : kind === "photo" ? "Photo" : "File";
-    return {
-      v: 1,
-      kind,
-      title: contactDisplayName(file.from.name || label),
-      body: `${label}: ${file.filename}`,
-      contact_id: contactId,
-      wire_id: wireId,
-      url
-    };
+  let progress = push.notificationPageProgress;
+  if (progress) {
+    const prefix = page.events.slice(0, progress.eventCount);
+    if (progress.fromCursor !== fromCursor || page.cursor < progress.cursor || page.events.length < progress.eventCount || pageDigest(prefix) !== progress.digest) {
+      throw new Error("daemon notification page changed while a checkpoint was in progress");
+    }
+  } else {
+    progress = push.beginNotificationPage({
+      fromCursor,
+      cursor: page.cursor,
+      eventCount: page.events.length,
+      digest: pageDigest(page.events)
+    });
   }
-  return null;
-}
-async function reconcileMissed(client, delivery, log2) {
-  let queued = 0;
-  const messages = await client.listIncomingMessages();
-  for (const m3 of messages) {
-    if (m3.status !== "unread") continue;
-    if (delivery.enqueue({
-      event: "message_received",
-      sender_id: m3.from.id,
-      sender_name: m3.from.name,
-      wire_id: m3.wire_id
-    })) queued++;
-  }
-  const files = await client.listIncomingFiles();
-  for (const f4 of files) {
-    if (f4.status !== "unread") continue;
-    if (delivery.enqueue({
-      event: "file_received",
-      sender_id: f4.from.id,
-      sender_name: f4.from.name,
-      wire_id: f4.wire_id,
-      // notificationKind() reads `kind` to split voice from file; passing the
-      // raw value keeps that decision in one place rather than duplicating it
-      // here, and matches what the live daemon record carries.
-      kind: f4.kind
-    })) queued++;
-  }
-  if (queued > 0) log2.info(`watch reconcile: queued ${queued} push(es) for notifications missed while disconnected`);
-  return queued;
+  for (let index = progress.nextIndex; index < progress.eventCount; index++) {
+    const record = page.events[index];
+    const admission = delivery.admit(record, index + 1);
+    if (admission.status === "saturated") {
+      push.checkpointNotificationPage();
+      stats.saturationEvents++;
+      log2.warn(`event=push_cursor_blocked status=saturated source_cursor=${page.cursor}`);
+      return false;
+    }
+    stats.events++;
+    events.publish(normalizeNotification(record));
+    if (!admission.checkpointed) push.advanceNotificationPage(index + 1);
+  }
+  push.commitNotificationPage();
+  stats.cursorCommits++;
+  return true;
 }
 function abortableWait(ms, signal) {
   if (signal.aborted) return Promise.resolve();
@@ -21935,12 +22199,11 @@ function abortableWait(ms, signal) {
     signal.addEventListener("abort", done, { once: true });
   });
 }
-function startWatcher(client, identity, push, log2, events, options = {}) {
+function startWatcher(client, identity, push, log2, events, options) {
   const controller = new AbortController();
-  const stats = { pushes: 0, events: 0, reconnects: 0 };
+  const stats = { pushes: 0, events: 0, reconnects: 0, cursorCommits: 0, saturationEvents: 0 };
   let backoffMs = 500;
   let reconnecting = false;
-  const watch = options.watch ?? ((name, signal) => client.watchNotifications(name, { signal }));
   const wait = options.wait ?? abortableWait;
   const probe = options.probe ?? (() => client.version());
   const loop = (async () => {
@@ -21952,35 +22215,16 @@ function startWatcher(client, identity, push, log2, events, options = {}) {
           events.publish({ type: "sync_required", reason: "daemon_reconnected" });
           reconnecting = false;
         }
-        const upstream = watch(identity, controller.signal);
-        if (options.delivery) {
-          try {
-            await reconcileMissed(client, options.delivery, log2);
-          } catch (e) {
-            reportFailure(log2.warn, "watch reconcile", e);
-          }
-        }
-        for await (const record of upstream) {
-          if (controller.signal.aborted) break;
-          stats.events++;
-          backoffMs = 500;
-          events.publish(normalizeNotification(record));
-          try {
-            if (options.delivery) options.delivery.enqueue(record);
-            if (options.delivery) continue;
-            const event = await pushEventFor(client, record);
-            if (!event) continue;
-            const result = await push.send(event);
-            stats.pushes += result.sent;
-            if (result.pruned) log2.info(`push: pruned ${result.pruned} dead subscription(s)`);
-            if (result.failed) {
-              log2.warn(`push: ${result.failed} subscription(s) failed (kept for retry)`);
-            }
-          } catch (e) {
-            reportFailure(log2.warn, "push send", e);
-          }
+        const since = push.notificationCursor ?? "tip";
+        const page = await options.readPage(identity, since, controller.signal);
+        if (controller.signal.aborted) break;
+        const committed = applyNotificationPage(page, push, options.delivery, events, stats, log2);
+        if (!committed) {
+          await wait(backoffMs, controller.signal);
+          backoffMs = Math.min(backoffMs * 2, 3e4);
+          continue;
         }
-        if (!controller.signal.aborted) throw new Error("notification stream ended");
+        backoffMs = 500;
       } catch (e) {
         if (controller.signal.aborted) break;
         stats.reconnects++;
@@ -22480,15 +22724,18 @@ async function start(cfg, buildInfo, dependencies = DEFAULT_START_DEPENDENCIES)
       log,
       foregroundBindingIds: () => presence.onlineBindings(bound.cid)
     });
-    watcher = startWatcher(runtime.client, cfg.identity, push, log, events, { delivery });
+    watcher = startWatcher(runtime.client, cfg.identity, push, log, events, {
+      delivery,
+      readPage: runtime.readNotificationPage
+    });
     const readyDeps = {
       runtime,
       push,
       config: cfg,
       buildInfo,
       watcherStats: () => ({
-        ...watcher?.stats ?? { pushes: 0, events: 0, reconnects: 0 },
-        ...delivery?.stats ?? { queued: 0, sent: 0, pruned: 0, retried: 0, dropped: 0 },
+        ...watcher?.stats ?? { pushes: 0, events: 0, reconnects: 0, cursorCommits: 0, saturationEvents: 0 },
+        ...delivery?.stats ?? { queued: 0, sent: 0, pruned: 0, retried: 0, dropped: 0, suppressed: 0, saturationEvents: 0 },
         presenceIdentities: presence.onlineCount,
         presenceSockets: presence.socketCount
       }),