@spooky-sync/core 0.0.1-canary.279 → 0.0.1-canary.281

package/dist/index.js

@@ -613,6 +613,648 @@ function withTimeout(promise, timeoutMs, message) {
 	});
 }
 
+//#endregion
+//#region src/push/types.ts
+/**
+* Web Push wire types shared by the page (`db.webPush`), the service worker
+* bridge (`@spooky-sync/core/sw`) and the live feed. Pure: types plus a few
+* dependency-free helpers, safe in any context.
+*
+* `PushPayload` mirrors `packages/push-core/src/config.rs` (`PushPayload`,
+* `PayloadKind`, `Op`, `NotificationTemplate`). Keep the two in step.
+*/
+/** Payload format version this build understands. */
+const PUSH_PAYLOAD_VERSION = 1;
+/** `urlBase64ToUint8Array`: the VAPID key as `applicationServerKey` wants it. */
+function base64UrlToBytes(value) {
+	const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
+	const raw = typeof atob === "function" ? atob(padded) : decodeBase64Fallback(padded);
+	const out = new Uint8Array(raw.length);
+	for (let i = 0; i < raw.length; i++) out[i] = raw.charCodeAt(i);
+	return out;
+}
+function sameBytes(a, b) {
+	if (!a || !b) return false;
+	const x = a instanceof Uint8Array ? a : new Uint8Array(a);
+	const y = b instanceof Uint8Array ? b : new Uint8Array(b);
+	if (x.length !== y.length) return false;
+	for (let i = 0; i < x.length; i++) if (x[i] !== y[i]) return false;
+	return true;
+}
+/** A payload this build can act on (`v` known, `kind` set). */
+function isPushPayload(value) {
+	if (!value || typeof value !== "object") return false;
+	const v = value;
+	return v.v === PUSH_PAYLOAD_VERSION && (v.kind === "rule" || v.kind === "message");
+}
+const B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function decodeBase64Fallback(input) {
+	const clean = input.replace(/=+$/, "");
+	let out = "";
+	let buffer = 0;
+	let bits = 0;
+	for (const ch of clean) {
+		const idx = B64.indexOf(ch);
+		if (idx < 0) continue;
+		buffer = buffer << 6 | idx;
+		bits += 6;
+		if (bits >= 8) {
+			bits -= 8;
+			out += String.fromCharCode(buffer >> bits & 255);
+		}
+	}
+	return out;
+}
+
+//#endregion
+//#region src/modules/web-push/index.ts
+var WebPushError = class extends Error {
+	constructor(code, message, cause) {
+		super(message);
+		this.code = code;
+		this.cause = cause;
+		this.name = "WebPushError";
+	}
+};
+const PUSH_ENDPOINT_KEY = "sp00ky_push_endpoint";
+const SIGN_OUT_UNSUBSCRIBE_TIMEOUT_MS = 1500;
+const SUBSCRIBE_READY_TIMEOUT_MS = 1e4;
+const SYNC_READY_TIMEOUT_MS = 5e3;
+const AUTO_SYNC_DELAY_MS = 1500;
+const noop = () => {};
+/** `table:id` of a record id value, without the SDK's escaping. */
+function recordIdString(value) {
+	if (value instanceof RecordId$1) return encodeRecordId(value);
+	const v = value;
+	if (v && typeof v === "object" && v.table !== void 0 && v.id !== void 0) return `${typeof v.table === "string" ? v.table : String(v.table.name ?? v.table)}:${String(v.id)}`;
+	return String(value ?? "");
+}
+function toDate(value) {
+	if (value === null || value === void 0) return void 0;
+	if (value instanceof Date) return value;
+	const d = value;
+	if (typeof d.toDate === "function") return d.toDate();
+	const parsed = new Date(value);
+	return Number.isNaN(parsed.getTime()) ? void 0 : parsed;
+}
+function dropUndefined(obj) {
+	for (const key of Object.keys(obj)) if (obj[key] === void 0) delete obj[key];
+	return obj;
+}
+function toDevice(row, thisEndpoint) {
+	return {
+		id: recordIdString(row.id),
+		endpoint: String(row.endpoint ?? ""),
+		kid: typeof row.kid === "string" ? row.kid : "",
+		label: row.label ?? void 0,
+		userAgent: row.user_agent ?? void 0,
+		rules: Array.isArray(row.rules) ? row.rules : void 0,
+		meta: row.meta ?? void 0,
+		createdAt: toDate(row.created_at),
+		updatedAt: toDate(row.updated_at),
+		lastOkAt: toDate(row.last_ok_at),
+		lastError: row.last_error ?? void 0,
+		failures: typeof row.failures === "number" ? row.failures : 0,
+		disabledAt: toDate(row.disabled_at),
+		disabledReason: row.disabled_reason ?? void 0,
+		current: typeof row.current === "boolean" ? row.current : void 0,
+		thisDevice: !!thisEndpoint && row.endpoint === thisEndpoint
+	};
+}
+function toMessage(row) {
+	return {
+		id: recordIdString(row?.id),
+		status: typeof row?.status === "string" ? row.status : "pending",
+		sendAt: toDate(row?.send_at),
+		createdAt: toDate(row?.created_at)
+	};
+}
+/** Where Web Push can work, from the given globals. */
+function detectWebPushSupport(g) {
+	const nav = g.navigator;
+	const permission = g.Notification?.permission ?? "unsupported";
+	if (!g.window || !nav) return {
+		supported: false,
+		permission: "unsupported",
+		reason: "no-window"
+	};
+	if (g.isSecureContext === false) return {
+		supported: false,
+		permission,
+		reason: "insecure-context"
+	};
+	const ua = nav.userAgent ?? "";
+	if (/iPad|iPhone|iPod/.test(ua) || nav.platform === "MacIntel" && (nav.maxTouchPoints ?? 0) > 1) {
+		if (!(nav.standalone === true || g.matchMedia?.("(display-mode: standalone)").matches === true)) return {
+			supported: false,
+			permission,
+			reason: "ios-not-installed"
+		};
+	}
+	if (!("serviceWorker" in nav) || !nav.serviceWorker) return {
+		supported: false,
+		permission,
+		reason: "no-service-worker"
+	};
+	if (!g.PushManager) return {
+		supported: false,
+		permission,
+		reason: "no-push-manager"
+	};
+	if (!g.Notification) return {
+		supported: false,
+		permission: "unsupported",
+		reason: "no-notification"
+	};
+	return {
+		supported: true,
+		permission
+	};
+}
+function browserGlobals() {
+	const g = globalThis;
+	return {
+		window: typeof g.window !== "undefined" ? g.window : void 0,
+		navigator: g.navigator,
+		Notification: g.Notification,
+		isSecureContext: g.isSecureContext,
+		matchMedia: typeof g.matchMedia === "function" ? (q) => g.matchMedia(q) : void 0,
+		PushManager: g.PushManager
+	};
+}
+function requestPermission(N) {
+	return new Promise((resolve) => {
+		const ret = N.requestPermission((p) => resolve(p));
+		if (ret && typeof ret.then === "function") ret.then(resolve, () => resolve(N.permission));
+	});
+}
+/** `true`/`false` when the subscription says which key it was made with, `null` when it does not. */
+function keyMatches(sub, key) {
+	const k = sub.options?.applicationServerKey;
+	if (!k) return null;
+	return sameBytes(k, key);
+}
+var WebPushModule = class {
+	logger;
+	config;
+	globals;
+	infoCache = null;
+	lastInfo = null;
+	bridges = /* @__PURE__ */ new Set();
+	disposers = [];
+	syncedFor = null;
+	syncTimer = null;
+	attached = false;
+	constructor(deps) {
+		this.deps = deps;
+		this.logger = deps.logger.child({ service: "WebPush" });
+		this.config = deps.config ?? {};
+		this.globals = deps.globals ?? browserGlobals;
+	}
+	/**
+	* Wire sign-out, auto-sync and the token bridge. Called by the client once;
+	* a no-op beyond the sign-out hook where push is unsupported.
+	*/
+	attach() {
+		if (this.attached) return () => this.dispose();
+		this.attached = true;
+		this.disposers.push(this.deps.auth.onBeforeSignOut((ctx) => this.beforeSignOut(ctx)));
+		const g = this.globals();
+		if (!g.window || !g.navigator?.serviceWorker) return () => this.dispose();
+		if (this.config.bridge !== false) this.disposers.push(this.startBridge(void 0, true));
+		if (this.config.autoSync !== false) {
+			let connected = !this.deps.connection;
+			let user = null;
+			const maybeSync = () => {
+				if (!connected || !user || this.syncedFor === user) return;
+				if (!this.support().supported) return;
+				this.syncedFor = user;
+				if (this.syncTimer) clearTimeout(this.syncTimer);
+				this.syncTimer = setTimeout(() => {
+					this.syncTimer = null;
+					this.sync().then((status) => {
+						if (status === "error") this.syncedFor = null;
+					});
+				}, AUTO_SYNC_DELAY_MS);
+			};
+			if (this.deps.connection) this.disposers.push(this.deps.connection.subscribe((state) => {
+				connected = state === "connected";
+				maybeSync();
+			}));
+			this.disposers.push(this.deps.auth.subscribe((uid) => {
+				user = uid ? recordIdString(uid) : null;
+				if (!user) this.syncedFor = null;
+				maybeSync();
+			}), this.onMessage((msg) => {
+				if (msg.type !== "sp00ky:subscriptionchange") return;
+				this.sync();
+			}));
+		}
+		return () => this.dispose();
+	}
+	dispose() {
+		if (this.syncTimer) clearTimeout(this.syncTimer);
+		this.syncTimer = null;
+		for (const off of this.disposers.splice(0)) off();
+		this.bridges.clear();
+		this.attached = false;
+	}
+	support() {
+		try {
+			return detectWebPushSupport(this.globals());
+		} catch {
+			return {
+				supported: false,
+				permission: "unsupported",
+				reason: "no-window"
+			};
+		}
+	}
+	/** Is push on for this deployment, and with which key. Cached; `refresh` re-reads. */
+	info(options = {}) {
+		if (!this.infoCache || options.refresh) {
+			const pending = this.call("RETURN fn::push::info()").then((r) => {
+				const info = dropUndefined({
+					enabled: r?.enabled === true && typeof r.publicKey === "string",
+					publicKey: typeof r?.publicKey === "string" ? r.publicKey : void 0,
+					kid: typeof r?.kid === "string" ? r.kid : void 0
+				});
+				this.lastInfo = info;
+				return info;
+			});
+			this.infoCache = pending;
+			pending.catch(() => {
+				if (this.infoCache === pending) this.infoCache = null;
+			});
+		}
+		return this.infoCache;
+	}
+	/** This browser holds a push subscription registered for the signed-in user. No server round trip. */
+	async isSubscribed() {
+		const support = this.support();
+		if (!support.supported || support.permission !== "granted") return false;
+		const userId = this.userId();
+		if (!userId) return false;
+		const stored = await this.readStored();
+		if (!stored || stored.userId !== userId) return false;
+		const sub = await this.currentSubscription();
+		return !!sub && sub.endpoint === stored.endpoint;
+	}
+	/** The user's devices, this one marked. */
+	async devices() {
+		this.assertSignedIn();
+		const rows = await this.listRaw();
+		const mine = await this.thisEndpoint();
+		return rows.map((r) => toDevice(r, mine));
+	}
+	/**
+	* Ask for permission (when still `default`), subscribe this browser with the
+	* deployment's key and register it for the signed-in user. Call it from a
+	* click handler: permission prompts need a user gesture.
+	*/
+	async subscribe(options = {}) {
+		const support = this.support();
+		if (!support.supported) throw new WebPushError("unsupported", `web push is not available here (${support.reason})`);
+		const userId = this.userId();
+		if (!userId) throw new WebPushError("signed-out", "sign in before subscribing to push notifications");
+		if (this.deps.auth.impersonation) throw new WebPushError("impersonating", "push notifications are not available while impersonating");
+		const N = this.globals().Notification;
+		let permission = support.permission;
+		if (permission === "default" && options.requestPermission !== false) permission = await requestPermission(N);
+		if (permission === "denied") throw new WebPushError("permission-denied", "notification permission was denied");
+		if (permission !== "granted") throw new WebPushError("permission-default", "notification permission was not granted");
+		const info = await this.info();
+		if (!info.enabled || !info.publicKey) throw new WebPushError("disabled", "push is not enabled on this deployment yet");
+		const registration = await this.registration(options.registration, SUBSCRIBE_READY_TIMEOUT_MS);
+		if (!registration?.pushManager) throw new WebPushError("no-registration", "no active service worker to subscribe with");
+		const key = base64UrlToBytes(info.publicKey);
+		let sub;
+		try {
+			sub = await registration.pushManager.getSubscription();
+			if (sub && keyMatches(sub, key) === false) {
+				await sub.unsubscribe().catch(() => false);
+				sub = null;
+			}
+			sub ??= await registration.pushManager.subscribe({
+				userVisibleOnly: true,
+				applicationServerKey: key
+			});
+		} catch (error) {
+			throw new WebPushError("subscribe-failed", error instanceof Error ? error.message : String(error), error);
+		}
+		const row = await this.register(sub, options);
+		await this.writeStored({
+			endpoint: sub.endpoint,
+			userId,
+			kid: row.kid || info.kid,
+			publicKey: info.publicKey,
+			at: Date.now()
+		});
+		this.refreshBridges();
+		return toDevice(row, sub.endpoint);
+	}
+	/** Remove this device (or every device, `all`) for the signed-in user. Returns how many rows went. */
+	async unsubscribe(options = {}) {
+		const userId = this.userId();
+		let removed = 0;
+		const sub = await this.currentSubscription();
+		if (userId && !this.deps.auth.impersonation) if (options.all) removed = Number(await this.call("RETURN fn::push::unsubscribe(NONE)")) || 0;
+		else {
+			const stored = await this.readStored();
+			const endpoint = sub?.endpoint ?? (stored?.userId === userId ? stored.endpoint : null);
+			if (endpoint) removed = Number(await this.call("RETURN fn::push::unsubscribe($endpoint)", { endpoint })) || 0;
+		}
+		if (sub && !options.keepBrowserSubscription) await sub.unsubscribe().catch(() => false);
+		await this.deps.persistence.remove(PUSH_ENDPOINT_KEY).catch(noop);
+		this.refreshBridges();
+		return removed;
+	}
+	/**
+	* Reconcile after sign-in (runs by itself with `autoSync`). Needs granted
+	* permission and a user who subscribed on this browser (or
+	* `autoResubscribe`). Repairs a missing browser subscription, one made with
+	* a rotated key, and a missing, disabled or stale server row. Never throws.
+	*/
+	async sync(options = {}) {
+		try {
+			const support = this.support();
+			if (!support.supported) return "unsupported";
+			const userId = this.userId();
+			if (!userId) return "signed-out";
+			if (this.deps.auth.impersonation) return "impersonating";
+			if (support.permission === "denied") return "permission-denied";
+			if (support.permission !== "granted") return "permission-default";
+			const stored = await this.readStored();
+			const mine = stored && stored.userId === userId ? stored : null;
+			if (!mine && !(options.autoResubscribe ?? this.config.autoResubscribe ?? false)) return "not-subscribed";
+			const info = await this.info({ refresh: true });
+			if (!info.enabled || !info.publicKey) return "disabled";
+			const registration = await this.registration(options.registration, SYNC_READY_TIMEOUT_MS);
+			if (!registration?.pushManager) return "no-registration";
+			const key = base64UrlToBytes(info.publicKey);
+			const devices = await this.listRaw();
+			let sub = await registration.pushManager.getSubscription();
+			const previousEndpoint = sub?.endpoint ?? mine?.endpoint;
+			const previous = devices.find((d) => d.endpoint === previousEndpoint) ?? devices.find((d) => d.endpoint === mine?.endpoint);
+			let status = "ok";
+			if (sub) {
+				const match = keyMatches(sub, key);
+				const rotated = match === false || match === null && !!mine?.kid && !!info.kid && mine.kid !== info.kid;
+				const broken = previous?.endpoint === sub.endpoint && previous.disabled_at != null;
+				if (rotated || broken) {
+					await sub.unsubscribe().catch(() => false);
+					sub = null;
+				}
+			}
+			if (!sub) {
+				sub = await registration.pushManager.subscribe({
+					userVisibleOnly: true,
+					applicationServerKey: key
+				});
+				status = "resubscribed";
+			}
+			const row = devices.find((d) => d.endpoint === sub.endpoint);
+			if (status === "resubscribed" || !row || row.current === false || row.disabled_at != null) {
+				await this.register(sub, {
+					label: previous?.label ?? void 0,
+					rules: previous?.rules ?? void 0,
+					meta: previous?.meta ?? void 0
+				});
+				if (status === "ok") status = "registered";
+				if (previous?.endpoint && previous.endpoint !== sub.endpoint) await this.call("RETURN fn::push::unsubscribe($endpoint)", { endpoint: previous.endpoint }).catch(noop);
+			}
+			await this.writeStored({
+				endpoint: sub.endpoint,
+				userId,
+				kid: info.kid,
+				publicKey: info.publicKey,
+				at: Date.now()
+			});
+			this.refreshBridges();
+			return status;
+		} catch (error) {
+			this.logger.warn({
+				error,
+				Category: "sp00ky-client::WebPush::sync"
+			}, "Web Push sync failed");
+			return "error";
+		}
+	}
+	/** Change this device's label, rule filter or meta. */
+	async update(options) {
+		this.assertSignedIn();
+		this.assertNotImpersonating();
+		const endpoint = await this.thisEndpoint();
+		if (!endpoint) throw new WebPushError("not-subscribed", "this browser is not subscribed");
+		const opts = dropUndefined({
+			label: options.label,
+			rules: options.rules === null ? [] : options.rules,
+			meta: options.meta
+		});
+		const rows = await this.call("RETURN fn::push::update($endpoint, $opts)", {
+			endpoint,
+			opts
+		});
+		const row = Array.isArray(rows) ? rows[0] : null;
+		return row ? toDevice(row, endpoint) : null;
+	}
+	/** Push to yourself, now or at `sendAt` (reminders). Omit `notification` for a nudge. */
+	async notify(message) {
+		this.assertSignedIn();
+		this.assertNotImpersonating();
+		const sendAt = message.sendAt === void 0 ? void 0 : new Date(message.sendAt).toISOString();
+		const msg = dropUndefined({
+			notification: message.notification,
+			data: message.data,
+			topic: message.topic,
+			urgency: message.urgency,
+			ttl: message.ttl,
+			sendAt
+		});
+		return toMessage(await this.call("RETURN fn::push::notify($msg)", { msg }));
+	}
+	/** Cancel a scheduled message. `true` when it was still pending. */
+	async cancel(id) {
+		this.assertSignedIn();
+		const rid = id instanceof RecordId$1 ? id : new RecordId$1("_00_push_message", String(id).replace(/^_00_push_message:/, ""));
+		return await this.call("RETURN fn::push::cancel($id)", { id: rid }) === true;
+	}
+	/** A visible test notification to every device of the user. */
+	async test(options = {}) {
+		this.assertSignedIn();
+		this.assertNotImpersonating();
+		return toMessage(await this.call("RETURN fn::push::test($opts)", { opts: dropUndefined({ ...options }) }));
+	}
+	/**
+	* Post the session to the service worker now and whenever the token
+	* changes (`{ type: 'sp00ky:token', token, userId, endpoint, namespace,
+	* database }`). Never posts an impersonation token. Returns a disposer.
+	* With `webPush.bridge` (the default) this already runs while notification
+	* permission is granted.
+	*/
+	bridge(registration) {
+		return this.startBridge(registration, false);
+	}
+	/** Messages from the push service worker (`sp00ky:push` while visible, `sp00ky:navigate`, ...). */
+	onMessage(cb) {
+		const sw = this.globals().navigator?.serviceWorker;
+		if (!sw || typeof sw.addEventListener !== "function") return noop;
+		const handler = (event) => {
+			const data = event.data;
+			if (data && typeof data.type === "string" && data.type.startsWith("sp00ky:")) cb(data);
+		};
+		sw.addEventListener("message", handler);
+		return () => sw.removeEventListener("message", handler);
+	}
+	userId() {
+		const auth = this.deps.auth;
+		if (!auth.isAuthenticated || !auth.currentUser?.id) return null;
+		return recordIdString(auth.currentUser.id);
+	}
+	assertSignedIn() {
+		if (!this.userId()) throw new WebPushError("signed-out", "sign in first");
+	}
+	assertNotImpersonating() {
+		if (this.deps.auth.impersonation) throw new WebPushError("impersonating", "push notifications are not available while impersonating");
+	}
+	async call(sql, vars) {
+		try {
+			const [result] = await this.deps.remote.query(sql, vars);
+			return result;
+		} catch (error) {
+			throw new WebPushError("server", error instanceof Error ? error.message : String(error), error);
+		}
+	}
+	async listRaw() {
+		const rows = await this.call("RETURN fn::push::list()");
+		return Array.isArray(rows) ? rows : [];
+	}
+	async register(sub, options) {
+		const opts = dropUndefined({
+			label: options.label,
+			rules: options.rules && options.rules.length > 0 ? options.rules : void 0,
+			meta: options.meta,
+			userAgent: this.globals().navigator?.userAgent
+		});
+		return await this.call("RETURN fn::push::subscribe($sub, $opts)", {
+			sub: sub.toJSON(),
+			opts
+		}) ?? { endpoint: sub.endpoint };
+	}
+	async readStored() {
+		try {
+			const value = await this.deps.persistence.get(PUSH_ENDPOINT_KEY);
+			return value && typeof value.endpoint === "string" && typeof value.userId === "string" ? value : null;
+		} catch {
+			return null;
+		}
+	}
+	async writeStored(value) {
+		await this.deps.persistence.set(PUSH_ENDPOINT_KEY, dropUndefined({ ...value })).catch((error) => {
+			this.logger.debug({
+				error,
+				Category: "sp00ky-client::WebPush"
+			}, "Could not persist the push endpoint");
+		});
+	}
+	/** The page's registration: given, existing, registered from config, or `ready` within `waitMs`. */
+	async registration(given, waitMs) {
+		if (given) return given;
+		const sw = this.globals().navigator?.serviceWorker;
+		if (!sw) return null;
+		let reg = await sw.getRegistration().catch(() => void 0) ?? null;
+		if (!reg && this.config.serviceWorkerUrl) reg = await sw.register(this.config.serviceWorkerUrl).catch(() => null);
+		if (reg?.active) return reg;
+		return await withTimeout(sw.ready, waitMs, "service worker not ready").catch(() => null) ?? reg;
+	}
+	/** This browser's subscription, without waiting for a worker. */
+	async currentSubscription() {
+		try {
+			const sw = this.globals().navigator?.serviceWorker;
+			return await (sw ? await sw.getRegistration() : void 0)?.pushManager?.getSubscription() ?? null;
+		} catch {
+			return null;
+		}
+	}
+	async thisEndpoint() {
+		const sub = this.support().supported ? await this.currentSubscription() : null;
+		if (sub) return sub.endpoint;
+		const stored = await this.readStored();
+		return stored && stored.userId === this.userId() ? stored.endpoint : null;
+	}
+	async postToWorker(message, registration, wait = false) {
+		const sw = this.globals().navigator?.serviceWorker;
+		if (!sw) return;
+		let reg = registration;
+		if (!reg) reg = wait ? await sw.ready : await sw.getRegistration().catch(() => void 0);
+		(reg?.active ?? sw.controller)?.postMessage(message);
+	}
+	startBridge(registration, requirePermission) {
+		if (!this.globals().navigator?.serviceWorker || !this.deps.database.endpoint) return noop;
+		let last = null;
+		let disposed = false;
+		const post = () => {
+			if (disposed) return;
+			const auth = this.deps.auth;
+			const token = auth.token;
+			const userId = this.userId();
+			if (!token || !userId || auth.impersonation) return;
+			if (requirePermission && this.support().permission !== "granted") return;
+			if (token === last) return;
+			last = token;
+			this.tokenMessage(token, userId).then((message) => this.postToWorker(message, registration, true)).catch((error) => {
+				last = null;
+				this.logger.debug({
+					error,
+					Category: "sp00ky-client::WebPush::bridge"
+				}, "Could not post the session to the service worker");
+			});
+		};
+		const entry = { reset: () => {
+			last = null;
+			post();
+		} };
+		this.bridges.add(entry);
+		const off = this.deps.auth.subscribe(() => post());
+		return () => {
+			disposed = true;
+			off();
+			this.bridges.delete(entry);
+		};
+	}
+	refreshBridges() {
+		for (const b of this.bridges) b.reset();
+	}
+	async tokenMessage(token, userId) {
+		const stored = await this.readStored();
+		const { endpoint, namespace, database } = this.deps.database;
+		return dropUndefined({
+			type: "sp00ky:token",
+			token,
+			userId,
+			endpoint: endpoint ?? "",
+			namespace,
+			database,
+			publicKey: this.lastInfo?.publicKey ?? stored?.publicKey,
+			pushEndpoint: stored?.userId === userId ? stored.endpoint : void 0
+		});
+	}
+	/** Sign-out hook: tell the worker, and drop this device's row for the user. Bounded. */
+	async beforeSignOut(ctx) {
+		const tasks = [this.postToWorker({ type: "sp00ky:signout" }).catch(noop)];
+		if (this.config.unsubscribeOnSignOut !== false && !ctx.impersonating) {
+			const userId = this.userId();
+			const stored = await this.readStored();
+			if (userId && stored && stored.userId === userId) tasks.push(withTimeout(this.deps.remote.query("RETURN fn::push::unsubscribe($endpoint)", { endpoint: stored.endpoint }), SIGN_OUT_UNSUBSCRIBE_TIMEOUT_MS, "push unsubscribe timed out").catch((error) => this.logger.debug({
+				error,
+				Category: "sp00ky-client::WebPush::signOut"
+			}, "Could not remove the push subscription")).finally(() => this.deps.persistence.remove(PUSH_ENDPOINT_KEY).catch(noop)));
+		}
+		this.syncedFor = null;
+		await Promise.allSettled(tasks);
+	}
+};
+
 //#endregion
 //#region src/events/index.ts
 /**
@@ -1076,8 +1718,8 @@ function selfAllowlistedVariant(flag, userId) {
 
 //#endregion
 //#region src/modules/devtools/index.ts
-const CORE_VERSION = "0.0.1-canary.279";
-const WASM_VERSION = "0.0.1-canary.279";
+const CORE_VERSION = "0.0.1-canary.281";
+const WASM_VERSION = "0.0.1-canary.281";
 const SURREAL_VERSION = "3.0.3";
 var DevToolsService = class DevToolsService {
 	eventsHistory = [];
@@ -9932,6 +10574,8 @@ var ImpersonationTimers = class {
 
 //#endregion
 //#region src/modules/auth/index.ts
+/** Upper bound on the before-sign-out hooks, so a dead socket never holds a sign-out. */
+const SIGN_OUT_HOOK_TIMEOUT_MS = 2e3;
 function decodeAccessFromToken(token) {
 	return decodeTokenClaims(token).access;
 }
@@ -9948,6 +10592,7 @@ var AuthService = class {
 	access = null;
 	isLoading = true;
 	events = createAuthEventSystem();
+	signOutHooks = /* @__PURE__ */ new Set();
 	/** The impersonation last announced, for change detection. */
 	announcedImpersonation = null;
 	/** Target of an impersonation that just ended, until the client purges its
@@ -9997,6 +10642,38 @@ var AuthService = class {
 			this.events.unsubscribe(id);
 		};
 	}
+	/**
+	* Run `hook` at the start of every sign-out, while the token and the socket
+	* still belong to the leaving user (Web Push removes this device's
+	* subscription here). Hooks are best-effort: they run in parallel, errors
+	* are swallowed, and the sign-out goes on after
+	* {@link SIGN_OUT_HOOK_TIMEOUT_MS} whatever they are doing. Returns a disposer.
+	*/
+	onBeforeSignOut(hook) {
+		this.signOutHooks.add(hook);
+		return () => {
+			this.signOutHooks.delete(hook);
+		};
+	}
+	async runSignOutHooks() {
+		if (this.signOutHooks.size === 0 || !this.isAuthenticated) return;
+		const id = this.currentUser?.id;
+		const ctx = {
+			userId: id ? typeof id === "string" ? id : encodeRecordId(id) : null,
+			token: this.token,
+			impersonating: this.impersonation !== null
+		};
+		let timer;
+		const deadline = new Promise((resolve) => {
+			timer = setTimeout(resolve, SIGN_OUT_HOOK_TIMEOUT_MS);
+		});
+		const hooks = Promise.allSettled([...this.signOutHooks].map(async (hook) => hook(ctx)));
+		try {
+			await Promise.race([hooks, deadline]);
+		} finally {
+			clearTimeout(timer);
+		}
+	}
 	notifyListeners() {
 		const userId = this.currentUser?.id || null;
 		this.events.emit(AuthEventTypes.AuthStateChanged, userId);
@@ -10250,6 +10927,7 @@ var AuthService = class {
 	* impersonation and signs the admin out too.
 	*/
 	async signOut() {
+		await this.runSignOutHooks();
 		const impersonating = this.impersonation;
 		this.impersonationTimers.clear();
 		if (impersonating) {
@@ -12702,6 +13380,60 @@ function createBlobCache(opts) {
 	});
 }
 
+//#endregion
+//#region src/utils/sha256.ts
+/**
+* Lowercase hex SHA-256 of a UTF-8 string, through WebCrypto.
+*
+* Pure and dependency free so it can live in `@spooky-sync/core/pure` and run
+* in a service worker, a dedicated worker or Node (`globalThis.crypto` is
+* there on Node 19+). Query keys are `sha256Hex(JSON.stringify(..))`, see
+* `query/hash.ts`.
+*/
+async function sha256Hex(input) {
+	const bytes = new TextEncoder().encode(input);
+	const digest = await crypto.subtle.digest("SHA-256", bytes);
+	return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+//#endregion
+//#region src/utils/edges.ts
+/**
+* Reading `_00_list_ref` edges as a LIVE notification delivers them. Pure, so
+* both the full client and the wasm-free live feed (`@spooky-sync/core/live`)
+* decode the same wire shape the same way.
+*/
+/** The hash a `_00_list_ref` edge belongs to: the id part of its `in` (`_00_query:<hash>`). */
+function hashOfEdge(value) {
+	const inId = value?.in;
+	if (!inId) return null;
+	const str = inId instanceof RecordId$1 ? String(inId.id) : String(inId).replace(/^_00_query:/, "");
+	return str.length > 0 ? str : null;
+}
+/**
+* The row an edge notification carries, when the subscription joined it on.
+*
+* Without `FETCH out` the edge's `out` is a record id and there is nothing to
+* land, so this returns null and the caller falls back to fetching the body.
+* It also returns null for a row the session may not read (the join yields
+* `out: null`) and for an edge whose target has been deleted.
+*/
+function rowOfEdge(value) {
+	const edge = value;
+	const out = edge?.out;
+	if (!out || typeof out !== "object" || Array.isArray(out) || out instanceof RecordId$1) return null;
+	const rid = out.id;
+	if (!(rid instanceof RecordId$1)) return null;
+	const id = encodeRecordId(rid);
+	const version = typeof edge?.version === "number" ? edge.version : null;
+	if (version === null) return null;
+	return {
+		id,
+		version,
+		record: out
+	};
+}
+
 //#endregion
 //#region src/utils/blurhash.ts
 /**
@@ -12961,11 +13693,6 @@ function writeBootBucketHint(bucketId) {
 		if (typeof localStorage !== "undefined") localStorage.setItem(LAST_BUCKET_KEY, bucketId);
 	} catch {}
 }
-async function sha256Hex(input) {
-	const bytes = new TextEncoder().encode(input);
-	const digest = await crypto.subtle.digest("SHA-256", bytes);
-	return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
 function mintSalt() {
 	const c = globalThis.crypto;
 	if (c?.randomUUID) return c.randomUUID();
@@ -13025,7 +13752,7 @@ function createTabsCoordinator(config, s, host) {
 	return new TabsCoordinator({
 		tabId: s.tabId,
 		fingerprint: computeTabsFingerprint({
-			coreVersion: "0.0.1-canary.279",
+			coreVersion: "0.0.1-canary.281",
 			schemaHash: hash53(config.schemaSurql),
 			endpoint: config.database.endpoint ?? "",
 			namespace: config.database.namespace,
@@ -13123,36 +13850,6 @@ function leaderToRuntime(msg) {
 		default: return msg;
 	}
 }
-/** The hash a `_00_list_ref` edge belongs to: the id part of its `in` (`_00_query:<hash>`). */
-function hashOfEdge(value) {
-	const inId = value?.in;
-	if (!inId) return null;
-	const str = inId instanceof RecordId$1 ? String(inId.id) : String(inId).replace(/^_00_query:/, "");
-	return str.length > 0 ? str : null;
-}
-/**
-* The row an edge notification carries, when the subscription joined it on.
-*
-* Without `FETCH out` the edge's `out` is a record id and there is nothing to
-* land, so this returns null and the caller falls back to fetching the body.
-* It also returns null for a row the session may not read (the join yields
-* `out: null`) and for an edge whose target has been deleted.
-*/
-function rowOfEdge(value) {
-	const edge = value;
-	const out = edge?.out;
-	if (!out || typeof out !== "object" || Array.isArray(out) || out instanceof RecordId$1) return null;
-	const rid = out.id;
-	if (!(rid instanceof RecordId$1)) return null;
-	const id = encodeRecordId(rid);
-	const version = typeof edge?.version === "number" ? edge.version : null;
-	if (version === null) return null;
-	return {
-		id,
-		version,
-		record: out
-	};
-}
 /** Build the adapters the interpreter drives from the services. */
 function createAdapters(config, s, host, lateModules) {
 	const timers = /* @__PURE__ */ new Map();
@@ -13644,6 +14341,8 @@ const UNKNOWN_STORAGE_HEALTH = Object.freeze({
 var Sp00kyClient = class {
 	auth;
 	streamProcessor;
+	/** Web Push for this browser: subscribe, devices, self-pushes, service worker bridge. */
+	webPush;
 	services;
 	env;
 	runtime;
@@ -13714,6 +14413,16 @@ var Sp00kyClient = class {
 			auth: s.auth,
 			logger: s.logger
 		});
+		this.webPush = new WebPushModule({
+			remote: s.remote,
+			auth: s.auth,
+			persistence: s.persistence,
+			logger: s.logger,
+			database: config.database,
+			connection: s.connectionSupervisor,
+			config: config.webPush
+		});
+		this.disposers.push(this.webPush.attach());
 		this.devTools = new DevToolsService(s.local, s.remote, s.logger, config.schema, s.auth, {
 			getActiveQueries: () => [...this.runtime.state.queries.values()].map(toQueryState),
 			getQueryById: (id) => {
@@ -14061,4 +14770,4 @@ var Sp00kyClient = class {
 };
 
 //#endregion
-export { AppReleaseHandle, AppReleaseModule, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, BucketHandle, CURSOR_COLORS, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, FeatureFlagHandle, FeatureFlagModule, IMPERSONATION_ACCESS, ImpersonationTimers, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, ORIGIN_TOKEN_KEY, SESSION_POLL_MS, Sp00kyClient, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, renewDelayMs, sameImpersonation, semverGt, textToHtml };
+export { AppReleaseHandle, AppReleaseModule, AuthEventTypes, AuthService, BLURHASH_IMAGE_EXTENSIONS, BucketHandle, CURSOR_COLORS, CrdtField, CrdtManager, DEFAULT_LOCAL_OP_TIMEOUT_MS, FeatureFlagHandle, FeatureFlagModule, IMPERSONATION_ACCESS, ImpersonationTimers, LocalOpTimeoutError, MATERIALIZATION_SAMPLE_WINDOW, ORIGIN_TOKEN_KEY, PUSH_ENDPOINT_KEY, PUSH_PAYLOAD_VERSION, SESSION_POLL_MS, SIGN_OUT_HOOK_TIMEOUT_MS, Sp00kyClient, WebPushError, WebPushModule, blurhashSidecarPath, bucketContentToBlob, createAuthEventSystem, cursorColorFromName, decode as decodeBlurhash, decodeTokenClaims, detectWebPushSupport, encode as encodeBlurhash, encodeImageToBlurhash, fileToUint8Array, impersonationFromToken, isBlurhashValid, isImagePath, isPushPayload, renewDelayMs, sameImpersonation, semverGt, textToHtml };