@voltro/plugin-notifications 0.52.0 → 0.53.0

package/dist/index.js

@@ -1,18 +1,18 @@
-import { archiveDescriptor as e, clearQuietHoursDescriptor as t, inboxDescriptor as n, markAllReadDescriptor as r, markReadDescriptor as i, markUnreadDescriptor as a, notificationsRpcClientImports as o, preferencesDescriptor as s, setPreferenceDescriptor as c, setQuietHoursDescriptor as l, subscribeDescriptor as u, unarchiveDescriptor as ee, unreadCountDescriptor as te, unsubscribeDescriptor as ne } from "./rpc.js";
-import { Context as d, Effect as f, Layer as p, Schema as m } from "effect";
-import { and as h, boolean as g, eq as _, generateId as v, id as y, integer as b, isNotNull as re, isNull as x, json as S, lte as C, registerRetention as w, retentionTtlMsFromEnv as T, table as E, text as D, timestamp as O } from "@voltro/database";
-import { definePlugin as ie, pluginInstanceName as ae } from "@voltro/protocol";
-import { randomUUID as k } from "node:crypto";
+import { archiveDescriptor as e, clearQuietHoursDescriptor as t, inboxDescriptor as n, markAllReadDescriptor as r, markReadDescriptor as i, markUnreadDescriptor as a, notificationsRpcClientImports as o, preferencesDescriptor as s, setPreferenceDescriptor as c, setQuietHoursDescriptor as l, subscribeDescriptor as u, unarchiveDescriptor as d, unreadCountDescriptor as f, unsubscribeDescriptor as p, webPushPublicKeyDescriptor as m, webPushRpcClientImports as ee, webPushStatusDescriptor as te, webPushSubscribeDescriptor as ne, webPushUnsubscribeDescriptor as re } from "./rpc.js";
+import { Context as h, Effect as g, Layer as ie, Schema as _ } from "effect";
+import { and as v, boolean as y, eq as b, generateId as x, id as S, integer as C, isNotNull as ae, isNull as w, json as T, lte as E, registerRetention as D, retentionTtlMsFromEnv as O, table as k, text as A, timestamp as j } from "@voltro/database";
+import { definePlugin as oe, pluginInstanceName as se } from "@voltro/protocol";
+import { createCipheriv as M, createDecipheriv as ce, createECDH as N, createHash as le, createHmac as ue, createPrivateKey as de, randomBytes as fe, randomUUID as P, sign as pe, timingSafeEqual as me } from "node:crypto";
 //#region src/errors.ts
-var A = class extends m.TaggedError()("PushTokenRejected", {
-	token: m.String,
-	reason: m.String
-}) {}, j = () => ({
+var F = class extends _.TaggedError()("PushTokenRejected", {
+	token: _.String,
+	reason: _.String
+}) {}, I = () => ({
 	id: "console",
 	deliver: async (e) => {
 		process.stdout.write(`[notify:${e.category}] → ${e.to}: ${e.title} — ${e.body}\n`);
 	}
-}), oe = (e) => ({
+}), he = (e) => ({
 	id: e.id ?? "slack",
 	deliver: async (t) => {
 		let n = e.format ? e.format(t) : { text: `*${t.title}*\n${t.body}` }, r = await fetch(e.url, {
@@ -25,7 +25,7 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 		});
 		if (!r.ok) throw Error(`webhook ${e.id ?? "slack"} POST ${r.status}`);
 	}
-}), M = (e) => ({
+}), ge = (e) => ({
 	id: "email",
 	deliver: (t) => e({
 		to: t.to,
@@ -33,38 +33,58 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 		html: `<p>${t.body}</p>`,
 		text: t.body
 	})
-}), N = (e) => ({
+}), _e = (e) => ({
 	id: "sms",
 	deliver: (t) => e(t.to, `${t.title}: ${t.body}`)
-}), P = (e, t) => ({
+}), ve = (e, t) => ({
 	id: e,
 	deliver: t
-}), se = (e) => ({
-	id: e.id ?? "push",
-	deliver: async (t) => {
-		let n = await e.tokensFor(t.to), r = t.data?.badge, i = typeof r == "number" ? r : void 0;
-		for (let r of n) {
-			let n = {
-				token: r,
-				title: t.title,
-				body: t.body,
-				...i === void 0 ? {} : { badge: i },
-				data: t.data ?? {}
+}), ye = (e) => {
+	let t = async (t, n, r) => {
+		let i = {
+			token: n,
+			title: t.title,
+			body: t.body,
+			...r === void 0 ? {} : { badge: r },
+			data: t.data ?? {}
+		};
+		try {
+			return await e.transport(i), {
+				endpoint: n,
+				status: "sent"
+			};
+		} catch (t) {
+			let r = t instanceof F, i = r ? t.reason : t instanceof Error ? t.message : String(t);
+			if (r && e.onTokenRejected !== void 0) try {
+				await e.onTokenRejected(n, i);
+			} catch {}
+			return {
+				endpoint: n,
+				status: "failed",
+				error: i,
+				...r ? { pruned: e.onTokenRejected !== void 0 } : {}
 			};
-			try {
-				await e.transport(n);
-			} catch (e) {
-				throw e instanceof A ? e : new A({
-					token: r,
-					reason: e instanceof Error ? e.message : String(e)
-				});
-			}
 		}
-	}
-}), F = (e, t, n, r, i) => {
+	}, n = async (n) => {
+		let r = await e.tokensFor(n.to), i = n.data?.badge, a = typeof i == "number" ? i : void 0, o = [];
+		for (let e of r) o.push(await t(n, e, a));
+		return o;
+	};
+	return {
+		id: e.id ?? "push",
+		deliver: async (e) => {
+			let t = await n(e), r = t.filter((e) => e.status === "failed");
+			if (t.length > 0 && r.length === t.length) throw new F({
+				token: t[0].endpoint,
+				reason: r[0].error ?? "all tokens rejected"
+			});
+		},
+		deliverDetailed: n
+	};
+}, L = (e, t, n, r, i) => {
 	let a = n ? e.filter((e) => n.includes(e)) : [...e], o = new Set(r.filter((e) => e.subjectId === i && e.category === t && e.enabled === !1).map((e) => e.channel));
 	return a.filter((e) => !o.has(e));
-}, I = () => {
+}, R = () => {
 	let e = [], t = /* @__PURE__ */ new Map(), n = [], r = /* @__PURE__ */ new Map(), i = /* @__PURE__ */ new Map(), a = [], o = (e) => `${e.subjectId}|${e.category}|${e.channel}`, s = (e, t) => `${e}|${t}`;
 	return {
 		addInbox: async (t) => {
@@ -121,6 +141,13 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 			n.unshift(e);
 		},
 		listDeliveries: async (e) => e?.limit === void 0 ? [...n] : n.slice(0, e.limit),
+		markClicked: async (e) => {
+			let t = n.findIndex((t) => t.clickToken === e);
+			return t !== -1 && (n[t] = {
+				...n[t],
+				clickedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}, !0);
+		},
 		subscribeTopic: async (e) => {
 			r.set(s(e.topic, e.subjectId), e);
 		},
@@ -145,7 +172,7 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 			for (let e = a.length - 1; e >= 0; e--) t.has(a[e].id) && a.splice(e, 1);
 		}
 	};
-}, L = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : "", R = (e) => {
+}, z = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : "", be = (e) => {
 	let t = async (t, n, r, i) => await e.query({
 		table: t,
 		predicate: n,
@@ -160,29 +187,27 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 		title: String(e.title),
 		body: String(e.body),
 		data: e.data ?? {},
-		readAt: e.readAt == null ? null : L(e.readAt),
-		archivedAt: e.archivedAt == null ? null : L(e.archivedAt),
-		createdAt: L(e.createdAt),
+		readAt: e.readAt == null ? null : z(e.readAt),
+		archivedAt: e.archivedAt == null ? null : z(e.archivedAt),
+		createdAt: z(e.createdAt),
 		tenantId: e.tenantId ?? null
 	}), r = (e) => ({
 		subjectId: String(e.subjectId),
 		category: String(e.category),
 		channel: String(e.channel),
 		enabled: !!e.enabled
-	}), i = (e) => {
-		let t = {
-			id: String(e.id),
-			to: String(e.recipient),
-			category: String(e.category),
-			channel: String(e.channel),
-			status: e.status,
-			at: L(e.at)
-		};
-		return e.error == null ? t : {
-			...t,
-			error: String(e.error)
-		};
-	}, a = (e) => ({
+	}), i = (e) => ({
+		id: String(e.id),
+		to: String(e.recipient),
+		category: String(e.category),
+		channel: String(e.channel),
+		status: e.status,
+		at: z(e.at),
+		...e.error == null ? {} : { error: String(e.error) },
+		...e.endpoint == null ? {} : { endpoint: String(e.endpoint) },
+		...e.clickToken == null ? {} : { clickToken: String(e.clickToken) },
+		...e.clickedAt == null ? {} : { clickedAt: z(e.clickedAt) }
+	}), a = (e) => ({
 		topic: String(e.topic),
 		subjectId: String(e.subjectId),
 		tenantId: e.tenantId ?? null
@@ -197,7 +222,7 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 		kind: e.kind === "quiet" ? "quiet" : "digest",
 		subjectId: String(e.subjectId),
 		send: e.send ?? {},
-		flushAt: L(e.flushAt)
+		flushAt: z(e.flushAt)
 	});
 	return {
 		addInbox: async (t) => {
@@ -215,24 +240,24 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 			});
 		},
 		listInbox: async (e, r) => {
-			let i = r?.unreadOnly ? h(_("subjectId", e), x("readAt")) : _("subjectId", e);
+			let i = r?.unreadOnly ? v(b("subjectId", e), w("readAt")) : b("subjectId", e);
 			return (await t("_voltro_notification_inbox", i, [{
 				column: "createdAt",
 				direction: "desc"
 			}], r?.limit)).map(n);
 		},
-		markRead: async (n, r) => (await t("_voltro_notification_inbox", h(_("id", n), _("subjectId", r)), [], 1))[0] ? (await e.update("_voltro_notification_inbox", n, { readAt: (/* @__PURE__ */ new Date()).toISOString() }), !0) : !1,
-		markUnread: async (n, r) => (await t("_voltro_notification_inbox", h(_("id", n), _("subjectId", r)), [], 1))[0] ? (await e.update("_voltro_notification_inbox", n, { readAt: null }), !0) : !1,
+		markRead: async (n, r) => (await t("_voltro_notification_inbox", v(b("id", n), b("subjectId", r)), [], 1))[0] ? (await e.update("_voltro_notification_inbox", n, { readAt: (/* @__PURE__ */ new Date()).toISOString() }), !0) : !1,
+		markUnread: async (n, r) => (await t("_voltro_notification_inbox", v(b("id", n), b("subjectId", r)), [], 1))[0] ? (await e.update("_voltro_notification_inbox", n, { readAt: null }), !0) : !1,
 		markAllRead: async (n) => {
-			let r = await t("_voltro_notification_inbox", h(_("subjectId", n), x("readAt")), [], void 0), i = (/* @__PURE__ */ new Date()).toISOString();
+			let r = await t("_voltro_notification_inbox", v(b("subjectId", n), w("readAt")), [], void 0), i = (/* @__PURE__ */ new Date()).toISOString();
 			for (let t of r) await e.update("_voltro_notification_inbox", String(t.id), { readAt: i });
 			return r.length;
 		},
-		setArchived: async (n, r, i) => (await t("_voltro_notification_inbox", h(_("id", n), _("subjectId", r)), [], 1))[0] ? (await e.update("_voltro_notification_inbox", n, { archivedAt: i ? (/* @__PURE__ */ new Date()).toISOString() : null }), !0) : !1,
-		unreadCount: async (e) => (await t("_voltro_notification_inbox", h(_("subjectId", e), x("readAt")), [], void 0)).length,
-		getPreferences: async (e) => (await t("_voltro_notification_preferences", _("subjectId", e), [], void 0)).map(r),
+		setArchived: async (n, r, i) => (await t("_voltro_notification_inbox", v(b("id", n), b("subjectId", r)), [], 1))[0] ? (await e.update("_voltro_notification_inbox", n, { archivedAt: i ? (/* @__PURE__ */ new Date()).toISOString() : null }), !0) : !1,
+		unreadCount: async (e) => (await t("_voltro_notification_inbox", v(b("subjectId", e), w("readAt")), [], void 0)).length,
+		getPreferences: async (e) => (await t("_voltro_notification_preferences", b("subjectId", e), [], void 0)).map(r),
 		setPreference: async (t) => {
-			let n = v({
+			let n = x({
 				kind: "typeid",
 				prefix: "notifpref"
 			}, "_voltro_notification_preferences");
@@ -259,15 +284,22 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 				channel: t.channel,
 				status: t.status,
 				error: t.error ?? null,
-				at: t.at
+				at: t.at,
+				endpoint: t.endpoint ?? null,
+				clickToken: t.clickToken ?? null,
+				clickedAt: t.clickedAt ?? null
 			});
 		},
+		markClicked: async (n) => {
+			let r = await t("_voltro_notification_deliveries", b("clickToken", n), [], 1);
+			return r[0] ? (await e.update("_voltro_notification_deliveries", String(r[0].id), { clickedAt: (/* @__PURE__ */ new Date()).toISOString() }), !0) : !1;
+		},
 		listDeliveries: async (e) => (await t("_voltro_notification_deliveries", void 0, [{
 			column: "at",
 			direction: "desc"
 		}], e?.limit)).map(i),
 		subscribeTopic: async (t) => {
-			let n = v({
+			let n = x({
 				kind: "typeid",
 				prefix: "notiftsub"
 			}, "_voltro_notification_topic_subscriptions");
@@ -282,16 +314,16 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 			});
 		},
 		unsubscribeTopic: async (n, r) => {
-			let i = await t("_voltro_notification_topic_subscriptions", h(_("topic", n), _("subjectId", r)), [], 1);
+			let i = await t("_voltro_notification_topic_subscriptions", v(b("topic", n), b("subjectId", r)), [], 1);
 			i[0] && await e.delete("_voltro_notification_topic_subscriptions", String(i[0].id));
 		},
-		listTopicSubscribers: async (e) => (await t("_voltro_notification_topic_subscriptions", _("topic", e), [], void 0)).map(a),
+		listTopicSubscribers: async (e) => (await t("_voltro_notification_topic_subscriptions", b("topic", e), [], void 0)).map(a),
 		getQuietHours: async (e) => {
-			let n = await t("_voltro_notification_quiet_hours", _("subjectId", e), [], 1);
+			let n = await t("_voltro_notification_quiet_hours", b("subjectId", e), [], 1);
 			return n[0] ? o(n[0]) : null;
 		},
 		setQuietHours: async (t) => {
-			let n = v({
+			let n = x({
 				kind: "typeid",
 				prefix: "notifqh"
 			}, "_voltro_notification_quiet_hours");
@@ -313,7 +345,7 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 			});
 		},
 		clearQuietHours: async (n) => {
-			let r = await t("_voltro_notification_quiet_hours", _("subjectId", n), [], 1);
+			let r = await t("_voltro_notification_quiet_hours", b("subjectId", n), [], 1);
 			r[0] && await e.delete("_voltro_notification_quiet_hours", String(r[0].id));
 		},
 		enqueueHeld: async (t) => {
@@ -325,11 +357,11 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 				flushAt: t.flushAt
 			});
 		},
-		pendingDigest: async (e) => (await t("_voltro_notification_held", h(_("kind", "digest"), _("subjectId", e)), [{
+		pendingDigest: async (e) => (await t("_voltro_notification_held", v(b("kind", "digest"), b("subjectId", e)), [{
 			column: "flushAt",
 			direction: "asc"
 		}], void 0)).map(s),
-		dueHeld: async (e) => (await t("_voltro_notification_held", C("flushAt", e), [{
+		dueHeld: async (e) => (await t("_voltro_notification_held", E("flushAt", e), [{
 			column: "flushAt",
 			direction: "asc"
 		}], void 0)).map(s),
@@ -337,11 +369,11 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 			for (let n of t) await e.delete("_voltro_notification_held", n);
 		}
 	};
-}, z = (e) => ({
+}, xe = (e) => ({
 	id: "inApp",
 	deliver: async (t) => {
 		await e.addInbox({
-			id: k(),
+			id: P(),
 			subjectId: t.to,
 			category: t.category,
 			title: t.title,
@@ -363,16 +395,16 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 	} catch {
 		return e.getUTCHours() * 60 + e.getUTCMinutes();
 	}
-}, V = (e, t) => {
+}, Se = (e, t) => {
 	if (e.startMinute === e.endMinute) return !1;
 	let n = B(t, e.tz ?? "UTC");
 	return e.startMinute < e.endMinute ? n >= e.startMinute && n < e.endMinute : n >= e.startMinute || n < e.endMinute;
-}, H = (e, t) => {
+}, Ce = (e, t) => {
 	let n = B(t, e.tz ?? "UTC"), r = e.endMinute - n;
 	return r <= 0 && (r += 1440), new Date(t.getTime() + r * 6e4);
-}, U = (e) => {
+}, we = (e) => {
 	let t = new Map(e.channels.map((e) => [e.id, e])), n = e.channels.map((e) => e.id), r = e.now ?? (() => (/* @__PURE__ */ new Date()).toISOString()), i = e.digestWindowMs ?? 0, a = async (i) => {
-		let a = await e.store.getPreferences(i.to), o = F(n, i.category, i.channels, a, i.to), s = n.filter((e) => !o.includes(e)), c = [], l = [], u = {
+		let a = await e.store.getPreferences(i.to), o = L(n, i.category, i.channels, a, i.to), s = n.filter((e) => !o.includes(e)), c = [], l = [], u = {
 			to: i.to,
 			category: i.category,
 			title: i.title,
@@ -383,8 +415,44 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 		for (let n of o) {
 			let a = t.get(n);
 			if (!a) continue;
+			if (a.deliverDetailed !== void 0) {
+				try {
+					let t = await a.deliverDetailed(u);
+					for (let a of t) await e.store.recordDelivery({
+						id: P(),
+						to: i.to,
+						category: i.category,
+						channel: n,
+						at: r(),
+						status: a.status,
+						endpoint: a.endpoint,
+						...a.error === void 0 ? {} : { error: a.error },
+						...a.clickToken === void 0 ? {} : { clickToken: a.clickToken }
+					});
+					let o = t.filter((e) => e.status === "failed");
+					t.length === 0 || o.length < t.length ? c.push(n) : l.push({
+						channel: n,
+						error: o[0]?.error ?? "all endpoints failed"
+					});
+				} catch (t) {
+					let a = t instanceof Error ? t.message : String(t);
+					l.push({
+						channel: n,
+						error: a
+					}), await e.store.recordDelivery({
+						id: P(),
+						to: i.to,
+						category: i.category,
+						channel: n,
+						at: r(),
+						status: "failed",
+						error: a
+					});
+				}
+				continue;
+			}
 			let o = {
-				id: k(),
+				id: P(),
 				to: i.to,
 				category: i.category,
 				channel: n,
@@ -414,17 +482,17 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 		};
 	}, o = async (t) => {
 		let n = await e.store.getQuietHours(t.to), o = new Date(r());
-		if (n && V(n, o)) return (n.policy ?? "hold") === "drop" ? {
+		if (n && Se(n, o)) return (n.policy ?? "hold") === "drop" ? {
 			delivered: [],
 			failed: [],
 			skipped: [],
 			held: "quiet-drop"
 		} : (await e.store.enqueueHeld({
-			id: k(),
+			id: P(),
 			kind: "quiet",
 			subjectId: t.to,
 			send: t,
-			flushAt: H(n, o).toISOString()
+			flushAt: Ce(n, o).toISOString()
 		}), {
 			delivered: [],
 			failed: [],
@@ -434,7 +502,7 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 		if (i > 0 && !t.channels) {
 			let n = (await e.store.pendingDigest(t.to))[0]?.flushAt ?? new Date(o.getTime() + i).toISOString();
 			return await e.store.enqueueHeld({
-				id: k(),
+				id: P(),
 				kind: "digest",
 				subjectId: t.to,
 				send: t,
@@ -488,11 +556,11 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 				let t = i.get(e.subjectId) ?? [];
 				t.push(e), i.set(e.subjectId, t);
 			}
-			for (let [e, t] of i) await a(W(e, t));
+			for (let [e, t] of i) await a(Te(e, t));
 			return await e.store.clearHeld(n.map((e) => e.id)), n.length;
 		}
 	};
-}, W = (e, t) => {
+}, Te = (e, t) => {
 	if (t.length === 1) return t[0].send;
 	let n = t.map((e) => ({
 		category: e.send.category,
@@ -507,159 +575,423 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 		data: { items: n },
 		tenantId: t[0].send.tenantId ?? null
 	};
-}, G = E("_voltro_notification_inbox", {
-	id: y({ prefix: "notif" }),
-	subjectId: D(),
-	category: D(),
-	title: D(),
-	body: D(),
-	data: S(),
-	readAt: O().nullable(),
-	archivedAt: O().nullable(),
-	createdAt: O().default("now"),
-	tenantId: D().nullable()
-}).renamedFrom("notification_inbox").index("byInboxSubject", ["subjectId"]).index("byInboxSubjectCreatedAt", ["subjectId", "createdAt"]).index("byInboxSubjectUnread", ["subjectId"], { where: "\"readAt\" IS NULL" }), K = E("_voltro_notification_preferences", {
-	id: y({ prefix: "notifpref" }),
-	subjectId: D(),
-	category: D(),
-	channel: D(),
-	enabled: g().default(!0)
+}, V = (e) => e.toString("base64url"), H = (e) => Buffer.from(e, "base64url"), U = (e, t) => ue("sha256", e).update(t).digest(), W = (e, t, n) => U(e, Buffer.concat([t, Buffer.from([1])])).subarray(0, n), Ee = () => {
+	let e = N("prime256v1");
+	return e.generateKeys(), V(e.getPrivateKey());
+}, G = (e) => {
+	let t = H(e);
+	if (t.length !== 32) throw Error(`VOLTRO_VAPID_PRIVATE_KEY must be a base64url 32-byte P-256 scalar (got ${t.length} bytes)`);
+	let n = N("prime256v1");
+	return n.setPrivateKey(t), V(n.getPublicKey());
+}, De = (e) => {
+	let t = H(e), n = N("prime256v1");
+	n.setPrivateKey(t);
+	let r = n.getPublicKey();
+	return de({
+		key: {
+			kty: "EC",
+			crv: "P-256",
+			d: V(t),
+			x: V(r.subarray(1, 33)),
+			y: V(r.subarray(33, 65))
+		},
+		format: "jwk"
+	});
+}, K = (e, t, n, r = Date.now()) => {
+	let i = new URL(e), a = {
+		aud: `${i.protocol}//${i.host}`,
+		exp: Math.floor(r / 1e3) + 43200,
+		...n === void 0 ? {} : { sub: n }
+	}, o = `${V(Buffer.from(JSON.stringify({
+		typ: "JWT",
+		alg: "ES256"
+	})))}.${V(Buffer.from(JSON.stringify(a)))}`;
+	return `vapid t=${o}.${V(pe("sha256", Buffer.from(o), {
+		key: De(t),
+		dsaEncoding: "ieee-p1363"
+	}))}, k=${G(t)}`;
+}, Oe = Buffer.from("WebPush: info\0"), ke = Buffer.from("Content-Encoding: aes128gcm\0"), Ae = Buffer.from("Content-Encoding: nonce\0"), je = 4096, Me = (e, t, n = {}) => {
+	let r = H(e.p256dh), i = H(e.auth);
+	if (r.length !== 65 || r[0] !== 4) throw Error("push subscription p256dh must be a 65-byte uncompressed P-256 point");
+	if (i.length !== 16) throw Error("push subscription auth must be 16 bytes");
+	let a = N("prime256v1");
+	n.asPrivate ? a.setPrivateKey(n.asPrivate) : a.generateKeys();
+	let o = a.getPublicKey(), s = W(U(i, a.computeSecret(r)), Buffer.concat([
+		Oe,
+		r,
+		o
+	]), 32), c = n.salt ?? fe(16), l = U(c, s), u = W(l, ke, 16), d = W(l, Ae, 12), f = M("aes-128-gcm", u, d), p = Buffer.concat([
+		f.update(Buffer.concat([t, Buffer.from([2])])),
+		f.final(),
+		f.getAuthTag()
+	]), m = Buffer.alloc(21);
+	return c.copy(m, 0), m.writeUInt32BE(je, 16), m.writeUInt8(o.length, 20), Buffer.concat([
+		m,
+		o,
+		p
+	]);
+}, Ne = (e, t) => {
+	let n = e.subarray(0, 16), r = e.readUInt8(20), i = e.subarray(21, 21 + r), a = e.subarray(21 + r), o = N("prime256v1");
+	o.setPrivateKey(t.uaPrivate);
+	let s = o.getPublicKey(), c = o.computeSecret(i), l = U(n, W(U(t.authSecret, c), Buffer.concat([
+		Oe,
+		s,
+		i
+	]), 32)), u = W(l, ke, 16), d = W(l, Ae, 12), f = ce("aes-128-gcm", u, d);
+	f.setAuthTag(a.subarray(a.length - 16));
+	let p = Buffer.concat([f.update(a.subarray(0, a.length - 16)), f.final()]), m = p.length - 1;
+	for (; m >= 0 && p[m] === 0;) m--;
+	if (p[m] !== 2) throw Error("web-push record missing the last-record delimiter");
+	return p.subarray(0, m);
+}, Pe = async (e, t, n) => {
+	let r = Me(e.keys, t), i = n.fetchImpl ?? fetch, a;
+	try {
+		a = await i(e.endpoint, {
+			method: "POST",
+			headers: {
+				"content-encoding": "aes128gcm",
+				"content-type": "application/octet-stream",
+				ttl: String(n.ttl ?? 86400),
+				urgency: "normal",
+				authorization: K(e.endpoint, n.privateKey, n.contact)
+			},
+			body: new Uint8Array(r)
+		});
+	} catch (e) {
+		return {
+			kind: "failed",
+			status: 0,
+			detail: e instanceof Error ? e.message : String(e)
+		};
+	}
+	if (a.status === 404 || a.status === 410) return {
+		kind: "gone",
+		status: a.status
+	};
+	if (a.status >= 200 && a.status < 300) return {
+		kind: "delivered",
+		status: a.status
+	};
+	let o = await a.text().catch(() => "");
+	return {
+		kind: "failed",
+		status: a.status,
+		detail: o.slice(0, 200)
+	};
+}, Fe = (e, t) => {
+	let n = Buffer.from(e), r = Buffer.from(t);
+	return n.length === r.length && me(n, r);
+}, Ie = k("_voltro_notification_push_subscriptions", {
+	id: S({ prefix: "notifpush" }),
+	subjectId: A(),
+	endpointHash: A(),
+	endpoint: A(),
+	p256dh: A(),
+	auth: A(),
+	ua: A().nullable(),
+	createdAt: j().default("now"),
+	tenantId: A().nullable()
+}).unique("byPushEndpointHash", ["endpointHash"]).index("byPushSubject", ["subjectId"]), q = (e) => le("sha256").update(e).digest("hex"), J = () => {
+	let e = /* @__PURE__ */ new Map();
+	return {
+		upsert: async (t) => {
+			e.set(t.endpointHash, t);
+		},
+		listForSubject: async (t) => [...e.values()].filter((e) => e.subjectId === t),
+		removeForSubject: async (t, n) => {
+			let r = e.get(t);
+			return !r || r.subjectId !== n ? !1 : (e.delete(t), !0);
+		},
+		removeByHash: async (t) => {
+			e.delete(t);
+		},
+		countForSubject: async (t) => [...e.values()].filter((e) => e.subjectId === t).length
+	};
+}, Y = "_voltro_notification_push_subscriptions", Le = (e) => {
+	let t = async (t, n) => e.query({
+		table: Y,
+		predicate: t,
+		order: [],
+		take: n,
+		skip: void 0,
+		projection: void 0
+	}), n = (e) => ({
+		subjectId: String(e.subjectId),
+		endpoint: String(e.endpoint),
+		endpointHash: String(e.endpointHash),
+		p256dh: String(e.p256dh),
+		auth: String(e.auth),
+		ua: e.ua == null ? null : String(e.ua),
+		tenantId: e.tenantId == null ? null : String(e.tenantId)
+	});
+	return {
+		upsert: async (t) => {
+			let n = x({
+				kind: "typeid",
+				prefix: "notifpush"
+			}, Y);
+			await e.upsert(Y, {
+				id: n,
+				subjectId: t.subjectId,
+				endpointHash: t.endpointHash,
+				endpoint: t.endpoint,
+				p256dh: t.p256dh,
+				auth: t.auth,
+				ua: t.ua,
+				tenantId: t.tenantId
+			}, {
+				conflictColumns: ["endpointHash"],
+				update: [
+					"subjectId",
+					"p256dh",
+					"auth",
+					"ua",
+					"tenantId"
+				]
+			});
+		},
+		listForSubject: async (e) => (await t(b("subjectId", e))).map(n),
+		removeForSubject: async (n, r) => {
+			let i = await t(v(b("endpointHash", n), b("subjectId", r)), 1);
+			return i[0] ? (await e.delete(Y, String(i[0].id)), !0) : !1;
+		},
+		removeByHash: async (n) => {
+			let r = await t(b("endpointHash", n), 1);
+			r[0] && await e.delete(Y, String(r[0].id));
+		},
+		countForSubject: async (e) => (await t(b("subjectId", e))).length
+	};
+}, Re = Symbol.for("@voltro/plugin-notifications:web-push"), X = () => {
+	let e = globalThis;
+	return e[Re] ??= {
+		store: J(),
+		bound: !1
+	};
+}, ze = (e) => {
+	let t = X();
+	t.store = Le(e), t.bound = !0;
+}, Be = () => {
+	let e = X();
+	e.store = J(), e.bound = !1;
+}, Z = (e) => {
+	let t = e ?? process.env.VOLTRO_VAPID_PRIVATE_KEY;
+	if (t === void 0 || t.trim() === "") throw Error("web push needs VOLTRO_VAPID_PRIVATE_KEY (a base64url P-256 scalar). `voltro dev` mints one into .env.local; for production generate one and set it in the deployment environment. There is deliberately no default.");
+	return t;
+}, Q = 3800, Ve = (e, t) => {
+	let n = typeof e.data?.url == "string" ? e.data.url : void 0, r = {
+		title: e.title,
+		body: e.body,
+		category: e.category,
+		clickToken: t,
+		...n === void 0 ? {} : { url: n },
+		...e.data === void 0 ? {} : { data: e.data }
+	}, i = Buffer.from(JSON.stringify(r));
+	if (i.length <= Q) return i;
+	let { data: a, ...o } = r;
+	if (i = Buffer.from(JSON.stringify(o)), i.length <= Q) return i;
+	let s = i.length - Buffer.byteLength(o.body), c = Math.max(0, Q - s - Buffer.byteLength("…")), l = Buffer.from(o.body).subarray(0, c).toString("utf8").replace(/�+$/u, "");
+	return Buffer.from(JSON.stringify({
+		...o,
+		body: `${l}…`
+	}));
+}, He = (e = {}) => (X().channelOptions = e, We(e)), Ue = () => {
+	let e = X().channelOptions;
+	G(Z(e?.privateKey));
+}, We = (e) => ({
+	id: e.id ?? "webPush",
+	deliver: async (t) => {
+		let n = await Ge(t, e), r = n.filter((e) => e.status === "failed");
+		if (n.length > 0 && r.length === n.length) throw Error(`web push failed for all ${r.length} endpoint(s): ${r[0].error ?? "unknown"}`);
+	},
+	deliverDetailed: (t) => Ge(t, e)
+}), Ge = async (e, t) => {
+	let n = Z(t.privateKey), r = await X().store.listForSubject(e.to), i = [];
+	for (let a of r) {
+		let r = fe(16).toString("base64url"), o = {
+			privateKey: n,
+			...t.contact === void 0 ? {} : { contact: t.contact },
+			...t.ttl === void 0 ? {} : { ttl: t.ttl },
+			...t.fetchImpl === void 0 ? {} : { fetchImpl: t.fetchImpl }
+		}, s = await Pe({
+			endpoint: a.endpoint,
+			keys: {
+				p256dh: a.p256dh,
+				auth: a.auth
+			}
+		}, Ve(e, r), o);
+		s.kind === "delivered" ? i.push({
+			endpoint: a.endpoint,
+			status: "sent",
+			clickToken: r
+		}) : s.kind === "gone" ? (await X().store.removeByHash(a.endpointHash), i.push({
+			endpoint: a.endpoint,
+			status: "failed",
+			error: `endpoint gone (${s.status}) — pruned`,
+			pruned: !0
+		})) : i.push({
+			endpoint: a.endpoint,
+			status: "failed",
+			error: `${s.status}: ${s.detail}`
+		});
+	}
+	return i;
+}, Ke = (e) => G(Z(e)), qe = k("_voltro_notification_inbox", {
+	id: S({ prefix: "notif" }),
+	subjectId: A(),
+	category: A(),
+	title: A(),
+	body: A(),
+	data: T(),
+	readAt: j().nullable(),
+	archivedAt: j().nullable(),
+	createdAt: j().default("now"),
+	tenantId: A().nullable()
+}).renamedFrom("notification_inbox").index("byInboxSubject", ["subjectId"]).index("byInboxSubjectCreatedAt", ["subjectId", "createdAt"]).index("byInboxSubjectUnread", ["subjectId"], { where: "\"readAt\" IS NULL" }), Je = k("_voltro_notification_preferences", {
+	id: S({ prefix: "notifpref" }),
+	subjectId: A(),
+	category: A(),
+	channel: A(),
+	enabled: y().default(!0)
 }).renamedFrom("notification_preferences").unique("byPreferencesSubjectCategoryChannel", [
 	"subjectId",
 	"category",
 	"channel"
-]), q = E("_voltro_notification_deliveries", {
-	id: y({ prefix: "notifdlv" }),
-	recipient: D(),
-	category: D(),
-	channel: D(),
-	status: D(),
-	error: D().nullable(),
-	at: O().default("now")
-}).renamedFrom("notification_deliveries").index("byDeliveriesAt", ["at"]), J = E("_voltro_notification_topic_subscriptions", {
-	id: y({ prefix: "notiftsub" }),
-	topic: D(),
-	subjectId: D(),
-	tenantId: D().nullable()
-}).renamedFrom("notification_topic_subscriptions").unique("byTopicSubject", ["topic", "subjectId"]).index("byTopic", ["topic"]), Y = E("_voltro_notification_quiet_hours", {
-	id: y({ prefix: "notifqh" }),
-	subjectId: D(),
-	startMinute: b(),
-	endMinute: b(),
-	tz: D().default("UTC"),
-	policy: D().default("hold")
-}).renamedFrom("notification_quiet_hours").unique("byQuietHoursSubject", ["subjectId"]), X = E("_voltro_notification_held", {
-	id: y({ prefix: "notifheld" }),
-	kind: D(),
-	subjectId: D(),
-	send: S(),
-	flushAt: O()
-}).renamedFrom("notification_held").index("byHeldFlushAt", ["flushAt"]).index("byHeldSubjectKind", ["subjectId", "kind"]), Z = class extends d.Tag("@voltro/plugin-notifications/NotificationService")() {}, Q = (e) => async (t) => {
+]), Ye = k("_voltro_notification_deliveries", {
+	id: S({ prefix: "notifdlv" }),
+	recipient: A(),
+	category: A(),
+	channel: A(),
+	status: A(),
+	error: A().nullable(),
+	at: j().default("now"),
+	endpoint: A().nullable(),
+	clickToken: A().nullable(),
+	clickedAt: j().nullable()
+}).renamedFrom("notification_deliveries").index("byDeliveriesAt", ["at"]).index("byDeliveriesClickToken", ["clickToken"]), Xe = k("_voltro_notification_topic_subscriptions", {
+	id: S({ prefix: "notiftsub" }),
+	topic: A(),
+	subjectId: A(),
+	tenantId: A().nullable()
+}).renamedFrom("notification_topic_subscriptions").unique("byTopicSubject", ["topic", "subjectId"]).index("byTopic", ["topic"]), $ = k("_voltro_notification_quiet_hours", {
+	id: S({ prefix: "notifqh" }),
+	subjectId: A(),
+	startMinute: C(),
+	endMinute: C(),
+	tz: A().default("UTC"),
+	policy: A().default("hold")
+}).renamedFrom("notification_quiet_hours").unique("byQuietHoursSubject", ["subjectId"]), Ze = k("_voltro_notification_held", {
+	id: S({ prefix: "notifheld" }),
+	kind: A(),
+	subjectId: A(),
+	send: T(),
+	flushAt: j()
+}).renamedFrom("notification_held").index("byHeldFlushAt", ["flushAt"]).index("byHeldSubjectKind", ["subjectId", "kind"]), Qe = class extends h.Tag("@voltro/plugin-notifications/NotificationService")() {}, $e = (e) => async (t) => {
 	if (e !== void 0) try {
 		let n = await e(t);
 		if (typeof n == "string" && n !== "") return n;
 	} catch {}
 	return t.request.subject.id ?? "anonymous";
-}, ce = (e) => e.request.subject.tenantId ?? null, $ = "@voltro/plugin-notifications", le = (d = {}) => {
-	let m = Q(d.resolveSubjectId), h = ae({
-		base: $,
-		alias: d.alias,
-		instance: d.name
+}, et = (e) => e.request.subject.tenantId ?? null, tt = "@voltro/plugin-notifications", nt = (h = {}) => {
+	let _ = $e(h.resolveSubjectId), v = se({
+		base: tt,
+		alias: h.alias,
+		instance: h.name
 	});
-	w({
+	D({
 		source: "plugin",
 		table: "_voltro_notification_deliveries",
 		timeColumn: "at",
-		ttlMs: T(process.env.VOLTRO_NOTIFICATION_DELIVERIES_TTL_HOURS, 2160),
+		ttlMs: O(process.env.VOLTRO_NOTIFICATION_DELIVERIES_TTL_HOURS, 2160),
 		envVar: "VOLTRO_NOTIFICATION_DELIVERIES_TTL_HOURS"
-	}), w({
+	}), D({
 		source: "plugin",
 		table: "_voltro_notification_inbox",
 		timeColumn: "createdAt",
-		ttlMs: T(process.env.VOLTRO_NOTIFICATION_INBOX_READ_TTL_HOURS, 4320),
+		ttlMs: O(process.env.VOLTRO_NOTIFICATION_INBOX_READ_TTL_HOURS, 4320),
 		envVar: "VOLTRO_NOTIFICATION_INBOX_READ_TTL_HOURS",
-		where: re("readAt")
-	}), w({
+		where: ae("readAt")
+	}), D({
 		source: "plugin",
 		table: "_voltro_notification_held",
 		timeColumn: "flushAt",
-		ttlMs: T(process.env.VOLTRO_NOTIFICATION_HELD_TTL_HOURS, 168),
+		ttlMs: O(process.env.VOLTRO_NOTIFICATION_HELD_TTL_HOURS, 168),
 		envVar: "VOLTRO_NOTIFICATION_HELD_TTL_HOURS"
 	});
-	let g = d.store === void 0, _ = { current: d.store ?? I() }, v = {
-		addInbox: (e) => _.current.addInbox(e),
-		listInbox: (e, t) => _.current.listInbox(e, t),
-		markRead: (e, t) => _.current.markRead(e, t),
-		markUnread: (e, t) => _.current.markUnread(e, t),
-		markAllRead: (e) => _.current.markAllRead(e),
-		setArchived: (e, t, n) => _.current.setArchived(e, t, n),
-		unreadCount: (e) => _.current.unreadCount(e),
-		getPreferences: (e) => _.current.getPreferences(e),
-		setPreference: (e) => _.current.setPreference(e),
-		recordDelivery: (e) => _.current.recordDelivery(e),
-		listDeliveries: (e) => _.current.listDeliveries(e),
-		subscribeTopic: (e) => _.current.subscribeTopic(e),
-		unsubscribeTopic: (e, t) => _.current.unsubscribeTopic(e, t),
-		listTopicSubscribers: (e) => _.current.listTopicSubscribers(e),
-		getQuietHours: (e) => _.current.getQuietHours(e),
-		setQuietHours: (e) => _.current.setQuietHours(e),
-		clearQuietHours: (e) => _.current.clearQuietHours(e),
-		enqueueHeld: (e) => _.current.enqueueHeld(e),
-		pendingDigest: (e) => _.current.pendingDigest(e),
-		dueHeld: (e) => _.current.dueHeld(e),
-		clearHeld: (e) => _.current.clearHeld(e)
-	}, y = d.channels ?? [j()], b = y.some((e) => e.id === "inApp") ? y : [...y, z(v)], x = d.digestWindowMs ?? 0, S = U({
-		channels: b,
-		store: v,
-		digestWindowMs: x
-	}), C, E = [
+	let y = h.store === void 0, b = { current: h.store ?? R() }, x = {
+		addInbox: (e) => b.current.addInbox(e),
+		listInbox: (e, t) => b.current.listInbox(e, t),
+		markRead: (e, t) => b.current.markRead(e, t),
+		markUnread: (e, t) => b.current.markUnread(e, t),
+		markAllRead: (e) => b.current.markAllRead(e),
+		setArchived: (e, t, n) => b.current.setArchived(e, t, n),
+		unreadCount: (e) => b.current.unreadCount(e),
+		getPreferences: (e) => b.current.getPreferences(e),
+		setPreference: (e) => b.current.setPreference(e),
+		recordDelivery: (e) => b.current.recordDelivery(e),
+		listDeliveries: (e) => b.current.listDeliveries(e),
+		markClicked: (e) => b.current.markClicked(e),
+		subscribeTopic: (e) => b.current.subscribeTopic(e),
+		unsubscribeTopic: (e, t) => b.current.unsubscribeTopic(e, t),
+		listTopicSubscribers: (e) => b.current.listTopicSubscribers(e),
+		getQuietHours: (e) => b.current.getQuietHours(e),
+		setQuietHours: (e) => b.current.setQuietHours(e),
+		clearQuietHours: (e) => b.current.clearQuietHours(e),
+		enqueueHeld: (e) => b.current.enqueueHeld(e),
+		pendingDigest: (e) => b.current.pendingDigest(e),
+		dueHeld: (e) => b.current.dueHeld(e),
+		clearHeld: (e) => b.current.clearHeld(e)
+	}, S = h.channels ?? [I()], C = S.some((e) => e.id === "inApp") ? S : [...S, xe(x)], w = h.digestWindowMs ?? 0, T = C.some((e) => e.id === "webPush"), E = we({
+		channels: C,
+		store: x,
+		digestWindowMs: w
+	}), k, A = [
 		{
 			...n,
 			description: "The caller's in-app inbox items.",
-			execute: (e, t) => f.promise(async () => S.inbox(await m(t), e))
+			execute: (e, t) => g.promise(async () => E.inbox(await _(t), e))
 		},
 		{
-			...te,
+			...f,
 			description: "The caller's unread count.",
-			execute: (e, t) => f.promise(async () => ({ count: await S.unreadCount(await m(t)) }))
+			execute: (e, t) => g.promise(async () => ({ count: await E.unreadCount(await _(t)) }))
 		},
 		{
 			...i,
 			description: "Mark an inbox item read.",
-			execute: (e, t) => f.promise(async () => ({ ok: await S.markRead(e.id, await m(t)) }))
+			execute: (e, t) => g.promise(async () => ({ ok: await E.markRead(e.id, await _(t)) }))
 		},
 		{
 			...a,
 			description: "Mark an inbox item unread again.",
-			execute: (e, t) => f.promise(async () => ({ ok: await S.markUnread(e.id, await m(t)) }))
+			execute: (e, t) => g.promise(async () => ({ ok: await E.markUnread(e.id, await _(t)) }))
 		},
 		{
 			...r,
 			description: "Mark every unread item in the caller's inbox read.",
-			execute: (e, t) => f.promise(async () => ({ count: await S.markAllRead(await m(t)) }))
+			execute: (e, t) => g.promise(async () => ({ count: await E.markAllRead(await _(t)) }))
 		},
 		{
 			...e,
 			description: "Archive an inbox item — a different state from read; this is what empties the inbox.",
-			execute: (e, t) => f.promise(async () => ({ ok: await S.setArchived(e.id, await m(t), !0) }))
+			execute: (e, t) => g.promise(async () => ({ ok: await E.setArchived(e.id, await _(t), !0) }))
 		},
 		{
-			...ee,
+			...d,
 			description: "Return an archived item to the inbox.",
-			execute: (e, t) => f.promise(async () => ({ ok: await S.setArchived(e.id, await m(t), !1) }))
+			execute: (e, t) => g.promise(async () => ({ ok: await E.setArchived(e.id, await _(t), !1) }))
 		},
 		{
 			...s,
 			description: "The caller's channel preferences.",
-			execute: (e, t) => f.promise(async () => S.getPreferences(await m(t)))
+			execute: (e, t) => g.promise(async () => E.getPreferences(await _(t)))
 		},
 		{
 			...c,
 			description: "Toggle a channel on/off for a category.",
-			execute: (e, t) => f.promise(async () => {
+			execute: (e, t) => g.promise(async () => {
 				let { category: n, channel: r, enabled: i } = e;
-				return await S.setPreference({
-					subjectId: await m(t),
+				return await E.setPreference({
+					subjectId: await _(t),
 					category: n,
 					channel: r,
 					enabled: i
@@ -669,20 +1001,20 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 		{
 			...u,
 			description: "Subscribe the caller to a broadcast topic.",
-			execute: (e, t) => f.promise(async () => (await S.subscribe(e.topic, await m(t), ce(t)), { ok: !0 }))
+			execute: (e, t) => g.promise(async () => (await E.subscribe(e.topic, await _(t), et(t)), { ok: !0 }))
 		},
 		{
-			...ne,
+			...p,
 			description: "Unsubscribe the caller from a broadcast topic.",
-			execute: (e, t) => f.promise(async () => (await S.unsubscribe(e.topic, await m(t)), { ok: !0 }))
+			execute: (e, t) => g.promise(async () => (await E.unsubscribe(e.topic, await _(t)), { ok: !0 }))
 		},
 		{
 			...l,
 			description: "Set the caller's quiet-hours (DND) window.",
-			execute: (e, t) => f.promise(async () => {
+			execute: (e, t) => g.promise(async () => {
 				let n = e;
-				return await S.setQuietHours({
-					subjectId: await m(t),
+				return await E.setQuietHours({
+					subjectId: await _(t),
 					startMinute: n.startMinute,
 					endMinute: n.endMinute,
 					...n.tz ? { tz: n.tz } : {},
@@ -693,25 +1025,58 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 		{
 			...t,
 			description: "Clear the caller's quiet-hours window.",
-			execute: (e, t) => f.promise(async () => (await S.clearQuietHours(await m(t)), { ok: !0 }))
+			execute: (e, t) => g.promise(async () => (await E.clearQuietHours(await _(t)), { ok: !0 }))
+		}
+	], j = T ? [
+		{
+			...m,
+			description: "The VAPID application-server key a subscribing browser needs.",
+			execute: () => g.sync(() => ({ key: Ke(X().channelOptions?.privateKey) }))
+		},
+		{
+			...ne,
+			description: "Register the calling subject's browser push subscription (one row per endpoint).",
+			execute: (e, t) => g.promise(async () => {
+				let n = e;
+				return await X().store.upsert({
+					subjectId: await _(t),
+					endpoint: n.endpoint,
+					endpointHash: q(n.endpoint),
+					p256dh: n.p256dh,
+					auth: n.auth,
+					ua: n.ua ?? null,
+					tenantId: et(t)
+				}), { ok: !0 };
+			})
+		},
+		{
+			...re,
+			description: "Remove one of the calling subject's own subscriptions.",
+			execute: (e, t) => g.promise(async () => ({ ok: await X().store.removeForSubject(q(e.endpoint), await _(t)) }))
+		},
+		{
+			...te,
+			description: "How many push endpoints the calling subject has registered.",
+			execute: (e, t) => g.promise(async () => ({ endpoints: await X().store.countForSubject(await _(t)) }))
 		}
-	], D = (e) => ({
+	] : [], M = (e) => ({
 		kind: "json",
 		data: e
-	}), O = (e, t) => ({
+	}), ce = (e, t) => ({
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), k = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t), A = [{
+	}), N = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t), le = [{
 		method: "GET",
 		path: "/deliveries",
 		description: "Recent delivery records (newest first) + per-channel + per-status counts.",
-		handler: () => f.promise(async () => {
-			let e = await v.listDeliveries({ limit: 200 }), t = {}, n = 0, r = 0;
+		handler: () => g.promise(async () => {
+			let e = await x.listDeliveries({ limit: 200 }), t = {}, n = 0, r = 0;
 			for (let i of e) t[i.channel] = (t[i.channel] ?? 0) + 1, i.status === "sent" ? n++ : r++;
-			return D({
-				deliveries: e.slice(0, 100),
-				channels: b.map((e) => e.id),
+			let i = e.slice(0, 100).map(({ clickToken: e, ...t }) => t);
+			return M({
+				deliveries: i,
+				channels: C.map((e) => e.id),
 				stats: {
 					sent: n,
 					failed: r,
@@ -724,45 +1089,79 @@ var A = class extends m.TaggedError()("PushTokenRejected", {
 		path: "/inbox",
 		description: "In-app inbox for a subject (?subjectId=…).",
 		handler: (e) => {
-			let t = k(e.url, "subjectId");
-			return t ? f.promise(async () => D({
-				items: await v.listInbox(t, { limit: 100 }),
-				unread: await v.unreadCount(t)
-			})) : f.succeed(O(400, "subjectId query param required"));
+			let t = N(e.url, "subjectId");
+			return t ? g.promise(async () => M({
+				items: await x.listInbox(t, { limit: 100 }),
+				unread: await x.unreadCount(t)
+			})) : g.succeed(ce(400, "subjectId query param required"));
 		}
 	}];
-	return ie({
-		name: h,
-		baseName: $,
+	return oe({
+		name: v,
+		baseName: tt,
 		description: "Unified notifications — email/slack/sms/push/in-app with preference routing, inbox + delivery log.",
 		permissions: ["inspect:read", "store:write"],
-		...d.tables === !1 ? {} : { extendSchema: { tables: [
-			G,
-			K,
-			q,
-			J,
-			Y,
-			X
+		...h.tables === !1 ? {} : { extendSchema: { tables: [
+			qe,
+			Je,
+			Ye,
+			Xe,
+			$,
+			Ze,
+			Ie
 		] } },
-		services: p.succeed(Z, S),
-		routes: E,
-		rpcClientDescriptors: o,
-		inspectEndpoints: A,
+		...T ? {
+			declaredEnv: [{
+				name: "VOLTRO_VAPID_PRIVATE_KEY",
+				required: !0,
+				secret: !0,
+				generate: "p256",
+				description: "VAPID P-256 private scalar (base64url) for web push. Minted per project by `voltro dev`; production sets its own — never a shared or default value."
+			}],
+			httpRoutes: [{
+				method: "POST",
+				path: "/_voltro/notifications/clicked",
+				handle: async (e) => {
+					let t;
+					try {
+						t = JSON.parse(Buffer.from(e.rawBody).toString("utf8")).token;
+					} catch {}
+					if (typeof t != "string" || t === "" || !Fe(t, t)) return {
+						status: 400,
+						body: JSON.stringify({ error: "token required" }),
+						contentType: "application/json"
+					};
+					let n = await x.markClicked(t);
+					return {
+						status: n ? 200 : 404,
+						body: JSON.stringify({ ok: n }),
+						contentType: "application/json"
+					};
+				},
+				maxBodyBytes: 4096
+			}]
+		} : {},
+		services: ie.succeed(Qe, E),
+		routes: [...A, ...j],
+		rpcClientDescriptors: T ? [...o, ...ee] : o,
+		inspectEndpoints: le,
 		bindDataStore: (e) => {
-			g && (_.current = R(e));
-			let t = d.flushIntervalMs ?? 3e4;
-			C = setInterval(() => {
-				S.flushDue().catch(() => {});
-			}, t), typeof C.unref == "function" && C.unref();
-		},
-		onActivate: (e) => f.sync(() => e.logger.info("notifications active", {
-			channels: b.map((e) => e.id),
-			digestWindowMs: x
-		})),
-		onDeactivate: () => f.sync(() => {
-			C && clearInterval(C), C = void 0;
+			y && (b.current = be(e)), ze(e);
+			let t = h.flushIntervalMs ?? 3e4;
+			k = setInterval(() => {
+				E.flushDue().catch(() => {});
+			}, t), typeof k.unref == "function" && k.unref();
+		},
+		onActivate: (e) => g.sync(() => {
+			T && Ue(), e.logger.info("notifications active", {
+				channels: C.map((e) => e.id),
+				digestWindowMs: w
+			});
+		}),
+		onDeactivate: () => g.sync(() => {
+			k && clearInterval(k), k = void 0;
 		})
 	});
 };
 //#endregion
-export { Z as NotificationService, A as PushTokenRejected, U as buildNotificationService, j as consoleChannel, P as customChannel, R as dataStoreNotificationStore, q as deliveriesTable, M as emailChannel, X as heldTable, z as inAppChannel, V as inQuietHours, G as inboxTable, Q as makeSubjectId, I as memoryNotificationStore, B as minuteOfDayInZone, le as notificationsPlugin, K as preferencesTable, se as pushChannel, H as quietHoursEnd, Y as quietHoursTable, F as resolveChannels, N as smsChannel, J as topicSubscriptionsTable, oe as webhookChannel };
+export { Qe as NotificationService, F as PushTokenRejected, we as buildNotificationService, I as consoleChannel, ve as customChannel, be as dataStoreNotificationStore, Le as dataStorePushSubscriptionStore, Ne as decryptWebPushPayload, Ye as deliveriesTable, ge as emailChannel, Me as encryptWebPushPayload, q as endpointHashOf, Ee as generateVapidPrivateKey, Ze as heldTable, xe as inAppChannel, Se as inQuietHours, qe as inboxTable, $e as makeSubjectId, R as memoryNotificationStore, J as memoryPushSubscriptionStore, B as minuteOfDayInZone, nt as notificationsPlugin, Je as preferencesTable, ye as pushChannel, Ie as pushSubscriptionsTable, Ce as quietHoursEnd, $ as quietHoursTable, Be as resetWebPushStoreForTest, L as resolveChannels, Pe as sendWebPush, _e as smsChannel, Xe as topicSubscriptionsTable, K as vapidAuthorization, G as vapidPublicKeyFor, He as webPushChannel, Ke as webPushPublicKey, he as webhookChannel };