@xopcai/xopc 0.0.309 → 0.0.311

package/dist/src/gateway/service.js

@@ -6,9 +6,11 @@ import { getRuntimeLogStats } from "../utils/logger/stats.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { closeXopcDatabase, openXopcDatabase } from "../storage/sqlite/connection.js";
+import { getSqliteDatabase, init_transaction } from "../storage/sqlite/transaction.js";
 import { findSessionInput, init_session_input_repository, insertSessionInput } from "../storage/sqlite/session-input-repository.js";
 import { init_changes, notifyUserContextChange } from "../user-context/changes.js";
-import { getSessionMetadata, init_session_repository, patchSessionMetadata } from "../storage/sqlite/session-repository.js";
+import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
+import { init_session_repository, patchSessionMetadata } from "../storage/sqlite/session-repository.js";
 import { getSessionConfig } from "../storage/sqlite/config-repository.js";
 import "../storage/sqlite/index.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
@@ -33,13 +35,10 @@ import { resolveProjectAgentId } from "../projects/project-agent.js";
 import "../projects/index.js";
 import { resolveEffectiveGatewayPort } from "./host.js";
 import { onSessionTranscriptUpdate } from "../session/transcript-events.js";
-import { ProactiveScenarioService } from "../proactive/scenarios/service.js";
-import { ProactiveEventService } from "../proactive/service.js";
-import { TaskApplicationService } from "../tasks/task-application-service.js";
-import { ProactiveInboxService } from "../proactive/inbox/service.js";
 import { AutomationService } from "../automations/service/automation-service.js";
 import { onAutomationProductEvent, publishAutomationProductEvent } from "../automations/product-events.js";
 import "../automations/index.js";
+import { TaskApplicationService } from "../tasks/task-application-service.js";
 import { TaskOutboxDispatcher } from "../tasks/task-outbox-dispatcher.js";
 import { TaskRunDispatcher } from "../tasks/task-run-dispatcher.js";
 import { TaskSignalService } from "../tasks/task-signal-service.js";
@@ -64,7 +63,6 @@ import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js"
 import "../knowledge/index.js";
 import { ConnectionRecoveryService } from "../connectors/connection-recovery-service.js";
 import { startConnectorLearningCoordinator } from "../connectors/learning-coordinator.js";
-import { ConnectedSourceChangePublisher } from "../connectors/source-change-publisher.js";
 import { startConnectorSupervisor } from "../connectors/supervisor.js";
 import { DiscussionService } from "../discussions/service.js";
 import { DiscussionOrganizer } from "../discussions/organizer.js";
@@ -79,7 +77,6 @@ import { prepareAutomationAgentSession } from "./automation-agent-session.js";
 import { stopTailscaleExposure } from "./tailscale-lifecycle.js";
 import { createBackgroundTask } from "../infra/background-task.js";
 import { buildTaskAgentContext } from "../agent/source-context/task-context.js";
-import { deliverProactiveCard } from "../proactive/inbox/delivery.js";
 import { WorkDiscoveryService } from "../work-discovery/service.js";
 import { buildVoiceMemoryContext } from "../voice/realtime/memory-context.js";
 import { buildVoicePersonaContext } from "../voice/realtime/persona-context.js";
@@ -91,8 +88,6 @@ import "../notes/index.js";
 import { buildWorkflowChildTools } from "../agent/workflow/workflow-child-tools.js";
 import { WorkflowRunService } from "../workflows/service/workflow-run-service.js";
 import { WorkflowSessionBridge } from "../workflows/service/workflow-session-bridge.js";
-import { HeartbeatService, heartbeatRunnerConfigFromConfig } from "./heartbeat/service.js";
-import "./heartbeat/index.js";
 import { EphemeralSideChatManager } from "./side-chat/manager.js";
 import { SideChatRunService } from "./side-chat/run-service.js";
 import "./side-chat/index.js";
@@ -113,13 +108,6 @@ import { LocalAppService } from "../local-apps/service.js";
 import "../local-apps/index.js";
 import { createRuntimeBrowserAutomationService } from "../browser/automations/runtime-service.js";
 import "../browser/automations/index.js";
-import { mapProductEventToProactive } from "../proactive/events/product-event-bridge.js";
-import { ReadonlyProactiveAgentExecutor } from "../proactive/execution/agent-executor.js";
-import { listInsights } from "../proactive/execution/repository.js";
-import { ProactiveWorker } from "../proactive/execution/worker.js";
-import { ProactiveTemporalWorker } from "../proactive/temporal/worker.js";
-import { ProactiveInboxWorker } from "../proactive/inbox/worker.js";
-import "../proactive/index.js";
 import { scheduleGatewayUpdateCheck } from "../infra/update-startup.js";
 import { resolveChannelConnectDeferSet } from "./resolve-channel-connect-defer.js";
 import { restartGatewayProcessWithFreshPid } from "./respawn.js";
@@ -134,6 +122,7 @@ import { DurableVoiceAgentBroker } from "../voice/realtime/agentBroker.js";
 import { reconcileMemoryMaintenanceAutomations } from "./memory-maintenance-automation-reconciler.js";
 import { GatewayReadiness } from "./startup-readiness.js";
 import { createGatewayStartupTrace } from "./startup-trace.js";
+import { GatewaySceneHost } from "./scenes/host.js";
 import { applyAutomaticVoiceLanguage, inferProductLanguageFromEnvironment, initializeVoiceDefaults } from "../voice/language-profile.js";
 import crypto from "node:crypto";
 //#region src/gateway/service.ts
@@ -151,6 +140,7 @@ init_paths();
 init_package_version();
 init_resolve_route();
 init_session_key();
+init_transaction();
 const log = createLogger("Gateway:Service");
 var GatewayService = class {
 	bus;
@@ -163,7 +153,7 @@ var GatewayService = class {
 	notesService;
 	extensionLoader = null;
 	extensionMetadataSnapshot = null;
-	heartbeatService = null;
+	sceneHost = null;
 	sessionIndex;
 	running = false;
 	startTime = Date.now();
@@ -287,7 +277,6 @@ var GatewayService = class {
 	notificationService = null;
 	connectorSupervisor = null;
 	connectorLearningCoordinator = null;
-	connectedSourceChangePublisher = null;
 	connectedKnowledgeCoordinator = null;
 	stopAutomationProductEventBridge = null;
 	stopSessionTranscriptAutomationEvents = null;
@@ -329,25 +318,21 @@ var GatewayService = class {
 	discussionSealer;
 	/** Local user-created apps, their coder projects, previews, and installs. */
 	localApps;
-	/** Unified durable event spine for proactive scenarios. */
-	proactiveScenarios = new ProactiveScenarioService();
-	proactive = new ProactiveEventService(() => this.proactiveScenarios.routes());
-	proactiveInbox = new ProactiveInboxService();
-	proactiveInsights = listInsights;
-	proactiveWorker;
-	proactiveTemporalWorker;
-	proactiveInboxWorker;
+	get sceneAccess() {
+		return this.sceneHost ? {
+			services: this.sceneHost.http,
+			principal: {
+				ownerId: "local-owner",
+				workspaceId: this.workspacePath
+			}
+		} : void 0;
+	}
 	constructor(serviceConfig = {}) {
 		this.serviceConfig = serviceConfig;
 		this.bus = new MessageBus();
 		this.configPath = serviceConfig.configPath || resolveConfigPath();
 		runBootstrapMigrationsSync(this.configPath);
 		this.config = loadConfig(this.configPath);
-		this.proactiveWorker = new ProactiveWorker(new ReadonlyProactiveAgentExecutor(() => this.config));
-		this.proactiveTemporalWorker = new ProactiveTemporalWorker(this.proactive);
-		this.proactiveInboxWorker = new ProactiveInboxWorker({ deliver: async ({ inboxItem }) => {
-			return deliverProactiveCard(inboxItem, this.createNotificationService(), (type, payload) => this.realtime.broker.publish("gateway", type, payload));
-		} });
 		let bootstrapConfigChanged = initializeVoiceDefaults(this.config, inferProductLanguageFromEnvironment());
 		const starterResult = ensureStarterAgentsInitialized(this.config);
 		if (starterResult.changed) {
@@ -401,9 +386,9 @@ var GatewayService = class {
 		this.workspacePath = getWorkspacePath(this.config) || "./workspace";
 		this.initializeExtensionLoader();
 		this.sessionIndex = new SessionIndex({ config: this.config });
-		this.automationService = new AutomationService(this.proactive, this.workspacePath);
+		this.automationService = new AutomationService();
 		this.notesService = new NotesService(new NotesStore());
-		this.projects = new ProjectService(void 0, this.proactive, this.workspacePath);
+		this.projects = new ProjectService();
 		const emitDiscussion = (capture) => {
 			this.emit("discussion.updated", capture);
 		};
@@ -546,7 +531,6 @@ var GatewayService = class {
 			},
 			getAgentService: () => this.ensureAgentService(),
 			getChannelManager: () => this.channelManager,
-			getHeartbeatService: () => this.heartbeatService,
 			getExtensionLoader: () => this.extensionLoader,
 			reconcileMemoryMaintenanceAutomations: () => this.reconcileMemoryMaintenanceAutomations(),
 			getChannelsStatus: () => this.getChannelsStatus(),
@@ -592,6 +576,7 @@ var GatewayService = class {
 			extensionRegistry: this.extensionLoader?.getRegistry(),
 			endpointTools: this.endpointTools,
 			getAutomationService: () => this.automationService,
+			getSceneAccess: () => this.sceneAccess,
 			getBrowserAutomationService: () => this.browserAutomations,
 			emitBrowserEvent: (type, payload) => this.emit(type, payload),
 			getNotesService: () => this.notesService,
@@ -666,17 +651,6 @@ var GatewayService = class {
 		});
 		return this._agentService;
 	}
-	ensureHeartbeatService() {
-		if (this.heartbeatService) return this.heartbeatService;
-		this.heartbeatService = new HeartbeatService({
-			agentService: this.ensureAgentService(),
-			messageBus: this.bus,
-			sessionStore: this.sessionIndex.getStore(),
-			getConfig: () => this.config,
-			getWorkspace: () => this.workspacePath
-		});
-		return this.heartbeatService;
-	}
 	createTaskRunDispatcher() {
 		if (!this.taskRunDispatcher) this.taskRunDispatcher = new TaskRunDispatcher({
 			workerId: "gateway-agent",
@@ -712,21 +686,7 @@ var GatewayService = class {
 		return this.taskRunDispatcher;
 	}
 	createNotificationService() {
-		if (!this.notificationService) this.notificationService = new NotificationService({
-			publish: (type, payload) => this.realtime.broker.publish("gateway", type, payload),
-			sendChannel: async (target, text) => {
-				const outbound = this.channelManager.getPlugin("telegram")?.outbound;
-				if (!outbound?.sendText || !this.channelManager.getRunningChannels().includes("telegram")) throw new Error("Telegram is not connected");
-				const result = await outbound.sendText({
-					cfg: this.config,
-					to: target.chatId,
-					accountId: target.accountId,
-					text
-				});
-				if (!result.success) throw new Error("Telegram delivery failed");
-				return { messageId: result.messageId };
-			}
-		});
+		if (!this.notificationService) this.notificationService = new NotificationService({ publish: (type, payload) => this.realtime.broker.publish("gateway", type, payload) });
 		return this.notificationService;
 	}
 	taskRunDispatch = createBackgroundTask(async () => {
@@ -967,6 +927,19 @@ var GatewayService = class {
 		}
 	}
 	async start() {
+		try {
+			await this.startRuntime();
+		} catch (err) {
+			await this.stop().catch((cleanupError) => log.error({ err: cleanupError }, "Gateway startup cleanup failed"));
+			await this.sceneHost?.stop();
+			this.sceneHost = null;
+			this.stopRealtimeLogBridge?.();
+			this.stopRealtimeLogBridge = null;
+			setPairingBroadcastSink(null);
+			throw err;
+		}
+	}
+	async startRuntime() {
 		if (this.running) return;
 		this.stopRealtimeLogBridge = subscribeToLogs((entry) => {
 			this.realtime.broker.publish("logs", "log.entry", entry);
@@ -983,9 +956,14 @@ var GatewayService = class {
 		this.running = true;
 		this.taskRunDispatchTimer = setInterval(() => this.dispatchTaskRuns(), 1e3);
 		this.taskRunDispatchTimer.unref?.();
-		this.proactiveWorker.start();
-		this.proactiveTemporalWorker.start();
-		this.proactiveInboxWorker.start();
+		this.sceneHost = new GatewaySceneHost(getSqliteDatabase(), {
+			principal: {
+				ownerId: "local-owner",
+				workspaceId: this.workspacePath
+			},
+			config: () => this.config,
+			publish: (type, notification) => this.realtime.broker.publish("gateway", type, notification)
+		});
 		this.startupTrace = createGatewayStartupTrace();
 		this.readiness.markStarting(this.startTime);
 		const trace = this.startupTrace;
@@ -1128,7 +1106,6 @@ var GatewayService = class {
 		this.discussionLiveWorker.start();
 		this.discussionSealer.start();
 		this.discussionWorker.start();
-		this.ensureHeartbeatService().start(heartbeatRunnerConfigFromConfig(this.config));
 		this.connectorSupervisor = startConnectorSupervisor({
 			getConfig: () => this.config,
 			saveConfig: (cfg) => this.saveConfig(cfg)
@@ -1149,8 +1126,6 @@ var GatewayService = class {
 			}
 		});
 		this.managedComposioEventPoller.start();
-		this.connectedSourceChangePublisher = new ConnectedSourceChangePublisher(this.proactive);
-		this.connectedSourceChangePublisher.start();
 		this.connectedKnowledgeCoordinator = startConnectedKnowledgeCoordinator({ resolvePipelineOptions: () => ({
 			agentId: resolveDefaultAgentId(this.config),
 			workspaceId: this.currentWorkspacePath
@@ -1174,6 +1149,7 @@ var GatewayService = class {
 		import("../share/share-auto.js").then(({ runStagingSweep }) => runStagingSweep([...new Set([getDefaultAgentId(this.config), ...listAgentEntries(this.config).map((entry) => entry.id)])].map((agentId) => resolveAgentWorkspaceDir(this.config, agentId)))).catch((err) => log.warn({ err }, "Share staging sweep failed"));
 		if (this.serviceConfig.deferChannelConnectUntilAfterHttp !== true) this.markGatewayReady();
 		else trace.mark("service.started-awaiting-http");
+		this.sceneHost.start();
 		log.debug("Gateway service started");
 	}
 	/** Called when the HTTP listener is bound (before deferred channel work). */
@@ -1267,14 +1243,13 @@ var GatewayService = class {
 		this.readiness.markStarting();
 		this.endpointTools.close();
 		await this.sideChats.disposeAll();
+		await this.sceneHost?.stop();
+		this.sceneHost = null;
 		this.realtime.close();
 		this.voiceRealtime.close();
-		await this.proactiveWorker.stop();
 		await this.discussionWorker.stop();
 		await this.discussionSealer.stop();
 		await this.discussionLiveWorker.stop();
-		this.proactiveTemporalWorker.stop();
-		await this.proactiveInboxWorker.stop();
 		this.notificationService?.stop();
 		if (this.taskRunDispatchTimer) {
 			clearInterval(this.taskRunDispatchTimer);
@@ -1289,15 +1264,12 @@ var GatewayService = class {
 		}
 		this.modelCatalogSync.stop();
 		await this.configCoordinator.stopHotReloader();
-		this.heartbeatService?.stop();
 		this.connectorSupervisor?.stop();
 		this.connectorSupervisor = null;
 		this.connectorLearningCoordinator?.stop();
 		this.connectorLearningCoordinator = null;
 		this.managedComposioEventPoller?.stop();
 		this.managedComposioEventPoller = void 0;
-		this.connectedSourceChangePublisher?.stop();
-		this.connectedSourceChangePublisher = null;
 		this.connectedKnowledgeCoordinator?.stop();
 		this.connectedKnowledgeCoordinator = null;
 		await this.browserAutomationService?.shutdown();
@@ -1343,9 +1315,6 @@ var GatewayService = class {
 			await new Promise((resolve) => setTimeout(resolve, 1e3));
 		}
 	}
-	reloadHeartbeatFromCurrentConfig() {
-		this.configCoordinator.reloadHeartbeatFromCurrentConfig();
-	}
 	reloadConfig() {
 		return this.configCoordinator.reloadConfig();
 	}
@@ -1453,15 +1422,6 @@ var GatewayService = class {
 			return a.id.localeCompare(b.id);
 		});
 	}
-	heartbeatStatus() {
-		return this.heartbeatService?.status() ?? null;
-	}
-	/**
-	* Request an immediate heartbeat run (coalesced like interval/cron wakes).
-	*/
-	requestHeartbeatNow(opts) {
-		this.heartbeatService?.requestNow({ reason: opts?.reason ?? "manual" });
-	}
 	requestConnectorLearning(connectionId, request) {
 		return this.connectorLearningCoordinator?.enqueueConnection(connectionId, request) ?? null;
 	}
@@ -1669,21 +1629,6 @@ var GatewayService = class {
 		this.stopSessionTranscriptAutomationEvents?.();
 		this.stopAutomationProductEventBridge = onAutomationProductEvent((event) => {
 			if (event.type.startsWith("task.")) this.emit(event.type, event.payload);
-			const proactiveEvent = mapProductEventToProactive({
-				event,
-				workspaceId: this.currentWorkspacePath,
-				defaultAgentId: resolveDefaultAgentId(this.config)
-			});
-			if (proactiveEvent) try {
-				this.proactive.publish(proactiveEvent);
-			} catch (err) {
-				const em = err instanceof Error ? err.message : String(err);
-				log.warn({
-					err,
-					eventType: event.type,
-					source: event.source
-				}, `Proactive product event publication failed: ${em}`);
-			}
 			this.automationService.triggerEvent(event).catch((err) => {
 				const em = err instanceof Error ? err.message : String(err);
 				log.warn({

package/dist/src/gateway/session-context-summary.js

@@ -2,7 +2,8 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { getSqliteDatabase, init_transaction } from "../storage/sqlite/transaction.js";
 import { hasGatewayScope } from "./security/gateway-scopes.js";
-import { getSessionMetadata, init_session_repository } from "../storage/sqlite/session-repository.js";
+import { getSessionMetadata } from "../storage/sqlite/session-read-repository.js";
+import { init_session_repository } from "../storage/sqlite/session-repository.js";
 import { getSessionConfig } from "../storage/sqlite/config-repository.js";
 import { TaskRepository } from "../tasks/task-repository.js";
 import { TaskConversationRepository } from "../tasks/task-conversation-repository.js";

package/dist/src/heartbeat/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, shouldSilence, stripHeartbeatToken } from "./tokens.js";
-import { appendCronEventLines } from "./event-prompt.js";
 import { isWithinActiveHours } from "./active-hours.js";
 import { isHeartbeatContentEmpty } from "./content-check.js";
+import { appendCronEventLines } from "./event-prompt.js";
 import { createHeartbeatWake } from "./wake.js";
 export { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, appendCronEventLines, createHeartbeatWake, isHeartbeatContentEmpty, isWithinActiveHours, shouldSilence, stripHeartbeatToken };

package/dist/src/infra/unhandled-rejections.js

@@ -1,7 +1,7 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { init_global_singleton, resolveGlobalSingleton } from "../utils/global-singleton.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
+import { init_global_singleton, resolveGlobalSingleton } from "../utils/global-singleton.js";
 import { init_process_diagnostics, recordProcessDiagnostic } from "./process-diagnostics.js";
 import { init_sqlite_errors, isTransientSqliteError } from "./sqlite-errors.js";
 //#region src/infra/unhandled-rejections.ts

package/dist/src/migrations/runner.js

@@ -2,7 +2,6 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { ConfigSchema, init_schema } from "../config/schema.js";
 import { listRegisteredMigrations } from "./registry.js";
-import { conversationRoutingConfigMigration } from "./conversation-routing-config.js";
 import { memoryConfigMigration } from "./memory-config.js";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
@@ -12,7 +11,7 @@ init_logger();
 const log = createLogger("Migrations");
 const MIGRATION_LEDGER_FILENAME = "migrations.json";
 const CONFIG_BACKUP_COUNT = 10;
-const CORE_MIGRATIONS = [conversationRoutingConfigMigration, memoryConfigMigration];
+const CORE_MIGRATIONS = [memoryConfigMigration];
 function listAllMigrations() {
 	return [...CORE_MIGRATIONS, ...listRegisteredMigrations().map((entry) => entry.migration)];
 }
@@ -178,8 +177,6 @@ function runBootstrapMigrationsSync(configPath, options = {}) {
 		...options,
 		mode: "auto-safe"
 	});
-	const failedCutover = result.items.find((item) => item.id === conversationRoutingConfigMigration.id && item.status === "error");
-	if (failedCutover) throw new Error(failedCutover.message);
 	if (result.changed) log.info({
 		configPath,
 		count: result.items.filter((item) => item.status === "applied").length

package/dist/src/notifications/browser-endpoint.d.ts

@@ -0,0 +1,2 @@
+/** Only supported public browser-push providers may receive subscription requests. */
+export declare function allowedPushEndpoint(value: string): boolean;

package/dist/src/notifications/browser-endpoint.js

@@ -0,0 +1,13 @@
+//#region src/notifications/browser-endpoint.ts
+/** Only supported public browser-push providers may receive subscription requests. */
+function allowedPushEndpoint(value) {
+	try {
+		const url = new URL(value);
+		const host = url.hostname;
+		return url.protocol === "https:" && !url.username && !url.password && (!url.port || url.port === "443") && (host === "fcm.googleapis.com" || host === "updates.push.services.mozilla.com" || host.endsWith(".push.services.mozilla.com") || host === "web.push.apple.com" || host.endsWith(".notify.windows.com"));
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { allowedPushEndpoint };

package/dist/src/notifications/browserSubscriptions.d.ts

@@ -0,0 +1,20 @@
+import type { DatabaseSync } from 'node:sqlite';
+type Owner = {
+    ownerId: string;
+    workspaceId: string;
+};
+/** User subscriptions share the same durable delivery ledger as every browser transport. */
+export declare class BrowserSubscriptionService {
+    private readonly db;
+    private readonly clock;
+    constructor(db: DatabaseSync, clock?: () => number);
+    prepare(): {
+        publicKey: string;
+    };
+    register(owner: Owner, value: unknown): {
+        id: string;
+    };
+    remove(owner: Owner, id: string): void;
+}
+export declare function enqueueBrowserDispatches(db: DatabaseSync, owner: Owner, notificationId: string, subjectId: string | null, revision: number, now: number): void;
+export {};

package/dist/src/notifications/browserSubscriptions.js

@@ -0,0 +1,59 @@
+import { allowedPushEndpoint } from "./browser-endpoint.js";
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import webPush from "web-push";
+//#region src/notifications/browserSubscriptions.ts
+const inputSchema = z.strictObject({
+	endpoint: z.string().max(4096).refine(allowedPushEndpoint),
+	expirationTime: z.number().int().positive().nullable(),
+	language: z.enum(["en", "zh"]),
+	keys: z.strictObject({
+		auth: z.string().regex(/^[\w-]+$/).refine((value) => Buffer.from(value, "base64url").length === 16),
+		p256dh: z.string().regex(/^[\w-]+$/).refine((value) => Buffer.from(value, "base64url").length === 65)
+	})
+});
+/** User subscriptions share the same durable delivery ledger as every browser transport. */
+var BrowserSubscriptionService = class {
+	constructor(db, clock = Date.now) {
+		this.db = db;
+		this.clock = clock;
+	}
+	prepare() {
+		let row = this.db.prepare("SELECT public_key FROM notification_browser_keys WHERE id = 1").get();
+		if (!row) {
+			const keys = webPush.generateVAPIDKeys();
+			this.db.prepare("INSERT INTO notification_browser_keys VALUES (1, ?, ?)").run(keys.publicKey, keys.privateKey);
+			row = { public_key: keys.publicKey };
+		}
+		return { publicKey: String(row.public_key) };
+	}
+	register(owner, value) {
+		const input = inputSchema.parse(value);
+		const now = this.clock();
+		if (input.expirationTime !== null && input.expirationTime <= now) throw new Error("Subscription expired");
+		const id = createHash("sha256").update(input.endpoint).digest("hex");
+		const existing = this.db.prepare("SELECT owner_id, workspace_id FROM notification_browser_subscriptions WHERE id = ?").get(id);
+		if (existing && (existing.owner_id !== owner.ownerId || existing.workspace_id !== owner.workspaceId)) throw new Error("Subscription belongs to another workspace");
+		this.db.prepare("DELETE FROM notification_browser_subscriptions WHERE expires_at <= ?").run(now);
+		if (!existing && Number(this.db.prepare("SELECT COUNT(*) AS n FROM notification_browser_subscriptions WHERE owner_id = ? AND workspace_id = ?").get(owner.ownerId, owner.workspaceId)?.n) >= 20) throw new Error("Subscription limit reached");
+		this.db.prepare(`INSERT INTO notification_browser_subscriptions VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET auth_key = excluded.auth_key, public_key = excluded.public_key,
+        expires_at = excluded.expires_at, language = excluded.language`).run(id, owner.ownerId, owner.workspaceId, input.endpoint, input.keys.auth, input.keys.p256dh, input.expirationTime, input.language, now);
+		return { id };
+	}
+	remove(owner, id) {
+		this.db.prepare("DELETE FROM notification_browser_subscriptions WHERE id = ? AND owner_id = ? AND workspace_id = ?").run(id, owner.ownerId, owner.workspaceId);
+		this.db.prepare("UPDATE notification_dispatches SET status = 'cancelled' WHERE owner_id = ? AND workspace_id = ? AND destination_id = ? AND status = 'pending'").run(owner.ownerId, owner.workspaceId, id);
+	}
+};
+function enqueueBrowserDispatches(db, owner, notificationId, subjectId, revision, now) {
+	const subscriptions = db.prepare("SELECT id FROM notification_browser_subscriptions WHERE owner_id = ? AND workspace_id = ? AND (expires_at IS NULL OR expires_at > ?)").all(owner.ownerId, owner.workspaceId, now);
+	for (const subscription of subscriptions) {
+		const id = createHash("sha256").update(`${notificationId}:${subscription.id}`).digest("hex");
+		db.prepare(`INSERT OR IGNORE INTO notification_dispatches(id, notification_id, owner_id, workspace_id, channel, destination_id,
+      subject_id, subject_revision, status, attempt, next_attempt_at)
+      VALUES (?, ?, ?, ?, 'browser', ?, ?, ?, 'pending', 0, ?)`).run(id, notificationId, owner.ownerId, owner.workspaceId, subscription.id, subjectId, revision, now);
+	}
+}
+//#endregion
+export { BrowserSubscriptionService, enqueueBrowserDispatches };

package/dist/src/notifications/browserTransport.d.ts

@@ -0,0 +1,9 @@
+import type { DatabaseSync } from 'node:sqlite';
+import webPush from 'web-push';
+import type { DispatchReceipt, NotificationDispatch } from './dispatch.js';
+/** Browser transport over the canonical ledger. Route resolution remains an authenticated host concern. */
+export declare function createBrowserNotificationTransport(db: DatabaseSync, options: {
+    route: (dispatch: NotificationDispatch) => string | null;
+    send?: typeof webPush.sendNotification;
+    clock?: () => number;
+}): (dispatch: NotificationDispatch, signal: AbortSignal) => Promise<DispatchReceipt>;

package/dist/src/notifications/browserTransport.js

@@ -0,0 +1,64 @@
+import { allowedPushEndpoint } from "./browser-endpoint.js";
+import { createHash } from "node:crypto";
+import webPush from "web-push";
+//#region src/notifications/browserTransport.ts
+/** Browser transport over the canonical ledger. Route resolution remains an authenticated host concern. */
+function createBrowserNotificationTransport(db, options) {
+	return async (dispatch, signal) => {
+		const now = (options.clock ?? Date.now)();
+		if (dispatch.channel !== "browser" || signal.aborted) return { status: "rejected" };
+		const subscription = db.prepare(`SELECT * FROM notification_browser_subscriptions
+      WHERE id = ? AND owner_id = ? AND workspace_id = ? AND (expires_at IS NULL OR expires_at > ?)`).get(dispatch.destinationId, dispatch.ownerId, dispatch.workspaceId, now);
+		const keys = db.prepare("SELECT public_key, private_key FROM notification_browser_keys WHERE id = 1").get();
+		if (!subscription || !keys || !allowedPushEndpoint(String(subscription.endpoint))) return { status: "rejected" };
+		const route = options.route(dispatch);
+		if (!route || !route.startsWith("/") || route.startsWith("//") || /[\\\s]/u.test(route) || new URL(route, "https://xopc.invalid").origin !== "https://xopc.invalid") return { status: "rejected" };
+		const zh = subscription.language === "zh";
+		const payload = JSON.stringify({
+			id: dispatch.notificationId,
+			title: zh ? "有新成果需要查看" : "An update is ready",
+			body: zh ? "打开 xopc 查看详情。" : "Open xopc to review it.",
+			route
+		});
+		try {
+			await (options.send ?? webPush.sendNotification)({
+				endpoint: String(subscription.endpoint),
+				expirationTime: subscription.expires_at === null ? null : Number(subscription.expires_at),
+				keys: {
+					auth: String(subscription.auth_key),
+					p256dh: String(subscription.public_key)
+				}
+			}, payload, {
+				vapidDetails: {
+					subject: "https://xopc.ai",
+					publicKey: String(keys.public_key),
+					privateKey: String(keys.private_key)
+				},
+				TTL: 3600,
+				timeout: 1e4,
+				topic: createHash("sha256").update(dispatch.id).digest("base64url").slice(0, 32)
+			});
+			return {
+				status: "accepted",
+				providerMessageId: null
+			};
+		} catch (error) {
+			const status = error?.statusCode;
+			if (status === 429) return {
+				status: "rejected",
+				retryAt: (options.clock ?? Date.now)() + 3e4
+			};
+			if (status !== void 0 && [
+				400,
+				401,
+				403,
+				404,
+				410,
+				413
+			].includes(status)) return { status: "rejected" };
+			throw new Error("Browser transport result is unconfirmed");
+		}
+	};
+}
+//#endregion
+export { createBrowserNotificationTransport };

package/dist/src/notifications/dispatch.d.ts

@@ -0,0 +1,46 @@
+import type { DatabaseSync } from 'node:sqlite';
+export interface NotificationDispatch {
+    id: string;
+    notificationId: string;
+    ownerId: string;
+    workspaceId: string;
+    channel: 'browser' | 'telegram';
+    destinationId: string;
+    destination: unknown;
+    subjectId: string | null;
+    subjectRevision: number;
+    attempt: number;
+}
+export type DispatchPolicy = {
+    action: 'send';
+} | {
+    action: 'cancel';
+} | {
+    action: 'defer';
+    until: number;
+};
+export type DispatchReceipt = {
+    status: 'accepted';
+    providerMessageId: string | null;
+} | {
+    status: 'rejected';
+    retryAt?: number;
+};
+/** Owns durable delivery only. The host supplies policy and transports; neither may widen the saved scope. */
+export declare class NotificationDispatcher {
+    private readonly db;
+    private readonly dependencies;
+    private active;
+    private stopped;
+    constructor(db: DatabaseSync, dependencies: {
+        authorize: (dispatch: NotificationDispatch, signal: AbortSignal) => Promise<DispatchPolicy>;
+        send: (dispatch: NotificationDispatch, signal: AbortSignal) => Promise<DispatchReceipt>;
+        clock?: () => number;
+        timeoutMs?: number;
+    });
+    /** Called by the host notification pump; overlapping passes never make a second claim. */
+    drainOne(): Promise<boolean>;
+    stop(): Promise<void>;
+    private now;
+    private deliver;
+}