dsh-mobile 0.7.1 → 0.8.1

package/lib/index.mjs

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
-import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { X509Certificate, createECDH, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { basename, dirname, extname, isAbsolute, join, posix, relative, resolve, win32 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import z from "@deepseek-ai/schemastery";
@@ -10,7 +10,7 @@ import { execFile, spawn } from "node:child_process";
 import { createSocket } from "node:dgram";
 import { homedir, hostname, networkInterfaces, tmpdir } from "node:os";
 import { STATUS_CODES, createServer as createServer$1, request } from "node:http";
-import { createServer as createServer$2, request as request$1 } from "node:https";
+import https, { createServer as createServer$2, request as request$1 } from "node:https";
 import { Readable, Transform, finished } from "node:stream";
 import { finished as finished$1, pipeline } from "node:stream/promises";
 import { promisify } from "node:util";
@@ -26,6 +26,8 @@ import { generate } from "selfsigned";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm/message";
 import { lookup } from "node:dns/promises";
 import { constants } from "node:fs";
+import { z as z$1 } from "zod";
+import webPush from "web-push";
 //#region src/access.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
 var AccessError = class extends Error {
@@ -112,6 +114,7 @@ var AccessController = class {
 	pairPending = false;
 	sessions = /* @__PURE__ */ new Map();
 	sessionEndedListeners = /* @__PURE__ */ new Set();
+	devicesRemovedListeners = /* @__PURE__ */ new Set();
 	mutation = Promise.resolve();
 	initialized = false;
 	closing = false;
@@ -166,6 +169,13 @@ var AccessController = class {
 		});
 		for (const listener of this.sessionEndedListeners) listener(authorization, reason);
 	}
+	emitDevicesRemoved(ids, reason) {
+		const notificationIds = Object.freeze([...ids]);
+		for (const listener of [...this.devicesRemovedListeners]) try {
+			const result = listener(notificationIds, reason);
+			Promise.resolve(result).catch(() => void 0);
+		} catch (_error) {}
+	}
 	removeSession(key, reason) {
 		const session = this.sessions.get(key);
 		if (session === void 0) return;
@@ -360,7 +370,11 @@ var AccessController = class {
 			if (next.length === this.devices.length) return false;
 			await this.store.save(this.snapshot(next));
 			this.devices = next;
-			for (const [key, session] of this.sessions) if (session.deviceId === deviceId) this.removeSession(key, "revoked");
+			try {
+				for (const [key, session] of this.sessions) if (session.deviceId === deviceId) this.removeSession(key, "revoked");
+			} finally {
+				this.emitDevicesRemoved([deviceId], "revoked");
+			}
 			return true;
 		});
 	}
@@ -368,12 +382,31 @@ var AccessController = class {
 	async resetDevices() {
 		this.requireInitialized();
 		await this.exclusive(async () => {
+			const removedIds = this.devices.map((device) => device.id);
 			await this.store.save(this.snapshot([]));
 			this.devices = [];
-			for (const key of [...this.sessions.keys()]) this.removeSession(key, "revoked");
 			this.pairingWindow = void 0;
+			try {
+				for (const key of [...this.sessions.keys()]) this.removeSession(key, "revoked");
+			} finally {
+				this.emitDevicesRemoved(removedIds, "reset");
+			}
 		});
 	}
+	/**
+	* Read fresh persistent-device authorization metadata without changing credentials,
+	* last-seen state, Session state, or the backing store.
+	*/
+	async authorizedDevices() {
+		this.requireInitialized();
+		const snapshot = await this.store.load();
+		this.requireInitialized();
+		const now = this.now();
+		return Object.freeze(snapshot.devices.filter((device) => device.revokedAt === void 0 && device.expiresAt > now).map((device) => Object.freeze({
+			id: device.id,
+			expiresAt: device.expiresAt
+		})));
+	}
 	/** Safe metadata for the loopback administration surface. */
 	listDevices() {
 		this.requireInitialized();
@@ -399,6 +432,14 @@ var AccessController = class {
 			this.sessionEndedListeners.delete(listener);
 		};
 	}
+	/** Subscribe to durably committed removal of persistent-device authorization. */
+	onDevicesRemoved(listener) {
+		if (this.closing) throw new Error("access controller is not available");
+		this.devicesRemovedListeners.add(listener);
+		return () => {
+			this.devicesRemovedListeners.delete(listener);
+		};
+	}
 	/** Stop new operations, drain durable mutations, then clear volatile credentials. */
 	close() {
 		if (this.closeTask !== void 0) return this.closeTask;
@@ -409,9 +450,13 @@ var AccessController = class {
 	async finishClose() {
 		await this.mutation;
 		this.pairingWindow = void 0;
-		for (const key of [...this.sessions.keys()]) this.removeSession(key, "expired");
-		this.sessionEndedListeners.clear();
-		this.initialized = false;
+		try {
+			for (const key of [...this.sessions.keys()]) this.removeSession(key, "expired");
+		} finally {
+			this.sessionEndedListeners.clear();
+			this.devicesRemovedListeners.clear();
+			this.initialized = false;
+		}
 	}
 	/** Bounded volatile-state metrics for tests and local status. */
 	metrics() {
@@ -967,7 +1012,7 @@ const Config = z.object({
 	mobileCompatibilityFile: z.string().hidden(),
 	excludedClientModules: z.array(String).default([]),
 	websocketCompression: z.object({
-		paths: z.array(String).default([]),
+		paths: z.array(String).default(["/api/remote.mux"]),
 		maxMessageBytes: z.natural(),
 		maxQueuedBytes: z.natural(),
 		thresholdBytes: z.natural(),
@@ -1005,6 +1050,8 @@ function integer(value, name, fallback, minimum, maximum) {
 	if (typeof resolved !== "number" || !Number.isSafeInteger(resolved) || resolved < minimum || resolved > maximum) throw new Error(`${name} must be an integer from ${String(minimum)} through ${String(maximum)}`);
 	return resolved;
 }
+/** Live paths the mobile gateway compresses by default; an explicit `paths: []` opts out. */
+const DEFAULT_WEBSOCKET_COMPRESSION_PATHS = Object.freeze(["/api/remote.mux"]);
 function parseWebSocketCompression(raw) {
 	if (raw !== void 0 && (typeof raw !== "object" || raw === null || Array.isArray(raw))) throw new Error("websocketCompression must be an object");
 	const value = raw ?? {};
@@ -1012,7 +1059,7 @@ function parseWebSocketCompression(raw) {
 	const maxQueuedBytes = integer(value.maxQueuedBytes, "websocketCompression.maxQueuedBytes", 67108864, 1024, 268435456);
 	if (maxQueuedBytes < maxMessageBytes + 14) throw new Error("websocketCompression.maxQueuedBytes must cover maxMessageBytes and the frame header");
 	return Object.freeze({
-		paths: Object.freeze(normalizeWebSocketPaths(value.paths ?? [])),
+		paths: Object.freeze(normalizeWebSocketPaths(value.paths ?? DEFAULT_WEBSOCKET_COMPRESSION_PATHS)),
 		maxMessageBytes,
 		maxQueuedBytes,
 		thresholdBytes: integer(value.thresholdBytes, "websocketCompression.thresholdBytes", 1024, 0, maxMessageBytes),
@@ -1500,6 +1547,15 @@ var ClientModulePreferenceStore = class {
 };
 //#endregion
 //#region src/control.ts
+/** A configuration change failed; recovered distinguishes a restored runtime from an unknown configuration. */
+var MobileAccessReconfigurationError = class extends Error {
+	recovered;
+	constructor(recovered, cause) {
+		super(recovered ? "mobile access configuration restored" : "mobile access configuration requires recovery", { cause });
+		this.recovered = recovered;
+		this.name = "MobileAccessReconfigurationError";
+	}
+};
 /** Keeps one runtime aligned with a changing network selection. */
 var FollowingMobileAccessRuntime = class {
 	select;
@@ -1690,6 +1746,36 @@ var MobileAccessGatewayController = class {
 			else await this.disable();
 		});
 	}
+	/** Change configuration with the runtime stopped, without changing its durable enabled preference. */
+	reconfigure(change, restore) {
+		if (this.closing) return Promise.reject(/* @__PURE__ */ new Error("mobile-access control is closing"));
+		return this.enqueue(async () => {
+			if (!this.initialized) throw new Error("mobile-access control is not initialized");
+			const previous = this.runtime;
+			if (previous !== void 0) try {
+				await previous.close();
+			} catch (error) {
+				throw new MobileAccessReconfigurationError(false, error);
+			}
+			this.runtime = void 0;
+			try {
+				const value = await change();
+				if (previous !== void 0) this.runtime = await this.startRuntime();
+				return {
+					value,
+					running: previous !== void 0
+				};
+			} catch (error) {
+				try {
+					await restore();
+					if (previous !== void 0) this.runtime = await this.startRuntime();
+				} catch (restoreError) {
+					throw new MobileAccessReconfigurationError(false, new AggregateError([error, restoreError]));
+				}
+				throw new MobileAccessReconfigurationError(true, error);
+			}
+		});
+	}
 	/** Stop the runtime after earlier transitions without changing the restart preference. */
 	close() {
 		if (this.closeTask !== void 0) return this.closeTask;
@@ -2041,6 +2127,7 @@ function requestPathCategory(path) {
 		default:
 			if (path.startsWith("/api/")) return "/api/*";
 			if (path.startsWith("/mobile-access/extensions/")) return "/mobile-access/extensions/*";
+			if (/^\/mobile-access\/compat-[a-f\d]{64}\.js$/u.test(path)) return "/mobile-access/compat.js";
 			if (path.startsWith("/mobile-access/")) return "/mobile-access/*";
 			return "/*";
 	}
@@ -2518,6 +2605,22 @@ function renderClientModuleRecoveryScript(locale) {
 //#region src/mobile-compat-bootstrap.ts
 const MOBILE_COMPAT_PATH = `${AUTH_PREFIX}/compat.js`;
 /**
+* Name the compatibility bundle by content.
+*
+* The plain path has no revision, so a client that stores it must revalidate on
+* every page load. A content-addressed path can be served `immutable` instead: the
+* URL changes exactly when the bundle does, and a stale URL is refused rather than
+* answered with different bytes.
+*/
+function mobileCompatibilityRevisionPath(digest) {
+	return `${AUTH_PREFIX}/compat-${digest}.js`;
+}
+const MOBILE_COMPAT_REVISION = new RegExp(`^${AUTH_PREFIX}/compat-([a-f\\d]{64})\\.js$`, "u");
+/** The content digest named by a revisioned compatibility path, if this is one. */
+function mobileCompatibilityRevision(pathname) {
+	return MOBILE_COMPAT_REVISION.exec(pathname)?.[1];
+}
+/**
 * Read one attribute out of a tag body.
 *
 * A plain `/\snonce\s*=/` search can be fooled by a value that merely contains the
@@ -2550,17 +2653,19 @@ function ensureMobileGatewayMarker(html) {
 * Returns the HTML unchanged when there is no executable script to anchor to.
 * The bundle supplies missing browser APIs before the page's scripts execute.
 */
-function ensureMobileCompatibility(html) {
+function ensureMobileCompatibility(html, compatPath = MOBILE_COMPAT_PATH) {
 	const comments = commentRanges(html);
 	const isInert = (at) => comments.some(([start, end]) => at >= start && at < end);
 	const scripts = [...html.matchAll(/<script\b[^>]*>/giu)].filter((match) => !isInert(match.index));
 	if (scripts.length === 0) return html;
-	if (scripts.some((match) => attributeValue(match[0], "src") === MOBILE_COMPAT_PATH)) return html;
+	if (scripts.some((match) => {
+		const src = attributeValue(match[0], "src");
+		return src !== void 0 && (src === MOBILE_COMPAT_PATH || mobileCompatibilityRevision(src) !== void 0);
+	})) return html;
 	const first = scripts[0];
 	if (first === void 0) return html;
 	const nonce = attributeValue(first[0], "nonce")?.replace(/["'<>\s]/gu, "") ?? "";
-	const attribute = nonce === "" ? "" : ` nonce="${nonce}"`;
-	const script = `<script src="${MOBILE_COMPAT_PATH}"${attribute}><\/script>`;
+	const script = `<script src="${compatPath}"${nonce === "" ? "" : ` nonce="${nonce}"`}><\/script>`;
 	return `${html.slice(0, first.index)}${script}${html.slice(first.index)}`;
 }
 /** Maximum sizes enforced when reading local extension files. */
@@ -5209,6 +5314,67 @@ function resolveBrowserUiLocale(cookieHeader, acceptLanguage) {
 	return readBrowserUiLocale(cookieHeader) ?? resolveAuthPageLocale(acceptLanguage);
 }
 //#endregion
+//#region src/mobile-push/assets.ts
+const ICON_FILES = Object.freeze({
+	"/mobile-access/push/icon-180.png": "icon-180.png",
+	"/mobile-access/push/icon-192.png": "icon-192.png",
+	"/mobile-access/push/icon-512.png": "icon-512.png"
+});
+const MANIFEST_PATH = "/mobile-access/push/manifest.webmanifest";
+const MANIFEST = JSON.stringify({
+	id: "/",
+	start_url: "/",
+	scope: "/",
+	display: "standalone",
+	icons: [
+		{
+			src: "/mobile-access/push/icon-180.png",
+			sizes: "180x180",
+			type: "image/png"
+		},
+		{
+			src: "/mobile-access/push/icon-192.png",
+			sizes: "192x192",
+			type: "image/png"
+		},
+		{
+			src: "/mobile-access/push/icon-512.png",
+			sizes: "512x512",
+			type: "image/png"
+		}
+	]
+});
+/** Create a fixed-allowlist loader rooted at a package root containing assets/mobile-push. */
+function createMobilePushAssetLoader(packageRoot) {
+	const root = resolve(packageRoot);
+	return async (path) => {
+		if (path === MANIFEST_PATH) return {
+			contentType: "application/manifest+json; charset=utf-8",
+			body: MANIFEST
+		};
+		const filename = ICON_FILES[path];
+		if (!filename) return void 0;
+		return {
+			contentType: "image/png",
+			body: await readFile(join(root, "assets", "mobile-push", filename))
+		};
+	};
+}
+const packageRoot = dirname(createRequire(import.meta.url).resolve("dsh-mobile/package.json"));
+const loadFromPackage = createMobilePushAssetLoader(packageRoot);
+/** Return only a known push manifest/icon; optional packageRoot enables explicit host injection. */
+function mobilePushAsset(path, root = packageRoot) {
+	return root === packageRoot ? loadFromPackage(path) : createMobilePushAssetLoader(root)(path);
+}
+//#endregion
+//#region src/mobile-push/installation-id.ts
+/** Browser-safe installation-id validation shared by the browser controller and the Gateway. */
+const INSTALLATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
+/** True only for a UUID-shaped installation id with an allowed version and variant nibble. */
+function isPushInstallationId(value) {
+	return typeof value === "string" && INSTALLATION_ID.test(value);
+}
+//#endregion
 //#region src/gateway.ts
 const MAX_CONTROL_BODY_BYTES = 16384;
 const MAX_HEADER_BYTES = 16384;
@@ -5220,6 +5386,93 @@ const MOBILE_LAYOUT_MODULE = "@deepseek-ai/dsh-client-ui-layout";
 const MOBILE_LAYOUT_PATH = `${AUTH_PREFIX}/mobile-layout.js`;
 const MOBILE_BOOT_BATCH_PREFIX = `${AUTH_PREFIX}/mobile-boot/`;
 const MOBILE_DOCUMENT_VIEW_HEADER = "x-dsh-mobile-view";
+const MOBILE_PUSH_CONFIG_PATH = `${AUTH_PREFIX}/push/config`;
+const MOBILE_PUSH_SUBSCRIPTION_PATH = `${AUTH_PREFIX}/push/subscription`;
+const MOBILE_PUSH_PREFERENCES_PATH = `${AUTH_PREFIX}/push/preferences`;
+const MOBILE_PUSH_DISABLE_PATH = `${AUTH_PREFIX}/push/disable`;
+const MOBILE_PUSH_TEST_PATH = `${AUTH_PREFIX}/push/test`;
+const MOBILE_PUSH_RESOLVE_PATH = `${AUTH_PREFIX}/push/resolve`;
+const MOBILE_PUSH_PREFERENCE_KEYS = [
+	"question",
+	"plan",
+	"approval",
+	"response",
+	"goal",
+	"failure"
+];
+const DEFAULT_PUSH_PREFERENCES = Object.freeze({
+	question: true,
+	plan: true,
+	approval: true,
+	response: true,
+	goal: true,
+	failure: true
+});
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasOnlyKeys(value, keys) {
+	return Object.keys(value).every((key) => keys.includes(key));
+}
+function exactKeys$1(value, keys) {
+	return Object.keys(value).length === keys.length && hasOnlyKeys(value, keys);
+}
+function parseInstallationId(value) {
+	if (!isPushInstallationId(value)) throw new HttpError(400, "bad_request");
+	return value;
+}
+function parsePushPreferences(value) {
+	if (!isRecord$1(value) || !exactKeys$1(value, MOBILE_PUSH_PREFERENCE_KEYS) || !MOBILE_PUSH_PREFERENCE_KEYS.every((key) => typeof value[key] === "boolean")) throw new HttpError(400, "bad_request");
+	return Object.freeze({
+		question: value.question,
+		plan: value.plan,
+		approval: value.approval,
+		response: value.response,
+		goal: value.goal,
+		failure: value.failure
+	});
+}
+function parseGeneration(value, allowZero) {
+	if (!Number.isSafeInteger(value) || Number(value) < (allowZero ? 0 : 1)) throw new HttpError(400, "bad_request");
+	return Number(value);
+}
+function parsePushEnrollment(value) {
+	if (!exactKeys$1(value, [
+		"installationId",
+		"subscription",
+		"locale",
+		"preferences",
+		"keyFingerprint",
+		"ownerGeneration",
+		"registrationGeneration"
+	]) || !isRecord$1(value.subscription) || !exactKeys$1(value.subscription, ["endpoint", "keys"]) || !isRecord$1(value.subscription.keys) || !exactKeys$1(value.subscription.keys, ["p256dh", "auth"]) || value.locale !== "en" && value.locale !== "zh-CN" && value.locale !== "it" || typeof value.keyFingerprint !== "string" || value.keyFingerprint.length === 0 || value.keyFingerprint.length > 128) throw new HttpError(400, "bad_request");
+	const installationId = parseInstallationId(value.installationId);
+	const preferences = parsePushPreferences(value.preferences);
+	const subscription = value.subscription;
+	if (typeof subscription.endpoint !== "string" || typeof subscription.keys.p256dh !== "string" || typeof subscription.keys.auth !== "string") throw new HttpError(400, "bad_request");
+	return {
+		installationId,
+		subscription,
+		locale: value.locale,
+		preferences,
+		keyFingerprint: value.keyFingerprint,
+		ownerGeneration: parseGeneration(value.ownerGeneration, true),
+		registrationGeneration: parseGeneration(value.registrationGeneration, true)
+	};
+}
+function safePushFailure(error) {
+	if (error instanceof HttpError) return error;
+	const message = error instanceof Error ? error.message : "";
+	if (message.includes("stale push mutation generation")) return new HttpError(409, "stale_generation");
+	if (message.includes("conflict") || message.includes("already owned")) return new HttpError(409, "push_conflict");
+	if (message === "push_unauthorized") return new HttpError(401, "authentication_failed");
+	if (message === "push_test_rate_limited") return new HttpError(429, "rate_limited");
+	if (message === "push_test_unavailable") return new HttpError(503, "push_unavailable");
+	if (message === "push_subscription_invalid" || message === "push_endpoint_invalid" || message.startsWith("invalid subscription")) return new HttpError(400, "bad_request");
+	if (message === "push_unavailable") return new HttpError(503, "push_unavailable");
+	if (message === "push_test_failed") return new HttpError(502, "push_test_failed");
+	return new HttpError(500, "internal_error");
+}
 const MAX_MOBILE_BOOT_BATCH_BYTES = 33554432;
 const MAX_MOBILE_BOOT_ENTRY_BYTES = 8388608;
 /**
@@ -5674,6 +5927,30 @@ function rewriteMobileApplicationPreloads(html, replacements) {
 		return escaped.get(preloadAttribute(tag, "href") ?? "") ?? tag;
 	});
 }
+const MOBILE_PUSH_HEAD_LINKS = [
+	"<link rel=\"manifest\" href=\"/mobile-access/push/manifest.webmanifest\">",
+	"<link rel=\"apple-touch-icon\" sizes=\"180x180\" href=\"/mobile-access/push/icon-180.png\">",
+	"<link rel=\"apple-touch-icon\" sizes=\"192x192\" href=\"/mobile-access/push/icon-192.png\">",
+	"<link rel=\"apple-touch-icon\" sizes=\"512x512\" href=\"/mobile-access/push/icon-512.png\">"
+].join("");
+function replaceDedicatedMobilePushLinks(html) {
+	if (/<head\b[^>]*>/iu.exec(html) === null) return html;
+	const linkPattern = /<link\b[^>]*>/giu;
+	const remove = [];
+	for (const match of html.matchAll(linkPattern)) {
+		const rel = (preloadAttribute(match[0], "rel") ?? "").toLowerCase().split(/\s+/u);
+		if (rel.includes("manifest") || rel.includes("apple-touch-icon")) remove.push({
+			start: match.index,
+			end: match.index + match[0].length
+		});
+	}
+	let cleaned = html;
+	for (const range of remove.reverse()) cleaned = `${cleaned.slice(0, range.start)}${cleaned.slice(range.end)}`;
+	const head = /<head\b[^>]*>/iu.exec(cleaned);
+	if (head?.index === void 0) throw new Error("dedicated mobile document has no head element");
+	const position = head.index + head[0].length;
+	return `${cleaned.slice(0, position)}${MOBILE_PUSH_HEAD_LINKS}${cleaned.slice(position)}`;
+}
 function rewriteMobileIndexWithBatch(html, options = {}) {
 	const plan = parseMobileBootPlan(html, options.excludedClientModules);
 	const projected = projectMobileBootGraph(plan, options);
@@ -5681,7 +5958,7 @@ function rewriteMobileIndexWithBatch(html, options = {}) {
 	const replacement = `${MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP}${transportBootstrap}${mobileCsrfFetchBootstrap(options.csrfCookie ?? "dsh_ma_csrf")}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
 	const rewritten = `${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`;
 	return Object.freeze({
-		html: ensureMobileGatewayMarker(ensureMobileViewport(ensureMobileCompatibility(rewriteMobileApplicationPreloads(rewritten, projected.preloadReplacements)))),
+		html: replaceDedicatedMobilePushLinks(ensureMobileGatewayMarker(ensureMobileViewport(ensureMobileCompatibility(rewriteMobileApplicationPreloads(rewritten, projected.preloadReplacements), options.compatPath)))),
 		batches: projected.batches,
 		graphTransport: projected.graphTransport
 	});
@@ -6141,6 +6418,7 @@ var MobileAccessGateway = class {
 	extraWebSocketPaths;
 	blockedUpgradeLog;
 	onDiscoveryDegraded;
+	pushGateway;
 	access;
 	listenerTlsEnabled;
 	tlsEnabled;
@@ -6188,6 +6466,10 @@ var MobileAccessGateway = class {
 	started = false;
 	closeTask;
 	removeSessionListener;
+	removePushDeviceListener;
+	detachPushOrigin;
+	pushDeviceRevocations = /* @__PURE__ */ new Set();
+	pushTestsInFlight = /* @__PURE__ */ new Set();
 	removeExtensionContentListener;
 	renewFailureLimiter;
 	renewDeviceLimiter;
@@ -6207,13 +6489,14 @@ var MobileAccessGateway = class {
 	httpFailures;
 	apiLatency;
 	upstreamAuthDiagnostics;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog, upstreamAuthLog, apiLatencyLog) {
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog, upstreamAuthLog, apiLatencyLog, pushGateway) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
 		this.extraWebSocketPaths = extraWebSocketPaths;
 		this.blockedUpgradeLog = blockedUpgradeLog;
 		this.onDiscoveryDegraded = onDiscoveryDegraded;
+		this.pushGateway = pushGateway;
 		this.authFailures = new AuthFailureRecorder(authFailureLog);
 		this.httpFailures = new HttpFailureRecorder(httpFailureLog);
 		this.apiLatency = new ApiLatencyRecorder(apiLatencyLog);
@@ -6239,6 +6522,15 @@ var MobileAccessGateway = class {
 		this.renewDeviceLimiter = new BoundedRateLimiter(renewLimit, config.rateLimitWindowMs, config.maxDevices);
 		this.probeFailureLimiter = new BoundedRateLimiter(probeLimit, config.rateLimitWindowMs, config.maxRateLimitKeys);
 		this.probeDeviceLimiter = new BoundedRateLimiter(probeLimit, config.rateLimitWindowMs, config.maxDevices);
+		this.removePushDeviceListener = this.access.onDevicesRemoved((ids) => {
+			const invalidate = this.pushGateway?.invalidateDevices;
+			if (invalidate === void 0) return;
+			const mutation = Promise.resolve().then(() => invalidate(config.stateFile, ids)).catch(() => {
+				process.emitWarning("Unable to remove revoked device notification state", { code: "DSH_MOBILE_PUSH_REVOKE_FAILED" });
+			});
+			this.pushDeviceRevocations.add(mutation);
+			mutation.finally(() => this.pushDeviceRevocations.delete(mutation));
+		});
 		this.removeSessionListener = this.access.onSessionEnded((authorization, reason) => {
 			for (const view of this.mobileDocumentViews.values()) if (view.sessionKey === authorization.sessionKey) this.removeMobileDocumentView(view);
 			if (reason === "revoked") {
@@ -6334,6 +6626,15 @@ var MobileAccessGateway = class {
 			if (address === null || typeof address === "string") throw new Error("gateway listener has no TCP address");
 			this.listenerPort = address.port;
 			this.policy = new RequestTrustPolicy(this.config.authorities, address.port, this.config.allowedCidrs, this.tlsEnabled);
+			if (this.pushGateway?.attachOrigin !== void 0) try {
+				this.detachPushOrigin = this.pushGateway.attachOrigin({
+					scopeId: this.config.stateFile,
+					origin: this.address().origin,
+					authorizedDevices: () => this.access.authorizedDevices()
+				});
+			} catch {
+				process.emitWarning("Mobile push origin attachment failed; Mobile access remains available", { code: "DSH_MOBILE_PUSH_ORIGIN_ATTACH_FAILED" });
+			}
 			if (this.config.discovery) await this.startDiscovery(address.port);
 			await this.pollLegacyCustomChanges();
 			this.extensionChangeTimer = setInterval(() => {
@@ -6465,6 +6766,10 @@ var MobileAccessGateway = class {
 		}), "utf8");
 	}
 	async closeFailedStart() {
+		const detachPushOrigin = this.detachPushOrigin;
+		this.detachPushOrigin = void 0;
+		detachPushOrigin?.();
+		this.removePushDeviceListener();
 		if (this.extensionChangeTimer !== void 0) clearInterval(this.extensionChangeTimer);
 		this.extensionChangeTimer = void 0;
 		this.removeExtensionContentListener();
@@ -6696,10 +7001,111 @@ var MobileAccessGateway = class {
 			}, this.tlsEnabled);
 		});
 	}
+	async requireFreshPushOwner(authorization) {
+		const owner = {
+			scopeId: this.config.stateFile,
+			deviceId: authorization.deviceId,
+			origin: this.address().origin
+		};
+		if (!(await this.access.authorizedDevices()).some((device) => device.id === owner.deviceId && device.expiresAt > Date.now())) throw new HttpError(401, "authentication_failed");
+		return owner;
+	}
+	async handleMobilePushRequest(target, request, response, authorization) {
+		const method = request.method ?? "";
+		if (target.decodedPathname === MOBILE_PUSH_CONFIG_PATH) {
+			if (method !== "GET") throw new HttpError(405, "method_not_allowed");
+			const params = new URLSearchParams(target.search);
+			const values = params.getAll("installationId");
+			if (params.size !== 1 || values.length !== 1) throw new HttpError(400, "bad_request");
+			const installationId = parseInstallationId(values[0]);
+			const owner = await this.requireFreshPushOwner(authorization);
+			sendJson(response, 200, this.pushGateway === void 0 ? {
+				available: false,
+				installationId,
+				ownerGeneration: 0,
+				registrationGeneration: 0,
+				status: "disabled",
+				preferences: DEFAULT_PUSH_PREFERENCES
+			} : await this.pushGateway.config(owner, installationId).catch((error) => {
+				throw safePushFailure(error);
+			}), this.tlsEnabled);
+			return;
+		}
+		if (method !== "POST" || target.search !== "") throw new HttpError(method === "POST" ? 400 : 405, method === "POST" ? "bad_request" : "method_not_allowed");
+		const owner = await this.requireFreshPushOwner(authorization);
+		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+		const service = this.pushGateway;
+		if (service === void 0) throw new HttpError(503, "push_unavailable");
+		try {
+			if (target.decodedPathname === MOBILE_PUSH_SUBSCRIPTION_PATH) {
+				const enrollment = parsePushEnrollment(body);
+				sendJson(response, 200, await service.enroll(owner, enrollment), this.tlsEnabled);
+				return;
+			}
+			if (target.decodedPathname === MOBILE_PUSH_PREFERENCES_PATH) {
+				if (!exactKeys$1(body, [
+					"installationId",
+					"preferences",
+					"ownerGeneration",
+					"registrationGeneration"
+				])) throw new HttpError(400, "bad_request");
+				const installationId = parseInstallationId(body.installationId);
+				const preferences = parsePushPreferences(body.preferences);
+				const guard = {
+					ownerGeneration: parseGeneration(body.ownerGeneration, true),
+					registrationGeneration: parseGeneration(body.registrationGeneration, true)
+				};
+				sendJson(response, 200, await service.preferences(owner, installationId, preferences, guard), this.tlsEnabled);
+				return;
+			}
+			if (target.decodedPathname === MOBILE_PUSH_DISABLE_PATH) {
+				if (!exactKeys$1(body, body.ifGeneration === void 0 ? ["installationId"] : ["installationId", "ifGeneration"])) throw new HttpError(400, "bad_request");
+				const installationId = parseInstallationId(body.installationId);
+				const ifGeneration = body.ifGeneration === void 0 ? void 0 : parseGeneration(body.ifGeneration, false);
+				await service.disable(owner, installationId, ifGeneration);
+				sendJson(response, 200, { disabled: true }, this.tlsEnabled);
+				return;
+			}
+			if (target.decodedPathname === MOBILE_PUSH_TEST_PATH) {
+				if (!exactKeys$1(body, ["installationId"])) throw new HttpError(400, "bad_request");
+				const installationId = parseInstallationId(body.installationId);
+				const key = JSON.stringify([
+					owner.scopeId,
+					owner.deviceId,
+					owner.origin,
+					installationId
+				]);
+				if (this.pushTestsInFlight.has(key)) throw new HttpError(429, "rate_limited");
+				this.pushTestsInFlight.add(key);
+				try {
+					await service.test(owner, installationId);
+				} finally {
+					this.pushTestsInFlight.delete(key);
+				}
+				sendJson(response, 200, { accepted: true }, this.tlsEnabled);
+				return;
+			}
+			if (target.decodedPathname === MOBILE_PUSH_RESOLVE_PATH) {
+				if (!exactKeys$1(body, ["reference"]) || typeof body.reference !== "string" || body.reference.length === 0 || body.reference.length > 256 || !/^[A-Za-z0-9_-]+$/u.test(body.reference)) throw new HttpError(400, "bad_request");
+				const resolved = await service.resolve(owner, body.reference);
+				if (resolved === void 0) throw new HttpError(404, "not_found");
+				sendJson(response, 200, resolved, this.tlsEnabled);
+				return;
+			}
+			throw new HttpError(404, "not_found");
+		} catch (error) {
+			if (error instanceof HttpError) throw error;
+			throw safePushFailure(error);
+		}
+	}
 	async handleLogout(request, response) {
 		await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 		const authorization = this.authorize(request);
 		this.requireCsrf(request, authorization);
+		const owner = await this.requireFreshPushOwner(authorization);
+		if (this.pushGateway !== void 0) await this.pushGateway.logout(owner).catch((error) => {
+			throw safePushFailure(error);
+		});
 		this.access.logout(authorization);
 		response.setHeader("Set-Cookie", [
 			cookie(SESSION_COOKIE, "", {
@@ -6741,6 +7147,21 @@ var MobileAccessGateway = class {
 		assertExternalTrust(request, policy, isMutation);
 		if (target.decodedPathname === "/api/mobile-access" || target.decodedPathname.startsWith(`/api/mobile-access/`)) throw new HttpError(404, "not_found");
 		if (request.method === "TRACE" || request.method === "CONNECT") throw new HttpError(405, "method_not_allowed");
+		if (target.search === "" && (request.method === "GET" || request.method === "HEAD")) {
+			const asset = await mobilePushAsset(target.decodedPathname);
+			if (asset !== void 0) {
+				const body = Buffer.from(asset.body);
+				setSecurityHeaders(response, this.tlsEnabled);
+				response.writeHead(200, {
+					"Content-Type": asset.contentType,
+					"Content-Length": body.byteLength,
+					"Cache-Control": "public, max-age=3600"
+				});
+				if (request.method === "HEAD") response.end();
+				else response.end(body);
+				return;
+			}
+		}
 		if (target.search === "" && request.method === "GET" && target.decodedPathname === `/mobile-access/health`) {
 			sendJson(response, 200, { ok: true }, this.tlsEnabled);
 			return;
@@ -6832,8 +7253,17 @@ var MobileAccessGateway = class {
 		const computerImage = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-image`;
 		const workspaceDirectories = (request.method === "GET" || request.method === "POST") && target.decodedPathname === `/mobile-access/workspace-directories`;
 		const clientModules = target.decodedPathname === `${AUTH_PREFIX}/client-modules`;
+		const mobilePushRoute = [
+			MOBILE_PUSH_CONFIG_PATH,
+			MOBILE_PUSH_SUBSCRIPTION_PATH,
+			MOBILE_PUSH_PREFERENCES_PATH,
+			MOBILE_PUSH_DISABLE_PATH,
+			MOBILE_PUSH_TEST_PATH,
+			MOBILE_PUSH_RESOLVE_PATH
+		].includes(target.decodedPathname);
 		const requestedExtension = extensionTarget(target.decodedPathname);
 		const requestedMobileBootBatch = mobileBootBatchKey(target.decodedPathname);
+		const requestedCompatRevision = mobileCompatibilityRevision(target.decodedPathname);
 		const customAsset = request.method === "GET" || request.method === "HEAD" ? target.decodedPathname === `/mobile-access/custom.css` ? {
 			file: this.config.customCssFile,
 			contentType: "text/css; charset=utf-8",
@@ -6850,8 +7280,13 @@ var MobileAccessGateway = class {
 			file: this.config.mobileCompatibilityFile,
 			contentType: "text/javascript; charset=utf-8",
 			fallback: void 0
-		} : void 0 : void 0;
-		if (customAsset === void 0 && requestedMobileBootBatch === void 0 && !computerImages && !computerImage && !workspaceDirectories && !clientModules && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
+		} : requestedCompatRevision === void 0 ? void 0 : {
+			file: this.config.mobileCompatibilityFile,
+			contentType: "text/javascript; charset=utf-8",
+			fallback: void 0,
+			digest: requestedCompatRevision
+		} : void 0;
+		if (customAsset === void 0 && requestedMobileBootBatch === void 0 && !computerImages && !computerImage && !workspaceDirectories && !clientModules && !mobilePushRoute && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
 		if (![
 			"GET",
 			"HEAD",
@@ -6888,6 +7323,10 @@ var MobileAccessGateway = class {
 			this.authFailures.record("csrf", mapError(error).status, request, target.decodedPathname, policy.canonicalOrigin(request.headers.origin), authorization);
 			throw error;
 		}
+		if (mobilePushRoute) {
+			await this.handleMobilePushRequest(target, request, response, authorization);
+			return;
+		}
 		if (clientModules) {
 			if (target.search !== "") throw new HttpError(400, "bad_request");
 			if (request.method !== "GET" && request.method !== "POST") throw new HttpError(405, "method_not_allowed");
@@ -6953,23 +7392,32 @@ var MobileAccessGateway = class {
 				}
 				if (body.byteLength > 262144) throw new HttpError(413, "payload_too_large");
 				operation.signal.throwIfAborted();
-				const etag = `"${createHash("sha256").update(body).digest("hex")}"`;
+				const compressible = isCompressibleContentType(customAsset.contentType) && body.byteLength >= MIN_COMPRESSIBLE_BYTES;
+				const compressed = compressible && acceptsGzip(request.headers["accept-encoding"]);
+				const digest = createHash("sha256").update(body).digest("hex");
+				if (customAsset.digest !== void 0 && customAsset.digest !== digest) throw new HttpError(404, "not_found");
+				const etag = compressed ? `"${digest}-gzip"` : `"${digest}"`;
 				const responseHeaders = { ETag: etag };
 				if (mtime !== void 0) responseHeaders["Last-Modified"] = mtime.toUTCString();
+				if (compressible) responseHeaders.Vary = "Accept-Encoding";
 				setSecurityHeaders(response, this.tlsEnabled);
-				response.setHeader("Cache-Control", "private, no-cache");
+				response.setHeader("Cache-Control", customAsset.digest === void 0 ? "private, no-cache" : "private, max-age=31536000, immutable");
 				if (matchesIfNoneMatch(headerValue(request.headers, "if-none-match"), etag)) {
 					response.writeHead(304, responseHeaders);
 					response.end();
 					return;
 				}
+				operation.signal.throwIfAborted();
+				const payload = compressed ? await gzipBuffer(body) : body;
+				operation.signal.throwIfAborted();
 				response.writeHead(200, {
 					...responseHeaders,
+					...compressed ? { "Content-Encoding": "gzip" } : {},
 					"Content-Type": customAsset.contentType,
-					"Content-Length": body.byteLength
+					"Content-Length": payload.byteLength
 				});
 				if (request.method === "HEAD") response.end();
-				else response.end(body);
+				else response.end(payload);
 				return;
 			} finally {
 				operation.release();
@@ -7731,10 +8179,12 @@ var MobileAccessGateway = class {
 					const cookies = browserAuthCookies(request.headers.cookie);
 					const csrfCookie = this.tlsEnabled && cookies.has("__Host-dsh_ma_session") ? HOST_CSRF_COOKIE : CSRF_COOKIE;
 					const viewId = randomBytes(16).toString("hex");
+					const compatPath = await this.mobileCompatibilityUrl(operation.signal);
 					const rewritten = rewriteMobileIndexWithBatch(html, {
 						...options,
 						csrfCookie,
-						viewId
+						viewId,
+						compatPath
 					});
 					operation.signal.throwIfAborted();
 					for (const batch of rewritten.batches) this.rememberMobileBootBatch(batch);
@@ -7956,6 +8406,28 @@ var MobileAccessGateway = class {
 			await upstreamClosed;
 		}
 	}
+	/**
+	* Name the compatibility bundle by content, so a reload asks for it by revision.
+	*
+	* The digest is computed from the bytes on every page load rather than memoised on
+	* a modification-time signature: an edit that keeps the length and restores the
+	* timestamp (a build step preserving mtime, a same-size patch) is invisible to such
+	* a signature, and the document would then name a revision the route refuses with
+	* `404` — losing the shim exactly on the old WebViews it exists for. Hashing the
+	* ~78 KB bundle costs far less than the page load it belongs to.
+	*
+	* A missing bundle keeps the plain path, where the route reports the usual `503`
+	* instead of handing the document a URL that cannot exist.
+	*/
+	async mobileCompatibilityUrl(signal) {
+		try {
+			const body = await readFile(this.config.mobileCompatibilityFile, { signal });
+			return mobileCompatibilityRevisionPath(createHash("sha256").update(body).digest("hex"));
+		} catch (error) {
+			if (signal.aborted) throw error;
+			return MOBILE_COMPAT_PATH;
+		}
+	}
 	async serveMobileBootBatch(key, request, response, authorization) {
 		if (request.method !== "GET" && request.method !== "HEAD") throw new HttpError(405, "method_not_allowed");
 		const stored = this.mobileBootBatches.get(key);
@@ -8682,6 +9154,10 @@ var MobileAccessGateway = class {
 	}
 	async performClose() {
 		this.closing = true;
+		const detachPushOrigin = this.detachPushOrigin;
+		this.detachPushOrigin = void 0;
+		detachPushOrigin?.();
+		this.removePushDeviceListener();
 		const failures = [];
 		const directoryDrain = Promise.all(this.workspaceDirectoryTasks);
 		for (const controller of this.clientModuleOperations) controller.abort();
@@ -8733,6 +9209,7 @@ var MobileAccessGateway = class {
 			failures.push(error);
 		}
 		await accessClose;
+		await Promise.allSettled(this.pushDeviceRevocations);
 		await Promise.allSettled(this.clientModuleTasks);
 		await Promise.allSettled(this.clientModuleRevocations);
 		await Promise.allSettled(this.mobileGraphTasks);
@@ -11391,6 +11868,11 @@ async function saveManagedTrustedNetworks(setupFile, values) {
 	await restrictPrivateFile(setupFile);
 	return next;
 }
+/** Persist an existing managed setup without resetting its identity, paths or extra trusted networks. */
+async function saveManagedSetup(setupFile, setup) {
+	const validated = parseManagedSetup(setup);
+	await atomicWrite(setupFile, `${JSON.stringify(validated, null, 2)}\n`);
+}
 function privateIpv4(value) {
 	const parts = value.split(".").map(Number);
 	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
@@ -17209,6 +17691,44 @@ async function uninstallVps(serverAddress, uninstall, input, options = {}) {
 	});
 }
 //#endregion
+//#region src/lan-rebind.ts
+/** An unreadable setup is rejected before stopping the listener or replacing any file. */
+var ManagedLanConfigurationError = class extends Error {
+	constructor(cause) {
+		super("managed LAN configuration is unreadable", { cause });
+		this.name = "ManagedLanConfigurationError";
+	}
+};
+/** Rebind an existing listener; callers serialize this call with all other setup-file writes. */
+async function rebindManagedLan(options) {
+	let previous;
+	try {
+		previous = parseManagedSetup(JSON.parse(await readFile(options.setupFile, "utf8")));
+		await readManagedCa(previous.tls);
+	} catch (error) {
+		throw new ManagedLanConfigurationError(error);
+	}
+	const result = await options.controller.reconfigure(async () => {
+		const next = Object.freeze({
+			...previous,
+			networkInterface: options.network.name
+		});
+		await refreshManagedServerCertificate(next, options.network.address);
+		await saveManagedSetup(options.setupFile, next);
+		options.publish(next);
+		return next;
+	}, async () => {
+		await saveManagedSetup(options.setupFile, previous);
+		options.publish(previous);
+		const network = options.selectPrevious?.(previous) ?? selectLanNetwork(void 0, previous.networkInterface);
+		await refreshManagedServerCertificate(previous, network.address);
+	});
+	return {
+		setup: result.value,
+		running: result.running
+	};
+}
+//#endregion
 //#region src/funnel.ts
 const MAX_PROTOCOL_LINE_BYTES = 16384;
 const FUNNEL_START_TIMEOUT_MS = 45e3;
@@ -19771,80 +20291,2969 @@ async function installMobileFileLogger(ctx, stateDirectory, options = {}) {
 	return file;
 }
 //#endregion
-//#region src/installation-id.ts
-const INSTALLATION_ID_PATTERN = /^[a-f0-9]{64}\n$/u;
-const INSTALLATION_ID_BYTES = 65;
-async function readInstallationId(file) {
-	const entry = await lstat(file);
-	if (!entry.isFile() || entry.isSymbolicLink() || entry.size !== INSTALLATION_ID_BYTES) throw new Error("installation_id_invalid");
-	const contents = await readFile(file, "utf8");
-	if (!INSTALLATION_ID_PATTERN.test(contents)) throw new Error("installation_id_invalid");
-	await restrictPrivateFile(file);
-	return contents.slice(0, -1);
-}
-/** Keep one random plugin identity across setup changes, restarts, and FRP resets; creation requires hard-link support in the state directory. */
-async function loadOrCreateInstallationId(file) {
-	if (!isAbsolute(file)) throw new Error("installation ID path must be absolute");
-	const target = resolve(file);
-	const directory = dirname(target);
-	await ensureManagedDirectory(directory, directory, "installation_id");
-	try {
-		return await readInstallationId(target);
-	} catch (error) {
-		if (error.code !== "ENOENT") throw error;
+//#region src/mobile-push/contracts.ts
+const OUTCOME_COALESCE_MS = 1e3;
+const ATTENTION_TTL_MS = 3e5;
+const OUTCOME_TTL_MS = 18e5;
+const ATTEMPT_TIMEOUT_MS = 1e4;
+//#endregion
+//#region src/mobile-push/requests.ts
+var RequestLifetimes = class {
+	#records = /* @__PURE__ */ new Map();
+	#byCall = /* @__PURE__ */ new Map();
+	#clock;
+	#emit;
+	#ctx;
+	#closed = false;
+	constructor(ctx, emit, clock = Date.now) {
+		this.#ctx = ctx;
+		this.#emit = emit;
+		this.#clock = clock;
+	}
+	observeQuestion(agent, request, next) {
+		const question = Array.isArray(request?.questions) ? request.questions[0] : void 0;
+		if (!question || !request?.signal?.aborted) {
+			const intent = question?.intent;
+			const category = intent?.kind === "plan-review" ? "plan" : "question";
+			const callId = intent?.kind === "plan-review" && typeof intent.callId === "string" ? intent.callId : typeof request?.wait?.callId === "string" ? request.wait.callId : void 0;
+			const sessionId = String(agent?.id ?? request?.agent?.id ?? "");
+			const rec = sessionId ? this.#record(agent, sessionId, category, callId, request?.signal, ATTENTION_TTL_MS, request?.wait?.timed === true) : void 0;
+			if (rec) this.#arm(rec);
+			return Promise.resolve().then(next).then((result) => {
+				if (rec && !(rec.timed && result && typeof result === "object" && result.pending === true)) {
+					rec.settled = true;
+					rec.live = false;
+				}
+				return result;
+			}, (error) => {
+				if (rec && !(rec.timed && ["NO_PROVIDER", "ASK_TIMED_OUT"].includes(error?.code))) {
+					rec.settled = true;
+					rec.live = false;
+				}
+				throw error;
+			});
+		}
+		return Promise.resolve().then(next);
 	}
-	const temporary = join(directory, `.${basename(target)}.${randomBytes(12).toString("hex")}.tmp`);
-	let created = false;
-	let failure;
-	try {
-		await assertManagedParents(directory, temporary, "installation_id");
-		const handle = await open(temporary, "wx", 384);
-		created = true;
-		let writeFailure;
+	observeApproval(agent, request, next) {
+		const sessionId = String(agent?.id ?? request?.agent?.id ?? "");
+		const rec = !request?.signal?.aborted && sessionId ? this.#record(agent, sessionId, "approval", request?.callId, request?.signal, ATTENTION_TTL_MS) : void 0;
+		if (rec) this.#arm(rec);
+		return Promise.resolve().then(next).finally(() => {
+			if (rec) {
+				rec.settled = true;
+				rec.live = false;
+			}
+		});
+	}
+	queuedReply(sessionId, callId) {
+		const rec = this.#byCall.get(`${sessionId}\u0000${callId}`);
+		if (rec) this.#invalidate(rec, true);
+	}
+	invalidateSession(sessionId, options = {}) {
+		for (const rec of this.#records.values()) if (rec.source.sessionId === sessionId && !(options.preserveTimed && rec.timed)) this.#invalidate(rec, false);
+	}
+	reconcileLive(source) {
+		if (source.expiresAt <= this.#clock()) return "stale";
+		const rec = this.#records.get(source.sourceId);
+		if (!rec) return "unverifiable";
+		if (this.#closed || rec.settled || rec.queuedReply || !rec.live) return "stale";
+		const timed = this.#callForSource(source);
+		if (rec.timed && !timed) return "unverifiable";
+		if (!timed) return "eligible";
+		const state = this.#projection(source.sessionId);
+		const view = state?.questions ?? state;
+		if ((Array.isArray(view?.active) ? view.active : []).some((item) => item.callId === timed && (item.state === "open" || item.state === "continued"))) return "eligible";
+		if (rec.timed) return "stale";
+		if ((Array.isArray(view?.settled) ? view.settled : []).some((item) => item.callId === timed)) return "stale";
+		return "eligible";
+	}
+	eligible(source) {
+		return this.reconcileLive(source) === "eligible";
+	}
+	/** Retires expired records at their original TTL; returns how many were removed. */
+	sweep(now = this.#clock()) {
+		let removed = 0;
+		for (const [sourceId, rec] of this.#records) {
+			if (rec.source.expiresAt > now) continue;
+			this.#retire(rec);
+			this.#records.delete(sourceId);
+			removed += 1;
+		}
+		return removed;
+	}
+	close() {
+		this.#closed = true;
+		for (const rec of this.#records.values()) this.#retire(rec);
+		this.#records.clear();
+		this.#byCall.clear();
+	}
+	#projection(sessionId) {
+		const session = this.#ctx.agents?.get?.(sessionId)?.session ?? { id: sessionId };
+		return this.#ctx.sessionProjections?.stateOf?.(session, "userQuestions");
+	}
+	#retire(rec) {
+		if (rec.timer) {
+			clearTimeout(rec.timer);
+			rec.timer = void 0;
+		}
+		rec.disposeAbort?.();
+		rec.disposeAbort = void 0;
+		if (typeof rec.source.callId === "string") {
+			const key = `${rec.source.sessionId}\u0000${rec.source.callId}`;
+			if (this.#byCall.get(key) === rec) this.#byCall.delete(key);
+		}
+	}
+	#invalidate(rec, queuedReply) {
+		rec.settled = true;
+		rec.live = false;
+		if (queuedReply) rec.queuedReply = true;
+		if (rec.timer) clearTimeout(rec.timer);
+		rec.timer = void 0;
+	}
+	#callForSource(source) {
+		return source.callId;
+	}
+	#record(agent, sessionId, category, callId, signal, ttl, timed = false) {
+		const createdAt = this.#clock();
+		const sourceId = `request:${sessionId}:${category}:${typeof callId === "string" && callId ? callId : `dispatch-${crypto.randomUUID()}`}`;
+		const existing = this.#records.get(sourceId);
+		if (existing && existing.source.expiresAt > createdAt) return existing;
+		if (existing) this.#retire(existing);
+		let turn;
 		try {
-			await handle.writeFile(`${randomBytes(32).toString("hex")}\n`, "utf8");
-		} catch (error) {
-			writeFailure = error;
-			throw error;
-		} finally {
+			const boundary = this.#ctx.sessionProjections?.stateOf?.(agent.session ?? agent, "turnBoundary");
+			if (boundary?.openTurnStartSeq != null && Number.isSafeInteger(boundary?.lastTurn)) turn = boundary.lastTurn;
+		} catch {}
+		const rec = {
+			source: {
+				sourceId,
+				sessionId,
+				targetSessionId: this.#root(agent).id,
+				category,
+				createdAt,
+				expiresAt: createdAt + ttl,
+				lifetime: "live",
+				...turn === void 0 ? {} : { turn },
+				...typeof callId === "string" ? { callId } : {}
+			},
+			settled: false,
+			queuedReply: false,
+			timed,
+			live: true
+		};
+		this.#records.set(sourceId, rec);
+		if (typeof callId === "string") this.#byCall.set(`${sessionId}\u0000${callId}`, rec);
+		const onAbort = () => {
+			if (rec.timed && (signal?.reason)?.code === "ASK_TIMED_OUT") return;
+			rec.settled = true;
+			rec.live = false;
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+		rec.disposeAbort = () => {
 			try {
-				await handle.close();
-			} catch (closeError) {
-				if (writeFailure !== void 0) throw new AggregateError([writeFailure, closeError], "installation ID candidate write and close failed");
-				throw closeError;
-			}
+				signal?.removeEventListener("abort", onAbort);
+			} catch {}
+		};
+		return rec;
+	}
+	#root(agent) {
+		const registry = this.#ctx.agents;
+		if (!registry?.isOwnedBy || !registry.get || !registry.list) return agent;
+		let current = agent;
+		for (let count = 0; count < 64; count++) {
+			const parent = registry.list().find((candidate) => registry.isOwnedBy?.(current.id, candidate));
+			if (!parent) break;
+			current = parent;
+		}
+		return current;
+	}
+	#arm(rec) {
+		if (rec.timer) return;
+		rec.timer = setTimeout(() => {
+			rec.timer = void 0;
+			if (this.#closed || rec.settled || rec.queuedReply) return;
+			this.#emit(rec.source);
+		}, 250);
+	}
+};
+//#endregion
+//#region src/mobile-push/outcomes.ts
+const isCompletedGoalPhase = (phase) => phase === "complete";
+var OutcomeLifetimes = class {
+	#ctx;
+	#emit;
+	#pending = /* @__PURE__ */ new Map();
+	#goals = /* @__PURE__ */ new Map();
+	#blockedTurns = /* @__PURE__ */ new Map();
+	#sent = /* @__PURE__ */ new Map();
+	#closed = false;
+	constructor(ctx, emit) {
+		this.#ctx = ctx;
+		this.#emit = emit;
+	}
+	onGoal(payload) {
+		const agent = payload?.agent;
+		const change = payload?.change;
+		const goal = change?.goal;
+		const op = change?.operation;
+		if (!agent?.id || !change) return;
+		this.#cancel(agent.id);
+		if (op === "clear" || !goal) {
+			this.#goals.delete(agent.id);
+			return;
 		}
-		await restrictPrivateFile(temporary);
-		await assertManagedParents(directory, target, "installation_id");
-		try {
-			await link(temporary, target);
-		} catch (error) {
-			if (error.code !== "EEXIST") throw new Error("installation ID publication failed; the state filesystem must support hard links", { cause: error });
+		const id = String(goal.id ?? change?.ref?.id ?? "");
+		const revision = Number(goal.revision ?? change?.ref?.revision);
+		if (!id || !Number.isFinite(revision)) return;
+		const record = {
+			id,
+			revision,
+			phase: String(goal.phase ?? op ?? "")
+		};
+		this.#goals.set(agent.id, record);
+		if (op === "block") {
+			const boundary = this.#ctx.sessionProjections?.stateOf?.(agent.session ?? agent, "turnBoundary");
+			const turn = boundary?.openTurnStartSeq != null && Number.isSafeInteger(boundary?.lastTurn) ? boundary.lastTurn : void 0;
+			if (turn !== void 0) this.#blockedTurns.set(agent.id, {
+				id,
+				revision,
+				turn
+			});
+			this.#schedule(agent, "goal", turn, {
+				id,
+				revision
+			});
 		}
-		return await readInstallationId(target);
-	} catch (error) {
-		failure = error;
-		throw error;
-	} finally {
-		if (created) try {
-			await assertManagedParents(directory, temporary, "installation_id");
-			await unlink(temporary);
-		} catch (cleanupError) {
-			if (failure !== void 0) throw new AggregateError([failure, cleanupError], "installation ID publication and temporary cleanup failed");
-			throw cleanupError;
+	}
+	onSessionEvent(session, event) {
+		const type = event?.type;
+		const data = event?.data ?? event;
+		if (!session?.id || !data) return;
+		const id = session.id;
+		if (type === "agent/inbox/inserted" || type === "agent/inbox/spliced" || type === "turn/start") {
+			this.#cancel(id);
+			return;
 		}
+		if (type !== "turn/end") return;
+		const reason = data.reason?.kind;
+		const closesBlockedTurn = this.#blockedTurns.get(id)?.turn === data.turn;
+		if (closesBlockedTurn) this.#blockedTurns.delete(id);
+		if (closesBlockedTurn && [
+			"completed",
+			"blocked",
+			"error"
+		].includes(reason)) return;
+		if (reason === "completed") {
+			const observedGoal = this.#goals.get(id);
+			const activeGoal = observedGoal?.phase === "active" ? observedGoal : this.#projectedActiveGoal(session);
+			if (observedGoal && isCompletedGoalPhase(observedGoal.phase)) {
+				this.#schedule(session, "goal", data.turn, {
+					id: observedGoal.id,
+					revision: observedGoal.revision
+				});
+				this.#goals.delete(id);
+			} else if (!activeGoal) this.#schedule(session, "response", data.turn);
+		} else if (reason === "blocked" || reason === "error") this.#schedule(session, "failure", data.turn);
 	}
-}
+	#projectedActiveGoal(session) {
+		const goal = (this.#ctx.sessionProjections?.stateOf?.(session.session ?? session, "goal"))?.current?.goal;
+		if (!goal || typeof goal.id !== "string" || !Number.isSafeInteger(goal.revision) || goal.phase !== "active") return void 0;
+		return {
+			id: goal.id,
+			revision: goal.revision,
+			phase: "active"
+		};
+	}
+	onAgentError(_payload) {}
+	reconcileLive(source) {
+		if (source.expiresAt <= Date.now()) return "stale";
+		if (this.#closed) return "stale";
+		const candidate = this.#pending.get(source.sourceId);
+		if (!candidate) return "unverifiable";
+		return candidate.active ? "eligible" : "stale";
+	}
+	eligible(source) {
+		return this.reconcileLive(source) === "eligible";
+	}
+	/** Retires expired candidates and sent-dedupe records at their original TTL; returns how many were removed. */
+	sweep(now = Date.now()) {
+		let removed = 0;
+		for (const [id, candidate] of this.#pending) {
+			if (candidate.source.expiresAt > now) continue;
+			if (candidate.timer) {
+				clearTimeout(candidate.timer);
+				candidate.timer = void 0;
+			}
+			this.#pending.delete(id);
+			removed += 1;
+		}
+		for (const [id, expiresAt] of this.#sent) {
+			if (expiresAt > now) continue;
+			this.#sent.delete(id);
+			removed += 1;
+		}
+		return removed;
+	}
+	close() {
+		this.#closed = true;
+		for (const item of this.#pending.values()) if (item.timer) clearTimeout(item.timer);
+		this.#pending.clear();
+		this.#blockedTurns.clear();
+		this.#goals.clear();
+		this.#sent.clear();
+	}
+	#schedule(agent, category, turn, goal) {
+		if (this.#closed || this.#isRuntimeChild(agent)) return;
+		const createdAt = Date.now();
+		const goalKey = goal ? `${goal.id}:${goal.revision}` : "";
+		const sourceId = `${category}:${agent.id}:${turn ?? "goal"}:${goalKey}`;
+		if (this.#sent.has(sourceId) || this.#pending.has(sourceId)) return;
+		const source = {
+			sourceId,
+			sessionId: agent.id,
+			targetSessionId: this.#root(agent).id,
+			category,
+			createdAt,
+			expiresAt: createdAt + OUTCOME_TTL_MS,
+			lifetime: "committed",
+			...turn === void 0 ? {} : { turn },
+			...goal === void 0 ? {} : { goal }
+		};
+		const candidate = {
+			source,
+			active: true
+		};
+		candidate.timer = setTimeout(() => {
+			candidate.timer = void 0;
+			if (this.#closed || !candidate.active) return;
+			this.#sent.set(sourceId, source.expiresAt);
+			this.#emit(source);
+		}, OUTCOME_COALESCE_MS);
+		this.#pending.set(sourceId, candidate);
+	}
+	#cancel(sessionId) {
+		this.#blockedTurns.delete(sessionId);
+		for (const [id, candidate] of this.#pending) {
+			if (candidate.source.sessionId !== sessionId) continue;
+			clearTimeout(candidate.timer);
+			candidate.active = false;
+			this.#pending.delete(id);
+		}
+	}
+	#isRuntimeChild(agent) {
+		const registry = this.#ctx.agents;
+		if (!registry?.isOwnedBy || !registry.list) return false;
+		return registry.list().some((owner) => registry.isOwnedBy?.(agent.id, owner));
+	}
+	#root(agent) {
+		const registry = this.#ctx.agents;
+		if (!registry?.isOwnedBy || !registry.list) return agent;
+		let current = agent;
+		for (let count = 0; count < 64; count++) {
+			const owner = registry.list().find((candidate) => registry.isOwnedBy?.(current.id, candidate));
+			if (!owner) return current;
+			current = owner;
+		}
+		return current;
+	}
+};
 //#endregion
-//#region src/gateway-identity.ts
-/**
-* Attach the authenticated installation identity while retaining existing entry identity rules.
-* @param config - Validated gateway configuration containing the legacy identity.
-* @param installationId - Confirmed random identity read from this installation's state.
-* @param explicitIdentity - Whether the operator supplied the gateway identity.
-* @returns Configuration retaining certificate/operator identities or the new and legacy public identities.
-*/
-function withInstallationIdentity(config, installationId, explicitIdentity) {
+//#region src/mobile-push/reconcile.ts
+const TURN_REASONS = [
+	"completed",
+	"error",
+	"blocked",
+	"aborted",
+	"max-tokens",
+	"interrupted",
+	"forked",
+	"other"
+];
+const GOAL_OPERATIONS = [
+	"create",
+	"edit",
+	"pause",
+	"resume",
+	"complete",
+	"block",
+	"clear"
+];
+const GOAL_PHASES = [
+	"active",
+	"paused",
+	"blocked",
+	"complete",
+	"cleared"
+];
+const turnEndSchema = z$1.object({
+	turn: z$1.number().int().nonnegative(),
+	reason: z$1.enum(TURN_REASONS)
+}).strict();
+const goalChangeSchema = z$1.object({
+	id: z$1.string().min(1),
+	revision: z$1.number().int().nonnegative(),
+	phase: z$1.enum(GOAL_PHASES),
+	operation: z$1.enum(GOAL_OPERATIONS),
+	turn: z$1.number().int().nonnegative(),
+	openTurn: z$1.boolean()
+}).strict();
+const mobilePushLifecycleSchema = z$1.object({
+	latestTurn: z$1.number().int().nonnegative(),
+	openTurn: z$1.number().int().nonnegative().nullable(),
+	lastTurnEnd: turnEndSchema.nullable(),
+	latestGoalChange: goalChangeSchema.nullable()
+}).strict();
+const MOBILE_PUSH_LIFECYCLE_KEY = "mobilePushLifecycle";
+const INITIAL_STATE = {
+	latestTurn: 0,
+	openTurn: null,
+	lastTurnEnd: null,
+	latestGoalChange: null
+};
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const safeNumber = (value) => Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+/** Wire-visible verification metadata only; it stores no message text or diagnostics. */
+const mobilePushLifecycleProjectionDefinition = {
+	key: MOBILE_PUSH_LIFECYCLE_KEY,
+	stateSchema: mobilePushLifecycleSchema,
+	init: (_header, _inheritedEventCount) => INITIAL_STATE,
+	apply(state, event) {
+		if (!isRecord(event)) return state;
+		const data = isRecord(event.data) ? event.data : void 0;
+		if (!data) return state;
+		if (event.type === "turn/start") {
+			const turn = safeNumber(data.turn);
+			if (turn === void 0) return state;
+			return {
+				...state,
+				latestTurn: turn,
+				openTurn: turn,
+				lastTurnEnd: null
+			};
+		}
+		if (event.type === "turn/end") {
+			const turn = safeNumber(data.turn);
+			const rawReason = (isRecord(data.reason) ? data.reason : void 0)?.kind;
+			if (turn === void 0 || typeof rawReason !== "string") return state;
+			const reason = TURN_REASONS.includes(rawReason) ? rawReason : "other";
+			return {
+				...state,
+				latestTurn: turn,
+				openTurn: null,
+				lastTurnEnd: {
+					turn,
+					reason
+				}
+			};
+		}
+		if (event.type !== "goal/change") return state;
+		const rawOperation = data.operation;
+		if (typeof rawOperation !== "string" || !GOAL_OPERATIONS.includes(rawOperation)) return state;
+		const operation = rawOperation;
+		const goal = isRecord(data.goal) ? data.goal : void 0;
+		const cleared = isRecord(data.cleared) ? data.cleared : void 0;
+		const goalId = goal?.id;
+		const clearedId = cleared?.id;
+		const id = typeof goalId === "string" ? goalId : typeof clearedId === "string" ? clearedId : void 0;
+		const revision = safeNumber(goal?.revision ?? cleared?.revision);
+		const phaseValue = operation === "clear" ? "cleared" : goal?.phase;
+		if (!id || revision === void 0 || typeof phaseValue !== "string" || !GOAL_PHASES.includes(phaseValue)) return state;
+		const phase = phaseValue;
+		return {
+			...state,
+			latestGoalChange: {
+				id,
+				revision,
+				phase,
+				operation,
+				turn: state.latestTurn,
+				openTurn: state.openTurn !== null
+			}
+		};
+	},
+	wire: {
+		viewSchema: mobilePushLifecycleSchema,
+		view: (state) => state
+	},
+	stateVersion: 1
+};
+function projectionValues(ctx, agent) {
+	try {
+		return ctx.sessionProjections?.snapshot?.(agent.session ?? agent)?.values;
+	} catch {
+		return;
+	}
+}
+function queueArrays(values, agent) {
+	const queues = [];
+	const inbox = isRecord(values.inbox) ? values.inbox : void 0;
+	const projected = [inbox?.["next-turn"], inbox?.["next-step"]];
+	if (projected.every(Array.isArray)) queues.push(...projected);
+	const live = [agent?.inbox?.nextTurn, agent?.inbox?.nextStep];
+	if (live.every(Array.isArray)) queues.push(...live);
+	return queues.length > 0 ? queues : void 0;
+}
+function inboxContains(values, predicate, agent) {
+	const queues = queueArrays(values, agent);
+	if (!queues) return void 0;
+	return queues.some((queue) => queue.some(predicate));
+}
+function lifecycle(values) {
+	const parsed = mobilePushLifecycleSchema.safeParse(values[MOBILE_PUSH_LIFECYCLE_KEY]);
+	return parsed.success ? parsed.data : void 0;
+}
+function verifyQuestion(source, values, agent) {
+	const callId = source.callId;
+	if (typeof callId !== "string" || !callId) return "unverifiable";
+	const replyQueued = inboxContains(values, (message) => {
+		const source = isRecord(message) && isRecord(message.source) ? message.source : void 0;
+		return source?.kind === "user-question-reply" && source.callId === callId && source.outcome === "answered";
+	}, agent);
+	if (replyQueued === void 0) return "unverifiable";
+	if (replyQueued) return "stale";
+	const view = isRecord(values.userQuestions) ? values.userQuestions : void 0;
+	const activeItems = Array.isArray(view?.active) ? view.active : void 0;
+	const settledItems = Array.isArray(view?.settled) ? view.settled : void 0;
+	if (!activeItems || !settledItems) return "unverifiable";
+	const active = activeItems.find((item) => isRecord(item) && item.callId === callId);
+	if (active) {
+		if (active.state !== "open" && active.state !== "continued") return "stale";
+		const state = lifecycle(values);
+		const turn = safeNumber(source.turn);
+		if (turn === void 0 || !state) return "unverifiable";
+		if (state.latestTurn < turn) return "unverifiable";
+		return "eligible";
+	}
+	return settledItems.some((item) => isRecord(item) && item.callId === callId) ? "stale" : "unverifiable";
+}
+function verifyOutcome(source, values, agent) {
+	const turn = safeNumber(source.turn);
+	if (turn === void 0) return "unverifiable";
+	const queuedInput = inboxContains(values, (message) => message !== void 0 && message !== null, agent);
+	if (queuedInput === void 0) return "unverifiable";
+	if (queuedInput) return "stale";
+	const state = lifecycle(values);
+	if (!state) return "unverifiable";
+	if (state.latestTurn > turn) return "stale";
+	if (state.latestTurn < turn) return "unverifiable";
+	const ended = state.lastTurnEnd;
+	if (!ended || ended.turn !== turn) return "unverifiable";
+	const cause = state.latestGoalChange;
+	const goalEnvelope = isRecord(values.goal) ? values.goal : void 0;
+	const currentGoal = isRecord(goalEnvelope?.goal) ? goalEnvelope.goal : void 0;
+	if (source.category === "response") {
+		if (ended.reason !== "completed") return "stale";
+		if (cause?.turn === turn && (cause.operation === "complete" || cause.operation === "block")) return "stale";
+		if (currentGoal?.phase === "active" && cause?.turn === turn) return "stale";
+		return "eligible";
+	}
+	if (source.category === "failure") {
+		if (ended.reason !== "error" && ended.reason !== "blocked") return "stale";
+		if (cause?.turn === turn && cause.operation === "block") return "stale";
+		return "eligible";
+	}
+	return "unverifiable";
+}
+function verifyGoal(source, values) {
+	const identity = source.goal;
+	if (!identity) return "unverifiable";
+	const goalEnvelope = isRecord(values.goal) ? values.goal : void 0;
+	const goalView = isRecord(goalEnvelope?.goal) ? goalEnvelope.goal : void 0;
+	if (!goalView) return values.goal === null ? "stale" : "unverifiable";
+	if (goalView.id !== identity.id || goalView.revision !== identity.revision) return "stale";
+	const phase = goalView.phase;
+	if (phase !== "complete" && phase !== "blocked") return "stale";
+	const state = lifecycle(values);
+	if (!state) return "unverifiable";
+	const cause = state.latestGoalChange;
+	if (!cause) return "unverifiable";
+	if (cause.id !== identity.id || cause.revision !== identity.revision || cause.phase !== phase) return "stale";
+	const sourceTurn = safeNumber(source.turn);
+	if (sourceTurn === void 0) {
+		if (cause.operation !== "block") return "unverifiable";
+		if (state.latestTurn !== cause.turn || state.openTurn !== null) return "stale";
+		return "eligible";
+	}
+	if (state.latestTurn > sourceTurn) return "stale";
+	if (state.latestTurn < sourceTurn || cause.turn > sourceTurn) return "unverifiable";
+	if (phase === "blocked") {
+		if (cause.operation !== "block" || cause.turn !== sourceTurn) return "stale";
+		if (state.openTurn === sourceTurn) return "eligible";
+		const ended = state.lastTurnEnd;
+		return ended?.turn === sourceTurn && (ended.reason === "completed" || ended.reason === "blocked" || ended.reason === "error") ? "eligible" : "unverifiable";
+	}
+	if (cause.operation !== "complete") return "stale";
+	const ended = state.lastTurnEnd;
+	return ended?.turn === sourceTurn && ended.reason === "completed" ? "eligible" : "unverifiable";
+}
+var PushReconciler = class {
+	#ctx;
+	constructor(ctx) {
+		this.#ctx = ctx;
+	}
+	registerProjection() {
+		const dispose = this.#ctx.sessionProjections?.register?.(mobilePushLifecycleProjectionDefinition);
+		if (typeof dispose !== "function") throw new Error("public session projection registration unavailable");
+		return dispose;
+	}
+	async reconcile(source, liveProof) {
+		if (source.expiresAt <= Date.now()) return "stale";
+		if (liveProof !== "unverifiable") return liveProof;
+		if (source.category === "plan" || source.category === "approval") return "unverifiable";
+		if (source.category === "question" && !source.callId) return "unverifiable";
+		const agent = this.#ctx.agents?.get?.(source.sessionId);
+		if (agent) {
+			const values = projectionValues(this.#ctx, agent);
+			return values ? this.#verify(source, values, agent) : "unverifiable";
+		}
+		let observation;
+		let result = "unverifiable";
+		try {
+			observation = await this.#ctx.sessionQuery?.observeSession?.(source.sessionId, { projectionMode: "all" });
+			const values = observation?.projections?.values;
+			if (values) result = this.#verify(source, values, void 0);
+		} catch (error) {
+			result = isRecord(error) && error.code === "SESSION_QUERY_SESSION_NOT_FOUND" ? "stale" : "unverifiable";
+		} finally {
+			try {
+				observation?.[Symbol.dispose]();
+			} catch {
+				result = "unverifiable";
+			}
+		}
+		return source.expiresAt <= Date.now() ? "stale" : result;
+	}
+	#verify(source, values, agent) {
+		if (source.expiresAt <= Date.now()) return "stale";
+		if (source.category === "question") return verifyQuestion(source, values, agent);
+		if (source.category === "goal") return verifyGoal(source, values);
+		return verifyOutcome(source, values, agent);
+	}
+};
+//#endregion
+//#region src/mobile-push/host.ts
+function hasContract(ctx) {
+	return typeof ctx.on === "function" && typeof ctx.sessionProjections?.stateOf === "function" && typeof ctx.sessionProjections.snapshot === "function" && typeof ctx.sessionProjections.register === "function" && typeof ctx.sessionQuery?.observeSession === "function" && typeof ctx.agents?.get === "function" && typeof ctx.agents.list === "function" && typeof ctx.agents.roots === "function" && typeof ctx.agents.isOwnedBy === "function" && ctx.userQuestions !== void 0 && ctx.approval !== void 0;
+}
+const MAINTENANCE_INTERVAL_MS = 3e4;
+function createPushHost(ctx) {
+	let available = hasContract(ctx);
+	const reconciler = new PushReconciler(ctx);
+	let lifecycleProjectionDisposer;
+	const subscribers = /* @__PURE__ */ new Set();
+	const changeSubscribers = /* @__PURE__ */ new Set();
+	const disposers = [];
+	let questionDisposer;
+	let approvalDisposer;
+	const add = (source) => {
+		if (closed || !available) return;
+		for (const callback of subscribers) try {
+			callback(source);
+		} catch {}
+	};
+	const requests = new RequestLifetimes(ctx, add);
+	const outcomes = new OutcomeLifetimes(ctx, add);
+	let closed = false;
+	const maintenanceTimer = available ? setInterval(() => {
+		try {
+			requests.sweep();
+			outcomes.sweep();
+		} catch {}
+	}, MAINTENANCE_INTERVAL_MS) : void 0;
+	if (available) try {
+		lifecycleProjectionDisposer = reconciler.registerProjection();
+	} catch {
+		available = false;
+	}
+	const disposeLifecycleProjection = () => {
+		const dispose = lifecycleProjectionDisposer;
+		lifecycleProjectionDisposer = void 0;
+		try {
+			dispose?.();
+		} catch {}
+	};
+	const register = (event, listener, prepend = false) => {
+		try {
+			const dispose = ctx.on(event, listener, {
+				global: true,
+				...prepend ? { prepend: true } : {}
+			});
+			return typeof dispose === "function" ? dispose : void 0;
+		} catch {
+			return;
+		}
+	};
+	const questionObserver = function(request, next) {
+		return requests.observeQuestion(request?.agent ?? this, request, next);
+	};
+	const approvalObserver = function(request, next) {
+		return requests.observeApproval(request?.agent ?? this, request, next);
+	};
+	const refreshWaterfallObservers = () => {
+		questionDisposer?.();
+		approvalDisposer?.();
+		questionDisposer = void 0;
+		approvalDisposer = void 0;
+		const question = register("user-questions/request", questionObserver, true);
+		const approval = register("approval/request", approvalObserver, true);
+		if (!question || !approval) {
+			try {
+				question?.();
+			} catch {}
+			try {
+				approval?.();
+			} catch {}
+			available = false;
+			return false;
+		}
+		questionDisposer = question;
+		approvalDisposer = approval;
+		return true;
+	};
+	const listen = (event, listener) => {
+		const dispose = register(event, listener);
+		if (!dispose) return false;
+		disposers.push(dispose);
+		return true;
+	};
+	const disable = () => {
+		available = false;
+		disposeLifecycleProjection();
+		questionDisposer?.();
+		approvalDisposer?.();
+		questionDisposer = void 0;
+		approvalDisposer = void 0;
+	};
+	if (available && refreshWaterfallObservers()) {
+		const agentCreated = listen("agent/created", () => {
+			if (!refreshWaterfallObservers()) disable();
+		});
+		const sessionEvents = listen("session/event", (session, event) => {
+			if (event?.type === "turn/start" || event?.type === "agent/inbox/inserted" || event?.type === "agent/inbox/spliced") requests.invalidateSession(session.id, { preserveTimed: true });
+			outcomes.onSessionEvent(session, event);
+			if (event?.type === "user/message" && event?.data?.source?.kind === "user-question-reply") requests.queuedReply(session.id, event.data.source.callId);
+			for (const callback of changeSubscribers) try {
+				callback(session.id);
+			} catch {}
+		});
+		const goalEvents = listen("goal/changed", (payload) => {
+			outcomes.onGoal(payload);
+			const id = payload?.agent?.id;
+			if (id) for (const callback of changeSubscribers) try {
+				callback(id);
+			} catch {}
+		});
+		if (!agentCreated || !sessionEvents || !goalEvents) disable();
+		listen("agent/inbox/inserted", (payload) => {
+			const agent = payload?.agent;
+			const message = payload?.message;
+			if (agent?.id && message?.source?.kind === "user-question-reply" && typeof message.source.callId === "string") requests.queuedReply(agent.id, message.source.callId);
+			if (agent?.id) {
+				requests.invalidateSession(agent.id, { preserveTimed: true });
+				outcomes.onSessionEvent(agent, { type: "agent/inbox/inserted" });
+			}
+		});
+		listen("agent/error", (payload) => outcomes.onAgentError(payload));
+		listen("agent/aborted", (payload) => {
+			const id = payload?.agent?.id;
+			if (id) {
+				requests.invalidateSession(id);
+				outcomes.onSessionEvent(payload.agent, {
+					type: "turn/end",
+					data: {
+						turn: payload.turn,
+						reason: {
+							kind: "aborted",
+							reason: payload.reason
+						}
+					}
+				});
+			}
+		});
+	} else disable();
+	const reconcile = async (source) => {
+		if (source.expiresAt <= Date.now()) return "stale";
+		if (!available || closed) return "unverifiable";
+		const liveProof = source.category === "question" || source.category === "plan" || source.category === "approval" ? requests.reconcileLive(source) : outcomes.reconcileLive(source);
+		return reconciler.reconcile(source, liveProof);
+	};
+	return {
+		get available() {
+			return available;
+		},
+		subscribe(onSource, onChange) {
+			if (closed) return () => void 0;
+			subscribers.add(onSource);
+			changeSubscribers.add(onChange);
+			return () => {
+				subscribers.delete(onSource);
+				changeSubscribers.delete(onChange);
+			};
+		},
+		reconcile,
+		async eligible(source) {
+			return await reconcile(source) === "eligible";
+		},
+		async sessionExists(sessionId) {
+			if (!available || closed || !sessionId) return false;
+			let observation;
+			let exists = false;
+			try {
+				observation = await ctx.sessionQuery?.observeSession?.(sessionId, { projectionMode: "all" });
+				exists = observation !== void 0;
+			} catch {
+				exists = false;
+			} finally {
+				try {
+					observation?.[Symbol.dispose]();
+				} catch {
+					exists = false;
+				}
+			}
+			return exists && available && !closed;
+		},
+		async resolveTarget(source) {
+			if (!available) return void 0;
+			const current = ctx.agents?.get?.(source.targetSessionId);
+			return current ? {
+				sessionId: current.id,
+				interaction: "current"
+			} : {
+				sessionId: source.targetSessionId,
+				interaction: "resolved"
+			};
+		},
+		async close() {
+			if (closed) return;
+			closed = true;
+			if (maintenanceTimer) clearInterval(maintenanceTimer);
+			subscribers.clear();
+			changeSubscribers.clear();
+			requests.close();
+			outcomes.close();
+			questionDisposer?.();
+			approvalDisposer?.();
+			questionDisposer = void 0;
+			approvalDisposer = void 0;
+			for (const dispose of disposers.splice(0)) try {
+				dispose();
+			} catch {}
+			disposeLifecycleProjection();
+		}
+	};
+}
+//#endregion
+//#region src/mobile-push/endpoint.ts
+const MAX_ENDPOINT_BYTES = 2048;
+const APPLE_SUFFIX = ".push.apple.com";
+const BASE64URL = /^[A-Za-z0-9_-]+$/u;
+/** Canonical URL identity for push endpoint ownership; policy checks live elsewhere. */
+function canonicalPushEndpoint(value) {
+	try {
+		return new URL(value).href;
+	} catch {
+		throw new TypeError("push_endpoint_invalid");
+	}
+}
+function invalid() {
+	throw new TypeError("push_subscription_invalid");
+}
+function decodeBase64url(value) {
+	if (typeof value !== "string" || !BASE64URL.test(value)) return invalid();
+	const decoded = Buffer.from(value, "base64url");
+	if (decoded.toString("base64url") !== value) return invalid();
+	return decoded;
+}
+function validateEndpoint(value) {
+	if (typeof value !== "string" || Buffer.byteLength(value, "utf8") > MAX_ENDPOINT_BYTES) return invalid();
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return invalid();
+	}
+	const hostname = url.hostname.toLowerCase();
+	const authority = /^https:\/\/([^/?#]*)/iu.exec(value)?.[1] ?? "";
+	if (url.protocol !== "https:" || authority.includes("@") || url.username !== "" || url.password !== "" || value.includes("#") || url.hash !== "" || url.port !== "" && url.port !== "443" || url.pathname === "" || url.pathname === "/" || !hostname.endsWith(APPLE_SUFFIX) || hostname.length <= 15 || isIP(hostname) !== 0 || hostname.endsWith(".") || hostname.split(".").some((label) => label.length < 1 || label.length > 63 || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label))) return invalid();
+	const canonical = canonicalPushEndpoint(value);
+	if (Buffer.byteLength(canonical, "utf8") > MAX_ENDPOINT_BYTES) return invalid();
+	return canonical;
+}
+function validateP256PublicKey(value) {
+	const bytes = decodeBase64url(value);
+	if (bytes.length !== 65 || bytes[0] !== 4) return invalid();
+	try {
+		createPublicKey({
+			key: {
+				kty: "EC",
+				crv: "P-256",
+				x: bytes.subarray(1, 33).toString("base64url"),
+				y: bytes.subarray(33, 65).toString("base64url")
+			},
+			format: "jwk"
+		});
+	} catch {
+		return invalid();
+	}
+	return value;
+}
+/** Validate an untrusted browser subscription before persisting or sending it. */
+function validatePushSubscription(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return invalid();
+	const input = value;
+	if (input.keys === null || typeof input.keys !== "object" || Array.isArray(input.keys)) return invalid();
+	const keys = input.keys;
+	const p256dh = validateP256PublicKey(keys.p256dh);
+	if (decodeBase64url(keys.auth).length !== 16) return invalid();
+	return Object.freeze({
+		endpoint: validateEndpoint(input.endpoint),
+		keys: Object.freeze({
+			p256dh,
+			auth: keys.auth
+		})
+	});
+}
+function ipv6Value(address) {
+	const [leftText = "", rightText] = address.toLowerCase().split("::");
+	const left = leftText === "" ? [] : leftText.split(":");
+	const right = rightText === void 0 || rightText === "" ? [] : rightText.split(":");
+	const omitted = 8 - left.length - right.length;
+	const groups = [
+		...left,
+		...Array.from({ length: omitted }, () => "0"),
+		...right
+	];
+	if (groups.length !== 8 || groups.some((group) => !/^[0-9a-f]{1,4}$/u.test(group))) throw new Error("invalid IPv6");
+	return groups.reduce((n, group) => n << 16n | BigInt(`0x${group}`), 0n);
+}
+/** Reject non-global, special-purpose and IPv4-mapped DNS answers. */
+function isGloballyRoutableAddress(address) {
+	const family = isIP(address);
+	if (family === 4) return isGloballyRoutableIpv4(address);
+	if (family !== 6 || address.includes("%") || address.includes(".")) return false;
+	try {
+		const value = ipv6Value(address);
+		const first16 = value >> 112n;
+		if (value >> 125n !== 1n) return false;
+		if (first16 === 8193n && value >> 105n === 8193n << 7n) return false;
+		if (first16 === 8193n && value >> 96n === 536939960n) return false;
+		if (first16 === 8194n) return false;
+		if (first16 === 16383n && (value >> 108n & 15n) === 0n) return false;
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function systemResolver(hostname) {
+	return (await lookup(hostname, {
+		all: true,
+		verbatim: true
+	})).filter((item) => item.family === 4 || item.family === 6);
+}
+/** Resolve and vet every answer before a caller opens a socket. */
+async function resolveAppleEndpoint(endpoint, resolver = systemResolver) {
+	const url = new URL(validateEndpoint(endpoint));
+	const addresses = await resolver(url.hostname);
+	if (addresses.length === 0 || addresses.some((item) => !isGloballyRoutableAddress(item.address) || item.family !== 4 && item.family !== 6 || isIP(item.address) !== item.family)) throw new TypeError("push_endpoint_address_rejected");
+	return Object.freeze({
+		url,
+		addresses: Object.freeze([...addresses])
+	});
+}
+//#endregion
+//#region src/mobile-push/store.ts
+const MAX_STATE_BYTES = 4194304;
+const emptySnapshot = () => ({
+	version: 1,
+	ownerGenerations: [],
+	registrations: [],
+	pending: [],
+	receipts: [],
+	references: []
+});
+async function ensurePrivateDirectory(directory) {
+	const absolute = resolve(directory);
+	await mkdir(absolute, {
+		recursive: true,
+		mode: 448
+	});
+	const stat = await lstat(absolute);
+	if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("push state parent must be a managed non-symlink directory");
+	if (process.platform !== "win32" && (stat.mode & 63) !== 0) throw new Error("push state parent permissions must be owner-only");
+}
+function object(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function list(value) {
+	return Array.isArray(value);
+}
+function validKey(value) {
+	return object(value) && only(value, [
+		"publicKey",
+		"privateKey",
+		"fingerprint"
+	]) && typeof value.publicKey === "string" && value.publicKey.length > 0 && typeof value.privateKey === "string" && value.privateKey.length > 0 && typeof value.fingerprint === "string" && value.fingerprint.length > 0;
+}
+function owner(value) {
+	return object(value) && typeof value.scopeId === "string" && value.scopeId.length > 0 && typeof value.deviceId === "string" && value.deviceId.length > 0 && typeof value.origin === "string" && value.origin.length > 0;
+}
+function recipient(value) {
+	return owner(value) && typeof value.installationId === "string" && value.installationId.length > 0;
+}
+function only(value, keys) {
+	return Object.keys(value).every((key) => keys.includes(key));
+}
+function validSource(value) {
+	if (!object(value) || !only(value, [
+		"sourceId",
+		"sessionId",
+		"targetSessionId",
+		"category",
+		"createdAt",
+		"expiresAt",
+		"lifetime",
+		"turn",
+		"callId",
+		"goal"
+	])) return false;
+	return [
+		value.sourceId,
+		value.sessionId,
+		value.targetSessionId
+	].every((v) => typeof v === "string" && v.length > 0 && v.length <= 4096) && [
+		"question",
+		"plan",
+		"approval",
+		"response",
+		"goal",
+		"failure"
+	].includes(String(value.category)) && Number.isFinite(value.createdAt) && Number.isFinite(value.expiresAt) && [
+		"live",
+		"projected",
+		"committed"
+	].includes(String(value.lifetime)) && (value.turn === void 0 || Number.isSafeInteger(value.turn)) && (value.callId === void 0 || typeof value.callId === "string") && (value.goal === void 0 || object(value.goal) && only(value.goal, ["id", "revision"]) && typeof value.goal.id === "string" && Number.isSafeInteger(value.goal.revision));
+}
+function scopedCounts(rows, scope, maximum = 1024) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const key = scope(row);
+		const next = (counts.get(key) ?? 0) + 1;
+		counts.set(key, next);
+		if (next > maximum) return false;
+	}
+	return true;
+}
+function registration(value) {
+	return recipient(value) && object(value) && only(value, [
+		"scopeId",
+		"deviceId",
+		"origin",
+		"installationId",
+		"subscription",
+		"locale",
+		"preferences",
+		"generation",
+		"keyFingerprint",
+		"enabled",
+		"health"
+	]) && object(value.subscription) && only(value.subscription, ["endpoint", "keys"]) && typeof value.subscription.endpoint === "string" && value.subscription.endpoint.length > 0 && object(value.subscription.keys) && only(value.subscription.keys, ["p256dh", "auth"]) && typeof value.subscription.keys.p256dh === "string" && typeof value.subscription.keys.auth === "string" && (value.locale === "en" || value.locale === "zh-CN" || value.locale === "it") && object(value.preferences) && only(value.preferences, [
+		"question",
+		"plan",
+		"approval",
+		"response",
+		"goal",
+		"failure"
+	]) && [
+		"question",
+		"plan",
+		"approval",
+		"response",
+		"goal",
+		"failure"
+	].every((k) => typeof value.preferences[k] === "boolean") && Number.isSafeInteger(value.generation) && Number(value.generation) > 0 && typeof value.keyFingerprint === "string" && typeof value.enabled === "boolean" && [
+		"ready",
+		"suspended",
+		"repair-required"
+	].includes(String(value.health));
+}
+function parsePushSnapshot(value) {
+	if (!object(value) || !only(value, [
+		"version",
+		"keys",
+		"ownerGenerations",
+		"ownerGenerationFloor",
+		"registrations",
+		"pending",
+		"receipts",
+		"references"
+	]) || value.version !== 1) throw new Error("push state has an unsupported version");
+	for (const field of [
+		"ownerGenerations",
+		"registrations",
+		"pending",
+		"receipts",
+		"references"
+	]) if (!list(value[field])) throw new Error(`push state ${field} must be an array`);
+	if (value.ownerGenerationFloor !== void 0 && (!Number.isSafeInteger(value.ownerGenerationFloor) || Number(value.ownerGenerationFloor) < 0)) throw new Error("push state has an invalid owner generation floor");
+	if (value.keys !== void 0 && !validKey(value.keys)) throw new Error("push state contains invalid key material");
+	const owners = value.ownerGenerations;
+	const registrations = value.registrations;
+	const pending = value.pending;
+	const receipts = value.receipts;
+	const references = value.references;
+	if (!scopedCounts(owners, (row) => object(row) ? row.scopeId : void 0) || !scopedCounts(registrations, (row) => object(row) ? row.scopeId : void 0, 256) || !scopedCounts(pending, (row) => object(row) && object(row.key) ? row.key.scopeId : void 0, 256) || !scopedCounts(receipts, (row) => object(row) && object(row.key) ? row.key.scopeId : void 0) || !scopedCounts(references, (row) => object(row) && object(row.key) ? row.key.scopeId : void 0)) throw new Error("push state exceeds a storage limit");
+	if (!owners.every((o) => owner(o) && only(o, [
+		"scopeId",
+		"deviceId",
+		"origin",
+		"generation"
+	]) && Number.isSafeInteger(o.generation) && Number(o.generation) >= 0) || !registrations.every(registration) || !pending.every((i) => object(i) && only(i, [
+		"id",
+		"key",
+		"source",
+		"ownerGeneration",
+		"recipientGeneration",
+		"attempts",
+		"nextAttemptAt"
+	]) && typeof i.id === "string" && recipient(i.key) && object(i.key) && only(i.key, [
+		"scopeId",
+		"deviceId",
+		"origin",
+		"installationId"
+	]) && validSource(i.source) && Number.isSafeInteger(i.ownerGeneration) && Number.isSafeInteger(i.recipientGeneration) && Number.isSafeInteger(i.attempts) && Number.isFinite(i.nextAttemptAt)) || !receipts.every((r) => object(r) && only(r, [
+		"sourceId",
+		"key",
+		"recipientGeneration",
+		"expiresAt"
+	]) && typeof r.sourceId === "string" && recipient(r.key) && object(r.key) && only(r.key, [
+		"scopeId",
+		"deviceId",
+		"origin",
+		"installationId"
+	]) && Number.isSafeInteger(r.recipientGeneration) && Number.isFinite(r.expiresAt)) || !references.every((r) => object(r) && only(r, [
+		"reference",
+		"key",
+		"source",
+		"expiresAt"
+	]) && typeof r.reference === "string" && recipient(r.key) && object(r.key) && only(r.key, [
+		"scopeId",
+		"deviceId",
+		"origin",
+		"installationId"
+	]) && validSource(r.source) && r.expiresAt === r.source.expiresAt)) throw new Error("push state contains invalid records");
+	const ownerKeys = owners.map((o) => JSON.stringify([
+		o.scopeId,
+		o.deviceId,
+		o.origin
+	]));
+	const validRegistrations = registrations;
+	const regKeys = validRegistrations.map((reg) => JSON.stringify([
+		reg.scopeId,
+		reg.deviceId,
+		reg.origin,
+		reg.installationId
+	]));
+	const endpoints = validRegistrations.map((reg) => canonicalPushEndpoint(reg.subscription.endpoint));
+	if (new Set(ownerKeys).size !== owners.length || new Set(regKeys).size !== registrations.length || new Set(endpoints).size !== endpoints.length) throw new Error("push state contains duplicate ownership");
+	for (const reg of validRegistrations) if (validRegistrations.filter((other) => other.scopeId === reg.scopeId && other.deviceId === reg.deviceId).length > 4) throw new Error("push state exceeds the per-device registration limit");
+	return structuredClone(value);
+}
+var JsonPushStore = class {
+	file;
+	constructor(file) {
+		this.file = file;
+	}
+	async load() {
+		try {
+			const parent = await lstat(dirname(this.file));
+			if (!parent.isDirectory() || parent.isSymbolicLink()) throw new Error("push state parent must be a managed non-symlink directory");
+			if (process.platform !== "win32" && (parent.mode & 63) !== 0) throw new Error("push state parent permissions must be owner-only");
+		} catch (error) {
+			if (error.code === "ENOENT") return emptySnapshot();
+			throw error;
+		}
+		let info;
+		try {
+			info = await lstat(this.file);
+		} catch (error) {
+			if (error.code === "ENOENT") return emptySnapshot();
+			throw error;
+		}
+		if (!info.isFile() || info.isSymbolicLink() || info.size > MAX_STATE_BYTES) throw new Error("push state must be a regular file no larger than 4 MiB");
+		await restrictPrivateFile(this.file);
+		let parsed;
+		try {
+			parsed = JSON.parse(await readFile(this.file, "utf8"));
+		} catch (error) {
+			throw new Error("push state is not valid JSON", { cause: error });
+		}
+		return parsePushSnapshot(parsed);
+	}
+	async save(snapshot) {
+		const safe = parsePushSnapshot(snapshot);
+		const serialized = `${JSON.stringify(safe)}\n`;
+		if (Buffer.byteLength(serialized) > MAX_STATE_BYTES) throw new Error("push state exceeds 4 MiB");
+		const directory = dirname(this.file);
+		await ensurePrivateDirectory(directory);
+		try {
+			const current = await lstat(this.file);
+			if (!current.isFile() || current.isSymbolicLink()) throw new Error("push state target must remain a regular file");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		const temporary = join(directory, `.${basename(this.file)}.${randomBytes(12).toString("hex")}.tmp`);
+		try {
+			await writeFile(temporary, "", {
+				encoding: "utf8",
+				flag: "wx",
+				mode: 384
+			});
+			await restrictPrivateFile(temporary);
+			await writeFile(temporary, serialized, {
+				encoding: "utf8",
+				flag: "r+"
+			});
+			await rename(temporary, this.file);
+		} catch (error) {
+			try {
+				await rm(temporary, { force: true });
+			} catch (cleanupError) {
+				throw new AggregateError([error, cleanupError], "push state write and cleanup both failed");
+			}
+			throw error;
+		}
+	}
+};
+//#endregion
+//#region src/mobile-push/registry.ts
+const empty = () => ({
+	version: 1,
+	ownerGenerations: [],
+	registrations: [],
+	pending: [],
+	receipts: [],
+	references: []
+});
+const idOfOwner = (owner) => JSON.stringify([
+	owner.scopeId,
+	owner.deviceId,
+	owner.origin
+]);
+const idOfKey = (key) => JSON.stringify([
+	key.scopeId,
+	key.deviceId,
+	key.origin,
+	key.installationId
+]);
+const sameOwner = (a, b) => idOfOwner(a) === idOfOwner(b);
+function vapidFingerprint(keys) {
+	const rawPublic = Buffer.from(keys.publicKey, "base64url");
+	if (rawPublic.length !== 65 || rawPublic[0] !== 4 || rawPublic.toString("base64url") !== keys.publicKey) throw new Error("invalid uncompressed VAPID public key");
+	const privateBytes = Buffer.from(keys.privateKey, "base64url");
+	if (privateBytes.length !== 32 || privateBytes.toString("base64url") !== keys.privateKey) throw new Error("invalid VAPID private key");
+	const ecdh = createECDH("prime256v1");
+	ecdh.setPrivateKey(privateBytes);
+	if (!ecdh.getPublicKey(void 0, "uncompressed").equals(rawPublic)) throw new Error("VAPID public and private keys do not match");
+	return createHash("sha256").update(rawPublic).digest("hex");
+}
+const fingerprint = vapidFingerprint;
+const defaultPreferences = {
+	question: true,
+	plan: true,
+	approval: true,
+	response: true,
+	goal: true,
+	failure: true
+};
+function clone(value) {
+	return structuredClone(value);
+}
+function boundedText(value, label) {
+	if (typeof value !== "string" || value.length === 0 || value.length > 4096) throw new Error(`invalid ${label}`);
+}
+/** Serializes and durably commits all push ownership and consent mutations. */
+var PushRegistry = class {
+	store;
+	createKeys;
+	state = empty();
+	initialized = false;
+	closed = false;
+	queue = Promise.resolve();
+	constructor(store, createKeys) {
+		this.store = store;
+		this.createKeys = createKeys;
+	}
+	serialize(operation) {
+		const result = this.queue.then(() => {
+			if (this.closed) throw new Error("push registry is closed");
+			return operation();
+		});
+		this.queue = result.catch(() => void 0);
+		return result;
+	}
+	assertReady() {
+		if (!this.initialized) throw new Error("push registry is not initialized");
+	}
+	ownerGeneration(owner) {
+		return Math.max(this.state.ownerGenerationFloor ?? 0, this.state.ownerGenerations.find((item) => sameOwner(item, owner))?.generation ?? 0);
+	}
+	advanceOwnerGenerationFloor(snapshot, removedRegistrationGenerations = []) {
+		let maximum = snapshot.ownerGenerationFloor ?? 0;
+		for (const row of snapshot.ownerGenerations) maximum = Math.max(maximum, row.generation);
+		for (const generation of removedRegistrationGenerations) maximum = Math.max(maximum, generation);
+		if (!Number.isSafeInteger(maximum) || maximum >= Number.MAX_SAFE_INTEGER) throw new Error("owner generation floor exceeds safe integer range");
+		return {
+			...snapshot,
+			ownerGenerationFloor: maximum + 1
+		};
+	}
+	async commit(next) {
+		await this.store.save(next);
+		this.state = next;
+	}
+	putOwnerGeneration(next, owner, generation) {
+		const rows = [...next.ownerGenerations];
+		const index = rows.findIndex((item) => sameOwner(item, owner));
+		if (index >= 0) rows[index] = {
+			...rows[index],
+			generation
+		};
+		else {
+			if (rows.filter((item) => item.scopeId === owner.scopeId).length >= 1024) throw new Error("owner generation limit reached for authorization scope");
+			rows.push({
+				scopeId: owner.scopeId,
+				deviceId: owner.deviceId,
+				origin: owner.origin,
+				generation
+			});
+		}
+		return {
+			...next,
+			ownerGenerations: rows
+		};
+	}
+	async initialize() {
+		await this.serialize(async () => {
+			let loaded = await this.store.load();
+			let keyIntegrity = false;
+			try {
+				keyIntegrity = !!loaded.keys && loaded.keys.fingerprint === fingerprint(loaded.keys);
+			} catch (_error) {
+				keyIntegrity = false;
+			}
+			if (!keyIntegrity) {
+				if (loaded.registrations.length) {
+					loaded = {
+						...loaded,
+						registrations: loaded.registrations.map((reg) => ({
+							...reg,
+							health: "repair-required"
+						}))
+					};
+					await this.store.save(loaded);
+				} else {
+					const keys = this.createKeys();
+					if (!keys || typeof keys.publicKey !== "string" || !keys.publicKey || typeof keys.privateKey !== "string" || !keys.privateKey) throw new Error("key factory returned invalid VAPID keys");
+					loaded = {
+						...loaded,
+						keys: {
+							...keys,
+							fingerprint: fingerprint(keys)
+						}
+					};
+					await this.store.save(loaded);
+				}
+			}
+			this.state = clone(loaded);
+			this.initialized = true;
+		});
+	}
+	async publicKey() {
+		this.assertReady();
+		if (!this.state.keys || this.state.registrations.some((reg) => reg.health === "repair-required")) throw new Error("push VAPID keys require repair");
+		return this.state.keys.publicKey;
+	}
+	async config(owner, installationId) {
+		this.assertReady();
+		const key = {
+			...owner,
+			installationId
+		};
+		const registration = this.state.registrations.find((row) => idOfKey(row) === idOfKey(key));
+		const keyUsable = !!this.state.keys && !this.state.registrations.some((row) => row.health === "repair-required");
+		return {
+			available: keyUsable,
+			...keyUsable ? {
+				publicKey: this.state.keys.publicKey,
+				keyFingerprint: this.state.keys.fingerprint
+			} : {},
+			installationId,
+			ownerGeneration: this.ownerGeneration(owner),
+			registrationGeneration: registration?.generation ?? 0,
+			status: registration?.health === "repair-required" ? "repair-required" : registration?.health === "suspended" ? "suspended" : registration?.enabled ? "enabled" : "disabled",
+			preferences: clone(registration?.preferences ?? defaultPreferences)
+		};
+	}
+	/** Server-internal persistence snapshot; includes private VAPID material and is not a public config projection. */
+	snapshot() {
+		this.assertReady();
+		return clone(this.state);
+	}
+	async transact(update) {
+		await this.serialize(async () => {
+			this.assertReady();
+			const next = update(clone(this.state));
+			if (JSON.stringify(next.keys) !== JSON.stringify(this.state.keys) || next.ownerGenerationFloor !== this.state.ownerGenerationFloor || JSON.stringify(next.ownerGenerations) !== JSON.stringify(this.state.ownerGenerations) || JSON.stringify(next.registrations) !== JSON.stringify(this.state.registrations)) throw new Error("push transactions may only update delivery state");
+			const validated = {
+				...next,
+				...this.pruneExpired(next)
+			};
+			await this.commit(validated);
+		});
+	}
+	async upsert(owner, input) {
+		return this.serialize(async () => {
+			this.assertReady();
+			boundedText(owner.scopeId, "scope");
+			boundedText(owner.deviceId, "device");
+			boundedText(owner.origin, "origin");
+			boundedText(input.installationId, "installation");
+			boundedText(input.keyFingerprint, "key fingerprint");
+			boundedText(input.subscription?.endpoint, "subscription endpoint");
+			const canonicalEndpoint = canonicalPushEndpoint(input.subscription.endpoint);
+			const normalizedSubscription = {
+				...input.subscription,
+				endpoint: canonicalEndpoint
+			};
+			if (!normalizedSubscription.keys?.p256dh || !normalizedSubscription.keys.auth) throw new Error("invalid subscription keys");
+			if (!this.state.keys || input.keyFingerprint !== this.state.keys.fingerprint) throw new Error("subscription VAPID key fingerprint conflict");
+			const key = {
+				...owner,
+				installationId: input.installationId
+			};
+			const current = this.state.registrations.find((reg) => idOfKey(reg) === idOfKey(key));
+			const sameEndpoint = this.state.registrations.find((reg) => canonicalPushEndpoint(reg.subscription.endpoint) === canonicalEndpoint);
+			if (sameEndpoint && !sameOwner(sameEndpoint, owner)) throw new Error("subscription endpoint is already owned by another device (conflict)");
+			if (sameEndpoint && !current) {
+				if (sameEndpoint.keyFingerprint !== input.keyFingerprint || !sameEndpoint.enabled) throw new Error("canonical subscription recovery conflict");
+				return { registration: clone(sameEndpoint) };
+			}
+			const ownerGeneration = this.ownerGeneration(owner);
+			if (input.ownerGeneration !== ownerGeneration || input.registrationGeneration !== (current?.generation ?? 0)) throw new Error("stale push mutation generation");
+			if (current?.enabled && canonicalPushEndpoint(current.subscription.endpoint) === canonicalEndpoint && current.locale === input.locale && JSON.stringify(current.preferences) === JSON.stringify(input.preferences) && current.keyFingerprint === input.keyFingerprint) return { registration: clone(current) };
+			if (!current && this.state.registrations.filter((reg) => reg.scopeId === owner.scopeId).length >= 256) throw new Error("push registration limit reached for scope");
+			if (!current && this.state.registrations.filter((reg) => sameOwner(reg, owner)).length >= 4) throw new Error("push registration limit reached for device");
+			const generation = current ? current.generation + 1 : ownerGeneration + 1;
+			const registration = {
+				...key,
+				subscription: clone(normalizedSubscription),
+				locale: input.locale,
+				preferences: clone(input.preferences),
+				generation,
+				keyFingerprint: input.keyFingerprint,
+				enabled: true,
+				health: "ready"
+			};
+			let next = {
+				...this.state,
+				registrations: [...this.state.registrations.filter((reg) => idOfKey(reg) !== idOfKey(key)), registration]
+			};
+			next = this.pruneExpired(next);
+			if (next.pending.filter((intent) => intent.key.scopeId === owner.scopeId).length > 256) throw new Error("pending push limit reached for scope");
+			await this.commit(next);
+			return {
+				registration: clone(registration),
+				mutationGeneration: generation
+			};
+		});
+	}
+	async preferences(key, value, guard) {
+		return this.serialize(async () => {
+			this.assertReady();
+			const reg = this.state.registrations.find((row) => idOfKey(row) === idOfKey(key));
+			if (!reg || guard.ownerGeneration !== this.ownerGeneration(key) || guard.registrationGeneration !== reg.generation) throw new Error("stale push mutation generation");
+			if (!value || ![
+				"question",
+				"plan",
+				"approval",
+				"response",
+				"goal",
+				"failure"
+			].every((k) => typeof value[k] === "boolean")) throw new Error("invalid push preferences");
+			const updated = {
+				...reg,
+				preferences: clone(value),
+				generation: reg.generation + 1
+			};
+			await this.commit({
+				...this.state,
+				registrations: this.state.registrations.map((row) => idOfKey(row) === idOfKey(key) ? updated : row)
+			});
+			return clone(updated);
+		});
+	}
+	async disable(key, ifGeneration) {
+		await this.serialize(async () => {
+			this.assertReady();
+			const reg = this.state.registrations.find((row) => idOfKey(row) === idOfKey(key));
+			if (ifGeneration !== void 0 && reg?.generation !== ifGeneration) return;
+			let next = this.state;
+			if (reg) next = {
+				...next,
+				registrations: next.registrations.map((row) => idOfKey(row) === idOfKey(key) ? {
+					...row,
+					enabled: false,
+					generation: row.generation + 1
+				} : row)
+			};
+			next = this.putOwnerGeneration(next, key, this.ownerGeneration(key) + 1);
+			next = {
+				...next,
+				pending: next.pending.filter((intent) => idOfKey(intent.key) !== idOfKey(key))
+			};
+			await this.commit(next);
+		});
+	}
+	async settleRecipient(key, expectedGeneration, result) {
+		await this.serialize(async () => {
+			this.assertReady();
+			const registration = this.state.registrations.find((row) => idOfKey(row) === idOfKey(key));
+			if (!registration || registration.generation !== expectedGeneration) return;
+			if (result === "gone") {
+				const next = {
+					...this.advanceOwnerGenerationFloor(this.state, [registration.generation]),
+					registrations: this.state.registrations.filter((row) => idOfKey(row) !== idOfKey(key)),
+					pending: this.state.pending.filter((row) => idOfKey(row.key) !== idOfKey(key)),
+					receipts: this.state.receipts.filter((row) => idOfKey(row.key) !== idOfKey(key)),
+					references: this.state.references.filter((row) => idOfKey(row.key) !== idOfKey(key))
+				};
+				await this.commit(next);
+			} else {
+				const updated = {
+					...registration,
+					health: "suspended",
+					generation: registration.generation + 1
+				};
+				await this.commit({
+					...this.state,
+					registrations: this.state.registrations.map((row) => idOfKey(row) === idOfKey(key) ? updated : row)
+				});
+			}
+		});
+	}
+	async disableOwner(owner) {
+		await this.serialize(async () => {
+			this.assertReady();
+			let next = this.state;
+			next = {
+				...next,
+				registrations: next.registrations.map((reg) => sameOwner(reg, owner) ? {
+					...reg,
+					enabled: false,
+					generation: reg.generation + 1
+				} : reg),
+				pending: next.pending.filter((intent) => !sameOwner(intent.key, owner))
+			};
+			next = this.putOwnerGeneration(next, owner, this.ownerGeneration(owner) + 1);
+			await this.commit(next);
+		});
+	}
+	async purgeDevices(scopeId, ids) {
+		await this.serialize(async () => {
+			this.assertReady();
+			if (ids.length === 0) return;
+			const selected = new Set(ids);
+			const remove = (key) => key.scopeId === scopeId && selected.has(key.deviceId);
+			const removedRegistrationGenerations = this.state.registrations.filter((reg) => remove(reg)).map((reg) => reg.generation);
+			const withFloor = this.advanceOwnerGenerationFloor(this.state, removedRegistrationGenerations);
+			const next = {
+				...withFloor,
+				ownerGenerations: withFloor.ownerGenerations.filter((row) => !remove(row)),
+				registrations: withFloor.registrations.filter((reg) => !remove(reg)),
+				pending: withFloor.pending.filter((intent) => !remove(intent.key)),
+				receipts: withFloor.receipts.filter((row) => !remove(row.key)),
+				references: withFloor.references.filter((row) => !remove(row.key))
+			};
+			await this.commit(next);
+		});
+	}
+	async resetKeys() {
+		await this.serialize(async () => {
+			this.assertReady();
+			const withFloor = this.advanceOwnerGenerationFloor(this.state, this.state.registrations.map((reg) => reg.generation));
+			const keys = this.createKeys();
+			const nextKeys = {
+				...keys,
+				fingerprint: fingerprint(keys)
+			};
+			const next = {
+				...withFloor,
+				keys: nextKeys,
+				ownerGenerations: [],
+				registrations: [],
+				pending: [],
+				receipts: [],
+				references: []
+			};
+			await this.commit(next);
+		});
+	}
+	async close() {
+		await this.queue;
+		this.closed = true;
+	}
+	pruneExpired(snapshot) {
+		const now = Date.now();
+		const pending = snapshot.pending.filter((item) => item.source.expiresAt > now);
+		return {
+			...snapshot,
+			pending,
+			receipts: snapshot.receipts.filter((item) => item.expiresAt > now),
+			references: snapshot.references.filter((item) => item.expiresAt > now)
+		};
+	}
+};
+//#endregion
+//#region src/mobile-push/payload.ts
+const messages = {
+	en: {
+		question: ["Input requested", "A response needs your attention."],
+		plan: ["Plan review requested", "A plan review needs your attention."],
+		approval: ["Permission requested", "A permission request needs your attention."],
+		response: ["Response ready", "A response is ready to view."],
+		goal: ["Goal update", "A goal has an important update."],
+		failure: ["Attention needed", "A run needs your attention."],
+		test: ["Test notification", "Your notification settings are working."]
+	},
+	"zh-CN": {
+		question: ["需要输入", "有一项回复需要您关注。"],
+		plan: ["需要审核计划", "有一项计划审核需要您关注。"],
+		approval: ["需要授权", "有一项授权请求需要您关注。"],
+		response: ["回复已就绪", "有一项回复已准备好查看。"],
+		goal: ["目标更新", "有一项目标状态更新。"],
+		failure: ["需要关注", "有一项运行需要您关注。"],
+		test: ["测试通知", "通知设置已正常工作。"]
+	},
+	it: {
+		question: ["Input richiesto", "Una risposta richiede la tua attenzione."],
+		plan: ["Revisione del piano richiesta", "Una revisione del piano richiede la tua attenzione."],
+		approval: ["Autorizzazione richiesta", "Una richiesta di autorizzazione richiede la tua attenzione."],
+		response: ["Risposta pronta", "Una risposta è pronta da visualizzare."],
+		goal: ["Aggiornamento obiettivo", "Un obiettivo ha un aggiornamento importante."],
+		failure: ["Attenzione richiesta", "Un’esecuzione richiede la tua attenzione."],
+		test: ["Notifica di prova", "Le impostazioni delle notifiche funzionano."]
+	}
+};
+function validateNavigate(navigate, category) {
+	if (category === "test" && navigate === "/") return;
+	if (typeof navigate !== "string" || !/^\/\?mobile-push=[A-Za-z0-9_-]{1,256}$/u.test(navigate)) throw new TypeError("push_navigation_invalid");
+}
+/** Build Apple's declarative Web Push schema with generic, locale-owned text. */
+function buildDeclarativePayload(category, locale, navigate, tag) {
+	validateNavigate(navigate, category);
+	if (!(locale in messages) || !(category in messages[locale]) || typeof tag !== "string" || !/^[A-Za-z0-9._:-]{1,128}$/u.test(tag)) throw new TypeError("push_payload_invalid");
+	const [title, body] = messages[locale][category];
+	const payload = JSON.stringify({
+		web_push: 8030,
+		notification: {
+			title,
+			body,
+			lang: locale,
+			navigate,
+			tag
+		}
+	});
+	if (Buffer.byteLength(payload, "utf8") > 3072) throw new TypeError("push_payload_too_large");
+	return payload;
+}
+//#endregion
+//#region src/mobile-push/retention.ts
+/** Pure defer-membership retention helpers shared by delivery maintenance. */
+/** Removes deferred-recheck entries whose owning pending intent no longer exists; returns how many were removed. */
+function pruneOrphanedDeferrals(deferred, pending) {
+	const live = new Set(pending.map((item) => item.id));
+	let removed = 0;
+	for (const id of deferred.keys()) {
+		if (live.has(id)) continue;
+		deferred.delete(id);
+		removed += 1;
+	}
+	return removed;
+}
+//#endregion
+//#region src/mobile-push/sender.ts
+const MAX_RESPONSE_BYTES = 8192;
+const MAX_TTL_SECONDS = 1800;
+const CONTENT_ENCODING = "aes128gcm";
+function isObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validatePayload(payload) {
+	if (typeof payload !== "string" || Buffer.byteLength(payload, "utf8") > 3072) return false;
+	try {
+		const parsed = JSON.parse(payload);
+		if (!isObject(parsed) || parsed.web_push !== 8030 || !isObject(parsed.notification) || Object.keys(parsed).length !== 2 || Object.keys(parsed.notification).length !== 5) return false;
+		const notification = parsed.notification;
+		return typeof notification.title === "string" && notification.title.length > 0 && typeof notification.body === "string" && notification.body.length > 0 && (notification.lang === "en" || notification.lang === "zh-CN" || notification.lang === "it") && typeof notification.navigate === "string" && (notification.navigate === "/" || /^\/\?mobile-push=[A-Za-z0-9_-]{1,256}$/u.test(notification.navigate)) && typeof notification.tag === "string" && /^[A-Za-z0-9._:-]{1,128}$/u.test(notification.tag);
+	} catch {
+		return false;
+	}
+}
+function validSubject(subject, origin) {
+	if (typeof subject !== "string") return void 0;
+	const candidate = subject.trim() === "" ? `${origin}/` : subject;
+	let url;
+	try {
+		url = new URL(candidate);
+	} catch {
+		return;
+	}
+	if (url.protocol === "mailto:") return /^mailto:[^\s/?#@]+@[^\s/?#@]+$/iu.test(candidate) ? candidate : void 0;
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.hash !== "") return void 0;
+	const hostname = url.hostname.toLowerCase();
+	if (hostname === "localhost" || hostname.endsWith(".localhost") || isLoopbackAddress(hostname)) return void 0;
+	return candidate;
+}
+function canonicalOrigin(origin) {
+	try {
+		const url = new URL(origin);
+		if (url.protocol !== "https:" || url.origin !== origin || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") return void 0;
+		return url.origin;
+	} catch {
+		return;
+	}
+}
+/**
+* WebKit's declarative push parser resolves `navigate` without any base URL, so the encrypted wire
+* payload must carry an absolute URL. The already-validated relative template is resolved against
+* the canonical registration origin and the serialized copy is budget-checked again because the
+* origin adds bytes the payload template never counted.
+*/
+function bindNavigationOrigin(payload, origin) {
+	let parsed;
+	try {
+		parsed = JSON.parse(payload);
+	} catch {
+		return;
+	}
+	if (typeof parsed?.notification?.navigate !== "string") return void 0;
+	let resolved;
+	try {
+		resolved = new URL(parsed.notification.navigate, origin);
+	} catch {
+		return;
+	}
+	if (resolved.origin !== origin) return void 0;
+	const bound = JSON.stringify({
+		...parsed,
+		notification: {
+			...parsed.notification,
+			navigate: resolved.href
+		}
+	});
+	if (Buffer.byteLength(bound, "utf8") > 3072) return void 0;
+	return bound;
+}
+function retryAfterMs(value, now) {
+	const raw = Array.isArray(value) ? value[0] : value;
+	if (!raw) return void 0;
+	if (/^\d{1,10}$/u.test(raw)) return Number(raw) * 1e3;
+	const date = Date.parse(raw);
+	return Number.isFinite(date) ? Math.max(0, date - now) : void 0;
+}
+function safeStatus(statusCode, retryAfter, ttlSeconds) {
+	if (statusCode >= 200 && statusCode < 300) return { kind: "accepted" };
+	if (statusCode === 404 || statusCode === 410) return { kind: "gone" };
+	if (statusCode === 401 || statusCode === 403) return { kind: "suspended" };
+	if (statusCode === 429) {
+		if (retryAfter !== void 0 && retryAfter > ttlSeconds * 1e3) return { kind: "permanent" };
+		return retryAfter === void 0 ? { kind: "retry" } : {
+			kind: "retry",
+			retryAfterMs: retryAfter
+		};
+	}
+	if (statusCode >= 500 && statusCode < 600) return { kind: "retry" };
+	return { kind: "permanent" };
+}
+function abortable(promise, signal) {
+	if (signal.aborted) return Promise.reject(/* @__PURE__ */ new Error("push_aborted"));
+	return new Promise((resolve, reject) => {
+		const abort = () => reject(/* @__PURE__ */ new Error("push_aborted"));
+		signal.addEventListener("abort", abort, { once: true });
+		promise.then((value) => {
+			signal.removeEventListener("abort", abort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", abort);
+			reject(error);
+		});
+	});
+}
+function responseFromRequest(requestFactory, url, options, body, signal) {
+	return new Promise((resolve, reject) => {
+		let request;
+		let settled = false;
+		const finish = (result, error) => {
+			if (settled) return;
+			settled = true;
+			signal.removeEventListener("abort", abortRequest);
+			if (error) reject(error);
+			else if (result) resolve(result);
+		};
+		const abortRequest = () => {
+			request?.destroy(/* @__PURE__ */ new Error("push_aborted"));
+			finish(void 0, /* @__PURE__ */ new Error("push_aborted"));
+		};
+		try {
+			request = requestFactory(url, options);
+			signal.addEventListener("abort", abortRequest, { once: true });
+			request.once("error", () => finish(void 0, /* @__PURE__ */ new Error("push_transport_failed")));
+			request.once("response", (response) => {
+				const statusCode = response.statusCode;
+				if (typeof statusCode !== "number") {
+					response.destroy();
+					request.destroy();
+					finish(void 0, /* @__PURE__ */ new Error("push_transport_failed"));
+					return;
+				}
+				if (statusCode >= 300 && statusCode < 400) {
+					finish({
+						statusCode,
+						headers: response.headers
+					});
+					response.destroy();
+					request.destroy();
+					return;
+				}
+				let bytes = 0;
+				let oversized = false;
+				response.on("data", (chunk) => {
+					bytes += Buffer.byteLength(chunk);
+					if (bytes > MAX_RESPONSE_BYTES && !oversized) {
+						oversized = true;
+						finish({
+							statusCode,
+							headers: response.headers
+						});
+						response.destroy();
+						request.destroy();
+					}
+				});
+				response.once("error", () => {
+					if (!oversized) finish(void 0, /* @__PURE__ */ new Error("push_transport_failed"));
+				});
+				response.once("end", () => finish({
+					statusCode,
+					headers: response.headers
+				}));
+			});
+			request.end(body);
+		} catch {
+			finish(void 0, /* @__PURE__ */ new Error("push_transport_failed"));
+		}
+	});
+}
+function makePinnedLookup(hostname, address) {
+	return ((queryHostname, options, callback) => {
+		if (queryHostname.toLowerCase() !== hostname.toLowerCase()) {
+			callback(/* @__PURE__ */ new Error("push_dns_pin_mismatch"));
+			return;
+		}
+		if (isObject(options) && options.all === true) callback(null, [{
+			address: address.address,
+			family: address.family
+		}]);
+		else callback(null, address.address, address.family);
+	});
+}
+function requestOptions(url, details, address) {
+	return {
+		method: details.method,
+		headers: details.headers,
+		agent: false,
+		servername: url.hostname,
+		rejectUnauthorized: true,
+		lookup: makePinnedLookup(url.hostname, address),
+		timeout: ATTEMPT_TIMEOUT_MS
+	};
+}
+/** Generate one persistent installation VAPID key pair via the maintained library. */
+function createVapidKeys() {
+	const { publicKey, privateKey } = webPush.generateVAPIDKeys();
+	return Object.freeze({
+		publicKey,
+		privateKey
+	});
+}
+/** Encrypted, no-redirect HTTPS sender with DNS pinning and one absolute wall-clock budget. */
+var PushSender = class {
+	resolver;
+	requestFactory;
+	budgetMs;
+	constructor(dependencies = {}) {
+		this.resolver = dependencies.resolve ?? (async (hostname) => {
+			return (await lookup(hostname, {
+				all: true,
+				verbatim: true
+			})).filter((item) => item.family === 4 || item.family === 6);
+		});
+		this.requestFactory = dependencies.request ?? https.request.bind(https);
+		this.budgetMs = Math.max(1, Math.min(ATTEMPT_TIMEOUT_MS, dependencies.attemptTimeoutMs ?? 1e4));
+	}
+	async send(input) {
+		const started = performance.now();
+		const controller = new AbortController();
+		const callerAbort = () => controller.abort();
+		if (input.signal.aborted) controller.abort();
+		else input.signal.addEventListener("abort", callerAbort, { once: true });
+		const deadline = setTimeout(() => controller.abort(), this.budgetMs);
+		try {
+			if (controller.signal.aborted) return { kind: "retry" };
+			if (!Number.isSafeInteger(input.ttlSeconds) || input.ttlSeconds < 1 || input.ttlSeconds > MAX_TTL_SECONDS || !validatePayload(input.payload)) return { kind: "permanent" };
+			const origin = canonicalOrigin(input.registration.origin);
+			if (!origin) return { kind: "permanent" };
+			const wirePayload = bindNavigationOrigin(input.payload, origin);
+			if (!wirePayload) return { kind: "permanent" };
+			const subject = validSubject(input.subject, origin);
+			if (!subject) return { kind: "permanent" };
+			let subscription;
+			try {
+				subscription = validatePushSubscription(input.registration.subscription);
+			} catch {
+				return { kind: "permanent" };
+			}
+			const resolved = await abortable(resolveAppleEndpoint(subscription.endpoint, this.resolver), controller.signal);
+			if (controller.signal.aborted || performance.now() - started >= this.budgetMs) return { kind: "retry" };
+			const options = {
+				contentEncoding: CONTENT_ENCODING,
+				vapidDetails: {
+					subject,
+					publicKey: input.keys.publicKey,
+					privateKey: input.keys.privateKey
+				},
+				TTL: input.ttlSeconds,
+				timeout: ATTEMPT_TIMEOUT_MS
+			};
+			let details;
+			try {
+				details = webPush.generateRequestDetails(subscription, wirePayload, options);
+			} catch {
+				return { kind: "permanent" };
+			}
+			if (controller.signal.aborted || performance.now() - started >= this.budgetMs) return { kind: "retry" };
+			const requestConfig = requestOptions(resolved.url, details, resolved.addresses[0]);
+			const beforeRequest = input.beforeRequest;
+			if (beforeRequest !== void 0) {
+				if (typeof beforeRequest !== "function") return { kind: "cancelled" };
+				let permitted;
+				try {
+					permitted = await abortable(Promise.resolve().then(() => beforeRequest(controller.signal)), controller.signal);
+				} catch {
+					return { kind: "cancelled" };
+				}
+				if (permitted !== true || controller.signal.aborted || performance.now() - started >= this.budgetMs) return { kind: "cancelled" };
+			}
+			const response = await abortable(responseFromRequest(this.requestFactory, resolved.url, requestConfig, details.body ?? Buffer.alloc(0), controller.signal), controller.signal);
+			if (controller.signal.aborted || performance.now() - started > this.budgetMs) return { kind: "retry" };
+			const waitMs = retryAfterMs(response.headers["retry-after"], Date.now());
+			return safeStatus(response.statusCode, waitMs, input.ttlSeconds);
+		} catch (error) {
+			if (error instanceof TypeError && error.message === "push_endpoint_address_rejected") return { kind: "permanent" };
+			if (controller.signal.aborted || performance.now() - started >= this.budgetMs) return { kind: "retry" };
+			return { kind: "retry" };
+		} finally {
+			clearTimeout(deadline);
+			input.signal.removeEventListener("abort", callerAbort);
+		}
+	}
+};
+//#endregion
+//#region src/mobile-push/delivery.ts
+const RECONCILE_INTERVAL_MS = 3e4;
+const RETRY_BACKOFF_MS = [1e3, 5e3];
+const MAX_TEST_QUEUE = 64;
+const TEST_RATE_LIMIT_MS = 6e4;
+const UNVERIFIABLE_RECHECK_MS = 3e4;
+function ownerId(value) {
+	return JSON.stringify([
+		value.scopeId,
+		value.deviceId,
+		value.origin
+	]);
+}
+function keyId(value) {
+	return JSON.stringify([
+		value.scopeId,
+		value.deviceId,
+		value.origin,
+		value.installationId
+	]);
+}
+function sameKey(a, b) {
+	return keyId(a) === keyId(b);
+}
+function isPreferenceEnabled(preferences, category) {
+	return preferences[category] === true;
+}
+function pendingHas(snapshot, intent) {
+	return snapshot.pending.some((item) => item.id === intent.id && sameKey(item.key, intent.key));
+}
+function recipientCurrent(snapshot, intent) {
+	const registration = snapshot.registrations.find((row) => sameKey(row, intent.key));
+	return !!registration && registration.enabled && registration.health === "ready" && registration.generation === intent.recipientGeneration && registration.keyFingerprint === snapshot.keys?.fingerprint && isPreferenceEnabled(registration.preferences, intent.source.category);
+}
+function boundedSnapshot(snapshot, now) {
+	return {
+		...snapshot,
+		pending: snapshot.pending.filter((item) => item.source.expiresAt > now),
+		receipts: snapshot.receipts.filter((item) => item.expiresAt > now),
+		references: snapshot.references.filter((item) => item.expiresAt > now)
+	};
+}
+/** Coordinates bounded, consent-checked delivery while all durable writes remain registry-owned. */
+var PushDelivery = class {
+	#host;
+	#registry;
+	#sender;
+	#now;
+	#origins = /* @__PURE__ */ new Map();
+	#inFlight = /* @__PURE__ */ new Map();
+	#inFlightIds = /* @__PURE__ */ new Set();
+	#tasks = /* @__PURE__ */ new Set();
+	#tests = [];
+	#testAttempts = /* @__PURE__ */ new Map();
+	#deferredUntil = /* @__PURE__ */ new Map();
+	#purgeTasks = /* @__PURE__ */ new Map();
+	#writeQueue = Promise.resolve();
+	#unsubscribe;
+	#interval;
+	#wakeTimer;
+	#started = false;
+	#closed = false;
+	#admitting = true;
+	#pumping = false;
+	#active = 0;
+	constructor(options) {
+		this.#host = options.host;
+		this.#registry = options.registry;
+		this.#sender = options.sender;
+		this.#now = options.now ?? Date.now;
+	}
+	async start() {
+		if (this.#closed) throw new Error("push delivery is closed");
+		if (this.#started) return;
+		this.#started = true;
+		this.#unsubscribe = this.#host.subscribe((source) => this.observe(source), (sessionId) => {
+			this.#reconcileSession(sessionId).catch(() => void 0);
+		});
+		await this.#reconcileKnownScopes();
+		await this.#reconcilePending();
+		if (this.#closed) return;
+		this.#interval = setInterval(() => {
+			this.#periodicReconcile().catch(() => void 0);
+		}, RECONCILE_INTERVAL_MS);
+		this.#kick();
+	}
+	/** Nonblocking host-observer boundary: admission and durable outbox writes happen later. */
+	observe(source) {
+		if (!this.#admitting || !this.#started || this.#closed) return;
+		this.#admit(source).catch(() => {});
+	}
+	attachOrigin(input) {
+		if (this.#closed) return () => void 0;
+		const id = this.#originId(input);
+		const previous = this.#origins.get(id);
+		if (previous?.active) {
+			previous.active = false;
+			previous.generation += 1;
+			for (const work of this.#inFlight.values()) if (work.origin === previous) work.controller.abort();
+		}
+		const origin = {
+			...input,
+			active: true,
+			generation: (previous?.generation ?? 0) + 1
+		};
+		this.#origins.set(id, origin);
+		this.#clearOriginDeferrals(origin);
+		this.#kick();
+		return () => {
+			if (!origin.active || this.#origins.get(id) !== origin) return;
+			origin.active = false;
+			origin.generation += 1;
+			for (const work of this.#inFlight.values()) if (work.origin === origin) work.controller.abort();
+		};
+	}
+	async invalidateDevices(scopeId, ids) {
+		if (ids.length === 0 || this.#closed) return;
+		const selected = new Set(ids);
+		for (const work of this.#inFlight.values()) if (work.key.scopeId === scopeId && selected.has(work.key.deviceId)) work.controller.abort();
+		await this.#purgeDevices(scopeId, ids);
+		this.#kick();
+	}
+	async test(key) {
+		if (!this.#started || this.#closed || this.#tests.length >= MAX_TEST_QUEUE) throw new Error("push_test_unavailable");
+		const identity = keyId(key);
+		const now = this.#now();
+		const last = this.#testAttempts.get(identity);
+		if (last !== void 0 && now - last < TEST_RATE_LIMIT_MS) throw new Error("push_test_rate_limited");
+		this.#testAttempts.set(identity, now);
+		while (this.#testAttempts.size > 512) this.#testAttempts.delete(this.#testAttempts.keys().next().value);
+		return new Promise((resolve, reject) => {
+			this.#tests.push({
+				kind: "test",
+				key: { ...key },
+				resolve,
+				reject
+			});
+			this.#kick();
+		});
+	}
+	async resolve(owner, reference) {
+		if (this.#closed || !reference) return void 0;
+		let snapshot;
+		try {
+			snapshot = this.#registry.snapshot();
+		} catch {
+			return;
+		}
+		const row = snapshot.references.find((item) => item.reference === reference && ownerId(item.key) === ownerId(owner) && item.expiresAt > this.#now());
+		if (!row || row.source.expiresAt <= this.#now()) return void 0;
+		const origin = this.#originFor(row.key);
+		if (!origin?.active || await this.#guardKey(row.key, row.source, origin, true) !== "allowed") return void 0;
+		try {
+			if (!await this.#host.sessionExists(row.source.targetSessionId)) return void 0;
+			return await this.#host.resolveTarget(row.source);
+		} catch {
+			return;
+		}
+	}
+	async close() {
+		if (this.#closed) return;
+		this.#admitting = false;
+		this.#closed = true;
+		this.#unsubscribe?.();
+		this.#unsubscribe = void 0;
+		if (this.#interval) clearInterval(this.#interval);
+		if (this.#wakeTimer) clearTimeout(this.#wakeTimer);
+		this.#interval = void 0;
+		this.#wakeTimer = void 0;
+		for (const work of this.#inFlight.values()) work.controller.abort();
+		for (const item of this.#tests.splice(0)) item.reject(/* @__PURE__ */ new Error("push_test_unavailable"));
+		await Promise.allSettled([...this.#tasks]);
+		await this.#writeQueue;
+		await Promise.allSettled([...new Set(this.#purgeTasks.values())]);
+		this.#deferredUntil.clear();
+		for (const origin of this.#origins.values()) origin.active = false;
+		this.#origins.clear();
+	}
+	async #admit(source) {
+		if (!this.#admitting || source.expiresAt <= this.#now()) return;
+		let eligible = false;
+		try {
+			eligible = this.#host.available && await this.#host.eligible(source);
+		} catch {
+			eligible = false;
+		}
+		if (!eligible || source.expiresAt <= this.#now()) return;
+		for (const origin of this.#origins.values()) {
+			if (!origin.active || this.#closed) continue;
+			const devices = await this.#readAuthorized(origin);
+			if (!devices || !this.#admitting || this.#closed || !origin.active || this.#origins.get(this.#originId(origin)) !== origin) continue;
+			let snapshot;
+			try {
+				snapshot = this.#registry.snapshot();
+			} catch {
+				return;
+			}
+			const registrations = snapshot.registrations.filter((reg) => reg.scopeId === origin.scopeId && reg.origin === origin.origin && devices.has(reg.deviceId) && reg.enabled && reg.health === "ready" && isPreferenceEnabled(reg.preferences, source.category) && snapshot.keys?.fingerprint === reg.keyFingerprint);
+			if (registrations.length === 0) continue;
+			await this.#write((current) => {
+				const clean = boundedSnapshot(current, this.#now());
+				if (!this.#admitting || this.#closed || !origin.active || this.#origins.get(this.#originId(origin)) !== origin) return clean;
+				const pending = [...clean.pending];
+				for (const registration of registrations) {
+					const key = {
+						scopeId: registration.scopeId,
+						deviceId: registration.deviceId,
+						origin: registration.origin,
+						installationId: registration.installationId
+					};
+					const currentRegistration = clean.registrations.find((row) => sameKey(row, key));
+					if (!currentRegistration || !currentRegistration.enabled || currentRegistration.health !== "ready" || currentRegistration.generation !== registration.generation || currentRegistration.keyFingerprint !== registration.keyFingerprint || clean.keys?.fingerprint !== currentRegistration.keyFingerprint || !isPreferenceEnabled(currentRegistration.preferences, source.category)) continue;
+					if (clean.receipts.some((item) => item.sourceId === source.sourceId && sameKey(item.key, key))) continue;
+					if (pending.some((item) => item.source.sourceId === source.sourceId && sameKey(item.key, key))) continue;
+					if (pending.filter((item) => item.key.scopeId === origin.scopeId).length >= 256) continue;
+					pending.push({
+						id: randomUUID(),
+						key,
+						source: structuredClone(source),
+						ownerGeneration: current.ownerGenerations.find((row) => ownerId(row) === ownerId(key))?.generation ?? 0,
+						recipientGeneration: registration.generation,
+						attempts: 0,
+						nextAttemptAt: this.#now()
+					});
+				}
+				return {
+					...clean,
+					pending
+				};
+			});
+		}
+		this.#kick();
+	}
+	async #reconcileKnownScopes() {
+		let snapshot;
+		try {
+			snapshot = this.#registry.snapshot();
+		} catch {
+			return;
+		}
+		const scopes = /* @__PURE__ */ new Set([
+			...snapshot.ownerGenerations.map((row) => row.scopeId),
+			...snapshot.registrations.map((row) => row.scopeId),
+			...snapshot.pending.map((row) => row.key.scopeId),
+			...snapshot.receipts.map((row) => row.key.scopeId),
+			...snapshot.references.map((row) => row.key.scopeId),
+			...[...this.#origins.values()].map((row) => row.scopeId)
+		]);
+		for (const scopeId of scopes) {
+			if (this.#closed) return;
+			const scopeOrigins = [...this.#origins.values()].filter((row) => row.scopeId === scopeId);
+			const origin = scopeOrigins.find((row) => row.active) ?? scopeOrigins[0];
+			if (!origin) continue;
+			const authorized = await this.#readAuthorized(origin);
+			if (this.#closed) return;
+			if (!authorized) continue;
+			const current = this.#registry.snapshot();
+			const candidates = /* @__PURE__ */ new Set();
+			for (const row of current.ownerGenerations) if (row.scopeId === scopeId) candidates.add(row.deviceId);
+			for (const row of current.registrations) if (row.scopeId === scopeId) candidates.add(row.deviceId);
+			for (const row of current.pending) if (row.key.scopeId === scopeId) candidates.add(row.key.deviceId);
+			for (const row of current.receipts) if (row.key.scopeId === scopeId) candidates.add(row.key.deviceId);
+			for (const row of current.references) if (row.key.scopeId === scopeId) candidates.add(row.key.deviceId);
+			const removed = [...candidates].filter((id) => !authorized.has(id));
+			if (removed.length) await this.#purgeDevices(scopeId, removed);
+		}
+	}
+	async #purgeDevices(scopeId, ids) {
+		const waiting = [];
+		const fresh = [];
+		for (const id of new Set(ids)) {
+			const key = JSON.stringify([scopeId, id]);
+			const ongoing = this.#purgeTasks.get(key);
+			if (ongoing) waiting.push(ongoing);
+			else fresh.push(id);
+		}
+		if (fresh.length) {
+			const task = this.#registry.purgeDevices(scopeId, fresh);
+			for (const id of fresh) this.#purgeTasks.set(JSON.stringify([scopeId, id]), task);
+			const release = () => {
+				for (const id of fresh) if (this.#purgeTasks.get(JSON.stringify([scopeId, id])) === task) this.#purgeTasks.delete(JSON.stringify([scopeId, id]));
+			};
+			task.then(release, release);
+			waiting.push(task);
+		}
+		await Promise.all(waiting);
+	}
+	async #reconcilePending() {
+		let snapshot;
+		try {
+			snapshot = this.#registry.snapshot();
+		} catch {
+			return;
+		}
+		for (const intent of snapshot.pending) {
+			if (this.#closed) return;
+			if (intent.source.expiresAt <= this.#now()) {
+				await this.#removeIntent(intent);
+				continue;
+			}
+			if (snapshot.receipts.some((row) => row.sourceId === intent.source.sourceId && sameKey(row.key, intent.key))) {
+				await this.#removePending(intent);
+				continue;
+			}
+			const guard = await this.#sourceGuard(intent.source);
+			if (this.#closed) return;
+			if (guard === "denied") await this.#removeIntent(intent);
+			else if (guard === "unverifiable") this.#defer(intent);
+		}
+	}
+	async #periodicReconcile() {
+		if (this.#closed) return;
+		this.#pruneDeferred();
+		await this.#reconcileKnownScopes();
+		await this.#reconcilePending();
+		this.#kick();
+	}
+	async #reconcileSession(sessionId) {
+		if (this.#closed) return;
+		let snapshot;
+		try {
+			snapshot = this.#registry.snapshot();
+		} catch {
+			return;
+		}
+		for (const intent of snapshot.pending) {
+			if (intent.source.sessionId !== sessionId) continue;
+			const guard = await this.#sourceGuard(intent.source);
+			if (this.#closed) return;
+			if (guard === "denied") await this.#removeIntent(intent);
+			else if (guard === "unverifiable") this.#defer(intent);
+		}
+		this.#kick();
+	}
+	#kick() {
+		if (!this.#started || this.#closed || this.#pumping) return;
+		this.#pumping = true;
+		this.#pump().finally(() => {
+			this.#pumping = false;
+			this.#scheduleWake();
+		});
+	}
+	async #pump() {
+		while (!this.#closed && this.#active < 4) {
+			const test = this.#tests.shift();
+			if (test) {
+				this.#launchTest(test);
+				continue;
+			}
+			let intents;
+			try {
+				intents = this.#registry.snapshot().pending;
+			} catch {
+				return;
+			}
+			const now = this.#now();
+			const intent = [...intents].filter((item) => item.nextAttemptAt <= now && !this.#inFlightIds.has(item.id) && (this.#deferredUntil.get(item.id) ?? 0) <= now).sort((a, b) => a.nextAttemptAt - b.nextAttemptAt || a.source.createdAt - b.source.createdAt)[0];
+			if (!intent) return;
+			this.#deferredUntil.delete(intent.id);
+			this.#launchIntent(intent);
+		}
+	}
+	#launchIntent(intent) {
+		this.#active += 1;
+		this.#inFlightIds.add(intent.id);
+		const task = this.#sendIntent(intent).catch(() => {
+			this.#defer(intent);
+		}).finally(() => {
+			this.#inFlightIds.delete(intent.id);
+			this.#inFlight.delete(intent.id);
+			this.#active -= 1;
+			this.#kick();
+		});
+		this.#tasks.add(task);
+		task.finally(() => this.#tasks.delete(task));
+	}
+	#launchTest(work) {
+		this.#active += 1;
+		const task = this.#sendTest(work).catch(() => void 0).finally(() => {
+			this.#active -= 1;
+			this.#kick();
+		});
+		this.#tasks.add(task);
+		task.finally(() => this.#tasks.delete(task));
+	}
+	async #sendIntent(intent) {
+		if (this.#closed) return;
+		const origin = this.#originFor(intent.key);
+		if (!origin || this.#originDetached(origin)) {
+			this.#defer(intent);
+			return;
+		}
+		const initial = await this.#guard(intent, origin);
+		if (initial === "denied") {
+			await this.#denyOrDefer(intent, origin);
+			return;
+		}
+		if (initial === "unverifiable") {
+			this.#defer(intent);
+			return;
+		}
+		const setup = await this.#ensureReference(intent);
+		if (!setup) return;
+		const { registration, keys, reference } = setup;
+		const controller = new AbortController();
+		this.#inFlight.set(intent.id, {
+			controller,
+			key: intent.key,
+			origin
+		});
+		if (this.#closed) controller.abort();
+		const remaining = Math.floor((intent.source.expiresAt - this.#now()) / 1e3);
+		if (remaining < 1) {
+			await this.#removeIntent(intent);
+			return;
+		}
+		const payload = buildDeclarativePayload(intent.source.category, registration.locale, `/?mobile-push=${reference}`, intent.source.sourceId.replace(/[^A-Za-z0-9._:-]/gu, "_").slice(0, 128) || "push");
+		let result;
+		try {
+			result = await this.#sender.send({
+				registration,
+				payload,
+				ttlSeconds: Math.min(remaining, 1800),
+				subject: origin.origin,
+				keys,
+				signal: controller.signal,
+				beforeRequest: async (signal) => signal.aborted || controller.signal.aborted ? false : await this.#guard(intent, origin) === "allowed"
+			});
+		} catch {
+			result = { kind: "retry" };
+		}
+		if (this.#closed) return;
+		if (result.kind === "accepted") {
+			await this.#settleIntent(intent, result);
+			return;
+		}
+		if (result.kind === "cancelled") {
+			const current = await this.#guard(intent, origin);
+			if (current === "denied") await this.#denyOrDefer(intent, origin);
+			else if (current === "unverifiable") this.#defer(intent);
+			else await this.#settleIntent(intent, { kind: "retry" });
+			return;
+		}
+		const current = await this.#guard(intent, origin);
+		if (current === "denied") {
+			await this.#denyOrDefer(intent, origin);
+			return;
+		}
+		if (current === "unverifiable") {
+			this.#defer(intent);
+			return;
+		}
+		await this.#settleIntent(intent, result);
+	}
+	async #sendTest(work) {
+		if (this.#closed) {
+			work.reject(/* @__PURE__ */ new Error("push_test_unavailable"));
+			return;
+		}
+		const origin = this.#originFor(work.key);
+		if (!origin) {
+			work.reject(/* @__PURE__ */ new Error("push_test_unavailable"));
+			return;
+		}
+		const fakeSource = {
+			sourceId: `test:${randomUUID()}`,
+			sessionId: "",
+			targetSessionId: "",
+			category: "response",
+			createdAt: this.#now(),
+			expiresAt: this.#now() + 6e4,
+			lifetime: "committed"
+		};
+		if (await this.#guardKey(work.key, fakeSource, origin, false) !== "allowed") {
+			work.reject(/* @__PURE__ */ new Error("push_test_unavailable"));
+			return;
+		}
+		let snapshot;
+		try {
+			snapshot = this.#registry.snapshot();
+		} catch {
+			work.reject(/* @__PURE__ */ new Error("push_test_unavailable"));
+			return;
+		}
+		const registration = snapshot.registrations.find((row) => sameKey(row, work.key));
+		const keys = snapshot.keys;
+		if (!registration || !keys) {
+			work.reject(/* @__PURE__ */ new Error("push_test_unavailable"));
+			return;
+		}
+		const controller = new AbortController();
+		const workId = `test:${randomUUID()}`;
+		this.#inFlight.set(workId, {
+			controller,
+			key: work.key,
+			origin
+		});
+		let result;
+		try {
+			result = await this.#sender.send({
+				registration,
+				payload: buildDeclarativePayload("test", registration.locale, "/", `test-${randomUUID()}`),
+				ttlSeconds: 60,
+				subject: origin.origin,
+				keys,
+				signal: controller.signal,
+				beforeRequest: async (signal) => !signal.aborted && !controller.signal.aborted && await this.#guardKey(work.key, fakeSource, origin, false, registration.generation) === "allowed"
+			});
+		} catch {
+			result = { kind: "retry" };
+		} finally {
+			this.#inFlight.delete(workId);
+		}
+		if (!this.#closed && (result.kind === "gone" || result.kind === "suspended")) try {
+			await this.#registry.settleRecipient(work.key, registration.generation, result.kind);
+		} catch {}
+		const finalGuard = result.kind === "accepted" && !this.#closed ? await this.#guardKey(work.key, fakeSource, origin, false, registration.generation) : "denied";
+		if (result.kind === "accepted" && finalGuard === "allowed" && !this.#closed) work.resolve();
+		else work.reject(/* @__PURE__ */ new Error("push_test_unavailable"));
+	}
+	async #guard(intent, origin) {
+		return this.#guardKey(intent.key, intent.source, origin, true, intent.recipientGeneration);
+	}
+	/** Maps the Host tri-state for durable-work decisions; boolean eligible() would collapse transient uncertainty into denial. */
+	async #sourceGuard(source) {
+		if (!this.#host.available) return "unverifiable";
+		let result;
+		try {
+			result = await this.#host.reconcile(source);
+		} catch {
+			return "unverifiable";
+		}
+		if (result === "eligible") return "allowed";
+		if (result === "stale") return "denied";
+		if (source.category === "plan" || source.category === "approval" || source.category === "question" && typeof source.callId !== "string") return "denied";
+		return "unverifiable";
+	}
+	async #guardKey(key, source, origin, requireEligible, expectedGeneration) {
+		const epoch = origin.generation;
+		if (this.#closed || !origin.active || this.#origins.get(this.#originId(origin)) !== origin || source.expiresAt <= this.#now()) return "denied";
+		if (!this.#host.available) return "unverifiable";
+		let first;
+		try {
+			first = this.#registration(key);
+		} catch {
+			return "unverifiable";
+		}
+		if (!first || !first.enabled || first.health !== "ready" || expectedGeneration !== void 0 && first.generation !== expectedGeneration || requireEligible && !isPreferenceEnabled(first.preferences, source.category)) return "denied";
+		if (requireEligible) {
+			const guard = await this.#sourceGuard(source);
+			if (guard === "denied") return "denied";
+			if (guard === "unverifiable") return "unverifiable";
+		}
+		const auth = await this.#readAuthorized(origin);
+		if (!auth) return "unverifiable";
+		const device = auth.get(key.deviceId);
+		if (!device || device.expiresAt <= this.#now()) return "denied";
+		if (this.#closed || !origin.active || origin.generation !== epoch || this.#origins.get(this.#originId(origin)) !== origin || source.expiresAt <= this.#now()) return "denied";
+		let latest;
+		let latestFingerprint;
+		try {
+			latest = this.#registration(key);
+			latestFingerprint = this.#registry.snapshot().keys?.fingerprint;
+		} catch {
+			return "unverifiable";
+		}
+		if (!latest || !latest.enabled || latest.health !== "ready" || latest.generation !== first.generation || latest.keyFingerprint !== first.keyFingerprint || latestFingerprint !== latest.keyFingerprint || expectedGeneration !== void 0 && latest.generation !== expectedGeneration || requireEligible && !isPreferenceEnabled(latest.preferences, source.category)) return "denied";
+		return "allowed";
+	}
+	async #ensureReference(intent) {
+		let reference = "";
+		let registration;
+		let keys;
+		try {
+			await this.#write((snapshot) => {
+				const clean = boundedSnapshot(snapshot, this.#now());
+				if (!pendingHas(clean, intent)) return clean;
+				registration = clean.registrations.find((row) => sameKey(row, intent.key) && row.generation === intent.recipientGeneration);
+				keys = clean.keys;
+				if (!registration || !keys) return clean;
+				const old = clean.references.find((row) => row.source.sourceId === intent.source.sourceId && sameKey(row.key, intent.key) && row.expiresAt > this.#now());
+				reference = old?.reference ?? randomBytes(24).toString("base64url");
+				if (!old) {
+					const rows = clean.references.filter((row) => row.key.scopeId !== intent.key.scopeId);
+					const kept = clean.references.filter((row) => row.key.scopeId === intent.key.scopeId).slice(-1023);
+					return {
+						...clean,
+						references: [
+							...rows,
+							...kept,
+							{
+								reference,
+								key: intent.key,
+								source: structuredClone(intent.source),
+								expiresAt: intent.source.expiresAt
+							}
+						]
+					};
+				}
+				return clean;
+			});
+		} catch {
+			this.#defer(intent);
+			return;
+		}
+		return registration && keys && reference ? {
+			registration,
+			keys,
+			reference
+		} : void 0;
+	}
+	async #settleIntent(intent, result) {
+		if (result.kind === "accepted") {
+			await this.#write((snapshot) => {
+				const clean = boundedSnapshot(snapshot, this.#now());
+				if (!pendingHas(clean, intent) || intent.source.expiresAt <= this.#now()) return clean;
+				if (!recipientCurrent(clean, intent)) return {
+					...clean,
+					pending: clean.pending.filter((row) => row.id !== intent.id),
+					references: clean.references.filter((row) => !(row.source.sourceId === intent.source.sourceId && sameKey(row.key, intent.key)))
+				};
+				const duplicate = clean.receipts.some((row) => row.sourceId === intent.source.sourceId && sameKey(row.key, intent.key));
+				const rows = clean.receipts.filter((row) => row.key.scopeId !== intent.key.scopeId);
+				const sameScope = clean.receipts.filter((row) => row.key.scopeId === intent.key.scopeId);
+				const receipt = {
+					sourceId: intent.source.sourceId,
+					key: intent.key,
+					recipientGeneration: intent.recipientGeneration,
+					expiresAt: intent.source.expiresAt
+				};
+				const receipts = duplicate ? clean.receipts : [
+					...rows,
+					...sameScope.slice(-1023),
+					receipt
+				];
+				return {
+					...clean,
+					pending: clean.pending.filter((row) => row.id !== intent.id),
+					receipts
+				};
+			});
+			return;
+		}
+		if (result.kind === "gone" || result.kind === "suspended") {
+			await this.#registry.settleRecipient(intent.key, intent.recipientGeneration, result.kind);
+			await this.#removeIntent(intent);
+			return;
+		}
+		if (result.kind === "permanent") {
+			await this.#removeIntent(intent);
+			return;
+		}
+		if (result.kind !== "retry") {
+			await this.#removeIntent(intent);
+			return;
+		}
+		const attempt = intent.attempts + 1;
+		const remainingMs = intent.source.expiresAt - this.#now();
+		if (attempt >= 3 || remainingMs <= 0) {
+			await this.#removeIntent(intent);
+			return;
+		}
+		const retryAfter = result.retryAfterMs;
+		const backoff = RETRY_BACKOFF_MS[attempt - 1] ?? 5e3;
+		const delay = Number.isFinite(retryAfter) && retryAfter >= 0 ? retryAfter : backoff;
+		if (delay >= remainingMs) {
+			await this.#removeIntent(intent);
+			return;
+		}
+		await this.#write((snapshot) => {
+			const clean = boundedSnapshot(snapshot, this.#now());
+			if (!pendingHas(clean, intent)) return clean;
+			if (!recipientCurrent(clean, intent)) return {
+				...clean,
+				pending: clean.pending.filter((row) => row.id !== intent.id),
+				references: clean.references.filter((row) => !(row.source.sourceId === intent.source.sourceId && sameKey(row.key, intent.key)))
+			};
+			return {
+				...clean,
+				pending: clean.pending.map((row) => row.id === intent.id ? {
+					...row,
+					attempts: attempt,
+					nextAttemptAt: this.#now() + delay
+				} : row)
+			};
+		});
+	}
+	async #removePending(intent) {
+		await this.#write((snapshot) => ({
+			...boundedSnapshot(snapshot, this.#now()),
+			pending: snapshot.pending.filter((row) => row.id !== intent.id)
+		}));
+	}
+	async #removeIntent(intent) {
+		await this.#write((snapshot) => ({
+			...boundedSnapshot(snapshot, this.#now()),
+			pending: snapshot.pending.filter((row) => row.id !== intent.id),
+			references: snapshot.references.filter((row) => !(row.source.sourceId === intent.source.sourceId && sameKey(row.key, intent.key)))
+		}));
+	}
+	#defer(intent) {
+		this.#deferredUntil.set(intent.id, this.#now() + UNVERIFIABLE_RECHECK_MS);
+	}
+	/** Defer keys live only as long as their owning pending intent survives every removal path. */
+	#pruneDeferred() {
+		let pending;
+		try {
+			pending = this.#registry.snapshot().pending;
+		} catch {
+			return;
+		}
+		pruneOrphanedDeferrals(this.#deferredUntil, pending);
+	}
+	async #readAuthorized(origin) {
+		try {
+			const rows = await origin.authorizedDevices();
+			if (!Array.isArray(rows)) return void 0;
+			const result = /* @__PURE__ */ new Map();
+			for (const row of rows) {
+				if (!row || typeof row.id !== "string" || row.id.length === 0 || !Number.isFinite(row.expiresAt)) return void 0;
+				result.set(row.id, row);
+			}
+			return result;
+		} catch {
+			return;
+		}
+	}
+	#registration(key) {
+		const snapshot = this.#registry.snapshot();
+		const registration = snapshot.registrations.find((row) => sameKey(row, key));
+		if (!registration || snapshot.keys?.fingerprint !== registration.keyFingerprint) return void 0;
+		return registration;
+	}
+	#originFor(key) {
+		return this.#origins.get(JSON.stringify([key.scopeId, key.origin]));
+	}
+	#originId(origin) {
+		return JSON.stringify([origin.scopeId, origin.origin]);
+	}
+	/** True when the origin object is inactive or has been replaced — a transient state, never authorization evidence. */
+	#originDetached(origin) {
+		return !origin.active || this.#origins.get(this.#originId(origin)) !== origin;
+	}
+	/** Defers rather than removes when the denial could stem from origin state; removal stays reserved for authorization-backed denial. */
+	async #denyOrDefer(intent, origin) {
+		if (this.#originDetached(origin)) this.#defer(intent);
+		else await this.#removeIntent(intent);
+	}
+	#clearOriginDeferrals(origin) {
+		if (this.#deferredUntil.size === 0) return;
+		let pending;
+		try {
+			pending = this.#registry.snapshot().pending;
+		} catch {
+			return;
+		}
+		for (const intent of pending) if (intent.key.scopeId === origin.scopeId && intent.key.origin === origin.origin) this.#deferredUntil.delete(intent.id);
+	}
+	#write(update) {
+		const operation = this.#writeQueue.then(() => this.#registry.transact((snapshot) => update(boundedSnapshot(snapshot, this.#now()))));
+		this.#writeQueue = operation.catch(() => void 0);
+		return operation;
+	}
+	#scheduleWake() {
+		if (this.#closed) return;
+		if (this.#wakeTimer) clearTimeout(this.#wakeTimer);
+		this.#wakeTimer = void 0;
+		this.#pruneDeferred();
+		let nextAt = Number.POSITIVE_INFINITY;
+		try {
+			for (const intent of this.#registry.snapshot().pending) {
+				if (this.#inFlightIds.has(intent.id)) continue;
+				nextAt = Math.min(nextAt, Math.max(intent.nextAttemptAt, this.#deferredUntil.get(intent.id) ?? 0));
+			}
+		} catch {
+			return;
+		}
+		if (this.#tests.length) nextAt = this.#now();
+		if (!Number.isFinite(nextAt)) return;
+		const delay = Math.max(0, nextAt - this.#now());
+		this.#wakeTimer = setTimeout(() => {
+			this.#wakeTimer = void 0;
+			this.#kick();
+		}, delay);
+	}
+};
+//#endregion
+//#region src/mobile-push/gateway.ts
+/** One service shared by every Gateway while each Gateway owns a separate auth/origin attachment. */
+var PushGatewayCoordinator = class {
+	host;
+	registry;
+	delivery;
+	origins = /* @__PURE__ */ new Map();
+	closed = false;
+	constructor(host, registry, delivery) {
+		this.host = host;
+		this.registry = registry;
+		this.delivery = delivery;
+	}
+	attachOrigin(binding) {
+		if (this.closed) return () => void 0;
+		if (!binding.scopeId || !binding.origin) throw new Error("push_origin_invalid");
+		let parsed;
+		try {
+			parsed = new URL(binding.origin);
+		} catch {
+			throw new Error("push_origin_invalid");
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.origin !== binding.origin || parsed.username !== "" || parsed.password !== "" || parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "") throw new Error("push_origin_invalid");
+		const id = JSON.stringify([binding.scopeId, binding.origin]);
+		if (this.origins.has(id)) throw new Error("push_origin_already_attached");
+		const detachDelivery = this.delivery.attachOrigin(binding);
+		const row = {
+			binding,
+			detachDelivery
+		};
+		this.origins.set(id, row);
+		let active = true;
+		return () => {
+			if (!active) return;
+			active = false;
+			if (this.origins.get(id) === row) this.origins.delete(id);
+			detachDelivery();
+		};
+	}
+	async invalidateDevices(scopeId, deviceIds) {
+		await this.delivery.invalidateDevices(scopeId, deviceIds);
+	}
+	async reset() {
+		await this.registry.resetKeys();
+	}
+	async config(owner, installationId) {
+		const authorized = await this.authorize(owner);
+		const config = await this.registry.config(owner, installationId);
+		return {
+			...config,
+			available: config.available && this.host.available && authorized
+		};
+	}
+	async enroll(owner, input) {
+		if (!this.host.available) throw new Error("push_unavailable");
+		await this.authorize(owner);
+		let subscription;
+		try {
+			subscription = validatePushSubscription(input.subscription);
+		} catch (error) {
+			throw new Error(error instanceof Error ? error.message : "push_subscription_invalid");
+		}
+		return this.registry.upsert(owner, {
+			...input,
+			subscription
+		});
+	}
+	async preferences(owner, installationId, value, guard) {
+		await this.authorize(owner);
+		return this.registry.preferences({
+			...owner,
+			installationId
+		}, value, guard);
+	}
+	async disable(owner, installationId, ifGeneration) {
+		await this.authorize(owner);
+		await this.registry.disable({
+			...owner,
+			installationId
+		}, ifGeneration);
+	}
+	async logout(owner) {
+		await this.authorize(owner);
+		await this.registry.disableOwner(owner);
+	}
+	async test(owner, installationId) {
+		if (!this.host.available) throw new Error("push_unavailable");
+		await this.authorize(owner);
+		await this.delivery.test({
+			...owner,
+			installationId
+		});
+	}
+	async resolve(owner, reference) {
+		if (!this.host.available || !await this.authorize(owner, true)) return void 0;
+		return this.delivery.resolve(owner, reference);
+	}
+	/** Close only this service's origin attachments; its owning plugin closes shared Delivery/Host/Registry. */
+	close() {
+		if (this.closed) return;
+		this.closed = true;
+		for (const row of this.origins.values()) row.detachDelivery();
+		this.origins.clear();
+	}
+	async authorize(owner, neutralMissing = false) {
+		const row = this.origins.get(JSON.stringify([owner.scopeId, owner.origin]));
+		if (!row) {
+			if (neutralMissing) return false;
+			throw new Error("push_unavailable");
+		}
+		let devices;
+		try {
+			devices = await row.binding.authorizedDevices();
+		} catch {
+			throw new Error("push_unavailable");
+		}
+		if (!devices.some((device) => device.id === owner.deviceId && device.expiresAt > Date.now())) {
+			if (neutralMissing) return false;
+			throw new Error("push_unauthorized");
+		}
+		return true;
+	}
+};
+//#endregion
+//#region src/installation-id.ts
+const INSTALLATION_ID_PATTERN = /^[a-f0-9]{64}\n$/u;
+const INSTALLATION_ID_BYTES = 65;
+async function readInstallationId(file) {
+	const entry = await lstat(file);
+	if (!entry.isFile() || entry.isSymbolicLink() || entry.size !== INSTALLATION_ID_BYTES) throw new Error("installation_id_invalid");
+	const contents = await readFile(file, "utf8");
+	if (!INSTALLATION_ID_PATTERN.test(contents)) throw new Error("installation_id_invalid");
+	await restrictPrivateFile(file);
+	return contents.slice(0, -1);
+}
+/** Keep one random plugin identity across setup changes, restarts, and FRP resets; creation requires hard-link support in the state directory. */
+async function loadOrCreateInstallationId(file) {
+	if (!isAbsolute(file)) throw new Error("installation ID path must be absolute");
+	const target = resolve(file);
+	const directory = dirname(target);
+	await ensureManagedDirectory(directory, directory, "installation_id");
+	try {
+		return await readInstallationId(target);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const temporary = join(directory, `.${basename(target)}.${randomBytes(12).toString("hex")}.tmp`);
+	let created = false;
+	let failure;
+	try {
+		await assertManagedParents(directory, temporary, "installation_id");
+		const handle = await open(temporary, "wx", 384);
+		created = true;
+		let writeFailure;
+		try {
+			await handle.writeFile(`${randomBytes(32).toString("hex")}\n`, "utf8");
+		} catch (error) {
+			writeFailure = error;
+			throw error;
+		} finally {
+			try {
+				await handle.close();
+			} catch (closeError) {
+				if (writeFailure !== void 0) throw new AggregateError([writeFailure, closeError], "installation ID candidate write and close failed");
+				throw closeError;
+			}
+		}
+		await restrictPrivateFile(temporary);
+		await assertManagedParents(directory, target, "installation_id");
+		try {
+			await link(temporary, target);
+		} catch (error) {
+			if (error.code !== "EEXIST") throw new Error("installation ID publication failed; the state filesystem must support hard links", { cause: error });
+		}
+		return await readInstallationId(target);
+	} catch (error) {
+		failure = error;
+		throw error;
+	} finally {
+		if (created) try {
+			await assertManagedParents(directory, temporary, "installation_id");
+			await unlink(temporary);
+		} catch (cleanupError) {
+			if (failure !== void 0) throw new AggregateError([failure, cleanupError], "installation ID publication and temporary cleanup failed");
+			throw cleanupError;
+		}
+	}
+}
+//#endregion
+//#region src/gateway-identity.ts
+/**
+* Attach the authenticated installation identity while retaining existing entry identity rules.
+* @param config - Validated gateway configuration containing the legacy identity.
+* @param installationId - Confirmed random identity read from this installation's state.
+* @param explicitIdentity - Whether the operator supplied the gateway identity.
+* @returns Configuration retaining certificate/operator identities or the new and legacy public identities.
+*/
+function withInstallationIdentity(config, installationId, explicitIdentity) {
 	if (config.pairingCaFile !== void 0 || explicitIdentity) return Object.freeze({
 		...config,
 		installationId
@@ -19939,6 +23348,31 @@ const inject = [
 	"commands",
 	"connection"
 ];
+const pushHostServices = [
+	"userQuestions",
+	"approval",
+	"sessionProjections",
+	"sessionQuery",
+	"agents"
+];
+const unavailablePushPreferences = Object.freeze({
+	question: true,
+	plan: true,
+	approval: true,
+	response: true,
+	goal: true,
+	failure: true
+});
+function unavailablePushConfig(installationId) {
+	return {
+		available: false,
+		installationId,
+		ownerGeneration: 0,
+		registrationGeneration: 0,
+		status: "disabled",
+		preferences: unavailablePushPreferences
+	};
+}
 /** Run cleanup steps in ownership order and report every failure after all steps settle. */
 async function settleCleanupSteps(steps) {
 	const errors = [];
@@ -20262,6 +23696,9 @@ function locateIrohCompanionRoots(importMetaUrl, environment = process.env) {
 async function apply(ctx, config) {
 	const dshVersion = installedDshVersion();
 	const loaded = await loadSetup(config);
+	/** Rebind overrides the managed setup at runtime; the file on disk is the source of truth on restart. */
+	let managedSetupOverride;
+	let lanRebindRecoveryRequired = false;
 	const mobileAccess = createMobileAccessService(ctx);
 	const baseTemplate = loopbackTemplate(loaded, ctx.webServer.port);
 	const upstreamLoginUrl = upstreamAuthenticatedUrl(ctx, baseTemplate.upstreamOrigin);
@@ -20284,6 +23721,210 @@ async function apply(ctx, config) {
 			logger.info("task event=%s fields=%o", event, fields);
 		}
 	});
+	let pushHost;
+	let pushRegistry;
+	let pushDelivery;
+	let pushGatewayService;
+	let pushRuntimeReady;
+	let resolvePushRuntimeReady;
+	let activePushRuntimeGeneration;
+	const pushOriginAttachments = /* @__PURE__ */ new Map();
+	const pendingDeviceInvalidations = /* @__PURE__ */ new Map();
+	const beginPushRuntimeReadiness = () => {
+		if (pushGatewayService !== void 0) return Promise.resolve(pushGatewayService);
+		pushRuntimeReady ??= new Promise((resolve) => {
+			resolvePushRuntimeReady = resolve;
+		});
+		return pushRuntimeReady;
+	};
+	const settlePushRuntimeReadiness = (service) => {
+		const resolve = resolvePushRuntimeReady;
+		resolvePushRuntimeReady = void 0;
+		pushRuntimeReady = void 0;
+		resolve?.(service);
+	};
+	const setPushGatewayService = (service) => {
+		for (const attachment of pushOriginAttachments.values()) {
+			try {
+				attachment.detach?.();
+			} catch {
+				logger.warn("declarative push origin detach failed");
+			}
+			attachment.detach = void 0;
+		}
+		pushGatewayService = service;
+		if (service !== void 0) for (const attachment of pushOriginAttachments.values()) try {
+			attachment.detach = service.attachOrigin(attachment.binding);
+		} catch {
+			logger.warn("declarative push origin attach failed; Mobile access remains active");
+		}
+		settlePushRuntimeReadiness(service);
+	};
+	const currentPushGatewayService = async () => {
+		if (pushGatewayService !== void 0) return pushGatewayService;
+		return pushRuntimeReady === void 0 ? void 0 : pushRuntimeReady;
+	};
+	const requiredPushGatewayService = async () => {
+		const service = await currentPushGatewayService();
+		if (service === void 0) throw new Error("push_unavailable");
+		return service;
+	};
+	const queueDeviceInvalidations = (scopeId, deviceIds) => {
+		let queued = pendingDeviceInvalidations.get(scopeId);
+		if (queued === void 0) pendingDeviceInvalidations.set(scopeId, queued = /* @__PURE__ */ new Set());
+		for (const deviceId of deviceIds) queued.add(deviceId);
+	};
+	const flushDeviceInvalidations = async (service) => {
+		while (pendingDeviceInvalidations.size > 0) {
+			const batch = [...pendingDeviceInvalidations];
+			pendingDeviceInvalidations.clear();
+			for (const [scopeId, deviceIds] of batch) await service.invalidateDevices(scopeId, [...deviceIds]);
+		}
+	};
+	const pushGatewayFacade = {
+		attachOrigin(binding) {
+			const id = Symbol("dsh-mobile push origin");
+			const attachment = {
+				binding,
+				detach: void 0
+			};
+			pushOriginAttachments.set(id, attachment);
+			try {
+				if (pushGatewayService !== void 0) attachment.detach = pushGatewayService.attachOrigin(binding);
+			} catch (error) {
+				pushOriginAttachments.delete(id);
+				throw error;
+			}
+			let active = true;
+			return () => {
+				if (!active) return;
+				active = false;
+				pushOriginAttachments.delete(id);
+				try {
+					attachment.detach?.();
+				} finally {
+					attachment.detach = void 0;
+				}
+			};
+		},
+		async invalidateDevices(scopeId, deviceIds) {
+			if (pushGatewayService !== void 0) {
+				await pushGatewayService.invalidateDevices(scopeId, deviceIds);
+				return;
+			}
+			queueDeviceInvalidations(scopeId, deviceIds);
+		},
+		async reset() {
+			await (await requiredPushGatewayService()).reset();
+		},
+		async config(owner, installationId) {
+			const service = await currentPushGatewayService();
+			return service === void 0 ? unavailablePushConfig(installationId) : service.config(owner, installationId);
+		},
+		async enroll(owner, input) {
+			return (await requiredPushGatewayService()).enroll(owner, input);
+		},
+		async preferences(owner, installationId, value, guard) {
+			return (await requiredPushGatewayService()).preferences(owner, installationId, value, guard);
+		},
+		async disable(owner, installationId, ifGeneration) {
+			await (await requiredPushGatewayService()).disable(owner, installationId, ifGeneration);
+		},
+		async logout(owner) {
+			const service = await currentPushGatewayService();
+			if (service !== void 0) {
+				await service.logout(owner);
+				return;
+			}
+			if (activePushRuntimeGeneration !== void 0 || pushRegistry !== void 0) throw new Error("push_unavailable");
+			const saved = await new JsonPushStore(join(stateDirectory, "mobile-push", "push-state.json")).load();
+			if (activePushRuntimeGeneration !== void 0 || pushRegistry !== void 0 || saved.registrations.some((row) => row.enabled && row.scopeId === owner.scopeId && row.deviceId === owner.deviceId && row.origin === owner.origin)) throw new Error("push_unavailable");
+		},
+		async test(owner, installationId) {
+			await (await requiredPushGatewayService()).test(owner, installationId);
+		},
+		async resolve(owner, reference) {
+			return (await requiredPushGatewayService()).resolve(owner, reference);
+		}
+	};
+	const closePushRuntime = async (coordinatorOverride) => {
+		const coordinator = coordinatorOverride ?? pushGatewayService;
+		if (pushGatewayService === coordinator) setPushGatewayService(void 0);
+		else if (coordinator === void 0) settlePushRuntimeReadiness(void 0);
+		const delivery = pushDelivery;
+		pushDelivery = void 0;
+		const registry = pushRegistry;
+		pushRegistry = void 0;
+		const host = pushHost;
+		pushHost = void 0;
+		await settleCleanupSteps([
+			() => coordinator?.close(),
+			() => delivery?.close(),
+			() => registry?.close(),
+			() => host?.close()
+		]);
+	};
+	const initializePushRuntime = async (pushContext, isActive) => {
+		try {
+			pushHost = createPushHost(pushContext);
+			if (!pushHost.available) {
+				logger.info("declarative push unavailable: this DSH Host lacks the required public notification services");
+				return;
+			}
+			pushRegistry = new PushRegistry(new JsonPushStore(join(stateDirectory, "mobile-push", "push-state.json")), createVapidKeys);
+			await pushRegistry.initialize();
+			if (!isActive()) return;
+			pushDelivery = new PushDelivery({
+				host: pushHost,
+				registry: pushRegistry,
+				sender: new PushSender()
+			});
+			await pushDelivery.start();
+			if (!isActive()) return;
+			const coordinator = new PushGatewayCoordinator(pushHost, pushRegistry, pushDelivery);
+			await flushDeviceInvalidations(coordinator);
+			if (!isActive()) return;
+			setPushGatewayService(coordinator);
+		} catch (error) {
+			logger.warn("declarative push unavailable; Mobile access remains active (%s)", error instanceof Error ? error.name : "initialization-failed");
+			if (isActive()) try {
+				await closePushRuntime();
+			} catch {
+				logger.warn("declarative push cleanup failed; Mobile access remains active");
+			}
+		}
+	};
+	const startPushRuntimeGeneration = (pushContext) => {
+		const generation = {
+			active: true,
+			ready: beginPushRuntimeReadiness(),
+			initialization: Promise.resolve()
+		};
+		activePushRuntimeGeneration = generation;
+		generation.initialization = (async () => {
+			await initializePushRuntime(pushContext, () => generation.active);
+			if (generation.active && pushGatewayService === void 0) settlePushRuntimeReadiness(void 0);
+		})();
+		return generation;
+	};
+	const closePushRuntimeGeneration = (generation) => {
+		if (generation.closePromise !== void 0) return generation.closePromise;
+		generation.active = false;
+		if (activePushRuntimeGeneration !== generation) {
+			generation.closePromise = generation.initialization;
+			return generation.closePromise;
+		}
+		const coordinator = pushGatewayService;
+		if (coordinator !== void 0) setPushGatewayService(void 0);
+		else settlePushRuntimeReadiness(void 0);
+		generation.closePromise = (async () => {
+			await generation.initialization;
+			if (activePushRuntimeGeneration !== generation) return;
+			activePushRuntimeGeneration = void 0;
+			await closePushRuntime(coordinator);
+		})();
+		return generation.closePromise;
+	};
 	const remoteDirectory = join(stateDirectory, "remote");
 	const configuredDshHome = process.env.DSH_HOME?.trim();
 	const releaseManager = new PluginReleaseManager({ profileDirectory: releaseProfileDirectory(ctx, configuredDshHome === void 0 || configuredDshHome === "" ? dirname(stateDirectory) : resolve(configuredDshHome), process.argv.slice(2)) });
@@ -20354,8 +23995,17 @@ async function apply(ctx, config) {
 	let lanGateway;
 	let preparedLanSetup;
 	let trustedNetworksRestartRequired = false;
-	let trustedNetworksWrite = Promise.resolve();
+	let lanConfigurationWork = Promise.resolve();
 	let adminClosing = false;
+	const mutateLan = (operation) => {
+		if (adminClosing) return Promise.reject(new HttpError(503, "unavailable"));
+		const run = lanConfigurationWork.then(() => {
+			if (adminClosing) throw new HttpError(503, "unavailable");
+			return operation();
+		});
+		lanConfigurationWork = run.then(() => {}, () => {});
+		return run;
+	};
 	const startGateway = async (candidateConfig) => {
 		const resolved = withInstallationIdentity(parseGatewayConfig({
 			...candidateConfig,
@@ -20371,7 +24021,7 @@ async function apply(ctx, config) {
 			logger.info("upstream auth %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.warn("slow api %s", JSON.stringify(entry));
-		});
+		}, pushGatewayFacade);
 		await candidate.start();
 		lanGateway = candidate;
 		const removeTaskSink = taskEventHub.add(candidate);
@@ -20385,12 +24035,13 @@ async function apply(ctx, config) {
 		if (loaded.kind === "unconfigured") throw new Error(preparedLanSetup === void 0 ? "lan_setup_required" : "lan_setup_restart_required");
 		if (loaded.kind === "fixed") return startGateway(loaded.config);
 		const following = new FollowingMobileAccessRuntime(async () => {
-			const network = selectLanNetwork(void 0, loaded.setup.networkInterface);
+			const setup = managedSetupOverride ?? loaded.setup;
+			const network = selectLanNetwork(void 0, setup.networkInterface);
 			return {
 				key: `${network.name}\0${network.address}\0${network.cidr}`,
 				start: async () => startGateway({
 					...loaded.config,
-					...await materializeManagedSetup(loaded.setup)
+					...await materializeManagedSetup(setup)
 				})
 			};
 		}, (error) => {
@@ -20435,7 +24086,7 @@ async function apply(ctx, config) {
 			logger.info("upstream auth %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.warn("slow api %s", JSON.stringify(entry));
-		});
+		}, pushGatewayFacade);
 		await candidate.start();
 		return candidate;
 	};
@@ -20487,7 +24138,7 @@ async function apply(ctx, config) {
 			logger.info("upstream auth %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.warn("slow api %s", JSON.stringify(entry));
-		});
+		}, pushGatewayFacade);
 		try {
 			await candidate.start();
 		} catch (error) {
@@ -20506,7 +24157,7 @@ async function apply(ctx, config) {
 			logger.info("upstream auth %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.warn("slow api %s", JSON.stringify(entry));
-		});
+		}, pushGatewayFacade);
 		try {
 			await candidate.start();
 		} catch (error) {
@@ -20638,6 +24289,8 @@ async function apply(ctx, config) {
 			restartRequired: preparedLanSetup !== void 0
 		} : {},
 		running: lanController.isRunning(),
+		rebindSupported: loaded.kind === "managed",
+		...lanRebindRecoveryRequired ? { recoveryRequired: true } : {},
 		origin: lanGateway?.address().origin,
 		...preparedLanSetup === void 0 ? {} : { pendingOrigin: preparedLanSetup.origin },
 		...lanGateway === void 0 ? {} : { extensions: lanGateway.extensionStatus() }
@@ -20735,9 +24388,19 @@ async function apply(ctx, config) {
 		handler: async (request, response) => {
 			try {
 				const target = parseRequestTarget(request.url);
-				assertLocalAdminTrust(request, request.method === "POST", () => (isLoopbackAddress(request.socket.remoteAddress ?? "") || supportsRemoteAdminAuthentication) && authenticateDesktopAdmin(request), baseTemplate.adminAllowedCidrs);
+				const pushReset = target.decodedPathname === `${LOCAL_ADMIN_PREFIX}/push/reset`;
+				assertLocalAdminTrust(request, request.method === "POST", () => (isLoopbackAddress(request.socket.remoteAddress ?? "") || supportsRemoteAdminAuthentication) && authenticateDesktopAdmin(request), pushReset ? [] : baseTemplate.adminAllowedCidrs);
 				if (adminClosing) throw new HttpError(503, "unavailable");
 				if (target.search !== "") throw new HttpError(400, "bad_request");
+				if (pushReset) {
+					if (request.method !== "POST") throw new HttpError(405, "method_not_allowed");
+					const body = await readJsonObject(request, 1024);
+					if (Object.keys(body).length !== 1 || body.confirm !== "reset-web-push") throw new HttpError(400, "bad_request");
+					if (pushGatewayService === void 0) throw new HttpError(503, "push_unavailable");
+					await pushGatewayService.reset();
+					sendJson(response, 200, { reset: true }, false);
+					return;
+				}
 				const lanControl = target.decodedPathname === `/api/mobile-access/control` || target.decodedPathname === `/api/mobile-access/lan/control`;
 				if (request.method === "GET" && lanControl) {
 					sendJson(response, 200, lanPayload(), false);
@@ -20790,13 +24453,10 @@ async function apply(ctx, config) {
 					} catch {
 						throw new HttpError(400, "lan_trusted_networks_invalid");
 					}
-					const write = trustedNetworksWrite.then(async () => {
-						if (adminClosing) throw new HttpError(503, "unavailable");
+					await mutateLan(async () => {
 						await saveManagedTrustedNetworks(loaded.setupFile, values);
 						trustedNetworksRestartRequired = true;
 					});
-					trustedNetworksWrite = write.catch(() => void 0);
-					await write;
 					sendJson(response, 200, await trustedNetworksPayload(), false);
 					return;
 				}
@@ -20825,10 +24485,13 @@ async function apply(ctx, config) {
 					return;
 				}
 				if (request.method === "POST" && lanControl) {
-					const body = await readJsonObject(request, 4096);
-					if (typeof body.running !== "boolean") throw new HttpError(400, "bad_request");
-					if (body.running && loaded.kind === "unconfigured") throw new HttpError(409, preparedLanSetup === void 0 ? "lan_setup_required" : "lan_setup_restart_required");
-					await lanController.setRunning(body.running);
+					const running = (await readJsonObject(request, 4096)).running;
+					if (typeof running !== "boolean") throw new HttpError(400, "bad_request");
+					if (running && loaded.kind === "unconfigured") throw new HttpError(409, preparedLanSetup === void 0 ? "lan_setup_required" : "lan_setup_restart_required");
+					await mutateLan(async () => {
+						if (running && lanRebindRecoveryRequired) throw new HttpError(409, "lan_rebind_recovery_required");
+						await lanController.setRunning(running);
+					});
 					sendJson(response, 200, lanPayload(), false);
 					return;
 				}
@@ -20858,6 +24521,74 @@ async function apply(ctx, config) {
 					sendJson(response, 200, await lanSetupPayload(), false);
 					return;
 				}
+				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/lan/networks`) {
+					await lanConfigurationWork;
+					const networks = availableLanNetworks();
+					const preferred = await preferredLanInterfaceNames();
+					let recommendedAddress;
+					try {
+						recommendedAddress = selectLanNetwork(void 0, void 0, void 0, preferred).address;
+					} catch {}
+					const currentInterface = loaded.kind === "managed" ? (managedSetupOverride ?? loaded.setup).networkInterface : void 0;
+					sendJson(response, 200, {
+						supported: loaded.kind === "managed",
+						currentInterface,
+						listenPort: loaded.kind === "managed" ? loaded.setup.listenPort : 3443,
+						platform: process.platform,
+						networks: networks.map((network) => ({
+							name: network.name,
+							address: network.address,
+							cidr: network.cidr,
+							current: network.name === currentInterface,
+							recommended: network.address === recommendedAddress
+						}))
+					}, false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/lan/rebind`) {
+					if (loaded.kind !== "managed") throw new HttpError(409, "lan_rebind_unsupported");
+					const body = await readJsonObject(request, 4096);
+					const networkInterface = typeof body.networkInterface === "string" ? body.networkInterface : "";
+					if (networkInterface === "" || Object.keys(body).some((key) => key !== "networkInterface")) throw new HttpError(400, "bad_request");
+					sendJson(response, 200, await mutateLan(async () => {
+						let network;
+						try {
+							network = selectLanNetwork(void 0, networkInterface);
+						} catch {
+							throw new HttpError(409, "lan_rebind_network_unavailable");
+						}
+						const current = managedSetupOverride ?? loaded.setup;
+						if (!lanRebindRecoveryRequired && current.networkInterface === networkInterface) throw new HttpError(409, "lan_rebind_unchanged");
+						const previousOrigin = lanGateway?.address().origin;
+						try {
+							const result = await rebindManagedLan({
+								setupFile: loaded.setupFile,
+								controller: lanController,
+								network,
+								publish: (setup) => {
+									managedSetupOverride = setup;
+								}
+							});
+							trustedNetworksRestartRequired = false;
+							lanRebindRecoveryRequired = false;
+							return {
+								origin: lanGateway?.address().origin ?? `https://${network.address}:${String(result.setup.listenPort)}`,
+								previousOrigin,
+								restartRequired: false,
+								disconnected: result.running,
+								ready: lanGateway !== void 0
+							};
+						} catch (error) {
+							if (error instanceof ManagedLanConfigurationError) throw new HttpError(409, "lan_rebind_configuration_invalid");
+							if (!(error instanceof MobileAccessReconfigurationError)) throw new HttpError(503, "lan_rebind_unavailable");
+							const recovered = error.recovered;
+							if (!recovered) lanRebindRecoveryRequired = true;
+							logger.error("managed LAN rebind failed; prior configuration restored: %s", String(recovered));
+							throw new HttpError(500, recovered ? "lan_rebind_failed" : "lan_rebind_recovery_required");
+						}
+					}), false);
+					return;
+				}
 				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/remote/control`) {
 					sendJson(response, 200, remotePayload(), false);
 					return;
@@ -21340,7 +25071,20 @@ async function apply(ctx, config) {
 				};
 			}
 		});
+		let disposePushRuntimeInjection;
 		try {
+			const pushHostPresent = pushHostServices.every((service) => ctx.get(service) !== void 0);
+			if (pushHostPresent) beginPushRuntimeReadiness();
+			const pushRuntimeFiber = ctx.inject(pushHostServices, (pushContext) => {
+				const generation = startPushRuntimeGeneration(pushContext);
+				return () => closePushRuntimeGeneration(generation);
+			});
+			disposePushRuntimeInjection = () => pushRuntimeFiber.dispose();
+			if (pushHostPresent) {
+				await pushRuntimeFiber.await();
+				const generation = activePushRuntimeGeneration;
+				if (generation !== void 0) await generation.ready;
+			}
 			await mobileAccess.startLocal(template.extensionsDir, ctx, { hostExecution: template.hostExecution });
 			await lanController.initialize();
 			const stores = {
@@ -21363,7 +25107,7 @@ async function apply(ctx, config) {
 					stopAdmin,
 					drainRemoteWork,
 					() => releaseManager.dispose(),
-					() => trustedNetworksWrite,
+					() => lanConfigurationWork,
 					disposeMobileCommand,
 					disposeTaskEvents,
 					async () => {
@@ -21371,6 +25115,8 @@ async function apply(ctx, config) {
 						if (failures.length > 0) throw new AggregateError(failures, "remote provider cleanup failed");
 					},
 					() => lanController.close(),
+					() => disposePushRuntimeInjection?.(),
+					closePushRuntime,
 					() => mobileAccess.stopLocal(),
 					unregisterBuiltin
 				]);
@@ -21384,7 +25130,7 @@ async function apply(ctx, config) {
 				stopAdmin,
 				drainRemoteWork,
 				() => releaseManager.dispose(),
-				() => trustedNetworksWrite,
+				() => lanConfigurationWork,
 				disposeMobileCommand,
 				disposeTaskEvents,
 				async () => {
@@ -21392,6 +25138,8 @@ async function apply(ctx, config) {
 					if (failures.length > 0) throw new AggregateError(failures, "remote provider cleanup failed");
 				},
 				() => lanController.close(),
+				() => disposePushRuntimeInjection?.(),
+				closePushRuntime,
 				() => mobileAccess.stopLocal(),
 				unregisterBuiltin
 			]);