workerdeck 0.6.0 → 0.7.0

package/build/{instance-kupxU5UD.mjs → instance-DbIqlX-e.mjs}

@@ -2,10 +2,516 @@ import { createReadStream, existsSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { createFileSessionStore, createWorkerServer } from "@workerdeck/server";
 import { dashboardDir } from "@workerdeck/web";
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash, createPrivateKey, randomBytes, sign, timingSafeEqual } from "node:crypto";
 import { chmod, mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { connect } from "node:http2";
 import { homedir } from "node:os";
 import { pathToFileURL } from "node:url";
+//#region src/apns/client.ts
+/**
+* The environment is per *device token*, not per deployment, and that is the
+* single most expensive thing to get wrong here: a build run from Xcode gets a
+* sandbox token, a TestFlight build gets a production one, and the two
+* namespaces do not overlap. Same key, same phone, different token — cross them
+* and Apple answers `BadDeviceToken`. So the app declares which environment it
+* registered in and the forwarder routes each token to its own host.
+*/
+const HOSTS = {
+	development: "https://api.sandbox.push.apple.com",
+	production: "https://api.push.apple.com"
+};
+/**
+* Apple rejects a provider token older than an hour, and rate-limits refreshing
+* one (`TooManyProviderTokenUpdates`) if you re-sign much more often than every
+* twenty minutes. Forty sits in the middle of that window with room for clock
+* skew at both ends — and re-signing per push, the obvious-looking thing, is
+* exactly what the rate limit exists to punish.
+*/
+const TOKEN_TTL_MS = 2400 * 1e3;
+const REQUEST_TIMEOUT_MS = 1e4;
+const base64url = (input) => Buffer.from(input).toString("base64url");
+/**
+* Load and sanity-check the auth key. Done once at startup rather than at the
+* first push, so a mistyped path is a launch error with a clear message instead
+* of a notification that silently never arrives.
+*/
+async function loadApnsKey(keyFile) {
+	let pem;
+	try {
+		pem = await readFile(keyFile, "utf8");
+	} catch (error) {
+		throw new Error(`apns: cannot read the auth key at ${keyFile}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	let key;
+	try {
+		key = createPrivateKey(pem);
+	} catch (error) {
+		throw new Error(`apns: ${keyFile} is not a private key (${error instanceof Error ? error.message : String(error)})`);
+	}
+	if (key.asymmetricKeyType !== "ec") throw new Error(`apns: ${keyFile} is a ${key.asymmetricKeyType ?? "unknown"} key, not EC — an APNs auth key is the .p8 downloaded from Keys in the developer portal, not a certificate`);
+	return key;
+}
+/**
+* A cached provider JWT. The signature is over `{alg:ES256,kid}` + `{iss,iat}`,
+* and JWS wants the raw `r||s` pair — `sign()` produces a DER SEQUENCE unless
+* told otherwise, which Apple rejects with a bare 403 and no explanation.
+*/
+function createProviderToken(key, keyId, teamId) {
+	let cached = null;
+	return {
+		get(now = Date.now()) {
+			if (cached !== null && now - cached.issuedAt < TOKEN_TTL_MS) return cached.token;
+			const signingInput = `${base64url(JSON.stringify({
+				alg: "ES256",
+				kid: keyId
+			}))}.${base64url(JSON.stringify({
+				iss: teamId,
+				iat: Math.floor(now / 1e3)
+			}))}`;
+			const token = `${signingInput}.${base64url(sign("sha256", Buffer.from(signingInput), {
+				key,
+				dsaEncoding: "ieee-p1363"
+			}))}`;
+			cached = {
+				token,
+				issuedAt: now
+			};
+			return token;
+		},
+		invalidate() {
+			cached = null;
+		}
+	};
+}
+/**
+* One long-lived HTTP/2 session per environment, reconnected on demand. APNs
+* sends GOAWAY routinely (it rebalances connections), so a dead session is a
+* normal event and not an error worth surfacing — the next push simply dials
+* again.
+*/
+function createSessionPool(hosts) {
+	const sessions = /* @__PURE__ */ new Map();
+	const failures = /* @__PURE__ */ new Map();
+	const drop = (environment, session) => {
+		if (sessions.get(environment) === session) sessions.delete(environment);
+	};
+	return {
+		get(environment) {
+			const existing = sessions.get(environment);
+			if (existing !== void 0 && !existing.closed && !existing.destroyed) return existing;
+			const session = connect(hosts[environment]);
+			sessions.set(environment, session);
+			failures.delete(environment);
+			session.on("error", (error) => {
+				failures.set(environment, `${error.code ?? "error"}: ${error.message}`);
+				drop(environment, session);
+			});
+			session.on("goaway", (code, _lastStreamId, data) => {
+				const detail = data !== void 0 && data.length > 0 ? `: ${data.toString("utf8").slice(0, 200)}` : "";
+				failures.set(environment, `GOAWAY ${code}${detail}`);
+				drop(environment, session);
+			});
+			session.on("close", () => drop(environment, session));
+			session.setTimeout(5 * 6e4, () => session.close());
+			return session;
+		},
+		lastFailure: (environment) => failures.get(environment),
+		close() {
+			for (const session of sessions.values()) session.close();
+			sessions.clear();
+		}
+	};
+}
+function createApnsClient(config, key, options = {}) {
+	const providerToken = createProviderToken(key, config.keyId, config.teamId);
+	const pool = createSessionPool(options.hosts ?? HOSTS);
+	const post = (request, jwt) => new Promise((resolve) => {
+		const body = Buffer.from(JSON.stringify(request.payload));
+		let stream;
+		try {
+			stream = pool.get(request.environment).request({
+				":method": "POST",
+				":path": `/3/device/${request.deviceToken}`,
+				authorization: `bearer ${jwt}`,
+				"apns-topic": config.topic,
+				"apns-push-type": "alert",
+				"apns-priority": String(request.priority ?? 10),
+				"apns-expiration": String(request.expiration ?? 0),
+				"content-length": String(body.byteLength),
+				...request.collapseId === void 0 ? {} : { "apns-collapse-id": request.collapseId }
+			});
+		} catch (error) {
+			resolve({
+				ok: false,
+				status: 0,
+				reason: error instanceof Error ? error.message : String(error),
+				unregistered: false
+			});
+			return;
+		}
+		let status = 0;
+		let apnsId;
+		const chunks = [];
+		let settled = false;
+		const settle = (result) => {
+			if (settled) return;
+			settled = true;
+			resolve(result);
+		};
+		stream.setTimeout(REQUEST_TIMEOUT_MS, () => {
+			stream.close();
+			settle({
+				ok: false,
+				status: 0,
+				reason: "Timeout",
+				unregistered: false
+			});
+		});
+		stream.on("response", (headers) => {
+			status = Number(headers[":status"] ?? 0);
+			const id = headers["apns-id"];
+			apnsId = typeof id === "string" ? id : void 0;
+		});
+		stream.on("data", (chunk) => chunks.push(chunk));
+		stream.on("error", (error) => {
+			const cause = pool.lastFailure(request.environment);
+			settle({
+				ok: false,
+				status,
+				reason: cause !== void 0 ? `${cause} (stream: ${error.message})` : error.message,
+				unregistered: false
+			});
+		});
+		stream.on("end", () => {
+			if (status === 200) {
+				settle({
+					ok: true,
+					apnsId
+				});
+				return;
+			}
+			let reason = `HTTP ${status}`;
+			try {
+				const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+				if (typeof parsed.reason === "string") reason = parsed.reason;
+			} catch {}
+			settle({
+				ok: false,
+				status,
+				reason,
+				unregistered: reason === "Unregistered" || reason === "BadDeviceToken"
+			});
+		});
+		stream.end(body);
+	});
+	return {
+		async send(request) {
+			const first = await post(request, providerToken.get());
+			if (!first.ok && first.reason === "ExpiredProviderToken") {
+				providerToken.invalidate();
+				return post(request, providerToken.get());
+			}
+			return first;
+		},
+		close: pool.close
+	};
+}
+//#endregion
+//#region src/apns/devices.ts
+const FILENAME = "apns-devices.json";
+/** Apple's tokens are 64 hex chars today. The upper bound is generous because
+* Apple has reserved the right to grow them; the lower one just rejects junk. */
+const TOKEN_PATTERN = /^[0-9a-fA-F]{32,200}$/;
+const MAX_BODY_BYTES = 4096;
+const isEnvironment = (value) => value === "development" || value === "production";
+/**
+* `dir` null keeps the registry in memory: a restart then forgets every token,
+* which is survivable because the app re-registers on launch, but it does mean
+* an instance with no state dir goes quiet until each phone is next opened.
+*/
+async function createDeviceRegistry(options) {
+	const path = options.dir === null ? null : join(options.dir, FILENAME);
+	const devices = /* @__PURE__ */ new Map();
+	if (path !== null) try {
+		const parsed = JSON.parse(await readFile(path, "utf8"));
+		for (const record of parsed.devices ?? []) if (typeof record?.token === "string" && isEnvironment(record.environment)) devices.set(record.token, record);
+	} catch {}
+	const persist = async () => {
+		if (path === null) return;
+		try {
+			await mkdir(options.dir, {
+				recursive: true,
+				mode: 448
+			});
+			await writeFile(path, `${JSON.stringify({ devices: [...devices.values()] }, null, 2)}\n`, { mode: 384 });
+			await chmod(path, 384);
+		} catch (error) {
+			options.onError?.(error, {
+				op: "write",
+				path
+			});
+		}
+	};
+	return {
+		list: () => [...devices.values()],
+		async register(record) {
+			const existing = devices.get(record.token);
+			devices.set(record.token, {
+				...record,
+				updatedAt: Date.now()
+			});
+			if (existing !== void 0 && existing.environment === record.environment && existing.hostId === record.hostId) return;
+			await persist();
+		},
+		async remove(token) {
+			if (!devices.delete(token)) return;
+			await persist();
+		}
+	};
+}
+const respond = (res, status, body) => {
+	res.writeHead(status, {
+		"content-type": "application/json",
+		"cache-control": "no-store"
+	}).end(JSON.stringify(body));
+};
+const readBody = (req) => new Promise((resolve) => {
+	const chunks = [];
+	let size = 0;
+	let settled = false;
+	const finish = (value) => {
+		if (!settled) {
+			settled = true;
+			resolve(value);
+		}
+	};
+	req.on("data", (chunk) => {
+		size += chunk.length;
+		if (size > MAX_BODY_BYTES) {
+			finish(null);
+			return;
+		}
+		chunks.push(chunk);
+	});
+	req.on("end", () => finish(Buffer.concat(chunks).toString("utf8")));
+	req.on("error", () => finish(null));
+});
+/**
+* `POST /apns/devices` to register a token, `DELETE /apns/devices` to drop one.
+* Returns true when it consumed the request.
+*
+* Deliberately outside `/v1`: this is the forwarder's own surface, not part of
+* the protocol `packages/protocol` defines, and a client that finds a 404 here
+* has simply reached a gateway running without push configured.
+*
+* DELETE exists so removing a gateway from the app can stop its pushes. Without
+* it a forgotten server keeps buzzing a phone that no longer has any way to act
+* on what it says.
+*/
+function createDeviceRoute(registry, authenticate) {
+	return async (req, res) => {
+		let pathname;
+		try {
+			pathname = new URL(req.url ?? "/", "http://internal").pathname;
+		} catch {
+			return false;
+		}
+		if (pathname !== "/apns/devices") return false;
+		if (req.method !== "POST" && req.method !== "DELETE") {
+			res.writeHead(405, { allow: "POST, DELETE" }).end();
+			return true;
+		}
+		if (authenticate(req) === null) {
+			respond(res, 401, { error: "unauthorized" });
+			return true;
+		}
+		const raw = await readBody(req);
+		if (raw === null) {
+			respond(res, 413, { error: "body too large" });
+			res.once("finish", () => req.destroy());
+			return true;
+		}
+		let body;
+		try {
+			body = JSON.parse(raw);
+		} catch {
+			respond(res, 400, { error: "invalid JSON body" });
+			return true;
+		}
+		const token = body.token;
+		if (typeof token !== "string" || !TOKEN_PATTERN.test(token)) {
+			respond(res, 400, { error: "token must be a hex APNs device token" });
+			return true;
+		}
+		if (req.method === "DELETE") {
+			await registry.remove(token);
+			res.writeHead(204).end();
+			return true;
+		}
+		if (!isEnvironment(body.environment)) {
+			respond(res, 400, { error: "environment must be 'development' or 'production'" });
+			return true;
+		}
+		const optionalString = (value) => typeof value === "string" && value.length > 0 && value.length <= 200 ? value : void 0;
+		await registry.register({
+			token,
+			environment: body.environment,
+			hostId: optionalString(body.hostId),
+			bundleId: optionalString(body.bundleId),
+			platform: optionalString(body.platform)
+		});
+		respond(res, 200, {
+			registered: true,
+			environment: body.environment
+		});
+		return true;
+	};
+}
+//#endregion
+//#region src/apns/forwarder.ts
+/**
+* Turns the server's session notifications into APNs pushes.
+*
+* The architectural point, restated because it is easy to erode: session
+* webhooks are the primitive and this is one consumer of them. It hooks
+* `notifications.onNotification` in-process — same process as the gateway, so
+* there is no HTTP hop — but nothing about the server knows that, and the same
+* events can just as well drive Slack or a custom relay. Push credentials live
+* here and nowhere in `packages/server`.
+*/
+/** APNs caps a payload at 4 KB. Staying well under leaves room for the alert
+* dictionary to grow without anyone rediscovering the limit the hard way. */
+const MAX_PAYLOAD_BYTES = 3800;
+const BODY_LIMIT = 300;
+/** Category identifiers are wire contract with the app: it registers the
+* Approve/Deny actions under this exact string, and a mismatch means a
+* notification that arrives with no buttons on it. */
+const CATEGORY = {
+	permission: "PERMISSION_REQUEST",
+	event: "SESSION_EVENT"
+};
+const label = (session) => {
+	const title = session.title?.trim();
+	if (title !== void 0 && title !== "") return title;
+	const leaf = session.cwd.split("/").filter(Boolean).at(-1);
+	return leaf !== void 0 && leaf !== "" ? leaf : session.id;
+};
+const oneLine = (text, limit = BODY_LIMIT) => {
+	const flat = (text ?? "").replace(/\s+/g, " ").trim();
+	return flat.length <= limit ? flat : `${flat.slice(0, limit - 1)}…`;
+};
+/** A collapse id is capped at 64 bytes and a session id has no such bound, so
+* hash rather than truncate — two sessions sharing a prefix must not collapse
+* into each other. */
+const collapseKey = (sessionId) => createHash("sha256").update(sessionId).digest("base64url").slice(0, 32);
+const titleFor = (notification, name) => {
+	switch (notification.type) {
+		case "permission_requested": return `Approval needed — ${name}`;
+		case "turn_completed": return notification.result?.isError === true ? `Turn failed — ${name}` : name;
+		case "session_error": return `Session error — ${name}`;
+		case "session_closed": return `Session ended — ${name}`;
+		default: return name;
+	}
+};
+const bodyFor = (notification) => {
+	const preview = oneLine(notification.preview);
+	if (preview !== "") return preview;
+	switch (notification.type) {
+		case "permission_requested": return "The agent is waiting for your approval.";
+		case "turn_completed": return "The turn finished.";
+		case "session_closed": return `Closed by the ${notification.reason ?? "server"}.`;
+		default: return "Something needs your attention.";
+	}
+};
+/**
+* Build the push for one notification.
+*
+* The payload carries routing and nothing else — `sessionId` to deep-link,
+* `requestId` because a lock-screen Approve has nothing to POST to without it,
+* and `hostId` so a client with two gateways knows which one this came from.
+* Everything else the app fetches over REST the moment it opens; a transcript
+* has no business in a 4 KB envelope.
+*/
+function buildPush(notification, hostId) {
+	const permission = notification.type === "permission_requested";
+	const name = label(notification.session);
+	let body = bodyFor(notification);
+	const build = (text) => ({
+		aps: {
+			alert: {
+				title: titleFor(notification, name),
+				body: text
+			},
+			sound: "default",
+			category: permission ? CATEGORY.permission : CATEGORY.event,
+			"thread-id": notification.sessionId
+		},
+		type: notification.type,
+		sessionId: notification.sessionId,
+		seq: notification.seq,
+		...hostId === void 0 ? {} : { hostId },
+		...notification.request === void 0 ? {} : { requestId: notification.request.id }
+	});
+	let payload = build(body);
+	while (Buffer.byteLength(JSON.stringify(payload)) > MAX_PAYLOAD_BYTES && body.length > 16) {
+		body = oneLine(body, Math.floor(body.length / 2));
+		payload = build(body);
+	}
+	return {
+		payload,
+		priority: permission || notification.type === "session_error" ? 10 : 5,
+		expiration: permission && notification.request?.expiresAt !== void 0 ? Math.floor(notification.request.expiresAt / 1e3) : Math.floor(Date.now() / 1e3) + 3600,
+		...notification.type === "turn_completed" ? { collapseId: `t:${collapseKey(notification.sessionId)}` } : {}
+	};
+}
+async function createApnsForwarder(options) {
+	const warn = options.warn ?? ((message) => process.stderr.write(`[workerdeck] apns: ${message}\n`));
+	const key = await loadApnsKey(options.config.keyFile);
+	const client = createApnsClient(options.config, key);
+	const registry = await createDeviceRegistry({
+		dir: options.stateDir,
+		onError: (error, context) => warn(`device registry ${context.op} failed for ${context.path}: ${error instanceof Error ? error.message : String(error)}`)
+	});
+	const handleRequest = createDeviceRoute(registry, options.authenticate);
+	const fallbackEnvironment = options.config.production === false ? "development" : "production";
+	/** Per-session delivery chain, so a session's pushes arrive in the order the
+	* events happened — which matters precisely because `turn_completed` collapses
+	* and an out-of-order pair would leave the older text on screen. */
+	const chains = /* @__PURE__ */ new Map();
+	const deliver = async (notification) => {
+		const devices = registry.list();
+		if (devices.length === 0) return;
+		await Promise.all(devices.map(async (device) => {
+			const push = buildPush(notification, device.hostId);
+			const result = await client.send({
+				...push,
+				deviceToken: device.token,
+				environment: device.environment ?? fallbackEnvironment
+			});
+			if (result.ok) return;
+			if (result.unregistered) {
+				await registry.remove(device.token);
+				return;
+			}
+			warn(`push to ${device.token.slice(0, 8)}… failed: ${result.reason} (${result.status})`);
+		}));
+	};
+	return {
+		onNotification(notification) {
+			const next = (chains.get(notification.sessionId) ?? Promise.resolve()).then(() => deliver(notification).catch((error) => {
+				warn(error instanceof Error ? error.message : String(error));
+			}));
+			chains.set(notification.sessionId, next);
+			next.then(() => {
+				if (chains.get(notification.sessionId) === next) chains.delete(notification.sessionId);
+			});
+		},
+		handleRequest,
+		deviceCount: () => registry.list().length,
+		close: client.close
+	};
+}
+//#endregion
 //#region src/auth-key.ts
 /** 48 hex chars — far past `createCliAuth`'s 12-char floor, and header-safe. */
 const generateKey = () => randomBytes(24).toString("hex");
@@ -469,6 +975,7 @@ function parseArgs(argv) {
 	const flags = {
 		profiles: [],
 		cwdRoots: [],
+		fsRoots: [],
 		allowedOrigins: [],
 		allowedHosts: [],
 		insecureHosts: []
@@ -525,6 +1032,13 @@ function parseArgs(argv) {
 				flags.cwdRoots.push(resolve(next(i, arg)));
 				i++;
 				break;
+			case "--fs-root":
+				flags.fsRoots.push(resolve(next(i, arg)));
+				i++;
+				break;
+			case "--fs-write":
+				flags.fsWrite = true;
+				break;
 			case "--allowed-origin":
 				flags.allowedOrigins.push(next(i, arg));
 				i++;
@@ -658,6 +1172,8 @@ function resolveInstanceConfig(flags, loaded, env = process.env, cwd = process.c
 	const stateDir = flags.parking === false || loaded.options.stateDir === null ? null : flags.stateDir ?? env.WORKERDECK_STATE_DIR ?? loaded.options.stateDir ?? defaultStateDir(loaded.path);
 	const envCwdRoots = env.WORKERDECK_CWD_ROOTS?.split(":").filter(Boolean).map((p) => resolve(cwd, p));
 	const cwdRoots = flags.cwdRoots.length ? flags.cwdRoots : envCwdRoots;
+	const envFsRoots = env.WORKERDECK_FS_ROOTS?.split(":").filter(Boolean).map((p) => resolve(cwd, p));
+	const fsRoots = flags.fsRoots.length ? flags.fsRoots : envFsRoots;
 	const auth = {
 		...loaded.options.auth,
 		secret: authKey,
@@ -669,9 +1185,14 @@ function resolveInstanceConfig(flags, loaded, env = process.env, cwd = process.c
 		...[...flags.allowedHosts, ...loaded.options.allowedHosts ?? []].map((name) => name.toLowerCase()),
 		...insecureHosts
 	]);
-	const { port: _p, host: _h, auth: _a, stateDir: _s, allowedHosts: _ah, insecureHosts: _ih, webRoot: _w, ...serverOptions } = loaded.options;
+	const { port: _p, host: _h, auth: _a, stateDir: _s, allowedHosts: _ah, insecureHosts: _ih, webRoot: _w, apns: _ap, ...serverOptions } = loaded.options;
 	const options = { ...serverOptions };
 	if (cwdRoots?.length) options.allowedCwdRoots = cwdRoots;
+	if (fsRoots?.length || flags.fsWrite) options.hostFiles = {
+		...loaded.options.hostFiles,
+		...fsRoots?.length ? { roots: fsRoots } : {},
+		...flags.fsWrite ? { write: true } : {}
+	};
 	if (flags.profiles.length) options.profiles = flags.profiles;
 	return {
 		port,
@@ -684,10 +1205,33 @@ function resolveInstanceConfig(flags, loaded, env = process.env, cwd = process.c
 		generateAuthKey,
 		allowedHosts,
 		webRoot: loaded.options.webRoot,
+		apns: resolveApns(loaded),
 		open: flags.open ?? false,
 		options
 	};
 }
+/**
+* A relative `keyFile` resolves against the config file's own directory, not the
+* cwd — the same convention `defaultStateDir` uses, and the one that makes a
+* deployment directory self-contained. Missing required fields throw here rather
+* than at the first push, since a half-configured forwarder is a notification
+* that silently never arrives.
+*/
+function resolveApns(loaded) {
+	const apns = loaded.options.apns;
+	if (!apns) return void 0;
+	for (const field of [
+		"keyFile",
+		"keyId",
+		"teamId",
+		"topic"
+	]) if (typeof apns[field] !== "string" || apns[field] === "") throw new ConfigError(`apns.${field} is required when apns is configured`);
+	const base = loaded.path ? dirname(loaded.path) : process.cwd();
+	return {
+		...apns,
+		keyFile: resolve(base, apns.keyFile)
+	};
+}
 //#endregion
 //#region src/login-page.ts
 const escapeHtml = (value) => value.replace(/[&<>"']/g, (c) => ({
@@ -907,8 +1451,13 @@ function createHostGuard(allowedHosts) {
 * ungated — they are the app's own code, hold no secrets, and gating them would
 * only mean the login page could not be styled by the app it gates. Documents
 * come last, and that is the single place the auth decision is made.
+*
+* The APNs device route sits between auth and assets: it does its own
+* authentication (header only — it is never called by a browser), and it must
+* not fall through to the SPA's catch-all, which would answer a failed
+* registration with a 200 and an HTML document.
 */
-function createFallback(auth, webRoot, hostAllowed) {
+function createFallback(auth, webRoot, hostAllowed, apnsRoute) {
 	return async (req, res) => {
 		if (!hostAllowed(req)) {
 			res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
@@ -916,6 +1465,7 @@ function createFallback(auth, webRoot, hostAllowed) {
 			return;
 		}
 		if (await auth.handleAuthRequest(req, res)) return;
+		if (apnsRoute !== void 0 && await apnsRoute(req, res)) return;
 		const pathname = new URL(req.url ?? "/", "http://internal").pathname;
 		if (looksLikeAsset(pathname)) {
 			const filePath = resolveWithinRoot(webRoot, pathname);
@@ -962,7 +1512,12 @@ async function startInstance(config, options = {}) {
 	} : config.auth);
 	if (config.allowedHosts === null && !config.hostAuthenticates && !auth.enabled) throw new Error("refusing to serve: the resolved config expects auth but no shared secret was materialized — this instance would be open while believing itself authenticated");
 	const hostAllowed = createHostGuard(config.allowedHosts);
-	const fallback = createFallback(auth, webRoot, hostAllowed);
+	const apns = config.apns === void 0 ? void 0 : await createApnsForwarder({
+		config: config.apns,
+		stateDir: config.stateDir,
+		authenticate: (req) => hostAllowed(req) ? auth.authenticate(req) : null
+	});
+	const fallback = createFallback(auth, webRoot, hostAllowed, apns?.handleRequest);
 	const parking = { ...config.options.parking };
 	if (config.stateDir && !parking.store) parking.store = createFileSessionStore({
 		dir: join(config.stateDir, "parked"),
@@ -974,6 +1529,13 @@ async function startInstance(config, options = {}) {
 		...config.options,
 		checkCredentials: config.options.checkCredentials ?? true,
 		parking,
+		notifications: apns === void 0 ? config.options.notifications : {
+			...config.options.notifications,
+			onNotification: (notification) => {
+				config.options.notifications?.onNotification?.(notification);
+				apns.onNotification(notification);
+			}
+		},
 		fallback,
 		authenticate: config.hostAuthenticates ? (req) => hostAllowed(req) ? config.options.authenticate(req) : null : (req) => hostAllowed(req) ? auth.authenticate(req) : null
 	});
@@ -999,6 +1561,10 @@ async function startInstance(config, options = {}) {
 		else if (auth.enabled) line("  auth: shared key — browsers sign in, services send a header");
 		else line("  NO AUTH — anyone who can reach this port gets a session");
 		line(config.stateDir ? `  parked sessions persist in ${join(config.stateDir, "parked")}` : "  parked sessions are in memory only — a restart drops them");
+		if (apns) {
+			const count = apns.deviceCount();
+			line(`  push: APNs forwarder on ${config.apns?.topic} — ${count === 0 ? "no devices registered yet" : `${count} device(s)`}`);
+		}
 		if (config.configPath) line(`  config ${config.configPath}`);
 		line("");
 	}
@@ -1009,11 +1575,12 @@ async function startInstance(config, options = {}) {
 		closed,
 		close: async () => {
 			await server.close();
+			apns?.close();
 			resolveClosed();
 		}
 	};
 }
 //#endregion
-export { ConfigError as a, isLoopback as c, parseArgs as d, resolveInstanceConfig as f, renderLoginPage as i, isLoopbackHostname as l, materializeAuthKey as m, resolveWebRoot as n, defaultStateDir as o, createCliAuth as p, startInstance as r, hostnameOf as s, createHostGuard as t, loadConfigFile as u };
+export { createDeviceRegistry as _, ConfigError as a, loadApnsKey as b, isLoopback as c, parseArgs as d, resolveInstanceConfig as f, createApnsForwarder as g, buildPush as h, renderLoginPage as i, isLoopbackHostname as l, materializeAuthKey as m, resolveWebRoot as n, defaultStateDir as o, createCliAuth as p, startInstance as r, hostnameOf as s, createHostGuard as t, loadConfigFile as u, createDeviceRoute as v, createApnsClient as y };
 
-//# sourceMappingURL=instance-kupxU5UD.mjs.map
+//# sourceMappingURL=instance-DbIqlX-e.mjs.map