crossmate

push-worker.js (45003B)

---

 export class PushRegistry {
   constructor(state, env) {
     this.state = state;
     this.env = env;
     this.cachedJWT = null;
     this.cachedJWTExpiresAt = 0;
   }
 
   async fetch(request) {
     const url = new URL(request.url);
 
     if (url.pathname === "/attest/challenge" && request.method === "POST") {
       return this.handleAttestationChallenge(request);
     }
     if (url.pathname === "/attest/register" && request.method === "POST") {
       return this.handleAttestationRegister(request);
     }
 
     const bodyText = await request.text();
     const auth = await this.authenticate(request, bodyText);
     if (!auth.ok) {
       console.warn("Push worker auth failed", {
         method: request.method,
         path: url.pathname,
         status: auth.status,
         message: auth.message,
         authVersion: request.headers.get("X-Crossmate-Auth-Version") || "",
         deviceIDLength: (request.headers.get("X-Crossmate-Device-ID") || "").length,
         keyIDLength: (request.headers.get("X-Crossmate-Key-ID") || "").length,
         bodyLength: bodyText.length
       });
       return new Response(auth.message, { status: auth.status });
     }
 
     if (url.pathname === "/register" && request.method === "POST") {
       return this.handleRegister(bodyText, auth);
     }
     if (url.pathname === "/register" && request.method === "DELETE") {
       return this.handleUnregister(bodyText, auth);
     }
     if (url.pathname === "/publish" && request.method === "POST") {
       return this.handlePublish(request, bodyText, auth);
     }
     const gameRegister = url.pathname.match(/^\/games\/([^/]+)\/register$/);
     if (gameRegister && request.method === "POST") {
       return this.handleGameRegister(gameRegister[1], bodyText);
     }
     return new Response("Not found", { status: 404 });
   }
 
   async authenticate(request, bodyText) {
     try {
       return await this.authenticateAppAttest(request, bodyText);
     } catch (error) {
       return { ok: false, status: 401, message: `Bad App Attest auth: ${error.message}` };
     }
   }
 
   async authenticateAppAttest(request, bodyText) {
     if ((request.headers.get("X-Crossmate-Auth-Version") || "") !== "appattest-v1") {
       return { ok: false, status: 401, message: "Missing App Attest auth" };
     }
     const deviceID = request.headers.get("X-Crossmate-Device-ID") || "";
     const keyID = request.headers.get("X-Crossmate-Key-ID") || "";
     const timestamp = request.headers.get("X-Crossmate-Timestamp") || "";
     const nonce = request.headers.get("X-Crossmate-Nonce") || "";
     const bodyHash = request.headers.get("X-Crossmate-Body-SHA256") || "";
     const assertionBase64 = request.headers.get("X-Crossmate-Assertion") || "";
     if (!deviceID || !keyID || !timestamp || !nonce || !bodyHash || !assertionBase64) {
       return { ok: false, status: 401, message: "Incomplete App Attest auth" };
     }
 
     const nowSeconds = Math.floor(Date.now() / 1000);
     const timestampSeconds = Number(timestamp);
     const maxSkewSeconds = Number(this.env.MAX_AUTH_SKEW_SECONDS || "120");
     if (!Number.isFinite(timestampSeconds) || Math.abs(nowSeconds - timestampSeconds) > maxSkewSeconds) {
       return { ok: false, status: 401, message: "Stale auth timestamp" };
     }
 
     const computedBodyHash = base64URLEncode(await sha256Bytes(new TextEncoder().encode(bodyText)));
     if (!timingSafeEqual(bodyHash, computedBodyHash)) {
       return { ok: false, status: 401, message: "Bad body hash" };
     }
 
     const registrationKey = this.appAttestRegistrationKey(deviceID, keyID);
     const registration = await this.state.storage.get(registrationKey);
     if (!registration) {
       return { ok: false, status: 401, message: "Unknown App Attest key" };
     }
 
     const nonceTTLSeconds = Number(this.env.REQUEST_NONCE_TTL_SECONDS || "300");
     const nonceKey = `request-nonce:${deviceID}:${nonce}`;
     const nonceUsedAt = await this.state.storage.get(nonceKey);
     if (nonceUsedAt && Date.now() - nonceUsedAt <= nonceTTLSeconds * 1000) {
       return { ok: false, status: 401, message: "Nonce already used" };
     }
 
     const path = new URL(request.url).pathname;
     const canonical = canonicalPushRequest({
       method: request.method,
       path,
       bodyHash,
       timestamp,
       nonce,
       deviceID,
       keyID
     });
     const clientDataHash = await sha256Bytes(new TextEncoder().encode(canonical));
     const assertion = decodeAssertion(base64URLDecode(assertionBase64));
     const authData = parseAuthenticatorData(assertion.authenticatorData);
     const expectedAppIDHash = await this.expectedAppIDHash();
     if (!bytesEqual(authData.rpIDHash, expectedAppIDHash)) {
       return { ok: false, status: 401, message: "Bad App Attest app id" };
     }
     const signedBytes = concatBytes(assertion.authenticatorData, clientDataHash);
     // The Secure Enclave signs nonce = SHA256(authenticatorData || clientDataHash)
     // as an ECDSA-SHA256 *message*, so the digest under the signature is
     // SHA256(nonce). WebCrypto applies that second hash.
     const assertionNonce = await sha256Bytes(signedBytes);
     const publicKey = await this.importAppAttestPublicKey(registration);
     const verified = await crypto.subtle.verify(
       { name: "ECDSA", hash: "SHA-256" },
       publicKey,
       derECDSASignatureToRaw(assertion.signature),
       assertionNonce
     );
     if (!verified) {
       return { ok: false, status: 401, message: "Bad App Attest assertion" };
     }
 
     // Concurrent requests from one device can arrive out of counter order, and
     // replay is already blocked by the nonce and timestamp checks, so the
     // counter is only tracked (for clone diagnostics), never enforced.
     registration.signCount = Math.max(registration.signCount || 0, authData.signCount);
     registration.updatedAt = Date.now();
     await this.state.storage.put(registrationKey, registration);
     // Durable Object storage has no expirationTtl, so prune stale nonces here.
     await this.pruneExpired(`request-nonce:${deviceID}:`, nonceTTLSeconds);
     await this.state.storage.put(nonceKey, Date.now());
     return { ok: true, deviceID };
   }
 
   async handleAttestationChallenge(request) {
     const body = await readJSONText(await request.text());
     if (!body) return badRequest("Body must be JSON");
     const deviceID = body.deviceID || "";
     const keyID = body.keyID || "";
     if (!deviceID || !keyID) {
       return badRequest("deviceID and keyID required");
     }
     const ttlSeconds = this.appAttestChallengeTTLSeconds();
     const challenge = base64URLEncode(crypto.getRandomValues(new Uint8Array(32)));
     await this.pruneExpired(`appattest-challenge:${deviceID}:`, ttlSeconds);
     await this.state.storage.put(this.appAttestChallengeKey(deviceID, challenge), Date.now());
     console.log("App Attest challenge issued", {
       deviceIDLength: deviceID.length,
       keyIDLength: keyID.length,
       challengeLength: challenge.length,
       ttlSeconds
     });
     return Response.json({ challenge });
   }
 
   async handleAttestationRegister(request) {
     const body = await readJSONText(await request.text());
     if (!body) return badRequest("Body must be JSON");
     const { deviceID, keyID, challenge, attestationObject } = body;
     if (!deviceID || !keyID || !challenge || !attestationObject) {
       return badRequest("deviceID, keyID, challenge, attestationObject required");
     }
     const challengeKey = this.appAttestChallengeKey(deviceID, challenge);
     const challengeIssuedAt = await this.state.storage.get(challengeKey);
     const challengeExpired = challengeIssuedAt
       ? Date.now() - challengeIssuedAt > this.appAttestChallengeTTLSeconds() * 1000
       : false;
     if (!challengeIssuedAt || challengeExpired) {
       if (challengeExpired) await this.state.storage.delete(challengeKey);
       console.warn("App Attest registration failed", {
         error: challengeExpired ? "expired challenge" : "unknown challenge",
         deviceIDLength: deviceID.length,
         keyIDLength: keyID.length,
         challengeLength: challenge.length,
         attestationObjectLength: attestationObject.length
       });
       return new Response("Unknown App Attest challenge", { status: 401 });
     }
 
     try {
       const registration = await this.verifyAttestation({
         deviceID,
         keyID,
         challenge,
         attestationObject: base64URLDecode(attestationObject)
       });
       await this.state.storage.put(this.appAttestRegistrationKey(deviceID, keyID), registration);
       await this.state.storage.delete(challengeKey);
       console.log("App Attest registration accepted", {
         expectedEnvironment: this.env.APP_ATTEST_ENVIRONMENT || "production",
         appBundleID: this.env.APP_BUNDLE_ID || this.env.APNS_TOPIC || "",
         rootCertConfigured: Boolean(this.env.APP_ATTEST_ROOT_CERT_PEM),
         rootCertLength: (this.env.APP_ATTEST_ROOT_CERT_PEM || "").length,
         deviceIDLength: deviceID.length,
         keyIDLength: keyID.length,
         signCount: registration.signCount
       });
       return new Response(null, { status: 204 });
     } catch (error) {
       console.error("App Attest registration failed", {
         error: error.message,
         expectedEnvironment: this.env.APP_ATTEST_ENVIRONMENT || "production",
         appTeamIDConfigured: Boolean(this.env.APP_TEAM_ID),
         appBundleID: this.env.APP_BUNDLE_ID || this.env.APNS_TOPIC || "",
         rootCertConfigured: Boolean(this.env.APP_ATTEST_ROOT_CERT_PEM),
         rootCertLength: (this.env.APP_ATTEST_ROOT_CERT_PEM || "").length,
         deviceIDLength: deviceID.length,
         keyIDLength: keyID.length,
         challengeLength: challenge.length,
         attestationObjectLength: attestationObject.length
       });
       return new Response(`Bad App Attest attestation: ${error.message}`, { status: 401 });
     }
   }
 
   async verifyAttestation({ deviceID, keyID, challenge, attestationObject }) {
     const attestation = decodeAttestationObject(attestationObject);
     const authData = parseAuthenticatorData(attestation.authData, {
       requireAttestedCredential: true
     });
     const expectedAppIDHash = await this.expectedAppIDHash();
     if (!bytesEqual(authData.rpIDHash, expectedAppIDHash)) {
       throw new Error("app id hash mismatch");
     }
     if (!authData.credentialID || !bytesEqual(authData.credentialID, base64URLDecodeFlexible(keyID))) {
       throw new Error("credential id mismatch");
     }
     const appAttestEnvironment = this.env.APP_ATTEST_ENVIRONMENT || "production";
     if (!isExpectedAppAttestAAGUID(authData.aaguid, appAttestEnvironment)) {
       throw new Error(`unexpected aaguid for ${appAttestEnvironment}: ${bytesToHex(authData.aaguid)}`);
     }
     if (!attestation.attStmt || !Array.isArray(attestation.attStmt.x5c) || attestation.attStmt.x5c.length < 2) {
       throw new Error("missing certificate chain");
     }
 
     const leaf = parseCertificate(attestation.attStmt.x5c[0]);
     const intermediate = parseCertificate(attestation.attStmt.x5c[1]);
     await verifyCertificateSignature(leaf, intermediate.subjectPublicKeyInfo);
     const rootPEM = this.env.APP_ATTEST_ROOT_CERT_PEM || "";
     if (!rootPEM) {
       throw new Error("worker missing APP_ATTEST_ROOT_CERT_PEM");
     }
     const root = parseCertificate(pemToDer(rootPEM));
     await verifyCertificateSignature(intermediate, root.subjectPublicKeyInfo);
 
     const clientDataHash = await sha256Bytes(new TextEncoder().encode([
       "crossmate-appattest-v1",
       challenge,
       deviceID,
       keyID
     ].join("\n")));
     const expectedNonce = await sha256Bytes(concatBytes(attestation.authData, clientDataHash));
     const certNonce = certificateAppAttestNonce(leaf);
     if (!bytesEqual(certNonce, expectedNonce)) {
       throw new Error("certificate nonce mismatch");
     }
 
     return {
       publicKeyJWK: coseEC2PublicKeyToJWK(authData.cosePublicKey),
       publicKeySPKI: base64URLEncode(leaf.subjectPublicKeyInfo),
       signCount: authData.signCount,
       createdAt: Date.now()
     };
   }
 
   async importAppAttestPublicKey(registration) {
     if (registration.publicKeySPKI) {
       return crypto.subtle.importKey(
         "spki",
         base64URLDecode(registration.publicKeySPKI),
         { name: "ECDSA", namedCurve: "P-256" },
         false,
         ["verify"]
       );
     }
     return crypto.subtle.importKey(
       "jwk",
       registration.publicKeyJWK,
       { name: "ECDSA", namedCurve: "P-256" },
       false,
       ["verify"]
     );
   }
 
   async expectedAppIDHash() {
     const teamID = this.env.APP_TEAM_ID || "";
     const bundleID = this.env.APP_BUNDLE_ID || this.env.APNS_TOPIC || "";
     if (!teamID || !bundleID) {
       throw new Error("APP_TEAM_ID and APP_BUNDLE_ID/APNS_TOPIC are required");
     }
     return sha256Bytes(new TextEncoder().encode(`${teamID}.${bundleID}`));
   }
 
   appAttestChallengeKey(deviceID, challenge) {
     return `appattest-challenge:${deviceID}:${challenge}`;
   }
 
   appAttestChallengeTTLSeconds() {
     return Number(this.env.APP_ATTEST_CHALLENGE_TTL_SECONDS || "300");
   }
 
   // Deletes per-device keys whose stored timestamp is older than ttlSeconds.
   // Durable Object storage ignores KV's expirationTtl option, so expiry has to
   // be enforced manually.
   async pruneExpired(prefix, ttlSeconds) {
     const entries = await this.state.storage.list({ prefix });
     const cutoff = Date.now() - ttlSeconds * 1000;
     const expired = [];
     for (const [key, storedAt] of entries) {
       if (typeof storedAt !== "number" || storedAt < cutoff) expired.push(key);
     }
     if (expired.length > 0) {
       await this.state.storage.delete(expired);
     }
   }
 
   appAttestRegistrationKey(deviceID, keyID) {
     return `appattest-key:${deviceID}:${keyID}`;
   }
 
   async handleRegister(bodyText, auth) {
     const body = await readJSONText(bodyText);
     if (!body) return badRequest("Body must be JSON");
     const { deviceID, token, environment, addresses, mutedKinds } = body;
     if (!deviceID || !token || !Array.isArray(addresses)) {
       return badRequest("deviceID, token, addresses required");
     }
     if (auth.deviceID !== deviceID) {
       return new Response("Authenticated device mismatch", { status: 403 });
     }
     if (environment !== "sandbox" && environment !== "production") {
       return badRequest("environment must be 'sandbox' or 'production'");
     }
     // Notification preferences ride along as a denylist of `kind` strings the
     // device does not want delivered. The worker only string-matches them at
     // publish time — it never interprets them — so a missing field (older
     // clients) and a kind invented after registration both mean "deliver".
     const muted = Array.isArray(mutedKinds)
       ? mutedKinds.filter((kind) => typeof kind === "string" && kind.length > 0)
       : [];
     // Bind this device's APNs token to each address it knows. A game address
     // carries the game's `credID` and is stored under it so a publish can only
     // reach it when signed with that game's secret; the account-scoped sibling
     // address has no credID and uses the bare key. Identity never reaches the
     // worker — the (credID-scoped) address is the only lookup key.
     const updatedAt = Date.now();
     for (const entry of addresses) {
       const key = addressStorageKey(entry, deviceID);
       if (!key) continue;
       const registration = { token, environment, updatedAt };
       if (muted.length > 0) registration.mutedKinds = muted;
       await this.state.storage.put(key, registration);
     }
     return new Response(null, { status: 204 });
   }
 
   async handleUnregister(bodyText, auth) {
     const body = await readJSONText(bodyText);
     if (!body) return badRequest("Body must be JSON");
     const { deviceID, addresses } = body;
     if (!deviceID || !Array.isArray(addresses)) {
       return badRequest("deviceID and addresses required");
     }
     if (auth.deviceID !== deviceID) {
       return new Response("Authenticated device mismatch", { status: 403 });
     }
     for (const entry of addresses) {
       const key = addressStorageKey(entry, deviceID);
       if (!key) continue;
       await this.state.storage.delete(key);
     }
     return new Response(null, { status: 204 });
   }
 
   // Stores a game's shared push credential (first-write-wins), keyed by the
   // unguessable credID minted into the Game record. The client (any
   // participant) registers idempotently before publishing; a different secret
   // under the same credID is refused with 409 (only reachable on a credID
   // collision). Mirrors the room worker's `register`.
   async handleGameRegister(credID, bodyText) {
     const body = await readJSONText(bodyText);
     if (!body) return badRequest("Body must be JSON");
     const secret = typeof body.secret === "string" ? body.secret : "";
     if (!isAcceptableSecret(secret)) return badRequest("Invalid secret");
     const key = `gamecred:${credID}`;
     const stored = await this.state.storage.get(key);
     if (stored) {
       if (!timingSafeEqual(stored.secret, secret)) {
         return new Response("Game credential mismatch", { status: 409 });
       }
       return new Response(null, { status: 204 });
     }
     await this.state.storage.put(key, { secret, createdAt: Date.now() });
     return new Response(null, { status: 201 });
   }
 
   // Authorization model: a game push must prove participation. The publish
   // names the game's `credID` (minted into the participant-only Game record)
   // and is signed with that game's secret; this verifies the signature
   // against the secret registered under that credID and then resolves targets
   // only among addresses registered under the same credID. So a caller can
   // only reach a game's participants if it holds that game's secret — i.e. it
   // is a participant. Account-scoped sibling pushes (accountJoined/accountSeen)
   // carry no credID: their addresses derive from the account secret in the
   // private CloudKit database, so they were never participant-spoofable.
   async handlePublish(request, bodyText, auth) {
     const body = await readJSONText(bodyText);
     if (!body) return badRequest("Body must be JSON");
     const {
       kind,
       addressees,
       gameID,
       credID,
       fromAuthorID,
       senderDeviceID,
       readAt,
       title,
       alertBody,
       background,
       broadcast,
       excludeAddress,
       collapseID,
       payload,
       enc
     } = body;
     if (!kind) {
       return badRequest("kind required");
     }
     // A broadcast fans out to every device registered under the game's credID
     // (the whole room), so it carries no addressees but must be game-scoped —
     // the credID is both the delivery scope and, via its signature, the
     // participation proof. A non-broadcast publish names its recipients.
     if (broadcast === true) {
       if (!credID) return badRequest("broadcast requires credID");
     } else if (!Array.isArray(addressees) || addressees.length === 0) {
       return badRequest("non-empty addressees required");
     }
 
     if (credID) {
       const verification = await this.verifyGameSignature(request, credID);
       if (!verification.ok) {
         return new Response(verification.message, { status: verification.status });
       }
     }
 
     const targets = broadcast === true
       ? await this.resolveBroadcastTargets(credID, senderDeviceID, excludeAddress, alertBody, payload, enc)
       : await this.resolveTargets(addressees, senderDeviceID, credID);
     if (targets.length === 0) {
       return Response.json({ delivered: 0, removed: 0, muted: 0, failed: 0 });
     }
 
     let delivered = 0;
     let removed = 0;
     let muted = 0;
     let failed = 0;
     for (const target of targets) {
       // Honor the target device's registered notification preferences: a
       // muted kind is dropped here, before APNs, so the device never sees it.
       if (Array.isArray(target.mutedKinds) && target.mutedKinds.includes(kind)) {
         muted += 1;
         continue;
       }
       const result = await this.sendOne(target, {
         kind,
         gameID,
         fromAuthorID,
         senderDeviceID,
         readAt,
         title,
         body: target.body || alertBody,
         payload: target.payload,
         enc: target.enc,
         collapseID: typeof collapseID === "string" ? collapseID : undefined,
         background: background === true
       });
       if (result === "ok") delivered += 1;
       else if (result === "drop") {
         // Delete by the exact key the target was resolved from — game
         // addresses are stored credID-scoped (`addr:<credID>:<address>:<dev>`),
         // so reconstructing a bare `addr:<address>:<dev>` key would miss them.
         await this.state.storage.delete(target.storageKey);
         removed += 1;
       } else {
         failed += 1;
       }
     }
     return Response.json({ delivered, removed, muted, failed });
   }
 
   // Verifies the game-participation signature: HMAC, under the secret
   // registered for `credID`, over the App Attest request's own body hash,
   // timestamp, and nonce (already validated by `authenticate`, so they are
   // bound to this exact request and need no separate freshness check here).
   async verifyGameSignature(request, credID) {
     const cred = await this.state.storage.get(`gamecred:${credID}`);
     if (!cred) {
       return { ok: false, status: 403, message: "Game not registered" };
     }
     const signature = request.headers.get("X-Crossmate-Game-Signature") || "";
     if (!signature) {
       return { ok: false, status: 401, message: "Missing game signature" };
     }
     const bodyHash = request.headers.get("X-Crossmate-Body-SHA256") || "";
     const timestamp = request.headers.get("X-Crossmate-Timestamp") || "";
     const nonce = request.headers.get("X-Crossmate-Nonce") || "";
     const payload = [
       "crossmate-push-game-v1",
       credID,
       bodyHash,
       timestamp,
       nonce
     ].join("\n");
     const expected = await hmacSHA256(cred.secret, payload);
     if (!timingSafeEqual(signature, expected)) {
       return { ok: false, status: 401, message: "Invalid game signature" };
     }
     return { ok: true };
   }
 
   async resolveTargets(addressees, senderDeviceID, credID) {
     const targets = [];
     for (const addressee of addressees) {
       if (!addressee || !addressee.address) continue;
       const body = typeof addressee.body === "string" ? addressee.body : undefined;
       // Opaque, app-encoded semantics. `enc` is the encrypted (sealed) payload
       // current clients send; `payload` is the legacy cleartext base64 JSON an
       // older client may still send. Either way the worker never inspects it —
       // it just forwards it into the APNs userInfo for the notification service
       // extension to decode. Keeping it opaque is what lets the app evolve
       // notification meaning (and now encrypt it) without a worker deploy.
       const payload = typeof addressee.payload === "string" ? addressee.payload : undefined;
       const enc = typeof addressee.enc === "string" ? addressee.enc : undefined;
       // Game pushes resolve only among addresses registered under the same
       // credID; account pushes use the bare address key.
       const prefix = credID
         ? `addr:${credID}:${addressee.address}:`
         : `addr:${addressee.address}:`;
       const map = await this.state.storage.list({ prefix });
       for (const [key, value] of map) {
         const deviceID = key.slice(prefix.length);
         if (senderDeviceID && deviceID === senderDeviceID) continue;
         targets.push({
           address: addressee.address,
           deviceID,
           storageKey: key,
           body,
           payload,
           enc,
           ...value
         });
       }
     }
     return targets;
   }
 
   // Resolves every device registered under a game's credID — the whole room —
   // for a broadcast publish. Keys are `addr:<credID>:<address>:<deviceID>`;
   // addresses (base64url / `acct-…`) and device IDs (hex) never contain a
   // colon, so the first colon after the prefix splits address from deviceID.
   // The sender's own device and (via `excludeAddress`) its account's other
   // devices are skipped, and the uniform `body`/`payload`/`enc` ride every target.
   async resolveBroadcastTargets(credID, senderDeviceID, excludeAddress, alertBody, payload, enc) {
     const body = typeof alertBody === "string" ? alertBody : undefined;
     const forwarded = typeof payload === "string" ? payload : undefined;
     const forwardedEnc = typeof enc === "string" ? enc : undefined;
     const prefix = `addr:${credID}:`;
     const map = await this.state.storage.list({ prefix });
     const targets = [];
     for (const [key, value] of map) {
       const rest = key.slice(prefix.length);
       const sep = rest.indexOf(":");
       if (sep < 0) continue;
       const address = rest.slice(0, sep);
       const deviceID = rest.slice(sep + 1);
       if (senderDeviceID && deviceID === senderDeviceID) continue;
       if (excludeAddress && address === excludeAddress) continue;
       targets.push({
         address,
         deviceID,
         storageKey: key,
         body,
         payload: forwarded,
         enc: forwardedEnc,
         ...value
       });
     }
     return targets;
   }
 
   async sendOne(target, message) {
     const topic = this.env.APNS_TOPIC || "net.inqk.crossmate";
     const host = target.environment === "sandbox"
       ? "api.sandbox.push.apple.com"
       : "api.push.apple.com";
     const jwt = await this.providerJWT();
     const alert = {};
     if (message.title) alert.title = message.title;
     if (message.body) alert.body = message.body;
     const apnsPayload = {
       aps: message.background
         ? { "content-available": 1 }
         : { alert, sound: "default", "mutable-content": 1 },
       kind: message.kind
     };
     if (message.gameID) apnsPayload.gameID = message.gameID;
     if (message.fromAuthorID) apnsPayload.fromAuthorID = message.fromAuthorID;
     if (message.senderDeviceID) apnsPayload.senderDeviceID = message.senderDeviceID;
     if (message.readAt) apnsPayload.readAt = message.readAt;
     // Forward the opaque app payload verbatim when present. `enc` is the
     // encrypted payload current clients send; `payload` is the legacy cleartext
     // form an older client may still send. Both are absent for older app builds,
     // which the extension handles by falling back to `kind`.
     if (message.enc) apnsPayload.enc = message.enc;
     if (message.payload) apnsPayload.payload = message.payload;
 
     // A "nudge" rouse is ephemeral: deliver now or discard, since "come play"
     // delivered hours later is stale noise. `accountSeen` is also
     // background-only, but it withdraws already-read notifications from sibling
     // devices; give APNs a short store-and-forward window so a briefly-
     // unreachable device can still converge. Other alert kinds (win/resign/
     // pause) are one-time meaningful events and keep the longer window so a
     // recipient who is offline at send time still gets the banner.
     const expirationSeconds =
       message.kind === "accountSeen" ? 15 * 60 :
       message.background || message.kind === "nudge" ? 0 :
       4 * 60 * 60;
     const expiration = expirationSeconds === 0
       ? "0"
       : String(Math.floor(Date.now() / 1000) + expirationSeconds);
 
     const headers = {
       authorization: `bearer ${jwt}`,
       "apns-topic": topic,
       "apns-push-type": message.background ? "background" : "alert",
       "apns-priority": message.background ? "5" : "10",
       "apns-expiration": expiration,
       "content-type": "application/json"
     };
     // Coalesce alert pushes for one game into a single Notification Center tile
     // (the app picks the id; the receiver's NSE folds successive summaries into
     // it). Meaningless on a background push, which displays nothing.
     if (message.collapseID && !message.background) {
       headers["apns-collapse-id"] = message.collapseID;
     }
 
     const response = await fetch(`https://${host}/3/device/${target.token}`, {
       method: "POST",
       headers,
       body: JSON.stringify(apnsPayload)
     });
 
     if (response.status === 200) return "ok";
     if (response.status === 410) return "drop";
     if (response.status === 400) {
       const text = await response.text();
       if (text.includes("BadDeviceToken") || text.includes("DeviceTokenNotForTopic")) {
         return "drop";
       }
     }
     return "fail";
   }
 
   async providerJWT() {
     const nowSeconds = Math.floor(Date.now() / 1000);
     if (this.cachedJWT && nowSeconds < this.cachedJWTExpiresAt - 60) {
       return this.cachedJWT;
     }
     const jwt = await signProviderJWT({
       keyPEM: this.env.APNS_KEY,
       keyID: this.env.APNS_KEY_ID,
       teamID: this.env.APNS_TEAM_ID,
       issuedAt: nowSeconds
     });
     this.cachedJWT = jwt;
     // Refresh well before APNs' 1-hour ceiling; the rate-limit floor is ~20 min.
     this.cachedJWTExpiresAt = nowSeconds + 40 * 60;
     return jwt;
   }
 }
 
 export default {
   async fetch(request, env) {
     const url = new URL(request.url);
     if (url.pathname === "/health") {
       return new Response("ok");
     }
     const id = env.PUSH_REGISTRY.idFromName("registry");
     return env.PUSH_REGISTRY.get(id).fetch(request);
   }
 };
 
 async function readJSON(request) {
   return readJSONText(await request.text());
 }
 
 async function readJSONText(text) {
   try {
     return JSON.parse(text || "{}");
   } catch {
     return null;
   }
 }
 
 function badRequest(message) {
   return new Response(message, { status: 400 });
 }
 
 // Storage key for a device's registration under one address. A game address
 // arrives as `{address, credID}` and is keyed under its credID so a publish
 // can reach it only when signed with that game's secret; the account-scoped
 // address arrives without a credID and uses the bare key.
 function addressStorageKey(entry, deviceID) {
   const address = entry && typeof entry === "object" ? entry.address : entry;
   if (typeof address !== "string" || address.length === 0) return null;
   const credID = entry && typeof entry === "object" && typeof entry.credID === "string"
     ? entry.credID
     : "";
   return credID
     ? `addr:${credID}:${address}:${deviceID}`
     : `addr:${address}:${deviceID}`;
 }
 
 // The secret doubles as the HMAC key for game signatures, so a registered
 // value must decode to at least 32 key bytes (clients mint exactly 32).
 function isAcceptableSecret(secret) {
   if (!secret) return false;
   let bytes;
   try {
     bytes = base64URLDecode(secret);
   } catch {
     return false;
   }
   return bytes.length >= 32;
 }
 
 async function hmacSHA256(secret, payload) {
   const key = await crypto.subtle.importKey(
     "raw",
     base64URLDecode(secret),
     { name: "HMAC", hash: "SHA-256" },
     false,
     ["sign"]
   );
   const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload));
   return base64URLEncode(new Uint8Array(signature));
 }
 
 function canonicalPushRequest({
   method,
   path,
   bodyHash,
   timestamp,
   nonce,
   deviceID,
   keyID
 }) {
   return [
     "crossmate-push-request-v1",
     method.toUpperCase(),
     path,
     bodyHash,
     timestamp,
     nonce,
     deviceID,
     keyID
   ].join("\n");
 }
 
 async function sha256Bytes(bytes) {
   return new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
 }
 
 function concatBytes(...arrays) {
   let length = 0;
   for (const array of arrays) length += array.length;
   const result = new Uint8Array(length);
   let offset = 0;
   for (const array of arrays) {
     result.set(array, offset);
     offset += array.length;
   }
   return result;
 }
 
 function bytesEqual(left, right) {
   if (!left || !right || left.length !== right.length) return false;
   let diff = 0;
   for (let index = 0; index < left.length; index += 1) {
     diff |= left[index] ^ right[index];
   }
   return diff === 0;
 }
 
 function bytesToHex(bytes) {
   if (!bytes) return "";
   return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
 function base64URLDecode(string) {
   let base64 = string.replace(/-/g, "+").replace(/_/g, "/");
   base64 += "=".repeat((4 - (base64.length % 4)) % 4);
   const binary = atob(base64);
   const bytes = new Uint8Array(binary.length);
   for (let index = 0; index < binary.length; index += 1) {
     bytes[index] = binary.charCodeAt(index);
   }
   return bytes;
 }
 
 function base64URLDecodeFlexible(string) {
   try {
     return base64URLDecode(string);
   } catch {
     const binary = atob(string);
     const bytes = new Uint8Array(binary.length);
     for (let index = 0; index < binary.length; index += 1) {
       bytes[index] = binary.charCodeAt(index);
     }
     return bytes;
   }
 }
 
 function pemToDer(pem) {
   const stripped = pem
     .replace(/-----BEGIN CERTIFICATE-----/g, "")
     .replace(/-----END CERTIFICATE-----/g, "")
     .replace(/\s+/g, "");
   return base64URLDecodeFlexible(stripped);
 }
 
 function decodeAttestationObject(bytes) {
   const decoded = cborDecode(bytes);
   if (!decoded || decoded.fmt !== "apple-appattest" || !(decoded.authData instanceof Uint8Array)) {
     throw new Error("invalid attestation object");
   }
   return decoded;
 }
 
 function decodeAssertion(bytes) {
   const decoded = cborDecode(bytes);
   const authData = decoded.authenticatorData || decoded.authData;
   if (!(authData instanceof Uint8Array) || !(decoded.signature instanceof Uint8Array)) {
     throw new Error("invalid assertion object");
   }
   return {
     authenticatorData: authData,
     signature: decoded.signature
   };
 }
 
 function cborDecode(bytes) {
   const reader = new CBORReader(bytes);
   const value = reader.read();
   if (!reader.done) throw new Error("trailing cbor data");
   return value;
 }
 
 class CBORReader {
   constructor(bytes) {
     this.bytes = bytes;
     this.offset = 0;
   }
 
   get done() {
     return this.offset === this.bytes.length;
   }
 
   read() {
     const initial = this.readByte();
     const major = initial >> 5;
     const additional = initial & 0x1f;
     const value = this.readArgument(additional);
     switch (major) {
     case 0:
       return value;
     case 1:
       return -1 - value;
     case 2:
       return this.readBytes(value);
     case 3:
       return new TextDecoder().decode(this.readBytes(value));
     case 4: {
       const array = [];
       for (let index = 0; index < value; index += 1) {
         array.push(this.read());
       }
       return array;
     }
     case 5: {
       const object = {};
       for (let index = 0; index < value; index += 1) {
         object[this.read()] = this.read();
       }
       return object;
     }
     case 7:
       if (additional === 20) return false;
       if (additional === 21) return true;
       if (additional === 22) return null;
       break;
     default:
       break;
     }
     throw new Error("unsupported cbor value");
   }
 
   readArgument(additional) {
     if (additional < 24) return additional;
     if (additional === 24) return this.readByte();
     if (additional === 25) return this.readUInt(2);
     if (additional === 26) return this.readUInt(4);
     if (additional === 27) return this.readUInt(8);
     throw new Error("indefinite cbor values are unsupported");
   }
 
   readUInt(length) {
     let value = 0;
     for (let index = 0; index < length; index += 1) {
       value = (value * 256) + this.readByte();
     }
     return value;
   }
 
   readByte() {
     if (this.offset >= this.bytes.length) throw new Error("truncated cbor");
     return this.bytes[this.offset++];
   }
 
   readBytes(length) {
     if (this.offset + length > this.bytes.length) throw new Error("truncated cbor bytes");
     const value = this.bytes.slice(this.offset, this.offset + length);
     this.offset += length;
     return value;
   }
 }
 
 function parseAuthenticatorData(bytes, options = {}) {
   if (bytes.length < 37) throw new Error("authenticator data too short");
   const signCount = (
     (bytes[33] * 0x1000000) +
     (bytes[34] << 16) +
     (bytes[35] << 8) +
     bytes[36]
   ) >>> 0;
   const result = {
     rpIDHash: bytes.slice(0, 32),
     flags: bytes[32],
     signCount
   };
   const hasAttestedCredentialData = (result.flags & 0x40) !== 0;
   if (options.requireAttestedCredential && !hasAttestedCredentialData) {
     throw new Error("attested credential data missing");
   }
   if (options.requireAttestedCredential || options.parseAttestedCredential) {
     if (bytes.length < 55) throw new Error("attested credential data missing");
     result.aaguid = bytes.slice(37, 53);
     const credentialLength = (bytes[53] << 8) | bytes[54];
     const credentialStart = 55;
     const credentialEnd = credentialStart + credentialLength;
     if (credentialEnd > bytes.length) throw new Error("credential id truncated");
     result.credentialID = bytes.slice(credentialStart, credentialEnd);
     result.cosePublicKey = bytes.slice(credentialEnd);
   }
   return result;
 }
 
 function isExpectedAppAttestAAGUID(aaguid, environment) {
   if (!aaguid || aaguid.length !== 16) return false;
   const production = new Uint8Array(16);
   production.set(new TextEncoder().encode("appattest"), 0);
   const development = new TextEncoder().encode("appattestdevelop");
   if (environment === "development") {
     return bytesEqual(aaguid, development);
   }
   return bytesEqual(aaguid, production);
 }
 
 function coseEC2PublicKeyToJWK(bytes) {
   const key = cborDecode(bytes);
   const x = key[-2];
   const y = key[-3];
   if (key[1] !== 2 || key[-1] !== 1 || !(x instanceof Uint8Array) || !(y instanceof Uint8Array)) {
     throw new Error("unsupported cose key");
   }
   return {
     kty: "EC",
     crv: "P-256",
     x: base64URLEncode(x),
     y: base64URLEncode(y),
     ext: true
   };
 }
 
 function parseCertificate(bytes) {
   const cert = parseDER(bytes);
   if (cert.tag !== 0x30 || cert.children.length < 3) {
     throw new Error("invalid certificate");
   }
   const tbs = cert.children[0];
   const signatureAlgorithm = parseAlgorithmIdentifier(cert.children[1]);
   const signatureValue = cert.children[2];
   if (signatureValue.tag !== 0x03) throw new Error("invalid certificate signature");
 
   const tbsChildren = tbs.children;
   let index = tbsChildren[0].tag === 0xa0 ? 1 : 0;
   index += 5; // serial, signature, issuer, validity, subject
   const subjectPublicKeyInfo = tbsChildren[index].raw;
   const extensions = [];
   for (const child of tbsChildren.slice(index + 1)) {
     if (child.tag === 0xa3 && child.children[0]?.tag === 0x30) {
       for (const ext of child.children[0].children) {
         const oid = decodeOID(ext.children[0].value);
         const valueNode = ext.children.find((node) => node.tag === 0x04);
         if (valueNode) extensions.push({ oid, value: valueNode.value });
       }
     }
   }
 
   return {
     tbs: tbs.raw,
     signatureAlgorithm,
     subjectPublicKeyInfo,
     signature: signatureValue.value.slice(1),
     extensions
   };
 }
 
 function parseDER(bytes, offset = 0) {
   const start = offset;
   const tag = bytes[offset++];
   let length = bytes[offset++];
   if ((length & 0x80) !== 0) {
     const byteCount = length & 0x7f;
     length = 0;
     for (let index = 0; index < byteCount; index += 1) {
       length = (length * 256) + bytes[offset++];
     }
   }
   const valueStart = offset;
   const end = valueStart + length;
   if (end > bytes.length) throw new Error("truncated der");
   const constructed = (tag & 0x20) !== 0;
   const children = [];
   if (constructed) {
     let childOffset = valueStart;
     while (childOffset < end) {
       const child = parseDER(bytes, childOffset);
       children.push(child);
       childOffset = child.end;
     }
   }
   return {
     tag,
     start,
     valueStart,
     end,
     raw: bytes.slice(start, end),
     value: bytes.slice(valueStart, end),
     children
   };
 }
 
 function decodeOID(bytes) {
   const parts = [Math.floor(bytes[0] / 40), bytes[0] % 40];
   let value = 0;
   for (const byte of bytes.slice(1)) {
     value = (value << 7) | (byte & 0x7f);
     if ((byte & 0x80) === 0) {
       parts.push(value);
       value = 0;
     }
   }
   return parts.join(".");
 }
 
 async function verifyCertificateSignature(cert, issuerSPKI) {
   const issuerKey = parseSubjectPublicKeyInfo(issuerSPKI);
   const hash = certificateSignatureHash(cert.signatureAlgorithm);
   const publicKey = await crypto.subtle.importKey(
     "spki",
     issuerSPKI,
     { name: "ECDSA", namedCurve: issuerKey.namedCurve },
     false,
     ["verify"]
   );
   const ok = await crypto.subtle.verify(
     { name: "ECDSA", hash },
     publicKey,
     derECDSASignatureToRaw(cert.signature, issuerKey.coordinateLength),
     cert.tbs
   );
   if (!ok) throw new Error("certificate signature verification failed");
 }
 
 function parseAlgorithmIdentifier(node) {
   if (!node || node.tag !== 0x30 || !node.children[0]) {
     throw new Error("invalid algorithm identifier");
   }
   const algorithm = {
     oid: decodeOID(node.children[0].value)
   };
   if (node.children[1]) {
     if (node.children[1].tag === 0x06) {
       algorithm.parametersOID = decodeOID(node.children[1].value);
     } else {
       algorithm.parameters = node.children[1].raw;
     }
   }
   return algorithm;
 }
 
 function parseSubjectPublicKeyInfo(spki) {
   const node = parseDER(spki);
   if (node.tag !== 0x30 || !node.children[0]) {
     throw new Error("invalid subject public key info");
   }
   const algorithm = parseAlgorithmIdentifier(node.children[0]);
   if (algorithm.oid !== "1.2.840.10045.2.1") {
     throw new Error(`unsupported certificate public key algorithm ${algorithm.oid}`);
   }
   switch (algorithm.parametersOID) {
   case "1.2.840.10045.3.1.7":
     return { namedCurve: "P-256", coordinateLength: 32 };
   case "1.3.132.0.34":
     return { namedCurve: "P-384", coordinateLength: 48 };
   default:
     throw new Error(`unsupported certificate EC curve ${algorithm.parametersOID || ""}`);
   }
 }
 
 function certificateSignatureHash(signatureAlgorithm) {
   switch (signatureAlgorithm.oid) {
   case "1.2.840.10045.4.3.2":
     return "SHA-256";
   case "1.2.840.10045.4.3.3":
     return "SHA-384";
   default:
     throw new Error(`unsupported certificate signature algorithm ${signatureAlgorithm.oid}`);
   }
 }
 
 function certificateAppAttestNonce(cert) {
   const extension = cert.extensions.find((entry) => entry.oid === "1.2.840.113635.100.8.2");
   if (!extension) throw new Error("missing app attest nonce extension");
   const nested = parseDER(extension.value);
   const octets = findOctetString(nested, 32);
   if (!octets) throw new Error("missing app attest nonce");
   return octets;
 }
 
 function findOctetString(node, length) {
   if (node.tag === 0x04 && node.value.length === length) return node.value;
   for (const child of node.children) {
     const found = findOctetString(child, length);
     if (found) return found;
   }
   return null;
 }
 
 function derECDSASignatureToRaw(bytes, coordinateLength = 32) {
   const sequence = parseDER(bytes);
   if (sequence.tag !== 0x30 || sequence.children.length !== 2) {
     throw new Error("invalid ecdsa signature");
   }
   return concatBytes(
     derIntegerToFixed(sequence.children[0].value, coordinateLength),
     derIntegerToFixed(sequence.children[1].value, coordinateLength)
   );
 }
 
 function derIntegerToFixed(bytes, length) {
   let value = bytes;
   while (value.length > 0 && value[0] === 0) {
     value = value.slice(1);
   }
   if (value.length > length) throw new Error("ecdsa integer too long");
   const result = new Uint8Array(length);
   result.set(value, length - value.length);
   return result;
 }
 
 async function signProviderJWT({ keyPEM, keyID, teamID, issuedAt }) {
   if (!keyPEM || !keyID || !teamID) {
     throw new Error("APNS_KEY, APNS_KEY_ID, APNS_TEAM_ID must all be set");
   }
   const key = await importP8(keyPEM);
   const header = base64URLEncode(new TextEncoder().encode(JSON.stringify({
     alg: "ES256",
     kid: keyID
   })));
   const claims = base64URLEncode(new TextEncoder().encode(JSON.stringify({
     iss: teamID,
     iat: issuedAt
   })));
   const signingInput = `${header}.${claims}`;
   const signature = await crypto.subtle.sign(
     { name: "ECDSA", hash: "SHA-256" },
     key,
     new TextEncoder().encode(signingInput)
   );
   return `${signingInput}.${base64URLEncode(new Uint8Array(signature))}`;
 }
 
 async function importP8(pem) {
   const stripped = pem
     .replace(/-----BEGIN PRIVATE KEY-----/g, "")
     .replace(/-----END PRIVATE KEY-----/g, "")
     .replace(/\s+/g, "");
   const der = Uint8Array.from(atob(stripped), (char) => char.charCodeAt(0));
   return crypto.subtle.importKey(
     "pkcs8",
     der,
     { name: "ECDSA", namedCurve: "P-256" },
     false,
     ["sign"]
   );
 }
 
 function base64URLEncode(bytes) {
   let binary = "";
   for (const byte of bytes) {
     binary += String.fromCharCode(byte);
   }
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
 
 function timingSafeEqual(a, b) {
   const left = new TextEncoder().encode(a);
   const right = new TextEncoder().encode(b);
   if (left.length !== right.length) return false;
   let diff = 0;
   for (let index = 0; index < left.length; index += 1) {
     diff |= left[index] ^ right[index];
   }
   return diff === 0;
 }