crossmate

push-worker.js (66216B)

---

 // Single source for every rate bucket's defaults (env-overridable via
 // `<PREFIX>_LIMIT` / `<PREFIX>_WINDOW_SECONDS`), shared by the enforcement
 // call sites and the sweep horizon so the two cannot drift.
 const RATE_LIMIT_DEFAULTS = {
   APP_ATTEST_CHALLENGE_IP: { limit: 60, windowSeconds: 60 * 60 },
   APP_ATTEST_CHALLENGE_DEVICE: { limit: 10, windowSeconds: 5 * 60 },
   APP_ATTEST_REGISTER_IP: { limit: 30, windowSeconds: 60 * 60 },
   APP_ATTEST_REGISTER_DEVICE: { limit: 5, windowSeconds: 10 * 60 },
   PUBLISH_CRED: { limit: 60, windowSeconds: 60 },
   PUBLISH_ADDRESS: { limit: 30, windowSeconds: 60 }
 };
 
 // Ingress bounds: a single authenticated request must not be able to buy
 // unbounded buffering, storage scanning, or APNs fanout, so every body, list,
 // and string is capped before the work it would trigger. These counts and
 // byte budgets are env-overridable (same convention as the rate limits); the
 // per-field character caps below are structural and fixed.
 const INGRESS_LIMIT_DEFAULTS = {
   MAX_BODY_BYTES: 131072,
   MAX_ADDRESS_COUNT: 64,
   MAX_REGISTRATIONS_PER_CRED: 128,
   MAX_BROADCAST_TARGETS: 128
 };
 
 // Key-forming identifiers (addresses, credIDs, device IDs, APNs tokens,
 // nonces) are base64url/hex/UUID strings; anything longer or outside that
 // alphabet cannot be genuine and would otherwise flow into storage keys and
 // the APNs request URL.
 const MAX_ID_CHARS = 128;
 // App Attest key IDs are opaque Base64 supplied by Apple, not identifiers
 // minted by Crossmate. Accept both standard and URL-safe spellings, then use
 // one canonical base64url spelling anywhere the value becomes a storage key.
 const MAX_APP_ATTEST_KEY_ID_CHARS = 256;
 const MAX_KIND_CHARS = 64;
 const MAX_MUTED_KIND_COUNT = 32;
 const MAX_TEXT_CHARS = 512; // title / alert body
 const MAX_OPAQUE_CHARS = 4096; // forwarded base64 `payload` / `enc` blobs
 const MAX_COLLAPSE_ID_CHARS = 64; // APNs' own apns-collapse-id ceiling
 const MAX_SECRET_CHARS = 256; // clients mint 32 bytes → 43 base64url chars
 const MAX_ATTESTATION_OBJECT_CHARS = 32768; // genuine objects are ~8 KB base64
 const MAX_APNS_PAYLOAD_BYTES = 4096; // APNs payload ceiling (alert + background)
 
 export class PushRegistry {
   constructor(state, env) {
     this.state = state;
     this.env = env;
     this.cachedJWT = null;
     this.cachedJWTExpiresAt = 0;
   }
 
   async fetch(request) {
     const url = new URL(request.url);
 
     // Bound the body before any route (attestation included) buffers it: an
     // oversized request is refused for a few header bytes instead of being
     // materialized just to fail JSON or auth validation.
     const body = await readBodyWithinLimit(request, this.ingressLimit("MAX_BODY_BYTES"));
     if (!body.ok) {
       return new Response("Body too large", { status: 413 });
     }
     const bodyText = body.text;
 
     if (url.pathname === "/attest/challenge" && request.method === "POST") {
       return this.handleAttestationChallenge(request, bodyText);
     }
     if (url.pathname === "/attest/register" && request.method === "POST") {
       return this.handleAttestationRegister(request, bodyText);
     }
 
     const auth = await this.authenticate(request, bodyText);
     if (!auth.ok) {
       console.warn("Push worker auth failed", {
         method: request.method,
         path: url.pathname,
         status: auth.status,
         message: auth.message,
         authVersion: request.headers.get("X-Crossmate-Auth-Version") || "",
         deviceIDLength: (request.headers.get("X-Crossmate-Device-ID") || "").length,
         keyIDLength: (request.headers.get("X-Crossmate-Key-ID") || "").length,
         bodyLength: bodyText.length
       });
       return new Response(auth.message, { status: auth.status });
     }
 
     if (url.pathname === "/register" && request.method === "POST") {
       return this.handleRegister(request, bodyText, auth);
     }
     if (url.pathname === "/register" && request.method === "DELETE") {
       return this.handleUnregister(bodyText, auth);
     }
     if (url.pathname === "/publish" && request.method === "POST") {
       return this.handlePublish(request, bodyText, auth);
     }
     const gameRegister = url.pathname.match(/^\/games\/([^/]+)\/register$/);
     if (gameRegister && request.method === "POST") {
       return this.handleGameRegister(gameRegister[1], bodyText);
     }
     return new Response("Not found", { status: 404 });
   }
 
   async authenticate(request, bodyText) {
     try {
       return await this.authenticateAppAttest(request, bodyText);
     } catch (error) {
       return { ok: false, status: 401, message: `Bad App Attest auth: ${error.message}` };
     }
   }
 
   async authenticateAppAttest(request, bodyText) {
     if ((request.headers.get("X-Crossmate-Auth-Version") || "") !== "appattest-v1") {
       return { ok: false, status: 401, message: "Missing App Attest auth" };
     }
     const deviceID = request.headers.get("X-Crossmate-Device-ID") || "";
     const keyID = request.headers.get("X-Crossmate-Key-ID") || "";
     const timestamp = request.headers.get("X-Crossmate-Timestamp") || "";
     const nonce = request.headers.get("X-Crossmate-Nonce") || "";
     const bodyHash = request.headers.get("X-Crossmate-Body-SHA256") || "";
     const assertionBase64 = request.headers.get("X-Crossmate-Assertion") || "";
     if (!deviceID || !keyID || !timestamp || !nonce || !bodyHash || !assertionBase64) {
       return { ok: false, status: 401, message: "Incomplete App Attest auth" };
     }
     // These three form storage keys below; bound them before any storage touch.
     const canonicalKeyID = canonicalAppAttestKeyID(keyID);
     if (!isValidID(deviceID) || !canonicalKeyID || !isValidID(nonce)) {
       return { ok: false, status: 401, message: "Malformed App Attest auth" };
     }
 
     const nowSeconds = Math.floor(Date.now() / 1000);
     const timestampSeconds = Number(timestamp);
     const maxSkewSeconds = Number(this.env.MAX_AUTH_SKEW_SECONDS || "120");
     if (!Number.isFinite(timestampSeconds) || Math.abs(nowSeconds - timestampSeconds) > maxSkewSeconds) {
       return { ok: false, status: 401, message: "Stale auth timestamp" };
     }
 
     const computedBodyHash = base64URLEncode(await sha256Bytes(new TextEncoder().encode(bodyText)));
     if (!timingSafeEqual(bodyHash, computedBodyHash)) {
       return { ok: false, status: 401, message: "Bad body hash" };
     }
 
     const registrationKey = this.appAttestRegistrationKey(deviceID, canonicalKeyID);
     const registration = await this.loadAppAttestRegistration(deviceID, keyID, canonicalKeyID);
     if (!registration) {
       return { ok: false, status: 401, message: "Unknown App Attest key" };
     }
 
     const nonceTTLSeconds = Number(this.env.REQUEST_NONCE_TTL_SECONDS || "300");
     const nonceKey = `request-nonce:${deviceID}:${nonce}`;
     const nonceUsedAt = await this.state.storage.get(nonceKey);
     if (nonceUsedAt && Date.now() - nonceUsedAt <= nonceTTLSeconds * 1000) {
       return { ok: false, status: 401, message: "Nonce already used" };
     }
 
     const path = new URL(request.url).pathname;
     const canonical = canonicalPushRequest({
       method: request.method,
       path,
       bodyHash,
       timestamp,
       nonce,
       deviceID,
       keyID
     });
     const clientDataHash = await sha256Bytes(new TextEncoder().encode(canonical));
     const assertion = decodeAssertion(base64URLDecode(assertionBase64));
     const authData = parseAuthenticatorData(assertion.authenticatorData);
     const expectedAppIDHash = await this.expectedAppIDHash();
     if (!bytesEqual(authData.rpIDHash, expectedAppIDHash)) {
       return { ok: false, status: 401, message: "Bad App Attest app id" };
     }
     const signedBytes = concatBytes(assertion.authenticatorData, clientDataHash);
     // The Secure Enclave signs nonce = SHA256(authenticatorData || clientDataHash)
     // as an ECDSA-SHA256 *message*, so the digest under the signature is
     // SHA256(nonce). WebCrypto applies that second hash.
     const assertionNonce = await sha256Bytes(signedBytes);
     const publicKey = await this.importAppAttestPublicKey(registration);
     const verified = await crypto.subtle.verify(
       { name: "ECDSA", hash: "SHA-256" },
       publicKey,
       derECDSASignatureToRaw(assertion.signature),
       assertionNonce
     );
     if (!verified) {
       return { ok: false, status: 401, message: "Bad App Attest assertion" };
     }
 
     // Concurrent requests from one device can arrive out of counter order, and
     // replay is already blocked by the nonce and timestamp checks, so the
     // counter is only tracked (for clone diagnostics), never enforced.
     registration.signCount = Math.max(registration.signCount || 0, authData.signCount);
     registration.updatedAt = Date.now();
     await this.state.storage.put(registrationKey, registration);
     // Durable Object storage has no expirationTtl, so prune stale nonces here.
     await this.pruneExpired(`request-nonce:${deviceID}:`, nonceTTLSeconds);
     await this.state.storage.put(nonceKey, Date.now());
     return { ok: true, deviceID };
   }
 
   async loadAppAttestRegistration(deviceID, keyID, canonicalKeyID) {
     const registrationKey = this.appAttestRegistrationKey(deviceID, canonicalKeyID);
     let registration = await this.state.storage.get(registrationKey);
     // TEMPORARY BUILD-885 COMPATIBILITY: keys enrolled before 07aae65 were
     // stored using Apple's original spelling. Migrate that record on first
     // successful lookup. Remove this fallback with the other build-885 wire
     // compatibility after its supported upgrade window closes.
     if (!registration && keyID !== canonicalKeyID) {
       const legacyRegistrationKey = `appattest-key:${deviceID}:${keyID}`;
       registration = await this.state.storage.get(legacyRegistrationKey);
       if (registration) {
         await this.state.storage.put(registrationKey, registration);
         await this.state.storage.delete(legacyRegistrationKey);
       }
     }
     return registration;
   }
 
   async handleAttestationChallenge(request, bodyText) {
     const body = await readJSONText(bodyText);
     if (!body) return badRequest("Body must be JSON");
     const deviceID = body.deviceID || "";
     const keyID = body.keyID || "";
     if (!deviceID || !keyID) {
       return badRequest("deviceID and keyID required");
     }
     // Apple owns the key-ID format. Validate it as bounded Base64 rather than
     // applying Crossmate's narrower storage-identifier alphabet.
     if (!isValidID(deviceID) || !canonicalAppAttestKeyID(keyID)) {
       return badRequest("Malformed deviceID or keyID");
     }
     const limited = await this.checkAttestationRateLimit(request, "challenge", deviceID);
     if (limited) return limited;
     const ttlSeconds = this.appAttestChallengeTTLSeconds();
     const challenge = base64URLEncode(crypto.getRandomValues(new Uint8Array(32)));
     await this.pruneExpired(`appattest-challenge:${deviceID}:`, ttlSeconds);
     await this.state.storage.put(this.appAttestChallengeKey(deviceID, challenge), Date.now());
     console.log("App Attest challenge issued", {
       deviceIDLength: deviceID.length,
       keyIDLength: keyID.length,
       challengeLength: challenge.length,
       ttlSeconds
     });
     return Response.json({ challenge });
   }
 
   async handleAttestationRegister(request, bodyText) {
     const body = await readJSONText(bodyText);
     if (!body) return badRequest("Body must be JSON");
     const { deviceID, keyID, challenge, attestationObject } = body;
     if (!deviceID || !keyID || !challenge || !attestationObject) {
       return badRequest("deviceID, keyID, challenge, attestationObject required");
     }
     const canonicalKeyID = canonicalAppAttestKeyID(keyID);
     if (!isValidID(deviceID) || !canonicalKeyID || !isValidID(challenge)) {
       return badRequest("Malformed deviceID, keyID, or challenge");
     }
     // Attestation runs pre-auth, so keep the base64/CBOR/certificate work it
     // can demand tighter than the general body cap.
     if (typeof attestationObject !== "string" || attestationObject.length > MAX_ATTESTATION_OBJECT_CHARS) {
       return badRequest("attestationObject too large");
     }
     // Registration is idempotent. If the first 204 was lost, the client
     // resends the same persisted attestation after its challenge has already
     // been consumed. Confirm the existing canonical binding so that recovery
     // does not force it to discard a successfully enrolled Secure Enclave key.
     const registrationKey = this.appAttestRegistrationKey(deviceID, canonicalKeyID);
     if (await this.state.storage.get(registrationKey)) {
       return new Response(null, { status: 204 });
     }
     const limited = await this.checkAttestationRateLimit(request, "register", deviceID);
     if (limited) return limited;
     const challengeKey = this.appAttestChallengeKey(deviceID, challenge);
     const challengeIssuedAt = await this.state.storage.get(challengeKey);
     const challengeExpired = challengeIssuedAt
       ? Date.now() - challengeIssuedAt > this.appAttestChallengeTTLSeconds() * 1000
       : false;
     if (!challengeIssuedAt || challengeExpired) {
       if (challengeExpired) await this.state.storage.delete(challengeKey);
       console.warn("App Attest registration failed", {
         error: challengeExpired ? "expired challenge" : "unknown challenge",
         deviceIDLength: deviceID.length,
         keyIDLength: keyID.length,
         challengeLength: challenge.length,
         attestationObjectLength: attestationObject.length
       });
       return new Response("Unknown App Attest challenge", { status: 401 });
     }
 
     try {
       const registration = await this.verifyAttestation({
         deviceID,
         keyID,
         canonicalKeyID,
         challenge,
         attestationObject: base64URLDecode(attestationObject)
       });
       await this.state.storage.put(registrationKey, registration);
       await this.state.storage.delete(challengeKey);
       console.log("App Attest registration accepted", {
         expectedEnvironment: this.env.APP_ATTEST_ENVIRONMENT || "production",
         appBundleID: this.env.APP_BUNDLE_ID || this.env.APNS_TOPIC || "",
         rootCertConfigured: Boolean(this.env.APP_ATTEST_ROOT_CERT_PEM),
         rootCertLength: (this.env.APP_ATTEST_ROOT_CERT_PEM || "").length,
         deviceIDLength: deviceID.length,
         keyIDLength: keyID.length,
         signCount: registration.signCount
       });
       return new Response(null, { status: 204 });
     } catch (error) {
       console.error("App Attest registration failed", {
         error: error.message,
         expectedEnvironment: this.env.APP_ATTEST_ENVIRONMENT || "production",
         appTeamIDConfigured: Boolean(this.env.APP_TEAM_ID),
         appBundleID: this.env.APP_BUNDLE_ID || this.env.APNS_TOPIC || "",
         rootCertConfigured: Boolean(this.env.APP_ATTEST_ROOT_CERT_PEM),
         rootCertLength: (this.env.APP_ATTEST_ROOT_CERT_PEM || "").length,
         deviceIDLength: deviceID.length,
         keyIDLength: keyID.length,
         challengeLength: challenge.length,
         attestationObjectLength: attestationObject.length
       });
       return new Response(`Bad App Attest attestation: ${error.message}`, { status: 401 });
     }
   }
 
   async verifyAttestation({ deviceID, keyID, canonicalKeyID, challenge, attestationObject }) {
     const attestation = decodeAttestationObject(attestationObject);
     const authData = parseAuthenticatorData(attestation.authData, {
       requireAttestedCredential: true
     });
     const expectedAppIDHash = await this.expectedAppIDHash();
     if (!bytesEqual(authData.rpIDHash, expectedAppIDHash)) {
       throw new Error("app id hash mismatch");
     }
     if (!authData.credentialID || !bytesEqual(authData.credentialID, base64URLDecode(canonicalKeyID))) {
       throw new Error("credential id mismatch");
     }
     const appAttestEnvironment = this.env.APP_ATTEST_ENVIRONMENT || "production";
     if (!isExpectedAppAttestAAGUID(authData.aaguid, appAttestEnvironment)) {
       throw new Error(`unexpected aaguid for ${appAttestEnvironment}: ${bytesToHex(authData.aaguid)}`);
     }
     if (!attestation.attStmt || !Array.isArray(attestation.attStmt.x5c) || attestation.attStmt.x5c.length < 2) {
       throw new Error("missing certificate chain");
     }
 
     const leaf = parseCertificate(attestation.attStmt.x5c[0]);
     const intermediate = parseCertificate(attestation.attStmt.x5c[1]);
     await verifyCertificateSignature(leaf, intermediate.subjectPublicKeyInfo);
     const rootPEM = this.env.APP_ATTEST_ROOT_CERT_PEM || "";
     if (!rootPEM) {
       throw new Error("worker missing APP_ATTEST_ROOT_CERT_PEM");
     }
     const root = parseCertificate(pemToDer(rootPEM));
     await verifyCertificateSignature(intermediate, root.subjectPublicKeyInfo);
 
     // Build 2026.885 signs Apple's original key-ID spelling, which may be
     // padded standard Base64. Corrected clients send canonicalKeyID instead.
     // TEMPORARY COMPATIBILITY: after build 2026.885 is outside the supported
     // upgrade window, require `keyID === canonicalKeyID` at ingress and hash
     // canonicalKeyID here; standard Base64 parsing can then remain only as a
     // bounded normalization helper where Apple-originated values are read.
     const clientDataHash = await sha256Bytes(new TextEncoder().encode([
       "crossmate-appattest-v1",
       challenge,
       deviceID,
       keyID
     ].join("\n")));
     const expectedNonce = await sha256Bytes(concatBytes(attestation.authData, clientDataHash));
     const certNonce = certificateAppAttestNonce(leaf);
     if (!bytesEqual(certNonce, expectedNonce)) {
       throw new Error("certificate nonce mismatch");
     }
 
     return {
       publicKeyJWK: coseEC2PublicKeyToJWK(authData.cosePublicKey),
       publicKeySPKI: base64URLEncode(leaf.subjectPublicKeyInfo),
       signCount: authData.signCount,
       createdAt: Date.now()
     };
   }
 
   async importAppAttestPublicKey(registration) {
     if (registration.publicKeySPKI) {
       return crypto.subtle.importKey(
         "spki",
         base64URLDecode(registration.publicKeySPKI),
         { name: "ECDSA", namedCurve: "P-256" },
         false,
         ["verify"]
       );
     }
     return crypto.subtle.importKey(
       "jwk",
       registration.publicKeyJWK,
       { name: "ECDSA", namedCurve: "P-256" },
       false,
       ["verify"]
     );
   }
 
   async expectedAppIDHash() {
     const teamID = this.env.APP_TEAM_ID || "";
     const bundleID = this.env.APP_BUNDLE_ID || this.env.APNS_TOPIC || "";
     if (!teamID || !bundleID) {
       throw new Error("APP_TEAM_ID and APP_BUNDLE_ID/APNS_TOPIC are required");
     }
     return sha256Bytes(new TextEncoder().encode(`${teamID}.${bundleID}`));
   }
 
   appAttestChallengeKey(deviceID, challenge) {
     return `appattest-challenge:${deviceID}:${challenge}`;
   }
 
   appAttestChallengeTTLSeconds() {
     return Number(this.env.APP_ATTEST_CHALLENGE_TTL_SECONDS || "300");
   }
 
   // Deletes per-device keys whose stored timestamp is older than ttlSeconds.
   // Durable Object storage ignores KV's expirationTtl option, so expiry has to
   // be enforced manually.
   async pruneExpired(prefix, ttlSeconds) {
     const entries = await this.state.storage.list({ prefix });
     const cutoff = Date.now() - ttlSeconds * 1000;
     const expired = [];
     for (const [key, storedAt] of entries) {
       if (typeof storedAt !== "number" || storedAt < cutoff) expired.push(key);
     }
     if (expired.length > 0) {
       await this.state.storage.delete(expired);
     }
   }
 
   appAttestRegistrationKey(deviceID, keyID) {
     const canonicalKeyID = canonicalAppAttestKeyID(keyID);
     if (!canonicalKeyID) throw new Error("invalid App Attest key ID");
     return `appattest-key:${deviceID}:${canonicalKeyID}`;
   }
 
   async handleRegister(request, bodyText, auth) {
     const body = await readJSONText(bodyText);
     if (!body) return badRequest("Body must be JSON");
     const { deviceID, token, environment, addresses, mutedKinds } = body;
     if (!deviceID || !token || !Array.isArray(addresses)) {
       return badRequest("deviceID, token, addresses required");
     }
     if (auth.deviceID !== deviceID) {
       return new Response("Authenticated device mismatch", { status: 403 });
     }
     if (environment !== "sandbox" && environment !== "production") {
       return badRequest("environment must be 'sandbox' or 'production'");
     }
     if (!isValidID(deviceID) || !isValidID(token)) {
       return badRequest("Malformed deviceID or token");
     }
     if (addresses.length > this.ingressLimit("MAX_ADDRESS_COUNT")) {
       return badRequest("Too many addresses");
     }
     if (Array.isArray(mutedKinds) && mutedKinds.length > MAX_MUTED_KIND_COUNT) {
       return badRequest("Too many mutedKinds");
     }
     // Notification preferences ride along as a denylist of `kind` strings the
     // device does not want delivered. The worker only string-matches them at
     // publish time — it never interprets them — so a missing field (older
     // clients) and a kind invented after registration both mean "deliver".
     const muted = Array.isArray(mutedKinds)
       ? mutedKinds.filter((kind) => typeof kind === "string" && kind.length > 0 && kind.length <= MAX_KIND_CHARS)
       : [];
     // A game-scoped binding is a subscription to that game's pushes, so it
     // must prove current participation the same way a publish does: a game
     // signature over this request, verified against the secret registered
     // under the entry's credID. App Attest alone only proves "some enrolled
     // installation" — without the secret proof, anyone who ever learned a
     // credID (e.g. a departed participant, before rotation replaces it) could
     // re-subscribe to the room. The request carries one signature, so all
     // credID entries must name a single credID; the client registers each
     // game's bindings in its own signed request. An unknown credID fails
     // verification outright (`verifyGameSignature` requires the stored
     // secret). Unproven credID entries are dropped rather than failing the
     // request so a legacy client that still batches account + game entries in
     // one unsigned request keeps its account binding.
     const credIDs = new Set(
       addresses
         .filter((entry) => entry && typeof entry === "object" && isValidID(entry.credID))
         .map((entry) => entry.credID)
     );
     let verifiedCredID = null;
     if (credIDs.size === 1) {
       const credID = credIDs.values().next().value;
       const verification = await this.verifyGameSignature(request, credID);
       if (verification.ok) verifiedCredID = credID;
     }
     // A room's registration set is exactly what a broadcast fans out to, so
     // cap it at write time — that also bounds the broadcast storage scan.
     // Checked before any write so a refused request stores nothing;
     // re-registering an existing binding always succeeds.
     if (verifiedCredID) {
       const credPrefix = `addr:${verifiedCredID}:`;
       const existing = await this.state.storage.list({ prefix: credPrefix });
       const incoming = new Set();
       for (const entry of addresses) {
         const key = addressStorageKey(entry, deviceID);
         if (key && key.startsWith(credPrefix) && !existing.has(key)) incoming.add(key);
       }
       if (existing.size + incoming.size > this.ingressLimit("MAX_REGISTRATIONS_PER_CRED")) {
         return badRequest("Too many registrations for game");
       }
     }
     // Bind this device's APNs token to each address it knows. A game address
     // carries the game's `credID` and is stored under it so a publish can only
     // reach it when signed with that game's secret; the account-scoped sibling
     // address has no credID and uses the bare key. Identity never reaches the
     // worker — the (credID-scoped) address is the only lookup key.
     const updatedAt = Date.now();
     for (const entry of addresses) {
       const key = addressStorageKey(entry, deviceID);
       if (!key) continue;
       const entryCredID = entry && typeof entry === "object" && typeof entry.credID === "string"
         ? entry.credID
         : "";
       if (entryCredID && entryCredID !== verifiedCredID) continue;
       const registration = { token, environment, updatedAt };
       if (muted.length > 0) registration.mutedKinds = muted;
       await this.state.storage.put(key, registration);
     }
     return new Response(null, { status: 204 });
   }
 
   async handleUnregister(bodyText, auth) {
     const body = await readJSONText(bodyText);
     if (!body) return badRequest("Body must be JSON");
     const { deviceID, addresses } = body;
     if (!deviceID || !Array.isArray(addresses)) {
       return badRequest("deviceID and addresses required");
     }
     if (auth.deviceID !== deviceID) {
       return new Response("Authenticated device mismatch", { status: 403 });
     }
     if (!isValidID(deviceID)) {
       return badRequest("Malformed deviceID");
     }
     if (addresses.length > this.ingressLimit("MAX_ADDRESS_COUNT")) {
       return badRequest("Too many addresses");
     }
     for (const entry of addresses) {
       const key = addressStorageKey(entry, deviceID);
       if (!key) continue;
       await this.state.storage.delete(key);
     }
     return new Response(null, { status: 204 });
   }
 
   // Stores a game's shared push credential (first-write-wins), keyed by the
   // unguessable credID minted into the Game record. The client (any
   // participant) registers idempotently before publishing; a different secret
   // under the same credID is refused with 409 (only reachable on a credID
   // collision). Mirrors the room worker's `register`.
   async handleGameRegister(credID, bodyText) {
     const body = await readJSONText(bodyText);
     if (!body) return badRequest("Body must be JSON");
     if (!isValidID(credID)) return badRequest("Malformed credID");
     const secret = typeof body.secret === "string" && body.secret.length <= MAX_SECRET_CHARS
       ? body.secret
       : "";
     if (!isAcceptableSecret(secret)) return badRequest("Invalid secret");
     const key = `gamecred:${credID}`;
     const stored = await this.state.storage.get(key);
     if (stored) {
       if (!timingSafeEqual(stored.secret, secret)) {
         return new Response("Game credential mismatch", { status: 409 });
       }
       return new Response(null, { status: 204 });
     }
     await this.state.storage.put(key, { secret, createdAt: Date.now() });
     return new Response(null, { status: 201 });
   }
 
   // Authorization model: a game push must prove participation. The publish
   // names the game's `credID` (minted into the participant-only Game record)
   // and is signed with that game's secret; this verifies the signature
   // against the secret registered under that credID and then resolves targets
   // only among addresses registered under the same credID. So a caller can
   // only reach a game's participants if it holds that game's secret — i.e. it
   // is a participant. Account-scoped sibling pushes (accountJoined/accountSeen)
   // carry no credID: their addresses derive from the account secret in the
   // private CloudKit database, so they were never participant-spoofable.
   async handlePublish(request, bodyText, auth) {
     const body = await readJSONText(bodyText);
     if (!body) return badRequest("Body must be JSON");
     const {
       kind,
       addressees,
       gameID,
       credID,
       fromAuthorID,
       senderDeviceID,
       readAt,
       title,
       alertBody,
       background,
       broadcast,
       excludeAddress,
       collapseID,
       payload,
       enc
     } = body;
     if (!kind || typeof kind !== "string" || kind.length > MAX_KIND_CHARS) {
       return badRequest("kind required");
     }
     // Bound every field before the signature, rate-limit, storage, and APNs
     // work it would otherwise buy. Forwarded metadata only needs a length cap;
     // the credID additionally forms storage keys and gets the ID alphabet.
     if (!isAbsentOrBounded(gameID, MAX_ID_CHARS)
       || !isAbsentOrBounded(fromAuthorID, MAX_ID_CHARS)
       || !isAbsentOrBounded(senderDeviceID, MAX_ID_CHARS)
       || !isAbsentOrBounded(readAt, MAX_ID_CHARS)
       || !isAbsentOrBounded(excludeAddress, MAX_ID_CHARS)
       || !isAbsentOrBounded(title, MAX_TEXT_CHARS)
       || !isAbsentOrBounded(alertBody, MAX_TEXT_CHARS)
       || !isAbsentOrBounded(payload, MAX_OPAQUE_CHARS)
       || !isAbsentOrBounded(enc, MAX_OPAQUE_CHARS)) {
       return badRequest("Field too large");
     }
     if (credID != null && credID !== "" && !isValidID(credID)) {
       return badRequest("Malformed credID");
     }
     // The collapse ID travels as an APNs header (64-byte APNs ceiling), so it
     // must also stay printable ASCII.
     if (collapseID != null
       && !(typeof collapseID === "string"
         && collapseID.length <= MAX_COLLAPSE_ID_CHARS
         && /^[\x20-\x7e]*$/.test(collapseID))) {
       return badRequest("Malformed collapseID");
     }
     // A broadcast fans out to every device registered under the game's credID
     // (the whole room), so it carries no addressees but must be game-scoped —
     // the credID is both the delivery scope and, via its signature, the
     // participation proof. A non-broadcast publish names its recipients.
     if (broadcast === true) {
       if (!credID) return badRequest("broadcast requires credID");
     } else {
       if (!Array.isArray(addressees) || addressees.length === 0) {
         return badRequest("non-empty addressees required");
       }
       if (addressees.length > this.ingressLimit("MAX_ADDRESS_COUNT")) {
         return badRequest("Too many addressees");
       }
       for (const addressee of addressees) {
         if (!addressee || typeof addressee !== "object" || !isValidID(addressee.address)) {
           return badRequest("Malformed addressee");
         }
         if (!isAbsentOrBounded(addressee.body, MAX_TEXT_CHARS)
           || !isAbsentOrBounded(addressee.payload, MAX_OPAQUE_CHARS)
           || !isAbsentOrBounded(addressee.enc, MAX_OPAQUE_CHARS)) {
           return badRequest("Addressee field too large");
         }
       }
     }
 
     // APNs enforces its payload ceiling only after the worker has spent
     // signature, storage, and delivery work; measure the exact payload
     // `sendOne` would build and refuse oversized publishes up front instead.
     const encoder = new TextEncoder();
     const fits = (body, forwardedPayload, forwardedEnc) =>
       encoder.encode(JSON.stringify(buildAPNsPayload({
         kind,
         gameID,
         fromAuthorID,
         senderDeviceID,
         readAt,
         title,
         body,
         payload: forwardedPayload,
         enc: forwardedEnc,
         background: background === true
       }))).length <= MAX_APNS_PAYLOAD_BYTES;
     const oversized = broadcast === true
       ? !fits(alertBody, payload, enc)
       : addressees.some((addressee) => !fits(addressee.body || alertBody, addressee.payload, addressee.enc));
     if (oversized) {
       return new Response("Notification payload too large", { status: 413 });
     }
 
     if (credID) {
       const verification = await this.verifyGameSignature(request, credID);
       if (!verification.ok) {
         return new Response(verification.message, { status: verification.status });
       }
     }
 
     const limited = await this.checkPublishRateLimit({ credID, addressees, broadcast });
     if (limited) return limited;
 
     const targets = broadcast === true
       ? await this.resolveBroadcastTargets(credID, senderDeviceID, excludeAddress, alertBody, payload, enc)
       : await this.resolveTargets(addressees, senderDeviceID, credID);
     if (targets.length === 0) {
       return Response.json({ delivered: 0, removed: 0, muted: 0, failed: 0 });
     }
 
     let delivered = 0;
     let removed = 0;
     let muted = 0;
     let failed = 0;
     for (const target of targets) {
       // Honor the target device's registered notification preferences: a
       // muted kind is dropped here, before APNs, so the device never sees it.
       if (Array.isArray(target.mutedKinds) && target.mutedKinds.includes(kind)) {
         muted += 1;
         continue;
       }
       const result = await this.sendOne(target, {
         kind,
         gameID,
         fromAuthorID,
         senderDeviceID,
         readAt,
         title,
         body: target.body || alertBody,
         payload: target.payload,
         enc: target.enc,
         collapseID: typeof collapseID === "string" ? collapseID : undefined,
         background: background === true
       });
       if (result === "ok") delivered += 1;
       else if (result === "drop") {
         // Delete by the exact key the target was resolved from — game
         // addresses are stored credID-scoped (`addr:<credID>:<address>:<dev>`),
         // so reconstructing a bare `addr:<address>:<dev>` key would miss them.
         await this.state.storage.delete(target.storageKey);
         removed += 1;
       } else {
         failed += 1;
       }
     }
     return Response.json({ delivered, removed, muted, failed });
   }
 
   async checkAttestationRateLimit(request, endpoint, deviceID) {
     const ip = request.headers.get("CF-Connecting-IP") || "unknown";
     const ipLimit = endpoint === "register"
       ? this.rateLimitConfig("APP_ATTEST_REGISTER_IP")
       : this.rateLimitConfig("APP_ATTEST_CHALLENGE_IP");
     const deviceLimit = endpoint === "register"
       ? this.rateLimitConfig("APP_ATTEST_REGISTER_DEVICE")
       : this.rateLimitConfig("APP_ATTEST_CHALLENGE_DEVICE");
 
     const ipResult = await this.checkRateLimit(`attest:${endpoint}:ip`, ip, ipLimit);
     if (!ipResult.ok) return rateLimitedResponse(ipResult);
     const deviceResult = await this.checkRateLimit(`attest:${endpoint}:device`, deviceID, deviceLimit);
     if (!deviceResult.ok) return rateLimitedResponse(deviceResult);
     return null;
   }
 
   async checkPublishRateLimit({ credID, addressees, broadcast }) {
     if (credID) {
       const result = await this.checkRateLimit(
         "publish:cred",
         credID,
         this.rateLimitConfig("PUBLISH_CRED")
       );
       return result.ok ? null : rateLimitedResponse(result);
     }
 
     if (broadcast === true) {
       return badRequest("broadcast requires credID");
     }
 
     const seen = new Set();
     for (const addressee of addressees || []) {
       const address = addressee && typeof addressee.address === "string" ? addressee.address : "";
       if (!address || seen.has(address)) continue;
       seen.add(address);
       const result = await this.checkRateLimit(
         "publish:address",
         address,
         this.rateLimitConfig("PUBLISH_ADDRESS")
       );
       if (!result.ok) return rateLimitedResponse(result);
     }
     return null;
   }
 
   rateLimitConfig(prefix) {
     const defaults = RATE_LIMIT_DEFAULTS[prefix];
     const limit = Number(this.env[`${prefix}_LIMIT`] || String(defaults.limit));
     const windowSeconds = Number(this.env[`${prefix}_WINDOW_SECONDS`] || String(defaults.windowSeconds));
     return {
       limit: Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : defaults.limit,
       windowSeconds: Number.isFinite(windowSeconds) && windowSeconds > 0
         ? Math.floor(windowSeconds)
         : defaults.windowSeconds
     };
   }
 
   async checkRateLimit(bucket, identity, config) {
     const now = Date.now();
     const windowMillis = config.windowSeconds * 1000;
     const cutoff = now - windowMillis;
     const key = await rateLimitStorageKey(bucket, identity, this.rateLimitKeySecret());
     const stored = await this.state.storage.get(key);
     const recent = Array.isArray(stored)
       ? stored.filter((timestamp) => typeof timestamp === "number" && timestamp > cutoff)
       : [];
     if (recent.length >= config.limit) {
       const retryAfterSeconds = Math.max(1, Math.ceil((recent[0] + windowMillis - now) / 1000));
       await this.state.storage.put(key, recent);
       await this.ensureRateSweepScheduled();
       return { ok: false, retryAfterSeconds };
     }
     recent.push(now);
     await this.state.storage.put(key, recent);
     await this.ensureRateSweepScheduled();
     return { ok: true };
   }
 
   // Rate keys are written per rotatable identity (IP, deviceID, credID,
   // address) and would otherwise persist forever once that identity stops
   // appearing. Arm-if-unarmed keeps the sweep at most one per horizon even
   // under constant traffic — the same pattern as the room worker's
   // EngagementRegisterLimiter.
   async ensureRateSweepScheduled() {
     const scheduled = await this.state.storage.getAlarm();
     if (scheduled === null) {
       await this.state.storage.setAlarm(Date.now() + this.rateSweepHorizonMillis());
     }
   }
 
   // The sweep horizon is the largest configured window across all buckets: a
   // key untouched for that long has expired in every bucket, whatever its own
   // window, so one horizon safely serves keys whose bucket (and window) can't
   // be recovered from the HMAC-digested storage key.
   rateSweepHorizonMillis() {
     const windows = Object.keys(RATE_LIMIT_DEFAULTS).map(
       (prefix) => this.rateLimitConfig(prefix).windowSeconds
     );
     return Math.max(...windows) * 1000;
   }
 
   async alarm() {
     const cutoff = Date.now() - this.rateSweepHorizonMillis();
     const entries = await this.state.storage.list({ prefix: "rate:" });
     let liveKeys = 0;
     for (const [key, stored] of entries) {
       const newest = Array.isArray(stored)
         ? stored.reduce((max, timestamp) => (typeof timestamp === "number" && timestamp > max ? timestamp : max), 0)
         : 0;
       if (newest <= cutoff) {
         await this.state.storage.delete(key);
       } else {
         liveKeys += 1;
       }
     }
     if (liveKeys > 0) {
       await this.state.storage.setAlarm(Date.now() + this.rateSweepHorizonMillis());
     }
   }
 
   rateLimitKeySecret() {
     return this.env.RATE_LIMIT_HASH_KEY || this.env.APNS_KEY || "crossmate-rate-limit-v1";
   }
 
   // Resolves an env-overridable ingress cap, falling back to the table default
   // on a missing or malformed override — same convention as the rate limits.
   ingressLimit(name) {
     const parsed = Number(this.env[name] || "");
     return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : INGRESS_LIMIT_DEFAULTS[name];
   }
 
   // Verifies the game-participation signature: HMAC, under the secret
   // registered for `credID`, over the App Attest request's own body hash,
   // timestamp, and nonce (already validated by `authenticate`, so they are
   // bound to this exact request and need no separate freshness check here).
   async verifyGameSignature(request, credID) {
     const cred = await this.state.storage.get(`gamecred:${credID}`);
     if (!cred) {
       return { ok: false, status: 403, message: "Game not registered" };
     }
     const signature = request.headers.get("X-Crossmate-Game-Signature") || "";
     if (!signature) {
       return { ok: false, status: 401, message: "Missing game signature" };
     }
     const bodyHash = request.headers.get("X-Crossmate-Body-SHA256") || "";
     const timestamp = request.headers.get("X-Crossmate-Timestamp") || "";
     const nonce = request.headers.get("X-Crossmate-Nonce") || "";
     const payload = [
       "crossmate-push-game-v1",
       credID,
       bodyHash,
       timestamp,
       nonce
     ].join("\n");
     const expected = await hmacSHA256(cred.secret, payload);
     if (!timingSafeEqual(signature, expected)) {
       return { ok: false, status: 401, message: "Invalid game signature" };
     }
     return { ok: true };
   }
 
   async resolveTargets(addressees, senderDeviceID, credID) {
     const targets = [];
     for (const addressee of addressees) {
       if (!addressee || !addressee.address) continue;
       const body = typeof addressee.body === "string" ? addressee.body : undefined;
       // Opaque, app-encoded semantics. `enc` is the encrypted (sealed) payload
       // current clients send; `payload` is the legacy cleartext base64 JSON an
       // older client may still send. Either way the worker never inspects it —
       // it just forwards it into the APNs userInfo for the notification service
       // extension to decode. Keeping it opaque is what lets the app evolve
       // notification meaning (and now encrypt it) without a worker deploy.
       const payload = typeof addressee.payload === "string" ? addressee.payload : undefined;
       const enc = typeof addressee.enc === "string" ? addressee.enc : undefined;
       // Game pushes resolve only among addresses registered under the same
       // credID; account pushes use the bare address key.
       const prefix = credID
         ? `addr:${credID}:${addressee.address}:`
         : `addr:${addressee.address}:`;
       const map = await this.state.storage.list({ prefix });
       for (const [key, value] of map) {
         const deviceID = key.slice(prefix.length);
         if (senderDeviceID && deviceID === senderDeviceID) continue;
         targets.push({
           address: addressee.address,
           deviceID,
           storageKey: key,
           body,
           payload,
           enc,
           ...value
         });
       }
     }
     return targets;
   }
 
   // Resolves every device registered under a game's credID — the whole room —
   // for a broadcast publish. Keys are `addr:<credID>:<address>:<deviceID>`;
   // addresses (base64url / `acct-…`) and device IDs (hex) never contain a
   // colon, so the first colon after the prefix splits address from deviceID.
   // The sender's own device and (via `excludeAddress`) its account's other
   // devices are skipped, and the uniform `body`/`payload`/`enc` ride every target.
   async resolveBroadcastTargets(credID, senderDeviceID, excludeAddress, alertBody, payload, enc) {
     const body = typeof alertBody === "string" ? alertBody : undefined;
     const forwarded = typeof payload === "string" ? payload : undefined;
     const forwardedEnc = typeof enc === "string" ? enc : undefined;
     const prefix = `addr:${credID}:`;
     const map = await this.state.storage.list({ prefix });
     // The register-time per-credential cap bounds this scan; this cap bounds
     // the sequential APNs sends if an over-cap room predates that gate.
     const maxTargets = this.ingressLimit("MAX_BROADCAST_TARGETS");
     const targets = [];
     for (const [key, value] of map) {
       if (targets.length >= maxTargets) break;
       const rest = key.slice(prefix.length);
       const sep = rest.indexOf(":");
       if (sep < 0) continue;
       const address = rest.slice(0, sep);
       const deviceID = rest.slice(sep + 1);
       if (senderDeviceID && deviceID === senderDeviceID) continue;
       if (excludeAddress && address === excludeAddress) continue;
       targets.push({
         address,
         deviceID,
         storageKey: key,
         body,
         payload: forwarded,
         enc: forwardedEnc,
         ...value
       });
     }
     return targets;
   }
 
   async sendOne(target, message) {
     const topic = this.env.APNS_TOPIC || "net.inqk.crossmate";
     const host = target.environment === "sandbox"
       ? "api.sandbox.push.apple.com"
       : "api.push.apple.com";
     const jwt = await this.providerJWT();
     const apnsPayload = buildAPNsPayload(message);
 
     // A "nudge" rouse is ephemeral: deliver now or discard, since "come play"
     // delivered hours later is stale noise. `accountSeen` is also
     // background-only, but it withdraws already-read notifications from sibling
     // devices; give APNs a short store-and-forward window so a briefly-
     // unreachable device can still converge. Other alert kinds (win/resign/
     // pause) are one-time meaningful events and keep the longer window so a
     // recipient who is offline at send time still gets the banner.
     const expirationSeconds =
       message.kind === "accountSeen" ? 15 * 60 :
       message.background || message.kind === "nudge" ? 0 :
       4 * 60 * 60;
     const expiration = expirationSeconds === 0
       ? "0"
       : String(Math.floor(Date.now() / 1000) + expirationSeconds);
 
     const headers = {
       authorization: `bearer ${jwt}`,
       "apns-topic": topic,
       "apns-push-type": message.background ? "background" : "alert",
       "apns-priority": message.background ? "5" : "10",
       "apns-expiration": expiration,
       "content-type": "application/json"
     };
     // Coalesce alert pushes for one game into a single Notification Center tile
     // (the app picks the id; the receiver's NSE folds successive summaries into
     // it). Meaningless on a background push, which displays nothing.
     if (message.collapseID && !message.background) {
       headers["apns-collapse-id"] = message.collapseID;
     }
 
     const response = await fetch(`https://${host}/3/device/${target.token}`, {
       method: "POST",
       headers,
       body: JSON.stringify(apnsPayload)
     });
 
     if (response.status === 200) return "ok";
     if (response.status === 410) return "drop";
     if (response.status === 400) {
       const text = await response.text();
       if (text.includes("BadDeviceToken") || text.includes("DeviceTokenNotForTopic")) {
         return "drop";
       }
     }
     return "fail";
   }
 
   async providerJWT() {
     const nowSeconds = Math.floor(Date.now() / 1000);
     if (this.cachedJWT && nowSeconds < this.cachedJWTExpiresAt - 60) {
       return this.cachedJWT;
     }
     const jwt = await signProviderJWT({
       keyPEM: this.env.APNS_KEY,
       keyID: this.env.APNS_KEY_ID,
       teamID: this.env.APNS_TEAM_ID,
       issuedAt: nowSeconds
     });
     this.cachedJWT = jwt;
     // Refresh well before APNs' 1-hour ceiling; the rate-limit floor is ~20 min.
     this.cachedJWTExpiresAt = nowSeconds + 40 * 60;
     return jwt;
   }
 }
 
 export default {
   async fetch(request, env) {
     const url = new URL(request.url);
     if (url.pathname === "/health") {
       return new Response("ok");
     }
     const id = env.PUSH_REGISTRY.idFromName("registry");
     return env.PUSH_REGISTRY.get(id).fetch(request);
   }
 };
 
 // Buffers a request body only up to maxBytes: a Content-Length that already
 // exceeds the cap is refused for free, and a stream that grows past it is
 // cancelled mid-read instead of being materialized.
 async function readBodyWithinLimit(request, maxBytes) {
   const declared = Number(request.headers.get("content-length") || "");
   if (Number.isFinite(declared) && declared > maxBytes) {
     return { ok: false };
   }
   if (!request.body) {
     return { ok: true, text: "" };
   }
   const reader = request.body.getReader();
   const chunks = [];
   let total = 0;
   for (;;) {
     const { done, value } = await reader.read();
     if (done) break;
     total += value.byteLength;
     if (total > maxBytes) {
       try {
         await reader.cancel();
       } catch {
         // The stream is already errored/closed; nothing left to release.
       }
       return { ok: false };
     }
     chunks.push(value);
   }
   return { ok: true, text: new TextDecoder().decode(concatBytes(...chunks)) };
 }
 
 // Key-forming identifier: bounded and confined to the base64url/hex/UUID
 // alphabet every genuine address, credID, device ID, token, and nonce uses —
 // so it can never smuggle a `:` storage-key separator or APNs URL syntax.
 function isValidID(value) {
   return typeof value === "string"
     && value.length > 0
     && value.length <= MAX_ID_CHARS
     && /^[A-Za-z0-9._-]+$/.test(value);
 }
 
 // Returns the canonical, unpadded base64url spelling for an Apple App Attest
 // key ID. Comparing the round-trip spelling rejects malformed Base64 and
 // non-canonical trailing bits while deliberately treating standard Base64,
 // URL-safe Base64, and optional padding as the same opaque byte string.
 function canonicalAppAttestKeyID(value) {
   const mixesAlphabets = typeof value === "string"
     && (value.includes("+") || value.includes("/"))
     && (value.includes("-") || value.includes("_"));
   if (typeof value !== "string"
     || value.length === 0
     || value.length > MAX_APP_ATTEST_KEY_ID_CHARS
     || mixesAlphabets
     || !/^[A-Za-z0-9+/_-]+={0,2}$/.test(value)) {
     return null;
   }
   let bytes;
   try {
     bytes = base64URLDecodeFlexible(value);
   } catch {
     return null;
   }
   if (bytes.length === 0 || bytes.length > MAX_ID_CHARS) return null;
   const canonical = base64URLEncode(bytes);
   const suppliedCanonical = value
     .replace(/\+/g, "-")
     .replace(/\//g, "_")
     .replace(/=+$/g, "");
   return canonical === suppliedCanonical ? canonical : null;
 }
 
 // Forwarded metadata: absent (or null) is fine, anything present must be a
 // string within the cap.
 function isAbsentOrBounded(value, maxChars) {
   return value == null || (typeof value === "string" && value.length <= maxChars);
 }
 
 // The exact APNs payload for one target, shared by the publish-time size
 // check and `sendOne` so the two can never disagree.
 function buildAPNsPayload(message) {
   const alert = {};
   if (message.title) alert.title = message.title;
   if (message.body) alert.body = message.body;
   const apnsPayload = {
     aps: message.background
       ? { "content-available": 1 }
       : { alert, sound: "default", "mutable-content": 1 },
     kind: message.kind
   };
   if (message.gameID) apnsPayload.gameID = message.gameID;
   if (message.fromAuthorID) apnsPayload.fromAuthorID = message.fromAuthorID;
   if (message.senderDeviceID) apnsPayload.senderDeviceID = message.senderDeviceID;
   if (message.readAt) apnsPayload.readAt = message.readAt;
   // Forward the opaque app payload verbatim when present. `enc` is the
   // encrypted payload current clients send; `payload` is the legacy cleartext
   // form an older client may still send. Both are absent for older app builds,
   // which the extension handles by falling back to `kind`.
   if (message.enc) apnsPayload.enc = message.enc;
   if (message.payload) apnsPayload.payload = message.payload;
   return apnsPayload;
 }
 
 async function readJSONText(text) {
   try {
     return JSON.parse(text || "{}");
   } catch {
     return null;
   }
 }
 
 function badRequest(message) {
   return new Response(message, { status: 400 });
 }
 
 function rateLimitedResponse(result) {
   return new Response("Rate limit exceeded", {
     status: 429,
     headers: {
       "Retry-After": String(result.retryAfterSeconds)
     }
   });
 }
 
 async function rateLimitStorageKey(bucket, identity, secret) {
   const key = await crypto.subtle.importKey(
     "raw",
     new TextEncoder().encode(secret),
     { name: "HMAC", hash: "SHA-256" },
     false,
     ["sign"]
   );
   const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(String(identity || "")));
   const digest = new Uint8Array(signature);
   return `rate:${bucket}:${base64URLEncode(digest)}`;
 }
 
 // Storage key for a device's registration under one address. A game address
 // arrives as `{address, credID}` and is keyed under its credID so a publish
 // can reach it only when signed with that game's secret; the account-scoped
 // address arrives without a credID and uses the bare key.
 function addressStorageKey(entry, deviceID) {
   const address = entry && typeof entry === "object" ? entry.address : entry;
   // The address and credID become `:`-separated storage-key segments, so both
   // must pass the ID alphabet or the key's structure could be forged.
   if (!isValidID(address)) return null;
   const credID = entry && typeof entry === "object" && typeof entry.credID === "string"
     ? entry.credID
     : "";
   if (credID && !isValidID(credID)) return null;
   return credID
     ? `addr:${credID}:${address}:${deviceID}`
     : `addr:${address}:${deviceID}`;
 }
 
 // The secret doubles as the HMAC key for game signatures, so a registered
 // value must decode to at least 32 key bytes (clients mint exactly 32).
 function isAcceptableSecret(secret) {
   if (!secret) return false;
   let bytes;
   try {
     bytes = base64URLDecode(secret);
   } catch {
     return false;
   }
   return bytes.length >= 32;
 }
 
 async function hmacSHA256(secret, payload) {
   const key = await crypto.subtle.importKey(
     "raw",
     base64URLDecode(secret),
     { name: "HMAC", hash: "SHA-256" },
     false,
     ["sign"]
   );
   const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload));
   return base64URLEncode(new Uint8Array(signature));
 }
 
 function canonicalPushRequest({
   method,
   path,
   bodyHash,
   timestamp,
   nonce,
   deviceID,
   keyID
 }) {
   return [
     "crossmate-push-request-v1",
     method.toUpperCase(),
     path,
     bodyHash,
     timestamp,
     nonce,
     deviceID,
     keyID
   ].join("\n");
 }
 
 async function sha256Bytes(bytes) {
   return new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
 }
 
 function concatBytes(...arrays) {
   let length = 0;
   for (const array of arrays) length += array.length;
   const result = new Uint8Array(length);
   let offset = 0;
   for (const array of arrays) {
     result.set(array, offset);
     offset += array.length;
   }
   return result;
 }
 
 function bytesEqual(left, right) {
   if (!left || !right || left.length !== right.length) return false;
   let diff = 0;
   for (let index = 0; index < left.length; index += 1) {
     diff |= left[index] ^ right[index];
   }
   return diff === 0;
 }
 
 function bytesToHex(bytes) {
   if (!bytes) return "";
   return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
 function base64URLDecode(string) {
   let base64 = string.replace(/-/g, "+").replace(/_/g, "/");
   base64 += "=".repeat((4 - (base64.length % 4)) % 4);
   const binary = atob(base64);
   const bytes = new Uint8Array(binary.length);
   for (let index = 0; index < binary.length; index += 1) {
     bytes[index] = binary.charCodeAt(index);
   }
   return bytes;
 }
 
 function base64URLDecodeFlexible(string) {
   try {
     return base64URLDecode(string);
   } catch {
     const binary = atob(string);
     const bytes = new Uint8Array(binary.length);
     for (let index = 0; index < binary.length; index += 1) {
       bytes[index] = binary.charCodeAt(index);
     }
     return bytes;
   }
 }
 
 function pemToDer(pem) {
   const stripped = pem
     .replace(/-----BEGIN CERTIFICATE-----/g, "")
     .replace(/-----END CERTIFICATE-----/g, "")
     .replace(/\s+/g, "");
   return base64URLDecodeFlexible(stripped);
 }
 
 function decodeAttestationObject(bytes) {
   const decoded = cborDecode(bytes);
   if (!decoded || decoded.fmt !== "apple-appattest" || !(decoded.authData instanceof Uint8Array)) {
     throw new Error("invalid attestation object");
   }
   return decoded;
 }
 
 function decodeAssertion(bytes) {
   const decoded = cborDecode(bytes);
   const authData = decoded.authenticatorData || decoded.authData;
   if (!(authData instanceof Uint8Array) || !(decoded.signature instanceof Uint8Array)) {
     throw new Error("invalid assertion object");
   }
   return {
     authenticatorData: authData,
     signature: decoded.signature
   };
 }
 
 function cborDecode(bytes) {
   const reader = new CBORReader(bytes);
   const value = reader.read();
   if (!reader.done) throw new Error("trailing cbor data");
   return value;
 }
 
 class CBORReader {
   constructor(bytes) {
     this.bytes = bytes;
     this.offset = 0;
   }
 
   get done() {
     return this.offset === this.bytes.length;
   }
 
   read() {
     const initial = this.readByte();
     const major = initial >> 5;
     const additional = initial & 0x1f;
     const value = this.readArgument(additional);
     switch (major) {
     case 0:
       return value;
     case 1:
       return -1 - value;
     case 2:
       return this.readBytes(value);
     case 3:
       return new TextDecoder().decode(this.readBytes(value));
     case 4: {
       const array = [];
       for (let index = 0; index < value; index += 1) {
         array.push(this.read());
       }
       return array;
     }
     case 5: {
       const object = {};
       for (let index = 0; index < value; index += 1) {
         object[this.read()] = this.read();
       }
       return object;
     }
     case 7:
       if (additional === 20) return false;
       if (additional === 21) return true;
       if (additional === 22) return null;
       break;
     default:
       break;
     }
     throw new Error("unsupported cbor value");
   }
 
   readArgument(additional) {
     if (additional < 24) return additional;
     if (additional === 24) return this.readByte();
     if (additional === 25) return this.readUInt(2);
     if (additional === 26) return this.readUInt(4);
     if (additional === 27) return this.readUInt(8);
     throw new Error("indefinite cbor values are unsupported");
   }
 
   readUInt(length) {
     let value = 0;
     for (let index = 0; index < length; index += 1) {
       value = (value * 256) + this.readByte();
     }
     return value;
   }
 
   readByte() {
     if (this.offset >= this.bytes.length) throw new Error("truncated cbor");
     return this.bytes[this.offset++];
   }
 
   readBytes(length) {
     if (this.offset + length > this.bytes.length) throw new Error("truncated cbor bytes");
     const value = this.bytes.slice(this.offset, this.offset + length);
     this.offset += length;
     return value;
   }
 }
 
 function parseAuthenticatorData(bytes, options = {}) {
   if (bytes.length < 37) throw new Error("authenticator data too short");
   const signCount = (
     (bytes[33] * 0x1000000) +
     (bytes[34] << 16) +
     (bytes[35] << 8) +
     bytes[36]
   ) >>> 0;
   const result = {
     rpIDHash: bytes.slice(0, 32),
     flags: bytes[32],
     signCount
   };
   const hasAttestedCredentialData = (result.flags & 0x40) !== 0;
   if (options.requireAttestedCredential && !hasAttestedCredentialData) {
     throw new Error("attested credential data missing");
   }
   if (options.requireAttestedCredential || options.parseAttestedCredential) {
     if (bytes.length < 55) throw new Error("attested credential data missing");
     result.aaguid = bytes.slice(37, 53);
     const credentialLength = (bytes[53] << 8) | bytes[54];
     const credentialStart = 55;
     const credentialEnd = credentialStart + credentialLength;
     if (credentialEnd > bytes.length) throw new Error("credential id truncated");
     result.credentialID = bytes.slice(credentialStart, credentialEnd);
     result.cosePublicKey = bytes.slice(credentialEnd);
   }
   return result;
 }
 
 function isExpectedAppAttestAAGUID(aaguid, environment) {
   if (!aaguid || aaguid.length !== 16) return false;
   const production = new Uint8Array(16);
   production.set(new TextEncoder().encode("appattest"), 0);
   const development = new TextEncoder().encode("appattestdevelop");
   if (environment === "development") {
     return bytesEqual(aaguid, development);
   }
   return bytesEqual(aaguid, production);
 }
 
 function coseEC2PublicKeyToJWK(bytes) {
   const key = cborDecode(bytes);
   const x = key[-2];
   const y = key[-3];
   if (key[1] !== 2 || key[-1] !== 1 || !(x instanceof Uint8Array) || !(y instanceof Uint8Array)) {
     throw new Error("unsupported cose key");
   }
   return {
     kty: "EC",
     crv: "P-256",
     x: base64URLEncode(x),
     y: base64URLEncode(y),
     ext: true
   };
 }
 
 function parseCertificate(bytes) {
   const cert = parseDER(bytes);
   if (cert.tag !== 0x30 || cert.children.length < 3) {
     throw new Error("invalid certificate");
   }
   const tbs = cert.children[0];
   const signatureAlgorithm = parseAlgorithmIdentifier(cert.children[1]);
   const signatureValue = cert.children[2];
   if (signatureValue.tag !== 0x03) throw new Error("invalid certificate signature");
 
   const tbsChildren = tbs.children;
   let index = tbsChildren[0].tag === 0xa0 ? 1 : 0;
   index += 5; // serial, signature, issuer, validity, subject
   const subjectPublicKeyInfo = tbsChildren[index].raw;
   const extensions = [];
   for (const child of tbsChildren.slice(index + 1)) {
     if (child.tag === 0xa3 && child.children[0]?.tag === 0x30) {
       for (const ext of child.children[0].children) {
         const oid = decodeOID(ext.children[0].value);
         const valueNode = ext.children.find((node) => node.tag === 0x04);
         if (valueNode) extensions.push({ oid, value: valueNode.value });
       }
     }
   }
 
   return {
     tbs: tbs.raw,
     signatureAlgorithm,
     subjectPublicKeyInfo,
     signature: signatureValue.value.slice(1),
     extensions
   };
 }
 
 function parseDER(bytes, offset = 0) {
   const start = offset;
   const tag = bytes[offset++];
   let length = bytes[offset++];
   if ((length & 0x80) !== 0) {
     const byteCount = length & 0x7f;
     length = 0;
     for (let index = 0; index < byteCount; index += 1) {
       length = (length * 256) + bytes[offset++];
     }
   }
   const valueStart = offset;
   const end = valueStart + length;
   if (end > bytes.length) throw new Error("truncated der");
   const constructed = (tag & 0x20) !== 0;
   const children = [];
   if (constructed) {
     let childOffset = valueStart;
     while (childOffset < end) {
       const child = parseDER(bytes, childOffset);
       children.push(child);
       childOffset = child.end;
     }
   }
   return {
     tag,
     start,
     valueStart,
     end,
     raw: bytes.slice(start, end),
     value: bytes.slice(valueStart, end),
     children
   };
 }
 
 function decodeOID(bytes) {
   const parts = [Math.floor(bytes[0] / 40), bytes[0] % 40];
   let value = 0;
   for (const byte of bytes.slice(1)) {
     value = (value << 7) | (byte & 0x7f);
     if ((byte & 0x80) === 0) {
       parts.push(value);
       value = 0;
     }
   }
   return parts.join(".");
 }
 
 async function verifyCertificateSignature(cert, issuerSPKI) {
   const issuerKey = parseSubjectPublicKeyInfo(issuerSPKI);
   const hash = certificateSignatureHash(cert.signatureAlgorithm);
   const publicKey = await crypto.subtle.importKey(
     "spki",
     issuerSPKI,
     { name: "ECDSA", namedCurve: issuerKey.namedCurve },
     false,
     ["verify"]
   );
   const ok = await crypto.subtle.verify(
     { name: "ECDSA", hash },
     publicKey,
     derECDSASignatureToRaw(cert.signature, issuerKey.coordinateLength),
     cert.tbs
   );
   if (!ok) throw new Error("certificate signature verification failed");
 }
 
 function parseAlgorithmIdentifier(node) {
   if (!node || node.tag !== 0x30 || !node.children[0]) {
     throw new Error("invalid algorithm identifier");
   }
   const algorithm = {
     oid: decodeOID(node.children[0].value)
   };
   if (node.children[1]) {
     if (node.children[1].tag === 0x06) {
       algorithm.parametersOID = decodeOID(node.children[1].value);
     } else {
       algorithm.parameters = node.children[1].raw;
     }
   }
   return algorithm;
 }
 
 function parseSubjectPublicKeyInfo(spki) {
   const node = parseDER(spki);
   if (node.tag !== 0x30 || !node.children[0]) {
     throw new Error("invalid subject public key info");
   }
   const algorithm = parseAlgorithmIdentifier(node.children[0]);
   if (algorithm.oid !== "1.2.840.10045.2.1") {
     throw new Error(`unsupported certificate public key algorithm ${algorithm.oid}`);
   }
   switch (algorithm.parametersOID) {
   case "1.2.840.10045.3.1.7":
     return { namedCurve: "P-256", coordinateLength: 32 };
   case "1.3.132.0.34":
     return { namedCurve: "P-384", coordinateLength: 48 };
   default:
     throw new Error(`unsupported certificate EC curve ${algorithm.parametersOID || ""}`);
   }
 }
 
 function certificateSignatureHash(signatureAlgorithm) {
   switch (signatureAlgorithm.oid) {
   case "1.2.840.10045.4.3.2":
     return "SHA-256";
   case "1.2.840.10045.4.3.3":
     return "SHA-384";
   default:
     throw new Error(`unsupported certificate signature algorithm ${signatureAlgorithm.oid}`);
   }
 }
 
 function certificateAppAttestNonce(cert) {
   const extension = cert.extensions.find((entry) => entry.oid === "1.2.840.113635.100.8.2");
   if (!extension) throw new Error("missing app attest nonce extension");
   const nested = parseDER(extension.value);
   const octets = findOctetString(nested, 32);
   if (!octets) throw new Error("missing app attest nonce");
   return octets;
 }
 
 function findOctetString(node, length) {
   if (node.tag === 0x04 && node.value.length === length) return node.value;
   for (const child of node.children) {
     const found = findOctetString(child, length);
     if (found) return found;
   }
   return null;
 }
 
 function derECDSASignatureToRaw(bytes, coordinateLength = 32) {
   const sequence = parseDER(bytes);
   if (sequence.tag !== 0x30 || sequence.children.length !== 2) {
     throw new Error("invalid ecdsa signature");
   }
   return concatBytes(
     derIntegerToFixed(sequence.children[0].value, coordinateLength),
     derIntegerToFixed(sequence.children[1].value, coordinateLength)
   );
 }
 
 function derIntegerToFixed(bytes, length) {
   let value = bytes;
   while (value.length > 0 && value[0] === 0) {
     value = value.slice(1);
   }
   if (value.length > length) throw new Error("ecdsa integer too long");
   const result = new Uint8Array(length);
   result.set(value, length - value.length);
   return result;
 }
 
 async function signProviderJWT({ keyPEM, keyID, teamID, issuedAt }) {
   if (!keyPEM || !keyID || !teamID) {
     throw new Error("APNS_KEY, APNS_KEY_ID, APNS_TEAM_ID must all be set");
   }
   const key = await importP8(keyPEM);
   const header = base64URLEncode(new TextEncoder().encode(JSON.stringify({
     alg: "ES256",
     kid: keyID
   })));
   const claims = base64URLEncode(new TextEncoder().encode(JSON.stringify({
     iss: teamID,
     iat: issuedAt
   })));
   const signingInput = `${header}.${claims}`;
   const signature = await crypto.subtle.sign(
     { name: "ECDSA", hash: "SHA-256" },
     key,
     new TextEncoder().encode(signingInput)
   );
   return `${signingInput}.${base64URLEncode(new Uint8Array(signature))}`;
 }
 
 async function importP8(pem) {
   const stripped = pem
     .replace(/-----BEGIN PRIVATE KEY-----/g, "")
     .replace(/-----END PRIVATE KEY-----/g, "")
     .replace(/\s+/g, "");
   const der = Uint8Array.from(atob(stripped), (char) => char.charCodeAt(0));
   return crypto.subtle.importKey(
     "pkcs8",
     der,
     { name: "ECDSA", namedCurve: "P-256" },
     false,
     ["sign"]
   );
 }
 
 function base64URLEncode(bytes) {
   let binary = "";
   for (const byte of bytes) {
     binary += String.fromCharCode(byte);
   }
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
 
 function timingSafeEqual(a, b) {
   const left = new TextEncoder().encode(a);
   const right = new TextEncoder().encode(b);
   if (left.length !== right.length) return false;
   let diff = 0;
   for (let index = 0; index < left.length; index += 1) {
     diff |= left[index] ^ right[index];
   }
   return diff === 0;
 }