feat: native APNs/FCM push transport + shared push-core (P2 push, slice 3a)

[saucam]

What

Self-hosted push, no third party (P2 push, slice 3a — daemon side). The daemon can now deliver approval wake-ups directly via APNs/FCM (transport: "native"), holding its own credentials — replacing Expo (a third party in the delivery path) for the operator who is the app publisher.

The decision behind this: on iOS, only the app publisher can push to the App Store app. For a personal self-hosted daemon (operator == publisher), the daemon can push directly — no relay/process/repo needed. A standalone relay is only required to serve other users' daemons or a hosted offering. So this ships the embedded path now, structured so the relay is a drop-in later.

Shared core — both modes, zero duplication

The credential-bearing logic lives once in src/push-core (depends only on node:crypto / node:http2 / fetch — no daemon imports):

• ApnsClient — ES256 (.p8) provider JWT (cached), HTTP/2 to APNs, content-blind aps payload, dead-token classification (410 / BadDeviceToken / Unregistered). The HTTP/2 connect is injectable, so the send path is unit-tested without a real socket.
• FcmClient — service-account RS256 JWT → OAuth token (cached) → FCM v1 POST, content-blind message, UNREGISTERED/NOT_FOUND classification.
• PushSender — routes by platform (iOS→APNs, Android→FCM) over injectable channels.

Both delivery paths converge on this one sender:

• Embedded (transport: native): daemon → NativePushTransport → PushSender → APNs/FCM.
• Relay (transport: relay): daemon → RelayPushTransport (an HTTPS POST, no creds) → (future) relay service → the same PushSender → APNs/FCM.

RelayPushTransport (the daemon half of the relay seam) ships now; the standalone relay service is a thin wrapper around push-core, added when the multi-user/hosted path is needed.

Surface

• createPushTransport selects expo | native | relay | none.
• config.push gains transport: native/relay + apns/fcm creds + relayUrl/relayToken (+ env overrides). Native holds .p8/Firebase creds locally; relay holds none.
• Daemon advertises push.native when transport is native/relay (vs push for expo), so the client registers the right token type (native device token vs Expo token). Dead tokens are pruned via Store.pruneDeadToken.
• Content-blind everywhere: payloads carry only an opaque sessionId + kind — never a tool name, args, or description.

Verification

bun test: ES256/RS256 sign→verify; APNs content-blind payload + response classification + the HTTP/2 send via injected connect (session reuse, unregistered); FCM via mocked fetch (OAuth caching, Bearer, content-blind body, unregistered); PushSender routing; native/relay transports + factory + dead-token prune. tsc + biome clean; broad regression (session-manager / config / protocol / core) green.

Real APNs/FCM delivery needs your .p8 + Firebase service account (config.push.apns/fcm) + a device build — the sending logic is verified headlessly (injected socket / mocked fetch).

Follow-ups

• Mobile: register the native device token (getDevicePushTokenAsync) when the daemon advertises push.native (separate codeoid-mobile PR — completes 3a end-to-end).
• The standalone relay service (src/relay) wrapping push-core — when multi-user / hosted.

🤖 Generated with Claude Code

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.