Hide the in-app notification channel on Account unless running a development build.

WebView fetch to free ngrok was blocked by the interstitial (no CORS ACAO). Keep production notify-api requests unchanged.

.env.development

@@ -18,4 +18,6 @@ VITE_DEFAULT_ENDORSER_API_SERVER=http://localhost:3000
 VITE_DEFAULT_IMAGE_API_SERVER=https://test-image-api.timesafari.app
 VITE_DEFAULT_PARTNER_API_SERVER=http://localhost:3000
 #VITE_DEFAULT_PUSH_SERVER... can't be set up with localhost domain
+# Using shared test notify API (no local notify server by default).
+VITE_DEFAULT_NOTIFY_API_SERVER=https://test-notify-api.timesafari.app
 VITE_PASSKEYS_ENABLED=true

.env.production

@@ -11,3 +11,4 @@ VITE_DEFAULT_ENDORSER_API_SERVER=https://api.endorser.ch
 VITE_DEFAULT_IMAGE_API_SERVER=https://image-api.timesafari.app
 VITE_DEFAULT_PARTNER_API_SERVER=https://partner-api.endorser.ch
 VITE_DEFAULT_PUSH_SERVER=https://timesafari.app
+VITE_DEFAULT_NOTIFY_API_SERVER=https://notify-api.timesafari.app

.env.test

@@ -15,4 +15,5 @@ VITE_DEFAULT_ENDORSER_API_SERVER=https://test-api.endorser.ch
 VITE_DEFAULT_IMAGE_API_SERVER=https://test-image-api.timesafari.app
 VITE_DEFAULT_PARTNER_API_SERVER=https://test-partner-api.endorser.ch
 VITE_DEFAULT_PUSH_SERVER=https://test.timesafari.app
+VITE_DEFAULT_NOTIFY_API_SERVER=https://test-notify-api.timesafari.app
 VITE_PASSKEYS_ENABLED=true

.husky/commit-msg

@@ -1,9 +1,7 @@
-#!/usr/bin/env bash
 #
 # Husky Commit Message Hook
 # Validates commit message format using commitlint
 #
-. "$(dirname -- "$0")/_/husky.sh"
 
 # Run commitlint but don't fail the commit (|| true)
 # This provides helpful feedback without blocking commits

.husky/pre-commit

@@ -1,9 +1,7 @@
-#!/usr/bin/env bash
 #
 # Husky Pre-commit Hook
 # Runs lint-fix and Build Architecture Guard on staged files
 #
-. "$(dirname -- "$0")/_/husky.sh"
 
 echo "🔍 Running pre-commit hooks..."
 

.husky/pre-push

@@ -1,9 +1,7 @@
-#!/usr/bin/env bash
 #
 # Husky Pre-push Hook  
 # Runs Build Architecture Guard to check commits being pushed
 #
-. "$(dirname -- "$0")/_/husky.sh"
 
 echo "🔍 Running Build Architecture Guard (pre-push)..."
 

BUILDING.md

@@ -164,6 +164,7 @@ cp .env.example .env.development
 # - VITE_DEFAULT_ENDORSER_API_SERVER
 # - VITE_DEFAULT_PARTNER_API_SERVER
 # - VITE_DEFAULT_IMAGE_API_SERVER
+# - VITE_DEFAULT_NOTIFY_API_SERVER
 ```
 
 #### Platform-Specific Development
@@ -1126,7 +1127,7 @@ If you need to build manually or want to understand the individual steps:
 
 ##### 0. First time (or if dependencies change)
 
-- `pkgx +rubygems.org zsh`
+- `pkgx +rubygems.org +pod zsh`
 
 - ... and you may have to fix these, especially with pkgx:
 
@@ -1153,6 +1154,8 @@ Here's prod. Also available: test, dev
 npm run build:ios:prod
 ```
 
+- The first time, it may complain about a bundler install for "missing gems", and you'll want to run the "install" command it gives you.
+
 3.1. Use Xcode to build and run on simulator or device.
 
 - Select Product -> Destination with some Simulator version. Then click the run arrow.
@@ -1648,6 +1651,7 @@ The build system supports multiple environment file patterns for different scena
 VITE_DEFAULT_ENDORSER_API_SERVER=https://api.endorser.ch
 VITE_DEFAULT_PARTNER_API_SERVER=https://partner-api.endorser.ch
 VITE_DEFAULT_IMAGE_API_SERVER=https://image-api.timesafari.app
+VITE_DEFAULT_NOTIFY_API_SERVER=https://notify-api.timesafari.app
 
 # Platform Configuration
 VITE_PLATFORM=web|electron|capacitor
@@ -1667,6 +1671,7 @@ VITE_BVC_MEETUPS_PROJECT_CLAIM_ID=https://endorser.ch/entity/01HWE8FWHQ1YGP7GFZY
 VITE_DEFAULT_ENDORSER_API_SERVER=http://localhost:3000
 VITE_DEFAULT_PARTNER_API_SERVER=http://localhost:3000
 VITE_DEFAULT_IMAGE_API_SERVER=https://test-image-api.timesafari.app
+VITE_DEFAULT_NOTIFY_API_SERVER=https://test-notify-api.timesafari.app
 VITE_APP_SERVER=http://localhost:8080
 ```
 
@@ -1677,6 +1682,7 @@ VITE_APP_SERVER=http://localhost:8080
 VITE_DEFAULT_ENDORSER_API_SERVER=https://test-api.endorser.ch
 VITE_DEFAULT_PARTNER_API_SERVER=https://test-partner-api.endorser.ch
 VITE_DEFAULT_IMAGE_API_SERVER=https://test-image-api.timesafari.app
+VITE_DEFAULT_NOTIFY_API_SERVER=https://test-notify-api.timesafari.app
 VITE_APP_SERVER=https://test.timesafari.app
 ```
 
@@ -1687,6 +1693,7 @@ VITE_APP_SERVER=https://test.timesafari.app
 VITE_DEFAULT_ENDORSER_API_SERVER=https://api.endorser.ch
 VITE_DEFAULT_PARTNER_API_SERVER=https://partner-api.endorser.ch
 VITE_DEFAULT_IMAGE_API_SERVER=https://image-api.timesafari.app
+VITE_DEFAULT_NOTIFY_API_SERVER=https://notify-api.timesafari.app
 VITE_APP_SERVER=https://timesafari.app
 ```
 
@@ -1714,20 +1721,10 @@ VITE_APP_SERVER=https://timesafari.app
    fi
    ```
 
-2. **Platform-Specific Overrides**
+2. **Environment File Loading**
 
    ```bash
-   # scripts/build-android.sh
-   if [ "$BUILD_MODE" = "development" ]; then
-       export VITE_DEFAULT_ENDORSER_API_SERVER="http://10.0.2.2:3000"
-       export VITE_DEFAULT_PARTNER_API_SERVER="http://10.0.2.2:3000"
-   fi
-   ```
-
-3. **Environment File Loading**
-
-   ```bash
-   # scripts/build-web.sh
+   # scripts/build-web.sh, build-android.sh, build-ios.sh, build-electron.sh
    local env_file=".env.$BUILD_MODE"  # .env.development, .env.test, .env.production
    if [ -f "$env_file" ]; then
        load_env_file "$env_file"
@@ -1739,6 +1736,18 @@ VITE_APP_SERVER=https://timesafari.app
    fi
    ```
 
+3. **Platform-Specific Overrides**
+
+   These run last so the platform address wins over the `.env` files.
+
+   ```bash
+   # scripts/build-android.sh
+   if [ "$BUILD_MODE" = "development" ]; then
+       export VITE_DEFAULT_ENDORSER_API_SERVER="http://10.0.2.2:3000"
+       export VITE_DEFAULT_PARTNER_API_SERVER="http://10.0.2.2:3000"
+   fi
+   ```
+
 4. **Application Usage**
 
    ```typescript
@@ -1944,6 +1953,7 @@ The build system supports multiple environment file patterns:
 VITE_DEFAULT_ENDORSER_API_SERVER=https://api.endorser.ch
 VITE_DEFAULT_PARTNER_API_SERVER=https://partner-api.endorser.ch
 VITE_DEFAULT_IMAGE_API_SERVER=https://image-api.timesafari.app
+VITE_DEFAULT_NOTIFY_API_SERVER=https://notify-api.timesafari.app
 
 # Platform Configuration
 VITE_PLATFORM=web|electron|capacitor

CHANGELOG.md

@@ -6,6 +6,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## [?] - 2026
+### Added
+- Full flow for setting up SMS notifications: phone registration and code
+  verification, delegated alertSearch JWT batches with a send hour, and
+  revocation to stop the texts
+- Notification debug panel action to mint and upload a push-channel alertSearch
+  authorization, built on the same batch minter as the SMS channel
+### Fixed
+- Native build scripts set NODE_ENV, so `import.meta.env.DEV` matches the build
+  mode instead of always reporting a production build
+- Android and iOS development builds keep their emulator and `--api-ip` API
+  addresses, which the `.env` files had been overwriting
+
+
 ## [1.3.8] - 2026
 ### Added
 - Device wake-up for notifications

README.md

@@ -15,13 +15,43 @@ Quick start:
 
 ```bash
 npm install
+```
+
+### Web
+
+```bash
 npm run build:web:dev
 ```
 
-To be able to take action on the platform: go to [the test page](http://localhost:8080/test) and click "Become User 0".
+Then go to [the test page](http://localhost:8080/test) and click "Become User 0" to take action on the platform.
+
+### Android
+
+```bash
+npm run build:android:test:run
+```
+
+Assumes ADB is installed; see [Android Build](BUILDING.md#android-build) for SDK, emulator, and `PATH` setup.
+
+### iOS
+
+```bash
+npm run build:ios:studio
+```
+
+Assumes Xcode and Xcode Command Line Tools are installed.
 
 See [BUILDING.md](BUILDING.md) for comprehensive build instructions for all platforms (Web, Electron, iOS, Android, Docker).
 
+## Tests
+
+```
+npm run test:web
+
+# ... or do every check:
+npm run test:all
+```
+
 ## 🛡️ Build Architecture Guard
 
 This project uses **Husky Git hooks** to protect the build system
@@ -89,6 +119,27 @@ VITE_LOG_LEVEL=debug npm run build:web:dev
 
 See [Logging Configuration Guide](doc/logging-configuration.md) for complete details.
 
+## Notification Debug Panel (dev builds)
+
+In non-production bundles (for example `vite dev` or a Vite build whose mode is not `production`), the **Notification Debug Panel** at `/dev/notifications` helps you test notification registration, backend refresh, WAKEUP_PING handling, and local schedule inspection on native builds.
+
+**Access:** **Account** → enable **Show All General Advanced Functions** → **Notification Debug Panel**.
+
+Key configuration (independent settings):
+
+- **Notification Backend URL** — which notification server receives API calls
+- **Test Mode** — `testMode` sent in JSON request bodies (default on)
+- **Skip JWT Authentication (Local Development Only)** — omit JWT headers for local unauthenticated backends (default off)
+
+See [doc/notification-debug-panel.md](doc/notification-debug-panel.md) for controls, recommended settings (hosted test server vs local ngrok), and troubleshooting.
+
+Platform-specific end-to-end guides:
+
+- [doc/local-android-testing-ngrok.md](doc/local-android-testing-ngrok.md)
+- [doc/local-ios-testing-ngrok.md](doc/local-ios-testing-ngrok.md)
+
+## Database Clearing (development)
+
 ### Quick Usage
 ```bash
 # Run the database clearing script

android/app/capacitor.build.gradle

@@ -15,6 +15,8 @@ dependencies {
     implementation project(':capacitor-camera')
     implementation project(':capacitor-clipboard')
     implementation project(':capacitor-filesystem')
+    implementation project(':capacitor-preferences')
+    implementation project(':capacitor-push-notifications')
     implementation project(':capacitor-share')
     implementation project(':capacitor-status-bar')
     implementation project(':capawesome-capacitor-file-picker')

android/app/google-services.json

@@ -1,13 +1,13 @@
 {
   "project_info": {
-    "project_number": "123456789000",
-    "project_id": "timesafari-app",
-    "storage_bucket": "timesafari-app.appspot.com"
+    "project_number": "1094643115061",
+    "project_id": "pc-api-7249509642322112640-286",
+    "storage_bucket": "pc-api-7249509642322112640-286.firebasestorage.app"
   },
   "client": [
     {
       "client_info": {
-        "mobilesdk_app_id": "1:123456789000:android:1234567890abcdef",
+        "mobilesdk_app_id": "1:1094643115061:android:f11bd26f6bd2fcdc887d7c",
         "android_client_info": {
           "package_name": "app.timesafari.app"
         }
@@ -15,7 +15,45 @@
       "oauth_client": [],
       "api_key": [
         {
-          "current_key": "AIzaSyDummyKeyForBuildPurposesOnly12345"
+          "current_key": "AIzaSyCFLYeLfGQqh7ErvzXgy74H0Gx3yQAMEw8"
+        }
+      ],
+      "services": {
+        "appinvite_service": {
+          "other_platform_oauth_client": []
+        }
+      }
+    },
+    {
+      "client_info": {
+        "mobilesdk_app_id": "1:1094643115061:android:354e70007466b006887d7c",
+        "android_client_info": {
+          "package_name": "ch.endorser.mobile"
+        }
+      },
+      "oauth_client": [],
+      "api_key": [
+        {
+          "current_key": "AIzaSyCFLYeLfGQqh7ErvzXgy74H0Gx3yQAMEw8"
+        }
+      ],
+      "services": {
+        "appinvite_service": {
+          "other_platform_oauth_client": []
+        }
+      }
+    },
+    {
+      "client_info": {
+        "mobilesdk_app_id": "1:1094643115061:android:40b63cb5851f34ac887d7c",
+        "android_client_info": {
+          "package_name": "com.veramo_react_native"
+        }
+      },
+      "oauth_client": [],
+      "api_key": [
+        {
+          "current_key": "AIzaSyCFLYeLfGQqh7ErvzXgy74H0Gx3yQAMEw8"
         }
       ],
       "services": {
@@ -24,5 +62,6 @@
         }
       }
     }
-  ]
-} 
+  ],
+  "configuration_version": "1"
+}

android/app/src/main/assets/capacitor.config.json

@@ -16,6 +16,13 @@
 				]
 			}
 		},
+		"PushNotifications": {
+			"presentationOptions": [
+				"badge",
+				"sound",
+				"alert"
+			]
+		},
 		"SplashScreen": {
 			"launchShowDuration": 3000,
 			"launchAutoHide": true,

android/app/src/main/assets/capacitor.plugins.json

@@ -23,6 +23,14 @@
 		"pkg": "@capacitor/filesystem",
 		"classpath": "com.capacitorjs.plugins.filesystem.FilesystemPlugin"
 	},
+	{
+		"pkg": "@capacitor/preferences",
+		"classpath": "com.capacitorjs.plugins.preferences.PreferencesPlugin"
+	},
+	{
+		"pkg": "@capacitor/push-notifications",
+		"classpath": "com.capacitorjs.plugins.pushnotifications.PushNotificationsPlugin"
+	},
 	{
 		"pkg": "@capacitor/share",
 		"classpath": "com.capacitorjs.plugins.share.SharePlugin"

android/app/src/main/java/app/timesafari/MainActivity.java

@@ -16,6 +16,7 @@ import android.webkit.WebViewClient;
 import com.getcapacitor.BridgeActivity;
 import app.timesafari.safearea.SafeAreaPlugin;
 import app.timesafari.sharedimage.SharedImagePlugin;
+import app.timesafari.notifications.NotificationInspectorPlugin;
 //import com.getcapacitor.community.sqlite.SQLite;
 
 import android.content.SharedPreferences;
@@ -66,6 +67,9 @@ public class MainActivity extends BridgeActivity {
         
         // Register SharedImage plugin
         registerPlugin(SharedImagePlugin.class);
+
+        // Register NotificationInspector plugin (dev tooling; safe no-op on Android)
+        registerPlugin(NotificationInspectorPlugin.class);
         
         // Register DailyNotification plugin
         // Plugin is written in Kotlin but compiles to Java-compatible bytecode

android/app/src/main/java/app/timesafari/TimeSafariNativeFetcher.java

@@ -98,7 +98,17 @@ public class TimeSafariNativeFetcher implements NativeNotificationContentFetcher
                                 : ""));
     }
 
-    /** One pool entry per UTC day (epoch day mod pool size); else primary jwtToken. */
+    /**
+     * Picks the pool entry whose validity window covers today, falling back to the
+     * primary jwtToken when no pool is configured.
+     *
+     * <p>Each pooled JWT carries nbf/exp spanning exactly one UTC day, and the minter
+     * (mintBackgroundJwtTokenPool) files the token for a given day at index
+     * {@code epochDay % size}. That is why the index below is the raw epoch day rather
+     * than a count from when the pool arrived: this side keeps no mint date, and the
+     * same arithmetic on both ends is what lines the slot up with the day it covers.
+     * A token read from the wrong slot is outside its window and Endorser rejects it.
+     */
     private String selectBearerTokenForRequest() {
         List<String> pool = jwtTokenPool;
         if (pool == null || pool.isEmpty()) {

android/app/src/main/java/app/timesafari/notifications/NotificationInspectorPlugin.java

@@ -0,0 +1,16 @@
+package app.timesafari.notifications;
+
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+
+@CapacitorPlugin(name = "NotificationInspector")
+public class NotificationInspectorPlugin extends Plugin {
+  @PluginMethod
+  public void getPendingNotifications(PluginCall call) {
+    call.unimplemented(
+        "Pending notification inspection is currently implemented on iOS only");
+  }
+}
+

android/capacitor.settings.gradle

@@ -20,6 +20,12 @@ project(':capacitor-clipboard').projectDir = new File('../node_modules/@capacito
 include ':capacitor-filesystem'
 project(':capacitor-filesystem').projectDir = new File('../node_modules/@capacitor/filesystem/android')
 
+include ':capacitor-preferences'
+project(':capacitor-preferences').projectDir = new File('../node_modules/@capacitor/preferences/android')
+
+include ':capacitor-push-notifications'
+project(':capacitor-push-notifications').projectDir = new File('../node_modules/@capacitor/push-notifications/android')
+
 include ':capacitor-share'
 project(':capacitor-share').projectDir = new File('../node_modules/@capacitor/share/android')
 

capacitor.config.ts

@@ -18,6 +18,9 @@ const config: CapacitorConfig = {
         ]
       }
     },
+    PushNotifications: {
+      presentationOptions: ['badge', 'sound', 'alert']
+    },
     SplashScreen: {
       launchShowDuration: 3000,
       launchAutoHide: true,

doc/DAILY_NOTIFICATION_BUG_DIAGNOSIS.md

@@ -61,16 +61,14 @@ The app depends on:
 "@timesafari/daily-notification-plugin": "git+https://gitea.anomalistdesign.com/trent_larson/daily-notification-plugin.git#master"
 ```
 
-If the fixes were only made in a **different** clone (e.g. `daily-notification-plugin_test`) and never pushed to that gitea `master`, then:
+If the fixes were only made in a **local clone** and never pushed to **gitea** `master`, then:
 
 - `npm install` / `npm update` in the app would not pull the fixes.
 - The app’s `node_modules` would only have the fixes if they were copied/linked from the fixed repo.
 
 **Do this:**
 
-- If the fixes live in another clone: either **push** the fixed plugin to gitea `master` and run `npm update @timesafari/daily-notification-plugin` (then `npx cap sync android`, then clean build), **or** point the app at the fixed plugin locally, e.g. in **app** `package.json`:
-  - `"@timesafari/daily-notification-plugin": "file:../daily-notification-plugin"`  
-  (adjust path to your fixed plugin repo), then `npm install`, `npx cap sync android`, clean build and reinstall.
+- **Push** the fixed plugin to the official gitea repo (`trent_larson/daily-notification-plugin`), then in this app run `npm update @timesafari/daily-notification-plugin` (or set `package.json` to the branch/tag/commit you need), `npm install`, `npx cap sync android`, clean build and reinstall. The app should always depend on the published git remote, not a local `file:` path.
 
 ### 3. Fallback text from native fetcher (Bug 2 only)
 

doc/android-physical-device-guide.md

@@ -128,18 +128,29 @@ Your Android device and computer **must be on the same Wi-Fi network** for the d
 
 ### Step 3: Configure API Endpoints
 
-Create or edit `.env.development` with your computer's IP:
+Pass your computer's IP to the build with `--api-ip`. The build script points
+the claim and partner APIs at that address:
 
 ```bash
-# .env.development - for physical device testing
-VITE_DEFAULT_ENDORSER_API_SERVER=http://192.168.1.100:3000
-VITE_DEFAULT_PARTNER_API_SERVER=http://192.168.1.100:3000
-VITE_DEFAULT_IMAGE_API_SERVER=https://test-image-api.timesafari.app
-VITE_APP_SERVER=http://192.168.1.100:8080
+npm run build:android:dev -- --api-ip 192.168.1.100
 ```
 
 **Important**: Replace `192.168.1.100` with your actual IP address.
 
+Without `--api-ip`, a development build uses `10.0.2.2:3000`, which reaches the
+host machine from an emulator but not from a physical device.
+
+The build script applies `--api-ip` after loading `.env.development`, so the
+flag wins for the claim and partner APIs. Other addresses come from that file,
+which development web builds share:
+
+```bash
+# .env.development
+VITE_DEFAULT_IMAGE_API_SERVER=https://test-image-api.timesafari.app
+VITE_DEFAULT_NOTIFY_API_SERVER=https://test-notify-api.timesafari.app
+VITE_APP_SERVER=http://192.168.1.100:8080
+```
+
 ### Step 4: Start Your Local Server
 
 If testing against local API servers, ensure they're accessible from the network:

doc/background-jwt-pool.md

@@ -0,0 +1,155 @@
+# Background New Activity JWT pool
+
+How the app credentials native background prefetch for New Activity.
+
+## 1. What the pool is for
+
+Background prefetch runs in WorkManager on Android and a background task on iOS,
+with no JavaScript executing. It calls Endorser directly and needs a Bearer JWT
+that was minted while the app was awake, possibly days earlier.
+
+The app mints a pool of `BACKGROUND_JWT_POOL_SIZE` JWTs and hands them to the
+plugin through `configureNativeFetcher`. Each covers one UTC day, and the native
+fetcher picks the one matching the day it runs.
+
+Source: `src/libs/crypto/backgroundJwtPool.ts`,
+`src/services/notifications/nativeFetcherConfig.ts`,
+`src/constants/backgroundJwt.ts`.
+
+## 2. Token shape
+
+Each token in the pool carries:
+
+| Claim | Value |
+|-------|-------|
+| `iss` | the minting DID |
+| `iat` | mint time |
+| `nbf` | its day's opening midnight, minus `BACKGROUND_JWT_WINDOW_SLACK_SECONDS` |
+| `exp` | its day's closing midnight, plus `BACKGROUND_JWT_WINDOW_SLACK_SECONDS` |
+
+The slack widens the window at both ends for clock skew between the device and
+Endorser. Widening is safe; narrowing can leave a prefetch inside the day with
+no usable token.
+
+Two properties follow from the day windows, and both are load-bearing:
+
+- **Each token grants one day.** A token read from a log line or a captured
+  header buys one day of Endorser access rather than the whole grant.
+- **The tokens are distinct.** ES256K signing is deterministic, so JWTs built
+  from identical payloads are byte-identical. Differing windows are what keep
+  the pool from collapsing into one string repeated `POOL_SIZE` times, which
+  would defeat any duplicate-token rule the server applies.
+
+## 3. Slot ordering
+
+Both native fetchers select with `pool[epochDay % pool.size()]` and hold no
+record of when the pool was minted. The minter therefore files the token
+covering a given UTC day at index `epochDay % BACKGROUND_JWT_POOL_SIZE`.
+
+Any `POOL_SIZE` consecutive days hit every index exactly once, so the array is
+dense whatever day minting starts on.
+
+This is a contract across three languages. Changing the index arithmetic on one
+side without the others produces tokens presented outside their windows, which
+Endorser rejects with no local error. `src/test/backgroundJwtPool.test.ts`
+asserts the invariant by replaying the native selector against the minted pool.
+
+Implementations: `TimeSafariNativeFetcher.selectBearerTokenForRequest` in
+`android/app/src/main/java/app/timesafari/` and `ios/App/App/`.
+
+## 4. Identities that can mint
+
+Seed-phrase (`did:ethr`) identities only.
+
+Passkey (`did:peer`) identities raise
+`BackgroundJwtUnsupportedIdentityError`. Each of their signatures is a WebAuthn
+assertion, so minting a pool would raise one biometric prompt per token, and
+`createJwtNavigator` overrides the day window with a one-minute `exp` — the
+tokens would expire long before the prefetch they were minted for.
+`configureNativeFetcherIfReady` catches the error and leaves prefetch
+unconfigured.
+
+The delegated alertSearch batch rejects the same identities, with the
+notify-api answering `DELEGATED_JWT_UNSUPPORTED_IDENTITY`.
+
+## 5. Lifecycle
+
+| Event | Action |
+|-------|--------|
+| App foreground, startup, notification-time change | `configureNativeFetcherIfReady` mints a pool and configures the fetcher |
+| Active identity changes (`$setActiveDid`) | `clearNativeFetcherPool` drops the pool the fetcher holds |
+
+The identity is decrypted once per mint and reused for every signature.
+Decrypting per token costs seconds on a phone, and minting runs on every
+foreground.
+
+## 6. What the pool bounds
+
+The grant is `BACKGROUND_JWT_POOL_SIZE` days wide and each token inside it is
+one day wide.
+
+`clearNativeFetcherPool` is custody, not revocation. Endorser exposes no
+revocation mechanism, so a token that left the device before the clear stays
+valid until its window closes. What the clear bounds is the ordinary case — an
+account switch, a sign-out, a shared or lost handset — where no copy was taken
+and the device's own store is the only remaining exposure.
+
+Anti-replay in the strict sense is unavailable on this path. It would require
+either a server-side one-time-use store, which Endorser does not offer, or
+per-request signing, which would put the private key in native code. Day-scoped
+windows narrow the exposure instead of eliminating it.
+
+## 7. Constants
+
+All in `src/constants/backgroundJwt.ts`.
+
+| Constant | Meaning |
+|----------|---------|
+| `BACKGROUND_JWT_POOL_SIZE` | Consecutive UTC days the pool covers, one token each. The whole forward grant a user authorizes per mint. |
+| `BACKGROUND_JWT_WINDOW_SLACK_SECONDS` | Padding on each end of a day window, for clock skew. |
+| `BACKGROUND_JWT_SECONDS_PER_DAY` | The day frame each slot is cut from. |
+| `BACKGROUND_JWT_EXPIRY_DAYS` / `_SECONDS` | Lifetime for the single-token background path. |
+
+Past the last covered day the pool carries no credential and prefetch stops
+until the app opens again.
+
+## 8. A different credential
+
+The notify-api's delegated alertSearch batch
+(`src/services/notifications/alertAuthorizationBatch.ts`) is a separate
+credential with a separate inventory. It authorizes the notification service to
+run a user's daily alertSearch server-side; this pool authorizes the user's own
+device to prefetch. They share the day-window shape and nothing else. See
+`notification-wakeup-service/README.md`.
+
+## 9. Rejected
+
+- **A unique `jti` per slot, with one shared long `exp`.** A `jti` is an
+  identifier, not a replay defense: it does nothing unless the server keeps a
+  seen-set, and Endorser's behavior here was never confirmed. Day windows make
+  the tokens distinct for the same cost while also bounding each one.
+- **One long-lived token instead of a pool.** Fails if Endorser rejects
+  duplicate JWT strings across days. That policy question is open (§10), so the
+  design does not depend on the answer.
+- **Sizing the pool as `expiryDays + buffer`.** The rationale was headroom for
+  duplicate-token rules. With one token per day, the pool size is the grant
+  length in days and needs no separate buffer term.
+- **Per-request signing in native code (DPoP-style).** The only true anti-replay
+  option, rejected to keep one signing implementation in TypeScript rather than
+  forking crypto into Java and Swift.
+- **Routing all New Activity through the notification service and deleting this
+  path.** Rejected: it would force every user onto server-side delegation, and
+  the service is single-replica, so the direct device-to-Endorser path has no
+  equivalent.
+
+## 10. Open questions
+
+- **Endorser duplicate-JWT policy.** Whether Endorser rejects a Bearer JWT
+  string it has already seen is unconfirmed. The pool is correct either way; the
+  answer would determine whether a pool is required at all.
+- **Maximum `exp` Endorser accepts.** Day-scoped windows are well inside any
+  plausible limit, so this gates only the single-token path.
+- **Plugin behavior on an empty pool.** `clearNativeFetcherPool` passes empty
+  credentials to `configureNativeFetcher`. A plugin build that rejects them
+  leaves the previous pool in place; the failure is logged rather than reported
+  as a successful clear.

doc/consuming-app-handoff-ios-native-fetcher-chained-dual.md

@@ -0,0 +1,80 @@
+# Consuming app handoff: iOS native fetcher + chained dual (mirror)
+
+**Canonical source:** `daily-notification-plugin` repo, `doc/CONSUMING_APP_HANDOFF_IOS_NATIVE_FETCHER_AND_CHAINED_DUAL.md` (same content as below for offline use).
+
+---
+
+## Implemented in this app
+
+- **`ios/App/App/TimeSafariNativeFetcher.swift`** — Swift `NativeNotificationContentFetcher` mirroring `TimeSafariNativeFetcher.java` (`POST …/plansLastUpdatedBetween`, starred IDs from `daily_notification_timesafari.starredPlanIds`, JWT pool selection, pagination key `daily_notification_timesafari.last_acked_jwt_id`, aggregated copy).
+- **`AppDelegate.swift`** — `DailyNotificationPlugin.registerNativeFetcher(TimeSafariNativeFetcher.shared)` at launch **before** any JS `configureNativeFetcher`; foreground handler reads `scheduled_time` as `Int64`, `NSNumber`, or `Int` for `DailyNotificationDelivered`.
+
+## Dependency
+
+- **`@timesafari/daily-notification-plugin`** must be **≥ 3.0.0** (register native fetcher, chained dual, iOS `updateStarredPlans`). Declare it in `package.json` from the official remote (`git+https://gitea.anomalistdesign.com/trent_larson/daily-notification-plugin.git`, branch or tag as needed), then `npm install` so `package-lock.json` resolves the published tree.
+
+## Bump / sync (after plugin version is resolved)
+
+1. `npm install`
+2. `npx cap sync ios && npx cap sync android`
+3. `cd ios/App && pod install`
+4. Clean build in Xcode / Android Studio
+
+## QA focus
+
+- iOS: Fetcher registered before `configureNativeFetcher`; `updateStarredPlans` not `UNIMPLEMENTED`.
+- Both: New Activity fires **after** prefetch for that cycle where the plugin implements chaining.
+- Android: Existing `MainActivity.setNativeFetcher` unchanged; regression-test `cancelDualSchedule` vs Daily Reminder.
+
+---
+
+## Original handoff text (from plugin)
+
+This document is for the **host app** repository (e.g. crowd-funder-for-time-pwa) after bumping `@timesafari/daily-notification-plugin` to a version that includes:
+
+- **iOS** `NativeNotificationContentFetcher`–style registration (`DailyNotificationPlugin.registerNativeFetcher`)
+- **iOS** `updateStarredPlans` / `getStarredPlans` (parity with Android `daily_notification_timesafari` / `starredPlanIds` semantics)
+- **iOS** chained dual flow: user notification is **armed only after** prefetch completes (delay if fetch is late; max slip 15 minutes before fallback copy)
+- **Android** chained dual flow: exact **notify** alarm is scheduled **after** dual prefetch completes (no longer scheduled at initial `scheduleDualNotification` before fetch)
+
+Material from `doc/new-activity-notifications-ios-android-parity.md` still applies; the plugin doc adds **app-side** steps not spelled out there.
+
+### 1. iOS — register native fetcher before `configureNativeFetcher`
+
+The plugin **rejects** `configureNativeFetcher` if no fetcher is registered (aligned with Android).
+
+**In `AppDelegate` (or earliest app startup before Capacitor calls into the plugin):**
+
+```swift
+import TimesafariDailyNotificationPlugin
+
+DailyNotificationPlugin.registerNativeFetcher(TimeSafariNativeFetcher.shared)
+```
+
+Implement **`TimeSafariNativeFetcher`** as a Swift type that:
+
+- Conforms to `NativeNotificationContentFetcher`
+- Implements `fetchContent(context: FetchContext) async throws -> [NotificationContent]` with the same **Endorser** behavior as `TimeSafariNativeFetcher.java`
+- Implements `configure(apiBaseUrl:activeDid:jwtToken:jwtTokenPool:)` if the fetcher needs credentials pushed from TypeScript
+
+**Starred plan IDs for the fetcher:** Read JSON array string from UserDefaults key **`daily_notification_timesafari.starredPlanIds`** (written by `updateStarredPlans` from JS).
+
+### 2. iOS — `UNUserNotificationCenterDelegate` / rollover
+
+Chained dual notifications set:
+
+- `notification_id` = `org.timesafari.dailynotification.dual`
+- `scheduled_time` = `NSNumber` (fire time in ms)
+
+Ensure **`DailyNotificationDelivered`** forwards **`notification_id`** and **`scheduled_time`** from **notification content `userInfo`**.
+
+### 3. Android — no API change for `setNativeFetcher`
+
+Host apps that already call `DailyNotificationPlugin.setNativeFetcher(TimeSafariNativeFetcher(...))` keep that flow.
+
+**Behavior change:** the dual **notify** alarm is scheduled when **dual prefetch work finishes**, not at the initial `scheduleDualNotification` only.
+
+### 4. Assumptions
+
+- Swift host implements `TimeSafariNativeFetcher`; the plugin does **not** embed `plansLastUpdatedBetween` on iOS when a host fetcher is registered (mirrors Android).
+- Module import: `TimesafariDailyNotificationPlugin` (Pod `TimesafariDailyNotificationPlugin`).

doc/daily-notification-alignment-outline.md

@@ -6,8 +6,7 @@
 2. **Notifications show when the app is in the foreground** (not only background/closed).
 3. **Plugin loads at app launch** so recovery runs after reboot without the user opening notification UI.
 
-**Reference:** Test app at  
-`/Users/aardimus/Sites/trentlarson/daily-notification-plugin_test/daily-notification-plugin/test-apps/daily-notification-test`
+**Reference:** In the **daily-notification-plugin** repository, the test app lives at `test-apps/daily-notification-test` (same repo as `https://gitea.anomalistdesign.com/trent_larson/daily-notification-plugin`).
 
 ---
 

doc/local-android-testing-analysis.md

@@ -0,0 +1,401 @@
+# Android Local Notification Testing — Planning Analysis
+
+**Created:** 2026-06-02  
+**Source document:** [local-ios-testing-ngrok.md](./local-ios-testing-ngrok.md)  
+**Purpose:** Plan a future **Android** counterpart guide by mapping what can be reused from the iOS ngrok workflow and what must be written for Android-specific push, permissions, and OS behavior.
+
+**Status:** Planning only — does not replace or modify the iOS guide.
+
+---
+
+## Executive summary
+
+The iOS guide’s **backend + ngrok + in-app debug panel** path is platform-agnostic. Most of sections **1–3**, **6**, **9** (with log tooling swapped), **10** (with `platform: "android"`), **12**, and parts of **11** can be copied or lightly edited.
+
+Everything involving **APNs, Xcode, Apple Developer, iOS capabilities, and iOS background/silent-push caveats** must be replaced. Android adds **direct FCM delivery** (no APNs hop), **`google-services.json`**, **runtime notification permissions (API 33+)**, **Doze / battery optimization / OEM restrictions**, and different **force-stop / background** semantics.
+
+Existing related docs to cross-link (not duplicate):
+
+- [android-physical-device-guide.md](./android-physical-device-guide.md) — USB, `adb`, build/run commands
+- [notification-system-overview.md](./notification-system-overview.md)
+- [notification-from-api-call.md](./notification-from-api-call.md)
+- [notification-permissions-and-rollovers.md](./notification-permissions-and-rollovers.md)
+
+---
+
+## iOS guide structure (reference map)
+
+| § | iOS doc heading | Reuse for Android |
+|---|-----------------|-------------------|
+| Intro | Architecture overview | **Adapt** — swap APNs leg for FCM→device |
+| — | Prerequisites | **Partial** — drop Xcode/APNs; add Android SDK/device |
+| 1 | Install and configure ngrok | **Reuse unchanged** |
+| 2 | Start the backend locally | **Reuse unchanged** |
+| 3 | Obtain and use ngrok HTTPS URL | **Reuse** — wording: “device” not “iPhone” |
+| 4 | Generate and open iOS workspace | **Rewrite** — Android Studio / Capacitor sync |
+| 5 | Firebase + APNs setup | **Rewrite** — Firebase Android only; no APNs |
+| 6 | Notification Debug Panel override | **Reuse unchanged** |
+| 7 | Firebase and Xcode checklist | **Rewrite** — Android manifest / Gradle checklist |
+| 8 | iOS-specific testing notes | **Rewrite** — Android delivery caveats |
+| 9 | Recommended debug workflow | **Reuse** — replace Xcode console with logcat |
+| 10 | Sample curl commands | **Reuse** — change `platform` to `android` |
+| 11 | Troubleshooting | **Partial** — keep ngrok/API rows; replace push rows |
+| 12 | Key source files | **Reuse unchanged** |
+| 13 | Related docs | **Extend** — link Android build/device guides |
+
+---
+
+## Sections reusable unchanged (or near-unchanged)
+
+These blocks can be carried into `doc/local-android-testing-ngrok.md` (proposed name) with at most global find-replace (“iPhone” → “Android device”, “Mac” tunnel audience unchanged).
+
+### notification-wakeup-service startup (iOS §1 Terminal A, §2)
+
+- Clone **notification-wakeup-service**, `npm install`, `.env` from `.env.example`
+- `export PORT=3000` (or port from that repo’s README)
+- `npm run dev`
+- Local verify: `curl -sS http://localhost:3000/health`
+- Firebase **Admin** service account for the backend (`GOOGLE_APPLICATION_CREDENTIALS`) — same project can serve iOS and Android apps
+
+### ngrok setup (iOS §1)
+
+- `brew install ngrok/ngrok/ngrok` (or download)
+- `ngrok http 3000` in a second terminal
+- Use **HTTPS** forwarding URL; free tier URL rotation note
+- ngrok inspect UI at `http://127.0.0.1:4040`
+
+### ngrok account creation (iOS §1 “Account and auth token”)
+
+- Sign up at dashboard.ngrok.com
+- `ngrok config add-authtoken YOUR_AUTHTOKEN_HERE`
+
+### Obtaining HTTPS URL (iOS §3)
+
+- Copy `https://….ngrok-free.app` from Forwarding line
+- No trailing slash in debug panel
+- Mac-side tunnel test: `export NGROK_URL=…` and `curl "$NGROK_URL/health"`
+
+### Backend override configuration (iOS §6)
+
+- Non-production build required for Notification Debug Panel
+- Account → **Show All General Advanced Functions** → `/dev/notifications`
+- **Notification Backend URL**, **Save Backend URL**
+- `localStorage`: `notificationDebug.backendBaseUrl`, `notificationDebug.testMode`, `notificationDebug.bypassAuth`
+- Optional programmatic override via `@/services/notifications` (`setBackendBaseUrl`, `setTestMode`, `setBypassAuth`, `getNotificationApiBaseUrl`)
+
+### Debug panel usage (iOS §6 table, §8 “Two Simulate WAKEUP_PING buttons”)
+
+| Control | Android relevance |
+|---------|-------------------|
+| Notification Backend URL | Same |
+| Test Mode | Same (`testMode` in JSON body) |
+| Skip JWT Authentication | Same — explicit opt-in for unauthenticated local backends (default off) |
+| Register Token Now | Same (`POST /notifications/register`) |
+| Refresh Notifications | Same |
+| Simulate WAKEUP_PING (backend) | Same — isolates ngrok + refresh without FCM |
+| Wakeup Ping Simulator | Same — exercises `handleCapacitorPushNotificationReceived` path |
+| Event Log `[Notifications]` | Same |
+| Pending Notification Inspector | Same concept; confirm Android plugin inspector behavior in **daily-notification-plugin** |
+
+### testMode usage (iOS §6, §10)
+
+- Default-on when unset in storage (`NotificationDebugConfig.ts`)
+- Sent on register and refresh payloads
+- Backend/debug endpoints accept `testMode: true` for dev traffic
+
+### Refresh endpoint testing (iOS §9 steps 5, §11 “Refresh endpoint unreachable”)
+
+- Panel **Refresh Notifications** → expect Event Log + ngrok `POST /notifications/refresh`
+- **Simulate WAKEUP_PING** (backend button) for API-only path
+- Troubleshooting table for network error, 404, wrong port, stale URL
+
+### curl examples (iOS §10)
+
+Reuse structure; **only payload deltas** for Android doc:
+
+```bash
+export BASE="https://abc123.ngrok-free.app"
+```
+
+- `$BASE/health` — unchanged
+- `$BASE/notifications/register` — set `"platform": "android"`
+- `$BASE/notifications/refresh` — set `"platform": "android"`
+- `$BASE/debug/send-wakeup` — unchanged shape; confirm deviceId/token contract in **notification-wakeup-service** README
+
+App still uses `Capacitor.getPlatform()` for `platform` in `NotificationService.ts` (`ios` | `android`).
+
+### Shared architecture concepts (intro + silent wake sequence)
+
+Reusable narrative (edit diagram only):
+
+1. FCM **data** message with `data.type = "WAKEUP_PING"`
+2. Capacitor `pushNotificationReceived` → `handleCapacitorPushNotificationReceived()`
+3. `POST {backend}/notifications/refresh` with `testMode`
+4. `nextNotifications` → `applyNotificationRefreshPayload()` → **daily-notification-plugin** clear + schedule
+
+Repos table (notification-wakeup-service, crowd-funder-for-time-pwa, daily-notification-plugin) — unchanged.
+
+### Key source files (iOS §12)
+
+Same files apply on Android Capacitor builds:
+
+- `NotificationDebugConfig.ts`, `NotificationDebugEvents.ts`, `notificationLog.ts`
+- `NotificationService.ts`, `NativeNotificationService.ts`
+- `firebaseMessagingClient.ts`, `NotificationDebugPanel.vue`, `main.capacitor.ts`
+
+### Recommended debug workflow (iOS §9) — reuse with tooling swap
+
+Steps 1–5, 8–9 unchanged. Replace step 7:
+
+- **iOS:** Xcode console → `[Notifications] pushNotificationReceived type=WAKEUP_PING`
+- **Android:** `adb logcat` filtered on app tag / `[Notifications]` (document exact filter in Android guide)
+
+---
+
+## iOS-specific sections — must rewrite for Android
+
+### Architecture diagram (intro)
+
+**iOS today:** Mac → ngrok → app; FCM → **APNs** → iPhone.
+
+**Android doc:** FCM → **device directly** (no APNs). Update ASCII diagram and caption (“silent push” on Android is still FCM data; delivery rules differ).
+
+### Prerequisites (intro list)
+
+| iOS prerequisite | Android replacement |
+|------------------|---------------------|
+| Mac with **Xcode** | **Android Studio**, JDK 17+, `ANDROID_HOME`, `adb` — see [android-physical-device-guide.md](./android-physical-device-guide.md) |
+| Physical **iPhone** | Physical **Android** device (emulator possible for some steps but **not** representative for Doze/OEM/battery) |
+| Firebase with **APNs** for bundle ID | Firebase with **Android app** (`app.timesafari` package name) |
+| Non-production build | Same — e.g. `build:android:dev` / `build:android:test` |
+
+Remove: “simulator is not sufficient for reliable silent push / **APNs**”.
+
+Add: emulator vs physical device guidance for FCM and background limits.
+
+### §4 — Generate and open the iOS workspace
+
+**Replace entirely** with Android equivalent:
+
+- `npm install`
+- `npm run build:android:dev` or `build:android:test` (non-production for debug panel)
+- `npx cap sync android` if needed
+- Open `android/` in Android Studio
+- Run on physical device (USB debugging)
+- `VITE_FIREBASE_*` in Capacitor web build
+- `initializeNativePushAndFirebaseMessaging()` in `main.capacitor.ts` — same entry point
+
+Do **not** reference `.xcworkspace`, signing in Xcode, or `build:ios:*` except as cross-link to iOS doc.
+
+### §5 — Firebase + APNs setup (first-time setup)
+
+**Keep (Android-relevant portions only):**
+
+- Firebase account / Spark plan sufficient for FCM
+- Create Firebase project
+- **Register Android app** in Firebase (package name `app.timesafari` from `capacitor.config.ts`)
+- Download **`google-services.json`** → `android/app/` (project may gitignore this file — document secure handling)
+- Firebase Admin service account for **notification-wakeup-service** — same as iOS §5 tail
+
+**Remove entirely:**
+
+- Register **iOS** app in Firebase (or move to “shared project” sidebar: one Firebase project, two apps)
+- **GoogleService-Info.plist** / Xcode drag-and-drop
+- **Create APNs Authentication Key** (.p8)
+- **Upload APNs key to Firebase**
+- **Enable iOS capabilities** (Push Notifications, Background Modes → Remote notifications)
+
+**Add in Android guide (see next major section):**
+
+- Gradle plugin / `google-services` classpath if not already in repo
+- `POST_NOTIFICATIONS` permission (API 33+)
+- Default notification channel / Capacitor Push Notifications Android setup
+- SHA-1/SHA-256 only if using Firebase features that require it (note whether wakeup testing needs Play App Signing keys)
+
+### §5 verify checklist — iOS-only bullets
+
+Replace:
+
+- “Xcode without Firebase/plist errors” → Android Studio build; `google-services.json` present
+- “iOS push permission prompt” → Android 13+ notification permission + older grant model
+- “content-available style payload” → Android **high-priority data message** / FCM options as implemented by **notification-wakeup-service** (document actual payload; no APNs `content-available`)
+
+### §7 — Firebase and Xcode checklist (iOS)
+
+**Replace** with Android checklist, e.g.:
+
+| Item | Action |
+|------|--------|
+| **Application ID** | `app.timesafari` in `capacitor.config.ts`, `android/app/build.gradle`, Firebase Android app |
+| **google-services.json** | In `android/app/`; not committed if gitignored — local copy per developer |
+| **Gradle** | Google services plugin applied (verify repo’s current `build.gradle`) |
+| **Permissions** | `POST_NOTIFICATIONS` (API 33+); manifest entries for FCM |
+| **FCM token** | Debug panel **Register Token Now** + ngrok `POST /notifications/register` |
+| **No APNs** | N/A on Android |
+
+### §8 — iOS-specific testing notes
+
+**Replace** with Android-specific sections (draft topics below). Do not port:
+
+- APNs silent delivery / Simulator unreliability (iOS framing)
+- **Force-quit** via app switcher (iOS-specific policy)
+- **Low Power Mode** (iOS) — Android has different battery saver APIs
+- **Focus / Do Not Disturb** (iOS naming)
+
+Port with Android wording:
+
+- Two **Simulate WAKEUP_PING** buttons table — unchanged behavior
+
+### §11 — Troubleshooting (partial)
+
+**Reuse as-is:**
+
+- Refresh endpoint unreachable (ngrok, URL, 404, CORS note)
+- Stale ngrok URL
+- Plugin / JWT errors after refresh
+
+**Rewrite:**
+
+| iOS troubleshooting | Android replacement |
+|----------------------|---------------------|
+| Push permission + `VITE_FIREBASE_*` + **Xcode** log | Permission (runtime POST_NOTIFICATIONS), logcat, Firebase Android config |
+| Silent push not waking — **backgrounded not force-quit**, **APNs key**, wait 30–120s | FCM high-priority data, **force-stop** (`STOP` from settings), **Doze**, battery optimization, OEM autostart, token mismatch |
+| Physical device + provisioning profile | USB debugging, correct build variant, Play vs debug signing if relevant |
+
+### §13 — Related docs
+
+Keep iOS-centric links as “see also”; add:
+
+- [android-physical-device-guide.md](./android-physical-device-guide.md)
+- `BUILDING.md` — Android build commands (`build:android:*`)
+- **daily-notification-plugin** Android docs (exact alarm, pending inspector on Android)
+
+---
+
+## Android-Specific Topics Required
+
+These sections do not exist in the iOS guide (or exist only by analogy) and must be written for the Android notification testing doc.
+
+### Firebase project setup
+
+- Use the **same** Firebase project as iOS when testing the same backend, or document a dedicated `timesafari-dev` project.
+- Add an **Android** app with package name **`app.timesafari`**.
+- Enable **Cloud Messaging** (default on new projects).
+- Download **`google-services.json`** and install under `android/app/`.
+- Note: `android/.gitignore` may exclude `google-services.json` — developers copy locally; never commit secrets.
+
+### google-services.json
+
+- Placement: `android/app/google-services.json`
+- Sync after add: `npx cap sync android`, rebuild in Android Studio
+- Verify build merges Firebase config (no “missing google-services” Gradle errors)
+- Relationship to `VITE_FIREBASE_*` for the web layer / Capacitor JS Firebase initialization
+
+### Android notification permissions
+
+- **Android 13+ (API 33):** `POST_NOTIFICATIONS` runtime permission — required for notification **display**; document interaction with **data-only** FCM wake (may still deliver to app code when permission denied — verify against current app behavior and document accurately).
+- **Android 12 and below:** install-time grant model; fewer runtime prompts.
+- App Settings → Notifications — manual enable path for testers.
+- Link [notification-permissions-and-rollovers.md](./notification-permissions-and-rollovers.md) for product-level permission UX.
+
+### FCM token handling
+
+- Token obtained via Capacitor Push Notifications + `firebaseMessagingClient.ts` (same JS path as iOS).
+- **Register Token Now** in debug panel → `POST /notifications/register` with `platform: "android"`.
+- Token rotation: when to re-register; duplicate skip behavior in panel.
+- Ensure **notification-wakeup-service** stores/sends to the token shown in the panel for `/debug/send-wakeup`.
+- Optional: `adb` cannot easily read FCM token — panel is source of truth (same as iOS).
+
+### Android background delivery behavior
+
+- FCM **data** messages handled in foreground/background per Capacitor plugin and `NativeNotificationService.ts`.
+- No APNs intermediary — document expected latency vs iOS.
+- **High-priority** FCM for wakeup testing (align with backend message options).
+- App in **background** vs **foreground** vs **killed** — different from iOS “swipe away” story:
+  - **Force stop** (Settings → Force stop): delivery often blocked until user launches app again (stricter than iOS “backgrounded”).
+  - **Recent apps swipe**: behavior varies by OEM/Android version — document “test with Home button background, not force stop.”
+- `pushNotificationReceived` / listener registration at startup (`main.capacitor.ts`).
+
+### Doze Mode
+
+- Device idle → deferred network and job execution.
+- Testing: use `adb shell dumpsys deviceidle` (document safe dev-only commands) or unplugged idle wait.
+- Explain why `/debug/send-wakeup` may succeed on server but device wakes late.
+- Whitelisting app for tests (developer settings) — use cautiously; note production users won’t do this.
+
+### Battery optimization
+
+- Settings → Apps → TimeSafari → Battery → **Unrestricted** vs **Optimized**.
+- Manufacturer “battery saver” modes that restrict background network.
+- Recommend **Unrestricted** (or equivalent) for local wakeup validation; warn that production users may remain optimized.
+
+### OEM restrictions (Samsung, Xiaomi, Oppo, etc.)
+
+- **Autostart** / **Background activity** / **Battery** menus on Samsung, Xiaomi (MIUI), Oppo/ColorOS, Huawei, OnePlus, etc.
+- Symptom: FCM works on Pixel but not on OEM device until autostart enabled.
+- Provide a short “if wake fails on OEM, check…” checklist without exhaustive per-OEM screenshots (link community docs if needed).
+- Physical device testing should include at least one **stock-ish** device (Pixel) and one **OEM** device when possible.
+
+---
+
+## Proposed outline for `doc/local-android-testing-ngrok.md`
+
+Suggested section order mirroring iOS doc for easy maintenance:
+
+1. Title, audience, goal (Android physical device + ngrok + wakeup service)
+2. Architecture overview (FCM direct to Android)
+3. Prerequisites (Android Studio, device, Firebase Android app, non-prod build)
+4. ngrok install, account, tunnel (**reuse iOS §1**)
+5. Start notification-wakeup-service (**reuse iOS §2**)
+6. ngrok HTTPS URL (**reuse iOS §3**)
+7. Build and open Android project (**new**, replaces iOS §4)
+8. Firebase setup for Android (**new**, replaces iOS §5 — no APNs)
+9. Notification Debug Panel (**reuse iOS §6**)
+10. Android configuration checklist (**new**, replaces iOS §7)
+11. Android-specific testing notes (**new**, replaces iOS §8)
+12. Recommended debug workflow (**reuse iOS §9** + logcat)
+13. Sample curl commands (**reuse iOS §10** + `platform: "android"`)
+14. Troubleshooting (**merge reusable + Android push rows**)
+15. Key source files (**reuse iOS §12**)
+16. Related docs (**iOS doc + Android device guide + BUILDING**)
+
+---
+
+## Wording and terminology substitutions
+
+When adapting reused sections:
+
+| iOS doc term | Android doc term |
+|--------------|------------------|
+| iPhone | Android phone / device |
+| Xcode console | logcat / Android Studio Logcat |
+| `build:ios:dev` / `test` | `build:android:dev` / `test` |
+| `GoogleService-Info.plist` | `google-services.json` |
+| APNs / silent push | FCM data message / high-priority data |
+| Bundle ID | Application ID / package name (`app.timesafari`) |
+| Physical iPhone required for APNs | Physical device strongly recommended for Doze/OEM/FCM realism |
+| `platform: "ios"` in curl | `platform: "android"` |
+
+---
+
+## Gaps to resolve while writing the Android guide
+
+Research during authoring (code + **notification-wakeup-service** + **daily-notification-plugin**):
+
+1. Exact FCM Android message priority and payload fields for `WAKEUP_PING` (parity with iOS data message).
+2. Whether `POST_NOTIFICATIONS` denial blocks data message delivery to JS listeners on API 33+.
+3. Gradle/Firebase plugin versions already in `android/` — document exact files to touch.
+4. Android **Pending Notification Inspector** parity with iOS panel section.
+5. Whether emulator with Google Play image is acceptable for minimal FCM smoke tests vs mandatory physical device for wakeup SLA testing.
+
+---
+
+## Document maintenance
+
+| Document | Role |
+|----------|------|
+| [local-ios-testing-ngrok.md](./local-ios-testing-ngrok.md) | Canonical iOS + ngrok workflow (unchanged by this analysis) |
+| **This file** | Reuse vs rewrite matrix and Android topic backlog |
+| *Future* `local-android-testing-ngrok.md` | Operator guide for Android testers |
+
+When backend or debug panel behavior changes, update **both** platform guides’ shared sections in lockstep (or extract shared “ngrok + debug panel” snippet later — out of scope unless requested).

doc/local-ios-testing-ngrok.md

@@ -0,0 +1,544 @@
+# Local iOS Testing with ngrok (notification-wakeup-service)
+
+**Last updated:** 2026-05-18  
+**Audience:** Developers on **crowd-funder-for-time-pwa**, **daily-notification-plugin**, and **notification-wakeup-service**  
+**Goal:** Exercise silent push wake (`WAKEUP_PING`), FCM token registration, and notification refresh against a Mac-hosted backend reachable from a physical iPhone.
+
+---
+
+## Architecture overview
+
+End-to-end flow when testing New Activity / silent wake on a physical iPhone:
+
+```text
+┌─────────────────────┐     HTTPS      ┌──────────────────────┐
+│  Mac (localhost)    │ ◄───────────── │  ngrok edge           │
+│  notification-      │   tunnel       │  (public HTTPS URL)   │
+│  wakeup-service     │                └──────────┬───────────┘
+└──────────┬──────────┘                           │
+           │                                        │ fetch
+           │ POST /notifications/refresh            │ POST /notifications/register
+           │                                        ▼
+           │                             ┌──────────────────────┐
+           │                             │  crowd-funder-for-     │
+           │                             │  time-pwa (Capacitor   │
+           │                             │  iOS on iPhone)        │
+           │                             └──────────┬───────────┘
+           │                                        │
+           │  FCM data message (WAKEUP_PING)        │ daily-notification-plugin
+           ▼                                        ▼ (local schedule replace)
+┌─────────────────────┐                ┌──────────────────────┐
+│  Firebase Cloud      │ ──APNs──────► │  iPhone (physical)   │
+│  Messaging           │  silent push  │  app.timesafari      │
+└─────────────────────┘                └──────────────────────┘
+```
+
+### Repos and responsibilities
+
+| Repo | Role |
+|------|------|
+| **notification-wakeup-service** | HTTP API: device registration, refresh payload (`nextNotifications`), health, debug wakeup send |
+| **crowd-funder-for-time-pwa** | Capacitor app: FCM token, `POST /notifications/register` & `/refresh`, handles `WAKEUP_PING` push |
+| **daily-notification-plugin** | Native iOS/Android: clear + reschedule local notifications from refresh timestamps |
+
+### Silent wake sequence (production path)
+
+1. Backend (or `/debug/send-wakeup`) sends an FCM **data** message with `data.type = "WAKEUP_PING"`.
+2. APNs delivers to the device (best-effort; see iOS caveats below).
+3. Capacitor `pushNotificationReceived` fires → `handleCapacitorPushNotificationReceived()`.
+4. App calls `POST {backend}/notifications/refresh` with `testMode` (from debug config).
+5. Backend returns `nextNotifications: [{ timestamp }, ...]`.
+6. App calls `applyNotificationRefreshPayload()` → plugin clears and schedules new local alarms.
+
+Console and debug panel lines are prefixed with **`[Notifications]`** (see `NotificationDebugEvents.ts`).
+
+---
+
+## Prerequisites
+
+- Mac with Xcode, Node.js 18+, and the **notification-wakeup-service** repo cloned and runnable
+- Physical iPhone (USB or wireless debugging) — **simulator is not sufficient** for reliable silent push / APNs behavior
+- ngrok account (free tier is enough for dev)
+- Firebase project with APNs configured for the iOS app bundle ID
+- Non-production app build (Notification Debug Panel is dev-only)
+
+---
+
+## 1. Install and configure ngrok (macOS)
+
+### Install
+
+```bash
+# Homebrew
+brew install ngrok/ngrok/ngrok
+```
+
+Or download from [https://ngrok.com/download](https://ngrok.com/download).
+
+### Account and auth token
+
+1. Sign up at [https://dashboard.ngrok.com/signup](https://dashboard.ngrok.com/signup).
+2. Copy your authtoken from **Your Authtoken** in the dashboard.
+3. Configure the CLI:
+
+```bash
+ngrok config add-authtoken YOUR_AUTHTOKEN_HERE
+```
+
+### Start a tunnel to the wakeup service
+
+Assume the service listens on port **3000** (confirm in **notification-wakeup-service** `README` or `.env`).
+
+If the service already defaults to port 3000 internally, you may not need to export PORT manually.
+
+```bash
+# Terminal A — backend
+cd /path/to/notification-wakeup-service
+
+npm install
+
+# one-time setup if needed
+cp .env.example .env
+
+# configure Firebase/service account/etc as required
+export PORT=3000
+
+npm run dev
+```
+
+```bash
+# Terminal B — ngrok
+ngrok http 3000
+```
+
+The backend only needs to be started once. The dedicated backend section below exists for verification and troubleshooting details, not as a second startup step.
+
+ngrok prints a forwarding URL, for example:
+
+```text
+Forwarding   https://abc123.ngrok-free.app -> http://localhost:3000
+```
+
+Use the **HTTPS** URL (not `http://127.0.0.1:3000`). The iPhone cannot reach your Mac’s localhost without the tunnel.
+
+> **Note:** Free ngrok URLs change every time you restart ngrok unless you use a reserved domain (paid). Update the app debug override whenever the URL changes.
+
+---
+
+## 2. Start the backend locally
+
+Example (adjust to match **notification-wakeup-service**). On first setup, copy `.env.example` to `.env` and set Firebase service account, `PORT`, and other variables per that repo's docs.
+
+If the backend is not already running from section 1:
+
+```bash
+# If not already running from the previous step:
+cd /path/to/notification-wakeup-service
+npm run dev
+```
+
+Verify locally before ngrok:
+
+```bash
+curl -sS http://localhost:3000/health
+```
+
+Expected: HTTP 200 and a JSON body indicating the service is up (exact shape depends on that repo).
+
+---
+
+## 3. Obtain and use the ngrok HTTPS URL
+
+1. Run `ngrok http <PORT>`.
+2. Copy the `https://….ngrok-free.app` host from the **Forwarding** line.
+3. Do **not** add a trailing slash when saving in the app (the debug config trims it).
+4. Optional: open `http://127.0.0.1:4040` (ngrok web UI) to inspect requests and responses while testing.
+
+Test through the tunnel from your Mac:
+
+```bash
+export NGROK_URL="https://abc123.ngrok-free.app"
+curl -sS "$NGROK_URL/health"
+```
+
+---
+
+## 4. Generate and open the iOS workspace
+
+From **crowd-funder-for-time-pwa**, generate the Capacitor iOS project and open it in Xcode. **[Section 5](#5-firebase--apns-setup-first-time-setup) (Firebase + APNs)** needs this workspace—for example to add `GoogleService-Info.plist` and enable Push Notifications in the app target. The app does not need Firebase or push fully configured yet; the goal here is a buildable Xcode project on your Mac.
+
+```bash
+npm install
+npm run build:ios:dev    # or build:ios:test — non-production for debug panel
+```
+
+Open the generated Xcode workspace (for example `ios/App/App.xcworkspace`), select your **physical iPhone**, enable signing, and Run when you are ready to verify the app launches.
+
+Ensure `VITE_FIREBASE_*` variables are set for the Capacitor build you use (see `.env` / build docs). Native push registration runs at startup via `initializeNativePushAndFirebaseMessaging()` in `main.capacitor.ts` once Firebase is configured in the next section.
+
+---
+
+## 5. Firebase + APNs setup (first-time setup)
+
+Complete this section once before your first physical-device push test. If Firebase and APNs are already configured for this app, skip to [section 6](#6-configure-the-notification-debug-panel-backend-override).
+
+### Create or access a Firebase account
+
+1. Sign in with a Google account at [https://console.firebase.google.com/](https://console.firebase.google.com/).
+
+2. If this is your first time using Firebase:
+   - Accept the Firebase terms.
+   - Create a new Firebase account/workspace when prompted.
+
+3. No paid Firebase plan is required for local iOS notification testing. The free **Spark** plan is sufficient for:
+   - Firebase Cloud Messaging (FCM)
+   - APNs silent push testing
+   - local ngrok-based development
+
+### Create a Firebase project
+
+1. In the [Firebase Console](https://console.firebase.google.com/), click **Add project** (or **Create a project**).
+2. Enter a project name (for example, `timesafari-dev`) and continue through the wizard.
+3. **Google Analytics** is optional for this workflow; you can disable it for a simpler dev project.
+4. When the project is created, open it. **Cloud Messaging** is available on all projects — you do not need a separate enable step for FCM.
+
+### Register the iOS app in Firebase
+
+1. In the project overview, click the **iOS** icon (**Add app** → iOS).
+2. Enter the **Apple bundle ID**. It must **exactly** match the Capacitor / Xcode app ID:
+   - **`app.timesafari`** (see `appId` in `capacitor.config.ts` and the Xcode target **Bundle Identifier**).
+3. App nickname and App Store ID are optional for local testing; continue.
+4. Download **`GoogleService-Info.plist`** when prompted and keep it handy for the next step.
+
+### Add GoogleService-Info.plist to Xcode
+
+1. Open the iOS workspace you generated in [section 4](#4-generate-and-open-the-ios-workspace) (for example `ios/App/App.xcworkspace`).
+2. In the Project Navigator, drag **`GoogleService-Info.plist`** into the **App** folder (the same one that contains AppDelegate.swift and Info.plist).
+3. In the dialog that appears:
+   - Check **Copy items if needed** (so the file is copied into the project tree).
+   - Under **Add to targets**, ensure the main app target (not only the share extension) is checked.
+4. Confirm the file appears under the app target in Xcode and is listed in **Build Phases** → **Copy Bundle Resources** if your project uses that phase for plists.
+
+### Create an APNs Authentication Key
+
+Apple uses APNs to deliver pushes to devices; Firebase needs an APNs key to talk to Apple on your behalf.
+
+1. Sign in to [Apple Developer](https://developer.apple.com/account/) → **Certificates, Identifiers & Profiles**.
+2. Open **Keys** → **+** (create a new key).
+3. Name the key (for example, `Timesafari APNs Dev`).
+4. Enable **Apple Push Notifications service (APNs)** and continue.
+5. Register the key, then **Download** the `.p8` file. **You can download it only once** — store it securely.
+6. Note:
+   - **Key ID** (shown on the key detail page)
+   - **Team ID** (top right of the developer portal, or **Membership** details)
+
+### Upload APNs key to Firebase
+
+1. Firebase Console → your project → **Project settings** (gear icon).
+2. Open the **Cloud Messaging** tab.
+3. Under **Apple app configuration**, select your iOS app (`app.timesafari`) if prompted.
+4. Under **APNs Authentication Key**, click **Upload**.
+5. Select the `.p8` file and enter:
+   - **Key ID**
+   - **Team ID**
+6. Save. Firebase can now send FCM messages through APNs to your iOS app.
+
+### Enable iOS capabilities in Xcode
+
+1. Select the **App** target → **Signing & Capabilities**.
+2. Click **+ Capability** and add **Push Notifications**.
+3. Click **+ Capability** again and add **Background Modes**.
+4. Under Background Modes, enable **Remote notifications**.
+
+These match what silent / data wake flows expect for background delivery.
+
+### Configure Firebase Admin for the backend
+
+**notification-wakeup-service** uses the Firebase Admin SDK to send FCM (and thus APNs) messages from your Mac.
+
+1. Firebase Console → **Project settings** → **Service accounts**.
+2. Click **Generate new private key** and confirm download of the JSON file.
+3. Store the JSON outside the repo (do not commit it).
+4. Point the backend at it, for example:
+
+```bash
+export GOOGLE_APPLICATION_CREDENTIALS="/absolute/path/to/service-account.json"
+```
+
+The backend uses this credential to authenticate with Firebase when calling endpoints such as `/debug/send-wakeup`. Set the same variable (or the equivalent env var documented in **notification-wakeup-service**) in the shell where you run `npm run dev`, or add it to that repo’s `.env` per its README.
+
+### Verify Firebase configuration
+
+Before ngrok end-to-end testing, confirm:
+
+- [ ] App builds and launches on a **physical** iPhone without Firebase/plist errors in Xcode.
+- [ ] iOS shows the push **permission** prompt (or Settings → app → Notifications is enabled).
+- [ ] **Notification Debug Panel** shows an FCM token (after permission).
+- [ ] **Register Token Now** succeeds and ngrok (or local backend) shows `POST /notifications/register`.
+- [ ] Backend health and Firebase Admin env are set so `/debug/send-wakeup` can run when you reach that step in the workflow below.
+
+---
+
+## 6. Configure the Notification Debug Panel backend override
+
+
+The app normally calls `DEFAULT_NOTIFY_API_SERVER` (from `VITE_DEFAULT_NOTIFY_API_SERVER`, falling back to `AppString.PROD_NOTIFY_API_SERVER`). That is independent of `APP_SERVER`. For local wakeup testing, override the notification API base URL in the Debug Panel without rebuilding.
+
+For a full panel reference (configuration, URL resolution order, authentication, and troubleshooting), see [notification-debug-panel.md](./notification-debug-panel.md).
+
+### Open the panel
+
+1. Use a **non-production** bundle (e.g. dev/test build).
+2. **Account** → enable **Show All General Advanced Functions**.
+3. Open **Notification Debug Panel** (route `/dev/notifications`).
+
+### Backend Testing section
+
+| Control | Purpose |
+|---------|---------|
+| **Notification Backend URL** | Paste ngrok HTTPS URL → **Save Backend URL** (changes target server only) |
+| **Test Mode** | Sends `testMode: true/false` in register/refresh JSON bodies (default on when unset in storage) |
+| **Skip JWT Authentication (Local Development Only)** | When on, omits `Authorization` headers for local servers that accept unauthenticated requests (default **off**) |
+| **Register Token Now** | `POST /notifications/register` with current FCM token |
+| **Refresh Notifications** | `POST /notifications/refresh` (same as post-wakeup flow) |
+| **Simulate WAKEUP_PING (Local)** | Calls refresh API directly (no FCM) — quick backend test |
+| **Send Real WAKEUP_PING** | `POST /debug/send-wakeup`; server sends real FCM `WAKEUP_PING` (Android doc has full flow) |
+| **Event Log** | Shared `[Notifications]` panel log (100 entries) |
+
+Persistence: `localStorage` keys `notificationDebug.backendBaseUrl`, `notificationDebug.testMode`, and `notificationDebug.bypassAuth` (`NotificationDebugConfig.ts`).
+
+### Authentication vs backend URL
+
+These settings are **independent**:
+
+- **Backend URL** — which server receives notification API calls.
+- **Test Mode** — `testMode` field in JSON request bodies only.
+- **Skip JWT Authentication** — whether JWT `Authorization` headers are sent.
+
+For a **hosted shared test server**: set the backend URL, keep **Test Mode** on if required, leave **Skip JWT Authentication** **off**, and ensure an active DID exists.
+
+For **local ngrok**: set the backend URL; enable **Skip JWT Authentication** only if your local backend accepts unauthenticated requests.
+
+### Programmatic override (optional)
+
+From Safari Web Inspector or a dev console attached to the WebView:
+
+```javascript
+import {
+  setBackendBaseUrl,
+  setTestMode,
+  setBypassAuth,
+  getNotificationApiBaseUrl,
+} from "@/services/notifications";
+
+setBackendBaseUrl("https://abc123.ngrok-free.app");
+setTestMode(true);
+setBypassAuth(true); // local dev only — omit for hosted servers that require JWT
+getNotificationApiBaseUrl(); // → ngrok URL
+```
+
+---
+
+## 7. Firebase and Xcode checklist (iOS)
+
+This section is a quick verification checklist for the detailed Firebase/APNs setup steps above.
+
+| Item | Action |
+|------|--------|
+| **Bundle ID** | Match Capacitor `appId` (`app.timesafari` in `capacitor.config.ts`) to Firebase iOS app and Xcode target |
+| **APNs auth key** | Firebase Console → Project Settings → Cloud Messaging → upload **APNs Authentication Key** (.p8) or certificates |
+| **Push Notifications** | Xcode target → **Signing & Capabilities** → **+ Capability** → **Push Notifications** |
+| **Background Modes** | Enable **Remote notifications** (and any others required by your plugin docs) |
+| **GoogleService-Info.plist** | Present in the iOS target if using Firebase iOS SDK paths in your build |
+| **FCM token** | Confirm **Register Token Now** succeeds in the debug panel and ngrok shows `POST /notifications/register` |
+
+Silent/data pushes used for wake typically use a **content-available** style payload; confirm **notification-wakeup-service** and Firebase message format match what `handleCapacitorPushNotificationReceived` expects (`data.type === "WAKEUP_PING"`).
+
+---
+
+## 8. iOS-specific testing notes
+
+### Physical device required
+
+- APNs silent delivery and background wake behavior are **not** representative on the iOS Simulator.
+- Always validate on a plugged-in or trusted wireless device with a development provisioning profile.
+
+### Silent push is best-effort
+
+- iOS may **delay or coalesce** background pushes, especially on battery saver or under load.
+- A successful `/debug/send-wakeup` from the server does not guarantee immediate app wake.
+
+### Force-quit limitations
+
+- If the user **swipes the app away** from the app switcher, iOS often **will not** deliver background notifications until the user launches the app again.
+- Test with the app **backgrounded** (home button / gesture), not force-quit, when validating wake.
+
+### Low Power Mode and Focus
+
+- **Low Power Mode** can reduce background execution.
+- **Focus / Do Not Disturb** may affect notification presentation (separate from silent data wake, but confusing during tests).
+
+### Two “Simulate WAKEUP_PING” buttons
+
+| Button | Behavior |
+|--------|----------|
+| **Backend Testing → Simulate WAKEUP_PING** | Skips FCM; calls refresh API only (ngrok path test) |
+| **Wakeup Ping Simulator** (lower on panel) | Runs production handler with synthetic `WAKEUP_PING` payload |
+
+Use the backend button to verify ngrok + refresh; use the simulator to verify handler + refresh chaining.
+
+---
+
+## 9. Recommended debug workflow
+
+1. Start **notification-wakeup-service** on the Mac.
+2. Start **ngrok** and copy the HTTPS URL.
+3. Set URL + **Test Mode** in the Notification Debug Panel; confirm **Backend Status**.
+4. Tap **Register Token Now** → confirm ngrok request and `[Notifications] Token registration success`.
+5. Tap **Refresh Notifications** → confirm `Refresh completed in Nms (scheduled X)` in Event Log and ngrok `POST /notifications/refresh`.
+6. From the backend, call **`/debug/send-wakeup`** (see curl below) with the registered `deviceId` / FCM token as required by that service.
+7. Watch **Xcode console** for `[Notifications] pushNotificationReceived type=WAKEUP_PING` and refresh timing lines.
+8. Open **ngrok inspect UI** (`http://127.0.0.1:4040`) to correlate requests.
+9. Use **Pending Notification Inspector** on the panel to see locally scheduled fires after refresh.
+
+---
+
+## 10. Sample curl commands
+
+Set your tunnel base URL:
+
+```bash
+export BASE="https://abc123.ngrok-free.app"
+```
+
+### Health
+
+```bash
+curl -sS -w "\nHTTP %{http_code}\n" "$BASE/health"
+```
+
+### Register device (mirror app payload)
+
+```bash
+curl -sS -X POST "$BASE/notifications/register" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "deviceId": "00000000-0000-4000-8000-000000000001",
+    "fcmToken": "YOUR_FCM_TOKEN_FROM_DEBUG_PANEL",
+    "platform": "ios",
+    "testMode": true
+  }'
+```
+
+### Refresh (mirror app payload)
+
+```bash
+curl -sS -X POST "$BASE/notifications/refresh" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "platform": "ios",
+    "testMode": true
+  }'
+```
+
+Example success body shape (actual fields may vary by service version):
+
+```json
+{
+  "shouldNotify": true,
+  "nextNotifications": [
+    { "timestamp": 1710000000000 },
+    { "timestamp": 1710003600000 }
+  ]
+}
+```
+
+The app schedules those timestamps via **daily-notification-plugin** (`applyNotificationRefreshPayload` in `NativeNotificationService.ts`).
+
+### Send wakeup push (debug)
+
+Exact path and body depend on **notification-wakeup-service**; typical pattern:
+
+```bash
+curl -sS -X POST "$BASE/debug/send-wakeup" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "deviceId": "00000000-0000-4000-8000-000000000001",
+    "testMode": true
+  }'
+```
+
+Confirm parameters (token vs deviceId, auth headers) in that repo’s README or OpenAPI spec.
+
+---
+
+## 11. Troubleshooting
+
+### Refresh endpoint unreachable
+
+| Symptom | Checks |
+|---------|--------|
+| Network error in Event Log | ngrok running? URL saved without typo/trailing slash? |
+| HTTP 404 | Tunnel port matches backend `PORT`; path is `/notifications/refresh` |
+| CORS (web only) | Native Capacitor fetch usually avoids browser CORS; if testing in Safari PWA, configure CORS on the service |
+| ngrok browser warning | Free tier may show an interstitial for browser clients; native `fetch` from the app is usually unaffected |
+
+### Token registration failures
+
+- Push permission granted on the device?
+- Firebase `VITE_FIREBASE_*` env vars baked into the build?
+- `[Notifications] Token registration failure` in Xcode — read HTTP status in ngrok inspect
+- Duplicate token skip: panel may show “skipped (duplicate)”; use **Register Token Now** to force re-register
+
+### Silent push not waking the app
+
+- App **backgrounded**, not force-quit
+- Physical device, correct provisioning profile
+- APNs key uploaded to Firebase; bundle ID matches
+- FCM message includes `data.type = "WAKEUP_PING"` (see `NativeNotificationService.ts`)
+- Server actually sent to the **same** FCM token shown in the debug panel
+- Wait 30–120s — delivery is not instant
+- Try **Simulate WAKEUP_PING** (refresh API) to isolate app/plugin from FCM/APNs
+
+### Notifications duplicating
+
+- Multiple refresh calls (flood test, repeated wakeups) each **replace** schedule via clear + schedule — check Event Log for repeated refreshes
+- Separate issue: Daily Reminder vs New Activity both scheduling — see `doc/notification-new-activity-lay-of-the-land.md`
+
+### Stale ngrok URL
+
+- After restarting ngrok, update **Notification Backend URL** in the panel and tap **Save**
+- Or clear override (empty field + Save) only if you intend to hit `DEFAULT_NOTIFY_API_SERVER` again
+
+### Plugin / JWT errors after refresh
+
+- Refresh calls `configureNativeFetcherIfReady()` before scheduling — ensure an **active DID** and endorser API settings exist in the app DB
+- See `doc/notification-from-api-call.md` and `nativeFetcherConfig.ts`
+
+---
+
+## 12. Key source files (crowd-funder-for-time-pwa)
+
+| File | Purpose |
+|------|---------|
+| `src/services/notifications/NotificationDebugConfig.ts` | Backend URL, testMode, and bypassAuth overrides |
+| `src/services/notifications/NotificationDebugEvents.ts` | Panel event log + `logNotification()` |
+| `src/services/notifications/notificationLog.ts` | Structured log helpers |
+| `src/services/notifications/NotificationService.ts` | `POST /notifications/register` |
+| `src/services/notifications/NativeNotificationService.ts` | Refresh, `WAKEUP_PING`, schedule replace |
+| `src/services/notifications/firebaseMessagingClient.ts` | Capacitor push listeners |
+| `src/components/dev/NotificationDebugPanel.vue` | Dev UI |
+| `src/main.capacitor.ts` | Native push init at startup |
+
+---
+
+## 13. Related docs
+
+- [notification-debug-panel.md](./notification-debug-panel.md) — panel controls, authentication, troubleshooting
+- [Notification Debug Panel (README)](../README.md#notification-debug-panel-dev-builds)
+- [notification-system-overview.md](./notification-system-overview.md)
+- [notification-from-api-call.md](./notification-from-api-call.md)
+- [notification-new-activity-lay-of-the-land.md](./notification-new-activity-lay-of-the-land.md)
+- [BUILDING.md](../BUILDING.md) — iOS build commands
+
+For plugin-native behavior (exact alarm, iOS pending inspector), see **daily-notification-plugin** documentation. For FCM payload format and `/debug/send-wakeup` contract, see **notification-wakeup-service**.

doc/new-activity-notifications-ios-android-parity.md

@@ -0,0 +1,158 @@
+# New Activity Notifications: iOS Parity with Android
+
+**Purpose:** Describe what is required for **iOS** to match **Android** for the daily-notification-plugin **API-driven “New Activity”** flow (`scheduleDualNotification` / `cancelDualSchedule`, with prefetch and Endorser-backed content). The canonical product behavior is documented in `doc/notification-from-api-call.md` and `doc/notification-new-activity-lay-of-the-land.md`.
+
+**Plugin source of truth:** The Capacitor package is `@timesafari/daily-notification-plugin`, pulled from the official remote in `package.json` (`git+https://gitea.anomalistdesign.com/trent_larson/daily-notification-plugin.git`). Plugin development happens in that repository; this app bumps the dependency and runs `npm install` / `npx cap sync` after releases.
+
+---
+
+## 1. What “parity” means here
+
+| Concern | Intended behavior |
+|--------|---------------------|
+| **Scheduling** | Dual schedule: prefetch job **before** notify time (app uses cron T−5 minutes), then user-visible notification at the chosen time. |
+| **API content** | Prefetch calls the **same Endorser semantics** as the Android host: **`plansLastUpdatedBetween`** (POST) with **starred plan IDs**, JWT auth, aggregated titles/bodies consistent with `TimeSafariNativeFetcher`. |
+| **Starred plans** | `updateStarredPlans({ planIds })` from the app must affect what the native prefetch queries. |
+| **Configure** | `configureNativeFetcher({ apiBaseUrl, activeDid, jwtToken, … })` supplies credentials the native layer uses for prefetch. |
+| **Lifecycle** | `cancelDualSchedule()` removes the dual prefetch + notify schedule without breaking the separate Daily Reminder. |
+
+Platform differences (iOS **BGTaskScheduler** is opportunistic; Android **alarms/WorkManager** can be more exact) mean **timing** may never be identical, but **API behavior and user-visible copy** should align.
+
+---
+
+## 2. Current state: Android (this app)
+
+- **Host native fetcher:** `android/.../TimeSafariNativeFetcher.java` implements the plugin’s `NativeNotificationContentFetcher` and calls **`POST …/api/v2/report/plansLastUpdatedBetween`** using starred plan IDs (via plugin storage from `updateStarredPlans`).
+- **Registration:** `MainActivity` calls `DailyNotificationPlugin.setNativeFetcher(new TimeSafariNativeFetcher(this))`.
+- **Plugin (Android) — older notes:** Prior dual-schedule issues (native fetcher / fetch cron) are addressed in **plugin ≥ 3.0.0** (chained dual: notify after prefetch). Historical analysis: `doc/plugin-feedback-android-dual-schedule-native-fetch-and-timing.md`.
+
+---
+
+## 3. Current state: iOS (this app + bundled plugin)
+
+### 3.1 This repository
+
+- **iOS native fetcher:** `ios/App/App/TimeSafariNativeFetcher.swift` implements `NativeNotificationContentFetcher` (Endorser `plansLastUpdatedBetween`, same prefs keys as Java). **`AppDelegate`** calls `DailyNotificationPlugin.registerNativeFetcher(TimeSafariNativeFetcher.shared)` at launch **before** any `configureNativeFetcher` from JS (see plugin `doc/CONSUMING_APP_HANDOFF_IOS_NATIVE_FETCHER_AND_CHAINED_DUAL.md` and **`doc/consuming-app-handoff-ios-native-fetcher-chained-dual.md`**).
+- **JS/TS is already shared:** `nativeFetcherConfig.ts`, `dualScheduleConfig.ts`, `syncStarredPlansToNativePlugin.ts`, and `AccountViewView.vue` call the same APIs on both platforms.
+- **Info.plist** already lists `UIBackgroundModes` (fetch, processing) and `BGTaskSchedulerPermittedIdentifiers` for the plugin’s task IDs. Xcode **Signing & Capabilities** should still enable **Background fetch** and **Background processing** (see `doc/daily-notification-plugin-integration.md`).
+- **AppDelegate** posts `DailyNotificationDelivered` for foreground presentation—aligned with plugin rollover behavior.
+
+### 3.2 Bundled plugin (`node_modules/@timesafari/daily-notification-plugin`, iOS)
+
+Requires **plugin ≥ 3.0.0** (register native fetcher, chained dual, iOS `updateStarredPlans`). Version pinned in `ios/App/Podfile.lock` after `pod install`.
+
+- **`scheduleDualNotification` / `cancelDualSchedule`** — see plugin release notes; clean sync + `pod install` if you see `UNIMPLEMENTED` (`doc/plugin-feedback-ios-scheduleDualNotification.md`).
+- **`configureNativeFetcher`** — **requires** `DailyNotificationPlugin.registerNativeFetcher` first; the host Swift fetcher performs **`plansLastUpdatedBetween`** (plugin does not use in-plugin `offers` GET when a fetcher is registered—mirrors Android).
+- **`updateStarredPlans`** — implemented on iOS in current plugin; persists **`daily_notification_timesafari.starredPlanIds`** for the host fetcher.
+- **Chained dual** — user notification is armed **after** prefetch for that cycle (plugin); iOS remains subject to BG scheduling limits; see **§3.3**.
+
+### 3.3 Prefetch before notify (ordering, not cron)
+
+iOS has no system cron; the app/plugin may still **parse** cron to compute “next run” times. The hard part is **ordering**: if **prefetch** is driven by **`BGTaskScheduler`** (opportunistic) and **notify** by **`UNUserNotificationCenter`** at a fixed time **T**, those are **independent**. The OS can deliver the local notification at **T** while prefetch runs **after** **T** or not at all—so the awkward case (notify first, prefetch later, stale or fallback content) **can** happen. Two peer timers do **not** imply “fetch always completes before **T**.”
+
+To **enforce** prefetch-before-notify as a rule, use **chaining**, not two unrelated schedules:
+
+- After prefetch for that cycle **finishes** (success or explicit timeout policy), **then** schedule or **replace** the pending `UNNotificationRequest` for time **T** with the resolved title/body (or fallback). Until then, do not arm a user-visible notification that claims fresh API content.
+- **Tradeoffs:** If prefetch is late, the notification may be **late**; if prefetch never runs before a deadline, use **fallback** copy at **T** or skip—product choice.
+- **Parsing cron** remains useful to compute **T** and to decide when to **submit** BG work; **ordering** is a **pipeline** decision (fetch → cache → arm notify), not “BG at T−5 and UN at **T** both scheduled up front.”
+
+Plugin work item **§4A.3** should reflect this: document the chosen strategy (chained arm vs best-effort dual timer) and how it interacts with `relationship.contentTimeout` / fallback.
+
+---
+
+## 4. Work breakdown
+
+### 4A. Plugin (`daily-notification-plugin`) — status (v3.x)
+
+Items below were the original gap list; **plugin ≥ 3.0.0** ships **iOS** `updateStarredPlans`, **`registerNativeFetcher`**, **chained dual** on iOS and Android, and Android dual-path fixes. Remaining work is **release coordination** (bump, sync, QA), not greenfield plugin implementation.
+
+1. **`updateStarredPlans` on iOS** — shipped in current plugin.
+
+2. **iOS `plansLastUpdatedBetween` / host fetcher** — shipped: host registers **`TimeSafariNativeFetcher`** (Swift); plugin does not duplicate Endorser logic when a fetcher is registered.
+
+3. **Dual schedule / chaining** — shipped (notify after prefetch; see plugin release notes and **§3.3**).
+
+4. **Android dual path** — chained dual + native fetcher alignment in current plugin (see `doc/plugin-feedback-android-dual-schedule-native-fetch-and-timing.md` for historical context).
+
+5. **JWT pool / expiry (Phase B)**  
+   - **App:** Phase B is already implemented: `configureNativeFetcherIfReady()` passes `jwtTokens` from `mintBackgroundJwtTokenPool` on **both** iOS and Android (`src/services/notifications/nativeFetcherConfig.ts`).  
+   - **Android:** `TimeSafariNativeFetcher` selects a bearer from the pool for background requests (`doc/plugin-feedback-daily-notification-configureNativeFetcher-jwt-pool.md`).  
+   - **iOS:** The bundled plugin’s `configureNativeFetcher` **already accepts and persists** `jwtTokens` / `jwtTokenPoolJson`, and the in-plugin fetch path uses a bearer from the primary token or pool. What is **not** yet at parity with Android is **which API** that token is used for (`offers` GET vs `plansLastUpdatedBetween` + starred plans)—that falls under **§4A.2**, not “waiting for Phase B on iOS.”  
+   - **Expiry:** Re-calling `configureNativeFetcherIfReady` on foreground / Account (see `notification-from-api-call.md`) remains relevant on both platforms.
+
+### 4B. This app (crowd-funder-for-time-pwa) — after or alongside plugin changes
+
+1. **Bump `@timesafari/daily-notification-plugin`** to **≥ 3.0.0** via the git dependency in `package.json`, run `npm install`, `npx cap sync ios`, `cd ios/App && pod install`, clean build (`doc/plugin-feedback-ios-scheduleDualNotification.md`, **`doc/consuming-app-handoff-ios-native-fetcher-chained-dual.md`**).
+2. **iOS native fetcher** — **Done:** `TimeSafariNativeFetcher.swift` + `registerNativeFetcher` in `AppDelegate` (see handoff doc).
+3. **Re-test** `syncStarredPlansToNativePlugin` on iOS; the helper may still catch `UNIMPLEMENTED` for older plugin binaries.
+4. **Xcode:** Confirm Background Modes capabilities match `Info.plist`.
+5. **QA:** Full matrix in `doc/notification-from-api-call.md` (enable/disable, empty starred list, JWT expiry, foreground/background); chained dual timing (notify after prefetch).
+
+### 4C. Related product bug (both platforms)
+
+- **`PushNotificationPermission.vue` vs New Activity:** Enabling New Activity can still schedule the **single** daily reminder by mistake; turning New Activity off may not cancel that reminder. See `doc/notification-new-activity-lay-of-the-land.md`. Fixing this is orthogonal to iOS/Android API parity but affects perceived “notifications behavior.”
+
+---
+
+## 5. Reference map (this repo)
+
+| Topic | Document |
+|-------|-----------|
+| Plugin post-bump handoff (iOS fetcher + chained dual) | `doc/consuming-app-handoff-ios-native-fetcher-chained-dual.md` |
+| Feature plan & file list | `doc/notification-from-api-call.md` |
+| Dual vs Daily Reminder confusion | `doc/notification-new-activity-lay-of-the-land.md` |
+| iOS `UNIMPLEMENTED` / PluginHeaders | `doc/plugin-feedback-ios-scheduleDualNotification.md` |
+| Android dual schedule + native fetcher | `doc/plugin-feedback-android-dual-schedule-native-fetch-and-timing.md` |
+| Integration & Xcode | `doc/daily-notification-plugin-integration.md` |
+| Android host fetcher | `android/.../TimeSafariNativeFetcher.java`, `MainActivity.java` |
+
+---
+
+## 6. Handoff to plugin repo (Cursor / isolated workspace)
+
+Use this section when **daily-notification-plugin** is open **without** the TimeSafari app tree, so implementers do not depend on paths that only exist in crowd-funder-for-time-pwa.
+
+### 6.1 Bring reference material into scope
+
+| Source (this app repo) | Why |
+|------------------------|-----|
+| `android/app/src/main/java/app/timesafari/TimeSafariNativeFetcher.java` | **Canonical Endorser behavior** for New Activity: POST body, pagination, aggregation copy, prefs keys for starred IDs and `last_acked_jwt_id`. Copy or open alongside the plugin when implementing iOS fetch or `setNativeFetcher`. |
+| `src/services/notifications/dualScheduleConfig.ts` | Shape the app sends to `scheduleDualNotification` (`buildDualScheduleConfig`). |
+| `doc/plugin-feedback-android-dual-schedule-native-fetch-and-timing.md` | Android plugin: dual path must call native fetcher at fetch cron. |
+| `doc/plugin-feedback-ios-scheduleDualNotification.md` | iOS `UNIMPLEMENTED` / PluginHeaders troubleshooting. |
+
+In the plugin repo itself, align with **`src/definitions.ts`** (`DualScheduleConfiguration`, `configureNativeFetcher`, `updateStarredPlans`) and **INTEGRATION_GUIDE** if present.
+
+### 6.2 HTTP / storage contract (match `TimeSafariNativeFetcher`)
+
+Implementations on **iOS** (in-plugin Swift or host `NativeNotificationContentFetcher`) should match this **unless** product explicitly changes:
+
+- **Method & path:** `POST` `{apiBaseUrl}/api/v2/report/plansLastUpdatedBetween` (no trailing slash mismatch on `apiBaseUrl`).
+- **Headers:** `Content-Type: application/json`, `Authorization: Bearer {token}` (token from `jwtToken` or **JWT pool** selection—see Java `selectBearerTokenForRequest`: UTC day mod pool size).
+- **JSON body:** `planIds` (array of strings, possibly empty), `afterId` (string; use `"0"` if none stored).
+- **Starred plans:** Android: SharedPreferences **`daily_notification_timesafari`** + key **`starredPlanIds`**. iOS (plugin + host): `UserDefaults.standard` key **`daily_notification_timesafari.starredPlanIds`** (JSON array string).
+- **Pagination:** After a successful response with non-empty `data`, update **`last_acked_jwt_id`** from the last row’s `jwtId` (item or nested `plan.jwtId`)—see Java `updateLastAckedJwtIdFromResponse`. iOS host (`TimeSafariNativeFetcher.swift`) persists **`daily_notification_timesafari.last_acked_jwt_id`** in `UserDefaults.standard`.
+- **Empty `data`:** Return **no** notification items (empty list); do not synthesize a “no updates” push from an empty result—Java returns empty `contents` when `data` is absent or empty.
+- **Non-empty `data`:** One aggregated `NotificationContent`: titles **Starred Project Update** / **Starred Project Updates**, bodies use typographic quotes around first project name and **has been updated.** / **+ N more have been updated.** (see Java `parseApiResponse`).
+
+### 6.3 Likely plugin touchpoints (maintenance / debugging)
+
+- **iOS:** `ios/Plugin/DailyNotificationPlugin.swift`, `DailyNotificationScheduleHelper.swift`, native fetcher registry, BG / UN paths.
+- **Android:** `DailyNotificationPlugin.kt`, fetch workers / `ScheduleHelper`—see dual-schedule feedback doc for history.
+
+### 6.4 Suggested order (plugin shipped ≥ 3.0.0)
+
+1. Tag / publish **`@timesafari/daily-notification-plugin`**.  
+2. **Consuming app:** bump, `npm install`, `npx cap sync`, `pod install`, QA (`doc/consuming-app-handoff-ios-native-fetcher-chained-dual.md`).
+
+---
+
+## 7. Acceptance checklist (iOS vs Android product intent)
+
+- [ ] Prefetch uses **plansLastUpdatedBetween** (or host fetcher with identical behavior), not only `offers` GET.
+- [ ] **Starred plan IDs** from settings change what is queried (`updateStarredPlans` works on iOS).
+- [ ] Notification title/body match the **same rules** as Android for “starred project updates” (including empty updates).
+- [ ] `configureNativeFetcher` + JWT refresh story documented; re-config on foreground if needed (`notification-from-api-call.md`).
+- [ ] `cancelDualSchedule` clears dual prefetch/notify without leaving orphan schedules.
+- [ ] Understand and document **iOS timing** limitations vs Android for support/Help copy.
+- [ ] **Prefetch vs notify ordering** on iOS: chosen strategy (chained arm vs independent BG + UN) documented; avoids claiming fresh API content when prefetch has not run yet (**§3.3**).

doc/notification-debug-panel.md

@@ -0,0 +1,234 @@
+# Notification Debug Panel
+
+**Created:** 2026-07-07  
+**Updated:** 2026-07-22  
+**Audience:** Developers testing notification registration, refresh, and WAKEUP_PING flows on native (iOS/Android) dev builds.
+
+The **Notification Debug Panel** is a dev-only UI for exercising the same notification orchestration paths the production app uses: FCM token registration, backend refresh, wakeup handling, and local schedule inspection. It does not duplicate scheduling logic.
+
+---
+
+## Notification API base URL
+
+Notification HTTP calls (`/notifications/register`, `/notifications/refresh`, `/debug/send-wakeup`, etc.) do **not** use `APP_SERVER`. They use a dedicated Notification API host, resolved at runtime by `getNotificationApiBaseUrl()` in `NotificationDebugConfig.ts`.
+
+### Configuration constants
+
+| Symbol | Location | Purpose |
+|--------|----------|---------|
+| `VITE_DEFAULT_NOTIFY_API_SERVER` | `.env.development` / `.env.test` / `.env.production` | Build-time default Notification API URL for that Vite mode (same pattern as other `VITE_DEFAULT_*` backends) |
+| `DEFAULT_NOTIFY_API_SERVER` | `src/constants/app.ts` | Runtime constant: `import.meta.env.VITE_DEFAULT_NOTIFY_API_SERVER \|\| AppString.PROD_NOTIFY_API_SERVER` |
+| `AppString.PROD_NOTIFY_API_SERVER` | `src/constants/app.ts` | Hardcoded production fallback: `https://notify-api.timesafari.app` |
+| `AppString.TEST_NOTIFY_API_SERVER` | `src/constants/app.ts` | Hardcoded test host: `https://test-notify-api.timesafari.app` (for explicit UI/debug use; not the automatic fallback) |
+
+Production, test, and development builds get different Notification API URLs from their respective `.env.*` files. Runtime request code always goes through `DEFAULT_NOTIFY_API_SERVER` (via `getNotificationApiBaseUrl()`), not by reading the env var directly at each call site.
+
+Typical values today:
+
+| Build / env file | `VITE_DEFAULT_NOTIFY_API_SERVER` |
+|------------------|----------------------------------|
+| `.env.production` | `https://notify-api.timesafari.app` |
+| `.env.test` | `https://test-notify-api.timesafari.app` |
+| `.env.development` | `https://test-notify-api.timesafari.app` |
+
+### URL resolution order
+
+`getNotificationApiBaseUrl()` selects the base URL in this order:
+
+1. **Debug Panel backend override** — `localStorage` key `notificationDebug.backendBaseUrl` (set via **Save Backend URL** or `setBackendBaseUrl()`)
+2. **`VITE_DEFAULT_NOTIFY_API_SERVER`** — baked into the build as part of `DEFAULT_NOTIFY_API_SERVER`
+3. **`AppString.PROD_NOTIFY_API_SERVER`** — hardcoded fallback when the env var is unset (`https://notify-api.timesafari.app`)
+
+Clearing the Debug Panel override (empty field + Save) returns the app to step 2 / 3 (`DEFAULT_NOTIFY_API_SERVER`). The override never changes auth behavior by itself.
+
+`APP_SERVER` / `VITE_APP_SERVER` remain for deep links and the main app web host only — not for notification API traffic.
+
+---
+
+## Access
+
+1. Use a **non-production** build (for example `build:android:dev`, `build:ios:dev`, or `vite dev` with a non-`production` mode).
+2. Open **Account** → enable **Show All General Advanced Functions**.
+3. Open **Notification Debug Panel** (route `/dev/notifications`).
+
+On native platforms, grant notification permission when prompted so FCM token registration and the debug actions work.
+
+---
+
+## Configuration (Backend Testing)
+
+Settings persist in `localStorage` via `NotificationDebugConfig.ts`:
+
+| Key | Default | Purpose |
+|-----|---------|---------|
+| `notificationDebug.backendBaseUrl` | *(unset — use `DEFAULT_NOTIFY_API_SERVER`)* | Override which notification server receives API calls |
+| `notificationDebug.testMode` | `true` | Sent in JSON request bodies (`testMode: true/false`) |
+| `notificationDebug.bypassAuth` | `false` | When `true`, omit JWT `Authorization` headers on notification API calls |
+
+All notification API requests (`/notifications/register`, `/notifications/refresh`, `/debug/send-wakeup`, etc.) obtain headers through `getNotificationApiHeaders()` in `notificationApiAuth.ts`.
+
+### Notification Backend URL
+
+Paste a base URL (no trailing slash) and tap **Save Backend URL**. This changes **only** which server the app calls (`getNotificationApiBaseUrl()`). It does **not** disable JWT authentication.
+
+Leave empty to use the configured build default (`DEFAULT_NOTIFY_API_SERVER`, from `VITE_DEFAULT_NOTIFY_API_SERVER` or `AppString.PROD_NOTIFY_API_SERVER`). The Debug Panel override still wins whenever a non-empty URL is saved.
+
+### Test Mode
+
+When enabled (default if never saved), register and refresh requests include `"testMode": true` in the JSON body. The backend can use this to return dev-friendly schedules or route test traffic separately from production.
+
+Test Mode is **independent of authentication**. It does not control whether `Authorization` headers are sent.
+
+### Skip JWT Authentication (Local Development Only)
+
+When **off** (default), the app resolves the active DID and sends `Authorization: Bearer …` on notification API calls.
+
+When **on**, requests include only `Content-Type: application/json` — for local servers (localhost or ngrok) that intentionally accept unauthenticated notification requests during development.
+
+Enable this **only** for local development backends that do not require JWT. Hosted shared test servers that require normal app authentication should leave this **off**.
+
+The panel **Backend Status** section shows the active URL, `testMode`, and `bypassAuth` values.
+
+---
+
+## Recommended settings
+
+### Hosted test server
+
+Example: `https://test-notify-api.timesafari.app`
+
+On development and test builds, this host is already the default via `VITE_DEFAULT_NOTIFY_API_SERVER`. You can leave **Notification Backend URL** empty, or paste the same URL explicitly.
+
+| Setting | Value |
+|---------|-------|
+| **Notification Backend URL** | Empty (use default) or `https://test-notify-api.timesafari.app` |
+| **Test Mode** | **ON** (if the server expects `testMode: true`) |
+| **Skip JWT Authentication** | **OFF** |
+
+Ensure the app has an **active identity (DID)** with a valid endorser session so JWT headers can be built.
+
+### Local localhost / ngrok development
+
+Example: `https://abc123.ngrok-free.app` or `http://127.0.0.1:3000`
+
+| Setting | Value |
+|---------|-------|
+| **Notification Backend URL** | Your local or ngrok URL |
+| **Test Mode** | **ON** or **OFF** — match what your local **notification-wakeup-service** expects |
+| **Skip JWT Authentication** | **ON** only if the local server accepts unauthenticated requests; **OFF** if it validates JWT like production |
+
+---
+
+## Backend Testing actions
+
+| Action | What it does |
+|--------|----------------|
+| **Register Token Now** | `POST {backend}/notifications/register` with current FCM token, `deviceId`, `platform`, and `testMode`. Forces re-registration (bypasses duplicate-token skip). |
+| **Refresh Notifications** | `POST {backend}/notifications/refresh` — same path used after a real WAKEUP_PING. Applies returned schedule to the native plugin. |
+| **Simulate WAKEUP_PING (Local)** | Calls the refresh API directly (no FCM). Quick test of backend URL + auth + refresh parsing without push delivery. |
+| **Send Real WAKEUP_PING** | `POST {backend}/debug/send-wakeup`; server sends a real FCM data message with `data.type = "WAKEUP_PING"`. Exercises backend → FCM → Capacitor listener → refresh → reschedule. Background the app before expecting delivery. |
+
+**Current FCM Token** displays the last token from Capacitor/Firebase registration. **Event Log** shows the last 100 `[Notifications]` messages (also visible in logcat / Xcode console on native).
+
+---
+
+## Other panel sections
+
+| Section | Purpose |
+|---------|---------|
+| **Mock Timing Presets** | Interval for mock refresh timestamps (30 sec – 10 min). |
+| **Trigger Mock Refresh** | Applies synthetic future timestamps locally — no backend call. |
+| **Wakeup Ping Simulator** | Runs the production push handler with a synthetic `WAKEUP_PING` payload (no FCM, no backend). |
+| **Flood Test** | Runs 20 sequential mock refreshes (stress test). |
+| **Pending Notification Inspector** | Lists locally scheduled notifications (iOS; Android may show unavailable). |
+| **Clear Notifications** | Clears/cancels all plugin-scheduled notifications on native. |
+
+---
+
+## Programmatic override (optional)
+
+From a WebView dev console (`chrome://inspect` on Android, Safari Web Inspector on iOS):
+
+```javascript
+import {
+  setBackendBaseUrl,
+  setTestMode,
+  setBypassAuth,
+  getNotificationApiBaseUrl,
+} from "@/services/notifications";
+
+setBackendBaseUrl("https://abc123.ngrok-free.app");
+setTestMode(true);
+setBypassAuth(true); // local dev only
+getNotificationApiBaseUrl();
+```
+
+---
+
+## Troubleshooting
+
+### 401 Unauthorized (`registerToken failed: unauthorized`)
+
+**Likely causes:** JWT required but **Skip JWT Authentication** is off and the session is missing or expired; or JWT sent but the server rejected it.
+
+**Checks:**
+
+1. Panel **Backend Status** → `bypassAuth: false` for hosted servers.
+2. App has an active DID and endorser login.
+3. Event Log: look for `Using authenticated notification request` vs `Using debug unauthenticated notification request`.
+4. For hosted test server: keep **Skip JWT Authentication** **OFF**.
+
+**Fixes:** Sign in / restore identity; refresh endorser session; for local ngrok without JWT support, enable **Skip JWT Authentication**.
+
+### `registerToken auth unavailable` / `Waiting for auth before registration`
+
+The app deferred registration because JWT could not be built (no active DID or empty token) and **Skip JWT Authentication** is **off**.
+
+**Fixes:** Complete identity setup in the app, or enable **Skip JWT Authentication** only for an intentionally unauthenticated local backend.
+
+### Failed to fetch / network error
+
+**Likely causes:** Backend down, wrong URL, stale ngrok tunnel, device offline, or TLS/certificate issues.
+
+**Checks:** Panel **Backend Status** URL; `curl -sS "$URL/health"` from your machine; ngrok inspect UI for incoming requests.
+
+**Fixes:** Restart backend and ngrok; **Save Backend URL** with the current HTTPS forwarding URL (no trailing slash).
+
+### Backend unreachable / no requests in ngrok
+
+Same as above. Confirm the **Active** URL in the panel matches your running tunnel or local server port.
+
+### Register succeeds but Send Real WAKEUP_PING does not trigger refresh
+
+**Real WAKEUP_PING success** only means the backend accepted the wakeup request and attempted FCM delivery. Missing `pushNotificationReceived` / `Refresh completed (WAKEUP_PING)` indicates an FCM delivery or background execution issue — not necessarily a bad wakeup API call.
+
+**Checks:** App backgrounded (not force-stopped); FCM token matches registration; **Simulate WAKEUP_PING (Local)** works (isolates FCM from refresh API).
+
+See platform-specific guides for extended ngrok and FCM workflows:
+
+- [local-android-testing-ngrok.md](./local-android-testing-ngrok.md)
+- [local-ios-testing-ngrok.md](./local-ios-testing-ngrok.md)
+
+---
+
+## Key source files
+
+| File | Purpose |
+|------|---------|
+| `src/constants/app.ts` | `DEFAULT_NOTIFY_API_SERVER`, `PROD_NOTIFY_API_SERVER`, `TEST_NOTIFY_API_SERVER` |
+| `src/components/dev/NotificationDebugPanel.vue` | Dev UI |
+| `src/services/notifications/NotificationDebugConfig.ts` | Base URL resolution, testMode, bypassAuth persistence |
+| `src/services/notifications/notificationApiAuth.ts` | JWT vs unauthenticated headers |
+| `src/services/notifications/notificationApiDebugMode.ts` | Auth bypass gate |
+| `src/services/notifications/NotificationDebugService.ts` | Panel action handlers |
+| `src/services/notifications/NotificationService.ts` | `POST /notifications/register` |
+| `src/services/notifications/NativeNotificationService.ts` | `POST /notifications/refresh`, WAKEUP_PING handler |
+
+---
+
+## Related docs
+
+- [notification-system-overview.md](./notification-system-overview.md)
+- [notification-from-api-call.md](./notification-from-api-call.md)
+- [local-android-testing-ngrok.md](./local-android-testing-ngrok.md)
+- [local-ios-testing-ngrok.md](./local-ios-testing-ngrok.md)

doc/notification-from-api-call.md

@@ -59,6 +59,8 @@ The app must:
 
 ### iOS
 
+**Parity outline (API, starred plans, plugin vs app work):** See **`doc/new-activity-notifications-ios-android-parity.md`**.
+
 - **Confirm iOS native fetcher / dual schedule**  
 Plugin exposes `configureNativeFetcher` on iOS. Confirm whether the plugin expects an iOS-specific native fetcher registration (similar to Android’s `setNativeFetcher`) and, if so, register a TimeSafari fetcher implementation for iOS so API-driven notifications work on iPhone.
 - **Verify dual schedule on iOS**  
@@ -99,5 +101,8 @@ Add a short “New Activity notifications” section to BUILDING.md or a user-fa
 | Settings type          | `src/interfaces/accountView.ts`                                         |
 | Android native fetcher | `android/app/src/main/java/app/timesafari/TimeSafariNativeFetcher.java` |
 | Android registration   | `android/app/src/main/java/app/timesafari/MainActivity.java`            |
+| iOS native fetcher     | `ios/App/App/TimeSafariNativeFetcher.swift`                              |
+| iOS registration       | `ios/App/App/AppDelegate.swift` (`DailyNotificationPlugin.registerNativeFetcher`) |
+| Plugin 3.x handoff     | `doc/consuming-app-handoff-ios-native-fetcher-chained-dual.md`           |
 
 

doc/notification-new-activity-lay-of-the-land.md

@@ -220,7 +220,7 @@ The steps and expected notification copy below are **Android-specific**: this re
 
 ## 8. Plugin Repo Alignment and Attention Items
 
-Comparison with the **daily-notification-plugin** repo (e.g. `daily-notification-plugin_test` or gitea `master`) to confirm our documentation and usage line up, and to flag anything that needs attention for the New Activity feature.
+Comparison with the **daily-notification-plugin** repo on gitea (`trent_larson/daily-notification-plugin`, `master` or the tag this app pins) to confirm our documentation and usage line up, and to flag anything that needs attention for the New Activity feature.
 
 ### 8.1 What lines up
 

doc/plan-background-jwt-pool-and-expiry.md

@@ -1,203 +0,0 @@
-# Plan: Background New Activity JWT — extended expiry + token pool
-
-**Date:** 2026-03-27 14:29 PST  
-**Status:** Draft for implementation  
-**Audience:** TimeSafari / crowd-funder developers  
-**Related:** `doc/endorser-jwt-background-prefetch-options.md`, `android/.../TimeSafariNativeFetcher.java`, `src/services/notifications/nativeFetcherConfig.ts`, `src/libs/crypto/index.ts`
-
----
-
-## 1. Problem statement
-
-Background prefetch for New Activity calls Endorser with a Bearer JWT configured via `configureNativeFetcher`. The token previously came from `getHeaders()` → `accessToken()`, which used **`exp` ≈ 60 seconds** (`src/libs/crypto/index.ts`). Prefetch runs **minutes later** in WorkManager **without JavaScript**, so the JWT can be **expired** before the POST (`JWT_VERIFY_FAILED`).
-
-**Goals:**
-
-1. Use JWTs whose **`exp`** covers the gap between **last app-side configure** and **prefetch** (and ideally days without opening the app).
-2. Optionally support a **pool** of distinct JWT strings so Endorser can enforce **duplicate-JWT** / **one-time-use** rules without breaking daily prefetch. **Pool size** should follow **`expiryDays + buffer`** (one distinct token per day over the JWT lifetime, plus headroom for retries / edge cases); **implementation uses `BACKGROUND_JWT_POOL_SIZE = 100`** until policy changes.
-3. Keep pool size and expiry policy **easy to change** (constants / remote config later).
-
----
-
-## 2. Guiding principles
-
-| Principle | Implication |
-|-----------|-------------|
-| **Background has no JS** | Token selection and HTTP must run in **native** (or plugin) code using **persisted** data. |
-| **Single source of truth for signing** | Continue using **`createEndorserJwtForDid`** (same keys as today); do not fork crypto in Java/Kotlin. |
-| **Configurable pool size** | One constant `BACKGROUND_JWT_POOL_SIZE`; **currently 100**. Size should satisfy **`≥ expiryDays + buffer`** (see below). |
-| **Phased delivery** | Ship **extended expiry** first; add **pool** when server duplicate rules require it or in the same release if coordinated. |
-
-### 2.1 Pool size rationale (`expiryDays + buffer`)
-
-For **one New Activity prefetch per day**, each day should use a **distinct** JWT string if the server rejects reuse. Over the JWT lifetime (aligned with **`exp`**), you need at least **one token per day** the pool might be used without regeneration.
-
-**Rule of thumb:**
-
-```text
-BACKGROUND_JWT_POOL_SIZE ≥ ceil(BACKGROUND_JWT_EXPIRY_DAYS) + BACKGROUND_JWT_POOL_BUFFER
-```
-
-- **`BACKGROUND_JWT_EXPIRY_DAYS`** — human-facing match to `exp` (e.g. **90**); convert to `BACKGROUND_JWT_EXPIRY_SECONDS` for the payload.
-- **`BACKGROUND_JWT_POOL_BUFFER`** — extra slots for **same-day retries**, manual tests, or stricter duplicate rules (e.g. **10**).
-
-**Example:** 90‑day `exp` + buffer 10 ⇒ **minimum 100** logical slots. **This plan keeps `BACKGROUND_JWT_POOL_SIZE = 100`** as the shipped default so it matches that example; if `expiryDays` or buffer change later, **bump the constant** so the inequality still holds.
-
----
-
-## 3. Phases
-
-### Phase A — Extended expiry only (minimum viable)
-
-**Scope**
-
-- Introduce a dedicated mint path for **background / native fetcher** use (name TBD, e.g. `accessTokenForBackgroundNotifications(did)`), producing **one** JWT per configure call with:
-  - `iss`: DID (unchanged)
-  - `iat`: now
-  - `exp`: now + **`BACKGROUND_JWT_EXPIRY_SECONDS`** (derived from **`BACKGROUND_JWT_EXPIRY_DAYS`**; see §2.1 / Phase B constants — **confirm** with Endorser policy)
-  - Optional: `jti` or nonce for uniqueness if needed for logging/debug
-
-- **`configureNativeFetcherIfReady`** should pass this token (or keep using a thin wrapper) instead of reusing the **60s** `accessToken()` when configuring native fetcher **only** — **do not** change interactive `getHeaders()` / passkey caching behavior for normal API calls unless product asks for it.
-
-**Files (likely)**
-
-- `src/libs/crypto/index.ts` — new function or parameters; keep `accessToken()` default at 60s for existing callers.
-- `src/services/notifications/nativeFetcherConfig.ts` — obtain background JWT via the new mint path, not `getHeaders()`’s generic path, **or** add a dedicated branch that calls the new mint after resolving `did`.
-
-**Native**
-
-- **`TimeSafariNativeFetcher`**: still one `jwtToken` field; no pool yet. Ensure `configure()` is called whenever TS refreshes (startup, resume, Account — already partially covered).
-
-**Exit criteria**
-
-- Logcat: prefetch POST returns **200** (or non-expired 4xx) when user has not opened the app for several **minutes** after configure.
-- Endorser accepts **`exp`** far enough in the future (coordinate TTL policy).
-
----
-
-### Phase B — Token pool (size 100; driven by `expiryDays + buffer`)
-
-**Why**
-
-- Endorser may **reject duplicate JWT strings** (same bearer used twice). One long-lived token could fail on **day 2** if the server marks each JWT as consumed.
-- A **pool** of **N** distinct JWTs (different payload, e.g. unique `jti` per token) gives **N** independent strings with the same long **`exp`**. **N** should follow **§2.1** (`expiryDays + buffer`); **100** is the initial **`BACKGROUND_JWT_POOL_SIZE`** (satisfies e.g. 90 + 10).
-
-**Scope**
-
-1. **Constants** (single place, e.g. `src/constants/backgroundJwt.ts` or next to native fetcher config):
-
-   ```text
-   BACKGROUND_JWT_EXPIRY_DAYS = 90              // align with Endorser; drives exp
-   BACKGROUND_JWT_EXPIRY_SECONDS = 90 * 24 * 60 * 60  // derived
-   BACKGROUND_JWT_POOL_BUFFER = 10            // retries / headroom; tune with server team
-   BACKGROUND_JWT_POOL_SIZE = 100               // must be >= expiryDays + buffer; adjust if policy changes
-   ```
-
-2. **Mint in TS** (uses `createEndorserJwtForDid`):
-
-   - Loop `i = 0 .. POOL_SIZE - 1`
-   - Payload: `{ iss, iat, exp, jti: `${did}#bg#${i}` or uuid }` — **confirm** `jti` format with Endorser if required.
-
-3. **Persistence** — native code must read the pool **without JS**:
-
-   - **Option B1 (preferred):** Implement in **`@timesafari/daily-notification-plugin`** (not in the app): extend **`configureNativeFetcher`** to accept an optional JWT pool, persist it for native read. **Handoff spec:** `doc/plugin-feedback-daily-notification-configureNativeFetcher-jwt-pool.md` — copy or reference that file in the plugin repo PR.
-   - **Option B2 (app-only, no plugin release):** Write JSON to **Capacitor Preferences** or **encrypted storage** from TS; **TimeSafariNativeFetcher** reads the same store on Android (requires knowing Capacitor’s Android `SharedPreferences` name/key convention or a tiny **bridge** in `MainActivity`). Use only if plugin work is deferred.
-
-4. **Selection policy in `TimeSafariNativeFetcher`** (before each POST):
-
-   - **By calendar day:** `index = (epochDay + offset) % POOL_SIZE` (stable per day).
-   - Or **sequential:** persist `lastUsedIndex` in prefs and increment (wrap). **Decision:** document chosen policy; day-based is easier to reason about for “one token per day.”
-
-5. **configureNativeFetcherIfReady** (and any “reset notifications on startup” hook):
-
-   - Regenerate full pool when user opens app (per product decision), then call configure with pool + **current** `apiBaseUrl` / `did`.
-
-6. **iOS:** When iOS native fetcher exists, mirror Android behavior.
-
-**Exit criteria**
-
-- Prefetch succeeds on **consecutive days** with duplicate-JWT enforcement enabled on a **staging** Endorser.
-- Pool **refreshes** on startup without breaking dual schedule.
-
----
-
-## 4. Detailed tasks (checklist)
-
-### Crypto & TypeScript
-
-- [ ] Add `BACKGROUND_JWT_EXPIRY_DAYS`, `BACKGROUND_JWT_EXPIRY_SECONDS`, `BACKGROUND_JWT_POOL_BUFFER`, and `BACKGROUND_JWT_POOL_SIZE` (exported constants), with a **comment** that `POOL_SIZE >= expiryDays + buffer` (see §2.1).
-- [ ] Implement `mintBackgroundJwtPool(did: string): Promise<string[]>` (or split single + pool).
-- [ ] Ensure each JWT has **unique** `jti` (or equivalent) for duplicate detection.
-- [ ] **Do not** break existing `accessToken()` 60s behavior for unrelated features.
-- [ ] Wire `configureNativeFetcherIfReady` to pass **single extended token** (Phase A) then **pool** (Phase B).
-- [ ] On **logout / identity clear**, clear persisted pool and call plugin clear if needed.
-
-### Android
-
-- [ ] **Phase A:** No structural change if `configure()` still receives one string; verify non-null `jwtToken` after configure.
-- [ ] **Phase B:** Parse pool from persisted JSON; implement `selectTokenForRequest()`; use selected token in `Authorization` header instead of sole `jwtToken` field (keep `configure` for `apiBaseUrl` / `did`).
-- [ ] Unit or instrumentation tests optional: selection index deterministic.
-
-### Plugin (Option B1 — **daily-notification-plugin** repo)
-
-- [ ] Follow **`doc/plugin-feedback-daily-notification-configureNativeFetcher-jwt-pool.md`** (API shape, Android/iOS, versioning).
-- [ ] Release new plugin version; bump dependency in this app.
-
-### Product & server
-
-- [ ] Endorser: confirm **max `exp`**, **duplicate JWT** semantics, recommended **`jti`** format.
-- [ ] Document operational limit: if user never opens app for **longer than `exp` allows** (or longer than **pool × daily use** without refresh), prefetch may fail until next open — align with `doc/endorser-jwt-background-prefetch-options.md`.
-
----
-
-## 5. Security notes
-
-- Longer-lived JWTs and **many** tokens increase impact if device is compromised. Mitigations: **encrypted prefs** where possible, **no logging** of full JWTs, **revocation** story with Endorser (key rotation, deny list).
-- Pool regeneration on **login** should replace old pools.
-
----
-
-## 6. Testing plan
-
-| Test | Expected |
-|------|----------|
-| Configure → wait **> 5 min** → prefetch | **200** from `plansLastUpdatedBetween` (Phase A) |
-| Two consecutive **days** with duplicate-JWT staging | **200** both days (Phase B) |
-| Logout | Pool cleared; no stale bearer |
-| Lower `BACKGROUND_JWT_POOL_SIZE` in dev only (below `expiryDays + buffer`) | Expect possible reuse / server duplicate errors — use to reproduce failures |
-
----
-
-## 7. Rollout / staging
-
-1. Implement Phase A behind feature flag **optional** (or direct if low risk).
-2. Verify on **test-api.endorser.ch** with server team.
-3. Phase B behind flag or same release once server duplicate rules are understood.
-
----
-
-## 8. Where plugin documentation lives
-
-| Document | Purpose |
-|----------|---------|
-| **`doc/plan-background-jwt-pool-and-expiry.md`** (this file) | End-to-end app plan: crypto, pool sizing, native host, rollout. |
-| **`doc/plugin-feedback-daily-notification-configureNativeFetcher-jwt-pool.md`** | **Plugin-only** handoff: extend `configureNativeFetcher`, persist pool, Android/iOS notes — intended for PRs in **daily-notification-plugin** (or Cursor on that repo). |
-
-Keeping them **separate** avoids mixing consumer app tasks with plugin API contract; the plan **links** to the plugin feedback doc for Option B1.
-
----
-
-## 9. References
-
-| Topic | Location |
-|--------|----------|
-| Current 60s `accessToken` | `src/libs/crypto/index.ts` |
-| `createEndorserJwtForDid` | `src/libs/endorserServer.ts` |
-| Native configure | `src/services/notifications/nativeFetcherConfig.ts` |
-| Android HTTP | `android/.../TimeSafariNativeFetcher.java` |
-| Options doc (TTL, refresh, BFF) | `doc/endorser-jwt-background-prefetch-options.md` |
-| Plugin: `configureNativeFetcher` + JWT pool | `doc/plugin-feedback-daily-notification-configureNativeFetcher-jwt-pool.md` |
-
----
-
-*Update this plan when Phase A/B ship or when Endorser policy changes.*

doc/plugin-feedback-android-duplicate-reminder-notification.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-02-18  
 **Generated:** 2026-02-18 17:47:06 PST  
-**Target repo:** daily-notification-plugin (local copy at `daily-notification-plugin_test`)  
+**Target repo:** `@timesafari/daily-notification-plugin` (https://gitea.anomalistdesign.com/trent_larson/daily-notification-plugin)  
 **Consuming app:** crowd-funder-for-time-pwa (TimeSafari)  
 **Platform:** Android
 

doc/plugin-feedback-daily-notification-configureNativeFetcher-jwt-pool.md

@@ -3,7 +3,7 @@
 **Date:** 2026-03-27 PST  
 **Target repo:** `@timesafari/daily-notification-plugin` (daily-notification-plugin)  
 **Consuming app:** crowd-funder-for-time-pwa (TimeSafari)  
-**Related app plan:** `doc/plan-background-jwt-pool-and-expiry.md` (Phase B, Option B1)
+**Related app plan:** `doc/background-jwt-pool.md`
 
 ---
 
@@ -85,7 +85,7 @@ When `configureNativeFetcher` exists on iOS, mirror Android: accept optional poo
 
 | Topic | Location |
 |--------|----------|
-| End-to-end plan (Phase A/B, pool sizing) | `doc/plan-background-jwt-pool-and-expiry.md` |
+| Pool design, slot ordering, lifecycle | `doc/background-jwt-pool.md` |
 | Android fetcher | `android/.../TimeSafariNativeFetcher.java` |
 | Current configure call | `src/services/notifications/nativeFetcherConfig.ts` |
 | JWT options (expired token context) | `doc/endorser-jwt-background-prefetch-options.md` |

doc/sms-notifications.md

@@ -0,0 +1,30 @@
+# SMS Registration
+
+All text providers now require 10DLC registration, which is a horrendous process. (I can refer you to others who have also found the process to be a nightmare. I just tried to look up docs on the official pages and found broken links... cool.)
+
+The functionality here mirrors the server-push FCM functionality. We're taking this approach as well because A) iOS client-side notifications are unreliable, and B) some users prefer to get text messages.
+
+## Details on iOS client-side problems
+
+iOS in particular makes it impossible to guarantee that the user will get notifications,
+even if we separate the data-fetch from the user-notify as designed in the daily-notification-plugin
+
+You can see more details here: https://chatgpt.com/share/69e601ea-6434-8398-8d28-f1a3118f86ad
+... which explains:
+
+```
+That implies one of these patterns:
+
+- Polling (setInterval / timers / background fetch)
+- Service worker / PWA background sync
+- App wake-up logic (foreground or semi-background)
+
+All three are fragile or outright blocked on iOS.
+
+Unlike Android, iOS has these restrictions:
+
+- No persistent timers when app is backgrounded
+- No reliable background fetch at exact times
+- No service worker push for non-installed PWAs (and even then, limited)
+- No “wake up at X time and run JS”
+```

docker/README.md

@@ -133,6 +133,7 @@ VITE_DEFAULT_ENDORSER_API_SERVER=https://dev-api.endorser.ch
 VITE_DEFAULT_IMAGE_API_SERVER=https://dev-image-api.timesafari.app
 VITE_DEFAULT_PARTNER_API_SERVER=https://dev-partner-api.endorser.ch
 VITE_DEFAULT_PUSH_SERVER=https://dev.timesafari.app
+VITE_DEFAULT_NOTIFY_API_SERVER=https://test-notify-api.timesafari.app
 VITE_PASSKEYS_ENABLED=true
 
 # .env.test
@@ -141,6 +142,7 @@ VITE_DEFAULT_ENDORSER_API_SERVER=https://staging-api.endorser.ch
 VITE_DEFAULT_IMAGE_API_SERVER=https://staging-image-api.timesafari.app
 VITE_DEFAULT_PARTNER_API_SERVER=https://staging-partner-api.endorser.ch
 VITE_DEFAULT_PUSH_SERVER=https://staging.timesafari.app
+VITE_DEFAULT_NOTIFY_API_SERVER=https://test-notify-api.timesafari.app
 VITE_PASSKEYS_ENABLED=true
 
 # .env.production
@@ -149,6 +151,7 @@ VITE_DEFAULT_ENDORSER_API_SERVER=https://api.endorser.ch
 VITE_DEFAULT_IMAGE_API_SERVER=https://image-api.timesafari.app
 VITE_DEFAULT_PARTNER_API_SERVER=https://partner-api.endorser.ch
 VITE_DEFAULT_PUSH_SERVER=https://timesafari.app
+VITE_DEFAULT_NOTIFY_API_SERVER=https://notify-api.timesafari.app
 VITE_PASSKEYS_ENABLED=true
 ```
 

ios/App/App.xcodeproj/project.pbxproj

@@ -15,9 +15,13 @@
 		504EC3121FED79650016851F /* LaunchScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 504EC3101FED79650016851F /* LaunchScreen.storyboard */; };
 		50B271D11FEDC1A000F3C39B /* public in Resources */ = {isa = PBXBuildFile; fileRef = 50B271D01FEDC1A000F3C39B /* public */; };
 		97EF2DC6FD76C3643D680B8D /* Pods_App.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 90DCAFB4D8948F7A50C13800 /* Pods_App.framework */; };
+		B7E1C4F82A9D3E506F1B2C8D /* TimeSafariNativeFetcher.swift in Sources */ = {isa = PBXBuildFile; fileRef = A3F8E2D91B4C5E60718293A4 /* TimeSafariNativeFetcher.swift */; };
 		C86585DF2ED456DE00824752 /* TimeSafariShareExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = C86585D52ED456DE00824752 /* TimeSafariShareExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		C8C56E142EE0474B00737D0E /* SharedImageUtility.swift in Sources */ = {isa = PBXBuildFile; fileRef = C8C56E132EE0474B00737D0E /* SharedImageUtility.swift */; };
 		C8C56E162EE064CB00737D0E /* SharedImagePlugin.swift in Sources */ = {isa = PBXBuildFile; fileRef = C8C56E152EE064CA00737D0E /* SharedImagePlugin.swift */; };
+		C8E73DD12FC6E5DC0057F59A /* GoogleService-Info.plist in Resources */ = {isa = PBXBuildFile; fileRef = C8E73DD02FC6E5DC0057F59A /* GoogleService-Info.plist */; };
+		C8E73DD22FC6E5DC0057F59A /* GoogleService-Info.plist in Resources */ = {isa = PBXBuildFile; fileRef = C8E73DD02FC6E5DC0057F59A /* GoogleService-Info.plist */; };
+		E9F1A0022EE05A8B00737D01 /* NotificationInspectorPlugin.swift in Sources */ = {isa = PBXBuildFile; fileRef = E9F1A0012EE05A8B00737D01 /* NotificationInspectorPlugin.swift */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -55,11 +59,15 @@
 		504EC3131FED79650016851F /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		50B271D01FEDC1A000F3C39B /* public */ = {isa = PBXFileReference; lastKnownFileType = folder; path = public; sourceTree = "<group>"; };
 		90DCAFB4D8948F7A50C13800 /* Pods_App.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_App.framework; sourceTree = BUILT_PRODUCTS_DIR; };
+		A3F8E2D91B4C5E60718293A4 /* TimeSafariNativeFetcher.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = TimeSafariNativeFetcher.swift; sourceTree = "<group>"; };
 		C86585D52ED456DE00824752 /* TimeSafariShareExtension.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = TimeSafariShareExtension.appex; sourceTree = BUILT_PRODUCTS_DIR; };
 		C86585E52ED4577F00824752 /* App.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = App.entitlements; sourceTree = "<group>"; };
 		C8C56E132EE0474B00737D0E /* SharedImageUtility.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SharedImageUtility.swift; sourceTree = "<group>"; };
 		C8C56E152EE064CA00737D0E /* SharedImagePlugin.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SharedImagePlugin.swift; sourceTree = "<group>"; };
+		C8E73DD02FC6E5DC0057F59A /* GoogleService-Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "GoogleService-Info.plist"; sourceTree = "<group>"; };
+		C8E73DD32FC6ECC30057F59A /* AppDebug.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = AppDebug.entitlements; sourceTree = "<group>"; };
 		E2E9297D5D02C549106C77F9 /* Pods-App.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-App.release.xcconfig"; path = "Target Support Files/Pods-App/Pods-App.release.xcconfig"; sourceTree = "<group>"; };
+		E9F1A0012EE05A8B00737D01 /* NotificationInspectorPlugin.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NotificationInspectorPlugin.swift; sourceTree = "<group>"; };
 		EAEC6436E595F7CD3A1C9E96 /* Pods-App.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-App.debug.xcconfig"; path = "Target Support Files/Pods-App/Pods-App.debug.xcconfig"; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
@@ -74,18 +82,7 @@
 /* End PBXFileSystemSynchronizedBuildFileExceptionSet section */
 
 /* Begin PBXFileSystemSynchronizedRootGroup section */
-		C86585D62ED456DE00824752 /* TimeSafariShareExtension */ = {
-			isa = PBXFileSystemSynchronizedRootGroup;
-			exceptions = (
-				C86585E32ED456DE00824752 /* PBXFileSystemSynchronizedBuildFileExceptionSet */,
-			);
-			explicitFileTypes = {
-			};
-			explicitFolders = (
-			);
-			path = TimeSafariShareExtension;
-			sourceTree = "<group>";
-		};
+		C86585D62ED456DE00824752 /* TimeSafariShareExtension */ = {isa = PBXFileSystemSynchronizedRootGroup; exceptions = (C86585E32ED456DE00824752 /* PBXFileSystemSynchronizedBuildFileExceptionSet */, ); explicitFileTypes = {}; explicitFolders = (); path = TimeSafariShareExtension; sourceTree = "<group>"; };
 /* End PBXFileSystemSynchronizedRootGroup section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -138,8 +135,11 @@
 		504EC3061FED79650016851F /* App */ = {
 			isa = PBXGroup;
 			children = (
+				C8E73DD32FC6ECC30057F59A /* AppDebug.entitlements */,
 				C8C56E152EE064CA00737D0E /* SharedImagePlugin.swift */,
+				E9F1A0012EE05A8B00737D01 /* NotificationInspectorPlugin.swift */,
 				C8C56E132EE0474B00737D0E /* SharedImageUtility.swift */,
+				A3F8E2D91B4C5E60718293A4 /* TimeSafariNativeFetcher.swift */,
 				C86585E52ED4577F00824752 /* App.entitlements */,
 				50379B222058CBB4000EE86E /* capacitor.config.json */,
 				504EC3071FED79650016851F /* AppDelegate.swift */,
@@ -149,6 +149,7 @@
 				504EC3131FED79650016851F /* Info.plist */,
 				2FAD9762203C412B000D30F8 /* config.xml */,
 				50B271D01FEDC1A000F3C39B /* public */,
+				C8E73DD02FC6E5DC0057F59A /* GoogleService-Info.plist */,
 			);
 			path = App;
 			sourceTree = "<group>";
@@ -174,9 +175,9 @@
 				504EC3011FED79650016851F /* Frameworks */,
 				504EC3021FED79650016851F /* Resources */,
 				012076E8FFE4BF260A79B034 /* Fix Privacy Manifest */,
-				3525031ED1C96EF4CF6E9959 /* [CP] Embed Pods Frameworks */,
 				96A7EF592DF3366D00084D51 /* Fix Privacy Manifest */,
 				C86585E02ED456DE00824752 /* Embed Foundation Extensions */,
+				3FE25897CF40A571D4AC2ACE /* [CP] Copy Pods Resources */,
 			);
 			buildRules = (
 			);
@@ -204,8 +205,6 @@
 				C86585D62ED456DE00824752 /* TimeSafariShareExtension */,
 			);
 			name = TimeSafariShareExtension;
-			packageProductDependencies = (
-			);
 			productName = TimeSafariShareExtension;
 			productReference = C86585D52ED456DE00824752 /* TimeSafariShareExtension.appex */;
 			productType = "com.apple.product-type.app-extension";
@@ -218,7 +217,7 @@
 			attributes = {
 				BuildIndependentTargetsInParallel = YES;
 				LastSwiftUpdateCheck = 2610;
-				LastUpgradeCheck = 1630;
+				LastUpgradeCheck = 2660;
 				TargetAttributes = {
 					504EC3031FED79650016851F = {
 						CreatedOnToolsVersion = 9.2;
@@ -260,6 +259,7 @@
 				50379B232058CBB4000EE86E /* capacitor.config.json in Resources */,
 				504EC30D1FED79650016851F /* Main.storyboard in Resources */,
 				2FAD9763203C412B000D30F8 /* config.xml in Resources */,
+				C8E73DD12FC6E5DC0057F59A /* GoogleService-Info.plist in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -267,6 +267,7 @@
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				C8E73DD22FC6E5DC0057F59A /* GoogleService-Info.plist in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -293,19 +294,19 @@
 			shellScript = "\"${PROJECT_DIR}/app_privacy_manifest_fixer/fixer.sh\" \n";
 			showEnvVarsInLog = 0;
 		};
-		3525031ED1C96EF4CF6E9959 /* [CP] Embed Pods Frameworks */ = {
+		3FE25897CF40A571D4AC2ACE /* [CP] Copy Pods Resources */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			inputPaths = (
 			);
-			name = "[CP] Embed Pods Frameworks";
+			name = "[CP] Copy Pods Resources";
 			outputPaths = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "\"${PODS_ROOT}/Target Support Files/Pods-App/Pods-App-frameworks.sh\"\n";
+			shellScript = "\"${PODS_ROOT}/Target Support Files/Pods-App/Pods-App-resources.sh\"\n";
 			showEnvVarsInLog = 0;
 		};
 		92977BEA1068CC097A57FC77 /* [CP] Check Pods Manifest.lock */ = {
@@ -357,8 +358,10 @@
 			buildActionMask = 2147483647;
 			files = (
 				C8C56E162EE064CB00737D0E /* SharedImagePlugin.swift in Sources */,
+				E9F1A0022EE05A8B00737D01 /* NotificationInspectorPlugin.swift in Sources */,
 				504EC3081FED79650016851F /* AppDelegate.swift in Sources */,
 				C8C56E142EE0474B00737D0E /* SharedImageUtility.swift in Sources */,
+				B7E1C4F82A9D3E506F1B2C8D /* TimeSafariNativeFetcher.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -456,6 +459,7 @@
 				MTL_ENABLE_DEBUG_INFO = YES;
 				ONLY_ACTIVE_ARCH = YES;
 				SDKROOT = iphoneos;
+				STRING_CATALOG_GENERATE_SYMBOLS = YES;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
 			};
@@ -511,6 +515,7 @@
 				IPHONEOS_DEPLOYMENT_TARGET = 13.0;
 				MTL_ENABLE_DEBUG_INFO = NO;
 				SDKROOT = iphoneos;
+				STRING_CATALOG_GENERATE_SYMBOLS = YES;
 				SWIFT_COMPILATION_MODE = wholemodule;
 				SWIFT_OPTIMIZATION_LEVEL = "-O";
 				VALIDATE_PRODUCT = YES;
@@ -522,7 +527,8 @@
 			baseConfigurationReference = EAEC6436E595F7CD3A1C9E96 /* Pods-App.debug.xcconfig */;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_ENTITLEMENTS = App/App.entitlements;
+				CLANG_ENABLE_MODULES = YES;
+				CODE_SIGN_ENTITLEMENTS = App/AppDebug.entitlements;
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 65;
 				DEVELOPMENT_TEAM = GM3FS5JQPH;
@@ -550,6 +556,7 @@
 			baseConfigurationReference = E2E9297D5D02C549106C77F9 /* Pods-App.release.xcconfig */;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				CLANG_ENABLE_MODULES = YES;
 				CODE_SIGN_ENTITLEMENTS = App/App.entitlements;
 				CODE_SIGN_STYLE = Automatic;
 				CURRENT_PROJECT_VERSION = 65;

ios/App/App.xcodeproj/xcshareddata/xcschemes/App.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "1630"
+   LastUpgradeVersion = "2660"
    version = "1.7">
    <BuildAction
       parallelizeBuildables = "YES"

ios/App/App/AppDebug.entitlements

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>aps-environment</key>
+	<string>development</string>
+	<key>com.apple.security.application-groups</key>
+	<array>
+		<string>group.app.timesafari.share</string>
+	</array>
+</dict>
+</plist>

ios/App/App/AppDelegate.swift

@@ -1,6 +1,7 @@
 import UIKit
 import Capacitor
 import CapacitorCommunitySqlite
+import TimesafariDailyNotificationPlugin
 import UserNotifications
 
 @UIApplicationMain
@@ -9,6 +10,9 @@ class AppDelegate: UIResponder, UIApplicationDelegate, UNUserNotificationCenterD
     var window: UIWindow?
 
     func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
+        // New Activity / dual schedule: plugin requires a registered native fetcher before configureNativeFetcher (parity with Android setNativeFetcher).
+        DailyNotificationPlugin.registerNativeFetcher(TimeSafariNativeFetcher.shared)
+
         // Set notification center delegate so notifications show in foreground and rollover is triggered
         UNUserNotificationCenter.current().delegate = self
 
@@ -25,6 +29,7 @@ class AppDelegate: UIResponder, UIApplicationDelegate, UNUserNotificationCenterD
             attempts += 1
             if registerSharedImagePlugin() {
                 print("[AppDelegate] ✅ Plugin registration successful on attempt \(attempts)")
+                _ = registerNotificationInspectorPlugin()
             } else if attempts < maxAttempts {
                 DispatchQueue.main.asyncAfter(deadline: .now() + Double(attempts) * 0.5) {
                     tryRegister()
@@ -60,6 +65,20 @@ class AppDelegate: UIResponder, UIApplicationDelegate, UNUserNotificationCenterD
         return true
     }
 
+    @discardableResult
+    private func registerNotificationInspectorPlugin() -> Bool {
+        guard let window = self.window,
+              let bridgeVC = window.rootViewController as? CAPBridgeViewController,
+              let bridge = bridgeVC.bridge else {
+            return false
+        }
+
+        let pluginInstance = NotificationInspectorPlugin()
+        bridge.registerPluginInstance(pluginInstance)
+        print("[AppDelegate] ✅ Registered NotificationInspectorPlugin (exposed as 'NotificationInspector')")
+        return true
+    }
+
     func applicationWillResignActive(_ application: UIApplication) {
         // Sent when the application is about to move from active to inactive state. This can occur for certain types of temporary interruptions (such as an incoming phone call or SMS message) or when the user quits the application and it begins the transition to the background state.
         // Use this method to pause ongoing tasks, disable timers, and invalidate graphics rendering callbacks. Games should use this method to pause the game.
@@ -89,13 +108,20 @@ class AppDelegate: UIResponder, UIApplicationDelegate, UNUserNotificationCenterD
     /// Show notifications when app is in foreground and post DailyNotificationDelivered for rollover.
     func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) {
         let userInfo = notification.request.content.userInfo
-        if let notificationId = userInfo["notification_id"] as? String,
-           let scheduledTime = userInfo["scheduled_time"] as? Int64 {
-            NotificationCenter.default.post(
-                name: NSNotification.Name("DailyNotificationDelivered"),
-                object: nil,
-                userInfo: ["notification_id": notificationId, "scheduled_time": scheduledTime]
-            )
+        if let notificationId = userInfo["notification_id"] as? String {
+            let scheduledTime: Int64? = {
+                if let v = userInfo["scheduled_time"] as? Int64 { return v }
+                if let n = userInfo["scheduled_time"] as? NSNumber { return n.int64Value }
+                if let i = userInfo["scheduled_time"] as? Int { return Int64(i) }
+                return nil
+            }()
+            if let scheduledTime = scheduledTime {
+                NotificationCenter.default.post(
+                    name: NSNotification.Name("DailyNotificationDelivered"),
+                    object: nil,
+                    userInfo: ["notification_id": notificationId, "scheduled_time": scheduledTime]
+                )
+            }
         }
         if #available(iOS 14.0, *) {
             completionHandler([.banner, .sound, .badge])

ios/App/App/GoogleService-Info.plist

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>API_KEY</key>
+	<string>AIzaSyDhiy46kW7TH4VvUxzl2pOTLEK7mT14mIo</string>
+	<key>GCM_SENDER_ID</key>
+	<string>1094643115061</string>
+	<key>PLIST_VERSION</key>
+	<string>1</string>
+	<key>BUNDLE_ID</key>
+	<string>app.timesafari</string>
+	<key>PROJECT_ID</key>
+	<string>pc-api-7249509642322112640-286</string>
+	<key>STORAGE_BUCKET</key>
+	<string>pc-api-7249509642322112640-286.firebasestorage.app</string>
+	<key>IS_ADS_ENABLED</key>
+	<false></false>
+	<key>IS_ANALYTICS_ENABLED</key>
+	<false></false>
+	<key>IS_APPINVITE_ENABLED</key>
+	<true></true>
+	<key>IS_GCM_ENABLED</key>
+	<true></true>
+	<key>IS_SIGNIN_ENABLED</key>
+	<true></true>
+	<key>GOOGLE_APP_ID</key>
+	<string>1:1094643115061:ios:587b9422d019375e887d7c</string>
+</dict>
+</plist>

ios/App/App/Info.plist

@@ -2,6 +2,13 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>BGTaskSchedulerPermittedIdentifiers</key>
+	<array>
+		<string>org.timesafari.dailynotification.fetch</string>
+		<string>org.timesafari.dailynotification.notify</string>
+		<string>org.timesafari.dailynotification.content-fetch</string>
+		<string>org.timesafari.dailynotification.notification-delivery</string>
+	</array>
 	<key>CFBundleDevelopmentRegion</key>
 	<string>en</string>
 	<key>CFBundleDisplayName</key>
@@ -18,6 +25,17 @@
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
 	<string>$(MARKETING_VERSION)</string>
+	<key>CFBundleURLTypes</key>
+	<array>
+		<dict>
+			<key>CFBundleURLName</key>
+			<string>app.timesafari</string>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>timesafari</string>
+			</array>
+		</dict>
+	</array>
 	<key>CFBundleVersion</key>
 	<string>$(CURRENT_PROJECT_VERSION)</string>
 	<key>LSRequiresIPhoneOS</key>
@@ -26,6 +44,14 @@
 	<string>Time Safari allows you to take photos, and also scan QR codes from contacts.</string>
 	<key>NSPhotoLibraryUsageDescription</key>
 	<string>Time Safari allows you to upload photos.</string>
+	<key>NSUserNotificationAlertStyle</key>
+	<string>alert</string>
+	<key>UIBackgroundModes</key>
+	<array>
+		<string>fetch</string>
+		<string>processing</string>
+		<string>remote-notification</string>
+	</array>
 	<key>UILaunchStoryboardName</key>
 	<string>LaunchScreen</string>
 	<key>UIMainStoryboardFile</key>
@@ -47,30 +73,5 @@
 	</array>
 	<key>UIViewControllerBasedStatusBarAppearance</key>
 	<true/>
-	<key>CFBundleURLTypes</key>
-	<array>
-		<dict>
-			<key>CFBundleURLName</key>
-			<string>app.timesafari</string>
-			<key>CFBundleURLSchemes</key>
-			<array>
-				<string>timesafari</string>
-			</array>
-		</dict>
-	</array>
-	<key>UIBackgroundModes</key>
-	<array>
-		<string>fetch</string>
-		<string>processing</string>
-	</array>
-	<key>BGTaskSchedulerPermittedIdentifiers</key>
-	<array>
-		<string>org.timesafari.dailynotification.fetch</string>
-		<string>org.timesafari.dailynotification.notify</string>
-		<string>org.timesafari.dailynotification.content-fetch</string>
-		<string>org.timesafari.dailynotification.notification-delivery</string>
-	</array>
-	<key>NSUserNotificationAlertStyle</key>
-	<string>alert</string>
 </dict>
 </plist>

ios/App/App/NotificationInspectorPlugin.swift

@@ -0,0 +1,88 @@
+import Foundation
+import Capacitor
+import UserNotifications
+
+// DEV-only diagnostic plugin.
+// Kept separate from DailyNotificationPlugin intentionally
+// to avoid altering production notification scheduling behavior.
+
+@objc(NotificationInspector)
+public class NotificationInspectorPlugin: CAPPlugin, CAPBridgedPlugin {
+    public var identifier: String { "NotificationInspector" }
+    public var jsName: String { "NotificationInspector" }
+    public var pluginMethods: [CAPPluginMethod] {
+        [
+            CAPPluginMethod(#selector(getPendingNotifications(_:)), returnType: .promise)
+        ]
+    }
+
+    /// Stable wall-clock target: plugin `userInfo["scheduled_time"]`, or epoch ms in API notification identifiers.
+    /// (Apple documents `UNTimeIntervalNotificationTrigger.nextTriggerDate()` as resampling ~now+interval when queried.)
+    /// API notification identifiers use the `api_` prefix.
+    private static let apiNotificationIdentifierPrefix = "api_"
+
+    private func wallClockMillis(from request: UNNotificationRequest) -> (ms: Int64, source: String)? {
+        let info = request.content.userInfo
+        if let v = info["scheduled_time"] as? Int64 {
+            return (v, "userInfo.scheduled_time")
+        }
+        if let n = info["scheduled_time"] as? NSNumber {
+            return (n.int64Value, "userInfo.scheduled_time")
+        }
+        if let i = info["scheduled_time"] as? Int {
+            return (Int64(i), "userInfo.scheduled_time")
+        }
+        let prefix = Self.apiNotificationIdentifierPrefix
+        if request.identifier.hasPrefix(prefix) {
+            let suffix = String(request.identifier.dropFirst(prefix.count))
+            if let ms = Int64(suffix) {
+                return (ms, "identifier (API notification)")
+            }
+        }
+        return nil
+    }
+
+    @objc public func getPendingNotifications(_ call: CAPPluginCall) {
+        UNUserNotificationCenter.current().getPendingNotificationRequests { requests in
+            let pending: [[String: Any]] = requests.map { req in
+                var nextTriggerMs: NSNumber? = nil
+                var triggerType: String? = nil
+
+                if let trigger = req.trigger as? UNCalendarNotificationTrigger {
+                    triggerType = "calendar"
+                    if let next = trigger.nextTriggerDate() {
+                        nextTriggerMs = NSNumber(value: Int64(next.timeIntervalSince1970 * 1000))
+                    }
+                } else if let trigger = req.trigger as? UNTimeIntervalNotificationTrigger {
+                    triggerType = "timeInterval"
+                    if let next = trigger.nextTriggerDate() {
+                        nextTriggerMs = NSNumber(value: Int64(next.timeIntervalSince1970 * 1000))
+                    }
+                } else if req.trigger != nil {
+                    triggerType = "other"
+                } else {
+                    triggerType = nil
+                }
+
+                var obj: [String: Any] = [
+                    "identifier": req.identifier
+                ]
+                obj["nextTriggerDate"] = nextTriggerMs ?? NSNull()
+                obj["triggerType"] = triggerType ?? NSNull()
+                if let wall = self.wallClockMillis(from: req) {
+                    obj["wallClockMillis"] = NSNumber(value: wall.ms)
+                    obj["wallClockSource"] = wall.source
+                } else {
+                    obj["wallClockMillis"] = NSNull()
+                    obj["wallClockSource"] = NSNull()
+                }
+                return obj
+            }
+
+            call.resolve([
+                "pending": pending
+            ])
+        }
+    }
+}
+

ios/App/App/TimeSafariNativeFetcher.swift

@@ -0,0 +1,223 @@
+import Foundation
+import TimesafariDailyNotificationPlugin
+
+/// Native content fetcher for API-driven New Activity notifications on iOS.
+/// Mirrors `TimeSafariNativeFetcher.java` (POST `plansLastUpdatedBetween`, starred plans, JWT pool, pagination).
+final class TimeSafariNativeFetcher: NativeNotificationContentFetcher {
+    static let shared = TimeSafariNativeFetcher()
+
+    private let endpoint = "/api/v2/report/plansLastUpdatedBetween"
+    private let readTimeoutSec: TimeInterval = 15
+    private let maxRetries = 3
+    private let retryDelayMs = 1_000
+
+    /// Matches plugin `updateStarredPlans` storage (`DailyNotificationPlugin.swift`).
+    private let prefsStarredKey = "daily_notification_timesafari.starredPlanIds"
+    /// Matches Java `TimeSafariNativeFetcher` prefs namespace `daily_notification_timesafari` + `last_acked_jwt_id`.
+    private let prefsLastAckedKey = "daily_notification_timesafari.last_acked_jwt_id"
+
+    private var apiBaseUrl: String?
+    private var activeDid: String?
+    private var jwtToken: String?
+    private var jwtTokenPool: [String]?
+
+    private init() {}
+
+    func configure(apiBaseUrl: String, activeDid: String, jwtToken: String, jwtTokenPool: [String]?) {
+        self.apiBaseUrl = apiBaseUrl.trimmingCharacters(in: .whitespacesAndNewlines).replacingOccurrences(
+            of: "/$",
+            with: "",
+            options: .regularExpression
+        )
+        self.activeDid = activeDid
+        self.jwtToken = jwtToken
+        self.jwtTokenPool = (jwtTokenPool?.isEmpty == false) ? jwtTokenPool : nil
+    }
+
+    func fetchContent(context: FetchContext) async throws -> [NotificationContent] {
+        try await fetchContentWithRetry(context: context, retryCount: 0)
+    }
+
+    /// Picks the pool entry whose validity window covers today, falling back to the
+    /// primary `jwtToken` when no pool is configured. Same arithmetic as Java.
+    ///
+    /// Each pooled JWT carries nbf/exp spanning exactly one UTC day, and the minter
+    /// (`mintBackgroundJwtTokenPool`) files the token for a given day at index
+    /// `epochDay % size`. That is why the index below is the raw epoch day rather than
+    /// a count from when the pool arrived: this side keeps no mint date, and the same
+    /// arithmetic on both ends is what lines the slot up with the day it covers.
+    /// A token read from the wrong slot is outside its window and Endorser rejects it.
+    private func selectBearerTokenForRequest() -> String? {
+        guard let pool = jwtTokenPool, !pool.isEmpty else { return jwtToken }
+        let epochDay = Int64(Date().timeIntervalSince1970 * 1000) / (24 * 60 * 60 * 1000)
+        let idx = Int(epochDay) % pool.count
+        let t = pool[idx]
+        if t.isEmpty { return jwtToken }
+        return t
+    }
+
+    private func fetchContentWithRetry(context: FetchContext, retryCount: Int) async throws -> [NotificationContent] {
+        guard let base = apiBaseUrl, !base.isEmpty,
+              activeDid != nil,
+              let bearer = selectBearerTokenForRequest(), !bearer.isEmpty
+        else {
+            NSLog("[TimeSafariNativeFetcher] Not configured; call configureNativeFetcher from JS first.")
+            return []
+        }
+
+        guard let url = URL(string: base + endpoint) else {
+            return []
+        }
+
+        var request = URLRequest(url: url)
+        request.httpMethod = "POST"
+        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        request.setValue("Bearer \(bearer)", forHTTPHeaderField: "Authorization")
+        request.timeoutInterval = readTimeoutSec
+
+        let planIds = getStarredPlanIds()
+        var afterId = getLastAcknowledgedJwtId() ?? "0"
+        if afterId.isEmpty { afterId = "0" }
+
+        let body: [String: Any] = [
+            "planIds": planIds,
+            "afterId": afterId,
+        ]
+        request.httpBody = try JSONSerialization.data(withJSONObject: body)
+
+        NSLog(
+            "[TimeSafariNativeFetcher] POST \(endpoint) planCount=\(planIds.count) afterId=\(afterId.prefix(12))…"
+        )
+
+        let config = URLSessionConfiguration.ephemeral
+        config.timeoutIntervalForRequest = readTimeoutSec
+        config.timeoutIntervalForResource = readTimeoutSec
+        let session = URLSession(configuration: config)
+
+        do {
+            let (data, response) = try await session.data(for: request)
+            guard let http = response as? HTTPURLResponse else {
+                return []
+            }
+
+            if http.statusCode == 200 {
+                let bodyStr = String(data: data, encoding: .utf8) ?? ""
+                let contents = parseApiResponse(responseBody: bodyStr, context: context)
+                if !contents.isEmpty {
+                    updateLastAckedJwtIdFromResponse(responseBody: bodyStr)
+                }
+                return contents
+            }
+
+            if retryCount < maxRetries && (http.statusCode >= 500 || http.statusCode == 429) {
+                let delayMs = retryDelayMs * (1 << retryCount)
+                try await Task.sleep(nanoseconds: UInt64(delayMs) * 1_000_000)
+                return try await fetchContentWithRetry(context: context, retryCount: retryCount + 1)
+            }
+
+            NSLog("[TimeSafariNativeFetcher] API error \(http.statusCode)")
+            return []
+        } catch {
+            NSLog("[TimeSafariNativeFetcher] Fetch failed: \(error.localizedDescription)")
+            if retryCount < maxRetries {
+                let delayMs = retryDelayMs * (1 << retryCount)
+                try await Task.sleep(nanoseconds: UInt64(delayMs) * 1_000_000)
+                return try await fetchContentWithRetry(context: context, retryCount: retryCount + 1)
+            }
+            return []
+        }
+    }
+
+    private func getStarredPlanIds() -> [String] {
+        guard let jsonStr = UserDefaults.standard.string(forKey: prefsStarredKey),
+              !jsonStr.isEmpty, jsonStr != "[]",
+              let data = jsonStr.data(using: .utf8),
+              let arr = try? JSONSerialization.jsonObject(with: data) as? [Any]
+        else {
+            return []
+        }
+        return arr.compactMap { $0 as? String }
+    }
+
+    private func getLastAcknowledgedJwtId() -> String? {
+        let s = UserDefaults.standard.string(forKey: prefsLastAckedKey)
+        return (s?.isEmpty == false) ? s : nil
+    }
+
+    private func updateLastAckedJwtIdFromResponse(responseBody: String) {
+        guard let data = responseBody.data(using: .utf8),
+              let root = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let dataArray = root["data"] as? [[String: Any]], !dataArray.isEmpty
+        else { return }
+
+        let lastItem = dataArray[dataArray.count - 1]
+        var jwtId: String?
+        if let j = lastItem["jwtId"] as? String {
+            jwtId = j
+        } else if let plan = lastItem["plan"] as? [String: Any], let j = plan["jwtId"] as? String {
+            jwtId = j
+        }
+        if let jwtId = jwtId, !jwtId.isEmpty {
+            UserDefaults.standard.set(jwtId, forKey: prefsLastAckedKey)
+        }
+    }
+
+    private func extractProjectDisplayTitle(_ item: [String: Any]) -> String {
+        if let plan = item["plan"] as? [String: Any],
+           let name = plan["name"] as? String,
+           !name.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
+            return name.trimmingCharacters(in: .whitespacesAndNewlines)
+        }
+        return "Unnamed Project"
+    }
+
+    private func extractJwtIdFromItem(_ item: [String: Any]) -> String? {
+        if let plan = item["plan"] as? [String: Any], let j = plan["jwtId"] as? String, !j.isEmpty {
+            return j
+        }
+        if let j = item["jwtId"] as? String, !j.isEmpty { return j }
+        return nil
+    }
+
+    private func parseApiResponse(responseBody: String, context: FetchContext) -> [NotificationContent] {
+        guard let data = responseBody.data(using: .utf8),
+              let root = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let dataArray = root["data"] as? [[String: Any]], !dataArray.isEmpty
+        else {
+            return []
+        }
+
+        let firstItem = dataArray[0]
+        let firstTitle = extractProjectDisplayTitle(firstItem)
+        let jwtId = extractJwtIdFromItem(firstItem)
+        let nowMs = Int64(Date().timeIntervalSince1970 * 1000)
+        let scheduledMs: Int64 = context.scheduledTimeMillis ?? (nowMs + 3_600_000)
+
+        let n = dataArray.count
+        let quotedFirst = "\u{201C}\(firstTitle)\u{201D}"
+        let title: String
+        let body: String
+        if n == 1 {
+            title = "Starred Project Update"
+            body = "\(quotedFirst) has been updated."
+        } else {
+            title = "Starred Project Updates"
+            let more = n - 1
+            body = "\(quotedFirst) + \(more) more have been updated."
+        }
+
+        let id = "endorser_\(jwtId ?? "batch_\(nowMs)")"
+        return [
+            NotificationContent(
+                id: id,
+                title: title,
+                body: body,
+                scheduledTime: scheduledMs,
+                fetchedAt: nowMs,
+                url: apiBaseUrl,
+                payload: nil,
+                etag: nil
+            ),
+        ]
+    }
+}

ios/App/Podfile

@@ -1,7 +1,8 @@
 require_relative '../../node_modules/@capacitor/ios/scripts/pods_helpers'
 
 platform :ios, '13.0'
-use_frameworks!
+# Static linkage helps isolate SQLCipher from Apple's system SQLite module/headers.
+use_frameworks! :linkage => :static
 
 # workaround to avoid Xcode caching of Pods that requires
 # Product -> Clean Build Folder after new Cordova plugins installed
@@ -17,6 +18,8 @@ def capacitor_pods
   pod 'CapacitorCamera', :path => '../../node_modules/@capacitor/camera'
   pod 'CapacitorClipboard', :path => '../../node_modules/@capacitor/clipboard'
   pod 'CapacitorFilesystem', :path => '../../node_modules/@capacitor/filesystem'
+  pod 'CapacitorPreferences', :path => '../../node_modules/@capacitor/preferences'
+  pod 'CapacitorPushNotifications', :path => '../../node_modules/@capacitor/push-notifications'
   pod 'CapacitorShare', :path => '../../node_modules/@capacitor/share'
   pod 'CapacitorStatusBar', :path => '../../node_modules/@capacitor/status-bar'
   pod 'CapawesomeCapacitorFilePicker', :path => '../../node_modules/@capawesome/capacitor-file-picker'
@@ -28,11 +31,92 @@ target 'App' do
   # Add your Pods here
 end
 
+def merge_sqlite_omit_load_extension_definition(config)
+  defs = config.build_settings['GCC_PREPROCESSOR_DEFINITIONS']
+  if defs.nil?
+    config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] = ['$(inherited)', 'SQLITE_OMIT_LOAD_EXTENSION']
+  elsif defs.is_a?(Array)
+    unless defs.any? { |d| d.to_s.include?('SQLITE_OMIT_LOAD_EXTENSION') }
+      config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] = defs + ['SQLITE_OMIT_LOAD_EXTENSION']
+    end
+  else
+    s = defs.to_s
+    unless s.include?('SQLITE_OMIT_LOAD_EXTENSION')
+      config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] = "#{s} SQLITE_OMIT_LOAD_EXTENSION".squeeze(' ').strip
+    end
+  end
+end
+
+def strip_system_sqlite_from_pod_config(config)
+  bad_header = lambda do |path|
+    p = path.to_s
+    p.include?('/usr/include') || p.include?('/usr/local/include')
+  end
+  %w[HEADER_SEARCH_PATHS USER_HEADER_SEARCH_PATHS].each do |key|
+    paths = config.build_settings[key]
+    next unless paths
+    if paths.is_a?(Array)
+      config.build_settings[key] = paths.reject(&bad_header)
+    else
+      kept = paths.to_s.split(/\s+/).reject(&bad_header)
+      config.build_settings[key] = kept.join(' ')
+    end
+  end
+  %w[OTHER_LDFLAGS OTHER_LIBTOOLFLAGS].each do |key|
+    val = config.build_settings[key]
+    next unless val
+    if val.is_a?(Array)
+      config.build_settings[key] = val.reject do |x|
+        s = x.to_s
+        s.match?(/libsqlite3\.tbd/) || s == '-l"sqlite3"' || s.match?(/-l\s*sqlite3\b/)
+      end
+    else
+      s = val.to_s.gsub(/\s*-l"sqlite3"\s+/, ' ')
+           .gsub(/\s*-l\s*sqlite3\b/, ' ')
+           .gsub(/[^\s]*libsqlite3\.tbd[^\s]*/, ' ')
+      config.build_settings[key] = s.squeeze(' ').strip
+    end
+  end
+end
+
 post_install do |installer|
   assertDeploymentTarget(installer)
   installer.pods_project.targets.each do |target|
     target.build_configurations.each do |config|
       config.build_settings['EXCLUDED_ARCHS[sdk=iphonesimulator*]'] = 'arm64'
+      config.build_settings['CLANG_ALLOW_NON_MODULAR_INCLUDES_IN_FRAMEWORK_MODULES'] = 'YES'
+      merge_sqlite_omit_load_extension_definition(config)
+      strip_system_sqlite_from_pod_config(config)
     end
   end
 end
+
+# Aggregate Pods-App xcconfigs merge -l"sqlite3" from dependencies; that pulls in Apple's
+# libsqlite3 alongside SQLCipher. Strip it after CocoaPods writes the files (post_install is too early).
+# Also strip SQLCipher header-guard macros leaked into GCC_PREPROCESSOR_DEFINITIONS: Swift explicit
+# modules build the SDK SQLite3.modulemap PCM with the same -D flags; _SQLITE3_H_=1 empties sqlite3.h
+# and breaks sqlite3ext.h (unknown sqlite3_* types).
+def strip_aggregate_pods_app_xcconfig(contents)
+  # Unlink system libsqlite3 (SQLCipher is the only SQLite).
+  patched = contents.gsub(/\s+-l"sqlite3"\s+/, ' ')
+                    .gsub(/\s+-lsqlite3\b/, ' ')
+  # SQLCipher leaks sqlite3*.h guard macros into GCC_PREPROCESSOR_DEFINITIONS; Swift explicit
+  # modules must not inherit them when building the SDK SQLite3 module.
+  %w[_SQLITE3_H_=1 _FTS5_H=1 _SQLITE3RTREE_H_=1].each do |macro|
+    escaped = Regexp.escape(macro)
+    patched.gsub!(/(?:^|\s)-D#{escaped}(?=\s|$)/, ' ')
+    patched.gsub!(/(?:^|\s)#{escaped}(?=\s|$)/, ' ')
+  end
+  patched.gsub(/[ \t]+/, ' ')
+end
+
+post_integrate do |installer|
+  support = File.join(installer.sandbox.root, 'Target Support Files', 'Pods-App')
+  %w[Pods-App.debug.xcconfig Pods-App.release.xcconfig].each do |name|
+    path = File.join(support, name)
+    next unless File.exist?(path)
+    contents = File.read(path)
+    patched = strip_aggregate_pods_app_xcconfig(contents)
+    File.write(path, patched) if patched != contents
+  end
+end

ios/App/Podfile.lock

@@ -17,6 +17,10 @@ PODS:
   - CapacitorMlkitBarcodeScanning (6.2.0):
     - Capacitor
     - GoogleMLKit/BarcodeScanning (= 5.0.0)
+  - CapacitorPreferences (6.0.4):
+    - Capacitor
+  - CapacitorPushNotifications (6.0.5):
+    - Capacitor
   - CapacitorShare (6.0.3):
     - Capacitor
   - CapacitorStatusBar (6.0.2):
@@ -81,14 +85,14 @@ PODS:
   - nanopb/decode (2.30910.0)
   - nanopb/encode (2.30910.0)
   - PromisesObjC (2.4.0)
-  - SQLCipher (4.9.0):
-    - SQLCipher/standard (= 4.9.0)
-  - SQLCipher/common (4.9.0)
-  - SQLCipher/standard (4.9.0):
+  - SQLCipher (4.10.0):
+    - SQLCipher/standard (= 4.10.0)
+  - SQLCipher/common (4.10.0)
+  - SQLCipher/standard (4.10.0):
     - SQLCipher/common
-  - TimesafariDailyNotificationPlugin (2.1.1):
+  - TimesafariDailyNotificationPlugin (4.0.1):
     - Capacitor
-  - ZIPFoundation (0.9.19)
+  - ZIPFoundation (0.9.20)
 
 DEPENDENCIES:
   - "Capacitor (from `../../node_modules/@capacitor/ios`)"
@@ -99,6 +103,8 @@ DEPENDENCIES:
   - "CapacitorCordova (from `../../node_modules/@capacitor/ios`)"
   - "CapacitorFilesystem (from `../../node_modules/@capacitor/filesystem`)"
   - "CapacitorMlkitBarcodeScanning (from `../../node_modules/@capacitor-mlkit/barcode-scanning`)"
+  - "CapacitorPreferences (from `../../node_modules/@capacitor/preferences`)"
+  - "CapacitorPushNotifications (from `../../node_modules/@capacitor/push-notifications`)"
   - "CapacitorShare (from `../../node_modules/@capacitor/share`)"
   - "CapacitorStatusBar (from `../../node_modules/@capacitor/status-bar`)"
   - "CapawesomeCapacitorFilePicker (from `../../node_modules/@capawesome/capacitor-file-picker`)"
@@ -138,6 +144,10 @@ EXTERNAL SOURCES:
     :path: "../../node_modules/@capacitor/filesystem"
   CapacitorMlkitBarcodeScanning:
     :path: "../../node_modules/@capacitor-mlkit/barcode-scanning"
+  CapacitorPreferences:
+    :path: "../../node_modules/@capacitor/preferences"
+  CapacitorPushNotifications:
+    :path: "../../node_modules/@capacitor/push-notifications"
   CapacitorShare:
     :path: "../../node_modules/@capacitor/share"
   CapacitorStatusBar:
@@ -156,6 +166,8 @@ SPEC CHECKSUMS:
   CapacitorCordova: 8d93e14982f440181be7304aa9559ca631d77fff
   CapacitorFilesystem: 59270a63c60836248812671aa3b15df673fbaf74
   CapacitorMlkitBarcodeScanning: 7652be9c7922f39203a361de735d340ae37e134e
+  CapacitorPreferences: 5848e0691b36b4bb4acc98e481ab56d451578d30
+  CapacitorPushNotifications: 35abece14371c57172e8321c9ccc8b6fa35fabfe
   CapacitorShare: d2a742baec21c8f3b92b361a2fbd2401cdd8288e
   CapacitorStatusBar: b16799a26320ffa52f6c8b01737d5a95bbb8f3eb
   CapawesomeCapacitorFilePicker: c40822f0a39f86855321943c7829d52bca7f01bd
@@ -171,10 +183,10 @@ SPEC CHECKSUMS:
   MLKitVision: 90922bca854014a856f8b649d1f1f04f63fd9c79
   nanopb: 438bc412db1928dac798aa6fd75726007be04262
   PromisesObjC: f5707f49cb48b9636751c5b2e7d227e43fba9f47
-  SQLCipher: 31878d8ebd27e5c96db0b7cb695c96e9f8ad77da
-  TimesafariDailyNotificationPlugin: ab9860e6ab9db8019f64f3c08f115a0c4ffd32d9
-  ZIPFoundation: b8c29ea7ae353b309bc810586181fd073cb3312c
+  SQLCipher: eb79c64049cb002b4e9fcb30edb7979bf4706dfc
+  TimesafariDailyNotificationPlugin: 69277c884380a9a620f671b68e0327eaa4b3d27d
+  ZIPFoundation: dfd3d681c4053ff7e2f7350bc4e53b5dba3f5351
 
-PODFILE CHECKSUM: 6d92bfa46c6c2d31d19b8c0c38f56a8ae9fd222f
+PODFILE CHECKSUM: 3a6079307b3952d27d8dbfc0ce9abb523ecce7f0
 
 COCOAPODS: 1.16.2

package.json

@@ -10,6 +10,7 @@
     "lint-fix": "eslint --ext .js,.ts,.vue --ignore-path .gitignore --fix src",
     "type-safety-check": "./scripts/type-safety-check.sh",
     "type-check": "tsc --noEmit",
+    "type-check:vue": "vue-tsc --noEmit",
     "prebuild": "eslint --ext .js,.ts,.vue --ignore-path .gitignore src && node sw_combine.js && node scripts/copy-wasm.js",
     "test:prerequisites": "node scripts/check-prerequisites.js",
     "check:dependencies": "./scripts/check-dependencies.sh",
@@ -138,7 +139,7 @@
   },
   "dependencies": {
     "@capacitor-community/electron": "^5.0.1",
-    "@capacitor-community/sqlite": "6.0.2",
+    "@capacitor-community/sqlite": "^6.0.2",
     "@capacitor-mlkit/barcode-scanning": "^6.0.0",
     "@capacitor/android": "^6.2.0",
     "@capacitor/app": "^6.0.0",
@@ -148,6 +149,8 @@
     "@capacitor/core": "^6.2.0",
     "@capacitor/filesystem": "^6.0.0",
     "@capacitor/ios": "^6.2.0",
+    "@capacitor/preferences": "^6.0.4",
+    "@capacitor/push-notifications": "^6.0.5",
     "@capacitor/share": "^6.0.3",
     "@capacitor/status-bar": "^6.0.2",
     "@capawesome/capacitor-file-picker": "^6.2.0",
@@ -194,6 +197,7 @@
     "electron-builder": "^26.0.12",
     "ethereum-cryptography": "^2.1.3",
     "ethereumjs-util": "^7.1.5",
+    "firebase": "^12.12.1",
     "jdenticon": "^3.2.0",
     "js-generate-password": "^0.1.9",
     "js-yaml": "^4.1.0",
@@ -279,6 +283,7 @@
     "ts-jest": "^29.4.0",
     "tsx": "^4.20.4",
     "typescript": "~5.2.2",
-    "vite": "^5.2.0"
+    "vite": "^5.2.0",
+    "vue-tsc": "^2.1.10"
   }
 }

scripts/build-android.sh

@@ -492,21 +492,6 @@ log_info "Build type: $BUILD_TYPE"
 # Setup environment for Capacitor build
 setup_build_env "capacitor" "$BUILD_MODE"
 
-# Override API servers for Android development
-if [ "$BUILD_MODE" = "development" ]; then
-    if [ -n "$CUSTOM_API_IP" ]; then
-        # Use custom IP for physical device development
-        export VITE_DEFAULT_ENDORSER_API_SERVER="http://${CUSTOM_API_IP}:3000"
-        export VITE_DEFAULT_PARTNER_API_SERVER="http://${CUSTOM_API_IP}:3000"
-        log_info "Android development mode: Using custom IP ${CUSTOM_API_IP} for physical device"
-    else
-        # Use Android emulator IP (10.0.2.2) for Android development
-        export VITE_DEFAULT_ENDORSER_API_SERVER="http://10.0.2.2:3000"
-        export VITE_DEFAULT_PARTNER_API_SERVER="http://10.0.2.2:3000"
-        log_debug "Android development mode: Using 10.0.2.2 for emulator"
-    fi
-fi
-
 # Setup application directories
 setup_app_directories
 
@@ -523,6 +508,21 @@ if [ -f ".env" ]; then
     load_env_file ".env"
 fi
 
+# Override API servers for Android development
+if [ "$BUILD_MODE" = "development" ]; then
+    if [ -n "$CUSTOM_API_IP" ]; then
+        # Use custom IP for physical device development
+        export VITE_DEFAULT_ENDORSER_API_SERVER="http://${CUSTOM_API_IP}:3000"
+        export VITE_DEFAULT_PARTNER_API_SERVER="http://${CUSTOM_API_IP}:3000"
+        log_info "Android development mode: Using custom IP ${CUSTOM_API_IP} for physical device"
+    else
+        # Use Android emulator IP (10.0.2.2) for Android development
+        export VITE_DEFAULT_ENDORSER_API_SERVER="http://10.0.2.2:3000"
+        export VITE_DEFAULT_PARTNER_API_SERVER="http://10.0.2.2:3000"
+        log_debug "Android development mode: Using 10.0.2.2 for emulator"
+    fi
+fi
+
 # Handle clean-only mode
 if [ "$CLEAN_ONLY" = true ]; then
     log_info "Clean-only mode: cleaning build artifacts"

scripts/build-ios.sh

@@ -222,7 +222,8 @@ build_ios_app() {
     
     if [ "$BUILD_TYPE" = "debug" ]; then
         build_config="Debug"
-        destination="platform=iOS Simulator,name=iPhone 15 Pro"
+        # Any Simulator — avoids hardcoding a device name (e.g. iPhone 15 Pro) that may not exist in newer Xcode runtimes
+        destination="generic/platform=iOS Simulator"
     else
         build_config="Release"
         destination="platform=iOS,id=auto"
@@ -232,15 +233,21 @@ build_ios_app() {
     
     cd ios/App
     
-    # Build the app
-    xcodebuild -workspace App.xcworkspace \
+    # Build the app:
+    # -quiet: skip the huge export VAR dump (compiler warnings still show unless suppressed below).
+    # SWIFT_SUPPRESS_WARNINGS / GCC_WARN_INHIBIT_ALL_WARNINGS: quiet CLI output from Pods + plugins;
+    #   build in Xcode for full diagnostics. Real errors still fail the build.
+    xcodebuild -quiet \
+               -workspace App.xcworkspace \
                -scheme "$scheme" \
                -configuration "$build_config" \
                -destination "$destination" \
                build \
                CODE_SIGN_IDENTITY="" \
                CODE_SIGNING_REQUIRED=NO \
-               CODE_SIGNING_ALLOWED=NO
+               CODE_SIGNING_ALLOWED=NO \
+               SWIFT_SUPPRESS_WARNINGS=YES \
+               GCC_WARN_INHIBIT_ALL_WARNINGS=YES
     
     cd ../..
     
@@ -313,14 +320,6 @@ log_info "Build type: $BUILD_TYPE"
 # Setup environment for Capacitor build
 setup_build_env "capacitor" "$BUILD_MODE"
 
-# Override API servers for iOS development when custom IP is specified
-if [ "$BUILD_MODE" = "development" ] && [ -n "$CUSTOM_API_IP" ]; then
-    # Use custom IP for physical device development
-    export VITE_DEFAULT_ENDORSER_API_SERVER="http://${CUSTOM_API_IP}:3000"
-    export VITE_DEFAULT_PARTNER_API_SERVER="http://${CUSTOM_API_IP}:3000"
-    log_info "iOS development mode: Using custom IP ${CUSTOM_API_IP} for physical device"
-fi
-
 # Setup application directories
 setup_app_directories
 
@@ -337,6 +336,14 @@ if [ -f ".env" ]; then
     load_env_file ".env"
 fi
 
+# Override API servers for iOS development when custom IP is specified
+if [ "$BUILD_MODE" = "development" ] && [ -n "$CUSTOM_API_IP" ]; then
+    # Use custom IP for physical device development
+    export VITE_DEFAULT_ENDORSER_API_SERVER="http://${CUSTOM_API_IP}:3000"
+    export VITE_DEFAULT_PARTNER_API_SERVER="http://${CUSTOM_API_IP}:3000"
+    log_info "iOS development mode: Using custom IP ${CUSTOM_API_IP} for physical device"
+fi
+
 # Validate iOS environment
 validate_ios_environment
 
@@ -564,16 +571,19 @@ safe_execute "Building iOS app" "build_ios_app" || exit 5
 if [ "$BUILD_IPA" = true ]; then
     log_info "Building IPA package..."
     cd ios/App
-    xcodebuild -workspace App.xcworkspace \
+    xcodebuild -quiet \
+               -workspace App.xcworkspace \
                -scheme App \
                -configuration Release \
                -archivePath build/App.xcarchive \
                archive \
                CODE_SIGN_IDENTITY="" \
                CODE_SIGNING_REQUIRED=NO \
-               CODE_SIGNING_ALLOWED=NO
+               CODE_SIGNING_ALLOWED=NO \
+               SWIFT_SUPPRESS_WARNINGS=YES \
+               GCC_WARN_INHIBIT_ALL_WARNINGS=YES
     
-    xcodebuild -exportArchive \
+    xcodebuild -quiet -exportArchive \
                -archivePath build/App.xcarchive \
                -exportPath build/ \
                -exportOptionsPlist exportOptions.plist

scripts/common.sh

@@ -183,6 +183,16 @@ setup_build_env() {
     export VITE_GIT_HASH="$git_hash"
     log_debug "Set VITE_GIT_HASH=$git_hash"
     
+    # Vite derives import.meta.env.DEV/PROD from NODE_ENV, not from --mode.
+    # Without this, every native build reports DEV=false and loads the
+    # production .env file in vite.config.common.mts.
+    case "$build_mode" in
+        "production") export NODE_ENV=production ;;
+        "test") export NODE_ENV=test ;;
+        *) export NODE_ENV=development ;;
+    esac
+    log_debug "Set NODE_ENV=$NODE_ENV"
+    
     case $build_type in
         "capacitor")
             export VITE_PLATFORM=capacitor

src/components/ChoiceButtonDialog.vue

@@ -25,6 +25,7 @@
                 <p :class="textClasses">{{ text }}</p>
 
                 <button
+                  v-if="option1Text"
                   :class="option1ButtonClasses"
                   @click="handleOption1(close)"
                 >
@@ -32,6 +33,7 @@
                 </button>
 
                 <button
+                  v-if="option2Text"
                   :class="option2ButtonClasses"
                   @click="handleOption2(close)"
                 >
@@ -39,6 +41,7 @@
                 </button>
 
                 <button
+                  v-if="option3Text"
                   :class="option3ButtonClasses"
                   @click="handleOption3(close)"
                 >

src/components/PushNotificationPermission.vue

@@ -159,6 +159,13 @@ export default class PushNotificationPermission extends Vue {
   pushType = "";
   /** When true, dialog only returns time/message to parent; parent does cancel+schedule (avoids double schedule on edit). */
   skipScheduleForOpen = false;
+  /**
+   * When true, the dialog is a time picker and nothing else: no permission
+   * request, no web-push subscription, no settings write. Used by delivery
+   * channels that carry their own schedule -- SMS sends its hour to the
+   * notify-api rather than arming anything on this device.
+   */
+  timeOnlyForOpen = false;
   /** When set (e.g. 10), passed to plugin for dev/test fast rollover. */
   rolloverIntervalMinutesForSchedule: number | undefined = undefined;
   serviceWorkerReady = false;
@@ -174,14 +181,27 @@ export default class PushNotificationPermission extends Vue {
   async open(
     pushType: string,
     callback?: (success: boolean, time: string, message?: string) => void,
-    options?: { skipSchedule?: boolean; rolloverIntervalMinutes?: number },
+    options?: {
+      skipSchedule?: boolean;
+      rolloverIntervalMinutes?: number;
+      timeOnly?: boolean;
+    },
   ) {
     this.callback = callback || this.callback;
     this.isVisible = true;
     this.pushType = pushType;
     this.skipScheduleForOpen = options?.skipSchedule ?? false;
+    this.timeOnlyForOpen = options?.timeOnly ?? false;
     this.rolloverIntervalMinutesForSchedule = options?.rolloverIntervalMinutes;
 
+    // Time-only callers never subscribe to anything, so the web-push
+    // handshake would only be a way to fail before showing a clock.
+    if (this.timeOnlyForOpen) {
+      this.serviceWorkerReady = true;
+      this.messageInput = "";
+      return;
+    }
+
     // Native platforms: Skip web push initialization
     if (this.isNativePlatform) {
       logger.debug(
@@ -589,8 +609,8 @@ export default class PushNotificationPermission extends Vue {
    * For native platforms, always returns true (no VAPID needed)
    */
   get isSystemReady(): boolean {
-    if (this.isNativePlatform) {
-      return true; // Native doesn't need VAPID/service worker
+    if (this.isNativePlatform || this.timeOnlyForOpen) {
+      return true; // Neither needs VAPID/service worker
     }
     return this.serviceWorkerReady && !!this.vapidKey;
   }
@@ -601,8 +621,8 @@ export default class PushNotificationPermission extends Vue {
    * For native platforms, always returns true (no VAPID needed)
    */
   get canShowNotificationForm(): boolean {
-    if (this.isNativePlatform) {
-      return true; // Native doesn't need VAPID/service worker
+    if (this.isNativePlatform || this.timeOnlyForOpen) {
+      return true; // Neither needs VAPID/service worker
     }
     return this.serviceWorkerReady && !!this.vapidKey;
   }
@@ -672,6 +692,12 @@ export default class PushNotificationPermission extends Vue {
    * Close only after async flow completes so success/error $notify runs while component is mounted (fixes Android).
    */
   async handleTurnOnNotifications() {
+    if (this.timeOnlyForOpen) {
+      // Nothing to arm on this device; the caller owns whatever the time means.
+      this.callback(true, this.notificationTimeText, this.messageInput);
+      this.close();
+      return;
+    }
     if (this.isNativePlatform) {
       await this.turnOnNativeNotifications();
     } else {

src/components/SmsVerificationDialog.vue

@@ -0,0 +1,305 @@
+<template>
+  <div v-if="visible" class="dialog-overlay">
+    <div class="dialog">
+      <!-- Step 1: enter phone number -->
+      <div v-if="step === 'phone'">
+        <h1 class="text-xl font-bold text-center mb-2">Verify Your Phone</h1>
+        <p class="text-sm text-slate-500 mb-4">
+          Enter the mobile number where you want to receive New Activity text
+          messages. We'll send a one-time code to confirm it's yours. Standard
+          message and data rates may apply.
+        </p>
+
+        <label for="sms-phone" class="text-slate-500 text-sm font-bold">
+          Mobile number
+        </label>
+        <input
+          id="sms-phone"
+          v-model="phoneNumber"
+          type="tel"
+          inputmode="tel"
+          autocomplete="tel"
+          placeholder="+1 555 123 4567"
+          class="block w-full rounded border border-slate-400 mt-1 mb-1 px-3 py-2"
+          :disabled="sending"
+          @keyup.enter="sendCode()"
+        />
+        <p v-if="errorMessage" class="text-sm text-red-600 mb-2">
+          {{ errorMessage }}
+        </p>
+
+        <div class="mt-6">
+          <div class="grid grid-cols-1 sm:grid-cols-2 gap-2">
+            <button
+              type="button"
+              :class="primaryButtonClasses"
+              :disabled="sending"
+              @click="sendCode()"
+            >
+              <font-awesome v-if="sending" icon="spinner" spin class="mr-1" />
+              {{ sending ? "Sending…" : "Send Code" }}
+            </button>
+            <button
+              type="button"
+              :class="cancelButtonClasses"
+              :disabled="sending"
+              @click="onClickCancel()"
+            >
+              Cancel
+            </button>
+          </div>
+        </div>
+      </div>
+
+      <!-- Step 2: enter the code -->
+      <div v-else-if="step === 'code'">
+        <h1 class="text-xl font-bold text-center mb-2">Enter the Code</h1>
+        <p class="text-sm text-slate-500 mb-4">
+          We sent a 6-digit code to
+          <b>{{ sentTo }}</b
+          >. Enter it below to finish verifying your number.
+        </p>
+
+        <label for="sms-code" class="text-slate-500 text-sm font-bold">
+          Verification code
+        </label>
+        <input
+          id="sms-code"
+          v-model="code"
+          type="text"
+          inputmode="numeric"
+          autocomplete="one-time-code"
+          maxlength="6"
+          placeholder="123456"
+          class="block w-full tracking-[0.4em] text-center text-lg rounded border border-slate-400 mt-1 mb-1 px-3 py-2"
+          :disabled="verifying"
+          @keyup.enter="verifyCode()"
+        />
+        <p v-if="errorMessage" class="text-sm text-red-600 mb-2">
+          {{ errorMessage }}
+        </p>
+
+        <div class="text-center mb-2">
+          <button
+            type="button"
+            class="text-sm text-blue-500"
+            :disabled="sending || verifying"
+            @click="resendCode()"
+          >
+            {{ sending ? "Resending…" : "Resend code" }}
+          </button>
+        </div>
+
+        <div class="mt-4">
+          <div class="grid grid-cols-1 sm:grid-cols-2 gap-2">
+            <button
+              type="button"
+              :class="primaryButtonClasses"
+              :disabled="verifying"
+              @click="verifyCode()"
+            >
+              <font-awesome v-if="verifying" icon="spinner" spin class="mr-1" />
+              {{ verifying ? "Verifying…" : "Verify" }}
+            </button>
+            <button
+              type="button"
+              :class="cancelButtonClasses"
+              :disabled="verifying"
+              @click="onClickCancel()"
+            >
+              Cancel
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</template>
+
+<script lang="ts">
+import { Vue, Component } from "vue-facing-decorator";
+
+import { PlatformServiceMixin } from "@/utils/PlatformServiceMixin";
+import { logger } from "@/utils/logger";
+import {
+  normalizePhoneNumber,
+  registerSmsPhone,
+  SmsApiError,
+  smsErrorMessage,
+  verifySmsPhone,
+} from "@/services/notifications/smsNotificationApi";
+
+/**
+ * SmsVerificationDialog Component
+ *
+ * A two-step modal that walks the user through verifying a mobile number so
+ * they can opt in to SMS "New Activity" notifications:
+ *   1. Enter phone number  -> `POST /notify-sms/phone` texts a one-time code
+ *   2. Enter the code       -> `PUT /notify-sms/phone` confirms possession
+ *
+ * On successful verification the callback fires with (true, phoneNumber), the
+ * number in the E.164 form the service stores, so the caller can then let the
+ * user turn the SMS notification on. Cancelling fires the callback with
+ * (false).
+ *
+ * A number this identity has already verified comes back from the POST with
+ * `verified: true` and no text sent, which finishes the dialog in one step.
+ */
+@Component({
+  mixins: [PlatformServiceMixin],
+})
+export default class SmsVerificationDialog extends Vue {
+  visible = false;
+  step: "phone" | "code" = "phone";
+  phoneNumber = "";
+  sentTo = "";
+  code = "";
+  sending = false;
+  verifying = false;
+  errorMessage = "";
+
+  /** Identity the registration is scoped to; every route is per-DID. */
+  activeDid = "";
+
+  callback: (success: boolean, phoneNumber?: string) => void = () => {};
+
+  /**
+   * Opens the dialog at the phone-entry step.
+   * @param activeDid - identity the number is registered under
+   * @param aCallback - fired with (true, phoneNumber) on success, (false) on cancel
+   * @param prefillPhone - optional number to pre-populate (e.g. re-verifying)
+   */
+  open(
+    activeDid: string,
+    aCallback?: (success: boolean, phoneNumber?: string) => void,
+    prefillPhone = "",
+  ) {
+    this.activeDid = activeDid;
+    this.callback = aCallback || this.callback;
+    this.step = "phone";
+    this.phoneNumber = prefillPhone;
+    this.sentTo = "";
+    this.code = "";
+    this.sending = false;
+    this.verifying = false;
+    this.errorMessage = "";
+    this.visible = true;
+  }
+
+  /**
+   * Validate the phone number and ask the service to text a code.
+   *
+   * The masked number the service echoes back is what the user sees; the
+   * normalized one is what later calls send, since the mask is not a number.
+   */
+  async sendCode(): Promise<void> {
+    this.errorMessage = "";
+    const normalized = normalizePhoneNumber(this.phoneNumber);
+    if (!normalized || normalized.replace(/\D/g, "").length < 7) {
+      this.errorMessage = "Please enter a valid mobile number.";
+      return;
+    }
+
+    this.sending = true;
+    try {
+      const result = await registerSmsPhone(this.activeDid, normalized);
+      this.phoneNumber = normalized;
+
+      if (result.verified) {
+        // Already verified under this identity: nothing was texted and there
+        // is no code to enter.
+        this.visible = false;
+        this.callback(true, normalized);
+        return;
+      }
+
+      this.sentTo = result.phoneNumber || normalized;
+      // Only a dev server with SMS_DEV_ECHO_CODE returns this; it saves a
+      // developer with no carrier coverage from a dead-end flow.
+      this.code = result.devCode || "";
+      this.step = "code";
+    } catch (error) {
+      logger.error("[SmsVerificationDialog] sendCode failed:", error);
+      this.errorMessage = smsErrorMessage(
+        error,
+        "Could not send the code. Please try again.",
+      );
+    } finally {
+      this.sending = false;
+    }
+  }
+
+  /**
+   * Ask the service to send a fresh code to the same number. Sends are
+   * throttled to three per number per hour, so this can be refused.
+   */
+  async resendCode(): Promise<void> {
+    this.errorMessage = "";
+    this.sending = true;
+    try {
+      const result = await registerSmsPhone(this.activeDid, this.phoneNumber);
+      this.sentTo = result.phoneNumber || this.sentTo;
+      // A number already verified comes back with no code, dev or otherwise.
+      this.code = result.verified ? "" : result.devCode || "";
+    } catch (error) {
+      logger.error("[SmsVerificationDialog] resendCode failed:", error);
+      this.errorMessage = smsErrorMessage(
+        error,
+        "Could not resend the code. Please try again.",
+      );
+    } finally {
+      this.sending = false;
+    }
+  }
+
+  /**
+   * Confirm the entered code with the service.
+   *
+   * A wrong code says how many tries are left; running out clears the code
+   * server-side, so the only way forward is a fresh send from step one.
+   */
+  async verifyCode(): Promise<void> {
+    this.errorMessage = "";
+    if (!/^\d{6}$/.test(this.code.trim())) {
+      this.errorMessage = "Enter the 6-digit code we texted you.";
+      return;
+    }
+
+    this.verifying = true;
+    try {
+      await verifySmsPhone(this.activeDid, this.phoneNumber, this.code);
+      this.visible = false;
+      this.callback(true, this.phoneNumber);
+    } catch (error) {
+      logger.error("[SmsVerificationDialog] verifyCode failed:", error);
+      this.errorMessage = smsErrorMessage(
+        error,
+        "Could not verify the code. Please try again.",
+      );
+      if (
+        error instanceof SmsApiError &&
+        error.code === "SMS_CODE_ATTEMPTS_EXHAUSTED"
+      ) {
+        // The stored code is gone; recovery is another send, not another guess.
+        this.step = "phone";
+        this.code = "";
+      }
+    } finally {
+      this.verifying = false;
+    }
+  }
+
+  onClickCancel(): void {
+    this.visible = false;
+    this.callback(false);
+  }
+
+  get primaryButtonClasses(): string {
+    return "block w-full text-center text-lg font-bold uppercase bg-gradient-to-b from-blue-400 to-blue-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-2 py-3 rounded-md disabled:opacity-50";
+  }
+
+  get cancelButtonClasses(): string {
+    return "block w-full text-center text-md uppercase bg-gradient-to-b from-slate-400 to-slate-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-2 py-3 rounded-md disabled:opacity-50";
+  }
+}
+</script>

src/components/dev/NotificationDebugPanel.vue

@@ -0,0 +1,581 @@
+<template>
+  <section class="bg-slate-100 rounded-md overflow-hidden px-4 py-4">
+    <!-- Backend testing -->
+    <div class="mb-6">
+      <h2 class="mb-2 font-bold">Backend Testing</h2>
+
+      <label class="block text-sm font-medium text-slate-700 mb-1">
+        Notification Backend URL
+      </label>
+      <input
+        v-model="backendUrlDraft"
+        type="url"
+        class="w-full text-sm px-3 py-2 rounded border border-slate-300 bg-white mb-1"
+        placeholder="Leave empty for default (DEFAULT_NOTIFY_API_SERVER)"
+        :disabled="busy"
+        @keydown.enter="onSaveBackendUrl"
+      />
+      <p class="text-xs text-slate-500 mb-2">
+        Active:
+        <code class="text-[11px] break-all">{{ activeBackendUrl }}</code>
+      </p>
+      <button
+        class="w-full text-sm mb-4 px-3 py-2 rounded border border-slate-300 bg-white"
+        :disabled="busy"
+        :class="{ 'opacity-50 cursor-not-allowed': busy }"
+        @click="onSaveBackendUrl"
+      >
+        Save Backend URL
+      </button>
+
+      <label class="flex items-center gap-2 text-sm mb-4 cursor-pointer">
+        <input
+          v-model="testModeEnabled"
+          type="checkbox"
+          class="rounded border-slate-300"
+          :disabled="busy"
+          @change="onTestModeChange"
+        />
+        <span>Test Mode</span>
+      </label>
+
+      <label class="flex items-center gap-2 text-sm mb-1 cursor-pointer">
+        <input
+          v-model="bypassAuthEnabled"
+          type="checkbox"
+          class="rounded border-slate-300"
+          :disabled="busy"
+          @change="onBypassAuthChange"
+        />
+        <span>Skip JWT Authentication (Local Development Only)</span>
+      </label>
+      <p class="text-xs text-slate-500 mb-4">
+        Enable only when using a local development server (for example localhost
+        or ngrok) that intentionally accepts unauthenticated notification
+        requests.
+      </p>
+
+      <div class="flex flex-col gap-2 mb-4">
+        <button
+          class="w-full text-md bg-gradient-to-b from-emerald-400 to-emerald-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
+          :disabled="busy"
+          :class="{ 'opacity-50 cursor-not-allowed': busy }"
+          @click="onRegisterToken"
+        >
+          Register Token Now
+        </button>
+        <button
+          class="w-full text-md bg-gradient-to-b from-cyan-500 to-cyan-800 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
+          :disabled="busy"
+          :class="{ 'opacity-50 cursor-not-allowed': busy }"
+          @click="onUploadAlertAuthorization"
+        >
+          Upload AlertSearch Authorization
+        </button>
+        <p
+          v-if="alertAuthorizationStatus"
+          class="text-xs rounded px-3 py-2 border"
+          :class="
+            alertAuthorizationStatus.ok
+              ? 'text-emerald-900 bg-emerald-50 border-emerald-200'
+              : 'text-rose-900 bg-rose-50 border-rose-200'
+          "
+          role="status"
+        >
+          {{ alertAuthorizationStatus.message }}
+        </p>
+        <p v-else class="text-xs text-slate-500">
+          Manually mints and uploads 100 delegated day JWTs. Requires an active
+          did:ethr identity and JWT authentication; Test Mode is not used.
+        </p>
+        <button
+          class="w-full text-md bg-gradient-to-b from-blue-400 to-blue-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
+          :disabled="busy"
+          :class="{ 'opacity-50 cursor-not-allowed': busy }"
+          @click="onBackendRefresh"
+        >
+          Refresh Notifications
+        </button>
+        <button
+          class="w-full text-md bg-gradient-to-b from-violet-400 to-violet-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
+          :disabled="busy"
+          :class="{ 'opacity-50 cursor-not-allowed': busy }"
+          @click="onSimulateWakeupRefresh"
+        >
+          Simulate WAKEUP_PING (Local)
+        </button>
+        <p class="text-xs text-slate-500">
+          Local simulation only — calls the refresh API directly (no FCM push).
+        </p>
+        <button
+          class="w-full text-md bg-gradient-to-b from-amber-400 to-amber-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
+          :disabled="busy"
+          :class="{ 'opacity-50 cursor-not-allowed': busy }"
+          @click="onSendRealWakeupPing"
+        >
+          Send Real WAKEUP_PING
+        </button>
+        <p
+          v-if="realWakeupStatus"
+          class="text-xs rounded px-3 py-2 border"
+          :class="
+            realWakeupStatus.ok
+              ? 'text-emerald-900 bg-emerald-50 border-emerald-200'
+              : 'text-rose-900 bg-rose-50 border-rose-200'
+          "
+          role="status"
+        >
+          {{ realWakeupStatus.message }}
+        </p>
+        <p v-else class="text-xs text-slate-500">
+          Full pipeline — backend `/debug/send-wakeup` → FCM → WAKEUP_PING
+          handler.
+        </p>
+      </div>
+
+      <div class="mb-4">
+        <h3 class="text-sm font-bold mb-1">Current FCM Token</h3>
+        <div
+          v-if="fcmToken"
+          class="bg-white rounded border border-slate-200 px-3 py-2 text-xs font-mono break-all flex gap-2 items-start"
+        >
+          <span class="min-w-0 flex-1">{{ truncatedFcmToken }}</span>
+          <button
+            type="button"
+            class="shrink-0 text-sm px-2 py-1 rounded border border-slate-300 bg-slate-50"
+            @click="onCopyFcmToken"
+          >
+            Copy
+          </button>
+        </div>
+        <p
+          v-else
+          class="text-sm text-slate-500 bg-white rounded px-3 py-2 border border-slate-200"
+        >
+          (not available — try Register Token Now on native)
+        </p>
+      </div>
+
+      <div class="mb-2">
+        <h3 class="text-sm font-bold mb-1">Backend Status</h3>
+        <dl
+          class="bg-white rounded border border-slate-200 px-3 py-2 text-xs space-y-1"
+        >
+          <div class="flex gap-2">
+            <dt class="text-slate-500 shrink-0">URL</dt>
+            <dd class="break-all font-mono">{{ activeBackendUrl }}</dd>
+          </div>
+          <div class="flex gap-2">
+            <dt class="text-slate-500 shrink-0">testMode</dt>
+            <dd>{{ testModeEnabled ? "true" : "false" }}</dd>
+          </div>
+          <div class="flex gap-2">
+            <dt class="text-slate-500 shrink-0">bypassAuth</dt>
+            <dd>{{ bypassAuthEnabled ? "true" : "false" }}</dd>
+          </div>
+        </dl>
+      </div>
+    </div>
+
+    <!-- SECTION F: Mock Timing Presets -->
+    <div class="mb-6">
+      <h2 class="mb-2 font-bold">Mock Timing Presets</h2>
+      <div class="flex flex-wrap gap-2">
+        <button
+          v-for="preset in presets"
+          :key="preset.ms"
+          class="px-3 py-2 rounded border border-slate-300 bg-white text-sm"
+          :class="{
+            'border-blue-500 ring-1 ring-blue-300': intervalMs === preset.ms,
+          }"
+          @click="intervalMs = preset.ms"
+        >
+          {{ preset.label }}
+        </button>
+      </div>
+      <div class="text-xs text-slate-500 mt-2">
+        Selected interval: <b>{{ intervalLabel }}</b>
+      </div>
+    </div>
+
+    <!-- SECTION A: Mock Refresh Controls -->
+    <div class="mb-6">
+      <h2 class="mb-2 font-bold">Mock Refresh Controls</h2>
+      <button
+        class="w-full text-md bg-gradient-to-b from-blue-400 to-blue-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
+        :disabled="busy"
+        :class="{ 'opacity-50 cursor-not-allowed': busy }"
+        @click="onMockRefresh"
+      >
+        Trigger Mock Refresh
+      </button>
+    </div>
+
+    <!-- SECTION B: Wakeup Ping Simulator -->
+    <div class="mb-6">
+      <h2 class="mb-2 font-bold">Wakeup Ping Simulator</h2>
+      <p class="text-xs text-slate-500 mb-2">
+        Exercises the production push handler (not the refresh API shortcut
+        above).
+      </p>
+      <button
+        class="w-full text-md bg-gradient-to-b from-slate-400 to-slate-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
+        :disabled="busy"
+        :class="{ 'opacity-50 cursor-not-allowed': busy }"
+        @click="onWakeupPing"
+      >
+        Simulate WAKEUP_PING
+      </button>
+    </div>
+
+    <!-- SECTION C: Flood Test -->
+    <div class="mb-6">
+      <h2 class="mb-2 font-bold">Flood Test</h2>
+      <button
+        class="w-full text-md bg-gradient-to-b from-rose-400 to-rose-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
+        :disabled="busy"
+        :class="{ 'opacity-50 cursor-not-allowed': busy }"
+        @click="onFloodTest"
+      >
+        Run 20 Refreshes
+      </button>
+    </div>
+
+    <!-- SECTION D: Pending Notification Inspector -->
+    <div class="mb-6">
+      <div class="flex items-center gap-3 mb-2">
+        <h2 class="font-bold">Pending Notification Inspector</h2>
+        <button
+          class="ms-auto text-sm px-3 py-2 rounded border border-slate-300 bg-white"
+          :disabled="busy"
+          :class="{ 'opacity-50 cursor-not-allowed': busy }"
+          @click="refreshPending"
+        >
+          Refresh
+        </button>
+      </div>
+
+      <div
+        v-if="pendingInspectorMessage"
+        class="text-sm text-amber-900 bg-amber-50 rounded px-3 py-2 border border-amber-200"
+        role="status"
+      >
+        {{ pendingInspectorMessage }}
+      </div>
+      <div
+        v-else-if="pending.length === 0"
+        class="text-sm text-slate-500 bg-white rounded px-3 py-2 border border-slate-200"
+      >
+        (none)
+      </div>
+      <ul v-else class="bg-white rounded border border-slate-200 divide-y">
+        <li
+          v-for="p in pending"
+          :key="p.identifier"
+          class="px-3 py-2 text-sm flex gap-3 items-start"
+        >
+          <code class="truncate min-w-0">{{ p.identifier }}</code>
+          <span
+            class="ms-auto text-xs text-right text-slate-600 max-w-[58%] shrink-0"
+          >
+            <template v-if="p.wallClockMillis != null">
+              <span class="block font-medium">{{
+                formatIsoMs(p.wallClockMillis)
+              }}</span>
+              <span class="block text-[10px] text-slate-400"
+                >Scheduled target ({{ p.wallClockSource }})</span
+              >
+              <span
+                v-if="
+                  p.nextTriggerDate != null &&
+                  Math.abs(p.nextTriggerDate - p.wallClockMillis) > 5000
+                "
+                class="block text-[10px] text-amber-800 mt-0.5"
+                >iOS nextTriggerDate (resamples on each fetch for interval
+                triggers): {{ formatIsoMs(p.nextTriggerDate) }}</span
+              >
+            </template>
+            <template v-else>
+              <span class="block">{{
+                formatIsoMs(p.nextTriggerDate ?? null)
+              }}</span>
+              <span class="block text-[10px] text-slate-400"
+                >iOS nextTriggerDate</span
+              >
+            </template>
+          </span>
+        </li>
+      </ul>
+    </div>
+
+    <!-- SECTION E: Clear Notifications -->
+    <div class="mb-6">
+      <h2 class="mb-2 font-bold">Clear Notifications</h2>
+      <button
+        class="w-full text-md bg-gradient-to-b from-slate-400 to-slate-700 shadow-[inset_0_-1px_0_0_rgba(0,0,0,0.5)] text-white px-4 py-2 rounded-md"
+        :disabled="busy"
+        :class="{ 'opacity-50 cursor-not-allowed': busy }"
+        @click="onClearNotifications"
+      >
+        Clear Notifications
+      </button>
+    </div>
+
+    <!-- SECTION G: Event Log -->
+    <div>
+      <div class="flex items-center gap-3 mb-2">
+        <h2 class="font-bold">Event Log</h2>
+        <button
+          class="ms-auto text-sm px-3 py-2 rounded border border-slate-300 bg-white"
+          @click="NotificationDebugService.clearDebugLogs()"
+        >
+          Clear Log
+        </button>
+      </div>
+      <div
+        class="bg-white rounded border border-slate-200 px-3 py-2 text-xs font-mono whitespace-pre-wrap min-h-[8rem]"
+      >
+        <div v-if="eventLog.length === 0" class="text-slate-400">(empty)</div>
+        <div v-for="(line, idx) in eventLog" v-else :key="idx">
+          {{ line }}
+        </div>
+      </div>
+    </div>
+  </section>
+</template>
+
+<script setup lang="ts">
+import { computed, onBeforeUnmount, onMounted, ref } from "vue";
+import { copyToClipboard } from "@/services/ClipboardService";
+import { subscribe } from "@/services/notifications/NotificationDebugEvents";
+import { NotificationDebugService } from "@/services/notifications/NotificationDebugService";
+
+type PendingInfo = {
+  identifier: string;
+  nextTriggerDate?: number | null;
+  triggerType?: string | null;
+  wallClockMillis?: number | null;
+  wallClockSource?: string | null;
+};
+
+const presets = [
+  { label: "30 sec", ms: 30_000 },
+  { label: "1 min", ms: 60_000 },
+  { label: "5 min", ms: 5 * 60_000 },
+  { label: "10 min", ms: 10 * 60_000 },
+];
+
+const intervalMs = ref<number>(60_000);
+const busy = ref(false);
+const pending = ref<PendingInfo[]>([]);
+const pendingInspectorMessage = ref<string | null>(null);
+const backendUrlDraft = ref("");
+const testModeEnabled = ref(NotificationDebugService.isTestModeEnabled());
+const bypassAuthEnabled = ref(NotificationDebugService.isBypassAuthEnabled());
+const fcmToken = ref<string | null>(NotificationDebugService.getFcmToken());
+
+const activeBackendUrl = ref(NotificationDebugService.getActiveBackendUrl());
+const realWakeupStatus = ref<{ ok: boolean; message: string } | null>(null);
+const alertAuthorizationStatus = ref<{
+  ok: boolean;
+  message: string;
+} | null>(null);
+
+const truncatedFcmToken = computed(() => {
+  const t = fcmToken.value?.trim() ?? "";
+  if (!t) {
+    return "";
+  }
+  if (t.length <= 24) {
+    return t;
+  }
+  return `${t.slice(0, 12)}…${t.slice(-8)}`;
+});
+
+const eventLog = ref<string[]>([]);
+let unsubscribeEventLog: (() => void) | undefined;
+
+const intervalLabel = computed(() => {
+  const preset = presets.find((p) => p.ms === intervalMs.value);
+  return preset?.label ?? `${intervalMs.value}ms`;
+});
+
+function formatIsoMs(ms: number | null | undefined): string {
+  if (ms == null || !Number.isFinite(ms)) {
+    return "";
+  }
+  return new Date(ms).toISOString();
+}
+
+async function withBusy(fn: () => Promise<void>): Promise<void> {
+  if (busy.value) return;
+  busy.value = true;
+  try {
+    await fn();
+  } finally {
+    busy.value = false;
+  }
+}
+
+async function refreshPending(): Promise<void> {
+  const result = await NotificationDebugService.getPendingNotifications();
+  pending.value = result.pending;
+  pendingInspectorMessage.value = result.inspectorUnavailableMessage ?? null;
+}
+
+async function onMockRefresh(): Promise<void> {
+  await withBusy(async () => {
+    await NotificationDebugService.triggerMockRefresh(intervalMs.value);
+    await refreshPending();
+  });
+}
+
+async function onWakeupPing(): Promise<void> {
+  await withBusy(async () => {
+    await NotificationDebugService.simulateWakeupPing();
+    await refreshPending();
+  });
+}
+
+async function onFloodTest(): Promise<void> {
+  await withBusy(async () => {
+    await NotificationDebugService.runFloodTest(intervalMs.value);
+    await refreshPending();
+  });
+}
+
+async function onClearNotifications(): Promise<void> {
+  await withBusy(async () => {
+    await NotificationDebugService.clearNotifications();
+    await refreshPending();
+  });
+}
+
+function syncBackendState(): void {
+  backendUrlDraft.value =
+    NotificationDebugService.getBackendUrlOverride() ?? "";
+  testModeEnabled.value = NotificationDebugService.isTestModeEnabled();
+  bypassAuthEnabled.value = NotificationDebugService.isBypassAuthEnabled();
+  fcmToken.value = NotificationDebugService.getFcmToken();
+  activeBackendUrl.value = NotificationDebugService.getActiveBackendUrl();
+}
+
+function onSaveBackendUrl(): void {
+  NotificationDebugService.saveBackendBaseUrl(backendUrlDraft.value);
+  syncBackendState();
+}
+
+function onTestModeChange(): void {
+  NotificationDebugService.setTestModeEnabled(testModeEnabled.value);
+}
+
+function onBypassAuthChange(): void {
+  NotificationDebugService.setBypassAuthEnabled(bypassAuthEnabled.value);
+}
+
+async function onRegisterToken(): Promise<void> {
+  await withBusy(async () => {
+    try {
+      await NotificationDebugService.registerTokenNow();
+    } catch {
+      // logged in panel
+    } finally {
+      fcmToken.value = NotificationDebugService.getFcmToken();
+    }
+  });
+}
+
+async function onUploadAlertAuthorization(): Promise<void> {
+  alertAuthorizationStatus.value = null;
+  await withBusy(async () => {
+    const result =
+      await NotificationDebugService.uploadAlertSearchAuthorization();
+    alertAuthorizationStatus.value = result.ok
+      ? {
+          ok: true,
+          message: [
+            `Uploaded ${result.jwtCount} JWTs (HTTP ${result.status}).`,
+            `Batch ${result.batchId}.`,
+            `${result.timezone}: ${result.firstDay} through ${result.lastDay}.`,
+          ]
+            .filter(Boolean)
+            .join(" "),
+        }
+      : {
+          ok: false,
+          message: [
+            `AlertSearch authorization upload failed: ${result.errorMessage}`,
+            result.status != null ? `(HTTP ${result.status})` : undefined,
+            result.errorCode ? `Code: ${result.errorCode}.` : undefined,
+          ]
+            .filter(Boolean)
+            .join(" "),
+        };
+  });
+}
+
+async function onBackendRefresh(): Promise<void> {
+  await withBusy(async () => {
+    await NotificationDebugService.triggerBackendRefresh();
+    await refreshPending();
+  });
+}
+
+async function onSimulateWakeupRefresh(): Promise<void> {
+  await withBusy(async () => {
+    await NotificationDebugService.simulateWakeupViaRefresh();
+    await refreshPending();
+  });
+}
+
+function formatRealWakeupStatusMessage(
+  result: Awaited<
+    ReturnType<typeof NotificationDebugService.sendRealWakeupPing>
+  >,
+): string {
+  if (result.ok) {
+    const parts = ["Real WAKEUP_PING sent via backend."];
+    const suffix = result.responseBody?.fcmTokenSuffix?.trim();
+    if (suffix) {
+      parts.push(`token …${suffix}`);
+    }
+    return parts.join(" ");
+  }
+  const parts = [`Real WAKEUP_PING failed: ${result.errorMessage}`];
+  if (result.status != null) {
+    parts.push(`(HTTP ${result.status})`);
+  }
+  return parts.join(" ");
+}
+
+async function onSendRealWakeupPing(): Promise<void> {
+  realWakeupStatus.value = null;
+  await withBusy(async () => {
+    const result = await NotificationDebugService.sendRealWakeupPing();
+    realWakeupStatus.value = {
+      ok: result.ok,
+      message: formatRealWakeupStatusMessage(result),
+    };
+  });
+}
+
+async function onCopyFcmToken(): Promise<void> {
+  const token = fcmToken.value?.trim();
+  if (!token) {
+    return;
+  }
+  await copyToClipboard(token);
+}
+
+onMounted(() => {
+  unsubscribeEventLog = subscribe((entries) => {
+    eventLog.value = [...entries];
+  });
+  syncBackendState();
+  void refreshPending();
+});
+
+onBeforeUnmount(() => {
+  unsubscribeEventLog?.();
+});
+</script>

src/composables/useNotifications.ts

@@ -1,6 +1,8 @@
 /* eslint-disable @typescript-eslint/no-unused-vars */
-import { inject } from "vue";
+import { inject, onBeforeUnmount, onMounted } from "vue";
 import { NotificationIface } from "../constants/app";
+import { registerToken } from "@/services/notifications/NotificationService";
+import { refreshNotifications } from "@/services/notifications/NativeNotificationService";
 
 /**
  * Vue 3 composable for notifications
@@ -29,6 +31,38 @@ export function useNotifications() {
     );
   }
 
+  let refreshTimer: number | undefined = undefined;
+  let refreshInFlight: Promise<void> | null = null;
+
+  async function refreshNotificationsDebounced(): Promise<void> {
+    if (refreshTimer != null) {
+      window.clearTimeout(refreshTimer);
+    }
+    refreshTimer = window.setTimeout(() => {
+      if (!refreshInFlight) {
+        refreshInFlight = refreshNotifications().finally(() => {
+          refreshInFlight = null;
+        });
+      }
+    }, 300);
+  }
+
+  const onResume = () => {
+    void refreshNotificationsDebounced();
+  };
+
+  onMounted(() => {
+    void refreshNotificationsDebounced();
+    document.addEventListener("resume", onResume);
+  });
+
+  onBeforeUnmount(() => {
+    document.removeEventListener("resume", onResume);
+    if (refreshTimer != null) {
+      window.clearTimeout(refreshTimer);
+    }
+  });
+
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
   function success(_notification: NotificationIface, _timeout?: number) {}
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -93,5 +127,8 @@ export function useNotifications() {
     notAGive,
     notificationOff,
     downloadStarted,
+    /** POST FCM token to `/notifications/register` (same as startup native hook). */
+    registerFcmToken: registerToken,
+    refreshNotifications: refreshNotificationsDebounced,
   };
 }

src/constants/accountView.ts

@@ -40,6 +40,8 @@ export const ACCOUNT_VIEW_CONSTANTS = {
     NO_PROFILE_LOCATION: "No profile location is saved.",
     RELOAD_VAPID:
       "Now reload the app to get a new VAPID to use with this push server.",
+    NOTIFY_SERVER_INFO:
+      "The notify server URL can be modified on the Notification Debug screen.",
   },
 
   // Warning messages
@@ -57,11 +59,20 @@ export const ACCOUNT_VIEW_CONSTANTS = {
   // Notification messages
   NOTIFICATIONS: {
     NEW_ACTIVITY_INFO: `
-      This will only notify you when there is new relevant activity for you personally.
-      Note that it runs on your device and many factors may affect delivery,
-      so if you want a reliable but simple daily notification then choose a 'Reminder'.
+      This will notify you with an app message when there is new relevant activity for you personally.
       Do you want more details?
     `,
+    NEW_ACTIVITY_SMS_INFO: `
+      This is opt-in: by turning it on you agree to receive text messages when there is new relevant activity for you personally.
+      Standard message and data rates may apply, and you can turn it off at any time.
+      Do you want more details?
+    `,
+    SMS_OPT_IN_CHOICE: `
+      This is opt-in: by entering your phone number you agree to receive text messages when there is new relevant activity for you personally.
+      Standard message and data rates may apply, and you can turn it off at any time.
+    `,
+    SMS_FORGET_PHONE_CONFIRM:
+      "This will remove your phone number and turn off all text messages. You will have to verify a number again to re-enable them. Are you sure?",
     REMINDER_INFO: `
       This will notify you at a specific time each day.
       Note that it does not give you personalized notifications,

src/constants/app.ts

@@ -26,6 +26,10 @@ export enum AppString {
   TEST1_PUSH_SERVER = "https://test.timesafari.app",
   TEST2_PUSH_SERVER = "https://timesafari-pwa.anomalistlabs.com",
 
+  PROD_NOTIFY_API_SERVER = "https://notify-api.timesafari.app",
+  TEST_NOTIFY_API_SERVER = "https://test-notify-api.timesafari.app",
+  LOCAL_NOTIFY_API_SERVER = "http://127.0.0.1:3003",
+
   NO_CONTACT_NAME = "(no name)",
 }
 
@@ -47,6 +51,11 @@ export const DEFAULT_PARTNER_API_SERVER =
 export const DEFAULT_PUSH_SERVER =
   import.meta.env.VITE_DEFAULT_PUSH_SERVER || AppString.PROD_PUSH_SERVER;
 
+/** Base URL of the notify-api (FCM wakeup registration and SMS notifications). */
+export const DEFAULT_NOTIFY_API_SERVER =
+  import.meta.env.VITE_DEFAULT_NOTIFY_API_SERVER ||
+  AppString.PROD_NOTIFY_API_SERVER;
+
 export const IMAGE_TYPE_PROFILE = "profile";
 
 /**

src/constants/backgroundJwt.ts

@@ -1,15 +1,27 @@
 /**
- * JWT lifetime for native New Activity background prefetch (`configureNativeFetcher`).
- * See doc/plan-background-jwt-pool-and-expiry.md. Confirm max `exp` with Endorser before raising.
+ * JWT lifetime for the single-token native background prefetch path
+ * (`accessTokenForBackgroundNotifications`). Confirm the maximum `exp` Endorser
+ * accepts before raising this.
  */
 export const BACKGROUND_JWT_EXPIRY_DAYS = 90;
 
 export const BACKGROUND_JWT_EXPIRY_SECONDS =
   BACKGROUND_JWT_EXPIRY_DAYS * 24 * 60 * 60;
 
-/** Headroom for retries / tests; pool size should be ≥ expiryDays + buffer. */
-export const BACKGROUND_JWT_POOL_BUFFER = 10;
+/** Seconds in a UTC day; the frame every pool slot is cut from. */
+export const BACKGROUND_JWT_SECONDS_PER_DAY = 24 * 60 * 60;
 
-/** Distinct JWT strings minted per configure (duplicate-JWT / daily slot). */
-export const BACKGROUND_JWT_POOL_SIZE =
-  BACKGROUND_JWT_EXPIRY_DAYS + BACKGROUND_JWT_POOL_BUFFER;
+/**
+ * Consecutive UTC days the native background prefetch pool covers, one JWT per
+ * day. This is the whole forward grant the user authorizes in a single mint:
+ * past the last day the pool carries no credential and prefetch stops until the
+ * app opens again. See `doc/background-jwt-pool.md`.
+ */
+export const BACKGROUND_JWT_POOL_SIZE = 100;
+
+/**
+ * Padding on each end of a day's validity window, for clock skew between the
+ * device and Endorser. Widening a window is safe; narrowing it can leave a
+ * prefetch inside the day with no usable token.
+ */
+export const BACKGROUND_JWT_WINDOW_SLACK_SECONDS = 5 * 60;

src/db-sql/migration.ts

@@ -276,6 +276,17 @@ const MIGRATIONS = [
       ALTER TABLE settings ADD COLUMN reminderFastRolloverForTesting BOOLEAN DEFAULT FALSE;
     `,
   },
+  {
+    name: "010_add_sms_notification_settings",
+    sql: `
+      -- Verified mobile number this identity registered with the notify-api
+      ALTER TABLE settings ADD COLUMN notifyingNewActivitySmsPhone TEXT;
+      -- Local time of day the notify-api was told to text, blank when off
+      ALTER TABLE settings ADD COLUMN notifyingNewActivitySmsTime TEXT;
+      -- Master switch for the SMS channel; a paused channel keeps its number
+      ALTER TABLE settings ADD COLUMN smsNotificationsEnabled BOOLEAN DEFAULT FALSE;
+    `,
+  },
 ];
 
 /**

src/db/tables/settings.ts

@@ -50,11 +50,15 @@ export type Settings = {
   lastViewedClaimId?: string;
 
   notifyingNewActivityTime?: string; // set to their chosen time if they have turned on daily check for new activity via the push server
+  notifyingNewActivitySmsPhone?: string; // verified mobile number registered with the notify-api for text alerts
+  notifyingNewActivitySmsTime?: string; // set to their chosen time if they have turned on new-activity texts
   notifyingReminderMessage?: string; // set to their chosen message for a daily reminder
   notifyingReminderTime?: string; // set to their chosen time for a daily reminder
   /** Dev/test only: use 10-minute rollover interval for daily reminder (plugin rolloverIntervalMinutes) */
   reminderFastRolloverForTesting?: boolean;
 
+  smsNotificationsEnabled?: boolean; // master switch for the text-message channel
+
   partnerApiServer?: string; // partner server API URL
 
   passkeyExpirationMinutes?: number; // passkey access token time-to-live in minutes

src/interfaces/accountView.ts

@@ -31,6 +31,9 @@ export interface AccountSettings {
     bbox: BoundingBox;
   }>;
   notifyingNewActivityTime?: string;
+  notifyingNewActivitySmsPhone?: string;
+  notifyingNewActivitySmsTime?: string;
+  smsNotificationsEnabled?: boolean;
   notifyingReminderMessage?: string;
   notifyingReminderTime?: string;
   starredPlanHandleIds?: string[];
@@ -80,6 +83,12 @@ export interface ProfileState {
 export interface NotificationState {
   notifyingNewActivity: boolean;
   notifyingNewActivityTime: string;
+  /** Master switch for the text-message channel. */
+  smsEnabled: boolean;
+  /** Verified number, kept while the channel is paused so re-enabling is free. */
+  notifyingNewActivitySmsPhone: string;
+  notifyingNewActivitySms: boolean;
+  notifyingNewActivitySmsTime: string;
   notifyingReminder: boolean;
   notifyingReminderMessage: string;
   notifyingReminderTime: string;

src/interfaces/alertSearch.ts

@@ -0,0 +1,125 @@
+/**
+ * alertSearch response item and envelope types.
+ *
+ * These buckets are new to this app. Item shapes are taken from the endorser-ch
+ * SELECT lists for alertSearch, not from similarly named existing report types.
+ *
+ * Existing types that were considered and not reused:
+ * - GenericCredWrapper — claims lack a `claim` body; extra jwt columns differ.
+ * - GiveSummaryRecord / OfferSummaryRecord — those use `jwtId` and give/offer
+ *   summary fields; alertSearch jwt rows use `id` and jwt table columns.
+ * - PlanSummaryAndPreviousClaim — `/plansLastUpdatedBetween` wraps `{ plan,
+ *   wrappedClaimBefore }`; alertSearch `trackedPlanUpdates` are plan_claim rows.
+ * - PlanSummaryRecord — overlapping plan fields, but the app type is a subset
+ *   (missing fulfillsLinkConfirmed, result*, etc.) and required fields differ.
+ * - UserProfile — partner nearby rows include `updatedAt` / `rowId` and omit
+ *   embedding flags that UserProfile models.
+ */
+
+/**
+ * Server-issued ULID on a stored JWT/plan record, used as alertSearch afterId /
+ * beforeId. Not an authentication JWT and not a delegated notification JWT.
+ */
+export type AlertSearchCursorUlid = string;
+
+/**
+ * JWT row from endorser `jwtsWithDidAfterId` (no claim body).
+ * Cursor field: `id`.
+ */
+export interface AlertSearchClaimRecord {
+  id: AlertSearchCursorUlid;
+  issuedAt: string;
+  issuer: string;
+  subject?: string;
+  claimType?: string;
+  handleId?: string;
+  fromEntity?: string;
+  toEntity?: string;
+}
+
+/**
+ * JWT row from `jwtsForUserPlanContributions` and
+ * `jwtsGiveActionOfferForPlanHandleIds`. `claim` is the jwt table TEXT
+ * (canonical JSON string); alertSearch does not JSON.parse it.
+ * Cursor field: `id`.
+ */
+export interface AlertSearchJwtWithClaimRecord extends AlertSearchClaimRecord {
+  claim?: string;
+}
+
+/**
+ * plan_claim row from `plansLastUpdatedBetween` and `plansByLocationAfterId`.
+ * Cursor field: `jwtId` (not `id`).
+ */
+export interface AlertSearchPlanRecord {
+  handleId: string;
+  jwtId: AlertSearchCursorUlid;
+  issuerDid?: string;
+  agentDid?: string;
+  fulfillsLinkConfirmed?: boolean | number;
+  fulfillsPlanClaimId?: string;
+  fulfillsPlanHandleId?: string;
+  name?: string;
+  description?: string;
+  image?: string;
+  endTime?: string;
+  startTime?: string;
+  locLat?: number;
+  locLon?: number;
+  resultDescription?: string;
+  resultIdentifier?: string;
+  url?: string;
+}
+
+/**
+ * user_profile row from partner `profilesByLocationAfterDate`.
+ * Profiles have no JWT `id`; partner paging uses dates decoded from cursor ULIDs.
+ */
+export interface AlertSearchProfileRecord {
+  rowId?: number;
+  issuerDid: string;
+  updatedAt?: string;
+  description: string;
+  locLat?: number;
+  locLon?: number;
+  locLat2?: number;
+  locLon2?: number;
+}
+
+export interface EndorserAlertSearchData {
+  claims: AlertSearchClaimRecord[];
+  personalPlanContributions: AlertSearchJwtWithClaimRecord[];
+  trackedPlanUpdates: AlertSearchPlanRecord[];
+  trackedPlanClaims: AlertSearchJwtWithClaimRecord[];
+  plansNearby: AlertSearchPlanRecord[];
+}
+
+export interface PartnerAlertSearchData {
+  profilesNearby: AlertSearchProfileRecord[];
+}
+
+/**
+ * Endorser GET/POST /api/v2/report/alertSearch body.
+ * Per-bucket SQL hitLimit is not currently copied onto this envelope.
+ * Timeouts may set `userMessage` instead.
+ */
+export interface EndorserAlertSearchResponse {
+  data: EndorserAlertSearchData;
+  userMessage?: string;
+}
+
+/**
+ * Partner GET/POST /api/partner/alertSearch body.
+ */
+export interface PartnerAlertSearchResponse {
+  data: PartnerAlertSearchData;
+  userMessage?: string;
+}
+
+/**
+ * Union of the six alertSearch buckets for a future combined daily run.
+ * Not returned by a single server endpoint today.
+ */
+export interface CombinedAlertSearchData
+  extends EndorserAlertSearchData,
+    PartnerAlertSearchData {}

src/interfaces/index.ts

@@ -1,7 +1,9 @@
+export * from "./alertSearch";
 export * from "./claims";
 export * from "./claims-result";
 export * from "./common";
 export * from "./deepLinks";
 export * from "./limits";
+export * from "./notifyApi";
 export * from "./records";
 export * from "./user";

src/interfaces/notifyApi.ts

@@ -0,0 +1,424 @@
+/**
+ * Wire payloads for the notify-api (notification-wakeup-service): request
+ * bodies, query parameters, the JWT payloads the app signs for it, and the
+ * bodies it answers with.
+ *
+ * Each type names the route it belongs to and holds the fields that route reads
+ * or writes; a field the app sends and the service ignores is marked "Not read
+ * by the service." The service's code is the source of truth, in
+ * notification-wakeup-service: `src/routes/notifications.ts`,
+ * `src/routes/notifySms.ts`, `src/routes/debug.ts`, `src/middleware/`, and
+ * `src/services/alertAuthorization.ts`.
+ *
+ * Two kinds of JWT travel to the service:
+ * - The Bearer token on each request authenticates the caller, and the service
+ *   takes the DID from it; no body carries the DID. On `/notify-sms` that token
+ *   also carries an {@link SmsNotificationActionClaim}.
+ * - The delegated JWTs inside an {@link AlertAuthorizationRequestBody} are
+ *   stored credentials the service later presents to Endorser and Partner.
+ *   They authenticate nothing about the upload that carries them.
+ *
+ * Refusals come in these shapes, by where they are raised:
+ * - {@link NotifyApiUncodedFailure}: a message and no code, from the auth
+ *   stages in front of every authenticated route, and from a push
+ *   alert-authorization route that fails to store or delete.
+ * - {@link NotificationDeviceRouteFailure}: a sentence under `error`, from
+ *   register and refresh.
+ * - {@link DebugSendWakeupResponse} with `success: false`.
+ * - {@link AlertAuthorizationBatchFailure} and {@link NotifySmsFailure}: coded.
+ *
+ * A proxy in front of the service can answer with none of these, or with no
+ * JSON at all.
+ */
+
+// ---------------------------------------------------------------------------
+// Shared
+// ---------------------------------------------------------------------------
+
+/**
+ * Refusal with a message and no code. The auth stages send it with 401 for a
+ * missing, invalid, or Endorser-rejected Bearer token and 503 when Endorser
+ * cannot be reached; their messages end with a timestamp for finding the server
+ * log. The push alert-authorization routes send it with 500 when storing or
+ * deleting fails.
+ */
+export interface NotifyApiUncodedFailure {
+  success: false;
+  message: string;
+}
+
+// ---------------------------------------------------------------------------
+// Device routes: /notifications/register, /notifications/refresh, /debug
+// ---------------------------------------------------------------------------
+
+/**
+ * Local-test switch on the device routes. `true` with no `Authorization`
+ * header makes the service skip JWT and Endorser checks and file the request
+ * under a synthetic test user. A request carrying a Bearer token is
+ * authenticated normally whatever this says, and no other route reads it.
+ */
+export interface NotifyApiTestModeFlag {
+  testMode?: boolean;
+}
+
+/**
+ * Body of `POST /notifications/register`: store this device's FCM token under
+ * the caller's DID, keyed by `deviceId`. Success is a bare 200 with a
+ * plain-text body; a failure to store is a bare 500.
+ */
+export interface NotificationRegisterRequest extends NotifyApiTestModeFlag {
+  /** Stable per-install id; trimmed by the service and required non-empty. */
+  deviceId: string;
+  /** Required non-empty. */
+  fcmToken: string;
+  /** `Capacitor.getPlatform()`: `"ios"`, `"android"`, or `"web"`. Required non-empty. */
+  platform: string;
+  /** The DID comes from the Bearer token; a body with a `userId` key is rejected. */
+  userId?: never;
+}
+
+/**
+ * Body of `POST /notifications/refresh`. The service finds the caller's device
+ * by `deviceId`, or by `fcmToken` when no `deviceId` is sent, and answers 400
+ * when neither is present and non-empty. When both are sent they must name the
+ * same device, or the answer is 404.
+ */
+export type NotificationRefreshRequest = NotifyApiTestModeFlag & {
+  /** Not read by the service. */
+  platform?: string;
+} & (
+    | { deviceId: string; fcmToken?: string }
+    | { deviceId?: string; fcmToken: string }
+  );
+
+/** Success body of `POST /notifications/refresh`. */
+export interface NotificationRefreshResponse {
+  shouldNotify: boolean;
+  /** Instants for the device to schedule, as Unix milliseconds. */
+  nextNotifications: Array<{ timestamp: number }>;
+}
+
+/**
+ * Refusal from `POST /notifications/register` (400) or
+ * `POST /notifications/refresh` (400, or 404 when no device of the caller's
+ * matches). `error` is a sentence such as `"Device not found"`, not a code.
+ */
+export interface NotificationDeviceRouteFailure {
+  error: string;
+}
+
+/**
+ * Body of `POST /debug/send-wakeup`, which pushes a WAKEUP_PING to one of the
+ * caller's devices. The `/debug` routes exist only on a service started with
+ * `DEBUG_ENDPOINT` on.
+ */
+export interface DebugSendWakeupRequest extends NotifyApiTestModeFlag {
+  /** A token registered under the caller's DID; required non-empty. */
+  fcmToken: string;
+  /** Not read by the service. */
+  deviceId?: string;
+  /** Not read by the service. */
+  platform?: string;
+}
+
+/**
+ * Every answer `POST /debug/send-wakeup` writes itself. A 200 still carries
+ * `success: false` when the push was skipped or failed, so `success`, not the
+ * status, says whether a WAKEUP_PING went out.
+ */
+export interface DebugSendWakeupResponse {
+  success: boolean;
+  /**
+   * Why no push went out: `"fcmToken is required"` (400), `"Device not found"`
+   * (404), or with a 200, `"Device was notified within the eligibility
+   * threshold"` or `"FCM send failed"`.
+   */
+  failureReason?: string;
+  /** Last six characters of the token; absent on the 400. */
+  fcmTokenSuffix?: string;
+}
+
+// ---------------------------------------------------------------------------
+// Alert authorization: /notifications/alert-authorization and
+// /notify-sms/alert-authorization
+// ---------------------------------------------------------------------------
+
+/**
+ * Payload the app signs for one {@link DelegatedAlertJwt}; the signer adds
+ * `iss` (the DID) and `iat`. The service requires the signed `nbf` and `exp` to
+ * equal the values listed beside the JWT.
+ */
+export interface DelegatedAlertJwtPayload {
+  /** Unix seconds, at or before the midnight UTC that opens the entry's `day`. */
+  nbf: number;
+  /** Unix seconds, at or after the midnight UTC that closes the entry's `day`. */
+  exp: number;
+}
+
+/** One day's delegated credential inside an {@link AlertAuthorizationRequestBody}. */
+export interface DelegatedAlertJwt {
+  /** Integer; the batch's values are consecutive, starting anywhere. */
+  sequence: number;
+  /** UTC calendar day, `YYYY-MM-DD`, distinct across the batch. */
+  day: string;
+  /** Unix seconds; equal to the signed `nbf`. */
+  nbf: number;
+  /** Unix seconds; equal to the signed `exp`. */
+  exp: number;
+  /** Signed by the caller's DID, which must be a `did:ethr`. */
+  jwt: string;
+}
+
+/**
+ * Body of `PUT /notifications/alert-authorization` (push) and
+ * `POST /notify-sms/alert-authorization` (SMS), which validate it with one
+ * rule. A stored batch replaces the unused inventory the DID holds in that
+ * channel; JWTs already spent stay behind.
+ */
+export interface AlertAuthorizationRequestBody {
+  /** Required non-empty; echoed in the response. */
+  batchId: string;
+  /** UTC hour, integer 0-23. */
+  notifyHourUtc: number;
+  /** UTC minute, integer 0-59. */
+  notifyMinuteUtc: number;
+  /**
+   * IANA zone name such as `"America/Denver"`. Validated and stored; no
+   * scheduling decision reads it.
+   */
+  timezone?: string;
+  /** Exactly 100 entries. */
+  jwts: DelegatedAlertJwt[];
+}
+
+/** Success body of storing a batch, on either alert-authorization route. */
+export interface AlertAuthorizationResponse {
+  success: true;
+  batchId: string;
+  /** The stored UTC hour; null only for a batch stored without one. */
+  notifyHourUtc: number | null;
+  /** The stored UTC minute; null only for a batch stored without one. */
+  notifyMinuteUtc: number | null;
+  timezone: string | null;
+  /** JWTs stored from this batch. */
+  storedCount: number;
+  /** Unused JWTs the DID holds in this channel once the batch is stored. */
+  unusedCount: number;
+}
+
+/** Success body of `DELETE` on either alert-authorization route. */
+export interface AlertAuthorizationRevokeResponse {
+  success: true;
+  /** Batches removed, spent ones included. */
+  deletedBatches: number;
+  /** JWTs removed, spent ones included. */
+  deletedJwts: number;
+}
+
+/**
+ * Coded refusal of a batch (400) on either alert-authorization route: it failed
+ * validation, or the caller's identity cannot hold one. Nothing was stored.
+ */
+export interface AlertAuthorizationBatchFailure {
+  success: false;
+  error:
+    | "ALERT_AUTHORIZATION_INVALID_BATCH"
+    | "DELEGATED_JWT_UNSUPPORTED_IDENTITY";
+  message: string;
+  /** Specific problems, at most 20 plus a count of the rest. */
+  details: string[];
+}
+
+/** Refusal from `PUT` or `DELETE /notifications/alert-authorization`. */
+export type AlertAuthorizationFailure =
+  | AlertAuthorizationBatchFailure
+  | NotifyApiUncodedFailure;
+
+// ---------------------------------------------------------------------------
+// SMS channel: /notify-sms
+// ---------------------------------------------------------------------------
+
+/**
+ * What a `/notify-sms` action claim authorizes. The service checks `action`
+ * against the route and, for handset actions, checks that `phoneNumber`
+ * normalizes to the same E.164 number the request names.
+ */
+export type SmsActionTarget =
+  // Bound to one handset; the number must match the request's.
+  | {
+      action: "register-phone" | "verify-phone" | "delete-phone";
+      phoneNumber: string;
+    }
+  // Bound to a number only when the request sends `?phoneNumber=`.
+  | { action: "list-phones"; phoneNumber?: string }
+  // Acts on the DID's whole alert authorization; the service reads no number.
+  | {
+      action: "authorize-alert-search" | "revoke-alert-search";
+      phoneNumber?: undefined;
+    };
+
+/** Actions the service's `requireSmsActionJwt` stage recognizes, one per route. */
+export type SmsAction = SmsActionTarget["action"];
+
+/** The `claim` in the Bearer JWT on every `/notify-sms` request. */
+export type SmsNotificationActionClaim = {
+  /** Claim namespace; distinct from `https://giftopia.me`, the link in the texts. */
+  "@context": "https://giftopia.tech";
+  "@type": "SmsNotificationAction";
+} & SmsActionTarget;
+
+/**
+ * Payload the app signs as the Bearer JWT on every `/notify-sms` request; the
+ * signer adds `iss`, `iat`, and `exp`. The service refuses a token whose `iat`
+ * is further than `SMS_ACTION_JWT_MAX_AGE_SEC` from its clock or whose `exp`
+ * has passed, and accepts each token once.
+ */
+export interface SmsActionJwtPayload {
+  claim: SmsNotificationActionClaim;
+}
+
+/**
+ * Query of `GET /notify-sms/phone`. With `phoneNumber`, the response adds the
+ * DIDs verified on that number, which the service reveals only to a DID that
+ * has verified it too.
+ */
+export interface SmsPhoneListQuery {
+  phoneNumber?: string;
+}
+
+/** One of the caller's registrations, as `GET /notify-sms/phone` lists it. */
+export interface SmsPhoneRegistration {
+  /** The full E.164 number; these are the caller's own. */
+  phoneNumber: string;
+  verified: boolean;
+  /** ISO 8601; null until verified. */
+  verifiedAt: string | null;
+  /** ISO 8601. */
+  createdAt: string;
+}
+
+/**
+ * Success body of `GET /notify-sms/phone`, oldest registration first. An
+ * identity with no registrations gets an empty list.
+ */
+export interface SmsPhoneListResponse {
+  success: true;
+  phones: SmsPhoneRegistration[];
+  /** The queried number, normalized; present exactly when `?phoneNumber=` was sent. */
+  phoneNumber?: string;
+  /**
+   * Every DID verified on the queried number, the caller's included; present
+   * exactly when `?phoneNumber=` was sent.
+   */
+  dids?: string[];
+}
+
+/** Body of `POST /notify-sms/phone`: record the number, unverified, and text it a code. */
+export interface SmsPhoneRegisterRequest {
+  /** E.164; the service normalizes, taking ten bare digits as a US number. */
+  phoneNumber: string;
+}
+
+/**
+ * Success body of `POST /notify-sms/phone`. `phoneNumber` is masked, such as
+ * `+1555*****23`, so it cannot stand in for the number that was sent.
+ */
+export type SmsPhoneRegisterResponse =
+  // The caller had already verified this number; no text was sent.
+  | { success: true; phoneNumber: string; verified: true }
+  | {
+      success: true;
+      phoneNumber: string;
+      verified: false;
+      /** ISO 8601; when the texted code stops working. */
+      expiresAt: string;
+      /**
+       * The plaintext code, only from a service run with both
+       * `NODE_ENV=test-local` and `SMS_DEV_ECHO_CODE`.
+       */
+      devCode?: string;
+    };
+
+/** Body of `PUT /notify-sms/phone`: match the texted code. */
+export interface SmsPhoneVerifyRequest {
+  phoneNumber: string;
+  /** The six digits as texted. */
+  code: string;
+}
+
+/**
+ * Success body of `PUT /notify-sms/phone`, also for a number the caller had
+ * already verified. `phoneNumber` is masked.
+ */
+export interface SmsPhoneVerifyResponse {
+  success: true;
+  phoneNumber: string;
+  verified: true;
+}
+
+/**
+ * Body, and also query, of `DELETE /notify-sms/phone`. The service reads the
+ * body first and falls back to the query, because proxies may drop DELETE
+ * bodies.
+ */
+export interface SmsPhoneDeleteRequest {
+  phoneNumber: string;
+}
+
+/** Success body of `DELETE /notify-sms/phone`; `deleted` is false when the number was not registered. */
+export interface SmsPhoneDeleteResponse {
+  success: true;
+  deleted: boolean;
+}
+
+/** Codes of `/notify-sms` refusals that carry nothing beyond the message. */
+export type NotifySmsPlainErrorCode =
+  | "SMS_DISABLED" // 503
+  | "SMS_NOT_CONFIGURED" // 500
+  | "SMS_PHONE_INVALID" // 400
+  | "SMS_PHONE_BLOCKED" // 403
+  | "SMS_PHONE_NOT_VERIFIED_BY_CALLER" // 403
+  | "SMS_RECIPIENT_NOT_ALLOWED" // 403
+  | "SMS_CODE_RATE_LIMITED" // 429
+  | "SMS_CODE_SEND_FAILED" // 502
+  | "SMS_CODE_EXPIRED" // 400
+  | "SMS_CODE_ATTEMPTS_EXHAUSTED" // 429
+  | "SMS_NO_VERIFIED_PHONE" // 409
+  | "SMS_ALERT_AUTHORIZATION_FAILED" // 500
+  | "SMS_ALERT_AUTHORIZATION_DELETE_FAILED" // 500
+  | "SMS_ACTION_JWT_NOT_AUTHENTICATED" // 500
+  | "SMS_ACTION_JWT_MISSING_CLAIM" // 403
+  | "SMS_ACTION_JWT_WRONG_ACTION" // 403
+  | "SMS_ACTION_JWT_PHONE_MISMATCH" // 403
+  | "SMS_ACTION_JWT_STALE" // 401
+  | "SMS_ACTION_JWT_EXPIRED" // 401
+  | "SMS_ACTION_JWT_REPLAYED"; // 401
+
+/**
+ * A coded refusal from any `/notify-sms` route. The auth stages in front of
+ * these routes refuse with a {@link NotifyApiUncodedFailure} instead.
+ */
+export type NotifySmsFailure =
+  | { success: false; error: NotifySmsPlainErrorCode; message: string }
+  | {
+      success: false;
+      error: "SMS_CODE_MISMATCH"; // 400
+      message: string;
+      /** Wrong codes left before this code is cleared. */
+      attemptsRemaining: number;
+    }
+  | {
+      success: false;
+      error: "SMS_PHONE_DID_LIMIT"; // 409
+      message: string;
+      /** Most identities one number may carry. */
+      limit: number;
+      /** Identities other than the caller already verified on the number. */
+      verifiedCount: number;
+      /**
+       * Every DID verified on the number. Sent only by `PUT`, whose caller has
+       * just proved possession of the handset.
+       */
+      dids?: string[];
+    }
+  | AlertAuthorizationBatchFailure;

src/libs/alertSearch.ts

@@ -0,0 +1,69 @@
+/**
+ * Typed alertSearch API contract only. No HTTP client yet.
+ *
+ * Hosts: use DEFAULT_ENDORSER_API_SERVER and DEFAULT_PARTNER_API_SERVER from
+ * `@/constants/app`. Do not duplicate those constants here.
+ *
+ * JWT kinds (do not mix these):
+ * - Authentication JWT: short-lived access token (`iss`/`iat`/`exp`) sent as
+ *   `Authorization: Bearer` for interactive API calls (`accessToken` /
+ *   `getHeaders`). Identifies the requester DID.
+ * - Delegated notification JWT: a batch of 100 tokens, each valid for one whole
+ *   UTC day, from `mintAlertAuthorizationBatch`
+ *   (`@/services/notifications/alertAuthorizationBatch`), uploaded to the
+ *   notify-api's push or SMS `alert-authorization` route.
+ * - Native background pool: `mintBackgroundJwtTokenPool` for daily-notification
+ *   plugin prefetch. Unrelated to alertSearch and to the delegated batch.
+ * - alertSearch cursor ULID: server-issued record/JWT primary id (26-char
+ *   ULID). `afterId` means ids strictly greater than that ULID; `beforeId`
+ *   means strictly less. First daily run omits afterId. `beforeId` is for
+ *   pagination within a run. These are not auth JWTs and not signed tokens.
+ *
+ * Truncation: each endorser bucket query uses a server hit-limit (typically
+ * 50). That flag is not currently returned on the alertSearch JSON envelope.
+ * Timeouts may add `userMessage`. A later caller must still paginate with
+ * beforeId when a bucket may be incomplete.
+ */
+
+import type {
+  AlertSearchCursorUlid,
+  CombinedAlertSearchData,
+  EndorserAlertSearchResponse,
+  PartnerAlertSearchResponse,
+} from "@/interfaces/alertSearch";
+
+export const ENDORSER_ALERT_SEARCH_PATH = "/api/v2/report/alertSearch";
+export const PARTNER_ALERT_SEARCH_PATH = "/api/partner/alertSearch";
+
+export interface AlertSearchLocationBBox {
+  minLocLat: number;
+  maxLocLat: number;
+  minLocLon: number;
+  maxLocLon: number;
+}
+
+/**
+ * Query/body params accepted by endorser and partner alertSearch (GET or POST).
+ * GET is the planned daily method; the server also accepts POST.
+ */
+export interface AlertSearchRequestParams {
+  afterId?: AlertSearchCursorUlid;
+  beforeId?: AlertSearchCursorUlid;
+  afterDate?: string;
+  beforeDate?: string;
+  location?: AlertSearchLocationBBox;
+  minLocLat?: number;
+  maxLocLat?: number;
+  minLocLon?: number;
+  maxLocLon?: number;
+  planHandleIds?: string[];
+  planIds?: string[];
+  handleIds?: string[];
+}
+
+export type {
+  AlertSearchCursorUlid,
+  CombinedAlertSearchData,
+  EndorserAlertSearchResponse,
+  PartnerAlertSearchResponse,
+};

src/libs/crypto/backgroundJwtPool.ts

@@ -0,0 +1,93 @@
+/**
+ * Day-scoped JWT pool for native New Activity background prefetch.
+ *
+ * Kept apart from `@/libs/crypto` so minting depends only on the signer and the
+ * pool constants: the prefetch path is the one place in the app where a
+ * credential is handed to native code and used without any JavaScript running,
+ * and its dependencies should stay small enough to read in one sitting.
+ */
+
+import {
+  BACKGROUND_JWT_POOL_SIZE,
+  BACKGROUND_JWT_SECONDS_PER_DAY,
+  BACKGROUND_JWT_WINDOW_SLACK_SECONDS,
+} from "@/constants/backgroundJwt";
+import type { KeyMetaWithPrivate } from "@/interfaces/common";
+import { createEndorserJwtForKey } from "./vc";
+
+/** Thrown for identities whose keys cannot sign a day-scoped background pool. */
+export class BackgroundJwtUnsupportedIdentityError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "BackgroundJwtUnsupportedIdentityError";
+  }
+}
+
+/**
+ * Mint one JWT per UTC day for native background prefetch
+ * (`configureNativeFetcher` `jwtTokens`), covering the
+ * {@link BACKGROUND_JWT_POOL_SIZE} consecutive days starting with the day of
+ * the call.
+ *
+ * Each token is valid only for the single day it covers: `nbf` at that day's
+ * opening midnight and `exp` at its closing one, each widened by
+ * {@link BACKGROUND_JWT_WINDOW_SLACK_SECONDS} for clock skew. A token that
+ * escapes through a log line or a captured header therefore buys one day of
+ * Endorser access rather than the whole grant. The day windows are also what
+ * make the tokens distinct: the ES256K signer is deterministic, so JWTs built
+ * from identical payloads are byte-identical, and a pool of identical strings
+ * defeats any duplicate-token rule the server may apply.
+ *
+ * Slot order is a contract with the native selector, which reads
+ * `pool[epochDay % pool.size()]` and has no record of when the pool was minted:
+ * the token covering a UTC day sits at index `epochDay % POOL_SIZE`. Any
+ * POOL_SIZE consecutive days hit every index exactly once, so the array is
+ * dense whatever day minting starts on.
+ *
+ * The caller supplies the decrypted account rather than a DID: signing
+ * {@link BACKGROUND_JWT_POOL_SIZE} tokens from a DID would decrypt the identity
+ * once per token, which costs seconds on a phone and runs on every app
+ * foreground.
+ *
+ * Passkey (`did:peer`) identities cannot mint this pool -- each signature is a
+ * WebAuthn assertion, and `createJwtNavigator` overrides the day window with its
+ * own one-minute `exp` -- so they raise
+ * {@link BackgroundJwtUnsupportedIdentityError} instead of prompting
+ * {@link BACKGROUND_JWT_POOL_SIZE} times for tokens that expire before the
+ * prefetch they were minted for.
+ *
+ * @param account decrypted identity the pool is issued by and for
+ * @throws BackgroundJwtUnsupportedIdentityError for passkey identities
+ */
+export async function mintBackgroundJwtTokenPool(
+  account: KeyMetaWithPrivate,
+): Promise<string[]> {
+  if (!account?.identity) {
+    throw new BackgroundJwtUnsupportedIdentityError(
+      `No day-scoped signing key for ${account?.did}; background prefetch ` +
+        "requires a seed-phrase identity.",
+    );
+  }
+  const did = account.did;
+  const nowEpoch = Math.floor(Date.now() / 1000);
+  const firstEpochDay = Math.floor(nowEpoch / BACKGROUND_JWT_SECONDS_PER_DAY);
+  const tokens: string[] = new Array(BACKGROUND_JWT_POOL_SIZE);
+  for (let offset = 0; offset < BACKGROUND_JWT_POOL_SIZE; offset++) {
+    const epochDay = firstEpochDay + offset;
+    const dayStartEpoch = epochDay * BACKGROUND_JWT_SECONDS_PER_DAY;
+    const tokenPayload = {
+      nbf: dayStartEpoch - BACKGROUND_JWT_WINDOW_SLACK_SECONDS,
+      exp:
+        dayStartEpoch +
+        BACKGROUND_JWT_SECONDS_PER_DAY +
+        BACKGROUND_JWT_WINDOW_SLACK_SECONDS,
+      iat: nowEpoch,
+      iss: did,
+    };
+    tokens[epochDay % BACKGROUND_JWT_POOL_SIZE] = await createEndorserJwtForKey(
+      account,
+      tokenPayload,
+    );
+  }
+  return tokens;
+}

src/libs/crypto/index.ts

@@ -4,10 +4,6 @@ import { entropyToMnemonic } from "ethereum-cryptography/bip39";
 import { wordlist } from "ethereum-cryptography/bip39/wordlists/english";
 import { HDNode } from "@ethersproject/hdnode";
 
-import {
-  BACKGROUND_JWT_EXPIRY_SECONDS,
-  BACKGROUND_JWT_POOL_SIZE,
-} from "@/constants/backgroundJwt";
 import {
   CONTACT_IMPORT_CONFIRM_URL_PATH_TIME_SAFARI,
   createEndorserJwtForDid,
@@ -108,45 +104,6 @@ export const accessToken = async (did?: string) => {
   }
 };
 
-/**
- * JWT for native New Activity prefetch (`configureNativeFetcher` / WorkManager).
- * Uses a long `exp` (`BACKGROUND_JWT_EXPIRY_SECONDS`); do not use for ordinary
- * in-app API calls — use `getHeaders` / `accessToken` instead.
- */
-export const accessTokenForBackgroundNotifications = async (
-  did?: string,
-): Promise<string> => {
-  if (!did) {
-    return "";
-  }
-  const nowEpoch = Math.floor(Date.now() / 1000);
-  const endEpoch = nowEpoch + BACKGROUND_JWT_EXPIRY_SECONDS;
-  const tokenPayload = { exp: endEpoch, iat: nowEpoch, iss: did };
-  return createEndorserJwtForDid(did, tokenPayload);
-};
-
-/**
- * Mint {@link BACKGROUND_JWT_POOL_SIZE} distinct JWTs for native background prefetch
- * (`configureNativeFetcher` `jwtTokens`). Unique `jti` per slot; same `exp` for all.
- */
-export async function mintBackgroundJwtTokenPool(
-  did: string,
-): Promise<string[]> {
-  const nowEpoch = Math.floor(Date.now() / 1000);
-  const endEpoch = nowEpoch + BACKGROUND_JWT_EXPIRY_SECONDS;
-  const tokens: string[] = [];
-  for (let i = 0; i < BACKGROUND_JWT_POOL_SIZE; i++) {
-    const tokenPayload = {
-      exp: endEpoch,
-      iat: nowEpoch,
-      iss: did,
-      jti: `${did}#bg#${i}`,
-    };
-    tokens.push(await createEndorserJwtForDid(did, tokenPayload));
-  }
-  return tokens;
-}
-
 /**
  * Extract JWT from various URL formats
  * @param jwtUrlText The URL containing the JWT

src/main.capacitor.ts

@@ -43,7 +43,11 @@ import "./utils/safeAreaInset";
 
 // Load Daily Notification plugin at startup so native performRecovery() runs at launch (rollover recovery)
 import "@timesafari/daily-notification-plugin";
-import { configureNativeFetcherIfReady } from "@/services/notifications";
+import {
+  configureNativeFetcherIfReady,
+  initializeNativePushAndFirebaseMessaging,
+  onNotificationAuthMayBeReady,
+} from "@/services/notifications";
 
 logger.log("[Capacitor] 🚀 Starting initialization");
 logger.log("[Capacitor] Platform:", process.env.VITE_PLATFORM);
@@ -462,6 +466,7 @@ if (
       // Refresh JWT for background New Activity prefetch (WorkManager cannot run JS;
       // short-lived tokens would expire between configure and T−5 fetch without this).
       await configureNativeFetcherIfReady();
+      onNotificationAuthMayBeReady();
     }
   });
 }
@@ -474,6 +479,8 @@ setTimeout(async () => {
     );
     await registerDeepLinkListener();
     logger.info(`[Main] 🎉 Deep link system fully initialized!`);
+    // Firebase Messaging (JS) + Capacitor PushNotifications (FCM/APNs token, delivery listeners)
+    await initializeNativePushAndFirebaseMessaging();
     // Configure native fetcher for API-driven daily notifications (activeDid + JWT)
     await configureNativeFetcherIfReady();
   } catch (error) {

src/plugins/NotificationInspectorPlugin.ts

@@ -0,0 +1,17 @@
+import { registerPlugin } from "@capacitor/core";
+
+export type PendingNotificationInfo = {
+  identifier: string;
+  nextTriggerDate?: number | null;
+  triggerType?: string | null;
+  /** Epoch ms for intended fire time when known (userInfo or API notification id); stable across refresh. */
+  wallClockMillis?: number | null;
+  wallClockSource?: string | null;
+};
+
+export interface NotificationInspectorPlugin {
+  getPendingNotifications(): Promise<{ pending: PendingNotificationInfo[] }>;
+}
+
+export const NotificationInspector =
+  registerPlugin<NotificationInspectorPlugin>("NotificationInspector");

src/router/index.ts

@@ -10,6 +10,7 @@ import {
   retrieveAccountDids,
   generateSaveAndActivateIdentity,
 } from "../libs/util";
+import { includeDevToolkitRoutes } from "../utils/includeDevToolkitRoutes";
 
 const routes: Array<RouteRecordRaw> = [
   {
@@ -290,6 +291,19 @@ const routes: Array<RouteRecordRaw> = [
     name: "user-profile",
     component: () => import("../views/UserProfileView.vue"),
   },
+  ...(includeDevToolkitRoutes
+    ? ([
+        {
+          path: "/dev/notifications",
+          name: "dev-notifications",
+          component: () => import("../views/dev/NotificationDebugView.vue"),
+          meta: {
+            title: "Notification Debug",
+            requiresAuth: false,
+          },
+        },
+      ] satisfies Array<RouteRecordRaw>)
+    : []),
   // Catch-all route for 404 errors - must be last
   {
     path: "/:pathMatch(.*)*",
@@ -424,6 +438,18 @@ router.beforeEach(async (to, _from, next) => {
       // sessionStorage may be unavailable
     }
 
+    // Keep diagnostic pages reachable when identity creation fails (e.g. a
+    // failed migration leaves every DB call throwing), so the user can open
+    // Profile, then Advanced Settings, then the Test Page or Logs, instead of
+    // being bounced back to /start forever.
+    const diagnosticRoutes = ["/account", "/test", "/logs"];
+    if (diagnosticRoutes.includes(to.path)) {
+      logger.info(
+        `[Router] 🩺 Allowing diagnostic route ${to.path} despite identity creation failure`,
+      );
+      return next();
+    }
+
     // Redirect to start page if identity creation fails
     // This allows users to manually create an identity or troubleshoot
     logger.info(

src/services/notifications/NativeNotificationService.ts

@@ -12,8 +12,32 @@
  */
 
 import { Capacitor } from "@capacitor/core";
+import type { PushNotificationSchema } from "@capacitor/push-notifications";
+import type {
+  NotificationRefreshRequest,
+  NotificationRefreshResponse,
+} from "@/interfaces/notifyApi";
 import { DailyNotification } from "@/plugins/DailyNotificationPlugin";
+import { getOrCreateDeviceId } from "./deviceId";
 import { REMINDER_ID_DAILY_REMINDER } from "./reminderIds";
+import { configureNativeFetcherIfReady } from "./nativeFetcherConfig";
+import {
+  getNotificationApiBaseUrl,
+  getTestMode,
+} from "./NotificationDebugConfig";
+import {
+  logRefreshFailure,
+  logRefreshStarted,
+  logRefreshSuccess,
+  logScheduleReplacement,
+} from "./notificationLog";
+import {
+  getNotificationApiHeaders,
+  logSkippingRefreshDueToMissingAuth,
+  notificationApiFailureMessage,
+  readNotificationApiBody,
+} from "./notificationApiAuth";
+import { logNotification } from "./NotificationDebugEvents";
 
 /**
  * Extended type for DailyNotification that includes the actual Swift implementation
@@ -542,3 +566,204 @@ export class NativeNotificationService implements NotificationServiceInterface {
     return this.platformName;
   }
 }
+
+export type RefreshNotificationsResult = {
+  ok: boolean;
+  scheduledCount: number;
+  status?: number;
+  errorMessage?: string;
+};
+
+/**
+ * Re-applies native API fetcher credentials (JWT pool, active DID) so background
+ * notification workers can run. No UI; safe from push handlers while backgrounded.
+ */
+export async function refreshNotificationsWithDiagnostics(options?: {
+  source?: string;
+}): Promise<RefreshNotificationsResult> {
+  const startedAt = performance.now();
+  const source = options?.source;
+  logRefreshStarted(source);
+
+  if (!Capacitor.isNativePlatform()) {
+    const errorMessage = "not a native platform";
+    logRefreshFailure(startedAt, errorMessage, undefined, source);
+    return {
+      ok: false,
+      scheduledCount: 0,
+      errorMessage,
+    };
+  }
+
+  try {
+    const auth = await getNotificationApiHeaders("refresh");
+    if (!auth.ok) {
+      logSkippingRefreshDueToMissingAuth();
+      logRefreshFailure(startedAt, auth.message, undefined, source);
+      return {
+        ok: false,
+        scheduledCount: 0,
+        errorMessage: auth.message,
+      };
+    }
+
+    let deviceId: string | undefined;
+    try {
+      deviceId = await getOrCreateDeviceId();
+    } catch (err) {
+      logger.warn(
+        "[NativeNotificationService] Could not obtain deviceId; skipping refresh",
+        err,
+      );
+    }
+    if (!deviceId) {
+      // The service finds the device by deviceId or fcmToken and answers 400
+      // without either, so there is no request worth sending.
+      const errorMessage = "no deviceId (cannot identify this device)";
+      logRefreshFailure(startedAt, errorMessage, undefined, source);
+      return { ok: false, scheduledCount: 0, errorMessage };
+    }
+
+    const body: NotificationRefreshRequest = {
+      deviceId,
+      platform: Capacitor.getPlatform(),
+      testMode: getTestMode(),
+    };
+    const baseUrl = getNotificationApiBaseUrl();
+    const res = await fetch(`${baseUrl}/notifications/refresh`, {
+      method: "POST",
+      headers: auth.headers,
+      body: JSON.stringify(body),
+    });
+
+    if (!res.ok) {
+      const errorMessage = notificationApiFailureMessage(
+        res.status,
+        await readNotificationApiBody(res),
+      );
+      logger.warn("[NativeNotificationService] refreshNotifications failed", {
+        status: res.status,
+        statusText: res.statusText,
+        errorMessage,
+      });
+      logRefreshFailure(startedAt, errorMessage, res.status, source);
+      return {
+        ok: false,
+        scheduledCount: 0,
+        status: res.status,
+        errorMessage,
+      };
+    }
+
+    const payload = (await res.json()) as NotificationRefreshResponse;
+    const scheduledCount = Array.isArray(payload?.nextNotifications)
+      ? payload.nextNotifications.length
+      : 0;
+    await applyNotificationRefreshPayload(payload);
+    logRefreshSuccess(startedAt, scheduledCount, source);
+    return { ok: true, scheduledCount };
+  } catch (err) {
+    logger.error("[NativeNotificationService] Refresh failed", err);
+    const message = err instanceof Error ? err.message : String(err);
+    logRefreshFailure(startedAt, message, undefined, source);
+    return { ok: false, scheduledCount: 0, errorMessage: message };
+  }
+}
+
+export async function refreshNotifications(): Promise<void> {
+  await refreshNotificationsWithDiagnostics();
+}
+
+export type NotificationRefreshPayload = {
+  shouldNotify?: boolean;
+  nextNotifications?: Array<{ timestamp?: number }>;
+};
+
+// `handleCapacitorPushNotificationReceived` and `applyNotificationRefreshPayload` are used by
+// DEV notification simulation tooling; they must stay production-safe because that tooling
+// exercises real flows. (`applyNotificationRefreshPayload` is also used by production refresh.)
+
+/**
+ * Apply a "refresh notifications" payload by clearing and scheduling timestamps via the native plugin.
+ *
+ * This is the shared implementation used by:
+ * - production refresh flow (`refreshNotifications` fetching from backend)
+ * - dev-only debug flows (mock refresh with local payloads)
+ *
+ * Important: This function intentionally mirrors production behavior and does not introduce
+ * any scheduling logic in UI layers.
+ */
+export async function applyNotificationRefreshPayload(
+  payload: unknown,
+): Promise<void> {
+  if (!Capacitor.isNativePlatform()) {
+    return;
+  }
+
+  const data = payload as NotificationRefreshPayload;
+  const nextNotifications = data?.nextNotifications;
+  if (!Array.isArray(nextNotifications)) {
+    return;
+  }
+
+  const timestamps = nextNotifications
+    .map((n) => (n as { timestamp?: unknown })?.timestamp)
+    .filter((t): t is number => typeof t === "number" && Number.isFinite(t));
+
+  if (timestamps.length === 0) {
+    logNotification("Schedule replacement skipped (no valid timestamps)");
+    return;
+  }
+
+  // Keep existing behavior: ensure background worker credentials are current.
+  await configureNativeFetcherIfReady();
+
+  logScheduleReplacement(timestamps.length);
+
+  if (typeof DailyNotification.clearApiNotifications !== "function") {
+    logger.warn(
+      "[NativeNotificationService] API notification clear unavailable (plugin clearApiNotifications missing); cannot replace schedule",
+    );
+    logNotification(
+      "Schedule replacement aborted (API notification clear unavailable on plugin)",
+    );
+    return;
+  }
+
+  logNotification("Clearing API notifications before refresh");
+  await DailyNotification.clearApiNotifications();
+  logNotification("Cleared API notifications");
+
+  if (typeof DailyNotification.scheduleApiNotifications !== "function") {
+    logger.warn(
+      "[NativeNotificationService] scheduleApiNotifications not available on plugin; cannot apply timestamps",
+    );
+    logNotification(
+      "Schedule replacement aborted (scheduleApiNotifications unavailable)",
+    );
+    return;
+  }
+
+  await DailyNotification.scheduleApiNotifications({ timestamps });
+  logNotification(
+    `Schedule replacement applied (${timestamps.length} timestamp(s))`,
+  );
+}
+
+/**
+ * Silent FCM/APNs data push: refresh native notification pipeline when requested by backend.
+ */
+export async function handleCapacitorPushNotificationReceived(
+  notification: PushNotificationSchema,
+): Promise<void> {
+  if (notification.data?.type === "WAKEUP_PING") {
+    logNotification("WAKEUP_PING handler — invoking refresh");
+    await refreshNotificationsWithDiagnostics({ source: "WAKEUP_PING" });
+    return;
+  }
+  const type =
+    typeof notification.data?.type === "string"
+      ? notification.data.type
+      : "(none)";
+  logNotification(`push handler ignored type=${type}`);
+}

src/services/notifications/NotificationDebugConfig.test.ts

@@ -0,0 +1,50 @@
+jest.mock("@/constants/app", () => ({
+  DEFAULT_NOTIFY_API_SERVER: "https://notify-api.timesafari.app",
+}));
+
+import {
+  getNotificationDebugOverrideHeaders,
+  NGROK_SKIP_BROWSER_WARNING_HEADER,
+  NGROK_SKIP_BROWSER_WARNING_VALUE,
+  setBackendBaseUrl,
+} from "./NotificationDebugConfig";
+
+const STORAGE_KEY_BACKEND_URL = "notificationDebug.backendBaseUrl";
+
+describe("getNotificationDebugOverrideHeaders", () => {
+  const memory = new Map<string, string>();
+
+  beforeEach(() => {
+    memory.clear();
+    Object.defineProperty(globalThis, "localStorage", {
+      configurable: true,
+      value: {
+        getItem: (key: string) => memory.get(key) ?? null,
+        setItem: (key: string, value: string) => {
+          memory.set(key, value);
+        },
+        removeItem: (key: string) => {
+          memory.delete(key);
+        },
+      },
+    });
+  });
+
+  it("adds the ngrok skip header when the debug backend override is set", () => {
+    setBackendBaseUrl("https://detail-frown-machine.ngrok-free.dev");
+
+    expect(getNotificationDebugOverrideHeaders()).toEqual({
+      [NGROK_SKIP_BROWSER_WARNING_HEADER]: NGROK_SKIP_BROWSER_WARNING_VALUE,
+    });
+    expect(memory.get(STORAGE_KEY_BACKEND_URL)).toBe(
+      "https://detail-frown-machine.ngrok-free.dev",
+    );
+  });
+
+  it("omits the ngrok skip header for the default/production notification API", () => {
+    setBackendBaseUrl("");
+
+    expect(getNotificationDebugOverrideHeaders()).toEqual({});
+    expect(memory.get(STORAGE_KEY_BACKEND_URL)).toBeUndefined();
+  });
+});

src/services/notifications/NotificationDebugConfig.ts

@@ -0,0 +1,132 @@
+/**
+ * Lightweight debug configuration for notification backend testing.
+ * Persists overrides in localStorage; production defaults apply when unset.
+ */
+
+import { DEFAULT_NOTIFY_API_SERVER } from "@/constants/app";
+
+const LOG = "[NotificationDebug]";
+const STORAGE_KEY_BACKEND_URL = "notificationDebug.backendBaseUrl";
+const STORAGE_KEY_TEST_MODE = "notificationDebug.testMode";
+const STORAGE_KEY_BYPASS_AUTH = "notificationDebug.bypassAuth";
+
+/** Free-ngrok interstitial bypass; only sent when the debug backend override is set. */
+export const NGROK_SKIP_BROWSER_WARNING_HEADER = "ngrok-skip-browser-warning";
+export const NGROK_SKIP_BROWSER_WARNING_VALUE = "true";
+
+/** Trim whitespace, drop trailing slash; empty input becomes null. */
+export function normalizeNotificationBackendUrl(url: string): string | null {
+  const trimmed = url.trim();
+  if (!trimmed) {
+    return null;
+  }
+  return trimmed.replace(/\/$/, "");
+}
+
+function readStorage(key: string): string | null {
+  if (typeof localStorage === "undefined") {
+    return null;
+  }
+  try {
+    return localStorage.getItem(key);
+  } catch {
+    return null;
+  }
+}
+
+function writeStorage(key: string, value: string | null): void {
+  if (typeof localStorage === "undefined") {
+    return;
+  }
+  try {
+    if (value === null) {
+      localStorage.removeItem(key);
+    } else {
+      localStorage.setItem(key, value);
+    }
+  } catch {
+    // Quota / privacy mode — ignore
+  }
+}
+
+/** Backend URL override, or null when using the default notify-api server. */
+export function getBackendBaseUrl(): string | null {
+  const raw = readStorage(STORAGE_KEY_BACKEND_URL);
+  if (raw === null) {
+    return null;
+  }
+  return normalizeNotificationBackendUrl(raw);
+}
+
+export function setBackendBaseUrl(url: string): void {
+  const normalized = normalizeNotificationBackendUrl(url);
+  if (normalized === null) {
+    writeStorage(STORAGE_KEY_BACKEND_URL, null);
+    // eslint-disable-next-line no-console
+    console.log(`${LOG} backend URL cleared (using default)`);
+    return;
+  }
+  writeStorage(STORAGE_KEY_BACKEND_URL, normalized);
+  // eslint-disable-next-line no-console
+  console.log(`${LOG} backend URL set to ${normalized}`);
+}
+
+/**
+ * When never configured via debug UI/console, matches prior hardcoded `testMode: true`.
+ */
+export function getTestMode(): boolean {
+  const raw = readStorage(STORAGE_KEY_TEST_MODE);
+  if (raw === null) {
+    return true;
+  }
+  return raw === "true";
+}
+
+export function setTestMode(enabled: boolean): void {
+  writeStorage(STORAGE_KEY_TEST_MODE, enabled ? "true" : "false");
+  // eslint-disable-next-line no-console
+  console.log(`${LOG} test mode ${enabled ? "enabled" : "disabled"}`);
+}
+
+/** When never configured via debug UI/console, auth bypass is off (JWT used). */
+export function getBypassAuth(): boolean {
+  const raw = readStorage(STORAGE_KEY_BYPASS_AUTH);
+  if (raw === null) {
+    return false;
+  }
+  return raw === "true";
+}
+
+export function setBypassAuth(enabled: boolean): void {
+  writeStorage(STORAGE_KEY_BYPASS_AUTH, enabled ? "true" : "false");
+  // eslint-disable-next-line no-console
+  console.log(`${LOG} auth bypass ${enabled ? "enabled" : "disabled"}`);
+}
+
+/**
+ * Base URL for notify-api calls (`/notifications/*`, `/notify-sms/*`).
+ * Uses debug override when set; otherwise `DEFAULT_NOTIFY_API_SERVER`.
+ */
+export function getNotificationApiBaseUrl(): string {
+  const override = getBackendBaseUrl();
+  if (override) {
+    return override;
+  }
+  return (
+    normalizeNotificationBackendUrl(DEFAULT_NOTIFY_API_SERVER) ??
+    DEFAULT_NOTIFY_API_SERVER
+  );
+}
+
+/**
+ * Extra headers for notification API calls when the Debug Panel backend URL
+ * override is set. Production/default hosts do not get this header.
+ */
+export function getNotificationDebugOverrideHeaders(): Record<string, string> {
+  if (!getBackendBaseUrl()) {
+    return {};
+  }
+  return {
+    [NGROK_SKIP_BROWSER_WARNING_HEADER]: NGROK_SKIP_BROWSER_WARNING_VALUE,
+  };
+}

src/services/notifications/NotificationDebugEvents.ts

@@ -0,0 +1,74 @@
+/**
+ * Lightweight in-memory notification debug log + console observability.
+ * Used by production notification flows and the Notification Debug Panel.
+ */
+
+export const NOTIFICATION_LOG_PREFIX = "[Notifications]";
+
+const MAX_ENTRIES = 100;
+
+type LogListener = (entries: readonly string[]) => void;
+
+const entries: string[] = [];
+const listeners = new Set<LogListener>();
+
+function formatTime(d: Date): string {
+  const hh = d.getHours().toString().padStart(2, "0");
+  const mm = d.getMinutes().toString().padStart(2, "0");
+  const ss = d.getSeconds().toString().padStart(2, "0");
+  return `${hh}:${mm}:${ss}`;
+}
+
+function formatPanelLine(message: string): string {
+  return `[${formatTime(new Date())}] ${message}`;
+}
+
+function notifyListeners(): void {
+  const snapshot = [...entries] as readonly string[];
+  for (const listener of listeners) {
+    listener(snapshot);
+  }
+}
+
+/** Append a timestamped line to the in-memory debug log (panel). */
+export function appendLog(message: string): void {
+  entries.push(formatPanelLine(message));
+  if (entries.length > MAX_ENTRIES) {
+    entries.splice(0, entries.length - MAX_ENTRIES);
+  }
+  notifyListeners();
+}
+
+export function subscribe(listener: LogListener): () => void {
+  listeners.add(listener);
+  listener([...entries]);
+  return () => {
+    listeners.delete(listener);
+  };
+}
+
+export function clearNotificationDebugLogs(): void {
+  entries.length = 0;
+  notifyListeners();
+}
+
+export function getNotificationDebugLogEntries(): readonly string[] {
+  return [...entries];
+}
+
+/**
+ * Structured console log (`[Notifications] …`) plus debug panel entry.
+ */
+export function logNotification(
+  message: string,
+  detail?: Record<string, unknown>,
+): void {
+  if (detail !== undefined) {
+    // eslint-disable-next-line no-console
+    console.log(`${NOTIFICATION_LOG_PREFIX} ${message}`, detail);
+  } else {
+    // eslint-disable-next-line no-console
+    console.log(`${NOTIFICATION_LOG_PREFIX} ${message}`);
+  }
+  appendLog(message);
+}

src/services/notifications/NotificationDebugService.ts

@@ -0,0 +1,376 @@
+/**
+ * DEV-only notification testing utilities.
+ *
+ * IMPORTANT:
+ * This service intentionally routes through the same production notification
+ * orchestration paths used by refresh flows, wakeup pushes, and replacement.
+ * Avoid adding duplicate scheduling logic here.
+ */
+
+import { Capacitor } from "@capacitor/core";
+import type { PushNotificationSchema } from "@capacitor/push-notifications";
+import type {
+  DebugSendWakeupRequest,
+  DebugSendWakeupResponse,
+} from "@/interfaces/notifyApi";
+import { logger } from "@/utils/logger";
+import { getOrCreateDeviceId } from "./deviceId";
+import {
+  clearNotificationDebugLogs,
+  logNotification,
+} from "./NotificationDebugEvents";
+import { logNotificationClearing } from "./notificationLog";
+import {
+  getBackendBaseUrl,
+  getBypassAuth,
+  getNotificationApiBaseUrl,
+  getTestMode,
+  setBackendBaseUrl,
+  setBypassAuth,
+  setTestMode,
+} from "./NotificationDebugConfig";
+import {
+  getLastKnownFcmToken,
+  reregisterFcmTokenNow,
+} from "./firebaseMessagingClient";
+import {
+  getNotificationApiHeaders,
+  notificationApiFailureMessage,
+  readNotificationApiBody,
+} from "./notificationApiAuth";
+import {
+  applyNotificationRefreshPayload,
+  handleCapacitorPushNotificationReceived,
+  refreshNotificationsWithDiagnostics,
+  type NotificationRefreshPayload,
+} from "./NativeNotificationService";
+import { truncateFcmTokenForLog } from "./notificationLog";
+import { DailyNotification } from "@/plugins/DailyNotificationPlugin";
+import { NotificationInspector } from "@/plugins/NotificationInspectorPlugin";
+import {
+  uploadAlertSearchAuthorization as uploadAlertSearchAuthorizationBatch,
+  type AlertAuthorizationUploadResult,
+} from "./alertAuthorization";
+
+type PendingNotificationInfo = {
+  identifier: string;
+  nextTriggerDate?: number | null;
+  triggerType?: string | null;
+  wallClockMillis?: number | null;
+  wallClockSource?: string | null;
+};
+
+export type PendingNotificationsResult = {
+  pending: PendingNotificationInfo[];
+  /** Native layer does not implement inspection on this platform (e.g. Android). */
+  inspectorUnavailableMessage?: string;
+};
+
+export type SendRealWakeupPingResult =
+  | { ok: true; responseBody?: DebugSendWakeupResponse }
+  | {
+      ok: false;
+      errorMessage: string;
+      status?: number;
+      responseBody?: DebugSendWakeupResponse;
+    };
+
+/** The fields of a send-wakeup answer worth a debug log line. */
+function wakeupPingResponseDetail(
+  body: DebugSendWakeupResponse | undefined,
+): Record<string, unknown> {
+  if (!body) {
+    return {};
+  }
+  return {
+    success: body.success,
+    ...(body.failureReason !== undefined
+      ? { failureReason: body.failureReason }
+      : {}),
+    ...(body.fcmTokenSuffix !== undefined
+      ? { fcmTokenSuffix: body.fcmTokenSuffix }
+      : {}),
+  };
+}
+
+function isUnimplementedError(e: unknown): boolean {
+  return (
+    typeof e === "object" &&
+    e !== null &&
+    "code" in e &&
+    (e as { code?: string }).code === "UNIMPLEMENTED"
+  );
+}
+
+const LOG = "[NotificationDebugService]";
+
+export const NotificationDebugService = {
+  clearDebugLogs(): void {
+    clearNotificationDebugLogs();
+  },
+
+  getActiveBackendUrl(): string {
+    return getNotificationApiBaseUrl();
+  },
+
+  getBackendUrlOverride(): string | null {
+    return getBackendBaseUrl();
+  },
+
+  saveBackendBaseUrl(url: string): void {
+    setBackendBaseUrl(url);
+    logNotification(
+      url.trim()
+        ? `Backend URL saved (${getNotificationApiBaseUrl()})`
+        : "Backend URL cleared (using default)",
+    );
+  },
+
+  setTestModeEnabled(enabled: boolean): void {
+    setTestMode(enabled);
+    logNotification(`Test mode ${enabled ? "enabled" : "disabled"}`);
+  },
+
+  isTestModeEnabled(): boolean {
+    return getTestMode();
+  },
+
+  setBypassAuthEnabled(enabled: boolean): void {
+    setBypassAuth(enabled);
+    logNotification(
+      `Auth bypass ${enabled ? "enabled" : "disabled"} (local dev only)`,
+    );
+  },
+
+  isBypassAuthEnabled(): boolean {
+    return getBypassAuth();
+  },
+
+  getFcmToken(): string | null {
+    return getLastKnownFcmToken();
+  },
+
+  async registerTokenNow(): Promise<void> {
+    logNotification("Register token now (debug panel)");
+    await reregisterFcmTokenNow();
+  },
+
+  async uploadAlertSearchAuthorization(): Promise<AlertAuthorizationUploadResult> {
+    logNotification("AlertSearch authorization upload requested");
+    const result = await uploadAlertSearchAuthorizationBatch();
+    if (result.ok) {
+      logNotification("AlertSearch authorization upload succeeded", {
+        batchId: result.batchId,
+        timezone: result.timezone,
+        jwtCount: result.jwtCount,
+        firstDay: result.firstDay,
+        lastDay: result.lastDay,
+        status: result.status,
+      });
+    } else {
+      logNotification(
+        `AlertSearch authorization upload failed: ${result.errorMessage}`,
+        {
+          ...(result.status != null ? { status: result.status } : {}),
+          ...(result.errorCode ? { errorCode: result.errorCode } : {}),
+        },
+      );
+    }
+    return result;
+  },
+
+  async triggerBackendRefresh(): Promise<void> {
+    await refreshNotificationsWithDiagnostics({ source: "debug panel" });
+  },
+
+  /** Local simulation: same API call as a WAKEUP_PING handler (no push payload). */
+  async simulateWakeupViaRefresh(): Promise<void> {
+    logNotification("WAKEUP_PING simulation (local refresh API only)");
+    await refreshNotificationsWithDiagnostics({
+      source: "WAKEUP_PING simulation",
+    });
+  },
+
+  /** Full pipeline: backend `/debug/send-wakeup` → FCM → native WAKEUP_PING handler. */
+  async sendRealWakeupPing(): Promise<SendRealWakeupPingResult> {
+    logNotification("Real WAKEUP_PING requested");
+
+    const fcmToken = getLastKnownFcmToken()?.trim() ?? "";
+    if (!fcmToken) {
+      const errorMessage = "no FCM token (register first)";
+      logNotification(`Real WAKEUP_PING failed: ${errorMessage}`);
+      return { ok: false, errorMessage };
+    }
+
+    try {
+      const auth = await getNotificationApiHeaders();
+      if (!auth.ok) {
+        logNotification(`Real WAKEUP_PING failed: ${auth.message}`);
+        return { ok: false, errorMessage: auth.message };
+      }
+
+      const deviceId = await getOrCreateDeviceId();
+      const baseUrl = getNotificationApiBaseUrl();
+      const body: DebugSendWakeupRequest = {
+        deviceId,
+        fcmToken,
+        platform: Capacitor.getPlatform(),
+        testMode: getTestMode(),
+      };
+      const res = await fetch(`${baseUrl}/debug/send-wakeup`, {
+        method: "POST",
+        headers: auth.headers,
+        body: JSON.stringify(body),
+      });
+
+      const parsed = await readNotificationApiBody(res);
+      const responseBody =
+        typeof parsed === "object" && parsed !== null
+          ? (parsed as DebugSendWakeupResponse)
+          : undefined;
+
+      // A 200 still reports a skipped or failed push as `success: false`.
+      if (!res.ok || responseBody?.success === false) {
+        const errorMessage = notificationApiFailureMessage(
+          res.status,
+          responseBody,
+        );
+        logNotification(`Real WAKEUP_PING failed: ${errorMessage}`, {
+          status: res.status,
+          token: truncateFcmTokenForLog(fcmToken),
+          ...wakeupPingResponseDetail(responseBody),
+        });
+        return {
+          ok: false,
+          errorMessage,
+          status: res.status,
+          responseBody,
+        };
+      }
+
+      logNotification("Real WAKEUP_PING success", {
+        token: truncateFcmTokenForLog(fcmToken),
+        deviceId,
+        ...wakeupPingResponseDetail(responseBody),
+      });
+      return { ok: true, responseBody };
+    } catch (err) {
+      const errorMessage = err instanceof Error ? err.message : String(err);
+      logNotification(`Real WAKEUP_PING failed: ${errorMessage}`, {
+        token: truncateFcmTokenForLog(fcmToken),
+      });
+      logger.warn(`${LOG} sendRealWakeupPing failed`, err);
+      return { ok: false, errorMessage };
+    }
+  },
+
+  generateMockNotifications(
+    intervalMs: number = 60_000,
+  ): NotificationRefreshPayload {
+    const now = Date.now();
+    const future1 = now + intervalMs;
+    const future2 = now + intervalMs * 2;
+
+    return {
+      shouldNotify: true,
+      nextNotifications: [{ timestamp: future1 }, { timestamp: future2 }],
+    };
+  },
+
+  async triggerMockRefresh(intervalMs?: number): Promise<void> {
+    logNotification("Mock refresh requested");
+
+    const payload = this.generateMockNotifications(intervalMs);
+    const timestamps = payload.nextNotifications?.map((n) => n.timestamp) ?? [];
+    logNotification(`Mock payload generated (${timestamps.length} timestamps)`);
+
+    if (!Capacitor.isNativePlatform()) {
+      logNotification("Mock refresh skipped: not running on native platform");
+      return;
+    }
+
+    await applyNotificationRefreshPayload(payload);
+    logNotification("Mock refresh applied");
+  },
+
+  async simulateWakeupPing(): Promise<void> {
+    logNotification("Simulating WAKEUP_PING (production push handler)");
+
+    if (!Capacitor.isNativePlatform()) {
+      logNotification("WAKEUP_PING simulation skipped: not native platform");
+      return;
+    }
+
+    const notification = {
+      title: "WAKEUP_PING",
+      body: "",
+      id: "dev_wakeup_ping",
+      data: { type: "WAKEUP_PING" },
+    } as unknown as PushNotificationSchema;
+
+    await handleCapacitorPushNotificationReceived(notification);
+  },
+
+  async runFloodTest(intervalMs?: number): Promise<void> {
+    logNotification("Flood test started (20 sequential refreshes)");
+    for (let i = 0; i < 20; i++) {
+      logNotification(`Flood iteration ${i + 1}/20`);
+      await this.triggerMockRefresh(intervalMs);
+    }
+    logNotification("Flood test completed");
+  },
+
+  async clearNotifications(): Promise<void> {
+    logNotification("Clear notifications (debug panel)");
+
+    if (!Capacitor.isNativePlatform()) {
+      logNotification("Clear skipped: not running on native platform");
+      return;
+    }
+
+    const plugin = DailyNotification as unknown as {
+      clearAllNotifications?: () => Promise<void>;
+      cancelAllNotifications?: () => Promise<void>;
+    };
+
+    if (typeof plugin.clearAllNotifications === "function") {
+      logNotificationClearing("clearAllNotifications");
+      await plugin.clearAllNotifications();
+    } else if (typeof plugin.cancelAllNotifications === "function") {
+      logNotificationClearing("cancelAllNotifications");
+      await plugin.cancelAllNotifications();
+    } else {
+      logNotification("Clear not available (plugin method missing)");
+      return;
+    }
+
+    logNotification("Notifications cleared");
+  },
+
+  async getPendingNotifications(): Promise<PendingNotificationsResult> {
+    logNotification("Fetching pending notifications");
+
+    if (!Capacitor.isNativePlatform()) {
+      logNotification("Pending fetch skipped: not running on native platform");
+      return { pending: [] };
+    }
+
+    try {
+      const res = await NotificationInspector.getPendingNotifications();
+      const items = (res?.pending ?? []) as PendingNotificationInfo[];
+      logNotification(`Pending fetched (${items.length})`);
+      return { pending: items };
+    } catch (e: unknown) {
+      if (isUnimplementedError(e)) {
+        return {
+          pending: [],
+          inspectorUnavailableMessage:
+            "Pending notification inspection is currently supported on iOS only.",
+        };
+      }
+      logNotification("Pending fetch failed");
+      logger.warn(`${LOG} getPendingNotifications failed`, e);
+      return { pending: [] };
+    }
+  },
+};

src/services/notifications/NotificationService.ts

@@ -14,9 +14,72 @@
  */
 
 import { Capacitor } from "@capacitor/core";
+import type { NotificationRegisterRequest } from "@/interfaces/notifyApi";
+import { logger } from "@/utils/logger";
+import { getOrCreateDeviceId } from "./deviceId";
+import {
+  getNotificationApiBaseUrl,
+  getTestMode,
+} from "./NotificationDebugConfig";
+import {
+  getNotificationApiHeaders,
+  logNotificationAuthFailure,
+  notificationApiFailureMessage,
+  readNotificationApiBody,
+} from "./notificationApiAuth";
+import {
+  logTokenRegistrationFailure,
+  logTokenRegistrationStarted,
+  logTokenRegistrationSuccess,
+} from "./notificationLog";
 import { NativeNotificationService } from "./NativeNotificationService";
 import { WebPushNotificationService } from "./WebPushNotificationService";
 
+/**
+ * Registers an FCM device token with the app backend (native Capacitor token or web getToken).
+ */
+export async function registerToken(fcmToken: string): Promise<void> {
+  logTokenRegistrationStarted(fcmToken);
+  const deviceId = await getOrCreateDeviceId();
+  const baseUrl = getNotificationApiBaseUrl();
+  try {
+    const auth = await getNotificationApiHeaders("register");
+    if (!auth.ok) {
+      logNotificationAuthFailure("register", auth.message);
+      throw new Error(`registerToken auth unavailable: ${auth.message}`);
+    }
+
+    const body: NotificationRegisterRequest = {
+      deviceId,
+      fcmToken,
+      platform: Capacitor.getPlatform(),
+      testMode: getTestMode(),
+    };
+    const res = await fetch(`${baseUrl}/notifications/register`, {
+      method: "POST",
+      headers: auth.headers,
+      body: JSON.stringify(body),
+    });
+    // Success is a bare 200 with a plain-text body; only a refusal is read.
+    if (!res.ok) {
+      const detail = notificationApiFailureMessage(
+        res.status,
+        await readNotificationApiBody(res),
+      );
+      logger.warn("[NotificationService] registerToken failed", {
+        status: res.status,
+        statusText: res.statusText,
+        detail,
+      });
+      throw new Error(`registerToken failed: ${detail}`);
+    }
+    logTokenRegistrationSuccess(fcmToken);
+  } catch (err) {
+    logTokenRegistrationFailure(fcmToken, err);
+    throw err;
+  }
+}
+
 /**
  * Options for scheduling a daily notification
  */

src/services/notifications/alertAuthorization.test.ts

@@ -0,0 +1,240 @@
+import type { AlertAuthorizationBatch } from "./alertAuthorizationBatch";
+import {
+  type AlertAuthorizationDependencies,
+  uploadAlertSearchAuthorization,
+} from "./alertAuthorization";
+import { alertSearchNotifyTimeUtcFromLocalNineAm } from "./alertSearchNotifyTime";
+
+jest.mock("@/libs/crypto/vc", () => ({
+  ETHR_DID_PREFIX: "did:ethr:",
+}));
+jest.mock("./alertAuthorizationBatch", () => ({
+  ALERT_AUTHORIZATION_BATCH_DAYS: 100,
+  mintAlertAuthorizationBatch: jest.fn(),
+}));
+jest.mock("./NotificationDebugConfig", () => ({
+  getNotificationApiBaseUrl: jest.fn(),
+}));
+jest.mock("./notificationApiAuth", () => ({
+  getActiveNotificationDid: jest.fn(),
+  getNotificationApiHeaders: jest.fn(),
+  httpAuthErrorMessage: (status: number) => `HTTP ${status}`,
+}));
+jest.mock("./notificationApiDebugMode", () => ({
+  shouldBypassNotificationAuth: jest.fn(),
+}));
+
+const BATCH_DAYS = 100;
+const ACTIVE_DID = `did:ethr:0x${"0".repeat(40)}`;
+const TIME_ZONE = "America/Denver";
+const BATCH_ID = "batch-fixture";
+
+function createMintedBatch(): AlertAuthorizationBatch {
+  return {
+    batchId: BATCH_ID,
+    jwts: Array.from({ length: BATCH_DAYS }, (_, index) => ({
+      sequence: index,
+      day: new Date(Date.UTC(2026, 8, index + 1)).toISOString().slice(0, 10),
+      nbf: 1_788_220_800 + index * 86_400,
+      exp: 1_788_307_200 + index * 86_400,
+      jwt: `delegated-token-${index}`,
+    })),
+  };
+}
+
+function createResponse(
+  status: number,
+  body: Record<string, unknown>,
+): Response {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    json: jest.fn().mockResolvedValue(body),
+  } as unknown as Response;
+}
+
+function createDependencies(overrides?: {
+  did?: string | null;
+  bypassAuth?: boolean;
+  timeZone?: string;
+  response?: Response;
+}): {
+  dependencies: AlertAuthorizationDependencies;
+  fetchMock: jest.Mock;
+  mintMock: jest.Mock;
+  authMock: jest.Mock;
+} {
+  const fetchMock = jest
+    .fn()
+    .mockResolvedValue(overrides?.response ?? createResponse(200, {}));
+  const mintMock = jest.fn().mockResolvedValue(createMintedBatch());
+  const authMock = jest.fn().mockResolvedValue({
+    ok: true,
+    authenticated: true,
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: "Bearer access-token-fixture",
+    },
+  });
+
+  return {
+    dependencies: {
+      getActiveDid: jest
+        .fn()
+        .mockResolvedValue(
+          overrides && "did" in overrides ? overrides.did : ACTIVE_DID,
+        ),
+      isAuthBypassEnabled: jest
+        .fn()
+        .mockReturnValue(overrides?.bypassAuth ?? false),
+      mintBatch: mintMock,
+      getTimeZone: () => overrides?.timeZone ?? TIME_ZONE,
+      getAuthHeaders: authMock,
+      getBaseUrl: () => "https://notification-backend.invalid",
+      fetch: fetchMock,
+    },
+    fetchMock,
+    mintMock,
+    authMock,
+  };
+}
+
+describe("uploadAlertSearchAuthorization", () => {
+  it("uploads the minted batch with authenticated PUT semantics", async () => {
+    const { dependencies, fetchMock, mintMock, authMock } =
+      createDependencies();
+    const minted = createMintedBatch();
+
+    const result = await uploadAlertSearchAuthorization(dependencies);
+
+    expect(result).toEqual({
+      ok: true,
+      status: 200,
+      batchId: BATCH_ID,
+      timezone: TIME_ZONE,
+      jwtCount: BATCH_DAYS,
+      firstDay: minted.jwts[0]!.day,
+      lastDay: minted.jwts[BATCH_DAYS - 1]!.day,
+    });
+    expect(mintMock).toHaveBeenCalledWith(ACTIVE_DID);
+    expect(authMock).toHaveBeenCalledWith(undefined, ACTIVE_DID);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+
+    const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe(
+      "https://notification-backend.invalid/notifications/alert-authorization",
+    );
+    expect(init.method).toBe("PUT");
+    expect(init.headers).toEqual({
+      "Content-Type": "application/json",
+      Authorization: "Bearer access-token-fixture",
+    });
+
+    const expectedNotify = alertSearchNotifyTimeUtcFromLocalNineAm(TIME_ZONE);
+    expect(JSON.parse(String(init.body))).toEqual({
+      batchId: BATCH_ID,
+      notifyHourUtc: expectedNotify.notifyHourUtc,
+      notifyMinuteUtc: expectedNotify.notifyMinuteUtc,
+      timezone: TIME_ZONE,
+      jwts: minted.jwts,
+    });
+  });
+
+  it("does not log delegated JWT contents", async () => {
+    const logSpy = jest.spyOn(console, "log").mockImplementation();
+    const warnSpy = jest.spyOn(console, "warn").mockImplementation();
+    const errorSpy = jest.spyOn(console, "error").mockImplementation();
+    const { dependencies } = createDependencies();
+
+    await uploadAlertSearchAuthorization(dependencies);
+
+    expect(logSpy).not.toHaveBeenCalled();
+    expect(warnSpy).not.toHaveBeenCalled();
+    expect(errorSpy).not.toHaveBeenCalled();
+    logSpy.mockRestore();
+    warnSpy.mockRestore();
+    errorSpy.mockRestore();
+  });
+
+  it("rejects unsupported identities before minting or network submission", async () => {
+    const { dependencies, fetchMock, mintMock, authMock } = createDependencies({
+      did: "did:peer:unsupported",
+    });
+
+    const result = await uploadAlertSearchAuthorization(dependencies);
+
+    expect(result).toEqual({
+      ok: false,
+      errorMessage:
+        "AlertSearch authorization requires an active did:ethr identity.",
+    });
+    expect(mintMock).not.toHaveBeenCalled();
+    expect(authMock).not.toHaveBeenCalled();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("rejects notification auth bypass before minting or submission", async () => {
+    const { dependencies, fetchMock, mintMock } = createDependencies({
+      bypassAuth: true,
+    });
+
+    const result = await uploadAlertSearchAuthorization(dependencies);
+
+    expect(result.ok).toBe(false);
+    expect(mintMock).not.toHaveBeenCalled();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("does not submit when the device zone cannot be resolved", async () => {
+    const { dependencies, fetchMock } = createDependencies({
+      timeZone: "Not/AZone",
+    });
+
+    const result = await uploadAlertSearchAuthorization(dependencies);
+
+    expect(result.ok).toBe(false);
+    expect(result.ok ? "" : result.errorMessage).toContain("Not/AZone");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("surfaces a coded refusal using only its code and message", async () => {
+    const { dependencies } = createDependencies({
+      response: createResponse(400, {
+        success: false,
+        error: "ALERT_AUTHORIZATION_INVALID_BATCH",
+        message:
+          "Delegated notification-JWT batch was rejected. Nothing was stored.",
+        details: ["jwts[0].jwt failed verification"],
+        jwt: "must-not-be-returned",
+      }),
+    });
+
+    const result = await uploadAlertSearchAuthorization(dependencies);
+
+    expect(result).toEqual({
+      ok: false,
+      status: 400,
+      errorCode: "ALERT_AUTHORIZATION_INVALID_BATCH",
+      errorMessage:
+        "Delegated notification-JWT batch was rejected. Nothing was stored.",
+    });
+    expect(JSON.stringify(result)).not.toContain("must-not-be-returned");
+  });
+
+  it("surfaces an uncoded auth refusal without an error code", async () => {
+    const { dependencies } = createDependencies({
+      response: createResponse(401, {
+        success: false,
+        message: "Unauthorized. See server logs at 2026-09-14T08:00:00.000Z",
+      }),
+    });
+
+    const result = await uploadAlertSearchAuthorization(dependencies);
+
+    expect(result).toEqual({
+      ok: false,
+      status: 401,
+      errorMessage: "Unauthorized. See server logs at 2026-09-14T08:00:00.000Z",
+    });
+  });
+});

src/services/notifications/alertAuthorization.ts

@@ -0,0 +1,205 @@
+/**
+ * Manual upload of a push-channel AlertSearch authorization, for the
+ * notification debug panel: mint a delegated JWT batch for the active identity
+ * and `PUT /notifications/alert-authorization`, with the send time fixed at
+ * 09:00 in the device's zone.
+ *
+ * The SMS channel uploads the same body through `authorizeSmsAlertSearch`, and
+ * both mint with `mintAlertAuthorizationBatch`. The wire shapes are in
+ * `@/interfaces/notifyApi`.
+ */
+
+import type { AlertAuthorizationRequestBody } from "@/interfaces/notifyApi";
+import { ETHR_DID_PREFIX } from "@/libs/crypto/vc";
+import {
+  ALERT_AUTHORIZATION_BATCH_DAYS,
+  type AlertAuthorizationBatch,
+  mintAlertAuthorizationBatch,
+} from "./alertAuthorizationBatch";
+import { alertSearchNotifyTimeUtcFromLocalNineAm } from "./alertSearchNotifyTime";
+import { getNotificationApiBaseUrl } from "./NotificationDebugConfig";
+import {
+  getActiveNotificationDid,
+  getNotificationApiHeaders,
+  httpAuthErrorMessage,
+} from "./notificationApiAuth";
+import { shouldBypassNotificationAuth } from "./notificationApiDebugMode";
+
+export type AlertAuthorizationUploadResult =
+  | {
+      ok: true;
+      status: number;
+      batchId: string;
+      timezone: string;
+      jwtCount: number;
+      firstDay: string;
+      lastDay: string;
+    }
+  | {
+      ok: false;
+      errorMessage: string;
+      status?: number;
+      errorCode?: string;
+    };
+
+type FetchNotificationApi = (
+  input: RequestInfo | URL,
+  init?: RequestInit,
+) => Promise<Response>;
+
+export interface AlertAuthorizationDependencies {
+  getActiveDid: () => Promise<string | null>;
+  isAuthBypassEnabled: () => boolean;
+  mintBatch: (did: string) => Promise<AlertAuthorizationBatch>;
+  /** IANA zone whose 09:00 becomes the batch's UTC send time. */
+  getTimeZone: () => string;
+  getAuthHeaders: typeof getNotificationApiHeaders;
+  getBaseUrl: () => string;
+  fetch: FetchNotificationApi;
+}
+
+const defaultDependencies: AlertAuthorizationDependencies = {
+  getActiveDid: getActiveNotificationDid,
+  isAuthBypassEnabled: shouldBypassNotificationAuth,
+  mintBatch: (did) => mintAlertAuthorizationBatch(did),
+  getTimeZone: () => Intl.DateTimeFormat().resolvedOptions().timeZone,
+  getAuthHeaders: getNotificationApiHeaders,
+  getBaseUrl: getNotificationApiBaseUrl,
+  fetch: (input, init) => globalThis.fetch(input, init),
+};
+
+function buildRequestBody(
+  batch: AlertAuthorizationBatch,
+  timeZone: string,
+): AlertAuthorizationRequestBody {
+  if (batch.jwts.length !== ALERT_AUTHORIZATION_BATCH_DAYS) {
+    throw new Error(
+      `Expected ${ALERT_AUTHORIZATION_BATCH_DAYS} delegated JWTs, received ${batch.jwts.length}.`,
+    );
+  }
+
+  const notifyTime = alertSearchNotifyTimeUtcFromLocalNineAm(timeZone);
+
+  return {
+    batchId: batch.batchId,
+    notifyHourUtc: notifyTime.notifyHourUtc,
+    notifyMinuteUtc: notifyTime.notifyMinuteUtc,
+    timezone: timeZone,
+    jwts: batch.jwts,
+  };
+}
+
+/**
+ * The code and message of a refusal, and nothing else from its body. The
+ * service sends an `AlertAuthorizationFailure`: the code, when there is one,
+ * under `error`, and the sentence under `message`.
+ */
+async function readRefusal(
+  response: Response,
+): Promise<{ message?: string; errorCode?: string }> {
+  let body: unknown;
+  try {
+    body = await response.json();
+  } catch {
+    return {};
+  }
+  if (typeof body !== "object" || body === null) {
+    return {};
+  }
+
+  const { error, message } = body as { error?: unknown; message?: unknown };
+  return {
+    ...(typeof message === "string" && message.trim()
+      ? { message: message.trim() }
+      : {}),
+    ...(typeof error === "string" && error.trim()
+      ? { errorCode: error.trim() }
+      : {}),
+  };
+}
+
+/**
+ * Mint and manually upload a delegated AlertSearch authorization batch.
+ * This function never retries and refuses notification auth bypass mode.
+ */
+export async function uploadAlertSearchAuthorization(
+  dependencies: AlertAuthorizationDependencies = defaultDependencies,
+): Promise<AlertAuthorizationUploadResult> {
+  try {
+    const did = await dependencies.getActiveDid();
+    if (!did) {
+      return { ok: false, errorMessage: "No active identity is available." };
+    }
+    if (!did.startsWith(ETHR_DID_PREFIX)) {
+      return {
+        ok: false,
+        errorMessage:
+          "AlertSearch authorization requires an active did:ethr identity.",
+      };
+    }
+    if (dependencies.isAuthBypassEnabled()) {
+      return {
+        ok: false,
+        errorMessage:
+          "AlertSearch authorization cannot be uploaded while JWT authentication is skipped.",
+      };
+    }
+
+    const batch = await dependencies.mintBatch(did);
+    const timeZone = dependencies.getTimeZone();
+    const body = buildRequestBody(batch, timeZone);
+
+    const auth = await dependencies.getAuthHeaders(undefined, did);
+    if (!auth.ok) {
+      return {
+        ok: false,
+        errorMessage: `Authentication unavailable: ${auth.message}`,
+      };
+    }
+    if (!auth.authenticated) {
+      return {
+        ok: false,
+        errorMessage:
+          "AlertSearch authorization requires authenticated notification API headers.",
+      };
+    }
+
+    const response = await dependencies.fetch(
+      `${dependencies.getBaseUrl()}/notifications/alert-authorization`,
+      {
+        method: "PUT",
+        headers: auth.headers,
+        body: JSON.stringify(body),
+      },
+    );
+
+    if (!response.ok) {
+      const refusal = await readRefusal(response);
+      const fallback =
+        response.status === 401 || response.status === 403
+          ? httpAuthErrorMessage(response.status)
+          : `HTTP ${response.status}`;
+      return {
+        ok: false,
+        status: response.status,
+        errorMessage: refusal.message || fallback,
+        ...(refusal.errorCode ? { errorCode: refusal.errorCode } : {}),
+      };
+    }
+
+    return {
+      ok: true,
+      status: response.status,
+      batchId: body.batchId,
+      timezone: timeZone,
+      jwtCount: body.jwts.length,
+      firstDay: body.jwts[0]!.day,
+      lastDay: body.jwts[body.jwts.length - 1]!.day,
+    };
+  } catch (error: unknown) {
+    return {
+      ok: false,
+      errorMessage: error instanceof Error ? error.message : "Upload failed.",
+    };
+  }
+}

src/services/notifications/alertAuthorizationBatch.ts

@@ -0,0 +1,211 @@
+/**
+ * Delegated alertSearch JWT batches for the notify-api.
+ *
+ * The notify-api runs a user's daily alertSearch on their behalf, so it needs a
+ * credential it can present to Endorser and Partner without the app being
+ * awake. The app mints a batch of {@link ALERT_AUTHORIZATION_BATCH_DAYS}
+ * single-day JWTs up front and uploads them; the service spends one per UTC day
+ * and stops when the inventory runs out.
+ *
+ * Both delivery channels take the same batch: push through
+ * `PUT /notifications/alert-authorization` (see `alertAuthorization.ts`)
+ * and SMS through `POST /notify-sms/alert-authorization` (see
+ * `smsNotificationApi.ts`). The service validates both with one rule and keeps
+ * a separate inventory per channel, so this module is the only minter for
+ * either and each upload carries a batch of its own. The native background
+ * prefetch pool (`mintBackgroundJwtTokenPool`) is a different credential. The
+ * wire shapes are in `@/interfaces/notifyApi`.
+ *
+ * Each JWT must cover the whole of the UTC day it names -- `nbf` at or before
+ * that day's opening midnight and `exp` at or after its closing midnight --
+ * because the daily run may fire at any moment inside the day, catch-up runs
+ * included. The frame is UTC rather than the device's zone: a window from local
+ * midnight to local midnight misses part of the UTC day it is filed under in
+ * every zone but UTC, and the service rejects the whole batch.
+ *
+ * Passkey (`did:peer`) identities cannot mint these: signing goes through a
+ * WebAuthn prompt with a fixed one-minute lifetime, so a day-long window is not
+ * expressible. The service rejects such batches with
+ * `DELEGATED_JWT_UNSUPPORTED_IDENTITY`; {@link mintAlertAuthorizationBatch}
+ * throws {@link UnsupportedIdentityError} before spending a round trip.
+ */
+
+import { KeyMetaWithPrivate } from "@/interfaces/common";
+import type {
+  AlertAuthorizationRequestBody,
+  DelegatedAlertJwt,
+  DelegatedAlertJwtPayload,
+} from "@/interfaces/notifyApi";
+import { retrieveFullyDecryptedAccount } from "@/libs/util";
+import { createEndorserJwtForKey } from "@/libs/crypto/vc";
+
+/**
+ * JWTs per batch. The service expects consecutive sequence numbers covering
+ * distinct days, so this is also the number of days an upload lasts.
+ */
+export const ALERT_AUTHORIZATION_BATCH_DAYS = 100;
+
+const SECONDS_PER_DAY = 24 * 60 * 60;
+const MS_PER_DAY = SECONDS_PER_DAY * 1000;
+
+/**
+ * Padding on each end of a day's validity window, for clock skew between this
+ * device, the notify-api, and Endorser. The service asks for `nbf` at or before
+ * the opening midnight and `exp` at or after the closing one, so widening is
+ * allowed and narrowing is not.
+ */
+const WINDOW_SLACK_SECONDS = 5 * 60;
+
+export interface AlertAuthorizationBatch {
+  batchId: string;
+  jwts: DelegatedAlertJwt[];
+}
+
+/** Thrown for identities whose keys cannot sign a day-long delegated JWT. */
+export class UnsupportedIdentityError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "UnsupportedIdentityError";
+  }
+}
+
+function generateBatchId(): string {
+  if (typeof crypto !== "undefined" && crypto.randomUUID) {
+    return crypto.randomUUID();
+  }
+  return `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+
+/** UTC calendar day (`YYYY-MM-DD`) for an epoch-milliseconds instant. */
+function utcDayString(epochMs: number): string {
+  return new Date(epochMs).toISOString().slice(0, 10);
+}
+
+/**
+ * Mint a full batch of delegated alertSearch JWTs starting with the UTC day
+ * containing `startingAt`.
+ *
+ * The account is decrypted once and reused for all
+ * {@link ALERT_AUTHORIZATION_BATCH_DAYS} signatures; decrypting per JWT costs
+ * seconds on a phone.
+ *
+ * @param did identity the batch is issued by and for
+ * @param startingAt instant whose UTC day is sequence 0 (defaults to now)
+ * @throws UnsupportedIdentityError for passkey identities
+ */
+export async function mintAlertAuthorizationBatch(
+  did: string,
+  startingAt: Date = new Date(),
+): Promise<AlertAuthorizationBatch> {
+  const account = await retrieveFullyDecryptedAccount(did);
+  if (!account) {
+    throw new Error(`No account found for ${did}`);
+  }
+  if (!account.identity && account.passkeyCredIdHex) {
+    throw new UnsupportedIdentityError(
+      "Passkey identities cannot authorize background notifications. " +
+        "Switch to a seed-phrase identity to turn this on.",
+    );
+  }
+  if (!account.identity) {
+    throw new Error(`No signing key found for ${did}`);
+  }
+
+  const firstDayStartMs = Date.UTC(
+    startingAt.getUTCFullYear(),
+    startingAt.getUTCMonth(),
+    startingAt.getUTCDate(),
+  );
+
+  const jwts: DelegatedAlertJwt[] = [];
+  for (
+    let sequence = 0;
+    sequence < ALERT_AUTHORIZATION_BATCH_DAYS;
+    sequence++
+  ) {
+    const dayStartMs = firstDayStartMs + sequence * MS_PER_DAY;
+    const dayStartSec = Math.floor(dayStartMs / 1000);
+    const nbf = dayStartSec - WINDOW_SLACK_SECONDS;
+    const exp = dayStartSec + SECONDS_PER_DAY + WINDOW_SLACK_SECONDS;
+    // `iat` and `iss` are filled in by the signer; nbf/exp are the day window.
+    const payload: DelegatedAlertJwtPayload = { nbf, exp };
+    const jwt = await createEndorserJwtForKey(
+      account as KeyMetaWithPrivate,
+      payload,
+    );
+    jwts.push({
+      sequence,
+      day: utcDayString(dayStartMs),
+      nbf,
+      exp,
+      jwt,
+    });
+  }
+
+  return { batchId: generateBatchId(), jwts };
+}
+
+/**
+ * Mint a fresh batch and wrap it in the upload body for either channel.
+ *
+ * Mint once per upload: each channel spends its own inventory, and one batch
+ * shared by both would put the same JWT in front of Endorser twice a day.
+ *
+ * @param notifyHourUtc UTC hour, 0-23
+ * @param notifyMinuteUtc UTC minute, 0-59
+ * @throws UnsupportedIdentityError for passkey identities
+ */
+export async function buildAlertAuthorizationBody(
+  did: string,
+  notifyHourUtc: number,
+  notifyMinuteUtc: number,
+): Promise<AlertAuthorizationRequestBody> {
+  const batch = await mintAlertAuthorizationBatch(did);
+  // Recorded for whatever later re-derives the hour across a daylight-saving
+  // change; no scheduling decision reads it.
+  const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone;
+  return {
+    batchId: batch.batchId,
+    notifyHourUtc,
+    notifyMinuteUtc,
+    ...(timezone ? { timezone } : {}),
+    jwts: batch.jwts,
+  };
+}
+
+/**
+ * Split a 12-hour clock reading such as `"6:30 PM"` -- the format the time
+ * picker hands back -- into the UTC hour and minute the notify-api schedules
+ * on. The reading is interpreted in the device's current local time, so the
+ * result follows the device's present UTC offset and does not track later
+ * daylight-saving changes.
+ *
+ * @returns the UTC pair, or null when the text is not a time
+ */
+export function localTimeTextToUtc(
+  timeText: string,
+): { notifyHourUtc: number; notifyMinuteUtc: number } | null {
+  const match = (timeText || "").match(/(\d{1,2}):(\d{2})\s*(AM|PM)/i);
+  if (!match) {
+    return null;
+  }
+  const rawHour = parseInt(match[1], 10);
+  const minute = parseInt(match[2], 10);
+  if (rawHour < 1 || rawHour > 12 || minute > 59) {
+    return null;
+  }
+  const isAm = match[3].toUpperCase() === "AM";
+  let hour24 = rawHour % 12; // 12 AM -> 0, 12 PM -> 12 after the PM shift
+  if (!isAm) {
+    hour24 += 12;
+  }
+
+  // Resolve through a real local date so the offset used is the device's own,
+  // including half-hour and 45-minute zones that an hour-based shift mangles.
+  const local = new Date();
+  local.setHours(hour24, minute, 0, 0);
+  return {
+    notifyHourUtc: local.getUTCHours(),
+    notifyMinuteUtc: local.getUTCMinutes(),
+  };
+}

src/services/notifications/alertSearchNotifyTime.test.ts

@@ -0,0 +1,25 @@
+import { alertSearchNotifyTimeUtcFromLocalNineAm } from "./alertSearchNotifyTime";
+
+describe("alertSearchNotifyTimeUtcFromLocalNineAm", () => {
+  it("converts 09:00 Asia/Manila to 01:00 UTC", () => {
+    const result = alertSearchNotifyTimeUtcFromLocalNineAm(
+      "Asia/Manila",
+      new Date("2026-09-10T16:00:00.000Z"),
+    );
+    expect(result).toEqual({ notifyHourUtc: 1, notifyMinuteUtc: 0 });
+  });
+
+  it("returns integers in the UTC hour/minute ranges", () => {
+    const result = alertSearchNotifyTimeUtcFromLocalNineAm(
+      "America/Denver",
+      new Date("2026-01-15T12:00:00.000Z"),
+    );
+    expect(Number.isInteger(result.notifyHourUtc)).toBe(true);
+    expect(Number.isInteger(result.notifyMinuteUtc)).toBe(true);
+    expect(result.notifyHourUtc).toBeGreaterThanOrEqual(0);
+    expect(result.notifyHourUtc).toBeLessThanOrEqual(23);
+    expect(result.notifyMinuteUtc).toBeGreaterThanOrEqual(0);
+    expect(result.notifyMinuteUtc).toBeLessThanOrEqual(59);
+    expect(result).toEqual({ notifyHourUtc: 16, notifyMinuteUtc: 0 });
+  });
+});

src/services/notifications/alertSearchNotifyTime.ts

@@ -0,0 +1,47 @@
+/**
+ * Debug/E2E AlertSearch notify-time conversion only.
+ * Not a user-facing setting; does not read Daily Reminder or New Activity times.
+ */
+
+import { DateTime } from "luxon";
+
+/** Temporary default wall-clock time for AlertSearch authorization uploads. */
+export const ALERT_SEARCH_DEBUG_LOCAL_NOTIFY_HOUR = 9;
+export const ALERT_SEARCH_DEBUG_LOCAL_NOTIFY_MINUTE = 0;
+
+function requireIanaTimeZone(timeZone: string): string {
+  const probe = DateTime.now().setZone(timeZone);
+  if (!timeZone || !probe.isValid) {
+    throw new Error(
+      "Invalid IANA timezone for AlertSearch notify time: " + timeZone,
+    );
+  }
+  return timeZone;
+}
+
+/**
+ * Convert 09:00 in `timeZone` (IANA) on the calendar day of `now` to UTC hour/minute.
+ */
+export function alertSearchNotifyTimeUtcFromLocalNineAm(
+  timeZone: string,
+  now: Date = new Date(),
+): { notifyHourUtc: number; notifyMinuteUtc: number } {
+  const zone = requireIanaTimeZone(timeZone);
+  const localNine = DateTime.fromJSDate(now, { zone }).set({
+    hour: ALERT_SEARCH_DEBUG_LOCAL_NOTIFY_HOUR,
+    minute: ALERT_SEARCH_DEBUG_LOCAL_NOTIFY_MINUTE,
+    second: 0,
+    millisecond: 0,
+  });
+  if (!localNine.isValid) {
+    throw new Error(
+      "Could not convert AlertSearch 09:00 local notify time to UTC for zone " +
+        zone,
+    );
+  }
+  const utc = localNine.toUTC();
+  return {
+    notifyHourUtc: utc.hour,
+    notifyMinuteUtc: utc.minute,
+  };
+}

src/services/notifications/deviceId.ts

@@ -0,0 +1,38 @@
+import { Preferences } from "@capacitor/preferences";
+
+const DEVICE_ID_KEY = "stable_device_id";
+
+function generateDeviceId(): string {
+  if (typeof crypto !== "undefined" && crypto.randomUUID) {
+    return crypto.randomUUID();
+  }
+
+  // eslint-disable-next-line no-console
+  console.warn(
+    "[DeviceId] crypto.randomUUID unavailable, using fallback generator",
+  );
+
+  return `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+
+export async function getOrCreateDeviceId(): Promise<string> {
+  const existing = await Preferences.get({ key: DEVICE_ID_KEY });
+
+  if (existing.value) {
+    // eslint-disable-next-line no-console
+    console.log("[DeviceId] Loaded existing deviceId");
+    return existing.value;
+  }
+
+  const newId = generateDeviceId();
+
+  await Preferences.set({
+    key: DEVICE_ID_KEY,
+    value: newId,
+  });
+
+  // eslint-disable-next-line no-console
+  console.log("[DeviceId] Generated new deviceId");
+
+  return newId;
+}

src/services/notifications/firebaseMessagingClient.ts

@@ -0,0 +1,314 @@
+/**
+ * Firebase Cloud Messaging (JS SDK) + Capacitor Push Notifications (native bridge).
+ *
+ * Initializes the Firebase web app when VITE_FIREBASE_* env vars are set, wires
+ * Capacitor push listeners, requests permission before registration/token flow,
+ * and attaches Firebase messaging when the browser/WebView reports support.
+ */
+
+import { Capacitor } from "@capacitor/core";
+import { PushNotifications } from "@capacitor/push-notifications";
+import {
+  type FirebaseApp,
+  type FirebaseOptions,
+  getApps,
+  initializeApp,
+} from "firebase/app";
+import {
+  getMessaging,
+  getToken,
+  isSupported,
+  onMessage,
+} from "firebase/messaging";
+import { logger } from "@/utils/logger";
+import { handleCapacitorPushNotificationReceived } from "./NativeNotificationService";
+import { getNotificationApiHeaders } from "./notificationApiAuth";
+import { deferFcmRegistration } from "./notificationAuthLifecycle";
+import { registerToken } from "./NotificationService";
+import {
+  logPushNotificationActionPerformed,
+  logPushNotificationReceived,
+  logTokenRegistrationSkippedDuplicate,
+} from "./notificationLog";
+
+const LOG = "[FirebaseMessaging]";
+
+let firebaseAppSingleton: FirebaseApp | null = null;
+let nativeInitPromise: Promise<void> | null = null;
+/** Avoid duplicate POSTs when the same token is delivered more than once. */
+let lastRegisteredFcmToken: string | null = null;
+/** Last token received from Capacitor/Firebase (may match registered). */
+let lastSeenFcmToken: string | null = null;
+
+async function registerRetrievedToken(
+  token: string,
+  options?: { force?: boolean },
+): Promise<void> {
+  const trimmed = token.trim();
+  if (!trimmed) {
+    return;
+  }
+  lastSeenFcmToken = trimmed;
+  if (!options?.force && trimmed === lastRegisteredFcmToken) {
+    logTokenRegistrationSkippedDuplicate(trimmed);
+    return;
+  }
+
+  const auth = await getNotificationApiHeaders("register");
+  if (!auth.ok) {
+    if (options?.force) {
+      throw new Error(`FCM registration auth unavailable: ${auth.message}`);
+    }
+    deferFcmRegistration(trimmed);
+    return;
+  }
+
+  await registerToken(trimmed);
+  lastRegisteredFcmToken = trimmed;
+}
+
+/** Most recent FCM token from native/web push registration (for debug UI). */
+export function getLastKnownFcmToken(): string | null {
+  return lastSeenFcmToken ?? lastRegisteredFcmToken;
+}
+
+/**
+ * Re-runs token registration immediately (debug). Bypasses duplicate-token skip.
+ */
+export async function reregisterFcmTokenNow(): Promise<string> {
+  if (!Capacitor.isNativePlatform()) {
+    throw new Error("FCM registration is only available on native platforms");
+  }
+
+  lastRegisteredFcmToken = null;
+
+  const cached = lastSeenFcmToken?.trim();
+  if (cached) {
+    await registerRetrievedToken(cached, { force: true });
+    return cached;
+  }
+
+  const app = ensureFirebaseApp();
+  if (app && (await isSupported())) {
+    const messaging = getMessaging(app);
+    const vapidKey = import.meta.env.VITE_FIREBASE_VAPID_KEY as
+      | string
+      | undefined;
+    const token = await getToken(
+      messaging,
+      vapidKey ? { vapidKey } : undefined,
+    );
+    if (!token?.trim()) {
+      throw new Error("Firebase getToken returned an empty token");
+    }
+    await registerRetrievedToken(token, { force: true });
+    return token.trim();
+  }
+
+  return new Promise<string>((resolve, reject) => {
+    const timeoutMs = 15_000;
+    const timeoutId = window.setTimeout(() => {
+      void listenerPromise.then((h) => h.remove());
+      reject(new Error("Timed out waiting for push registration token"));
+    }, timeoutMs);
+
+    const listenerPromise = PushNotifications.addListener(
+      "registration",
+      (token) => {
+        window.clearTimeout(timeoutId);
+        void listenerPromise.then((h) => h.remove());
+        const value = token.value?.trim() ?? "";
+        if (!value) {
+          reject(new Error("Capacitor registration returned an empty token"));
+          return;
+        }
+        void registerRetrievedToken(value, { force: true })
+          .then(() => resolve(value))
+          .catch(reject);
+      },
+    );
+
+    void PushNotifications.register().catch((err) => {
+      window.clearTimeout(timeoutId);
+      void listenerPromise.then((h) => h.remove());
+      reject(err);
+    });
+  });
+}
+
+function readFirebaseOptions(): FirebaseOptions | null {
+  const env = import.meta.env;
+  const apiKey = env.VITE_FIREBASE_API_KEY as string | undefined;
+  const projectId = env.VITE_FIREBASE_PROJECT_ID as string | undefined;
+  const appId = env.VITE_FIREBASE_APP_ID as string | undefined;
+  const messagingSenderId = env.VITE_FIREBASE_MESSAGING_SENDER_ID as
+    | string
+    | undefined;
+
+  if (!apiKey || !projectId || !appId || !messagingSenderId) {
+    logger.debug(
+      `${LOG} Missing one or more VITE_FIREBASE_* keys; Firebase app not initialized`,
+    );
+    return null;
+  }
+
+  const authDomain =
+    (env.VITE_FIREBASE_AUTH_DOMAIN as string | undefined) ||
+    `${projectId}.firebaseapp.com`;
+  const storageBucket =
+    (env.VITE_FIREBASE_STORAGE_BUCKET as string | undefined) ||
+    `${projectId}.appspot.com`;
+
+  const opts: FirebaseOptions = {
+    apiKey,
+    authDomain,
+    projectId,
+    storageBucket,
+    messagingSenderId,
+    appId,
+  };
+
+  const measurementId = env.VITE_FIREBASE_MEASUREMENT_ID as string | undefined;
+  if (measurementId) {
+    opts.measurementId = measurementId;
+  }
+
+  return opts;
+}
+
+/**
+ * Ensures a single Firebase app instance for the client when config is present.
+ */
+export function ensureFirebaseApp(): FirebaseApp | null {
+  if (firebaseAppSingleton) {
+    return firebaseAppSingleton;
+  }
+  const options = readFirebaseOptions();
+  if (!options) {
+    return null;
+  }
+  firebaseAppSingleton =
+    getApps().length > 0 ? getApps()[0]! : initializeApp(options);
+  logger.info(`${LOG} Firebase app initialized`);
+  return firebaseAppSingleton;
+}
+
+async function attachFirebaseMessagingIfSupported(
+  app: FirebaseApp,
+): Promise<void> {
+  if (!(await isSupported())) {
+    logger.debug(
+      `${LOG} firebase/messaging not supported in this context; skipping getMessaging`,
+    );
+    return;
+  }
+
+  const messaging = getMessaging(app);
+  const vapidKey = import.meta.env.VITE_FIREBASE_VAPID_KEY as
+    | string
+    | undefined;
+
+  try {
+    const token = await getToken(
+      messaging,
+      vapidKey ? { vapidKey } : undefined,
+    );
+    logger.info(`${LOG} Firebase getToken completed`, {
+      tokenPrefix: token ? `${token.slice(0, 12)}…` : "(empty)",
+    });
+    await registerRetrievedToken(token);
+  } catch (err) {
+    logger.warn(
+      `${LOG} Firebase getToken failed (common on native WebView without SW)`,
+      err,
+    );
+  }
+
+  onMessage(messaging, (payload) => {
+    logger.debug(`${LOG} onMessage (foreground)`, payload);
+  });
+}
+
+/**
+ * Native: register Capacitor push listeners, request permissions, register for push,
+ * then initialize Firebase Messaging when env config and platform support allow.
+ */
+async function initializeNativePushAndFirebaseMessagingImpl(): Promise<void> {
+  if (!Capacitor.isNativePlatform()) {
+    return;
+  }
+
+  try {
+    const app = ensureFirebaseApp();
+
+    await PushNotifications.addListener("registration", (token) => {
+      if (token.value?.trim()) {
+        lastSeenFcmToken = token.value.trim();
+      }
+      logger.info(`${LOG} Capacitor registration token`, {
+        valuePrefix: token.value ? `${token.value.slice(0, 12)}…` : "(empty)",
+      });
+      void registerRetrievedToken(token.value).catch((err) => {
+        logger.warn(
+          `${LOG} registerToken after Capacitor registration failed`,
+          err,
+        );
+      });
+    });
+
+    await PushNotifications.addListener("registrationError", (err) => {
+      logger.error(`${LOG} registrationError`, err);
+    });
+
+    await PushNotifications.addListener(
+      "pushNotificationReceived",
+      (notification) => {
+        logger.debug(`${LOG} pushNotificationReceived`, notification);
+        logPushNotificationReceived(notification);
+        void handleCapacitorPushNotificationReceived(notification).catch(
+          (err) => {
+            logger.warn(
+              `${LOG} handleCapacitorPushNotificationReceived failed`,
+              err,
+            );
+          },
+        );
+      },
+    );
+
+    await PushNotifications.addListener(
+      "pushNotificationActionPerformed",
+      (action) => {
+        logger.debug(`${LOG} pushNotificationActionPerformed`, action);
+        logPushNotificationActionPerformed(action);
+      },
+    );
+
+    const perm = await PushNotifications.requestPermissions();
+    if (perm.receive !== "granted") {
+      logger.warn(`${LOG} Push permission not granted`, perm);
+      return;
+    }
+
+    await PushNotifications.register();
+
+    if (app) {
+      await attachFirebaseMessagingIfSupported(app);
+    }
+  } catch (err) {
+    logger.error(`${LOG} Native push / Firebase messaging init failed`, err);
+  }
+}
+
+/**
+ * Idempotent startup hook for Capacitor iOS/Android.
+ */
+export function initializeNativePushAndFirebaseMessaging(): Promise<void> {
+  if (!Capacitor.isNativePlatform()) {
+    return Promise.resolve();
+  }
+  if (!nativeInitPromise) {
+    nativeInitPromise = initializeNativePushAndFirebaseMessagingImpl();
+  }
+  return nativeInitPromise;
+}

src/services/notifications/index.ts

@@ -13,17 +13,70 @@
  * ```
  */
 
-export { NotificationService } from "./NotificationService";
+export {
+  getBackendBaseUrl,
+  getBypassAuth,
+  getNotificationApiBaseUrl,
+  getNotificationDebugOverrideHeaders,
+  getTestMode,
+  NGROK_SKIP_BROWSER_WARNING_HEADER,
+  NGROK_SKIP_BROWSER_WARNING_VALUE,
+  normalizeNotificationBackendUrl,
+  setBackendBaseUrl,
+  setBypassAuth,
+  setTestMode,
+} from "./NotificationDebugConfig";
+export { shouldBypassNotificationAuth } from "./notificationApiDebugMode";
+export {
+  appendLog,
+  clearNotificationDebugLogs,
+  getNotificationDebugLogEntries,
+  logNotification,
+  NOTIFICATION_LOG_PREFIX,
+  subscribe,
+} from "./NotificationDebugEvents";
+export { NotificationService, registerToken } from "./NotificationService";
 export { NativeNotificationService } from "./NativeNotificationService";
 export { WebPushNotificationService } from "./WebPushNotificationService";
+export { uploadAlertSearchAuthorization } from "./alertAuthorization";
+export type { AlertAuthorizationUploadResult } from "./alertAuthorization";
 
 export { configureNativeFetcherIfReady } from "./nativeFetcherConfig";
+export {
+  deferFcmRegistration,
+  flushDeferredFcmRegistration,
+  onNotificationAuthMayBeReady,
+} from "./notificationAuthLifecycle";
+export {
+  ensureFirebaseApp,
+  initializeNativePushAndFirebaseMessaging,
+} from "./firebaseMessagingClient";
 export { syncStarredPlansToNativePlugin } from "./syncStarredPlansToNativePlugin";
 export {
   buildDualScheduleConfig,
   timeToCron,
   timeToCronFiveMinutesBefore,
 } from "./dualScheduleConfig";
+export {
+  ALERT_AUTHORIZATION_BATCH_DAYS,
+  buildAlertAuthorizationBody,
+  localTimeTextToUtc,
+  mintAlertAuthorizationBatch,
+  UnsupportedIdentityError,
+} from "./alertAuthorizationBatch";
+export type { AlertAuthorizationBatch } from "./alertAuthorizationBatch";
+
+export {
+  authorizeSmsAlertSearch,
+  deleteSmsPhone,
+  listSmsPhones,
+  normalizePhoneNumber,
+  registerSmsPhone,
+  revokeSmsAlertSearch,
+  SmsApiError,
+  smsErrorMessage,
+  verifySmsPhone,
+} from "./smsNotificationApi";
 export type { DualScheduleConfigInput } from "./dualScheduleConfig";
 
 export {

src/services/notifications/nativeFetcherConfig.ts

@@ -8,10 +8,17 @@
 
 import { Capacitor } from "@capacitor/core";
 import { DailyNotification } from "@/plugins/DailyNotificationPlugin";
-import { mintBackgroundJwtTokenPool } from "@/libs/crypto";
+import {
+  BackgroundJwtUnsupportedIdentityError,
+  mintBackgroundJwtTokenPool,
+} from "@/libs/crypto/backgroundJwtPool";
+import { retrieveFullyDecryptedAccount } from "@/libs/util";
+import type { KeyMetaWithPrivate } from "@/interfaces/common";
 import { PlatformServiceFactory } from "@/services/PlatformServiceFactory";
 import { logger } from "@/utils/logger";
 import { DEFAULT_ENDORSER_API_SERVER } from "@/constants/app";
+import { BACKGROUND_JWT_SECONDS_PER_DAY } from "@/constants/backgroundJwt";
+import { onNotificationAuthMayBeReady } from "./notificationAuthLifecycle";
 
 /**
  * Configure the native notification content fetcher with API credentials.
@@ -63,8 +70,39 @@ export async function configureNativeFetcherIfReady(
         : DEFAULT_ENDORSER_API_SERVER;
     }
 
-    const jwtTokens = await mintBackgroundJwtTokenPool(did);
-    const jwtToken = jwtTokens[0] ?? "";
+    // Decrypt once here rather than once per token inside the minter.
+    const account = await retrieveFullyDecryptedAccount(did);
+    if (!account) {
+      logger.debug(
+        "[nativeFetcherConfig] No account for active DID; skipping native fetcher config",
+      );
+      return false;
+    }
+
+    let jwtTokens: string[];
+    try {
+      jwtTokens = await mintBackgroundJwtTokenPool(
+        account as KeyMetaWithPrivate,
+      );
+    } catch (error) {
+      if (error instanceof BackgroundJwtUnsupportedIdentityError) {
+        // Passkey identities: minting would raise one WebAuthn prompt per token
+        // and yield one-minute tokens. Leave prefetch unconfigured instead.
+        logger.debug(
+          "[nativeFetcherConfig] Identity cannot mint a background pool; " +
+            "skipping native fetcher config",
+        );
+        return false;
+      }
+      throw error;
+    }
+    // Pool slots are keyed by `epochDay % size`, not by distance from the mint,
+    // so the standalone `jwtToken` a plugin without pool support falls back to
+    // has to be read at today's slot rather than at index 0.
+    const todayEpochDay = Math.floor(
+      Date.now() / 1000 / BACKGROUND_JWT_SECONDS_PER_DAY,
+    );
+    const jwtToken = jwtTokens[todayEpochDay % jwtTokens.length] ?? "";
     if (!jwtToken) {
       logger.warn(
         "[nativeFetcherConfig] No JWT for native fetcher; API-driven notifications may fail",
@@ -90,9 +128,58 @@ export async function configureNativeFetcherIfReady(
         jwtTokens.length +
         ")",
     );
+    onNotificationAuthMayBeReady();
     return true;
   } catch (error) {
     logger.error("[nativeFetcherConfig] configureNativeFetcher failed:", error);
     return false;
   }
 }
+
+/**
+ * Drop the JWT pool the native fetcher holds, so a signed-out or switched-away
+ * identity leaves no usable credential on the device.
+ *
+ * This is custody, not revocation: the tokens stay cryptographically valid
+ * until their windows close, and Endorser offers nothing that would invalidate
+ * a copy taken before this call. What it bounds is the ordinary case -- account
+ * switch, sign-out, a shared or lost handset -- where no copy was taken and the
+ * only remaining risk is the device's own store. A cleared pool leaves each
+ * selector with an empty bearer, which both refuse to send.
+ *
+ * Call before the active identity changes; `configureNativeFetcherIfReady`
+ * mints a fresh pool for whichever identity takes over.
+ *
+ * @returns true when the pool was cleared or there was nothing to clear
+ */
+export async function clearNativeFetcherPool(): Promise<boolean> {
+  if (!Capacitor.isNativePlatform()) {
+    return false;
+  }
+  if (!DailyNotification?.configureNativeFetcher) {
+    logger.warn(
+      "[nativeFetcherConfig] Plugin configureNativeFetcher not available; " +
+        "cannot clear the native JWT pool",
+    );
+    return false;
+  }
+  try {
+    await DailyNotification.configureNativeFetcher({
+      apiBaseUrl: DEFAULT_ENDORSER_API_SERVER,
+      activeDid: "",
+      jwtToken: "",
+      jwtTokens: [],
+    });
+    logger.info("[nativeFetcherConfig] Native fetcher JWT pool cleared");
+    return true;
+  } catch (error) {
+    // A plugin build that rejects empty credentials leaves the old pool in
+    // place; say so rather than reporting a clear that did not happen.
+    logger.error(
+      "[nativeFetcherConfig] Could not clear the native JWT pool; " +
+        "the previous identity's tokens remain on the device:",
+      error,
+    );
+    return false;
+  }
+}

src/services/notifications/notificationApiAuth.ts

@@ -0,0 +1,206 @@
+/**
+ * Authenticated headers for notification backend API calls (`/notifications/*`).
+ * Uses the same `getHeaders` + active DID flow as the rest of the app.
+ * Debug/local config can bypass auth for ngrok and panel testing.
+ */
+
+import { getHeaders } from "@/libs/endorserServer";
+import { PlatformServiceFactory } from "@/services/PlatformServiceFactory";
+import { logger } from "@/utils/logger";
+import { getNotificationDebugOverrideHeaders } from "./NotificationDebugConfig";
+import { shouldBypassNotificationAuth } from "./notificationApiDebugMode";
+import { logNotification } from "./NotificationDebugEvents";
+
+export type NotificationRequestKind = "register" | "refresh";
+
+export type NotificationApiHeadersResult =
+  | {
+      ok: true;
+      authenticated: boolean;
+      headers: Record<string, string>;
+    }
+  | {
+      ok: false;
+      reason: "no_active_did" | "missing_token" | "identity_changed";
+      message: string;
+    };
+
+const DEBUG_HEADERS: Record<string, string> = {
+  "Content-Type": "application/json",
+};
+
+export async function getActiveNotificationDid(): Promise<string | null> {
+  try {
+    const service = PlatformServiceFactory.getInstance();
+    const row = await service.dbGetOneRow(
+      "SELECT activeDid FROM active_identity WHERE id = 1",
+    );
+    if (!row?.[0]) {
+      return null;
+    }
+    const did = String(row[0]).trim();
+    return did || null;
+  } catch (err) {
+    logger.warn("[notificationApiAuth] Failed to read active DID", err);
+    return null;
+  }
+}
+
+function hasBearerToken(headers: {
+  Authorization?: string;
+}): headers is { Authorization: string } {
+  const auth = headers.Authorization;
+  return (
+    typeof auth === "string" &&
+    auth.startsWith("Bearer ") &&
+    auth.length > "Bearer ".length
+  );
+}
+
+function logAuthBypassEnabled(): void {
+  logNotification("Auth bypass enabled for debug/testing");
+}
+
+function logAuthenticatedNotificationRequest(): void {
+  logNotification("Using authenticated notification request");
+}
+
+function logDebugUnauthenticatedNotificationRequest(): void {
+  logNotification("Using debug unauthenticated notification request");
+}
+
+/**
+ * Resolve headers for notification API requests.
+ * @param kind Optional request kind for structured logs.
+ * @param expectedDid Reject if the active identity changed before token minting.
+ */
+export async function getNotificationApiHeaders(
+  kind?: NotificationRequestKind,
+  expectedDid?: string,
+): Promise<NotificationApiHeadersResult> {
+  if (shouldBypassNotificationAuth()) {
+    logAuthBypassEnabled();
+    if (kind) {
+      logDebugUnauthenticatedNotificationRequest();
+    }
+    return {
+      ok: true,
+      authenticated: false,
+      headers: {
+        ...DEBUG_HEADERS,
+        ...getNotificationDebugOverrideHeaders(),
+      },
+    };
+  }
+
+  const did = await getActiveNotificationDid();
+  if (!did) {
+    return {
+      ok: false,
+      reason: "no_active_did",
+      message: "no active identity (cannot authenticate)",
+    };
+  }
+  if (expectedDid && did !== expectedDid) {
+    return {
+      ok: false,
+      reason: "identity_changed",
+      message: "active identity changed before authentication",
+    };
+  }
+
+  const headers = await getHeaders(did);
+  if (!hasBearerToken(headers)) {
+    return {
+      ok: false,
+      reason: "missing_token",
+      message: "missing or empty Authorization token",
+    };
+  }
+
+  if (kind) {
+    logAuthenticatedNotificationRequest();
+  }
+
+  return {
+    ok: true,
+    authenticated: true,
+    headers: {
+      "Content-Type": headers["Content-Type"],
+      Authorization: headers.Authorization,
+      ...getNotificationDebugOverrideHeaders(),
+    },
+  };
+}
+
+export function logNotificationRequestAuthenticated(
+  kind: NotificationRequestKind,
+): void {
+  logNotification(
+    kind === "register"
+      ? "Register request authenticated"
+      : "Refresh request authenticated",
+  );
+}
+
+export function logNotificationAuthFailure(
+  kind: NotificationRequestKind,
+  message: string,
+): void {
+  const verb = kind === "register" ? "Register" : "Refresh";
+  logNotification(`${verb} auth unavailable: ${message}`);
+}
+
+export function logWaitingForAuthBeforeRegistration(): void {
+  logNotification("Waiting for auth before registration");
+}
+
+export function logSkippingRefreshDueToMissingAuth(): void {
+  logNotification("Skipping refresh due to missing auth");
+}
+
+export function httpAuthErrorMessage(status: number): string {
+  if (status === 401) {
+    return "unauthorized (expired or invalid auth)";
+  }
+  if (status === 403) {
+    return "forbidden (not authorized)";
+  }
+  return `HTTP ${status}`;
+}
+
+/** A response body parsed as JSON, or undefined when it is empty or not JSON. */
+export async function readNotificationApiBody(res: Response): Promise<unknown> {
+  try {
+    return await res.json();
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The best sentence for a failed device or debug route call: the service's own
+ * reason when the body carries one, otherwise a description of the status.
+ *
+ * Reads the uncoded refusal shapes in `@/interfaces/notifyApi`, in order:
+ * `error` (`NotificationDeviceRouteFailure`), `failureReason`
+ * (`DebugSendWakeupResponse`), and `message` (`NotifyApiUncodedFailure`).
+ */
+export function notificationApiFailureMessage(
+  status: number,
+  body: unknown,
+): string {
+  if (typeof body === "object" && body !== null) {
+    const { error, failureReason, message } = body as {
+      error?: unknown;
+      failureReason?: unknown;
+      message?: unknown;
+    };
+    for (const value of [error, failureReason, message]) {
+      if (typeof value === "string" && value.trim()) {
+        return value.trim();
+      }
+    }
+  }
+  return httpAuthErrorMessage(status);
+}

src/services/notifications/notificationApiDebugMode.ts

@@ -0,0 +1,11 @@
+/**
+ * Debug/local notification API auth bypass (ngrok, Notification Debug Panel).
+ * Controlled explicitly via `notificationDebug.bypassAuth`; off by default.
+ */
+
+import { getBypassAuth } from "./NotificationDebugConfig";
+
+/** True when debug panel explicitly allows unauthenticated API calls. */
+export function shouldBypassNotificationAuth(): boolean {
+  return getBypassAuth();
+}

src/services/notifications/notificationAuthLifecycle.ts

@@ -0,0 +1,115 @@
+/**
+ * Defers notification register/refresh until app auth (active DID + Bearer) is available.
+ * Bounded retries avoid racing startup and prevent infinite loops.
+ */
+
+import { logger } from "@/utils/logger";
+import {
+  getNotificationApiHeaders,
+  logWaitingForAuthBeforeRegistration,
+} from "./notificationApiAuth";
+import { registerToken } from "./NotificationService";
+
+const MAX_REGISTER_RETRY_ATTEMPTS = 6;
+const REGISTER_RETRY_BASE_MS = 2_000;
+const REGISTER_RETRY_MAX_MS = 60_000;
+
+let pendingFcmToken: string | null = null;
+let registerRetryAttempt = 0;
+let registerRetryTimer: ReturnType<typeof setTimeout> | null = null;
+let registerFlushInFlight: Promise<void> | null = null;
+
+function clearRegisterRetryTimer(): void {
+  if (registerRetryTimer != null) {
+    clearTimeout(registerRetryTimer);
+    registerRetryTimer = null;
+  }
+}
+
+function scheduleDeferredRegistrationRetry(): void {
+  if (!pendingFcmToken || registerRetryTimer != null) {
+    return;
+  }
+  if (registerRetryAttempt >= MAX_REGISTER_RETRY_ATTEMPTS) {
+    logger.warn(
+      "[notificationAuthLifecycle] Stopped retrying deferred FCM registration (max attempts)",
+    );
+    return;
+  }
+
+  const delay = Math.min(
+    REGISTER_RETRY_BASE_MS * 2 ** registerRetryAttempt,
+    REGISTER_RETRY_MAX_MS,
+  );
+  registerRetryAttempt += 1;
+  registerRetryTimer = setTimeout(() => {
+    registerRetryTimer = null;
+    void flushDeferredFcmRegistration("scheduled retry");
+  }, delay);
+}
+
+/**
+ * Queue FCM token registration until Bearer auth is available; retries with backoff.
+ */
+export function deferFcmRegistration(token: string): void {
+  const trimmed = token.trim();
+  if (!trimmed) {
+    return;
+  }
+  pendingFcmToken = trimmed;
+  logWaitingForAuthBeforeRegistration();
+  scheduleDeferredRegistrationRetry();
+}
+
+/** Attempt pending FCM registration when auth may now be ready (identity, resume, fetcher config). */
+export async function flushDeferredFcmRegistration(
+  reason?: string,
+): Promise<void> {
+  if (!pendingFcmToken) {
+    return;
+  }
+  if (registerFlushInFlight) {
+    return registerFlushInFlight;
+  }
+
+  registerFlushInFlight = (async () => {
+    const token = pendingFcmToken;
+    if (!token) {
+      return;
+    }
+
+    const auth = await getNotificationApiHeaders("register");
+    if (!auth.ok) {
+      scheduleDeferredRegistrationRetry();
+      return;
+    }
+
+    clearRegisterRetryTimer();
+    registerRetryAttempt = 0;
+    pendingFcmToken = null;
+
+    try {
+      await registerToken(token);
+    } catch (err) {
+      pendingFcmToken = token;
+      logger.warn(
+        `[notificationAuthLifecycle] Deferred FCM registration failed${reason ? ` (${reason})` : ""}`,
+        err,
+      );
+      scheduleDeferredRegistrationRetry();
+    }
+  })().finally(() => {
+    registerFlushInFlight = null;
+  });
+
+  return registerFlushInFlight;
+}
+
+/**
+ * Call when active identity or session may have become available (additive hooks only).
+ */
+export function onNotificationAuthMayBeReady(): void {
+  registerRetryAttempt = 0;
+  clearRegisterRetryTimer();
+  void flushDeferredFcmRegistration("auth may be ready");
+}

src/services/notifications/notificationLog.ts

@@ -0,0 +1,117 @@
+/**
+ * Shared observability helpers for notification flows (console + debug panel).
+ */
+
+import { logNotification } from "./NotificationDebugEvents";
+
+export function truncateFcmTokenForLog(token: string): string {
+  const t = token.trim();
+  if (t.length <= 24) {
+    return t;
+  }
+  return `${t.slice(0, 12)}…${t.slice(-8)}`;
+}
+
+export function logPushNotificationReceived(notification: {
+  title?: string;
+  data?: Record<string, unknown>;
+}): void {
+  const type =
+    typeof notification.data?.type === "string"
+      ? notification.data.type
+      : "(none)";
+  logNotification(`pushNotificationReceived type=${type}`, {
+    title: notification.title,
+    dataType: type,
+  });
+  if (type === "WAKEUP_PING") {
+    logNotification("WAKEUP_PING received — will trigger refresh");
+  }
+}
+
+export function logPushNotificationActionPerformed(action: {
+  actionId?: string;
+  notification?: { title?: string; data?: Record<string, unknown> };
+}): void {
+  const type =
+    typeof action.notification?.data?.type === "string"
+      ? action.notification.data.type
+      : "(none)";
+  logNotification(
+    `pushNotificationActionPerformed actionId=${action.actionId ?? "(none)"} type=${type}`,
+    {
+      actionId: action.actionId,
+      dataType: type,
+    },
+  );
+}
+
+export function logTokenRegistrationStarted(token: string): void {
+  logNotification("Token registration started", {
+    token: truncateFcmTokenForLog(token),
+  });
+}
+
+export function logTokenRegistrationSuccess(token: string): void {
+  logNotification("Token registration success", {
+    token: truncateFcmTokenForLog(token),
+  });
+}
+
+export function logTokenRegistrationSkippedDuplicate(token: string): void {
+  logNotification("Token registration skipped (duplicate token)", {
+    token: truncateFcmTokenForLog(token),
+  });
+}
+
+export function logTokenRegistrationFailure(
+  token: string,
+  error: unknown,
+): void {
+  const message = error instanceof Error ? error.message : String(error);
+  logNotification(`Token registration failure: ${message}`, {
+    token: truncateFcmTokenForLog(token),
+  });
+}
+
+export function logRefreshStarted(source?: string): void {
+  logNotification(source ? `Refresh started (${source})` : "Refresh started");
+}
+
+function elapsedMsSince(startedAt: number): number {
+  return performance.now() - startedAt;
+}
+
+export function logRefreshSuccess(
+  startedAt: number,
+  scheduledCount: number,
+  source?: string,
+): void {
+  const elapsedMs = Math.round(elapsedMsSince(startedAt));
+  const message = source
+    ? `Refresh completed (${source}) in ${elapsedMs}ms (scheduled ${scheduledCount})`
+    : `Refresh completed in ${elapsedMs}ms (scheduled ${scheduledCount})`;
+  logNotification(message);
+}
+
+export function logRefreshFailure(
+  startedAt: number,
+  errorMessage: string,
+  status?: number,
+  source?: string,
+): void {
+  const statusPart = status != null ? ` HTTP ${status}` : "";
+  const elapsedMs = Math.round(elapsedMsSince(startedAt));
+  const message = source
+    ? `Refresh failed (${source}) in ${elapsedMs}ms: ${errorMessage}${statusPart}`
+    : `Refresh failed in ${elapsedMs}ms: ${errorMessage}${statusPart}`;
+  logNotification(message);
+}
+
+export function logNotificationClearing(method: string): void {
+  logNotification(`Clearing notifications via ${method}`);
+}
+
+export function logScheduleReplacement(count: number): void {
+  logNotification(`Schedule replacement: ${count} notification(s)`);
+}

src/services/notifications/smsNotificationApi.ts

@@ -0,0 +1,453 @@
+/**
+ * Client for the notify-api's `/notify-sms` surface.
+ *
+ * The SMS channel texts the daily alertSearch digest. Setting it up is two
+ * independent steps: prove possession of a handset (POST then PUT `/phone`),
+ * and authorize the service to run the daily search (POST
+ * `/alert-authorization`). Stopping is the mirror image, and the two stops are
+ * different promises: DELETE `/alert-authorization` silences the texts and
+ * keeps the number verified, while DELETE `/phone` forgets the number and
+ * costs a fresh code next time.
+ *
+ * Every call carries a Bearer JWT that both authenticates the caller and names
+ * the single action it may perform, on the single number it applies to. The
+ * service records the token's hash before running the handler, so a token buys
+ * exactly one call -- each function here mints its own and none may be reused.
+ *
+ * The wire shapes are in `@/interfaces/notifyApi`; the service's own account of
+ * these routes is `notification-wakeup-service/README.md`.
+ */
+
+import type {
+  AlertAuthorizationRequestBody,
+  AlertAuthorizationResponse,
+  AlertAuthorizationRevokeResponse,
+  NotifySmsFailure,
+  SmsActionJwtPayload,
+  SmsActionTarget,
+  SmsNotificationActionClaim,
+  SmsPhoneDeleteRequest,
+  SmsPhoneDeleteResponse,
+  SmsPhoneListQuery,
+  SmsPhoneListResponse,
+  SmsPhoneRegisterRequest,
+  SmsPhoneRegisterResponse,
+  SmsPhoneVerifyRequest,
+  SmsPhoneVerifyResponse,
+} from "@/interfaces/notifyApi";
+import { createEndorserJwtForDid } from "@/libs/endorserServer";
+import { logger } from "@/utils/logger";
+import { buildAlertAuthorizationBody } from "./alertAuthorizationBatch";
+import { getNotificationApiBaseUrl } from "./NotificationDebugConfig";
+
+/**
+ * Claim namespace, shared with the FCM setup claim; `@type` is what separates
+ * the two. Not to be confused with `https://giftopia.me`, the app link that
+ * appears in the texts themselves.
+ */
+const SMS_CLAIM_CONTEXT = "https://giftopia.tech";
+const SMS_CLAIM_TYPE = "SmsNotificationAction";
+
+/**
+ * Lifetime of an action JWT. Long enough to survive a slow round trip and
+ * ordinary clock skew, short enough to stay inside the service's
+ * `SMS_ACTION_JWT_MAX_AGE_SEC` staleness window.
+ */
+const ACTION_JWT_EXPIRY_SECONDS = 300;
+
+/** A `/notify-sms` call that did not succeed. */
+export class SmsApiError extends Error {
+  /**
+   * The service's code, such as `SMS_CODE_MISMATCH`; `NO_ACTIVE_IDENTITY` when
+   * no request was sent; "" when the refusal carried no code, as from the auth
+   * stages or from an answer that was not the service's JSON.
+   */
+  readonly code: string;
+  /** HTTP status, or 0 when no request was sent. */
+  readonly status: number;
+  /**
+   * The coded refusal as sent, for the fields specific codes carry. A code the
+   * service adds later arrives here too, outside the union.
+   */
+  readonly response?: NotifySmsFailure;
+
+  constructor(
+    code: string,
+    status: number,
+    message: string,
+    response?: NotifySmsFailure,
+  ) {
+    super(message);
+    this.name = "SmsApiError";
+    this.code = code;
+    this.status = status;
+    this.response = response;
+  }
+}
+
+/**
+ * Normalize a typed number toward E.164 so the same string goes into the claim
+ * and the body, and so a number stored from one call still matches on the next.
+ * Ten digits are assumed US, matching the service's own rule; a leading `+` is
+ * taken at its word.
+ *
+ * @returns the normalized number, or "" when it cannot be one
+ */
+export function normalizePhoneNumber(raw: string): string {
+  const trimmed = (raw || "").trim();
+  if (!trimmed) {
+    return "";
+  }
+  const digits = trimmed.replace(/\D/g, "");
+  if (!digits) {
+    return "";
+  }
+  if (trimmed.startsWith("+")) {
+    return `+${digits}`;
+  }
+  if (digits.length === 10) {
+    return `+1${digits}`;
+  }
+  if (digits.length === 11 && digits.startsWith("1")) {
+    return `+${digits}`;
+  }
+  // Everything else keeps its digits and gains the `+` the service expects;
+  // whether the country code is real is Twilio's judgment, not ours.
+  return `+${digits}`;
+}
+
+/**
+ * Mint the one-shot Bearer token for a single `/notify-sms` call.
+ *
+ * {@link SmsActionTarget} pairs each action with the number it binds to: the
+ * per-handset actions require one and the inventory-wide ones take none. An
+ * empty number is left out of the claim.
+ */
+async function mintSmsActionJwt(
+  did: string,
+  target: SmsActionTarget,
+): Promise<string> {
+  // Copied field by field so request options passed along as `target` stay out
+  // of the claim; the parameter type has already checked the pairing.
+  const claim = {
+    "@context": SMS_CLAIM_CONTEXT,
+    "@type": SMS_CLAIM_TYPE,
+    action: target.action,
+    ...(target.phoneNumber ? { phoneNumber: target.phoneNumber } : {}),
+  } as SmsNotificationActionClaim;
+  const payload: SmsActionJwtPayload = { claim };
+  return createEndorserJwtForDid(did, payload, ACTION_JWT_EXPIRY_SECONDS);
+}
+
+/**
+ * Read a refusal: a coded `/notify-sms` refusal, or a message without a code
+ * from the auth stages. Anything else keeps only its status.
+ */
+function parseRefusal(
+  body: unknown,
+  status: number,
+): { code: string; message: string; response?: NotifySmsFailure } {
+  if (!body || typeof body !== "object") {
+    return { code: "", message: `HTTP ${status}` };
+  }
+  const { error, message } = body as { error?: unknown; message?: unknown };
+  const text =
+    typeof message === "string" && message ? message : `HTTP ${status}`;
+  if (typeof error === "string" && error) {
+    return { code: error, message: text, response: body as NotifySmsFailure };
+  }
+  return { code: "", message: text };
+}
+
+/**
+ * One `/notify-sms` call: what its action claim authorizes, plus the request.
+ * `phoneNumber` here goes into the claim only; a route that reads the number
+ * from the query or body still needs it there.
+ */
+type SmsRequestOptions = SmsActionTarget & {
+  method: "GET" | "POST" | "PUT" | "DELETE";
+  path: string;
+  query?: SmsPhoneListQuery | SmsPhoneDeleteRequest;
+  body?:
+    | SmsPhoneRegisterRequest
+    | SmsPhoneVerifyRequest
+    | SmsPhoneDeleteRequest
+    | AlertAuthorizationRequestBody;
+};
+
+async function smsRequest<T>(
+  did: string,
+  options: SmsRequestOptions,
+): Promise<T> {
+  if (!did) {
+    throw new SmsApiError(
+      "NO_ACTIVE_IDENTITY",
+      0,
+      "No active identity to authorize the request",
+    );
+  }
+
+  const jwt = await mintSmsActionJwt(did, options);
+  const url = new URL(`${getNotificationApiBaseUrl()}${options.path}`);
+  for (const [key, value] of Object.entries(options.query ?? {})) {
+    if (typeof value === "string") {
+      url.searchParams.set(key, value);
+    }
+  }
+
+  const response = await fetch(url.toString(), {
+    method: options.method,
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${jwt}`,
+    },
+    body: options.body ? JSON.stringify(options.body) : undefined,
+  });
+
+  const text = await response.text();
+  let parsed: unknown = null;
+  if (text) {
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      parsed = null;
+    }
+  }
+
+  if (!response.ok) {
+    const refusal = parseRefusal(parsed, response.status);
+    logger.warn("[smsNotificationApi] request failed", {
+      action: options.action,
+      status: response.status,
+      code: refusal.code,
+    });
+    throw new SmsApiError(
+      refusal.code,
+      response.status,
+      refusal.message,
+      refusal.response,
+    );
+  }
+
+  return (parsed ?? {}) as T;
+}
+
+/**
+ * List this DID's registrations, with full numbers. Pass a number to also learn
+ * which DIDs have verified it -- allowed only to a caller who has verified it
+ * too.
+ */
+export async function listSmsPhones(
+  did: string,
+  phoneNumber?: string,
+): Promise<SmsPhoneListResponse> {
+  const normalized = phoneNumber ? normalizePhoneNumber(phoneNumber) : "";
+  return smsRequest<SmsPhoneListResponse>(did, {
+    method: "GET",
+    path: "/notify-sms/phone",
+    action: "list-phones",
+    // The claim binds to a number only when the query parameter is present.
+    phoneNumber: normalized || undefined,
+    query: normalized ? { phoneNumber: normalized } : undefined,
+  });
+}
+
+/**
+ * Record the number for this DID and have the service text a 6-digit code.
+ *
+ * A number this DID has already verified comes back with `verified: true` and
+ * no text is sent, so a caller can treat that as an immediate success.
+ *
+ * The `phoneNumber` in the response is masked. Keep
+ * `normalizePhoneNumber(phoneNumber)` instead: only the full number matches
+ * what {@link listSmsPhones} returns and what the later calls must send.
+ */
+export async function registerSmsPhone(
+  did: string,
+  phoneNumber: string,
+): Promise<SmsPhoneRegisterResponse> {
+  const normalized = normalizePhoneNumber(phoneNumber);
+  return smsRequest<SmsPhoneRegisterResponse>(did, {
+    method: "POST",
+    path: "/notify-sms/phone",
+    action: "register-phone",
+    phoneNumber: normalized,
+    body: { phoneNumber: normalized },
+  });
+}
+
+/**
+ * Match the texted code and mark the registration verified. The response's
+ * `phoneNumber` is masked, as with {@link registerSmsPhone}.
+ */
+export async function verifySmsPhone(
+  did: string,
+  phoneNumber: string,
+  code: string,
+): Promise<SmsPhoneVerifyResponse> {
+  const normalized = normalizePhoneNumber(phoneNumber);
+  return smsRequest<SmsPhoneVerifyResponse>(did, {
+    method: "PUT",
+    path: "/notify-sms/phone",
+    action: "verify-phone",
+    phoneNumber: normalized,
+    body: { phoneNumber: normalized, code: code.trim() },
+  });
+}
+
+/**
+ * Forget the number entirely. Removing one that is not registered is a success
+ * with `deleted: false`, not an error, so this is safe to call blind.
+ *
+ * The number goes in both the body and the query string because proxies drop
+ * bodies on DELETE and the service reads either.
+ */
+export async function deleteSmsPhone(
+  did: string,
+  phoneNumber: string,
+): Promise<SmsPhoneDeleteResponse> {
+  const normalized = normalizePhoneNumber(phoneNumber);
+  return smsRequest<SmsPhoneDeleteResponse>(did, {
+    method: "DELETE",
+    path: "/notify-sms/phone",
+    action: "delete-phone",
+    phoneNumber: normalized,
+    query: { phoneNumber: normalized },
+    body: { phoneNumber: normalized },
+  });
+}
+
+/**
+ * Hand the service a fresh inventory of delegated JWTs and the UTC time of day
+ * to text. This is what turns the daily digest on; it replaces any batch
+ * already stored, so it is also how the send time is changed.
+ *
+ * Requires a verified phone for the DID -- without one the service answers
+ * `SMS_NO_VERIFIED_PHONE`.
+ *
+ * @param notifyHourUtc UTC hour, 0-23
+ * @param notifyMinuteUtc UTC minute, 0-59
+ */
+export async function authorizeSmsAlertSearch(
+  did: string,
+  notifyHourUtc: number,
+  notifyMinuteUtc: number,
+): Promise<AlertAuthorizationResponse> {
+  const body = await buildAlertAuthorizationBody(
+    did,
+    notifyHourUtc,
+    notifyMinuteUtc,
+  );
+  return smsRequest<AlertAuthorizationResponse>(did, {
+    method: "POST",
+    path: "/notify-sms/alert-authorization",
+    action: "authorize-alert-search",
+    body,
+  });
+}
+
+/**
+ * Turn the texts off: every SMS batch and JWT for this DID is removed and the
+ * scheduler stops listing the identity. Registered numbers survive, so turning
+ * the digest back on does not cost another verification code.
+ */
+export async function revokeSmsAlertSearch(
+  did: string,
+): Promise<AlertAuthorizationRevokeResponse> {
+  return smsRequest<AlertAuthorizationRevokeResponse>(did, {
+    method: "DELETE",
+    path: "/notify-sms/alert-authorization",
+    action: "revoke-alert-search",
+  });
+}
+
+/**
+ * Turn a failure into something worth showing a user.
+ *
+ * Codes the service documents get their own wording; an unrecognized code
+ * falls back to the message the service sent, since a new code is more likely
+ * to be informative than a generic apology. A refusal with no code gets
+ * wording by status, because the auth stages' messages point at server logs.
+ */
+export function smsErrorMessage(error: unknown, fallback: string): string {
+  if (!(error instanceof SmsApiError)) {
+    return fallback;
+  }
+  const response = error.response;
+  switch (error.code) {
+    case "SMS_DISABLED":
+      return "Text notifications are not available on this server yet.";
+    case "SMS_NOT_CONFIGURED":
+      return "This server cannot send texts right now. Please try again later.";
+    case "SMS_PHONE_BLOCKED":
+      return (
+        "This number has opted out of texts from us. Text START to the " +
+        "number that messaged you, then try again."
+      );
+    case "SMS_RECIPIENT_NOT_ALLOWED":
+      return "This server is not allowed to text your identity.";
+    case "SMS_CODE_MISMATCH": {
+      const remaining =
+        response?.error === "SMS_CODE_MISMATCH"
+          ? response.attemptsRemaining
+          : undefined;
+      return typeof remaining === "number"
+        ? `That code is not right. ${remaining} ${
+            remaining === 1 ? "try" : "tries"
+          } left.`
+        : "That code is not right.";
+    }
+    case "SMS_CODE_ATTEMPTS_EXHAUSTED":
+      return "Too many wrong codes. Ask for a new one to start over.";
+    case "SMS_CODE_EXPIRED":
+      return "That code has expired. Ask for a new one.";
+    case "SMS_CODE_RATE_LIMITED":
+      return "Too many codes sent to that number. Please wait a while.";
+    case "SMS_CODE_SEND_FAILED":
+      return "The code could not be texted to that number. Please try again.";
+    case "SMS_PHONE_INVALID":
+      return "That does not look like a mobile number we can text.";
+    case "SMS_PHONE_DID_LIMIT": {
+      const limit =
+        response?.error === "SMS_PHONE_DID_LIMIT" ? response.limit : undefined;
+      return typeof limit === "number"
+        ? `This number already has ${limit} identities on it, which is the limit.`
+        : "This number already has as many identities on it as we allow.";
+    }
+    case "SMS_PHONE_NOT_VERIFIED_BY_CALLER":
+      return "Verify this number first to see who else is using it.";
+    case "SMS_NO_VERIFIED_PHONE":
+      return "Verify a phone number before turning on text notifications.";
+    case "SMS_ACTION_JWT_STALE":
+    case "SMS_ACTION_JWT_EXPIRED":
+      return "That request took too long to reach the server. Please try again.";
+    case "SMS_ACTION_JWT_REPLAYED":
+      return "That request was already used. Please try again.";
+    case "SMS_ACTION_JWT_MISSING_CLAIM":
+    case "SMS_ACTION_JWT_WRONG_ACTION":
+    case "SMS_ACTION_JWT_PHONE_MISMATCH":
+    case "ALERT_AUTHORIZATION_INVALID_BATCH":
+      return "This app and the notification server disagree about that request.";
+    case "SMS_ALERT_AUTHORIZATION_FAILED":
+    case "SMS_ALERT_AUTHORIZATION_DELETE_FAILED":
+    case "SMS_ACTION_JWT_NOT_AUTHENTICATED":
+      return "The notification server had a problem. Please try again later.";
+    case "DELEGATED_JWT_UNSUPPORTED_IDENTITY":
+      return (
+        "Passkey identities cannot authorize background notifications. " +
+        "Switch to a seed-phrase identity to turn this on."
+      );
+    case "NO_ACTIVE_IDENTITY":
+      return "Choose an identity before setting up text notifications.";
+    case "":
+      if (error.status === 401) {
+        return "The notification server could not confirm your identity. Please try again.";
+      }
+      if (error.status === 503) {
+        return "The notification server cannot confirm identities right now. Please try again later.";
+      }
+      return fallback;
+    default:
+      return error.message || fallback;
+  }
+}

src/services/platforms/BaseDatabaseService.ts

@@ -139,6 +139,12 @@ export abstract class BaseDatabaseService {
       "UPDATE active_identity SET activeDid = ?, lastUpdated = datetime('now') WHERE id = 1",
       [did],
     );
+    if (did?.trim()) {
+      const { onNotificationAuthMayBeReady } = await import(
+        "@/services/notifications/notificationAuthLifecycle"
+      );
+      onNotificationAuthMayBeReady();
+    }
   }
 
   /**

src/services/platforms/CapacitorPlatformService.ts

@@ -590,16 +590,22 @@ export class CapacitorPlatformService
         await this.db!.run(sql, params);
       } else {
         // For multi-statement SQL (like migrations), use executeSet method
-        // This handles multiple statements properly
-        if (
-          sql.includes(";") &&
-          sql.split(";").filter((s) => s.trim()).length > 1
-        ) {
+        // This handles multiple statements properly.
+        // Strip "--" line comments before splitting: a semicolon inside a
+        // comment would otherwise split mid-comment, yielding a comment-only
+        // statement (SQLITE_MISUSE, "error code 21: not an error") and a
+        // statement that starts with stray comment text.
+        // (No migration uses "--" or ";" inside a string literal.)
+        const statements = sql
+          .replace(/--[^\n]*/g, "")
+          .split(";")
+          .map((s) => s.trim())
+          .filter((s) => s);
+        if (statements.length > 1) {
           // Multi-statement SQL - use executeSet for proper handling
-          const statements = sql.split(";").filter((s) => s.trim());
           await this.db!.executeSet(
             statements.map((stmt) => ({
-              statement: stmt.trim(),
+              statement: stmt,
               values: [], // Empty values array for non-parameterized statements
             })),
           );

src/test/alertAuthorizationBatch.test.ts

@@ -0,0 +1,183 @@
+import type { DelegatedAlertJwt } from "@/interfaces/notifyApi";
+import {
+  ALERT_AUTHORIZATION_BATCH_DAYS,
+  buildAlertAuthorizationBody,
+  mintAlertAuthorizationBatch,
+  UnsupportedIdentityError,
+} from "@/services/notifications/alertAuthorizationBatch";
+import { retrieveFullyDecryptedAccount } from "@/libs/util";
+import { createEndorserJwtForKey } from "@/libs/crypto/vc";
+
+jest.mock("@/libs/util", () => ({ retrieveFullyDecryptedAccount: jest.fn() }));
+jest.mock("@/libs/crypto/vc", () => ({ createEndorserJwtForKey: jest.fn() }));
+
+const mockedRetrieve = retrieveFullyDecryptedAccount as unknown as jest.Mock;
+const mockedSign = createEndorserJwtForKey as unknown as jest.Mock;
+
+const DID = "did:ethr:0x0000000000000000000000000000000000000001";
+const SECONDS_PER_DAY = 86400;
+
+/**
+ * The notify-api's acceptance rule for one entry, as enforced by
+ * `validateAlertAuthorizationBatch` in notification-wakeup-service: the JWT is
+ * valid for the whole UTC day it names.
+ */
+function coversWholeUtcDay(entry: DelegatedAlertJwt): boolean {
+  const dayStart = Date.parse(`${entry.day}T00:00:00Z`) / 1000;
+  return (
+    entry.nbf < entry.exp &&
+    entry.nbf <= dayStart &&
+    entry.exp >= dayStart + SECONDS_PER_DAY
+  );
+}
+
+/**
+ * `Date` methods whose answers depend on the device's zone. Jest cannot switch
+ * the process zone inside a test file, so rather than minting under several
+ * zones the test makes these throw: a minter that never calls them produces
+ * the same batch in every zone.
+ */
+const ZONE_DEPENDENT_DATE_METHODS = [
+  "getDate",
+  "getDay",
+  "getFullYear",
+  "getHours",
+  "getMilliseconds",
+  "getMinutes",
+  "getMonth",
+  "getSeconds",
+  "getTimezoneOffset",
+  "setDate",
+  "setFullYear",
+  "setHours",
+  "setMilliseconds",
+  "setMinutes",
+  "setMonth",
+  "setSeconds",
+  "toDateString",
+  "toLocaleDateString",
+  "toLocaleString",
+  "toLocaleTimeString",
+  "toString",
+  "toTimeString",
+] as const;
+
+async function mintWithoutZoneDependentDates(startingAt: Date) {
+  const spies = ZONE_DEPENDENT_DATE_METHODS.map((method) =>
+    jest.spyOn(Date.prototype, method).mockImplementation(() => {
+      throw new Error(`Date.prototype.${method} reads the device's zone`);
+    }),
+  );
+  try {
+    return await mintAlertAuthorizationBatch(DID, startingAt);
+  } finally {
+    spies.forEach((spy) => spy.mockRestore());
+  }
+}
+
+// Just after and just before a UTC midnight, where the device's calendar day
+// differs from the UTC one in most zones, and starts whose 100 days cross a US
+// daylight-saving change.
+const INSTANTS = [
+  "2026-09-13T00:10:00Z",
+  "2026-09-13T23:50:00Z",
+  "2026-02-20T12:00:00Z",
+  "2026-10-15T07:30:00Z",
+];
+
+describe("mintAlertAuthorizationBatch", () => {
+  beforeEach(() => {
+    mockedRetrieve.mockReset().mockResolvedValue({ did: DID, identity: "{}" });
+    mockedSign
+      .mockReset()
+      .mockImplementation(
+        async (_account: unknown, payload: object) =>
+          `jwt.${JSON.stringify(payload)}`,
+      );
+  });
+
+  it.each(INSTANTS)(
+    "starting at %s, mints a batch the notify-api accepts in any zone",
+    async (instant) => {
+      const batch = await mintWithoutZoneDependentDates(new Date(instant));
+
+      expect(batch.batchId).toEqual(expect.any(String));
+      expect(batch.batchId.length).toBeGreaterThan(0);
+      expect(batch.jwts).toHaveLength(ALERT_AUTHORIZATION_BATCH_DAYS);
+
+      // Sequence 0 is the UTC day containing the start.
+      expect(batch.jwts[0].day).toBe(instant.slice(0, 10));
+
+      const days = new Set(batch.jwts.map((entry) => entry.day));
+      expect(days.size).toBe(ALERT_AUTHORIZATION_BATCH_DAYS);
+
+      batch.jwts.forEach((entry, index) => {
+        expect(entry.sequence).toBe(index);
+        expect(coversWholeUtcDay(entry)).toBe(true);
+        if (index > 0) {
+          const previousStart = Date.parse(
+            `${batch.jwts[index - 1].day}T00:00:00Z`,
+          );
+          expect(Date.parse(`${entry.day}T00:00:00Z`) - previousStart).toBe(
+            SECONDS_PER_DAY * 1000,
+          );
+        }
+      });
+
+      // The service checks the signed claims against the listed window.
+      expect(mockedSign).toHaveBeenCalledTimes(ALERT_AUTHORIZATION_BATCH_DAYS);
+      mockedSign.mock.calls.forEach(([, payload], index) => {
+        expect(payload).toEqual({
+          nbf: batch.jwts[index].nbf,
+          exp: batch.jwts[index].exp,
+        });
+      });
+
+      // One decryption serves every signature.
+      expect(mockedRetrieve).toHaveBeenCalledTimes(1);
+    },
+  );
+
+  it("refuses passkey identities without signing", async () => {
+    mockedRetrieve.mockResolvedValue({
+      did: "did:peer:0zExample",
+      passkeyCredIdHex: "abcd",
+    });
+    await expect(mintAlertAuthorizationBatch(DID)).rejects.toBeInstanceOf(
+      UnsupportedIdentityError,
+    );
+    expect(mockedSign).not.toHaveBeenCalled();
+  });
+
+  it("refuses an unknown DID", async () => {
+    mockedRetrieve.mockResolvedValue(undefined);
+    await expect(mintAlertAuthorizationBatch(DID)).rejects.toThrow(
+      /No account found/,
+    );
+  });
+});
+
+describe("buildAlertAuthorizationBody", () => {
+  beforeEach(() => {
+    mockedRetrieve.mockReset().mockResolvedValue({ did: DID, identity: "{}" });
+    mockedSign.mockReset().mockResolvedValue("jwt");
+  });
+
+  it("carries the fields both alert-authorization routes require", async () => {
+    const body = await buildAlertAuthorizationBody(DID, 0, 30);
+
+    expect(body.batchId).toEqual(expect.any(String));
+    expect(body.notifyHourUtc).toBe(0);
+    expect(body.notifyMinuteUtc).toBe(30);
+    expect(body.timezone).toBe(
+      Intl.DateTimeFormat().resolvedOptions().timeZone,
+    );
+    expect(body.jwts).toHaveLength(ALERT_AUTHORIZATION_BATCH_DAYS);
+  });
+
+  it("mints a distinct batch on every call", async () => {
+    const first = await buildAlertAuthorizationBody(DID, 18, 0);
+    const second = await buildAlertAuthorizationBody(DID, 18, 0);
+    expect(first.batchId).not.toBe(second.batchId);
+  });
+});

src/test/backgroundJwtPool.test.ts

@@ -0,0 +1,144 @@
+import {
+  BACKGROUND_JWT_POOL_SIZE,
+  BACKGROUND_JWT_SECONDS_PER_DAY,
+} from "@/constants/backgroundJwt";
+import {
+  BackgroundJwtUnsupportedIdentityError,
+  mintBackgroundJwtTokenPool,
+} from "@/libs/crypto/backgroundJwtPool";
+import { createEndorserJwtForKey } from "@/libs/crypto/vc";
+import type { KeyMetaWithPrivate } from "@/interfaces/common";
+
+jest.mock("@/libs/crypto/vc", () => ({ createEndorserJwtForKey: jest.fn() }));
+
+const mockedSign = createEndorserJwtForKey as unknown as jest.Mock;
+
+const DID = "did:ethr:0x0000000000000000000000000000000000000001";
+
+const seedAccount = {
+  did: DID,
+  identity: JSON.stringify({ keys: [{ privateKeyHex: "ab".repeat(32) }] }),
+} as unknown as KeyMetaWithPrivate;
+
+const passkeyAccount = {
+  did: "did:peer:0zAbC",
+  passkeyCredIdHex: "beef",
+} as unknown as KeyMetaWithPrivate;
+
+interface DayWindow {
+  nbf: number;
+  exp: number;
+}
+
+/**
+ * The signer is mocked, so each slot carries back the window it was minted with
+ * instead of a JWT. Distinctness of the real strings rests on these windows
+ * differing: ES256K signing is deterministic, so equal payloads sign to equal
+ * bytes.
+ */
+function windowsFromMint(tokens: string[]): DayWindow[] {
+  return tokens.map((t) => JSON.parse(t) as DayWindow);
+}
+
+/** The selector both native fetchers run, in Java and Swift alike. */
+function selectBearerTokenForRequest(
+  pool: string[],
+  atEpochMs: number,
+): string {
+  const epochDay = Math.floor(atEpochMs / (24 * 60 * 60 * 1000));
+  return pool[epochDay % pool.length];
+}
+
+beforeEach(() => {
+  mockedSign.mockReset();
+  mockedSign.mockImplementation(async (_account, payload) =>
+    JSON.stringify(payload),
+  );
+});
+
+describe("mintBackgroundJwtTokenPool", () => {
+  // 23:47 UTC: a mint late in the day must still file today's token in today's
+  // slot, and the pool must not run a day short at the far end.
+  const MINTED_AT = Date.UTC(2026, 8, 14, 23, 47, 3);
+
+  function mintAt(epochMs: number): Promise<string[]> {
+    jest.spyOn(Date, "now").mockReturnValue(epochMs);
+    return mintBackgroundJwtTokenPool(seedAccount);
+  }
+
+  afterEach(() => jest.restoreAllMocks());
+
+  it("fills every slot exactly once", async () => {
+    const pool = await mintAt(MINTED_AT);
+    expect(pool).toHaveLength(BACKGROUND_JWT_POOL_SIZE);
+    expect(pool.filter(Boolean)).toHaveLength(BACKGROUND_JWT_POOL_SIZE);
+  });
+
+  it("gives every slot a distinct day window", async () => {
+    const pool = await mintAt(MINTED_AT);
+    expect(new Set(pool).size).toBe(BACKGROUND_JWT_POOL_SIZE);
+  });
+
+  it("scopes each token to one day rather than the whole grant", async () => {
+    const windows = windowsFromMint(await mintAt(MINTED_AT));
+    for (const w of windows) {
+      const span = w.exp - w.nbf;
+      expect(span).toBeLessThan(2 * BACKGROUND_JWT_SECONDS_PER_DAY);
+      expect(span).toBeGreaterThan(BACKGROUND_JWT_SECONDS_PER_DAY);
+    }
+  });
+
+  /**
+   * The invariant the native selectors depend on. Both read
+   * `pool[epochDay % size]` and hold no mint date, so the token filed in a slot
+   * has to be the one whose window covers the day that lands on it. A pool
+   * ordered by distance-from-mint passes every other test here and fails this
+   * one -- silently, in production, as rejected prefetches.
+   */
+  it("files each day's token where the native selector looks for it", async () => {
+    const pool = await mintAt(MINTED_AT);
+    const firstDayStart =
+      Math.floor(MINTED_AT / 1000 / BACKGROUND_JWT_SECONDS_PER_DAY) *
+      BACKGROUND_JWT_SECONDS_PER_DAY;
+
+    for (let offset = 0; offset < BACKGROUND_JWT_POOL_SIZE; offset++) {
+      // midday on each covered day, well inside any clock-skew slack
+      const atSec = firstDayStart + offset * BACKGROUND_JWT_SECONDS_PER_DAY;
+      for (const probe of [atSec, atSec + BACKGROUND_JWT_SECONDS_PER_DAY - 1]) {
+        const picked = selectBearerTokenForRequest(pool, probe * 1000);
+        const w = JSON.parse(picked) as DayWindow;
+        expect(probe).toBeGreaterThanOrEqual(w.nbf);
+        expect(probe).toBeLessThanOrEqual(w.exp);
+      }
+    }
+  });
+
+  it("holds the slot mapping whatever day minting starts on", async () => {
+    // Every residue mod the pool size, so no start day is a lucky one.
+    for (const dayOffset of [0, 1, 37, BACKGROUND_JWT_POOL_SIZE - 1]) {
+      const at = MINTED_AT + dayOffset * 24 * 60 * 60 * 1000;
+      const pool = await mintAt(at);
+      const picked = selectBearerTokenForRequest(pool, at);
+      const w = JSON.parse(picked) as DayWindow;
+      const nowSec = Math.floor(at / 1000);
+      expect(nowSec).toBeGreaterThanOrEqual(w.nbf);
+      expect(nowSec).toBeLessThanOrEqual(w.exp);
+      jest.restoreAllMocks();
+    }
+  });
+
+  it("refuses passkey identities instead of prompting once per token", async () => {
+    await expect(mintBackgroundJwtTokenPool(passkeyAccount)).rejects.toThrow(
+      BackgroundJwtUnsupportedIdentityError,
+    );
+    expect(mockedSign).not.toHaveBeenCalled();
+  });
+
+  it("decrypts the identity once, not once per token", async () => {
+    const pool = await mintAt(MINTED_AT);
+    expect(mockedSign).toHaveBeenCalledTimes(pool.length);
+    for (const call of mockedSign.mock.calls) {
+      expect(call[0]).toBe(seedAccount);
+    }
+  });
+});

src/test/notificationApiAuth.test.ts

@@ -0,0 +1,67 @@
+import {
+  notificationApiFailureMessage,
+  readNotificationApiBody,
+} from "@/services/notifications/notificationApiAuth";
+
+jest.mock("@/libs/endorserServer", () => ({ getHeaders: jest.fn() }));
+jest.mock("@/services/PlatformServiceFactory", () => ({
+  PlatformServiceFactory: { getInstance: jest.fn() },
+}));
+jest.mock("@/utils/logger", () => ({ logger: { warn: jest.fn() } }));
+jest.mock("@/services/notifications/notificationApiDebugMode", () => ({
+  shouldBypassNotificationAuth: () => false,
+}));
+jest.mock("@/services/notifications/NotificationDebugEvents", () => ({
+  logNotification: jest.fn(),
+}));
+// The real module reads `@/constants/app`, whose `import.meta.env` Jest cannot parse.
+jest.mock("@/services/notifications/NotificationDebugConfig", () => ({
+  getNotificationDebugOverrideHeaders: () => ({}),
+}));
+
+describe("notificationApiFailureMessage", () => {
+  it("reads a device route's `error` sentence", () => {
+    expect(
+      notificationApiFailureMessage(404, { error: "Device not found" }),
+    ).toBe("Device not found");
+  });
+
+  it("reads a send-wakeup `failureReason`", () => {
+    expect(
+      notificationApiFailureMessage(200, {
+        success: false,
+        failureReason: "FCM send failed",
+        fcmTokenSuffix: "abc123",
+      }),
+    ).toBe("FCM send failed");
+  });
+
+  it("reads an auth stage's `message`", () => {
+    expect(
+      notificationApiFailureMessage(401, {
+        success: false,
+        message: "Unauthorized. See server logs at 2026-09-13T12:00:00.000Z",
+      }),
+    ).toBe("Unauthorized. See server logs at 2026-09-13T12:00:00.000Z");
+  });
+
+  it("describes the status when the body says nothing", () => {
+    expect(notificationApiFailureMessage(401, undefined)).toBe(
+      "unauthorized (expired or invalid auth)",
+    );
+    expect(notificationApiFailureMessage(500, { error: "  " })).toBe(
+      "HTTP 500",
+    );
+  });
+});
+
+describe("readNotificationApiBody", () => {
+  it("returns undefined for a body that is not JSON", async () => {
+    const res = {
+      json: async () => {
+        throw new SyntaxError("Unexpected token O");
+      },
+    } as unknown as Response;
+    await expect(readNotificationApiBody(res)).resolves.toBeUndefined();
+  });
+});

src/test/smsNotificationApi.test.ts

@@ -0,0 +1,182 @@
+import {
+  listSmsPhones,
+  registerSmsPhone,
+  SmsApiError,
+  smsErrorMessage,
+} from "@/services/notifications/smsNotificationApi";
+import { createEndorserJwtForDid } from "@/libs/endorserServer";
+
+jest.mock("@/libs/endorserServer", () => ({
+  createEndorserJwtForDid: jest.fn(),
+}));
+jest.mock("@/utils/logger", () => ({ logger: { warn: jest.fn() } }));
+jest.mock("@/services/notifications/NotificationDebugConfig", () => ({
+  getNotificationApiBaseUrl: () => "https://notify.example",
+}));
+jest.mock("@/services/notifications/alertAuthorizationBatch", () => ({
+  buildAlertAuthorizationBody: jest.fn(),
+}));
+
+const mockedSign = createEndorserJwtForDid as unknown as jest.Mock;
+const mockedFetch = jest.fn();
+global.fetch = mockedFetch as unknown as typeof fetch;
+
+const DID = "did:ethr:0x0000000000000000000000000000000000000001";
+const FALLBACK = "Something went wrong.";
+
+function answer(status: number, body: unknown) {
+  mockedFetch.mockResolvedValueOnce({
+    ok: status >= 200 && status < 300,
+    status,
+    text: async () => (typeof body === "string" ? body : JSON.stringify(body)),
+  });
+}
+
+async function refusal(status: number, body: unknown): Promise<SmsApiError> {
+  answer(status, body);
+  try {
+    await registerSmsPhone(DID, "555-555-0123");
+  } catch (error) {
+    if (error instanceof SmsApiError) {
+      return error;
+    }
+    throw error;
+  }
+  throw new Error("expected the call to be refused");
+}
+
+beforeEach(() => {
+  mockedFetch.mockReset();
+  mockedSign.mockReset().mockResolvedValue("signed");
+});
+
+describe("listSmsPhones", () => {
+  it("returns the service's body and signs a claim without a number", async () => {
+    const body = {
+      success: true,
+      phones: [
+        {
+          phoneNumber: "+15555550123",
+          verified: true,
+          verifiedAt: "2026-09-01T00:00:00.000Z",
+          createdAt: "2026-08-31T00:00:00.000Z",
+        },
+        {
+          phoneNumber: "+15555550199",
+          verified: false,
+          verifiedAt: null,
+          createdAt: "2026-09-02T00:00:00.000Z",
+        },
+      ],
+    };
+    answer(200, body);
+
+    await expect(listSmsPhones(DID)).resolves.toEqual(body);
+    expect(mockedSign).toHaveBeenCalledWith(
+      DID,
+      {
+        claim: {
+          "@context": "https://giftopia.tech",
+          "@type": "SmsNotificationAction",
+          action: "list-phones",
+        },
+      },
+      300,
+    );
+    expect(mockedFetch.mock.calls[0][0]).toBe(
+      "https://notify.example/notify-sms/phone",
+    );
+  });
+
+  it("binds the claim and the query to a queried number", async () => {
+    answer(200, { success: true, phones: [], phoneNumber: "+15555550123" });
+
+    await listSmsPhones(DID, "(555) 555-0123");
+    expect(mockedSign.mock.calls[0][1].claim.phoneNumber).toBe("+15555550123");
+    expect(mockedFetch.mock.calls[0][0]).toBe(
+      "https://notify.example/notify-sms/phone?phoneNumber=%2B15555550123",
+    );
+  });
+});
+
+describe("refusals", () => {
+  it("keeps a coded refusal's extra fields", async () => {
+    const error = await refusal(400, {
+      success: false,
+      error: "SMS_CODE_MISMATCH",
+      message: "That code does not match.",
+      attemptsRemaining: 2,
+    });
+
+    expect(error.code).toBe("SMS_CODE_MISMATCH");
+    expect(error.status).toBe(400);
+    expect(error.message).toBe("That code does not match.");
+    expect(smsErrorMessage(error, FALLBACK)).toBe(
+      "That code is not right. 2 tries left.",
+    );
+  });
+
+  it("reads the identity limit from the refusal", async () => {
+    const error = await refusal(409, {
+      success: false,
+      error: "SMS_PHONE_DID_LIMIT",
+      message: "This number already carries the maximum number of identities.",
+      limit: 5,
+      verifiedCount: 5,
+    });
+
+    expect(smsErrorMessage(error, FALLBACK)).toBe(
+      "This number already has 5 identities on it, which is the limit.",
+    );
+  });
+
+  it("does not show an auth stage's server-log message", async () => {
+    const error = await refusal(401, {
+      success: false,
+      message: "Unauthorized. See server logs at 2026-09-13T12:00:00.000Z",
+    });
+
+    expect(error.code).toBe("");
+    expect(error.response).toBeUndefined();
+    expect(smsErrorMessage(error, FALLBACK)).toBe(
+      "The notification server could not confirm your identity. Please try again.",
+    );
+  });
+
+  it("names an unreachable Endorser for an uncoded 503", async () => {
+    const error = await refusal(503, {
+      success: false,
+      message: "Authentication service unavailable. See server logs at now",
+    });
+
+    expect(smsErrorMessage(error, FALLBACK)).toBe(
+      "The notification server cannot confirm identities right now. Please try again later.",
+    );
+  });
+
+  it("falls back for an answer that is not the service's JSON", async () => {
+    const error = await refusal(502, "<html>Bad Gateway</html>");
+
+    expect(error.code).toBe("");
+    expect(error.message).toBe("HTTP 502");
+    expect(smsErrorMessage(error, FALLBACK)).toBe(FALLBACK);
+  });
+
+  it("shows the service's message for a code this app does not know", async () => {
+    const error = await refusal(418, {
+      success: false,
+      error: "SMS_SOMETHING_NEW",
+      message: "A reason the app has no wording for.",
+    });
+
+    expect(smsErrorMessage(error, FALLBACK)).toBe(
+      "A reason the app has no wording for.",
+    );
+  });
+
+  it("uses the fallback for errors that are not SmsApiError", () => {
+    expect(smsErrorMessage(new TypeError("Failed to fetch"), FALLBACK)).toBe(
+      FALLBACK,
+    );
+  });
+});

src/utils/PlatformServiceMixin.ts

@@ -231,6 +231,12 @@ export const PlatformServiceMixin = {
           logger.debug(
             `[PlatformServiceMixin] ActiveDid updated in active_identity table: ${newDid}`,
           );
+          if (newDid) {
+            const { onNotificationAuthMayBeReady } = await import(
+              "@/services/notifications/notificationAuthLifecycle"
+            );
+            onNotificationAuthMayBeReady();
+          }
         } catch (error) {
           logger.error(
             `[PlatformServiceMixin] Error updating activeDid in active_identity table ${newDid}:`,
@@ -296,6 +302,7 @@ export const PlatformServiceMixin = {
             column === "warnIfProdServer" ||
             column === "warnIfTestServer" ||
             column === "reminderFastRolloverForTesting" ||
+            column === "smsNotificationsEnabled" ||
             // contacts
             column === "hideTheirContent" ||
             column === "registered" ||
@@ -775,6 +782,23 @@ export const PlatformServiceMixin = {
      * Required for smart deletion pattern
      */
     async $setActiveDid(did: string | null): Promise<void> {
+      // The outgoing identity's background-prefetch JWTs cover days ahead and
+      // stay valid on their own; drop them here so they do not outlive the
+      // identity that authorized them. Imported lazily to keep the native
+      // notification stack out of the bundle for every component using this
+      // mixin. A failure to clear is logged inside and must not block the
+      // switch, which is why this is not awaited into the caller's failure path.
+      try {
+        const { clearNativeFetcherPool } = await import(
+          "@/services/notifications/nativeFetcherConfig"
+        );
+        await clearNativeFetcherPool();
+      } catch (error) {
+        logger.warn(
+          "[PlatformServiceMixin] Native JWT pool clear failed",
+          error,
+        );
+      }
       await this.$dbExec(
         "UPDATE active_identity SET activeDid = ?, lastUpdated = datetime('now') WHERE id = 1",
         [did],

src/utils/includeDevToolkitRoutes.ts

@@ -0,0 +1,6 @@
+/**
+ * True for `vite dev` and for `vite build` when mode is not `production`
+ * (e.g. `--mode capacitor`, `--mode test`). Use for dev-only routes and UI.
+ */
+export const includeDevToolkitRoutes =
+  import.meta.env.DEV || import.meta.env.MODE !== "production";

src/views/HelpNotificationTypesView.vue

@@ -39,31 +39,76 @@
           something, so you can record thanks in here.
         </p>
         <p>
-          This is a reliable message, but it doesn't contain any details about
+          This is your own message activated in the app, but it doesn't contain any details about
           activity that might be especially interesting to you.
+          Note that the timing is not precise: the device may deliver it a bit later than scheduled.
         </p>
       </div>
 
-      <h2 class="text-xl font-semibold mt-4">New Activity Notifications</h2>
+      <h2 class="text-xl font-semibold mt-4">New Activity Notifications -- In App</h2>
       <div>
         <p>
-          The New Activity Notification will be sent to you when there is new, relevant activity 
-          for you. 
+          The New Activity Notification will be activated in your app when there is new, relevant
+          activity for you. 
           It will only trigger if something involves you or a project of interest; it will not
           bug you for other, general activity.
         </p>
-        <p>
-          This type is not as reliable as a Reminder Notification because mobile devices often 
-          suppress such notifications to save battery. (If you want to quickly check for relevant 
-          activity daily, use the Reminder Notification and open the app and look for a large green 
-          button that points out new activity that is personal to you. We are working on other 
-          ways to notify you more reliably. 
-          <router-link class="text-blue-500" to="/help">
-            go here to follow us or contact us
-            <font-awesome icon="chevron-right" class="fa-fw"></font-awesome>
-          </router-link>.)
-        </p>
       </div>
+
+      <h2 class="text-xl font-semibold mt-4">New Activity Notifications -- Texts From A Server</h2>
+      <div>
+        <p>
+          This New Activity Notification SMS will be sent to you when there is new, relevant
+          activity for you.
+          It will only trigger if something involves you or a project of interest; it will not
+          bug you for other, general activity.
+        </p>
+        <p class="mt-2">Notes and caveats for text messages:</p>
+        <ul class="list-disc list-outside ml-5 mt-1">
+          <li>
+            Text messages are opt-in: they are only sent after you enter your
+            phone number and confirm it with a verification code.
+          </li>
+          <li>
+            Standard message and data rates from your carrier may apply.
+          </li>
+          <li>
+            Message frequency is at most one New Activity text per day, at or
+            after the time you choose. The time is stored in UTC, so it shifts
+            by an hour when daylight saving starts or ends; set it again to put
+            it back where you want it.
+          </li>
+          <li>
+            Identities that sign with a passkey cannot turn this on, because
+            the server needs credentials it can use while your phone is asleep.
+          </li>
+          <li>
+            You can stop at any time: turn off the toggle in your settings, use
+            "Forget Phone Number" to remove your number entirely, or reply STOP
+            to any message. Reply HELP for help.
+          </li>
+          <li>
+            Delivery is not guaranteed or precisely timed; carriers may delay
+            or drop messages, and neither we nor the carriers are liable for
+            late or undelivered texts.
+          </li>
+          <li>
+            Only US phone numbers are currently supported.
+          </li>
+          <li>
+            Your phone number is used only to send you these notifications; it
+            is stored on the notification server and is deleted when you choose
+            "Forget Phone Number".
+          </li>
+          <li>
+            See our
+            <a href="https://timesafari.app/help-terms" target="_blank" class="text-blue-500">
+              Terms & Conditions and Privacy Policy docs here.
+            </a>
+          </li>
+        </ul>
+      </div>
+
     </div>
     <!-- eslint-enable -->
   </section>