diff --git a/TASKS/02-12.04.26-web-push-direct-message/01-ТЗ-web-push-direct-message.md b/TASKS/02-12.04.26-web-push-direct-message/01-ТЗ-web-push-direct-message.md
new file mode 100644
index 0000000..7019aed
--- /dev/null
+++ b/TASKS/02-12.04.26-web-push-direct-message/01-ТЗ-web-push-direct-message.md
@@ -0,0 +1,153 @@
+# Задача 02: Web Push + подписанный API отправки личных сообщений
+
+## Контекст (по текущему состоянию проекта)
+- Уже есть JSON WebSocket API для личных сообщений: `SendDirectMessage`, `AckIncomingMessage`, `UpsertPushToken`.
+- Сейчас серверный fallback-пуш реализован через FCM (`FcmPushSender`) и ключ `fcm.server.key`.
+- Клиент уже регистрирует service worker и токен Firebase, затем аплоадит push token на сервер.
+
+## Цель
+Добавить полностью рабочий сценарий доставки личных сообщений с приоритетом:
+1) онлайн-доставка в активную WebSocket-сессию;
+2) если не подтверждено — Web Push;
+3) поддержать отдельный API отправки без авторизации, где доступ проверяется цифровой подписью Ed25519 по `deviceKey` отправителя.
+
+---
+
+## Предварительная спецификация подписанного пакета (v1)
+> ВАЖНО: финально фиксируется после уточнений по endian/кодировкам/лимитам.
+
+Пакет (binary):
+1. `prefix` — ASCII-константа, например `SHINE_MESSAGE`.
+2. `toLoginLen` — 1 байт.
+3. `toLogin` — ASCII, длина = `toLoginLen`.
+4. `fromLoginLen` — 1 байт.
+5. `fromLogin` — ASCII, длина = `fromLoginLen`.
+6. `timeMs` — 8 байт (unix ms).
+7. `nonce32` — 4 байта случайное число.
+8. `messageType` — 4 байта.
+9. `targetMode` — 1 байт:
+   - `0` = всем сессиям пользователя,
+   - `1` = конкретной сессии.
+10. Если `targetMode=1`:
+   - `sessionIdLen` — 1 байт,
+   - `sessionId` — ASCII.
+11. `messageLen` — 2 байта.
+12. `messageBytes` — бинарные данные длиной `messageLen`.
+13. `signature64` — 64 байта, Ed25519 подпись всего блока **без** `signature64`.
+
+Ограничения (первичный draft):
+- общий размер пакета ≤ 4000 байт;
+- логины/префикс/идентификатор сессии — ASCII;
+- повторы отсекаются по `(fromLogin, timeMs, nonce32)` в окне TTL.
+
+---
+
+## Сервер: что доработать
+
+### 1) Новый endpoint без авторизации
+Операция (через WS JSON обертку) условно `SendSignedDirectMessage`:
+- принимает пакет (base64 binary blob);
+- парсит и валидирует формат;
+- достает `fromLogin`, поднимает `deviceKey` пользователя;
+- проверяет подпись Ed25519;
+- проверяет анти-replay (time window + nonce);
+- отправляет сообщение по правилам маршрутизации;
+- пишет результат (messageId, каналы доставки, причины недоставки).
+
+### 2) Маршрутизация доставки
+Для `targetMode=1`:
+- если целевая сессия онлайн и ACK пришел вовремя — успех;
+- иначе отправка в Web Push этой сессии (если есть subscription).
+
+Для `targetMode=0`:
+- обход всех сессий пользователя;
+- сначала online delivery + ACK;
+- для непринятых/офлайн — Web Push по соответствующим subscription;
+- если subscription отсутствует — тихий skip.
+
+### 3) Миграция от FCM к Web Push
+- добавить конфиг VAPID (`webpush.public.key`, `webpush.private.key`, `webpush.subject`);
+- хранить на сервере не только token, а web-push subscription (endpoint + keys);
+- сделать отправщик Web Push и заменить/расширить текущий `FcmPushSender`.
+
+### 4) Безопасность
+- строгая ASCII-валидация логинов/sessionId;
+- лимиты длины всех полей;
+- rate limit на endpoint;
+- audit-лог неуспешных проверок подписи/формата;
+- защита от replay.
+
+---
+
+## Клиент (shine-UI): что доработать
+
+1. Перейти на стандартный Web Push flow:
+   - регистрация service worker;
+   - `PushManager.subscribe(...)` с VAPID public key;
+   - отправка subscription на сервер (`UpsertPushSubscription` или расширение `UpsertPushToken`).
+
+2. Service worker:
+   - `push` handler получает payload целиком;
+   - показывает системное уведомление;
+   - при клике открывает/фокусирует нужный чат.
+
+3. Online-сообщения:
+   - сохранить текущий event-канал `IncomingDirectMessage`;
+   - обязателен ACK (`AckIncomingMessage` уже есть).
+
+4. Keep-alive:
+   - UI отправляет `Ping` раз в 60 секунд при активной сессии.
+
+---
+
+## Документация
+Сделать отдельный документ настройки Web Push:
+- как сгенерировать VAPID ключи;
+- какие параметры прописать на сервере и в UI;
+- как проверить локально e2e (онлайн + офлайн пуш);
+- ограничения payload и рекомендации по ретраям.
+
+---
+
+## Этапы реализации (предложение)
+1. Зафиксировать бинарный формат + валидации.
+2. Реализовать серверный parser/validator/signature verify/replay guard.
+3. Реализовать Web Push sender + storage subscription.
+4. Подключить новый endpoint и маршрутизацию доставки.
+5. Обновить UI (subscription + service worker + ping timer).
+6. Добавить интеграционные тесты (online ACK / offline push / bad signature / replay / oversize).
+7. Добавить документацию.
+
+---
+
+## Что нужно уточнить до разработки
+1. Endian для `timeMs/nonce/messageType/messageLen` (big-endian или little-endian).
+2. Что именно подписывается: строго весь префикс..messageBytes (без подписи) — подтвердить.
+3. Диапазон допустимых `messageType`.
+4. TTL окна для анти-replay (например 5 минут / 15 минут).
+5. Лимиты длин для login/session/message.
+6. Можно ли временно оставить FCM как fallback, пока не готов Web Push в проде.
+7. Формат сообщения в `messageBytes`: opaque bytes или UTF-8 строка.
+
+
+## Статус реализации (12.04.2026)
+
+### Что уже внедрено в коде
+- `SendDirectMessage` переведён на signed-binary payload (`blobB64`) без обязательной авторизации WS-сессии.
+- Внедрён бинарный парсер пакета формата `SHiNE_msg + version(1) + ... + signature64`.
+- Проверка подписи Ed25519 делается по `deviceKey` отправителя через `shine-server-crypto` (`Ed25519Util`).
+- Добавлен anti-replay guard `(from_login, time_ms, nonce)` с TTL 15 минут.
+- Добавлено историческое хранилище `signed_direct_messages_history` с сырым пакетом `raw_packet`.
+- Логика доставки: сначала WS+ACK, затем fallback на Web Push (по подписке конкретной session).
+- Поле типа сообщения переведено на `uint16`, пока поддерживается только `1`.
+- Для `targetMode=1` при несуществующей сессии возвращается `success` с `sessionNotFound=true` и `delivered=0`.
+- UI переведён с Firebase/FCM на браузерный `PushManager.subscribe` + Service Worker `push`.
+- Добавлен keep-alive ping из UI раз в 60 секунд при авторизованной сессии.
+
+### Что настроить в окружении
+- В `application.properties` задать:
+  - `webpush.vapid.public`
+  - `webpush.vapid.private`
+  - `webpush.vapid.subject`
+- В `shine-UI/index.html` задать публичный VAPID ключ в `window.__SHINE_WEBPUSH_VAPID_PUBLIC_KEY__`.
+
diff --git a/shine-UI/firebase-messaging-sw.js b/shine-UI/firebase-messaging-sw.js
index 28ce1aa..cf68f0a 100644
--- a/shine-UI/firebase-messaging-sw.js
+++ b/shine-UI/firebase-messaging-sw.js
@@ -1,30 +1,20 @@
-/* global importScripts, firebase */
-importScripts('https://www.gstatic.com/firebasejs/10.12.2/firebase-app-compat.js');
-importScripts('https://www.gstatic.com/firebasejs/10.12.2/firebase-messaging-compat.js');
-
 self.addEventListener('install', () => self.skipWaiting());
 self.addEventListener('activate', (event) => event.waitUntil(self.clients.claim()));
 
-// Заполните теми же значениями, что и в shine-UI/index.html
-const FIREBASE_CONFIG = {
-  apiKey: '',
-  authDomain: '',
-  projectId: '',
-  messagingSenderId: '',
-  appId: '',
-};
-
-if (FIREBASE_CONFIG.apiKey && firebase && firebase.messaging) {
-  if (!firebase.apps.length) {
-    firebase.initializeApp(FIREBASE_CONFIG);
+self.addEventListener('push', (event) => {
+  let body = 'Новое сообщение SHiNE';
+  try {
+    if (event.data) {
+      const text = event.data.text();
+      body = text || body;
+    }
+  } catch {
+    // ignore
   }
-  const messaging = firebase.messaging();
-  messaging.onBackgroundMessage((payload) => {
-    const title = payload?.notification?.title || 'Новое сообщение';
-    const options = {
-      body: payload?.notification?.body || '',
-      data: payload?.data || {},
-    };
-    self.registration.showNotification(title, options);
-  });
-}
+
+  event.waitUntil(self.registration.showNotification('SHiNE: входящее сообщение', {
+    body,
+    tag: 'shine-direct-message',
+    renotify: true,
+  }));
+});
diff --git a/shine-UI/index.html b/shine-UI/index.html
index 6272b58..e452966 100644
--- a/shine-UI/index.html
+++ b/shine-UI/index.html
@@ -27,17 +27,9 @@
       <div id="toolbar-slot" class="toolbar-slot"></div>
     </div>
     <div id="modal-root"></div>
-    <script src="https://www.gstatic.com/firebasejs/10.12.2/firebase-app-compat.js"></script>
-    <script src="https://www.gstatic.com/firebasejs/10.12.2/firebase-messaging-compat.js"></script>
     <script>
-      window.__SHINE_FIREBASE_CONFIG__ = {
-        apiKey: '',
-        authDomain: '',
-        projectId: '',
-        messagingSenderId: '',
-        appId: ''
-      };
-      window.__SHINE_FIREBASE_VAPID_KEY__ = '';
+      // Public VAPID key for Web Push (Base64URL)
+      window.__SHINE_WEBPUSH_VAPID_PUBLIC_KEY__ = '';
     </script>
     <script>
       (function attachAppWithBuildHash() {
diff --git a/shine-UI/js/app.js b/shine-UI/js/app.js
index 6063c91..735c161 100644
--- a/shine-UI/js/app.js
+++ b/shine-UI/js/app.js
@@ -213,10 +213,22 @@ async function init() {
     const fromLogin = payload.fromLogin || 'unknown';
     const messageId = payload.messageId || '';
     const eventId = payload.eventId || evt?.requestId || '';
-    const added = addIncomingMessage(fromLogin, payload.text || '', messageId);
+    let text = payload.text || '';
+    if (!text && payload.blobB64) {
+      try {
+        const bytes = Uint8Array.from(atob(payload.blobB64), (ch) => ch.charCodeAt(0));
+        const msgLen = (bytes[bytes.length - 66] << 8) | bytes[bytes.length - 65];
+        const msgStart = bytes.length - 64 - msgLen;
+        const msgBytes = bytes.slice(msgStart, msgStart + msgLen);
+        text = new TextDecoder().decode(msgBytes);
+      } catch {
+        text = '[binary message]';
+      }
+    }
+    const added = addIncomingMessage(fromLogin, text, messageId);
     if (added && Notification.permission === 'granted') {
       try {
-        new Notification(`Сообщение от ${fromLogin}`, { body: payload.text || '' });
+        new Notification(`Сообщение от ${fromLogin}`, { body: text || '' });
       } catch {}
     }
     if (eventId) {
@@ -226,6 +238,14 @@ async function init() {
   await tryAutoLogin();
   if (state.session.isAuthorized) {
     await initPwaPush({ authService });
+    window.setInterval(async () => {
+      if (!state.session.isAuthorized) return;
+      try {
+        await authService.ws.request('Ping', { timeMs: Date.now() });
+      } catch {
+        // silent keep-alive
+      }
+    }, 60_000);
   }
 
   if (!window.location.hash) {
diff --git a/shine-UI/js/pages/chat-view.js b/shine-UI/js/pages/chat-view.js
index fa8b0b0..73e9d3a 100644
--- a/shine-UI/js/pages/chat-view.js
+++ b/shine-UI/js/pages/chat-view.js
@@ -1,6 +1,6 @@
 import { renderHeader } from '../components/header.js';
 import { directMessages } from '../mock-data.js';
-import { addChatMessage, getChatMessages, authService } from '../state.js';
+import { addChatMessage, getChatMessages, authService, state } from '../state.js';
 
 export const pageMeta = { id: 'chat-view', title: 'Чат' };
 
@@ -66,7 +66,11 @@ export function render({ navigate, route }) {
     renderLog(log, chatId);
 
     try {
-      await authService.sendDirectMessage(chatId, text);
+      await authService.sendDirectMessage({
+        toLogin: chatId,
+        text,
+        storagePwd: state.session.storagePwdInMemory,
+      });
     } catch (e) {
       addChatMessage(chatId, `Ошибка отправки: ${e.message || 'unknown'}`);
       renderLog(log, chatId);
diff --git a/shine-UI/js/services/auth-service.js b/shine-UI/js/services/auth-service.js
index 8f3d344..1c29c18 100644
--- a/shine-UI/js/services/auth-service.js
+++ b/shine-UI/js/services/auth-service.js
@@ -1,5 +1,6 @@
 import { WsJsonClient } from './ws-client.js';
 import {
+  base64ToBytes,
   bytesToBase64,
   deriveEd25519FromPassword,
   exportEd25519PublicKeyB64,
@@ -95,6 +96,27 @@ function int64Bytes(value) {
   return bytes;
 }
 
+function uint16Bytes(value) {
+  const bytes = new Uint8Array(2);
+  const view = new DataView(bytes.buffer);
+  view.setUint16(0, Number(value), false);
+  return bytes;
+}
+
+function uint32Bytes(value) {
+  const bytes = new Uint8Array(4);
+  const view = new DataView(bytes.buffer);
+  view.setUint32(0, Number(value), false);
+  return bytes;
+}
+
+function uint64Bytes(value) {
+  const bytes = new Uint8Array(8);
+  const view = new DataView(bytes.buffer);
+  view.setBigUint64(0, BigInt(value), false);
+  return bytes;
+}
+
 function uint8Bytes(value) {
   return new Uint8Array([Number(value) & 0xff]);
 }
@@ -354,14 +376,57 @@ export class AuthService {
     return this.ws.onEvent(op, handler);
   }
 
-  async upsertPushToken({ tokenId, token, provider = 'fcm', platform = 'web', userAgent = navigator.userAgent || '' }) {
-    const response = await this.ws.request('UpsertPushToken', { tokenId, token, provider, platform, userAgent });
+  async upsertPushToken({ endpoint, p256dhKey, authKey, sessionId, platform = 'web', userAgent = navigator.userAgent || '' }) {
+    const response = await this.ws.request('UpsertPushToken', { endpoint, p256dhKey, authKey, sessionId, platform, userAgent });
     if (response.status !== 200) throw opError('UpsertPushToken', response);
     return response.payload || {};
   }
 
-  async sendDirectMessage(toLogin, text) {
-    const response = await this.ws.request('SendDirectMessage', { toLogin, text });
+  async sendDirectMessage({ toLogin, text, storagePwd, targetSessionId = null, messageType = 1 }) {
+    const cleanToLogin = String(toLogin || '').trim();
+    const cleanText = String(text || '');
+    if (!cleanToLogin || !cleanText) throw new Error('Не передан toLogin/text');
+    if (!storagePwd) throw new Error('Не передан storagePwd для подписи');
+    if (!this.ws.login) throw new Error('Нет активной авторизованной сессии');
+
+    const secrets = await loadEncryptedUserSecrets(this.ws.login, storagePwd);
+    const devicePriv = secrets?.deviceKey;
+    if (!devicePriv) throw new Error('Не найден приватный deviceKey');
+    const privateKey = await importPkcs8Ed25519(devicePriv);
+
+    const prefix = utf8Bytes('SHiNE_msg');
+    const version = uint8Bytes(1);
+    const toBytes = utf8Bytes(cleanToLogin);
+    const fromBytes = utf8Bytes(this.ws.login);
+    if (toBytes.length < 1 || toBytes.length > 30) throw new Error('toLogin должен быть 1..30 ASCII-символов');
+    if (fromBytes.length < 1 || fromBytes.length > 30) throw new Error('fromLogin должен быть 1..30 ASCII-символов');
+    if (cleanText.length > 3000) throw new Error('Слишком длинное сообщение');
+
+    const mode = targetSessionId ? 1 : 0;
+    const targetBytes = targetSessionId ? utf8Bytes(String(targetSessionId)) : new Uint8Array(0);
+    if (mode === 1 && (targetBytes.length < 1 || targetBytes.length > 255)) {
+      throw new Error('targetSessionId должен быть 1..255 символов');
+    }
+    const bodyBytes = utf8Bytes(cleanText);
+
+    const preimage = concatBytes(
+      prefix,
+      version,
+      uint8Bytes(toBytes.length), toBytes,
+      uint8Bytes(fromBytes.length), fromBytes,
+      uint64Bytes(Date.now()),
+      uint32Bytes(Math.floor(Math.random() * 0x100000000)),
+      uint16Bytes(messageType),
+      uint8Bytes(mode),
+      mode === 1 ? concatBytes(uint8Bytes(targetBytes.length), targetBytes) : new Uint8Array(0),
+      uint16Bytes(bodyBytes.length),
+      bodyBytes,
+    );
+    const signature = await signBytes(privateKey, preimage);
+    const packet = concatBytes(preimage, signature);
+    const blobB64 = bytesToBase64(packet);
+
+    const response = await this.ws.request('SendDirectMessage', { blobB64 });
     if (response.status !== 200) throw opError('SendDirectMessage', response);
     return response.payload || {};
   }
diff --git a/shine-UI/js/services/pwa-push-service.js b/shine-UI/js/services/pwa-push-service.js
index e449db3..c3449f6 100644
--- a/shine-UI/js/services/pwa-push-service.js
+++ b/shine-UI/js/services/pwa-push-service.js
@@ -1,50 +1,52 @@
-const LS_KEY = 'shine-ui-fcm-token-v1';
+const LS_KEY = 'shine-ui-webpush-subscription-v1';
+
+function urlBase64ToUint8Array(base64String) {
+  const padding = '='.repeat((4 - (base64String.length % 4)) % 4);
+  const base64 = (base64String + padding).replace(/-/g, '+').replace(/_/g, '/');
+  const rawData = window.atob(base64);
+  const outputArray = new Uint8Array(rawData.length);
+  for (let i = 0; i < rawData.length; ++i) {
+    outputArray[i] = rawData.charCodeAt(i);
+  }
+  return outputArray;
+}
 
 export async function initPwaPush({ authService }) {
-  if (!('serviceWorker' in navigator)) return;
-  try {
-    await navigator.serviceWorker.register('./firebase-messaging-sw.js');
-  } catch {
-    return;
-  }
+  if (!('serviceWorker' in navigator) || !('PushManager' in window)) return;
 
-  if (!window.firebase || !window.firebase.messaging) return;
+  const vapidPublicKey = window.__SHINE_WEBPUSH_VAPID_PUBLIC_KEY__ || '';
+  if (!vapidPublicKey) return;
 
   try {
-    const config = window.__SHINE_FIREBASE_CONFIG__ || null;
-    if (!config) return;
-    if (!window.firebase.apps.length) {
-      window.firebase.initializeApp(config);
-    }
-    const messaging = window.firebase.messaging();
-
+    const registration = await navigator.serviceWorker.register('./firebase-messaging-sw.js');
     const permission = await Notification.requestPermission();
     if (permission !== 'granted') return;
 
-    const vapidKey = window.__SHINE_FIREBASE_VAPID_KEY__ || '';
-    const token = await messaging.getToken({ vapidKey });
-    if (!token) return;
+    let sub = await registration.pushManager.getSubscription();
+    if (!sub) {
+      sub = await registration.pushManager.subscribe({
+        userVisibleOnly: true,
+        applicationServerKey: urlBase64ToUint8Array(vapidPublicKey),
+      });
+    }
 
-    const prev = localStorage.getItem(LS_KEY);
-    if (prev === token) return;
+    const serialized = JSON.stringify(sub);
+    if (localStorage.getItem(LS_KEY) === serialized) return;
+    localStorage.setItem(LS_KEY, serialized);
+
+    const json = sub.toJSON();
+    const endpoint = json.endpoint || '';
+    const p256dhKey = json.keys?.p256dh || '';
+    const authKey = json.keys?.auth || '';
+    if (!endpoint || !p256dhKey || !authKey) return;
 
-    localStorage.setItem(LS_KEY, token);
-    const tokenId = `tok-${new Date().toISOString().replace(/[-:.TZ]/g, '')}-${Math.random().toString(36).slice(2, 12)}`;
     await authService.upsertPushToken({
-      tokenId,
-      token,
-      provider: 'fcm',
+      endpoint,
+      p256dhKey,
+      authKey,
       platform: 'web',
       userAgent: navigator.userAgent || '',
     });
-
-    messaging.onMessage((payload) => {
-      const title = payload?.notification?.title || 'Новое сообщение';
-      const body = payload?.notification?.body || '';
-      try {
-        new Notification(title, { body });
-      } catch {}
-    });
   } catch {
     // silent for MVP
   }
diff --git a/shine-server-db/src/main/java/shine/db/DatabaseInitializer.java b/shine-server-db/src/main/java/shine/db/DatabaseInitializer.java
index 88a7851..eff7f83 100644
--- a/shine-server-db/src/main/java/shine/db/DatabaseInitializer.java
+++ b/shine-server-db/src/main/java/shine/db/DatabaseInitializer.java
@@ -376,6 +376,45 @@ public final class DatabaseInitializer {
                 ON user_push_tokens (login, session_id);
                 """);
 
+            // 11) signed_direct_message_replay (anti-replay window)
+            st.executeUpdate("""
+                CREATE TABLE IF NOT EXISTS signed_direct_message_replay (
+                    from_login     TEXT    NOT NULL,
+                    time_ms        INTEGER NOT NULL,
+                    nonce          INTEGER NOT NULL,
+                    created_at_ms  INTEGER NOT NULL,
+                    UNIQUE (from_login, time_ms, nonce)
+                );
+                """);
+
+            st.executeUpdate("""
+                CREATE INDEX IF NOT EXISTS idx_signed_dm_replay_created
+                ON signed_direct_message_replay (created_at_ms);
+                """);
+
+            // 12) signed_direct_messages_history (сырой бинарный пакет + мета)
+            st.executeUpdate("""
+                CREATE TABLE IF NOT EXISTS signed_direct_messages_history (
+                    message_id         TEXT    NOT NULL PRIMARY KEY,
+                    from_login         TEXT    NOT NULL,
+                    to_login           TEXT    NOT NULL,
+                    target_mode        INTEGER NOT NULL,
+                    target_session_id  TEXT,
+                    message_type       INTEGER NOT NULL,
+                    time_ms            INTEGER NOT NULL,
+                    nonce              INTEGER NOT NULL,
+                    raw_packet         BLOB    NOT NULL,
+                    created_at_ms      INTEGER NOT NULL,
+                    FOREIGN KEY (from_login) REFERENCES solana_users(login),
+                    FOREIGN KEY (to_login) REFERENCES solana_users(login)
+                );
+                """);
+
+            st.executeUpdate("""
+                CREATE INDEX IF NOT EXISTS idx_signed_dm_history_to
+                ON signed_direct_messages_history (to_login, created_at_ms);
+                """);
+
             DatabaseTriggersInstaller.createAllTriggers(st);
         }
     }
diff --git a/shine-server-db/src/main/java/shine/db/dao/ActiveSessionsDAO.java b/shine-server-db/src/main/java/shine/db/dao/ActiveSessionsDAO.java
index 46ac9b9..9495f80 100644
--- a/shine-server-db/src/main/java/shine/db/dao/ActiveSessionsDAO.java
+++ b/shine-server-db/src/main/java/shine/db/dao/ActiveSessionsDAO.java
@@ -217,6 +217,25 @@ public final class ActiveSessionsDAO {
         }
     }
 
+    public void updatePushSubscription(String sessionId, String endpoint, String p256dhKey, String authKey) throws SQLException {
+        try (Connection c = db.getConnection()) {
+            String sql = """
+                UPDATE active_sessions
+                SET push_endpoint = ?,
+                    push_p256dh_key = ?,
+                    push_auth_key = ?
+                WHERE session_id = ?
+                """;
+            try (PreparedStatement ps = c.prepareStatement(sql)) {
+                ps.setString(1, endpoint);
+                ps.setString(2, p256dhKey);
+                ps.setString(3, authKey);
+                ps.setString(4, sessionId);
+                ps.executeUpdate();
+            }
+        }
+    }
+
     // -------------------- DELETE --------------------
 
     public void deleteBySessionId(Connection c, String sessionId) throws SQLException {
diff --git a/shine-server-db/src/main/java/shine/db/dao/SignedDirectMessagesHistoryDAO.java b/shine-server-db/src/main/java/shine/db/dao/SignedDirectMessagesHistoryDAO.java
new file mode 100644
index 0000000..6cea224
--- /dev/null
+++ b/shine-server-db/src/main/java/shine/db/dao/SignedDirectMessagesHistoryDAO.java
@@ -0,0 +1,47 @@
+package shine.db.dao;
+
+import shine.db.SqliteDbController;
+import shine.db.entities.SignedDirectMessageHistoryEntry;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+
+public final class SignedDirectMessagesHistoryDAO {
+    private static volatile SignedDirectMessagesHistoryDAO instance;
+    private final SqliteDbController db = SqliteDbController.getInstance();
+
+    private SignedDirectMessagesHistoryDAO() {}
+
+    public static SignedDirectMessagesHistoryDAO getInstance() {
+        if (instance == null) {
+            synchronized (SignedDirectMessagesHistoryDAO.class) {
+                if (instance == null) instance = new SignedDirectMessagesHistoryDAO();
+            }
+        }
+        return instance;
+    }
+
+    public void insert(SignedDirectMessageHistoryEntry e) throws Exception {
+        try (Connection c = db.getConnection()) {
+            String sql = """
+                INSERT INTO signed_direct_messages_history (
+                    message_id, from_login, to_login, target_mode, target_session_id,
+                    message_type, time_ms, nonce, raw_packet, created_at_ms
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                """;
+            try (PreparedStatement ps = c.prepareStatement(sql)) {
+                ps.setString(1, e.getMessageId());
+                ps.setString(2, e.getFromLogin());
+                ps.setString(3, e.getToLogin());
+                ps.setInt(4, e.getTargetMode());
+                ps.setString(5, e.getTargetSessionId());
+                ps.setInt(6, e.getMessageType());
+                ps.setLong(7, e.getTimeMs());
+                ps.setLong(8, e.getNonce());
+                ps.setBytes(9, e.getRawPacket());
+                ps.setLong(10, e.getCreatedAtMs());
+                ps.executeUpdate();
+            }
+        }
+    }
+}
diff --git a/shine-server-db/src/main/java/shine/db/dao/SignedDmReplayDAO.java b/shine-server-db/src/main/java/shine/db/dao/SignedDmReplayDAO.java
new file mode 100644
index 0000000..3144dff
--- /dev/null
+++ b/shine-server-db/src/main/java/shine/db/dao/SignedDmReplayDAO.java
@@ -0,0 +1,50 @@
+package shine.db.dao;
+
+import shine.db.SqliteDbController;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+
+public final class SignedDmReplayDAO {
+    private static volatile SignedDmReplayDAO instance;
+    private final SqliteDbController db = SqliteDbController.getInstance();
+
+    private SignedDmReplayDAO() {}
+
+    public static SignedDmReplayDAO getInstance() {
+        if (instance == null) {
+            synchronized (SignedDmReplayDAO.class) {
+                if (instance == null) instance = new SignedDmReplayDAO();
+            }
+        }
+        return instance;
+    }
+
+    public boolean registerUnique(String fromLogin, long timeMs, long nonce, long nowMs) throws Exception {
+        cleanupExpired(nowMs - 15L * 60L * 1000L);
+        try (Connection c = db.getConnection()) {
+            String sql = """
+                INSERT OR IGNORE INTO signed_direct_message_replay (
+                    from_login, time_ms, nonce, created_at_ms
+                ) VALUES (?, ?, ?, ?)
+                """;
+            try (PreparedStatement ps = c.prepareStatement(sql)) {
+                ps.setString(1, fromLogin);
+                ps.setLong(2, timeMs);
+                ps.setLong(3, nonce);
+                ps.setLong(4, nowMs);
+                return ps.executeUpdate() > 0;
+            }
+        }
+    }
+
+    public void cleanupExpired(long minCreatedAtMs) throws Exception {
+        try (Connection c = db.getConnection()) {
+            String sql = "DELETE FROM signed_direct_message_replay WHERE created_at_ms < ?";
+            try (PreparedStatement ps = c.prepareStatement(sql)) {
+                ps.setLong(1, minCreatedAtMs);
+                ps.executeUpdate();
+            }
+        }
+    }
+}
diff --git a/shine-server-db/src/main/java/shine/db/entities/SignedDirectMessageHistoryEntry.java b/shine-server-db/src/main/java/shine/db/entities/SignedDirectMessageHistoryEntry.java
new file mode 100644
index 0000000..ca069f9
--- /dev/null
+++ b/shine-server-db/src/main/java/shine/db/entities/SignedDirectMessageHistoryEntry.java
@@ -0,0 +1,35 @@
+package shine.db.entities;
+
+public class SignedDirectMessageHistoryEntry {
+    private String messageId;
+    private String fromLogin;
+    private String toLogin;
+    private int targetMode;
+    private String targetSessionId;
+    private int messageType;
+    private long timeMs;
+    private long nonce;
+    private byte[] rawPacket;
+    private long createdAtMs;
+
+    public String getMessageId() { return messageId; }
+    public void setMessageId(String messageId) { this.messageId = messageId; }
+    public String getFromLogin() { return fromLogin; }
+    public void setFromLogin(String fromLogin) { this.fromLogin = fromLogin; }
+    public String getToLogin() { return toLogin; }
+    public void setToLogin(String toLogin) { this.toLogin = toLogin; }
+    public int getTargetMode() { return targetMode; }
+    public void setTargetMode(int targetMode) { this.targetMode = targetMode; }
+    public String getTargetSessionId() { return targetSessionId; }
+    public void setTargetSessionId(String targetSessionId) { this.targetSessionId = targetSessionId; }
+    public int getMessageType() { return messageType; }
+    public void setMessageType(int messageType) { this.messageType = messageType; }
+    public long getTimeMs() { return timeMs; }
+    public void setTimeMs(long timeMs) { this.timeMs = timeMs; }
+    public long getNonce() { return nonce; }
+    public void setNonce(long nonce) { this.nonce = nonce; }
+    public byte[] getRawPacket() { return rawPacket; }
+    public void setRawPacket(byte[] rawPacket) { this.rawPacket = rawPacket; }
+    public long getCreatedAtMs() { return createdAtMs; }
+    public void setCreatedAtMs(long createdAtMs) { this.createdAtMs = createdAtMs; }
+}
diff --git a/shine-server-net-protocol/build.gradle b/shine-server-net-protocol/build.gradle
index 6038c67..838da9b 100644
--- a/shine-server-net-protocol/build.gradle
+++ b/shine-server-net-protocol/build.gradle
@@ -23,6 +23,7 @@ dependencies {
     implementation 'com.fasterxml.jackson.core:jackson-databind:2.17.1'  // json
 
     implementation "org.slf4j:slf4j-api:2.0.16"          // вызов логгера
+    implementation 'nl.martijndwars:web-push:5.1.1'
 
     implementation project(':shine-server-config')       // модуль с настройками
     implementation project(":shine-server-log")          // модуль логирования и уведомления админов
@@ -40,4 +41,3 @@ java {
     targetCompatibility = JavaVersion.VERSION_17
 }
 
-
diff --git a/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/Net_SendDirectMessage_Handler.java b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/Net_SendDirectMessage_Handler.java
index 7b021a3..39af2a0 100644
--- a/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/Net_SendDirectMessage_Handler.java
+++ b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/Net_SendDirectMessage_Handler.java
@@ -9,18 +9,24 @@ import server.logic.ws_protocol.JSON.entyties.Net_Response;
 import server.logic.ws_protocol.JSON.handlers.JsonMessageHandler;
 import server.logic.ws_protocol.JSON.messages.entyties.Net_SendDirectMessage_Request;
 import server.logic.ws_protocol.JSON.messages.entyties.Net_SendDirectMessage_Response;
-import server.logic.ws_protocol.JSON.push.FcmPushSender;
+import server.logic.ws_protocol.JSON.push.WebPushSender;
 import server.logic.ws_protocol.JSON.push.WsEventSender;
 import server.logic.ws_protocol.JSON.utils.NetExceptionResponseFactory;
 import server.logic.ws_protocol.JSON.utils.NetIdGenerator;
 import server.logic.ws_protocol.WireCodes;
+import shine.db.dao.ActiveSessionsDAO;
 import shine.db.dao.DirectMessagesDAO;
-import shine.db.dao.PushTokensDAO;
+import shine.db.dao.SignedDirectMessagesHistoryDAO;
+import shine.db.dao.SignedDmReplayDAO;
 import shine.db.dao.SolanaUsersDAO;
+import shine.db.entities.ActiveSessionEntry;
 import shine.db.entities.DirectMessageEntry;
-import shine.db.entities.PushTokenEntry;
+import shine.db.entities.SignedDirectMessageHistoryEntry;
 import shine.db.entities.SolanaUserEntry;
+import utils.crypto.Ed25519Util;
 
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
@@ -29,102 +35,174 @@ import java.util.concurrent.TimeUnit;
 
 public class Net_SendDirectMessage_Handler implements JsonMessageHandler {
     private static final ObjectMapper MAPPER = new ObjectMapper();
+    private static final long REPLAY_TTL_MS = 15L * 60L * 1000L;
+    private static final int MAX_MESSAGE_BYTES = 3000;
 
     @Override
     public Net_Response handle(Net_Request baseRequest, ConnectionContext ctx) throws Exception {
         Net_SendDirectMessage_Request req = (Net_SendDirectMessage_Request) baseRequest;
-        if (ctx == null || !ctx.isAuthenticatedUser()) {
-            return NetExceptionResponseFactory.error(req, WireCodes.Status.UNVERIFIED, "NOT_AUTHENTICATED", "Требуется авторизация");
-        }
-        if (req.getToLogin() == null || req.getToLogin().isBlank() || req.getText() == null || req.getText().isBlank()) {
-            return NetExceptionResponseFactory.error(req, WireCodes.Status.BAD_REQUEST, "BAD_FIELDS", "toLogin и text обязательны");
+        if (req.getBlobB64() == null || req.getBlobB64().isBlank()) {
+            return NetExceptionResponseFactory.error(req, WireCodes.Status.BAD_REQUEST, "BAD_FIELDS", "blobB64 обязателен");
         }
 
-        String from = ctx.getLogin();
-        String toRequest = req.getToLogin().trim();
-        String text = req.getText().trim();
-
-        SolanaUserEntry targetUser = SolanaUsersDAO.getInstance().getByLogin(toRequest);
-        if (targetUser == null) {
-            return NetExceptionResponseFactory.error(req, 404, "USER_NOT_FOUND", "Пользователь не найден");
+        final byte[] raw;
+        final SignedDirectMessagePacket packet;
+        try {
+            raw = Base64.getDecoder().decode(req.getBlobB64().trim());
+            packet = SignedDirectMessagePacket.parse(raw, MAX_MESSAGE_BYTES);
+        } catch (IllegalArgumentException ex) {
+            return NetExceptionResponseFactory.error(req, WireCodes.Status.BAD_REQUEST, ex.getMessage(), "Некорректный формат пакета");
         }
-        String to = targetUser.getLogin();
 
-        if (!canSend(from, to)) {
-            return NetExceptionResponseFactory.error(req, WireCodes.Status.UNVERIFIED, "NO_PERMISSION", "Можно писать только контактам или тем, кто уже писал вам");
+        SolanaUserEntry fromUser = SolanaUsersDAO.getInstance().getByLogin(packet.fromLogin);
+        SolanaUserEntry toUser = SolanaUsersDAO.getInstance().getByLogin(packet.toLogin);
+        if (fromUser == null || toUser == null) {
+            return NetExceptionResponseFactory.error(req, 404, "USER_NOT_FOUND", "from/to пользователь не найден");
+        }
+
+        byte[] publicKey32;
+        try {
+            publicKey32 = Ed25519Util.keyFromBase64(fromUser.getDeviceKey());
+        } catch (Exception e) {
+            return NetExceptionResponseFactory.error(req, WireCodes.Status.UNPROCESSABLE, "BAD_DEVICE_KEY", "Некорректный deviceKey отправителя");
+        }
+        if (!Ed25519Util.verify(packet.signedBody, packet.signature64, publicKey32)) {
+            return NetExceptionResponseFactory.error(req, WireCodes.Status.UNPROCESSABLE, "BAD_SIGNATURE", "Подпись не прошла проверку");
+        }
+
+        long now = System.currentTimeMillis();
+        if (Math.abs(now - packet.timeMs) > REPLAY_TTL_MS) {
+            return NetExceptionResponseFactory.error(req, WireCodes.Status.UNPROCESSABLE, "BAD_TIME_WINDOW", "Время сообщения вышло за окно 15 минут");
+        }
+
+        boolean replayOk = SignedDmReplayDAO.getInstance().registerUnique(packet.fromLogin, packet.timeMs, packet.nonce, now);
+        if (!replayOk) {
+            return NetExceptionResponseFactory.error(req, WireCodes.Status.UNPROCESSABLE, "REPLAY", "Повторное сообщение заблокировано");
         }
 
         String messageId = NetIdGenerator.eventId("msg");
+        String textForUi = new String(packet.messageBytes, StandardCharsets.UTF_8);
+
         DirectMessageEntry entry = new DirectMessageEntry();
         entry.setMessageId(messageId);
-        entry.setFromLogin(from);
-        entry.setToLogin(to);
-        entry.setText(text);
-        entry.setCreatedAtMs(System.currentTimeMillis());
+        entry.setFromLogin(packet.fromLogin);
+        entry.setToLogin(packet.toLogin);
+        entry.setText(textForUi);
+        entry.setCreatedAtMs(now);
         DirectMessagesDAO.getInstance().insert(entry);
 
-        Set<ConnectionContext> activeSessions = ActiveConnectionsRegistry.getInstance().getByLogin(to);
-        List<PushTokenEntry> tokens = PushTokensDAO.getInstance().listByLogin(to);
+        SignedDirectMessageHistoryEntry history = new SignedDirectMessageHistoryEntry();
+        history.setMessageId(messageId);
+        history.setFromLogin(packet.fromLogin);
+        history.setToLogin(packet.toLogin);
+        history.setTargetMode(packet.targetMode);
+        history.setTargetSessionId(packet.targetSessionId);
+        history.setMessageType(packet.messageType);
+        history.setTimeMs(packet.timeMs);
+        history.setNonce(packet.nonce);
+        history.setRawPacket(packet.rawPacket);
+        history.setCreatedAtMs(now);
+        SignedDirectMessagesHistoryDAO.getInstance().insert(history);
 
-        int wsDelivered = 0;
-        int fcmDelivered = 0;
-
-        Set<String> activeSessionIds = new HashSet<>();
-        for (ConnectionContext targetCtx : activeSessions) {
-            activeSessionIds.add(targetCtx.getSessionId());
-            String eventId = NetIdGenerator.eventId("evt");
-            CompletableFuture<Boolean> waiter = DeliveryTracker.getInstance().register(eventId);
-
-            ObjectNode payload = MAPPER.createObjectNode();
-            payload.put("eventId", eventId);
-            payload.put("messageId", messageId);
-            payload.put("fromLogin", from);
-            payload.put("toLogin", to);
-            payload.put("text", text);
-            payload.put("timeMs", entry.getCreatedAtMs());
-
-            boolean sent = WsEventSender.sendEvent(targetCtx, "IncomingDirectMessage", eventId, payload);
-            boolean acked = false;
-            if (sent) {
-                try {
-                    acked = waiter.get(1200, TimeUnit.MILLISECONDS);
-                } catch (Exception ignored) {
-                    acked = false;
-                }
-            }
-            DeliveryTracker.getInstance().remove(eventId);
-            if (acked) {
-                wsDelivered++;
-                continue;
-            }
-
-            for (PushTokenEntry token : tokens) {
-                if (!targetCtx.getSessionId().equals(token.getSessionId())) continue;
-                boolean pushed = FcmPushSender.sendNotification(token.getToken(), "Новое сообщение", text, messageId);
-                if (pushed) {
-                    fcmDelivered++;
-                    break;
-                }
-            }
-        }
-
-        for (PushTokenEntry token : tokens) {
-            if (activeSessionIds.contains(token.getSessionId())) continue;
-            boolean pushed = FcmPushSender.sendNotification(token.getToken(), "Новое сообщение", text, messageId);
-            if (pushed) fcmDelivered++;
-        }
+        DeliveryResult delivery = deliver(packet, req.getBlobB64().trim(), messageId, now);
 
         Net_SendDirectMessage_Response resp = new Net_SendDirectMessage_Response();
         resp.setOp(req.getOp());
         resp.setRequestId(req.getRequestId());
         resp.setStatus(WireCodes.Status.OK);
         resp.setMessageId(messageId);
-        resp.setDeliveredWsSessions(wsDelivered);
-        resp.setDeliveredFcmSessions(fcmDelivered);
+        resp.setDeliveredWsSessions(delivery.wsDelivered);
+        resp.setDeliveredWebPushSessions(delivery.webPushDelivered);
+        resp.setSessionNotFound(delivery.sessionNotFound);
         return resp;
     }
 
-    private boolean canSend(String from, String to) {
-        return from != null && !from.isBlank() && to != null && !to.isBlank();
+    private DeliveryResult deliver(SignedDirectMessagePacket packet, String blobB64, String messageId, long createdAtMs) throws Exception {
+        DeliveryResult result = new DeliveryResult();
+
+        Set<String> selectedSessionIds = new HashSet<>();
+        if (packet.targetMode == SignedDirectMessagePacket.TARGET_ONE_SESSION) {
+            ActiveSessionEntry byId = ActiveSessionsDAO.getInstance().getBySessionId(packet.targetSessionId);
+            if (byId == null || !packet.toLogin.equalsIgnoreCase(byId.getLogin())) {
+                result.sessionNotFound = true;
+                return result;
+            }
+            selectedSessionIds.add(byId.getSessionId());
+            deliverToSession(packet, blobB64, messageId, createdAtMs, byId.getSessionId(), result);
+            return result;
+        }
+
+        List<ActiveSessionEntry> sessions = ActiveSessionsDAO.getInstance().getByLogin(packet.toLogin);
+        for (ActiveSessionEntry s : sessions) {
+            selectedSessionIds.add(s.getSessionId());
+            deliverToSession(packet, blobB64, messageId, createdAtMs, s.getSessionId(), result);
+        }
+        return result;
+    }
+
+    private void deliverToSession(
+            SignedDirectMessagePacket packet,
+            String blobB64,
+            String messageId,
+            long createdAtMs,
+            String sessionId,
+            DeliveryResult result
+    ) {
+        ConnectionContext targetCtx = ActiveConnectionsRegistry.getInstance().getBySessionId(sessionId);
+        boolean wsDelivered = false;
+        if (targetCtx != null) {
+            String eventId = NetIdGenerator.eventId("evt");
+            CompletableFuture<Boolean> waiter = DeliveryTracker.getInstance().register(eventId);
+            ObjectNode payload = MAPPER.createObjectNode();
+            payload.put("eventId", eventId);
+            payload.put("messageId", messageId);
+            payload.put("fromLogin", packet.fromLogin);
+            payload.put("toLogin", packet.toLogin);
+            payload.put("blobB64", blobB64);
+            payload.put("text", new String(packet.messageBytes, StandardCharsets.UTF_8));
+            payload.put("timeMs", createdAtMs);
+
+            boolean sent = WsEventSender.sendEvent(targetCtx, "IncomingDirectMessage", eventId, payload);
+            if (sent) {
+                try {
+                    wsDelivered = waiter.get(1200, TimeUnit.MILLISECONDS);
+                } catch (Exception ignored) {
+                    wsDelivered = false;
+                }
+            }
+            DeliveryTracker.getInstance().remove(eventId);
+        }
+
+        if (wsDelivered) {
+            result.wsDelivered++;
+            return;
+        }
+
+        try {
+            ActiveSessionEntry targetSession = ActiveSessionsDAO.getInstance().getBySessionId(sessionId);
+            if (targetSession == null) return;
+            if (isBlank(targetSession.getPushEndpoint()) || isBlank(targetSession.getPushP256dhKey()) || isBlank(targetSession.getPushAuthKey())) {
+                return;
+            }
+            boolean pushed = WebPushSender.sendBase64Payload(
+                    targetSession.getPushEndpoint(),
+                    targetSession.getPushP256dhKey(),
+                    targetSession.getPushAuthKey(),
+                    blobB64
+            );
+            if (pushed) result.webPushDelivered++;
+        } catch (Exception ignored) {
+            // ignore per-session push errors
+        }
+    }
+
+    private boolean isBlank(String s) {
+        return s == null || s.isBlank();
+    }
+
+    private static final class DeliveryResult {
+        int wsDelivered;
+        int webPushDelivered;
+        boolean sessionNotFound;
     }
 }
diff --git a/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/Net_UpsertPushToken_Handler.java b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/Net_UpsertPushToken_Handler.java
index 7fefe7a..6514be3 100644
--- a/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/Net_UpsertPushToken_Handler.java
+++ b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/Net_UpsertPushToken_Handler.java
@@ -8,8 +8,7 @@ import server.logic.ws_protocol.JSON.messages.entyties.Net_UpsertPushToken_Reque
 import server.logic.ws_protocol.JSON.messages.entyties.Net_UpsertPushToken_Response;
 import server.logic.ws_protocol.JSON.utils.NetExceptionResponseFactory;
 import server.logic.ws_protocol.WireCodes;
-import shine.db.dao.PushTokensDAO;
-import shine.db.entities.PushTokenEntry;
+import shine.db.dao.ActiveSessionsDAO;
 
 public class Net_UpsertPushToken_Handler implements JsonMessageHandler {
     @Override
@@ -18,27 +17,27 @@ public class Net_UpsertPushToken_Handler implements JsonMessageHandler {
         if (ctx == null || !ctx.isAuthenticatedUser()) {
             return NetExceptionResponseFactory.error(req, WireCodes.Status.UNVERIFIED, "NOT_AUTHENTICATED", "Требуется авторизация");
         }
-        if (req.getTokenId() == null || req.getTokenId().isBlank() || req.getToken() == null || req.getToken().isBlank()) {
-            return NetExceptionResponseFactory.error(req, WireCodes.Status.BAD_REQUEST, "BAD_FIELDS", "tokenId и token обязательны");
+        if (req.getEndpoint() == null || req.getEndpoint().isBlank()
+                || req.getP256dhKey() == null || req.getP256dhKey().isBlank()
+                || req.getAuthKey() == null || req.getAuthKey().isBlank()) {
+            return NetExceptionResponseFactory.error(req, WireCodes.Status.BAD_REQUEST, "BAD_FIELDS", "endpoint/p256dhKey/authKey обязательны");
         }
 
-        PushTokenEntry e = new PushTokenEntry();
-        e.setTokenId(req.getTokenId().trim());
-        e.setLogin(ctx.getLogin());
-        e.setSessionId((req.getSessionId() == null || req.getSessionId().isBlank()) ? ctx.getSessionId() : req.getSessionId().trim());
-        e.setProvider(req.getProvider() == null || req.getProvider().isBlank() ? "fcm" : req.getProvider().trim());
-        e.setToken(req.getToken().trim());
-        e.setPlatform(req.getPlatform());
-        e.setUserAgent(req.getUserAgent());
-        e.setUpdatedAtMs(System.currentTimeMillis());
-        PushTokensDAO.getInstance().upsert(e);
+        String sessionId = (req.getSessionId() == null || req.getSessionId().isBlank()) ? ctx.getSessionId() : req.getSessionId().trim();
+        long now = System.currentTimeMillis();
+        ActiveSessionsDAO.getInstance().updatePushSubscription(
+                sessionId,
+                req.getEndpoint().trim(),
+                req.getP256dhKey().trim(),
+                req.getAuthKey().trim()
+        );
 
         Net_UpsertPushToken_Response resp = new Net_UpsertPushToken_Response();
         resp.setOp(req.getOp());
         resp.setRequestId(req.getRequestId());
         resp.setStatus(WireCodes.Status.OK);
-        resp.setTokenId(e.getTokenId());
-        resp.setUpdatedAtMs(e.getUpdatedAtMs());
+        resp.setTokenId(sessionId);
+        resp.setUpdatedAtMs(now);
         return resp;
     }
 }
diff --git a/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/SignedDirectMessagePacket.java b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/SignedDirectMessagePacket.java
new file mode 100644
index 0000000..8b8d2a5
--- /dev/null
+++ b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/SignedDirectMessagePacket.java
@@ -0,0 +1,134 @@
+package server.logic.ws_protocol.JSON.messages;
+
+import java.nio.ByteBuffer;
+import java.nio.ByteOrder;
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
+
+final class SignedDirectMessagePacket {
+    static final byte[] PREFIX = "SHiNE_msg".getBytes(StandardCharsets.US_ASCII);
+    static final int VERSION = 1;
+    static final int MESSAGE_TYPE_DIRECT = 1;
+    static final int TARGET_ALL_SESSIONS = 0;
+    static final int TARGET_ONE_SESSION = 1;
+
+    final int version;
+    final String toLogin;
+    final String fromLogin;
+    final long timeMs;
+    final long nonce;
+    final int messageType;
+    final int targetMode;
+    final String targetSessionId;
+    final byte[] messageBytes;
+    final byte[] signedBody;
+    final byte[] signature64;
+    final byte[] rawPacket;
+
+    private SignedDirectMessagePacket(
+            int version,
+            String toLogin,
+            String fromLogin,
+            long timeMs,
+            long nonce,
+            int messageType,
+            int targetMode,
+            String targetSessionId,
+            byte[] messageBytes,
+            byte[] signedBody,
+            byte[] signature64,
+            byte[] rawPacket
+    ) {
+        this.version = version;
+        this.toLogin = toLogin;
+        this.fromLogin = fromLogin;
+        this.timeMs = timeMs;
+        this.nonce = nonce;
+        this.messageType = messageType;
+        this.targetMode = targetMode;
+        this.targetSessionId = targetSessionId;
+        this.messageBytes = messageBytes;
+        this.signedBody = signedBody;
+        this.signature64 = signature64;
+        this.rawPacket = rawPacket;
+    }
+
+    static SignedDirectMessagePacket parse(byte[] raw, int maxMessageBytes) {
+        if (raw == null || raw.length < PREFIX.length + 1 + 1 + 1 + 8 + 4 + 2 + 1 + 2 + 64) {
+            throw new IllegalArgumentException("BAD_LEN");
+        }
+        if (raw.length > 4096) {
+            throw new IllegalArgumentException("PAYLOAD_TOO_LARGE");
+        }
+
+        ByteBuffer bb = ByteBuffer.wrap(raw).order(ByteOrder.BIG_ENDIAN);
+        byte[] prefixBytes = new byte[PREFIX.length];
+        bb.get(prefixBytes);
+        if (!Arrays.equals(prefixBytes, PREFIX)) {
+            throw new IllegalArgumentException("BAD_PREFIX");
+        }
+
+        int version = Byte.toUnsignedInt(bb.get());
+        if (version != VERSION) {
+            throw new IllegalArgumentException("BAD_VERSION");
+        }
+
+        String toLogin = readAscii(bb, 1, 30, "BAD_TO_LOGIN");
+        String fromLogin = readAscii(bb, 1, 30, "BAD_FROM_LOGIN");
+
+        long timeMs = bb.getLong();
+        if (timeMs < 0) throw new IllegalArgumentException("BAD_TIME");
+
+        long nonce = Integer.toUnsignedLong(bb.getInt());
+
+        int messageType = Short.toUnsignedInt(bb.getShort());
+        if (messageType != MESSAGE_TYPE_DIRECT) {
+            throw new IllegalArgumentException("BAD_MESSAGE_TYPE");
+        }
+
+        int targetMode = Byte.toUnsignedInt(bb.get());
+        if (targetMode != TARGET_ALL_SESSIONS && targetMode != TARGET_ONE_SESSION) {
+            throw new IllegalArgumentException("BAD_TARGET_MODE");
+        }
+
+        String targetSessionId = null;
+        if (targetMode == TARGET_ONE_SESSION) {
+            targetSessionId = readAscii(bb, 1, 255, "BAD_SESSION_ID");
+        }
+
+        int msgLen = Short.toUnsignedInt(bb.getShort());
+        if (msgLen < 1 || msgLen > maxMessageBytes) {
+            throw new IllegalArgumentException("BAD_MESSAGE_LEN");
+        }
+        if (bb.remaining() != msgLen + 64) {
+            throw new IllegalArgumentException("BAD_LEN");
+        }
+
+        byte[] messageBytes = new byte[msgLen];
+        bb.get(messageBytes);
+
+        byte[] signature64 = new byte[64];
+        bb.get(signature64);
+
+        byte[] signedBody = Arrays.copyOf(raw, raw.length - 64);
+
+        return new SignedDirectMessagePacket(
+                version, toLogin, fromLogin, timeMs, nonce, messageType, targetMode,
+                targetSessionId, messageBytes, signedBody, signature64, raw
+        );
+    }
+
+    private static String readAscii(ByteBuffer bb, int minLen, int maxLen, String code) {
+        if (!bb.hasRemaining()) throw new IllegalArgumentException(code);
+        int len = Byte.toUnsignedInt(bb.get());
+        if (len < minLen || len > maxLen || bb.remaining() < len) {
+            throw new IllegalArgumentException(code);
+        }
+        byte[] bytes = new byte[len];
+        bb.get(bytes);
+        for (byte b : bytes) {
+            if (b < 0x20 || b > 0x7E) throw new IllegalArgumentException(code);
+        }
+        return new String(bytes, StandardCharsets.US_ASCII);
+    }
+}
diff --git a/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/entyties/Net_SendDirectMessage_Request.java b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/entyties/Net_SendDirectMessage_Request.java
index 45dda9c..cf52bc9 100644
--- a/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/entyties/Net_SendDirectMessage_Request.java
+++ b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/entyties/Net_SendDirectMessage_Request.java
@@ -3,11 +3,8 @@ package server.logic.ws_protocol.JSON.messages.entyties;
 import server.logic.ws_protocol.JSON.entyties.Net_Request;
 
 public class Net_SendDirectMessage_Request extends Net_Request {
-    private String toLogin;
-    private String text;
+    private String blobB64;
 
-    public String getToLogin() { return toLogin; }
-    public void setToLogin(String toLogin) { this.toLogin = toLogin; }
-    public String getText() { return text; }
-    public void setText(String text) { this.text = text; }
+    public String getBlobB64() { return blobB64; }
+    public void setBlobB64(String blobB64) { this.blobB64 = blobB64; }
 }
diff --git a/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/entyties/Net_SendDirectMessage_Response.java b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/entyties/Net_SendDirectMessage_Response.java
index bc83bc4..8833737 100644
--- a/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/entyties/Net_SendDirectMessage_Response.java
+++ b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/entyties/Net_SendDirectMessage_Response.java
@@ -5,12 +5,15 @@ import server.logic.ws_protocol.JSON.entyties.Net_Response;
 public class Net_SendDirectMessage_Response extends Net_Response {
     private String messageId;
     private int deliveredWsSessions;
-    private int deliveredFcmSessions;
+    private int deliveredWebPushSessions;
+    private boolean sessionNotFound;
 
     public String getMessageId() { return messageId; }
     public void setMessageId(String messageId) { this.messageId = messageId; }
     public int getDeliveredWsSessions() { return deliveredWsSessions; }
     public void setDeliveredWsSessions(int deliveredWsSessions) { this.deliveredWsSessions = deliveredWsSessions; }
-    public int getDeliveredFcmSessions() { return deliveredFcmSessions; }
-    public void setDeliveredFcmSessions(int deliveredFcmSessions) { this.deliveredFcmSessions = deliveredFcmSessions; }
+    public int getDeliveredWebPushSessions() { return deliveredWebPushSessions; }
+    public void setDeliveredWebPushSessions(int deliveredWebPushSessions) { this.deliveredWebPushSessions = deliveredWebPushSessions; }
+    public boolean isSessionNotFound() { return sessionNotFound; }
+    public void setSessionNotFound(boolean sessionNotFound) { this.sessionNotFound = sessionNotFound; }
 }
diff --git a/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/entyties/Net_UpsertPushToken_Request.java b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/entyties/Net_UpsertPushToken_Request.java
index 9e87e88..ae8541b 100644
--- a/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/entyties/Net_UpsertPushToken_Request.java
+++ b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/messages/entyties/Net_UpsertPushToken_Request.java
@@ -3,21 +3,21 @@ package server.logic.ws_protocol.JSON.messages.entyties;
 import server.logic.ws_protocol.JSON.entyties.Net_Request;
 
 public class Net_UpsertPushToken_Request extends Net_Request {
-    private String tokenId;
     private String sessionId;
-    private String provider;
-    private String token;
+    private String endpoint;
+    private String p256dhKey;
+    private String authKey;
     private String platform;
     private String userAgent;
 
-    public String getTokenId() { return tokenId; }
-    public void setTokenId(String tokenId) { this.tokenId = tokenId; }
     public String getSessionId() { return sessionId; }
     public void setSessionId(String sessionId) { this.sessionId = sessionId; }
-    public String getProvider() { return provider; }
-    public void setProvider(String provider) { this.provider = provider; }
-    public String getToken() { return token; }
-    public void setToken(String token) { this.token = token; }
+    public String getEndpoint() { return endpoint; }
+    public void setEndpoint(String endpoint) { this.endpoint = endpoint; }
+    public String getP256dhKey() { return p256dhKey; }
+    public void setP256dhKey(String p256dhKey) { this.p256dhKey = p256dhKey; }
+    public String getAuthKey() { return authKey; }
+    public void setAuthKey(String authKey) { this.authKey = authKey; }
     public String getPlatform() { return platform; }
     public void setPlatform(String platform) { this.platform = platform; }
     public String getUserAgent() { return userAgent; }
diff --git a/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/push/WebPushSender.java b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/push/WebPushSender.java
new file mode 100644
index 0000000..b9948a6
--- /dev/null
+++ b/shine-server-net-protocol/src/main/java/server/logic/ws_protocol/JSON/push/WebPushSender.java
@@ -0,0 +1,57 @@
+package server.logic.ws_protocol.JSON.push;
+
+import nl.martijndwars.webpush.Notification;
+import nl.martijndwars.webpush.PushService;
+import nl.martijndwars.webpush.Subscription;
+import org.jose4j.lang.JoseException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import utils.config.AppConfig;
+
+import java.nio.charset.StandardCharsets;
+import java.security.GeneralSecurityException;
+import java.security.NoSuchAlgorithmException;
+import java.util.Base64;
+
+public final class WebPushSender {
+    private static final Logger log = LoggerFactory.getLogger(WebPushSender.class);
+    private static volatile PushService service;
+
+    private WebPushSender() {}
+
+    private static PushService service() throws GeneralSecurityException, JoseException {
+        if (service != null) return service;
+        synchronized (WebPushSender.class) {
+            if (service != null) return service;
+            AppConfig cfg = AppConfig.getInstance();
+            String pub = cfg.getStringOrEmpty("webpush.vapid.public");
+            String priv = cfg.getStringOrEmpty("webpush.vapid.private");
+            String subject = cfg.getStringOrEmpty("webpush.vapid.subject");
+            if (pub.isBlank() || priv.isBlank() || subject.isBlank()) {
+                throw new IllegalStateException("webpush.vapid.* is not configured");
+            }
+            service = new PushService(pub, priv, subject);
+            return service;
+        }
+    }
+
+    public static boolean sendBase64Payload(String endpoint, String p256dhKey, String authKey, String payloadB64) {
+        try {
+            Subscription subscription = new Subscription(
+                    endpoint,
+                    new Subscription.Keys(p256dhKey, authKey)
+            );
+            byte[] payloadBytes = Base64.getDecoder().decode(payloadB64);
+            Notification notification = new Notification(subscription, payloadBytes);
+            var response = service().send(notification);
+            int code = response.getStatusLine().getStatusCode();
+            return code >= 200 && code < 300;
+        } catch (NoSuchAlgorithmException e) {
+            log.warn("WebPush crypto unsupported", e);
+            return false;
+        } catch (Exception e) {
+            log.warn("WebPush send failed: {}", e.getMessage());
+            return false;
+        }
+    }
+}
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 6492c61..b506d29 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -13,5 +13,7 @@ server.info.description=
 server.info.origin=
 server.info.extraInfo=
 
-# FCM (legacy HTTP)
-fcm.server.key=
+# Web Push (VAPID)
+webpush.vapid.public=
+webpush.vapid.private=
+webpush.vapid.subject=mailto:admin@shine.local