From 3b8fdf207271b7907fb37f5d37f75cca0ebda384 Mon Sep 17 00:00:00 2001
From: Florian <45694132+flo-bit@users.noreply.github.com>
Date: Sat, 23 May 2026 22:08:51 +0200
Subject: [PATCH] commit

---
 apps/example-sender/package.json              | 107 ++++++-------
 apps/example-sender/src/lib/server/relay.ts   |   3 +
 .../src/lib/server/subscribers.ts             |  19 +++
 .../example-sender/src/routes/+page.server.ts |   5 +-
 apps/example-sender/src/routes/+page.svelte   |  18 +++
 .../src/routes/xrpc/[method]/+server.ts       |  65 ++++++++
 apps/example-sender/wrangler.jsonc            |  10 +-
 apps/homepage/src/routes/docs/+page.server.ts |  31 +++-
 apps/homepage/src/routes/docs/+page.svelte    |  28 +++-
 apps/relay/package.json                       |   3 +-
 apps/relay/scripts/generate-relay-key.js      |  18 +++
 apps/relay/src/auth/relay-signer.ts           |  48 ++++++
 apps/relay/src/delivery/dispatcher.ts         |  55 +++++++
 apps/relay/src/env.ts                         |  13 ++
 apps/relay/src/lib/apps.ts                    |  52 +++++++
 apps/relay/src/lib/trusted.ts                 |  11 --
 apps/relay/src/rpc/entrypoint.ts              |   4 +
 apps/relay/src/rpc/ops.ts                     |  34 ++++
 apps/relay/src/well-known.ts                  |  28 +++-
 apps/relay/src/xrpc/requestPermission.ts      |   2 +-
 apps/relay/test/subscriberChanged.test.ts     | 147 ++++++++++++++++++
 apps/web/src/lib/server/relay.ts              |   1 +
 .../web/src/routes/(app)/apps/+page.server.ts |  17 +-
 apps/web/src/routes/(app)/apps/+page.svelte   |  45 ++++++
 .../pub/atmo/notify/subscriberChanged.json    |  42 +++++
 packages/lexicons/src/rpc.ts                  |  16 ++
 pnpm-lock.yaml                                |   9 +-
 27 files changed, 747 insertions(+), 84 deletions(-)
 create mode 100644 apps/example-sender/src/lib/server/subscribers.ts
 create mode 100644 apps/example-sender/src/routes/xrpc/[method]/+server.ts
 create mode 100644 apps/relay/scripts/generate-relay-key.js
 create mode 100644 apps/relay/src/auth/relay-signer.ts
 create mode 100644 apps/relay/src/lib/apps.ts
 delete mode 100644 apps/relay/src/lib/trusted.ts
 create mode 100644 apps/relay/test/subscriberChanged.test.ts
 create mode 100644 packages/lexicons/lexicons/pub/atmo/notify/subscriberChanged.json

diff --git a/apps/example-sender/package.json b/apps/example-sender/package.json
index 61b8c4c..c27292e 100644
--- a/apps/example-sender/package.json
+++ b/apps/example-sender/package.json
@@ -1,55 +1,56 @@
 {
-	"name": "example",
-	"private": true,
-	"version": "0.0.1",
-	"type": "module",
-	"scripts": {
-		"atproto:setup": "atproto-oauth setup",
-		"atproto:keygen": "atproto-oauth keygen",
-		"atproto:secret": "atproto-oauth secret",
-		"sender:keygen": "node scripts/generate-keys.js",
-		"dev": "vite dev",
-		"build": "vite build",
-		"preview": "vite preview",
-		"deploy": "vite build && wrangler deploy",
-		"prepare": "svelte-kit sync || echo ''",
-		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
-		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
-		"lint": "prettier --check . && eslint .",
-		"format": "prettier --write ."
-	},
-	"devDependencies": {
-		"@eslint/compat": "^2.0.4",
-		"@eslint/js": "^10.0.1",
-		"@sveltejs/adapter-cloudflare": "^7.2.8",
-		"@sveltejs/kit": "^2.57.0",
-		"@sveltejs/vite-plugin-svelte": "^7.0.0",
-		"@tailwindcss/forms": "^0.5.11",
-		"@tailwindcss/typography": "^0.5.19",
-		"@tailwindcss/vite": "^4.2.2",
-		"@types/node": "^22",
-		"eslint": "^10.2.0",
-		"eslint-config-prettier": "^10.1.8",
-		"eslint-plugin-svelte": "^3.17.0",
-		"globals": "^17.4.0",
-		"prettier": "^3.8.1",
-		"prettier-plugin-svelte": "^3.5.1",
-		"prettier-plugin-tailwindcss": "^0.7.2",
-		"svelte": "^5.55.2",
-		"svelte-check": "^4.4.6",
-		"tailwindcss": "^4.2.2",
-		"typescript": "^6.0.2",
-		"typescript-eslint": "^8.58.1",
-		"vite": "^8.0.7"
-	},
-	"dependencies": {
-		"@atcute/atproto": "^4.0.0",
-		"@atcute/client": "^5.0.0",
-		"@atcute/crypto": "^2.4.1",
-		"@atcute/lexicons": "^2.0.0",
-		"@atcute/uint8array": "^1.1.2",
-		"@atcute/xrpc-server": "^2.0.0",
-		"@svelte-atproto/oauth": "^0.3.0",
-		"valibot": "^1.0.0"
-	}
+  "name": "example",
+  "private": true,
+  "version": "0.0.1",
+  "type": "module",
+  "scripts": {
+    "atproto:setup": "atproto-oauth setup",
+    "atproto:keygen": "atproto-oauth keygen",
+    "atproto:secret": "atproto-oauth secret",
+    "sender:keygen": "node scripts/generate-keys.js",
+    "dev": "vite dev",
+    "build": "vite build",
+    "preview": "vite preview",
+    "deploy": "vite build && wrangler deploy",
+    "prepare": "svelte-kit sync || echo ''",
+    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+    "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+    "lint": "prettier --check . && eslint .",
+    "format": "prettier --write ."
+  },
+  "devDependencies": {
+    "@eslint/compat": "^2.0.4",
+    "@eslint/js": "^10.0.1",
+    "@sveltejs/adapter-cloudflare": "^7.2.8",
+    "@sveltejs/kit": "^2.57.0",
+    "@sveltejs/vite-plugin-svelte": "^7.0.0",
+    "@tailwindcss/forms": "^0.5.11",
+    "@tailwindcss/typography": "^0.5.19",
+    "@tailwindcss/vite": "^4.2.2",
+    "@types/node": "^22",
+    "eslint": "^10.2.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-svelte": "^3.17.0",
+    "globals": "^17.4.0",
+    "prettier": "^3.8.1",
+    "prettier-plugin-svelte": "^3.5.1",
+    "prettier-plugin-tailwindcss": "^0.7.2",
+    "svelte": "^5.55.2",
+    "svelte-check": "^4.4.6",
+    "tailwindcss": "^4.2.2",
+    "typescript": "^6.0.2",
+    "typescript-eslint": "^8.58.1",
+    "vite": "^8.0.7"
+  },
+  "dependencies": {
+    "@atcute/atproto": "^4.0.0",
+    "@atcute/client": "^5.0.0",
+    "@atcute/crypto": "^2.4.1",
+    "@atcute/identity-resolver": "^2.0.0",
+    "@atcute/lexicons": "^2.0.0",
+    "@atcute/uint8array": "^1.1.2",
+    "@atcute/xrpc-server": "^2.0.0",
+    "@svelte-atproto/oauth": "^0.3.0",
+    "valibot": "^1.0.0"
+  }
 }
diff --git a/apps/example-sender/src/lib/server/relay.ts b/apps/example-sender/src/lib/server/relay.ts
index ffe6f37..98e642f 100644
--- a/apps/example-sender/src/lib/server/relay.ts
+++ b/apps/example-sender/src/lib/server/relay.ts
@@ -35,6 +35,9 @@ async function postRelay(jwt: string, lxm: string, body: object): Promise<unknow
 	const data: unknown = text ? JSON.parse(text) : {};
 	if (!res.ok) {
 		const d = data as { error?: string; message?: string };
+		// Surface the relay's exact reason in the example's dev terminal — handy
+		// when debugging auth (401) vs authorization (403) failures.
+		console.error(`[relay] ${lxm} → ${res.status}`, d.error, d.message);
 		const err = new Error(d.message ?? d.error ?? 'Relay call failed') as RelayError;
 		err.error = d.error;
 		err.status = res.status;
diff --git a/apps/example-sender/src/lib/server/subscribers.ts b/apps/example-sender/src/lib/server/subscribers.ts
new file mode 100644
index 0000000..c668e7b
--- /dev/null
+++ b/apps/example-sender/src/lib/server/subscribers.ts
@@ -0,0 +1,19 @@
+// Demo store of users who enabled notifications for this app via atmo.pub's
+// "enable apps" flow (the relay's subscriberChanged callback, ENABLE-FROM-WEB.md).
+//
+// In-memory only — fine for the demo and for local dev (single process), but a
+// real app must persist this (D1/KV/Postgres) since Worker isolates are
+// ephemeral. Once a user is here, this app would start calling `send` for them.
+const subscribers = new Set<string>();
+
+export function recordSubscriber(did: string, enabled: boolean): void {
+	if (enabled) {
+		subscribers.add(did);
+	} else {
+		subscribers.delete(did);
+	}
+}
+
+export function listSubscribers(): string[] {
+	return [...subscribers];
+}
diff --git a/apps/example-sender/src/routes/+page.server.ts b/apps/example-sender/src/routes/+page.server.ts
index ef6ba2f..b06418e 100644
--- a/apps/example-sender/src/routes/+page.server.ts
+++ b/apps/example-sender/src/routes/+page.server.ts
@@ -1,6 +1,8 @@
 import { loadHandle } from '@svelte-atproto/oauth/helper';
 import { memory } from '@svelte-atproto/oauth/server/stores/memory';
 
+import { listSubscribers } from '$lib/server/subscribers';
+
 import type { PageServerLoad } from './$types';
 
 // Tiny in-memory cache for handle lookups (fine for a demo).
@@ -8,5 +10,6 @@ const handleCache = memory();
 
 export const load: PageServerLoad = async ({ locals }) => {
 	const handle = locals.did ? await loadHandle(locals.did, { cache: handleCache }) : null;
-	return { did: locals.did, handle };
+	// Users the relay told us enabled us via atmo.pub's "enable apps" flow.
+	return { did: locals.did, handle, subscribers: listSubscribers() };
 };
diff --git a/apps/example-sender/src/routes/+page.svelte b/apps/example-sender/src/routes/+page.svelte
index dc2ba24..f265fb9 100644
--- a/apps/example-sender/src/routes/+page.svelte
+++ b/apps/example-sender/src/routes/+page.svelte
@@ -370,6 +370,24 @@
 		</section>
 	{/if}
 
+	<section class={card}>
+		<h2 class="text-base font-semibold text-fg">Subscribers from atmo.pub</h2>
+		<p class="mt-2 text-sm leading-relaxed text-muted">
+			Users who enabled this app from inside atmo.pub. The relay tells us via a signed
+			<code class="font-mono text-fg">subscriberChanged</code> callback (we verify it's really the
+			relay), and a real app would start sending them notifications. Demo store is in-memory.
+		</p>
+		{#if data.subscribers.length === 0}
+			<p class="mt-3 text-sm text-muted-2">None yet — enable this app from atmo.pub's Apps screen.</p>
+		{:else}
+			<ul class="mt-3 space-y-1">
+				{#each data.subscribers as sub (sub)}
+					<li class="font-mono text-xs break-all text-fg">{sub}</li>
+				{/each}
+			</ul>
+		{/if}
+	</section>
+
 	<footer class="border-t border-line pt-6 text-xs text-muted-2">
 		Source:
 		<a class="hover:text-fg" href={GITHUB_URL} target="_blank" rel="noreferrer">{GITHUB_URL}</a>.
diff --git a/apps/example-sender/src/routes/xrpc/[method]/+server.ts b/apps/example-sender/src/routes/xrpc/[method]/+server.ts
new file mode 100644
index 0000000..45c45ea
--- /dev/null
+++ b/apps/example-sender/src/routes/xrpc/[method]/+server.ts
@@ -0,0 +1,65 @@
+// Inbound XRPC the relay calls on this app (relay → app). Currently just
+// `pub.atmo.notify.subscriberChanged`: the relay tells us a user enabled or
+// disabled notifications for us from inside atmo.pub. See ENABLE-FROM-WEB.md.
+//
+// Auth: a service-auth JWT signed by the RELAY's key. We verify the signature
+// against the relay's did:web document AND assert the issuer is the relay — that
+// last check is what makes this safe (anyone can address a token to us; only the
+// relay's signature counts).
+import {
+	CompositeDidDocumentResolver,
+	PlcDidDocumentResolver,
+	WebDidDocumentResolver
+} from '@atcute/identity-resolver';
+import type { Did, Nsid } from '@atcute/lexicons';
+import { ServiceJwtVerifier } from '@atcute/xrpc-server/auth';
+import { error, json } from '@sveltejs/kit';
+
+import { RELAY_DID, SENDER_DID } from '$lib/config';
+import { recordSubscriber } from '$lib/server/subscribers';
+
+import type { RequestHandler } from './$types';
+
+const SUBSCRIBER_CHANGED = 'pub.atmo.notify.subscriberChanged';
+
+let verifier: ServiceJwtVerifier | null = null;
+function getVerifier(): ServiceJwtVerifier {
+	verifier ??= new ServiceJwtVerifier({
+		// Tokens must be addressed to us, and we only accept the relay as issuer
+		// (checked below). did:web for the relay, did:plc fallback for safety.
+		acceptAudiences: [SENDER_DID as Did],
+		resolver: new CompositeDidDocumentResolver({
+			methods: { plc: new PlcDidDocumentResolver(), web: new WebDidDocumentResolver() }
+		}),
+		maxAge: 300
+	});
+	return verifier;
+}
+
+export const POST: RequestHandler = async ({ params, request }) => {
+	if (params.method !== SUBSCRIBER_CHANGED) {
+		error(404, 'Unknown method');
+	}
+
+	let issuer: Did;
+	try {
+		({ issuer } = await getVerifier().verifyRequest(request, { lxm: SUBSCRIBER_CHANGED as Nsid }));
+	} catch {
+		error(401, 'Invalid service-auth token');
+	}
+	// Critical: trust ONLY the relay. A valid signature from anyone else is not enough.
+	if (issuer !== RELAY_DID) {
+		error(403, 'Issuer is not the notification relay');
+	}
+
+	const body = (await request.json().catch(() => null)) as {
+		recipient?: string;
+		enabled?: boolean;
+	} | null;
+	if (!body || typeof body.recipient !== 'string' || typeof body.enabled !== 'boolean') {
+		error(400, 'Expected { recipient, enabled }');
+	}
+
+	recordSubscriber(body.recipient, body.enabled);
+	return json({ ok: true });
+};
diff --git a/apps/example-sender/wrangler.jsonc b/apps/example-sender/wrangler.jsonc
index 4ad69b0..e930673 100644
--- a/apps/example-sender/wrangler.jsonc
+++ b/apps/example-sender/wrangler.jsonc
@@ -20,13 +20,15 @@
 	"kv_namespaces": [
 		{ "binding": "OAUTH_SESSIONS", "id": "fc20e9a60f454bc4936859f86a73347f" },
 		{ "binding": "OAUTH_STATES", "id": "3466c423dfb2426abb4d397e86e17f1b" }
-	]
+	],
+
+	// Custom domain — so the relay can resolve `did:web:example.atmo.pub` by
+	// fetching https://example.atmo.pub/.well-known/did.json. wrangler provisions
+	// this domain on deploy (the atmo.pub zone must be in this CF account).
+	"routes": [{ "pattern": "example.atmo.pub", "custom_domain": true }]
 
 	// Secrets (wrangler secret put):
 	//   COOKIE_SECRET         (atproto-oauth secret | wrangler secret put COOKIE_SECRET)
 	//   CLIENT_ASSERTION_KEY  (atproto-oauth keygen | wrangler secret put CLIENT_ASSERTION_KEY)
 	//   SENDER_PRIVATE_KEY    (pnpm sender:keygen → the private multikey; for `send`)
-	//
-	// Custom domain: bind it in the CF dashboard, or add:
-	//   "routes": [{ "pattern": "example.atmo.pub", "custom_domain": true }]
 }
diff --git a/apps/homepage/src/routes/docs/+page.server.ts b/apps/homepage/src/routes/docs/+page.server.ts
index a253b2e..ecc5ed5 100644
--- a/apps/homepage/src/routes/docs/+page.server.ts
+++ b/apps/homepage/src/routes/docs/+page.server.ts
@@ -67,9 +67,35 @@ export interface CodeBlock {
 	html: string;
 }
 
+const enableCallbackExample = `import { ServiceJwtVerifier } from '@atcute/xrpc-server/auth';
+import { CompositeDidDocumentResolver, PlcDidDocumentResolver,
+         WebDidDocumentResolver } from '@atcute/identity-resolver';
+
+// Endpoint the relay POSTs when a user enables/disables you from atmo.pub:
+//   POST /xrpc/pub.atmo.notify.subscriberChanged  { recipient, enabled, changedAt }
+const verifier = new ServiceJwtVerifier({
+  acceptAudiences: ['did:web:yourapp.example'],          // tokens addressed to you
+  resolver: new CompositeDidDocumentResolver({ methods: {
+    plc: new PlcDidDocumentResolver(), web: new WebDidDocumentResolver() } })
+});
+
+const { issuer } = await verifier.verifyRequest(request, {
+  lxm: 'pub.atmo.notify.subscriberChanged'
+});
+// CRITICAL: only the relay may tell you this — a valid signature isn't enough.
+if (issuer !== '${RELAY_DID}') throw new Error('issuer is not the relay');
+
+const { recipient, enabled } = await request.json();
+// enabled ? start sending to \`recipient\` via send : stop.`;
+
 // Highlight the (static) examples once per server instance, then reuse.
 let cached:
-	| Promise<Record<'request' | 'sendJwt' | 'sendAtcute' | 'sendCurl' | 'appLogin', CodeBlock>>
+	| Promise<
+			Record<
+				'request' | 'sendJwt' | 'sendAtcute' | 'sendCurl' | 'appLogin' | 'enableCallback',
+				CodeBlock
+			>
+	  >
 	| undefined;
 function buildBlocks() {
 	cached ??= (async () => {
@@ -83,7 +109,8 @@ function buildBlocks() {
 			sendJwt: await make(sendJwtExample, 'ts'),
 			sendAtcute: await make(sendAtcuteExample, 'ts'),
 			sendCurl: await make(sendCurlExample, 'bash'),
-			appLogin: await make(appLoginExample, 'ts')
+			appLogin: await make(appLoginExample, 'ts'),
+			enableCallback: await make(enableCallbackExample, 'ts')
 		};
 	})();
 	return cached;
diff --git a/apps/homepage/src/routes/docs/+page.svelte b/apps/homepage/src/routes/docs/+page.svelte
index fcbcaa8..563d7a7 100644
--- a/apps/homepage/src/routes/docs/+page.svelte
+++ b/apps/homepage/src/routes/docs/+page.svelte
@@ -154,7 +154,31 @@
 	</section>
 
 	<section class="space-y-3">
-		<h2 class="text-lg font-semibold text-fg">5. Rate limits</h2>
+		<h2 class="text-lg font-semibold text-fg">5. Let users enable you from atmo.pub (optional)</h2>
+		<p class="max-w-prose text-sm leading-relaxed text-muted">
+			Users can turn on notifications for your app from inside {PROJECT_NAME} — without visiting your
+			app first. When they do, the relay POSTs a <strong class="text-fg">relay-signed</strong>
+			<code class="font-mono text-fg">subscriberChanged</code> callback to
+			<code class="font-mono text-fg">/xrpc/pub.atmo.notify.subscriberChanged</code> on your service:
+			<code class="font-mono text-fg">&#123; recipient, enabled, changedAt &#125;</code>. Verify it's
+			really the relay, then start (or stop) sending to that user with
+			<code class="font-mono text-fg">send</code>.
+		</p>
+		{@render codeblock(data.code.enableCallback)}
+		<p class="max-w-prose text-sm leading-relaxed text-muted">
+			You trust the relay's word that the user consented (the same trust you already place in it to
+			deliver). Callbacks are idempotent state, so safe to retry; treat them as such. Apps are
+			curated for now — <a
+				class="text-accent hover:underline"
+				href={GITHUB_URL}
+				target="_blank"
+				rel="noreferrer">get in touch</a
+			> to be listed.
+		</p>
+	</section>
+
+	<section class="space-y-3">
+		<h2 class="text-lg font-semibold text-fg">6. Rate limits</h2>
 		<ul class="ml-5 list-disc space-y-1 text-sm text-muted">
 			<li>At most <strong class="text-fg">1 outstanding pending request</strong> per (sender, recipient).</li>
 			<li><code class="font-mono text-fg">requestPermission</code>: <strong class="text-fg">50 / hour</strong> per recipient and <strong class="text-fg">100 / hour</strong> per sender.</li>
@@ -163,7 +187,7 @@
 	</section>
 
 	<section class="space-y-3">
-		<h2 class="text-lg font-semibold text-fg">6. Error handling</h2>
+		<h2 class="text-lg font-semibold text-fg">7. Error handling</h2>
 		<p class="max-w-prose text-sm leading-relaxed text-muted">Common XRPC errors:</p>
 		<ul class="ml-5 list-disc space-y-1 text-sm text-muted">
 			<li><code class="font-mono text-fg">AuthenticationRequired</code> — missing/invalid JWT.</li>
diff --git a/apps/relay/package.json b/apps/relay/package.json
index ea2e656..50e4743 100644
--- a/apps/relay/package.json
+++ b/apps/relay/package.json
@@ -11,11 +11,13 @@
     "typecheck": "tsc -b",
     "deploy": "wrangler deploy",
     "vapid:keygen": "node scripts/generate-vapid.js",
+    "relay:keygen": "node scripts/generate-relay-key.js",
     "db:migrate": "wrangler d1 migrations apply notifs-relay --remote",
     "db:migrate:local": "wrangler d1 migrations apply notifs-relay --local"
   },
   "dependencies": {
     "@atcute/client": "^5.0.0",
+    "@atcute/crypto": "^2.4.1",
     "@atcute/identity-resolver": "^2.0.0",
     "@atcute/lexicons": "^2.0.0",
     "@atcute/xrpc-server": "^2.0.0",
@@ -23,7 +25,6 @@
     "nanoid": "^5.1.11"
   },
   "devDependencies": {
-    "@atcute/crypto": "^2.4.1",
     "@cloudflare/vitest-pool-workers": "^0.16.9",
     "@cloudflare/workers-types": "^4.20260522.1",
     "typescript": "^5.8.3",
diff --git a/apps/relay/scripts/generate-relay-key.js b/apps/relay/scripts/generate-relay-key.js
new file mode 100644
index 0000000..1b13c71
--- /dev/null
+++ b/apps/relay/scripts/generate-relay-key.js
@@ -0,0 +1,18 @@
+// Generates the P-256 (ES256) keypair the relay signs OUTBOUND service-auth JWTs
+// with — e.g. the `subscriberChanged` callback it POSTs to apps (see
+// ENABLE-FROM-WEB.md). Run once: `pnpm --filter @atmo/notifs-relay relay:keygen`.
+// Set the private key as the RELAY_PRIVATE_KEY secret and paste the public
+// multikey into the did.json `verificationMethod` in src/well-known.ts.
+import { P256PrivateKeyExportable } from '@atcute/crypto';
+
+const keypair = await P256PrivateKeyExportable.createKeypair();
+const privateKey = await keypair.exportPrivateKey('multikey');
+const publicKey = await keypair.exportPublicKey('multikey');
+
+console.log('=== PRIVATE KEY (set as RELAY_PRIVATE_KEY secret / .dev.vars) ===');
+console.log(privateKey);
+console.log();
+console.log('=== PUBLIC KEY (publicKeyMultibase value in well-known.ts) ===');
+console.log(publicKey);
+console.log();
+console.log('Save the private key now — re-running this script generates new keys.');
diff --git a/apps/relay/src/auth/relay-signer.ts b/apps/relay/src/auth/relay-signer.ts
new file mode 100644
index 0000000..900178e
--- /dev/null
+++ b/apps/relay/src/auth/relay-signer.ts
@@ -0,0 +1,48 @@
+// Relay-as-issuer. Mints service-auth JWTs signed by the RELAY's own P-256 key
+// (whose public half is published in the relay's did:web document, see
+// well-known.ts). Used for OUTBOUND calls the relay makes to apps — e.g. the
+// `subscriberChanged` callback (ENABLE-FROM-WEB.md). Mirrors the example-sender's
+// sender-auth.ts. Until this, the relay only ever verified inbound JWTs.
+import { P256PrivateKey, parsePrivateMultikey } from '@atcute/crypto';
+import type { Did, Nsid } from '@atcute/lexicons';
+import type { AtprotoAudience } from '@atcute/lexicons/syntax';
+import { createServiceJwt } from '@atcute/xrpc-server/auth';
+
+import type { Env } from '../env';
+
+// Load + cache the keypair once per isolate, keyed on the secret value so a
+// rotated key (new Env) re-imports.
+let cached: { secret: string; keypair: Promise<P256PrivateKey> } | null = null;
+
+function getKeypair(env: Env): Promise<P256PrivateKey> {
+  if (!env.RELAY_PRIVATE_KEY) {
+    throw new Error('RELAY_PRIVATE_KEY is not set (run `pnpm --filter @atmo/notifs-relay relay:keygen`)');
+  }
+  if (cached === null || cached.secret !== env.RELAY_PRIVATE_KEY) {
+    const secret = env.RELAY_PRIVATE_KEY;
+    cached = {
+      secret,
+      keypair: (async () => {
+        const { privateKeyBytes } = parsePrivateMultikey(secret);
+        return P256PrivateKey.importRaw(privateKeyBytes);
+      })(),
+    };
+  }
+  return cached.keypair;
+}
+
+/** Mint a short-lived service-auth JWT issued by the relay, addressed to `aud`. */
+export async function mintRelayJwt(
+  env: Env,
+  aud: Did | AtprotoAudience,
+  lxm: Nsid,
+): Promise<string> {
+  const keypair = await getKeypair(env);
+  return createServiceJwt({
+    keypair,
+    issuer: env.RELAY_DID as Did,
+    audience: aud,
+    lxm,
+    expiresIn: 60,
+  });
+}
diff --git a/apps/relay/src/delivery/dispatcher.ts b/apps/relay/src/delivery/dispatcher.ts
index bced487..5fcc309 100644
--- a/apps/relay/src/delivery/dispatcher.ts
+++ b/apps/relay/src/delivery/dispatcher.ts
@@ -1,5 +1,9 @@
+import type { Did, Nsid } from '@atcute/lexicons';
+
+import { mintRelayJwt } from '../auth/relay-signer';
 import { deleteChannelByPlatformUser, deletePushSubscription } from '../db/queries';
 import type { DispatchJob, Env } from '../env';
+import { callbackAppFor } from '../lib/apps';
 
 import {
   escapeMd,
@@ -9,6 +13,8 @@ import {
 } from './telegram';
 import { sendWebPush, WebPushError } from './webpush';
 
+const SUBSCRIBER_CHANGED_LXM = 'pub.atmo.notify.subscriberChanged' as Nsid;
+
 /**
  * Queue consumer. Each message is an independent delivery; we ack on success and
  * on permanent failure (dead channel/subscription), and retry on transient
@@ -32,6 +38,13 @@ export async function handleQueue(batch: MessageBatch<DispatchJob>, env: Env): P
 
 /** If `err` means the target is permanently undeliverable, reap it and return true. */
 async function reapIfDead(env: Env, job: DispatchJob, err: unknown): Promise<boolean> {
+  // Relay→app callback has no `channel`. A 4xx means the app rejected the call
+  // (bad/forged token, unknown method) — retrying won't help, so drop it; 5xx /
+  // network errors fall through to retry.
+  if (job.kind === 'subscriberChanged') {
+    return err instanceof SubscriberCallbackError && err.statusCode >= 400 && err.statusCode < 500;
+  }
+
   const { channel } = job;
   if (channel.platform === 'telegram' && err instanceof TelegramApiError && isDeadChannel(err)) {
     // The user blocked the bot or the chat is gone.
@@ -64,7 +77,49 @@ function isDeadChannel(err: TelegramApiError): boolean {
   return false;
 }
 
+/** Non-2xx response from an app's subscriberChanged endpoint. */
+class SubscriberCallbackError extends Error {
+  constructor(readonly statusCode: number) {
+    super(`subscriberChanged callback failed: ${statusCode}`);
+    this.name = 'SubscriberCallbackError';
+  }
+}
+
+/**
+ * Relay → app callback: tell `job.sender` that `job.recipient` enabled/disabled
+ * notifications. Signed with the relay's own key (the app verifies `iss` is the
+ * relay). Idempotent state, so retries are safe.
+ */
+async function sendSubscriberCallback(
+  env: Env,
+  job: Extract<DispatchJob, { kind: 'subscriberChanged' }>,
+): Promise<void> {
+  const app = callbackAppFor(job.sender);
+  if (app?.callbackUrl === undefined) {
+    // Deregistered between enqueue and delivery — nothing to do.
+    return;
+  }
+  const jwt = await mintRelayJwt(env, job.sender as Did, SUBSCRIBER_CHANGED_LXM);
+  const res = await fetch(`${app.callbackUrl}/xrpc/${SUBSCRIBER_CHANGED_LXM}`, {
+    method: 'POST',
+    headers: { authorization: `Bearer ${jwt}`, 'content-type': 'application/json' },
+    body: JSON.stringify({
+      recipient: job.recipient,
+      enabled: job.enabled,
+      changedAt: job.changedAt,
+    }),
+  });
+  if (!res.ok) {
+    throw new SubscriberCallbackError(res.status);
+  }
+}
+
 async function dispatch(env: Env, job: DispatchJob): Promise<void> {
+  if (job.kind === 'subscriberChanged') {
+    await sendSubscriberCallback(env, job);
+    return;
+  }
+
   if (job.kind === 'notification') {
     if (job.channel.platform === 'webpush') {
       await sendWebPush(env, job.channel, {
diff --git a/apps/relay/src/env.ts b/apps/relay/src/env.ts
index aa7f5a9..1e80f36 100644
--- a/apps/relay/src/env.ts
+++ b/apps/relay/src/env.ts
@@ -40,6 +40,15 @@ export type DispatchJob =
       senderDescription?: string;
       senderIconUrl?: string;
       senderDid: string;
+    }
+  | {
+      // Relay → app callback: a user's notification subscription to `sender`
+      // changed. Has NO `channel` (unlike the others) — guard on `kind` first.
+      kind: 'subscriberChanged';
+      sender: string;
+      recipient: string;
+      enabled: boolean;
+      changedAt: string;
     };
 
 /** Cloudflare bindings + vars + secrets, as declared in `wrangler.toml`. */
@@ -56,6 +65,10 @@ export interface Env {
   /** Telegram bot username, used to build deep links (var). */
   BOT_USERNAME: string;
 
+  /** Relay's P-256 signing key as a private multikey (secret) — for outbound
+   *  service-auth JWTs (e.g. the subscriberChanged callback). `relay:keygen`. */
+  RELAY_PRIVATE_KEY: string;
+
   /** Telegram bot token (secret). */
   TELEGRAM_BOT_TOKEN: string;
   /** Shared secret embedded in the Telegram webhook path (secret). */
diff --git a/apps/relay/src/lib/apps.ts b/apps/relay/src/lib/apps.ts
new file mode 100644
index 0000000..dd5add9
--- /dev/null
+++ b/apps/relay/src/lib/apps.ts
@@ -0,0 +1,52 @@
+import type { Did } from '@atcute/lexicons';
+
+import type { AppInfo } from '@atmo/notifs-lexicons';
+
+// Hardcoded catalog of known apps (for now). Single source for three things:
+//   - the web's "apps you can enable" list (via the listApps binding method),
+//   - requestPermission auto-grant (the old TRUSTED_SENDERS `trusted` flag),
+//   - relay → app subscriber callbacks (`callbackUrl`, see ENABLE-FROM-WEB.md).
+// Replaces the former lib/trusted.ts.
+export interface RegisteredApp {
+  did: Did;
+  title: string;
+  description?: string;
+  iconUrl?: string;
+  /**
+   * Origin the relay POSTs subscriber callbacks to (`/xrpc/<method>` is
+   * appended). Omit to disable callbacks for this app.
+   */
+  callbackUrl?: string;
+  /** Auto-grant at `requestPermission` (skips the pending step). */
+  trusted?: boolean;
+}
+
+export const APPS: readonly RegisteredApp[] = [
+  {
+    did: 'did:web:example.atmo.pub',
+    title: 'Example Sender',
+    description: 'Demo app showing the atmo.pub integration.',
+    // For local end-to-end testing, point this at your local example-sender.
+    callbackUrl: 'https://example.atmo.pub',
+  },
+];
+
+/** Auto-grant senders (the former TRUSTED_SENDERS). */
+export function isTrustedSender(did: Did): boolean {
+  return APPS.some((app) => app.did === did && app.trusted === true);
+}
+
+/** The registered app for `did`, if it has a callback URL configured. */
+export function callbackAppFor(did: string): RegisteredApp | undefined {
+  return APPS.find((app) => app.did === did && app.callbackUrl !== undefined);
+}
+
+/** Public catalog metadata for the web "enable apps" UI (no callback URLs). */
+export function appCatalog(): AppInfo[] {
+  return APPS.map(({ did, title, description, iconUrl }) => ({
+    did,
+    title,
+    description,
+    iconUrl,
+  }));
+}
diff --git a/apps/relay/src/lib/trusted.ts b/apps/relay/src/lib/trusted.ts
deleted file mode 100644
index 0f0f99e..0000000
--- a/apps/relay/src/lib/trusted.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import type { Did } from '@atcute/lexicons';
-
-// "Trusted apps": sender DIDs that are auto-granted at `requestPermission`
-// (skipping the pending step). Hardcoded for now — add known-good app DIDs here.
-export const TRUSTED_SENDERS: readonly Did[] = [
-  // 'did:web:example.atmo.pub',
-];
-
-export function isTrustedSender(did: Did): boolean {
-  return TRUSTED_SENDERS.includes(did);
-}
diff --git a/apps/relay/src/rpc/entrypoint.ts b/apps/relay/src/rpc/entrypoint.ts
index 93163fd..a43669d 100644
--- a/apps/relay/src/rpc/entrypoint.ts
+++ b/apps/relay/src/rpc/entrypoint.ts
@@ -3,6 +3,7 @@ import { WorkerEntrypoint } from 'cloudflare:workers';
 import type { Did } from '@atcute/lexicons';
 import type {
   AlertRoute,
+  AppInfo,
   AppRoute,
   CategoryRoute,
   DeviceView,
@@ -104,4 +105,7 @@ export class RelayRpc extends WorkerEntrypoint<Env> implements NotifsRpc {
   verifyAppLogin(token: string): Promise<{ did: Did }> {
     return ops.verifyAppLogin(this.env, token);
   }
+  listApps(): Promise<AppInfo[]> {
+    return ops.listApps();
+  }
 }
diff --git a/apps/relay/src/rpc/ops.ts b/apps/relay/src/rpc/ops.ts
index 36a0945..4a2ad4f 100644
--- a/apps/relay/src/rpc/ops.ts
+++ b/apps/relay/src/rpc/ops.ts
@@ -7,6 +7,7 @@ import type { Did } from '@atcute/lexicons';
 
 import type {
   AlertRoute,
+  AppInfo,
   AppRoute,
   CategoryRoute,
   DeviceView,
@@ -32,6 +33,7 @@ import type {
 import { verifyAppLoginToken } from '../auth/appLogin';
 import * as q from '../db/queries';
 import type { Env } from '../env';
+import { appCatalog, callbackAppFor } from '../lib/apps';
 import { newLinkToken } from '../lib/ids';
 import { addMinutes, now, toIsoDatetime } from '../lib/time';
 
@@ -62,9 +64,33 @@ export async function grant(
     await q.deletePendingById(env.DB, input.requestId, did);
   }
 
+  await notifySubscriberChanged(env, did, input.sender, true);
   return { granted: true };
 }
 
+/**
+ * If `sender` is a registered callback app, enqueue a relay→app `subscriberChanged`
+ * callback. Fire-and-forget via the dispatch queue (Queues handles retries); a
+ * delivery failure must not fail the grant/revoke the user just made.
+ */
+async function notifySubscriberChanged(
+  env: Env,
+  recipient: Did,
+  sender: Did,
+  enabled: boolean,
+): Promise<void> {
+  if (callbackAppFor(sender) === undefined) {
+    return;
+  }
+  await env.DISPATCH_QUEUE.send({
+    kind: 'subscriberChanged',
+    sender,
+    recipient,
+    enabled,
+    changedAt: toIsoDatetime(now()),
+  });
+}
+
 export async function revoke(
   env: Env,
   did: Did,
@@ -74,6 +100,9 @@ export async function revoke(
   // The pending request (if any) for this pair is now irrelevant.
   await q.deletePendingByPair(env.DB, did, input.sender);
 
+  if (revoked) {
+    await notifySubscriberChanged(env, did, input.sender, false);
+  }
   return { revoked };
 }
 
@@ -402,3 +431,8 @@ export async function verifyAppLogin(env: Env, token: string): Promise<{ did: Di
   await q.ensureUser(env.DB, did, now());
   return { did };
 }
+
+/** The hardcoded catalog of enableable apps (see ../lib/apps). */
+export function listApps(): Promise<AppInfo[]> {
+  return Promise.resolve(appCatalog());
+}
diff --git a/apps/relay/src/well-known.ts b/apps/relay/src/well-known.ts
index 74abaf1..849cf43 100644
--- a/apps/relay/src/well-known.ts
+++ b/apps/relay/src/well-known.ts
@@ -4,6 +4,7 @@ import markRead from '@atmo/notifs-lexicons/lexicons/pub/atmo/notify/markRead.js
 import requestPermission from '@atmo/notifs-lexicons/lexicons/pub/atmo/notify/requestPermission.json';
 import send from '@atmo/notifs-lexicons/lexicons/pub/atmo/notify/send.json';
 import setRouting from '@atmo/notifs-lexicons/lexicons/pub/atmo/notify/setRouting.json';
+import subscriberChanged from '@atmo/notifs-lexicons/lexicons/pub/atmo/notify/subscriberChanged.json';
 
 import type { Env } from './env';
 
@@ -19,18 +20,37 @@ const LEXICONS: Record<string, unknown> = {
   'pub.atmo.notify.getRouting': getRouting,
   'pub.atmo.notify.listNotifications': listNotifications,
   'pub.atmo.notify.markRead': markRead,
+  'pub.atmo.notify.subscriberChanged': subscriberChanged,
 };
 
+// Relay's public signing key (multikey), published so apps can verify outbound
+// service-auth JWTs the relay issues (e.g. the `subscriberChanged` callback,
+// ENABLE-FROM-WEB.md). Its private half is the RELAY_PRIVATE_KEY secret. Rotate
+// both together via `relay:keygen`.
+const RELAY_PUBLIC_KEY_MULTIBASE = 'zDnaeZB4zYA9upEh4bXkxXjsQJJhdq9zuNVtmk9QXhrno5yhd';
+
 /**
- * `GET /.well-known/did.json` — the relay's `did:web` document. No
- * `verificationMethod`: the relay verifies inbound JWTs but never signs anything.
- * The service endpoint is derived from `RELAY_DID` so config has one source.
+ * `GET /.well-known/did.json` — the relay's `did:web` document. Publishes an
+ * `#atproto` verification method so apps can verify the JWTs the relay signs for
+ * its outbound callbacks. The service endpoint is derived from `RELAY_DID` so
+ * config has one source.
  */
 export function handleWellKnownDid(env: Env): Response {
   const host = env.RELAY_DID.replace(/^did:web:/, '');
   const doc = {
-    '@context': ['https://www.w3.org/ns/did/v1'],
+    '@context': [
+      'https://www.w3.org/ns/did/v1',
+      'https://w3id.org/security/multikey/v1',
+    ],
     id: env.RELAY_DID,
+    verificationMethod: [
+      {
+        id: `${env.RELAY_DID}#atproto`,
+        type: 'Multikey',
+        controller: env.RELAY_DID,
+        publicKeyMultibase: RELAY_PUBLIC_KEY_MULTIBASE,
+      },
+    ],
     service: [
       {
         id: '#notif_relay',
diff --git a/apps/relay/src/xrpc/requestPermission.ts b/apps/relay/src/xrpc/requestPermission.ts
index 7dd13d4..d59fd45 100644
--- a/apps/relay/src/xrpc/requestPermission.ts
+++ b/apps/relay/src/xrpc/requestPermission.ts
@@ -9,7 +9,7 @@ import type { AppContext } from '../env';
 import { rateLimited } from '../lib/errors';
 import { newId } from '../lib/ids';
 import { addDays, now } from '../lib/time';
-import { isTrustedSender } from '../lib/trusted';
+import { isTrustedSender } from '../lib/apps';
 import { ensureSenderProfile } from '../profile/fetch';
 import { checkAndIncrement } from '../ratelimit';
 
diff --git a/apps/relay/test/subscriberChanged.test.ts b/apps/relay/test/subscriberChanged.test.ts
new file mode 100644
index 0000000..b80b220
--- /dev/null
+++ b/apps/relay/test/subscriberChanged.test.ts
@@ -0,0 +1,147 @@
+import type { Did } from '@atcute/lexicons';
+import { env } from 'cloudflare:test';
+import { afterEach, expect, it } from 'vitest';
+
+import type { DispatchJob } from '../src/env';
+import { handleQueue } from '../src/delivery/dispatcher';
+import * as q from '../src/db/queries';
+import { grant } from '../src/rpc/ops';
+
+const EXAMPLE: Did = 'did:web:example.atmo.pub'; // registered with a callbackUrl
+const UNREGISTERED: Did = 'did:web:nope.example';
+const LXM = 'pub.atmo.notify.subscriberChanged';
+const CALLBACK_URL = `https://example.atmo.pub/xrpc/${LXM}`;
+
+interface Captured {
+  url: string;
+  headers: Record<string, string>;
+  body: unknown;
+}
+
+/** Replace global fetch with a capturing stub for the duration of a test. */
+function captureFetch(status = 200): { calls: Captured[] } {
+  const calls: Captured[] = [];
+  globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    calls.push({
+      url: String(input),
+      headers: (init?.headers ?? {}) as Record<string, string>,
+      body: init?.body ? JSON.parse(init.body as string) : undefined,
+    });
+    return new Response(JSON.stringify({ ok: true }), {
+      status,
+      headers: { 'content-type': 'application/json' },
+    });
+  }) as typeof fetch;
+  return { calls };
+}
+
+const realFetch = globalThis.fetch;
+afterEach(() => {
+  globalThis.fetch = realFetch;
+});
+
+/** Decode a JWT payload without verifying (claims assertion only). */
+function jwtPayload(token: string): Record<string, unknown> {
+  const part = token.split('.')[1]!.replaceAll('-', '+').replaceAll('_', '/');
+  return JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(part), (c) => c.charCodeAt(0))));
+}
+
+function batchOf(job: DispatchJob) {
+  let acked = 0;
+  let retried = 0;
+  const batch = {
+    messages: [{ body: job, ack: () => acked++, retry: () => retried++ }],
+  } as unknown as MessageBatch<DispatchJob>;
+  return { batch, result: () => ({ acked, retried }) };
+}
+
+it('POSTs a relay-signed callback to the app on enable', async () => {
+  const { calls } = captureFetch(200);
+  const { batch, result } = batchOf({
+    kind: 'subscriberChanged',
+    sender: EXAMPLE,
+    recipient: 'did:plc:subuser',
+    enabled: true,
+    changedAt: '2026-05-23T00:00:00.000Z',
+  });
+
+  await handleQueue(batch, env);
+
+  expect(result()).toEqual({ acked: 1, retried: 0 });
+  expect(calls).toHaveLength(1);
+  expect(calls[0]!.url).toBe(CALLBACK_URL);
+  expect(calls[0]!.body).toEqual({
+    recipient: 'did:plc:subuser',
+    enabled: true,
+    changedAt: '2026-05-23T00:00:00.000Z',
+  });
+
+  const auth = calls[0]!.headers.authorization;
+  expect(auth?.startsWith('Bearer ')).toBe(true);
+  const payload = jwtPayload(auth!.slice('Bearer '.length));
+  expect(payload.iss).toBe(env.RELAY_DID);
+  expect(payload.aud).toBe(EXAMPLE);
+  expect(payload.lxm).toBe(LXM);
+});
+
+it('carries enabled:false on revoke', async () => {
+  const { calls } = captureFetch(200);
+  const { batch } = batchOf({
+    kind: 'subscriberChanged',
+    sender: EXAMPLE,
+    recipient: 'did:plc:subuser',
+    enabled: false,
+    changedAt: '2026-05-23T00:00:00.000Z',
+  });
+
+  await handleQueue(batch, env);
+
+  expect(calls[0]!.body).toMatchObject({ enabled: false });
+});
+
+it('retries on a 5xx from the app, drops on a 4xx', async () => {
+  const five = captureFetch(503);
+  const a = batchOf({
+    kind: 'subscriberChanged',
+    sender: EXAMPLE,
+    recipient: 'did:plc:x',
+    enabled: true,
+    changedAt: '2026-05-23T00:00:00.000Z',
+  });
+  await handleQueue(a.batch, env);
+  expect(a.result()).toEqual({ acked: 0, retried: 1 });
+  expect(five.calls).toHaveLength(1);
+
+  captureFetch(400);
+  const b = batchOf({
+    kind: 'subscriberChanged',
+    sender: EXAMPLE,
+    recipient: 'did:plc:x',
+    enabled: true,
+    changedAt: '2026-05-23T00:00:00.000Z',
+  });
+  await handleQueue(b.batch, env);
+  expect(b.result()).toEqual({ acked: 1, retried: 0 });
+});
+
+it('does not call out for an unregistered sender', async () => {
+  const { calls } = captureFetch(200);
+  const { batch, result } = batchOf({
+    kind: 'subscriberChanged',
+    sender: UNREGISTERED,
+    recipient: 'did:plc:x',
+    enabled: true,
+    changedAt: '2026-05-23T00:00:00.000Z',
+  });
+
+  await handleQueue(batch, env);
+
+  expect(calls).toHaveLength(0);
+  expect(result()).toEqual({ acked: 1, retried: 0 });
+});
+
+it('grant() for a registered app creates the grant (and enqueues the callback)', async () => {
+  const user: Did = 'did:plc:granter-cb';
+  await grant(env, user, { sender: EXAMPLE });
+  expect(await q.getGrant(env.DB, user, EXAMPLE)).not.toBeNull();
+});
diff --git a/apps/web/src/lib/server/relay.ts b/apps/web/src/lib/server/relay.ts
index 1fa8fde..cce44e6 100644
--- a/apps/web/src/lib/server/relay.ts
+++ b/apps/web/src/lib/server/relay.ts
@@ -43,6 +43,7 @@ export function relayFor(platform: App.Platform | undefined, did: Did | null) {
 	return {
 		listGrants: () => svc.listGrants(did),
 		listPending: () => svc.listPending(did),
+		listApps: () => svc.listApps(),
 		listChannels: () => svc.listChannels(did),
 		getSettings: () => svc.getSettings(did),
 		grant: (input: PubAtmoNotifyGrant.$input) => svc.grant(did, input),
diff --git a/apps/web/src/routes/(app)/apps/+page.server.ts b/apps/web/src/routes/(app)/apps/+page.server.ts
index 74ecbac..d92e089 100644
--- a/apps/web/src/routes/(app)/apps/+page.server.ts
+++ b/apps/web/src/routes/(app)/apps/+page.server.ts
@@ -7,11 +7,24 @@ import type { PageServerLoad } from './$types';
 export const load: PageServerLoad = async ({ locals, platform }) => {
 	const relay = relayFor(platform, locals.did);
 
-	const [pending, grants] = await Promise.all([relay.listPending(), relay.listGrants()]);
+	const [pending, grants, apps] = await Promise.all([
+		relay.listPending(),
+		relay.listGrants(),
+		relay.listApps()
+	]);
+
+	// "Apps you can enable": the hardcoded catalog minus anything already granted
+	// or pending (those show in the sections below).
+	const grantedOrPending = new Set([
+		...(grants?.grants ?? []).map((g) => g.sender),
+		...(pending?.pending ?? []).map((p) => p.sender)
+	]);
+	const discover = (apps ?? []).filter((a) => !grantedOrPending.has(a.did));
 
 	// Be defensive about relay responses — render fallbacks rather than crash.
 	return {
 		pending: pending?.pending ?? [],
-		grants: grants?.grants ?? []
+		grants: grants?.grants ?? [],
+		discover
 	};
 };
diff --git a/apps/web/src/routes/(app)/apps/+page.svelte b/apps/web/src/routes/(app)/apps/+page.svelte
index 361433e..c875a10 100644
--- a/apps/web/src/routes/(app)/apps/+page.svelte
+++ b/apps/web/src/routes/(app)/apps/+page.svelte
@@ -228,4 +228,49 @@
 			</ul>
 		{/if}
 	</section>
+
+	<!-- Apps you can enable (hardcoded catalog) -->
+	{#if data.discover.length > 0}
+		<section class="mt-8">
+			<h2 class="mb-3 font-mono text-[0.7rem] tracking-wide text-muted-2 uppercase">
+				Apps you can enable · {data.discover.length}
+			</h2>
+			<ul class="overflow-hidden rounded-card border border-line bg-surface">
+				{#each data.discover as app, i (app.did)}
+					<li class="p-4 {i < data.discover.length - 1 ? 'border-b border-line-2' : ''}">
+						<div class="flex items-start gap-3">
+							{#if app.iconUrl}
+								<img
+									src={app.iconUrl}
+									alt=""
+									class="size-10 shrink-0 rounded-[0.6rem] bg-surface-2 object-cover"
+								/>
+							{:else}
+								<AppMark id={app.title || app.did} size={40} />
+							{/if}
+							<div class="min-w-0 flex-1">
+								<span class="truncate text-sm font-semibold text-fg">{app.title}</span>
+								<div class="truncate font-mono text-xs text-muted-2" title={app.did}>
+									{shortDid(app.did)}
+								</div>
+								{#if app.description}
+									<p class="mt-1 text-sm leading-relaxed text-muted">{app.description}</p>
+								{/if}
+							</div>
+							<button
+								class="shrink-0 rounded-md bg-accent px-3 py-2 text-sm font-semibold text-accent-fg transition-opacity hover:opacity-90 disabled:opacity-50"
+								disabled={busy[`enable:${app.did}`]}
+								onclick={() => run(`enable:${app.did}`, () => approve({ sender: app.did }))}
+							>
+								{busy[`enable:${app.did}`] ? 'Enabling…' : 'Enable'}
+							</button>
+						</div>
+					</li>
+				{/each}
+			</ul>
+			<p class="mt-2 text-xs text-muted-2">
+				Enabling notifies the app directly — you don't need to visit it first.
+			</p>
+		</section>
+	{/if}
 </div>
diff --git a/packages/lexicons/lexicons/pub/atmo/notify/subscriberChanged.json b/packages/lexicons/lexicons/pub/atmo/notify/subscriberChanged.json
new file mode 100644
index 0000000..c700ebe
--- /dev/null
+++ b/packages/lexicons/lexicons/pub/atmo/notify/subscriberChanged.json
@@ -0,0 +1,42 @@
+{
+  "lexicon": 1,
+  "id": "pub.atmo.notify.subscriberChanged",
+  "defs": {
+    "main": {
+      "type": "procedure",
+      "description": "Relay-authenticated callback an app implements. The relay tells the app that a user's notification subscription to it changed (enabled/disabled). The token's `iss` is the relay DID — the app MUST verify the issuer is the relay, in addition to signature/aud/lxm.",
+      "input": {
+        "encoding": "application/json",
+        "schema": {
+          "type": "object",
+          "required": ["recipient", "enabled"],
+          "properties": {
+            "recipient": {
+              "type": "string",
+              "format": "did",
+              "description": "The user who enabled/disabled notifications from this app."
+            },
+            "enabled": {
+              "type": "boolean",
+              "description": "true = the user granted; false = revoked."
+            },
+            "changedAt": {
+              "type": "string",
+              "format": "datetime",
+              "description": "When the grant changed — lets the app resolve out-of-order callbacks."
+            }
+          }
+        }
+      },
+      "output": {
+        "encoding": "application/json",
+        "schema": {
+          "type": "object",
+          "properties": {
+            "ok": { "type": "boolean" }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/packages/lexicons/src/rpc.ts b/packages/lexicons/src/rpc.ts
index b81a588..3801c68 100644
--- a/packages/lexicons/src/rpc.ts
+++ b/packages/lexicons/src/rpc.ts
@@ -92,6 +92,14 @@ export interface RoutingConfig {
   apps: RoutingApp[];
 }
 
+/** A catalog entry for an app the user can enable from the web (binding-only). */
+export interface AppInfo {
+  did: Did;
+  title: string;
+  description?: string;
+  iconUrl?: string;
+}
+
 export interface NotifsRpc {
   grant(did: Did, input: PubAtmoNotifyGrant.$input): Promise<PubAtmoNotifyGrant.$output>;
   revoke(did: Did, input: PubAtmoNotifyRevoke.$input): Promise<PubAtmoNotifyRevoke.$output>;
@@ -150,4 +158,12 @@ export interface NotifsRpc {
    * CROSS-APP-AUTH.md.
    */
   verifyAppLogin(token: string): Promise<{ did: Did }>;
+
+  /**
+   * The hardcoded catalog of apps a user can enable notifications for from the
+   * web. No leading `did` — the catalog is static. Enabling/disabling is just
+   * `grant`/`revoke`; the relay fires a `subscriberChanged` callback to the app
+   * (ENABLE-FROM-WEB.md).
+   */
+  listApps(): Promise<AppInfo[]>;
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c098336..2f51a9a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -29,6 +29,9 @@ importers:
       '@atcute/crypto':
         specifier: ^2.4.1
         version: 2.4.1
+      '@atcute/identity-resolver':
+        specifier: ^2.0.0
+        version: 2.0.0(@atcute/identity@2.0.0(@atcute/lexicons@2.0.0)(typescript@6.0.3))(@atcute/lexicons@2.0.0)(typescript@6.0.3)
       '@atcute/lexicons':
         specifier: ^2.0.0
         version: 2.0.0
@@ -190,6 +193,9 @@ importers:
       '@atcute/client':
         specifier: ^5.0.0
         version: 5.0.0(@atcute/lexicons@2.0.0)(typescript@5.9.3)
+      '@atcute/crypto':
+        specifier: ^2.4.1
+        version: 2.4.1
       '@atcute/identity-resolver':
         specifier: ^2.0.0
         version: 2.0.0(@atcute/identity@2.0.0(@atcute/lexicons@2.0.0)(typescript@5.9.3))(@atcute/lexicons@2.0.0)(typescript@5.9.3)
@@ -206,9 +212,6 @@ importers:
         specifier: ^5.1.11
         version: 5.1.11
     devDependencies:
-      '@atcute/crypto':
-        specifier: ^2.4.1
-        version: 2.4.1
       '@cloudflare/vitest-pool-workers':
         specifier: ^0.16.9
         version: 0.16.9(@cloudflare/workers-types@4.20260522.1)(@vitest/runner@4.1.7)(@vitest/snapshot@4.1.7)(vitest@4.1.7(@types/node@22.19.19)(vite@8.0.14(@types/node@22.19.19)(esbuild@0.27.3)(jiti@2.7.0)))
-- 
2.51.2