diff --git a/keyserver/src/creators/message-creator.js b/keyserver/src/creators/message-creator.js
index ca77b7be9..84fe5c48d 100644
--- a/keyserver/src/creators/message-creator.js
+++ b/keyserver/src/creators/message-creator.js
@@ -1,700 +1,701 @@
 // @flow
 
 import invariant from 'invariant';
 import _pickBy from 'lodash/fp/pickBy.js';
 
 import { permissionLookup } from 'lib/permissions/thread-permissions.js';
 import {
   rawMessageInfoFromMessageData,
   shimUnsupportedRawMessageInfos,
   stripLocalIDs,
 } from 'lib/shared/message-utils.js';
 import { pushTypes } from 'lib/shared/messages/message-spec.js';
 import type { PushType } from 'lib/shared/messages/message-spec.js';
 import { messageSpecs } from 'lib/shared/messages/message-specs.js';
 import { messageTypes } from 'lib/types/message-types-enum.js';
 import {
   messageDataLocalID,
   type MessageData,
   type RawMessageInfo,
 } from 'lib/types/message-types.js';
 import { redisMessageTypes } from 'lib/types/redis-types.js';
 import { threadPermissions } from 'lib/types/thread-permission-types.js';
 import { updateTypes } from 'lib/types/update-types-enum.js';
 import { promiseAll } from 'lib/utils/promises.js';
 
 import createIDs from './id-creator.js';
 import type { UpdatesForCurrentSession } from './update-creator.js';
 import { createUpdates } from './update-creator.js';
 import {
   dbQuery,
   SQL,
   appendSQLArray,
   mergeOrConditions,
 } from '../database/database.js';
 import { processMessagesForSearch } from '../database/search-utils.js';
 import {
   fetchMessageInfoForLocalID,
   fetchMessageInfoByID,
 } from '../fetchers/message-fetchers.js';
 import { fetchOtherSessionsForViewer } from '../fetchers/session-fetchers.js';
 import { fetchServerThreadInfos } from '../fetchers/thread-fetchers.js';
 import type { Device, PushUserInfo } from '../push/send.js';
 import { sendPushNotifs, sendRescindNotifs } from '../push/send.js';
 import { handleAsyncPromise } from '../responders/handlers.js';
 import type { Viewer } from '../session/viewer.js';
 import { earliestFocusedTimeConsideredExpired } from '../shared/focused-times.js';
 import { publisher } from '../socket/redis.js';
 import { creationString } from '../utils/idempotent.js';
 
 type UserThreadInfo = {
   +devices: Map<string, Device>,
   +threadIDs: Set<string>,
   +notFocusedThreadIDs: Set<string>,
   +userNotMemberOfSubthreads: Set<string>,
   +subthreadsCanSetToUnread: Set<string>,
 };
 
 type LatestMessagesPerUser = Map<
   string,
   $ReadOnlyMap<
     string,
     {
       +latestMessage: string,
       +latestReadMessage?: string,
     },
   >,
 >;
 
 type LatestMessages = $ReadOnlyArray<{
   +userID: string,
   +threadID: string,
   +latestMessage: string,
   +latestReadMessage: ?string,
 }>;
 
 // Does not do permission checks! (checkThreadPermission)
 async function createMessages(
   viewer: Viewer,
   messageDatas: $ReadOnlyArray<MessageData>,
   updatesForCurrentSession?: UpdatesForCurrentSession = 'return',
 ): Promise<RawMessageInfo[]> {
   if (messageDatas.length === 0) {
     return [];
   }
 
   const existingMessages = await Promise.all(
     messageDatas.map(messageData =>
       fetchMessageInfoForLocalID(viewer, messageDataLocalID(messageData)),
     ),
   );
 
   const existingMessageInfos: RawMessageInfo[] = [];
   const newMessageDatas: MessageData[] = [];
   for (let i = 0; i < messageDatas.length; i++) {
     const existingMessage = existingMessages[i];
     if (existingMessage) {
       existingMessageInfos.push(existingMessage);
     } else {
       newMessageDatas.push(messageDatas[i]);
     }
   }
   if (newMessageDatas.length === 0) {
     return shimUnsupportedRawMessageInfos(
       existingMessageInfos,
       viewer.platformDetails,
     );
   }
 
   const ids = await createIDs('messages', newMessageDatas.length);
 
   const returnMessageInfos: RawMessageInfo[] = [];
   const subthreadPermissionsToCheck: Set<string> = new Set();
   const messageInsertRows = [];
 
   // Indices in threadsToMessageIndices point to newMessageInfos
   const newMessageInfos: RawMessageInfo[] = [];
   const threadsToMessageIndices: Map<string, number[]> = new Map();
 
   let nextNewMessageIndex = 0;
   for (let i = 0; i < messageDatas.length; i++) {
     const existingMessage = existingMessages[i];
     if (existingMessage) {
       returnMessageInfos.push(existingMessage);
       continue;
     }
 
     const messageData = messageDatas[i];
     const threadID = messageData.threadID;
     const creatorID = messageData.creatorID;
 
     let messageIndices = threadsToMessageIndices.get(threadID);
     if (!messageIndices) {
       messageIndices = [];
       threadsToMessageIndices.set(threadID, messageIndices);
     }
 
     const newMessageIndex = nextNewMessageIndex++;
     messageIndices.push(newMessageIndex);
 
     const serverID = ids[newMessageIndex];
 
     if (messageData.type === messageTypes.CREATE_SUB_THREAD) {
       subthreadPermissionsToCheck.add(messageData.childThreadID);
     }
 
     const content =
       messageSpecs[messageData.type].messageContentForServerDB?.(messageData);
 
     const creation =
       messageData.localID && viewer.hasSessionInfo
         ? creationString(viewer, messageData.localID)
         : null;
 
     let targetMessageID = null;
     if (messageData.targetMessageID) {
       targetMessageID = messageData.targetMessageID;
     } else if (messageData.sourceMessage) {
       targetMessageID = messageData.sourceMessage.id;
     }
 
     messageInsertRows.push([
       serverID,
       threadID,
       creatorID,
       messageData.type,
       content,
       messageData.time,
       creation,
       targetMessageID,
     ]);
     const rawMessageInfo = rawMessageInfoFromMessageData(messageData, serverID);
     newMessageInfos.push(rawMessageInfo); // at newMessageIndex
     returnMessageInfos.push(rawMessageInfo); // at i
   }
 
   const messageInsertQuery = SQL`
     INSERT INTO messages(id, thread, user, type, content, time,
       creation, target_message)
     VALUES ${messageInsertRows}
   `;
   await dbQuery(messageInsertQuery);
 
   const postMessageSendPromise = postMessageSend(
     viewer,
     threadsToMessageIndices,
     subthreadPermissionsToCheck,
     stripLocalIDs(newMessageInfos),
     newMessageDatas,
     updatesForCurrentSession,
   );
   if (!viewer.isScriptViewer) {
     // If we're not being called from a script, then we avoid awaiting
     // postMessageSendPromise below so that we don't delay the response to the
     // user on external services. In that case, we use handleAsyncPromise to
     // make sure any exceptions are caught and logged.
     handleAsyncPromise(postMessageSendPromise);
   }
 
   await Promise.all([
     updateRepliesCount(threadsToMessageIndices, newMessageDatas),
     viewer.isScriptViewer ? postMessageSendPromise : undefined,
   ]);
 
   if (updatesForCurrentSession !== 'return') {
     return [];
   }
 
   return shimUnsupportedRawMessageInfos(
     returnMessageInfos,
     viewer.platformDetails,
   );
 }
 
 async function updateRepliesCount(
   threadsToMessageIndices: Map<string, number[]>,
   newMessageDatas: MessageData[],
 ) {
   const updatedThreads = [];
 
   const updateThreads = SQL`
     UPDATE threads
     SET replies_count = replies_count + (CASE `;
 
   const membershipConditions = [];
   for (const [threadID, messages] of threadsToMessageIndices.entries()) {
     const newRepliesIncrease = messages
       .map(i => newMessageDatas[i].type)
       .filter(type => messageSpecs[type].includedInRepliesCount).length;
     if (newRepliesIncrease === 0) {
       continue;
     }
 
     updateThreads.append(SQL`
       WHEN id = ${threadID} THEN ${newRepliesIncrease}
     `);
     updatedThreads.push(threadID);
 
     const senders = messages.map(i => newMessageDatas[i].creatorID);
     membershipConditions.push(
       SQL`thread = ${threadID} AND user IN (${senders})`,
     );
   }
   updateThreads.append(SQL`
       ELSE 0
       END)
     WHERE id IN (${updatedThreads})
       AND source_message IS NOT NULL
   `);
 
   const updateMemberships = SQL`
     UPDATE memberships
     SET sender = 1
     WHERE sender = 0 
       AND (
   `;
   updateMemberships.append(mergeOrConditions(membershipConditions));
   updateMemberships.append(SQL`
       )
   `);
 
   if (updatedThreads.length > 0) {
     const [{ threadInfos: serverThreadInfos }] = await Promise.all([
       fetchServerThreadInfos({ threadIDs: new Set(updatedThreads) }),
       dbQuery(updateThreads),
       dbQuery(updateMemberships),
     ]);
 
     const time = Date.now();
     const updates = [];
     for (const threadID in serverThreadInfos) {
       for (const member of serverThreadInfos[threadID].members) {
         updates.push({
           userID: member.id,
           time,
           threadID,
           type: updateTypes.UPDATE_THREAD,
         });
       }
     }
     await createUpdates(updates);
   }
 }
 
 // Handles:
 // (1) Sending push notifs
 // (2) Setting threads to unread and generating corresponding UpdateInfos
 // (3) Publishing to Redis so that active sockets pass on new messages
 // (4) Processing messages for search
 async function postMessageSend(
   viewer: Viewer,
   threadsToMessageIndices: Map<string, number[]>,
   subthreadPermissionsToCheck: Set<string>,
   messageInfos: RawMessageInfo[],
   messageDatas: MessageData[],
   updatesForCurrentSession: UpdatesForCurrentSession,
 ) {
   const processForSearch = processMessagesForSearch(messageInfos);
 
   let joinIndex = 0;
   let subthreadSelects = '';
   const subthreadJoins = [];
   for (const subthread of subthreadPermissionsToCheck) {
     const index = joinIndex++;
     subthreadSelects += `
       ,
       stm${index}.permissions AS subthread${subthread}_permissions,
       stm${index}.role AS subthread${subthread}_role
     `;
     const join = SQL`LEFT JOIN memberships `;
     join.append(`stm${index} ON stm${index}.`);
     join.append(SQL`thread = ${subthread} AND `);
     join.append(`stm${index}.user = m.user`);
     subthreadJoins.push(join);
   }
 
   const time = earliestFocusedTimeConsideredExpired();
   const visibleExtractString = `$.${threadPermissions.VISIBLE}.value`;
   const query = SQL`
     SELECT m.user, m.thread, c.platform, c.device_token, c.versions, c.id,
       f.user AS focused_user
   `;
   query.append(subthreadSelects);
   query.append(SQL`
     FROM memberships m
     LEFT JOIN cookies c ON c.user = m.user AND c.device_token IS NOT NULL
     LEFT JOIN focused f ON f.user = m.user AND f.thread = m.thread
       AND f.time > ${time}
   `);
   appendSQLArray(query, subthreadJoins, SQL` `);
   query.append(SQL`
     WHERE (m.role > 0 OR f.user IS NOT NULL) AND
       JSON_EXTRACT(m.permissions, ${visibleExtractString}) IS TRUE AND
       m.thread IN (${[...threadsToMessageIndices.keys()]})
   `);
 
   const perUserInfo = new Map<string, UserThreadInfo>();
   const [result] = await dbQuery(query);
   for (const row of result) {
     const userID = row.user.toString();
     const threadID = row.thread.toString();
     const deviceToken = row.device_token;
     const focusedUser = !!row.focused_user;
     const { platform } = row;
     const versions = JSON.parse(row.versions);
     const cookieID = row.id;
     let thisUserInfo = perUserInfo.get(userID);
     if (!thisUserInfo) {
       thisUserInfo = {
         devices: new Map(),
         threadIDs: new Set(),
         notFocusedThreadIDs: new Set(),
         userNotMemberOfSubthreads: new Set(),
         subthreadsCanSetToUnread: new Set(),
       };
       perUserInfo.set(userID, thisUserInfo);
       // Subthread info will be the same for each subthread, so we only parse
       // it once
       for (const subthread of subthreadPermissionsToCheck) {
         const isSubthreadMember = row[`subthread${subthread}_role`] > 0;
         const rawSubthreadPermissions =
           row[`subthread${subthread}_permissions`];
         const subthreadPermissions = JSON.parse(rawSubthreadPermissions);
         const canSeeSubthread = permissionLookup(
           subthreadPermissions,
           threadPermissions.KNOW_OF,
         );
         if (!canSeeSubthread) {
           continue;
         }
         thisUserInfo.subthreadsCanSetToUnread.add(subthread);
         // Only include the notification from the superthread if there is no
         // notification from the subthread
         if (
           !isSubthreadMember ||
           !permissionLookup(subthreadPermissions, threadPermissions.VISIBLE)
         ) {
           thisUserInfo.userNotMemberOfSubthreads.add(subthread);
         }
       }
     }
     if (deviceToken && cookieID) {
       thisUserInfo.devices.set(deviceToken, {
         platform,
         deviceToken,
         cookieID: cookieID.toString(),
         codeVersion: versions ? versions.codeVersion : null,
         stateVersion: versions ? versions.stateVersion : null,
+        majorDesktopVersion: versions ? versions.desktopCodeVersion : null,
       });
     }
     thisUserInfo.threadIDs.add(threadID);
     if (!focusedUser) {
       thisUserInfo.notFocusedThreadIDs.add(threadID);
     }
   }
 
   const messageInfosPerUser: {
     [userID: string]: $ReadOnlyArray<RawMessageInfo>,
   } = {};
   const latestMessagesPerUser: LatestMessagesPerUser = new Map();
   const userPushInfoPromises: { [string]: Promise<?PushUserInfo> } = {};
   const userRescindInfoPromises: { [string]: Promise<?PushUserInfo> } = {};
 
   for (const pair of perUserInfo) {
     const [userID, preUserPushInfo] = pair;
 
     const userMessageInfos = [];
     for (const threadID of preUserPushInfo.threadIDs) {
       const messageIndices = threadsToMessageIndices.get(threadID);
       invariant(messageIndices, `indices should exist for thread ${threadID}`);
       for (const messageIndex of messageIndices) {
         const messageInfo = messageInfos[messageIndex];
         userMessageInfos.push(messageInfo);
       }
     }
     if (userMessageInfos.length > 0) {
       messageInfosPerUser[userID] = userMessageInfos;
     }
 
     latestMessagesPerUser.set(
       userID,
       determineLatestMessagesPerThread(
         preUserPushInfo,
         userID,
         threadsToMessageIndices,
         messageInfos,
       ),
     );
 
     const { userNotMemberOfSubthreads } = preUserPushInfo;
     const userDevices = [...preUserPushInfo.devices.values()];
     if (userDevices.length === 0) {
       continue;
     }
 
     const generateNotifUserInfoPromise = async (pushType: PushType) => {
       const promises: Array<
         Promise<?{
           +messageInfo: RawMessageInfo,
           +messageData: MessageData,
         }>,
       > = [];
 
       for (const threadID of preUserPushInfo.notFocusedThreadIDs) {
         const messageIndices = threadsToMessageIndices.get(threadID);
         invariant(
           messageIndices,
           `indices should exist for thread ${threadID}`,
         );
         promises.push(
           ...messageIndices.map(async messageIndex => {
             const messageInfo = messageInfos[messageIndex];
             const { type } = messageInfo;
             if (messageInfo.creatorID === userID) {
               // We never send a user notifs about their own activity
               return undefined;
             }
             const { generatesNotifs } = messageSpecs[type];
             const messageData = messageDatas[messageIndex];
             if (!generatesNotifs) {
               return undefined;
             }
             const doesGenerateNotif = await generatesNotifs(
               messageInfo,
               messageData,
               {
                 notifTargetUserID: userID,
                 userNotMemberOfSubthreads,
                 fetchMessageInfoByID: (messageID: string) =>
                   fetchMessageInfoByID(viewer, messageID),
               },
             );
             return doesGenerateNotif === pushType
               ? { messageInfo, messageData }
               : undefined;
           }),
         );
       }
 
       const messagesToNotify = await Promise.all(promises);
       const filteredMessagesToNotify = messagesToNotify.filter(Boolean);
 
       if (filteredMessagesToNotify.length === 0) {
         return undefined;
       }
 
       return {
         devices: userDevices,
         messageInfos: filteredMessagesToNotify.map(
           ({ messageInfo }) => messageInfo,
         ),
         messageDatas: filteredMessagesToNotify.map(
           ({ messageData }) => messageData,
         ),
       };
     };
 
     const userPushInfoPromise = generateNotifUserInfoPromise(pushTypes.NOTIF);
     const userRescindInfoPromise = generateNotifUserInfoPromise(
       pushTypes.RESCIND,
     );
 
     userPushInfoPromises[userID] = userPushInfoPromise;
     userRescindInfoPromises[userID] = userRescindInfoPromise;
   }
 
   const latestMessages = flattenLatestMessagesPerUser(latestMessagesPerUser);
 
   const [pushInfo, rescindInfo] = await Promise.all([
     promiseAll(userPushInfoPromises),
     promiseAll(userRescindInfoPromises),
     createReadStatusUpdates(latestMessages),
     redisPublish(viewer, messageInfosPerUser, updatesForCurrentSession),
     updateLatestMessages(latestMessages),
     processForSearch,
   ]);
 
   await Promise.all([
     sendPushNotifs(_pickBy(Boolean)(pushInfo)),
     sendRescindNotifs(_pickBy(Boolean)(rescindInfo)),
   ]);
 }
 
 async function redisPublish(
   viewer: Viewer,
   messageInfosPerUser: { [userID: string]: $ReadOnlyArray<RawMessageInfo> },
   updatesForCurrentSession: UpdatesForCurrentSession,
 ) {
   const avoidBroadcastingToCurrentSession =
     viewer.hasSessionInfo && updatesForCurrentSession !== 'broadcast';
   for (const userID in messageInfosPerUser) {
     if (userID === viewer.userID && avoidBroadcastingToCurrentSession) {
       continue;
     }
     const messageInfos = messageInfosPerUser[userID];
     publisher.sendMessage(
       { userID },
       {
         type: redisMessageTypes.NEW_MESSAGES,
         messages: messageInfos,
       },
     );
   }
   const viewerMessageInfos = messageInfosPerUser[viewer.userID];
   if (!viewerMessageInfos || !avoidBroadcastingToCurrentSession) {
     return;
   }
   const sessionIDs = await fetchOtherSessionsForViewer(viewer);
   for (const sessionID of sessionIDs) {
     publisher.sendMessage(
       { userID: viewer.userID, sessionID },
       {
         type: redisMessageTypes.NEW_MESSAGES,
         messages: viewerMessageInfos,
       },
     );
   }
 }
 
 type LatestMessagePerThread = {
   +latestMessage: string,
   +latestReadMessage?: string,
 };
 function determineLatestMessagesPerThread(
   preUserPushInfo: UserThreadInfo,
   userID: string,
   threadsToMessageIndices: $ReadOnlyMap<string, $ReadOnlyArray<number>>,
   messageInfos: $ReadOnlyArray<RawMessageInfo>,
 ): $ReadOnlyMap<string, LatestMessagePerThread> {
   const { threadIDs, notFocusedThreadIDs, subthreadsCanSetToUnread } =
     preUserPushInfo;
   const latestMessagesPerThread = new Map<string, LatestMessagePerThread>();
   for (const threadID of threadIDs) {
     const messageIndices = threadsToMessageIndices.get(threadID);
     invariant(messageIndices, `indices should exist for thread ${threadID}`);
     for (const messageIndex of messageIndices) {
       const messageInfo = messageInfos[messageIndex];
       if (
         messageInfo.type === messageTypes.CREATE_SUB_THREAD &&
         !subthreadsCanSetToUnread.has(messageInfo.childThreadID)
       ) {
         continue;
       }
 
       const messageID = messageInfo.id;
       invariant(
         messageID,
         'message ID should exist in determineLatestMessagesPerThread',
       );
 
       if (
         notFocusedThreadIDs.has(threadID) &&
         messageInfo.creatorID !== userID
       ) {
         latestMessagesPerThread.set(threadID, {
           latestMessage: messageID,
         });
       } else {
         latestMessagesPerThread.set(threadID, {
           latestMessage: messageID,
           latestReadMessage: messageID,
         });
       }
     }
   }
   return latestMessagesPerThread;
 }
 
 function flattenLatestMessagesPerUser(
   latestMessagesPerUser: LatestMessagesPerUser,
 ): LatestMessages {
   const result = [];
   for (const [userID, latestMessagesPerThread] of latestMessagesPerUser) {
     for (const [threadID, latestMessages] of latestMessagesPerThread) {
       result.push({
         userID,
         threadID,
         latestMessage: latestMessages.latestMessage,
         latestReadMessage: latestMessages.latestReadMessage,
       });
     }
   }
   return result;
 }
 
 async function createReadStatusUpdates(latestMessages: LatestMessages) {
   const now = Date.now();
   const readStatusUpdates = latestMessages
     .filter(message => !message.latestReadMessage)
     .map(({ userID, threadID }) => ({
       type: updateTypes.UPDATE_THREAD_READ_STATUS,
       userID,
       time: now,
       threadID,
       unread: true,
     }));
 
   if (readStatusUpdates.length === 0) {
     return;
   }
 
   await createUpdates(readStatusUpdates);
 }
 
 function updateLatestMessages(latestMessages: LatestMessages) {
   if (latestMessages.length === 0) {
     return;
   }
 
   const query = SQL`
     UPDATE memberships
     SET 
   `;
 
   const lastMessageExpression = SQL`
     last_message = GREATEST(last_message, CASE 
   `;
   const lastReadMessageExpression = SQL`
     , last_read_message = GREATEST(last_read_message, CASE 
   `;
   let shouldUpdateLastReadMessage = false;
   for (const {
     userID,
     threadID,
     latestMessage,
     latestReadMessage,
   } of latestMessages) {
     lastMessageExpression.append(SQL`
       WHEN user = ${userID} AND thread = ${threadID} THEN ${latestMessage}
     `);
     if (latestReadMessage) {
       shouldUpdateLastReadMessage = true;
       lastReadMessageExpression.append(SQL`
         WHEN user = ${userID} AND thread = ${threadID} THEN ${latestReadMessage}
       `);
     }
   }
   lastMessageExpression.append(SQL`
     ELSE last_message
     END)
   `);
   lastReadMessageExpression.append(SQL`
     ELSE last_read_message
     END)
   `);
 
   const conditions = latestMessages.map(
     ({ userID, threadID }) => SQL`(user = ${userID} AND thread = ${threadID})`,
   );
 
   query.append(lastMessageExpression);
   if (shouldUpdateLastReadMessage) {
     query.append(lastReadMessageExpression);
   }
   query.append(SQL`WHERE `);
   query.append(mergeOrConditions(conditions));
 
   dbQuery(query);
 }
 
 export default createMessages;
diff --git a/keyserver/src/push/send.js b/keyserver/src/push/send.js
index 3abb6dbee..16e0f4686 100644
--- a/keyserver/src/push/send.js
+++ b/keyserver/src/push/send.js
@@ -1,1740 +1,1797 @@
 // @flow
 
 import apn from '@parse/node-apn';
 import type { ResponseFailure } from '@parse/node-apn';
 import invariant from 'invariant';
 import _cloneDeep from 'lodash/fp/cloneDeep.js';
 import _flow from 'lodash/fp/flow.js';
 import _groupBy from 'lodash/fp/groupBy.js';
 import _mapValues from 'lodash/fp/mapValues.js';
 import _pickBy from 'lodash/fp/pickBy.js';
 import type { QueryResults } from 'mysql';
 import t from 'tcomb';
 import uuidv4 from 'uuid/v4.js';
 
 import { oldValidUsernameRegex } from 'lib/shared/account-utils.js';
 import { isUserMentioned } from 'lib/shared/mention-utils.js';
 import {
   createMessageInfo,
   sortMessageInfoList,
   shimUnsupportedRawMessageInfos,
 } from 'lib/shared/message-utils.js';
 import { messageSpecs } from 'lib/shared/messages/message-specs.js';
 import { notifTextsForMessageInfo } from 'lib/shared/notif-utils.js';
 import { isStaff } from 'lib/shared/staff-utils.js';
 import {
   rawThreadInfoFromServerThreadInfo,
   threadInfoFromRawThreadInfo,
 } from 'lib/shared/thread-utils.js';
-import { hasMinCodeVersion } from 'lib/shared/version-utils.js';
+import {
+  hasMinCodeVersion,
+  NEXT_CODE_VERSION,
+} from 'lib/shared/version-utils.js';
 import type { Platform, PlatformDetails } from 'lib/types/device-types.js';
 import { messageTypes } from 'lib/types/message-types-enum.js';
 import {
   type RawMessageInfo,
   type MessageData,
 } from 'lib/types/message-types.js';
 import { rawMessageInfoValidator } from 'lib/types/message-types.js';
 import type {
   WNSNotification,
   ResolvedNotifTexts,
 } from 'lib/types/notif-types.js';
 import { resolvedNotifTextsValidator } from 'lib/types/notif-types.js';
 import type { ServerThreadInfo, ThreadInfo } from 'lib/types/thread-types.js';
 import { updateTypes } from 'lib/types/update-types-enum.js';
 import { type GlobalUserInfo } from 'lib/types/user-types.js';
 import { isDev } from 'lib/utils/dev-utils.js';
 import { values } from 'lib/utils/objects.js';
 import { tID, tPlatformDetails, tShape } from 'lib/utils/validation-utils.js';
 
 import {
   prepareEncryptedAPNsNotifications,
   prepareEncryptedAndroidNotifications,
   prepareEncryptedWebNotifications,
 } from './crypto.js';
 import { getAPNsNotificationTopic } from './providers.js';
 import { rescindPushNotifs } from './rescind.js';
 import type {
   NotificationTargetDevice,
   TargetedAPNsNotification,
   TargetedAndroidNotification,
   TargetedWebNotification,
   TargetedWNSNotification,
   AndroidNotification,
 } from './types.js';
 import {
   apnPush,
   fcmPush,
   getUnreadCounts,
   apnMaxNotificationPayloadByteSize,
   fcmMaxNotificationPayloadByteSize,
   wnsMaxNotificationPayloadByteSize,
   webPush,
   wnsPush,
   type WebPushError,
   type WNSPushError,
 } from './utils.js';
 import createIDs from '../creators/id-creator.js';
 import { createUpdates } from '../creators/update-creator.js';
 import { dbQuery, SQL, mergeOrConditions } from '../database/database.js';
 import type { CollapsableNotifInfo } from '../fetchers/message-fetchers.js';
 import { fetchCollapsableNotifs } from '../fetchers/message-fetchers.js';
 import { fetchServerThreadInfos } from '../fetchers/thread-fetchers.js';
 import { fetchUserInfos } from '../fetchers/user-fetchers.js';
 import type { Viewer } from '../session/viewer.js';
 import { getENSNames } from '../utils/ens-cache.js';
 import { validateOutput } from '../utils/validation-utils.js';
 
 export type Device = {
   +platform: Platform,
   +deviceToken: string,
   +cookieID: string,
   +codeVersion: ?number,
   +stateVersion: ?number,
+  +majorDesktopVersion: ?number,
 };
 
 export type PushUserInfo = {
   +devices: Device[],
   // messageInfos and messageDatas have the same key
   +messageInfos: RawMessageInfo[],
   +messageDatas: MessageData[],
 };
 type Delivery = PushDelivery | { collapsedInto: string };
 type NotificationRow = {
   +dbID: string,
   +userID: string,
   +threadID?: ?string,
   +messageID?: ?string,
   +collapseKey?: ?string,
   +deliveries: Delivery[],
 };
 export type PushInfo = { [userID: string]: PushUserInfo };
 
 async function sendPushNotifs(pushInfo: PushInfo) {
   if (Object.keys(pushInfo).length === 0) {
     return;
   }
 
   const [
     unreadCounts,
     { usersToCollapsableNotifInfo, serverThreadInfos, userInfos },
     dbIDs,
   ] = await Promise.all([
     getUnreadCounts(Object.keys(pushInfo)),
     fetchInfos(pushInfo),
     createDBIDs(pushInfo),
   ]);
 
   const preparePromises: Array<Promise<?$ReadOnlyArray<PreparePushResult>>> =
     [];
   const notifications: Map<string, NotificationRow> = new Map();
   for (const userID in usersToCollapsableNotifInfo) {
     const threadInfos = _flow(
       _mapValues((serverThreadInfo: ServerThreadInfo) => {
         const rawThreadInfo = rawThreadInfoFromServerThreadInfo(
           serverThreadInfo,
           userID,
         );
         if (!rawThreadInfo) {
           return null;
         }
         return threadInfoFromRawThreadInfo(rawThreadInfo, userID, userInfos);
       }),
       _pickBy(threadInfo => threadInfo),
     )(serverThreadInfos);
     for (const notifInfo of usersToCollapsableNotifInfo[userID]) {
       preparePromises.push(
         preparePushNotif({
           notifInfo,
           userID,
           pushUserInfo: pushInfo[userID],
           unreadCount: unreadCounts[userID],
           threadInfos,
           userInfos,
           dbIDs,
           rowsToSave: notifications,
         }),
       );
     }
   }
 
   const prepareResults = await Promise.all(preparePromises);
   const flattenedPrepareResults = prepareResults.filter(Boolean).flat();
 
   const deliveryResults = await deliverPushNotifsInEncryptionOrder(
     flattenedPrepareResults,
   );
   const cleanUpPromise = (async () => {
     if (dbIDs.length === 0) {
       return;
     }
     const query = SQL`DELETE FROM ids WHERE id IN (${dbIDs})`;
     await dbQuery(query);
   })();
 
   await Promise.all([
     cleanUpPromise,
     saveNotifResults(deliveryResults, notifications, true),
   ]);
 }
 
 type PreparePushResult = {
   +platform: Platform,
   +notificationInfo: NotificationInfo,
   +notification:
     | TargetedAPNsNotification
     | TargetedAndroidNotification
     | TargetedWebNotification
     | TargetedWNSNotification,
 };
 
 async function preparePushNotif(input: {
   notifInfo: CollapsableNotifInfo,
   userID: string,
   pushUserInfo: PushUserInfo,
   unreadCount: number,
   threadInfos: { +[threadID: string]: ThreadInfo },
   userInfos: { +[userID: string]: GlobalUserInfo },
   dbIDs: string[], // mutable
   rowsToSave: Map<string, NotificationRow>, // mutable
 }): Promise<?$ReadOnlyArray<PreparePushResult>> {
   const {
     notifInfo,
     userID,
     pushUserInfo,
     unreadCount,
     threadInfos,
     userInfos,
     dbIDs,
     rowsToSave,
   } = input;
 
   const hydrateMessageInfo = (rawMessageInfo: RawMessageInfo) =>
     createMessageInfo(rawMessageInfo, userID, userInfos, threadInfos);
   const newMessageInfos = [];
   const newRawMessageInfos = [];
   for (const newRawMessageInfo of notifInfo.newMessageInfos) {
     const newMessageInfo = hydrateMessageInfo(newRawMessageInfo);
     if (newMessageInfo) {
       newMessageInfos.push(newMessageInfo);
       newRawMessageInfos.push(newRawMessageInfo);
     }
   }
   if (newMessageInfos.length === 0) {
     return null;
   }
   const existingMessageInfos = notifInfo.existingMessageInfos
     .map(hydrateMessageInfo)
     .filter(Boolean);
   const allMessageInfos = sortMessageInfoList([
     ...newMessageInfos,
     ...existingMessageInfos,
   ]);
   const [firstNewMessageInfo, ...remainingNewMessageInfos] = newMessageInfos;
   const { threadID } = firstNewMessageInfo;
 
   const threadInfo = threadInfos[threadID];
   const parentThreadInfo = threadInfo.parentThreadID
     ? threadInfos[threadInfo.parentThreadID]
     : null;
   const updateBadge = threadInfo.currentUser.subscription.home;
   const displayBanner = threadInfo.currentUser.subscription.pushNotifs;
   const username = userInfos[userID] && userInfos[userID].username;
   const userWasMentioned =
     username &&
     threadInfo.currentUser.role &&
     oldValidUsernameRegex.test(username) &&
     newMessageInfos.some(newMessageInfo => {
       const unwrappedMessageInfo =
         newMessageInfo.type === messageTypes.SIDEBAR_SOURCE
           ? newMessageInfo.sourceMessage
           : newMessageInfo;
       return (
         unwrappedMessageInfo.type === messageTypes.TEXT &&
         isUserMentioned(username, unwrappedMessageInfo.text)
       );
     });
   if (!updateBadge && !displayBanner && !userWasMentioned) {
     return null;
   }
   const badgeOnly = !displayBanner && !userWasMentioned;
 
   const notifTargetUserInfo = { id: userID, username };
   const notifTexts = await notifTextsForMessageInfo(
     allMessageInfos,
     threadInfo,
     parentThreadInfo,
     notifTargetUserInfo,
     getENSNames,
   );
   if (!notifTexts) {
     return null;
   }
 
   const dbID = dbIDs.shift();
   invariant(dbID, 'should have sufficient DB IDs');
   const byPlatform = getDevicesByPlatform(pushUserInfo.devices);
   const firstMessageID = firstNewMessageInfo.id;
   invariant(firstMessageID, 'RawMessageInfo.id should be set on server');
   const notificationInfo = {
     source: 'new_message',
     dbID,
     userID,
     threadID,
     messageID: firstMessageID,
     collapseKey: notifInfo.collapseKey,
   };
 
   const preparePromises: Array<Promise<$ReadOnlyArray<PreparePushResult>>> = [];
 
   const iosVersionsToTokens = byPlatform.get('ios');
   if (iosVersionsToTokens) {
     for (const [versionKey, devices] of iosVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
 
       const platformDetails: PlatformDetails = {
         platform: 'ios',
         codeVersion,
         stateVersion,
       };
       const shimmedNewRawMessageInfos = shimUnsupportedRawMessageInfos(
         newRawMessageInfos,
         platformDetails,
       );
       const preparePromise: Promise<$ReadOnlyArray<PreparePushResult>> =
         (async () => {
           const targetedNotifications = await prepareAPNsNotification(
+            userID,
             {
               notifTexts,
               newRawMessageInfos: shimmedNewRawMessageInfos,
               threadID: threadInfo.id,
               collapseKey: notifInfo.collapseKey,
               badgeOnly,
               unreadCount,
               platformDetails,
             },
             devices,
           );
           return targetedNotifications.map(notification => ({
             notification,
             platform: 'ios',
             notificationInfo: {
               ...notificationInfo,
               codeVersion,
               stateVersion,
             },
           }));
         })();
       preparePromises.push(preparePromise);
     }
   }
   const androidVersionsToTokens = byPlatform.get('android');
   if (androidVersionsToTokens) {
     for (const [versionKey, devices] of androidVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const platformDetails = {
         platform: 'android',
         codeVersion,
         stateVersion,
       };
       const shimmedNewRawMessageInfos = shimUnsupportedRawMessageInfos(
         newRawMessageInfos,
         platformDetails,
       );
       const preparePromise: Promise<$ReadOnlyArray<PreparePushResult>> =
         (async () => {
           const targetedNotifications = await prepareAndroidNotification(
             {
               notifTexts,
               newRawMessageInfos: shimmedNewRawMessageInfos,
               threadID: threadInfo.id,
               collapseKey: notifInfo.collapseKey,
               badgeOnly,
               unreadCount,
               platformDetails,
               dbID,
             },
             devices,
           );
           return targetedNotifications.map(notification => ({
             notification,
             platform: 'android',
             notificationInfo: {
               ...notificationInfo,
               codeVersion,
               stateVersion,
             },
           }));
         })();
       preparePromises.push(preparePromise);
     }
   }
   const webVersionsToTokens = byPlatform.get('web');
   if (webVersionsToTokens) {
     for (const [versionKey, devices] of webVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const platformDetails = {
         platform: 'web',
         codeVersion,
         stateVersion,
       };
 
       const preparePromise: Promise<$ReadOnlyArray<PreparePushResult>> =
         (async () => {
           const targetedNotifications = await prepareWebNotification(
             userID,
             {
               notifTexts,
               threadID: threadInfo.id,
               unreadCount,
               platformDetails,
             },
             devices,
           );
 
           return targetedNotifications.map(notification => ({
             notification,
             platform: 'web',
             notificationInfo: {
               ...notificationInfo,
               codeVersion,
               stateVersion,
             },
           }));
         })();
       preparePromises.push(preparePromise);
     }
   }
   const macosVersionsToTokens = byPlatform.get('macos');
   if (macosVersionsToTokens) {
     for (const [versionKey, devices] of macosVersionsToTokens) {
-      const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
+      const { codeVersion, stateVersion, majorDesktopVersion } =
+        stringToVersionKey(versionKey);
       const platformDetails = {
         platform: 'macos',
         codeVersion,
         stateVersion,
+        majorDesktopVersion,
       };
       const shimmedNewRawMessageInfos = shimUnsupportedRawMessageInfos(
         newRawMessageInfos,
         platformDetails,
       );
       const preparePromise: Promise<$ReadOnlyArray<PreparePushResult>> =
         (async () => {
           const targetedNotifications = await prepareAPNsNotification(
+            userID,
             {
               notifTexts,
               newRawMessageInfos: shimmedNewRawMessageInfos,
               threadID: threadInfo.id,
               collapseKey: notifInfo.collapseKey,
               badgeOnly,
               unreadCount,
               platformDetails,
             },
             devices,
           );
           return targetedNotifications.map(notification => ({
             notification,
             platform: 'macos',
             notificationInfo: {
               ...notificationInfo,
               codeVersion,
               stateVersion,
             },
           }));
         })();
       preparePromises.push(preparePromise);
     }
   }
   const windowsVersionsToTokens = byPlatform.get('windows');
   if (windowsVersionsToTokens) {
     for (const [versionKey, devices] of windowsVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const platformDetails = {
         platform: 'windows',
         codeVersion,
         stateVersion,
       };
 
       const preparePromise: Promise<$ReadOnlyArray<PreparePushResult>> =
         (async () => {
           const notification = await prepareWNSNotification({
             notifTexts,
             threadID: threadInfo.id,
             unreadCount,
             platformDetails,
           });
 
           return devices.map(({ deviceToken }) => ({
             notification: ({
               deviceToken,
               notification,
             }: TargetedWNSNotification),
             platform: 'windows',
             notificationInfo: {
               ...notificationInfo,
               codeVersion,
               stateVersion,
             },
           }));
         })();
       preparePromises.push(preparePromise);
     }
   }
 
   for (const newMessageInfo of remainingNewMessageInfos) {
     const newDBID = dbIDs.shift();
     invariant(newDBID, 'should have sufficient DB IDs');
     const messageID = newMessageInfo.id;
     invariant(messageID, 'RawMessageInfo.id should be set on server');
     rowsToSave.set(newDBID, {
       dbID: newDBID,
       userID,
       threadID: newMessageInfo.threadID,
       messageID,
       collapseKey: notifInfo.collapseKey,
       deliveries: [{ collapsedInto: dbID }],
     });
   }
 
   const prepareResults = await Promise.all(preparePromises);
   return prepareResults.flat();
 }
 
 // For better readability we don't differentiate between
 // encrypted and unencrypted notifs and order them together
 function compareEncryptionOrder(
   pushNotif1: PreparePushResult,
   pushNotif2: PreparePushResult,
 ): number {
   const order1 = pushNotif1.notification.encryptionOrder ?? 0;
   const order2 = pushNotif2.notification.encryptionOrder ?? 0;
   return order1 - order2;
 }
 
 async function deliverPushNotifsInEncryptionOrder(
   preparedPushNotifs: $ReadOnlyArray<PreparePushResult>,
 ): Promise<$ReadOnlyArray<PushResult>> {
   const deliveryPromises: Array<Promise<$ReadOnlyArray<PushResult>>> = [];
 
   const groupedByDevice = _groupBy(
     preparedPushNotif => preparedPushNotif.deviceToken,
   )(preparedPushNotifs);
 
   for (const preparedPushNotifsForDevice of values(groupedByDevice)) {
     const orderedPushNotifsForDevice = preparedPushNotifsForDevice.sort(
       compareEncryptionOrder,
     );
 
     const deviceDeliveryPromise = (async () => {
       const deliveries = [];
       for (const preparedPushNotif of orderedPushNotifsForDevice) {
         const { platform, notification, notificationInfo } = preparedPushNotif;
         let delivery: PushResult;
         if (platform === 'ios' || platform === 'macos') {
           delivery = await sendAPNsNotification(
             platform,
             [notification],
             notificationInfo,
           );
         } else if (platform === 'android') {
           delivery = await sendAndroidNotification(
             [notification],
             notificationInfo,
           );
         } else if (platform === 'web') {
           delivery = await sendWebNotifications(
             [notification],
             notificationInfo,
           );
         } else if (platform === 'windows') {
           delivery = await sendWNSNotification(
             [notification],
             notificationInfo,
           );
         }
         if (delivery) {
           deliveries.push(delivery);
         }
       }
       return deliveries;
     })();
     deliveryPromises.push(deviceDeliveryPromise);
   }
 
   const deliveryResults = await Promise.all(deliveryPromises);
   return deliveryResults.flat();
 }
 
 async function sendRescindNotifs(rescindInfo: PushInfo) {
   if (Object.keys(rescindInfo).length === 0) {
     return;
   }
 
   const usersToCollapsableNotifInfo = await fetchCollapsableNotifs(rescindInfo);
 
   const promises = [];
   for (const userID in usersToCollapsableNotifInfo) {
     for (const notifInfo of usersToCollapsableNotifInfo[userID]) {
       for (const existingMessageInfo of notifInfo.existingMessageInfos) {
         const rescindCondition = SQL`
           n.user = ${userID} AND
           n.thread = ${existingMessageInfo.threadID} AND
           n.message = ${existingMessageInfo.id}
         `;
 
         promises.push(rescindPushNotifs(rescindCondition));
       }
     }
   }
 
   await Promise.all(promises);
 }
 
 // The results in deliveryResults will be combined with the rows
 // in rowsToSave and then written to the notifications table
 async function saveNotifResults(
   deliveryResults: $ReadOnlyArray<PushResult>,
   inputRowsToSave: Map<string, NotificationRow>,
   rescindable: boolean,
 ) {
   const rowsToSave = new Map(inputRowsToSave);
 
   const allInvalidTokens = [];
   for (const deliveryResult of deliveryResults) {
     const { info, delivery, invalidTokens } = deliveryResult;
     const { dbID, userID } = info;
     const curNotifRow = rowsToSave.get(dbID);
     if (curNotifRow) {
       curNotifRow.deliveries.push(delivery);
     } else {
       // Ternary expressions for Flow
       const threadID = info.threadID ? info.threadID : null;
       const messageID = info.messageID ? info.messageID : null;
       const collapseKey = info.collapseKey ? info.collapseKey : null;
       rowsToSave.set(dbID, {
         dbID,
         userID,
         threadID,
         messageID,
         collapseKey,
         deliveries: [delivery],
       });
     }
     if (invalidTokens) {
       allInvalidTokens.push({
         userID,
         tokens: invalidTokens,
       });
     }
   }
 
   const notificationRows = [];
   for (const notification of rowsToSave.values()) {
     notificationRows.push([
       notification.dbID,
       notification.userID,
       notification.threadID,
       notification.messageID,
       notification.collapseKey,
       JSON.stringify(notification.deliveries),
       Number(!rescindable),
     ]);
   }
 
   const dbPromises: Array<Promise<mixed>> = [];
   if (allInvalidTokens.length > 0) {
     dbPromises.push(removeInvalidTokens(allInvalidTokens));
   }
   if (notificationRows.length > 0) {
     const query = SQL`
       INSERT INTO notifications
         (id, user, thread, message, collapse_key, delivery, rescinded)
       VALUES ${notificationRows}
     `;
     dbPromises.push(dbQuery(query));
   }
   if (dbPromises.length > 0) {
     await Promise.all(dbPromises);
   }
 }
 
 async function fetchInfos(pushInfo: PushInfo) {
   const usersToCollapsableNotifInfo = await fetchCollapsableNotifs(pushInfo);
 
   const threadIDs = new Set<string>();
   const threadWithChangedNamesToMessages = new Map<string, Array<string>>();
   const addThreadIDsFromMessageInfos = (rawMessageInfo: RawMessageInfo) => {
     const threadID = rawMessageInfo.threadID;
     threadIDs.add(threadID);
     const messageSpec = messageSpecs[rawMessageInfo.type];
     if (messageSpec.threadIDs) {
       for (const id of messageSpec.threadIDs(rawMessageInfo)) {
         threadIDs.add(id);
       }
     }
     if (
       rawMessageInfo.type === messageTypes.CHANGE_SETTINGS &&
       rawMessageInfo.field === 'name'
     ) {
       const messages = threadWithChangedNamesToMessages.get(threadID);
       if (messages) {
         messages.push(rawMessageInfo.id);
       } else {
         threadWithChangedNamesToMessages.set(threadID, [rawMessageInfo.id]);
       }
     }
   };
   for (const userID in usersToCollapsableNotifInfo) {
     for (const notifInfo of usersToCollapsableNotifInfo[userID]) {
       for (const rawMessageInfo of notifInfo.existingMessageInfos) {
         addThreadIDsFromMessageInfos(rawMessageInfo);
       }
       for (const rawMessageInfo of notifInfo.newMessageInfos) {
         addThreadIDsFromMessageInfos(rawMessageInfo);
       }
     }
   }
 
   // These threadInfos won't have currentUser set
   const threadPromise = fetchServerThreadInfos({ threadIDs });
 
   const oldNamesPromise: Promise<?QueryResults> = (async () => {
     if (threadWithChangedNamesToMessages.size === 0) {
       return undefined;
     }
     const typesThatAffectName = [
       messageTypes.CHANGE_SETTINGS,
       messageTypes.CREATE_THREAD,
     ];
     const oldNameQuery = SQL`
       SELECT IF(
         JSON_TYPE(JSON_EXTRACT(m.content, "$.name")) = 'NULL',
         "",
         JSON_UNQUOTE(JSON_EXTRACT(m.content, "$.name"))
       ) AS name, m.thread
       FROM (
         SELECT MAX(id) AS id
         FROM messages
         WHERE type IN (${typesThatAffectName})
           AND JSON_EXTRACT(content, "$.name") IS NOT NULL
           AND`;
     const threadClauses = [];
     for (const [threadID, messages] of threadWithChangedNamesToMessages) {
       threadClauses.push(
         SQL`(thread = ${threadID} AND id NOT IN (${messages}))`,
       );
     }
     oldNameQuery.append(mergeOrConditions(threadClauses));
     oldNameQuery.append(SQL`
         GROUP BY thread
       ) x
       LEFT JOIN messages m ON m.id = x.id
     `);
     return await dbQuery(oldNameQuery);
   })();
 
   const [threadResult, oldNames] = await Promise.all([
     threadPromise,
     oldNamesPromise,
   ]);
   const serverThreadInfos = { ...threadResult.threadInfos };
   if (oldNames) {
     const [result] = oldNames;
     for (const row of result) {
       const threadID = row.thread.toString();
       serverThreadInfos[threadID] = {
         ...serverThreadInfos[threadID],
         name: row.name,
       };
     }
   }
 
   const userInfos = await fetchNotifUserInfos(
     serverThreadInfos,
     usersToCollapsableNotifInfo,
   );
 
   return { usersToCollapsableNotifInfo, serverThreadInfos, userInfos };
 }
 
 async function fetchNotifUserInfos(
   serverThreadInfos: { +[threadID: string]: ServerThreadInfo },
   usersToCollapsableNotifInfo: { +[userID: string]: CollapsableNotifInfo[] },
 ) {
   const missingUserIDs = new Set<string>();
 
   for (const threadID in serverThreadInfos) {
     const serverThreadInfo = serverThreadInfos[threadID];
     for (const member of serverThreadInfo.members) {
       missingUserIDs.add(member.id);
     }
   }
 
   const addUserIDsFromMessageInfos = (rawMessageInfo: RawMessageInfo) => {
     missingUserIDs.add(rawMessageInfo.creatorID);
     const userIDs =
       messageSpecs[rawMessageInfo.type].userIDs?.(rawMessageInfo) ?? [];
     for (const userID of userIDs) {
       missingUserIDs.add(userID);
     }
   };
 
   for (const userID in usersToCollapsableNotifInfo) {
     missingUserIDs.add(userID);
     for (const notifInfo of usersToCollapsableNotifInfo[userID]) {
       for (const rawMessageInfo of notifInfo.existingMessageInfos) {
         addUserIDsFromMessageInfos(rawMessageInfo);
       }
       for (const rawMessageInfo of notifInfo.newMessageInfos) {
         addUserIDsFromMessageInfos(rawMessageInfo);
       }
     }
   }
 
   return await fetchUserInfos([...missingUserIDs]);
 }
 
 async function createDBIDs(pushInfo: PushInfo): Promise<string[]> {
   let numIDsNeeded = 0;
   for (const userID in pushInfo) {
     numIDsNeeded += pushInfo[userID].messageInfos.length;
   }
   return await createIDs('notifications', numIDsNeeded);
 }
 
-type VersionKey = { codeVersion: number, stateVersion: number };
+type VersionKey = {
+  +codeVersion: number,
+  +stateVersion: number,
+  +majorDesktopVersion?: number,
+};
 const versionKeyRegex: RegExp = new RegExp(/^-?\d+\|-?\d+$/);
 function versionKeyToString(versionKey: VersionKey): string {
-  return `${versionKey.codeVersion}|${versionKey.stateVersion}`;
+  const baseStringVersionKey = `${versionKey.codeVersion}|${versionKey.stateVersion}`;
+  if (!versionKey.majorDesktopVersion) {
+    return baseStringVersionKey;
+  }
+  return `${baseStringVersionKey}|${versionKey.majorDesktopVersion}`;
 }
 
 function stringToVersionKey(versionKeyString: string): VersionKey {
   invariant(
     versionKeyRegex.test(versionKeyString),
     'should pass correct version key string',
   );
-  const [codeVersion, stateVersion] = versionKeyString.split('|').map(Number);
-  return { codeVersion, stateVersion };
+  const [codeVersion, stateVersion, majorDesktopVersion] = versionKeyString
+    .split('|')
+    .map(Number);
+  return { codeVersion, stateVersion, majorDesktopVersion };
 }
 
 function getDevicesByPlatform(
   devices: $ReadOnlyArray<Device>,
 ): Map<Platform, Map<string, Array<NotificationTargetDevice>>> {
   const byPlatform = new Map<
     Platform,
     Map<string, Array<NotificationTargetDevice>>,
   >();
   for (const device of devices) {
     let innerMap = byPlatform.get(device.platform);
     if (!innerMap) {
       innerMap = new Map<string, Array<NotificationTargetDevice>>();
       byPlatform.set(device.platform, innerMap);
     }
     const codeVersion: number =
-      device.codeVersion !== null &&
-      device.codeVersion !== undefined &&
-      device.platform !== 'windows' &&
-      device.platform !== 'macos'
+      device.codeVersion !== null && device.codeVersion !== undefined
         ? device.codeVersion
         : -1;
     const stateVersion: number = device.stateVersion ?? -1;
 
-    const versionKey = versionKeyToString({
-      codeVersion,
-      stateVersion,
-    });
+    let versionsObject = { codeVersion, stateVersion };
+    if (device.majorDesktopVersion) {
+      versionsObject = {
+        ...versionsObject,
+        majorDesktopVersion: device.majorDesktopVersion,
+      };
+    }
+
+    const versionKey = versionKeyToString(versionsObject);
     let innerMostArrayTmp: ?Array<NotificationTargetDevice> =
       innerMap.get(versionKey);
     if (!innerMostArrayTmp) {
       innerMostArrayTmp = [];
       innerMap.set(versionKey, innerMostArrayTmp);
     }
     const innerMostArray = innerMostArrayTmp;
 
     innerMostArray.push({
       cookieID: device.cookieID,
       deviceToken: device.deviceToken,
     });
   }
   return byPlatform;
 }
 
 type APNsNotifInputData = {
   +notifTexts: ResolvedNotifTexts,
   +newRawMessageInfos: RawMessageInfo[],
   +threadID: string,
   +collapseKey: ?string,
   +badgeOnly: boolean,
   +unreadCount: number,
   +platformDetails: PlatformDetails,
 };
 const apnsNotifInputDataValidator = tShape<APNsNotifInputData>({
   notifTexts: resolvedNotifTextsValidator,
   newRawMessageInfos: t.list(rawMessageInfoValidator),
   threadID: tID,
   collapseKey: t.maybe(t.String),
   badgeOnly: t.Boolean,
   unreadCount: t.Number,
   platformDetails: tPlatformDetails,
 });
 async function prepareAPNsNotification(
+  userID: string,
   inputData: APNsNotifInputData,
   devices: $ReadOnlyArray<NotificationTargetDevice>,
 ): Promise<$ReadOnlyArray<TargetedAPNsNotification>> {
   const convertedData = validateOutput(
     inputData.platformDetails,
     apnsNotifInputDataValidator,
     inputData,
   );
   const {
     notifTexts,
     newRawMessageInfos,
     threadID,
     collapseKey,
     badgeOnly,
     unreadCount,
     platformDetails,
   } = convertedData;
 
   const canDecryptNonCollapsibleTextNotifs =
     platformDetails.codeVersion && platformDetails.codeVersion > 222;
 
   const isNonCollapsibleTextNotification =
     newRawMessageInfos.every(
       newRawMessageInfo => newRawMessageInfo.type === messageTypes.TEXT,
     ) && !collapseKey;
 
   const canDecryptAllNotifTypes =
     platformDetails.codeVersion && platformDetails.codeVersion >= 267;
 
-  const shouldBeEncrypted =
+  const canDecryptIOSNotifs =
     platformDetails.platform === 'ios' &&
     (canDecryptAllNotifTypes ||
       (isNonCollapsibleTextNotification && canDecryptNonCollapsibleTextNotifs));
 
+  const isStaffOrDev = isStaff(userID) || isDev;
+  const canDecryptMacOSNotifs =
+    isStaffOrDev &&
+    platformDetails.platform === 'macos' &&
+    hasMinCodeVersion(platformDetails, {
+      web: NEXT_CODE_VERSION,
+      majorDesktop: NEXT_CODE_VERSION,
+    });
+
+  const shouldBeEncrypted = canDecryptIOSNotifs || canDecryptMacOSNotifs;
+
   const uniqueID = uuidv4();
   const notification = new apn.Notification();
   notification.topic = getAPNsNotificationTopic(platformDetails);
 
   const { merged, ...rest } = notifTexts;
   // We don't include alert's body on macos because we
   // handle displaying the notification ourselves and
   // we don't want macOS to display it automatically.
   if (!badgeOnly && platformDetails.platform !== 'macos') {
     notification.body = merged;
     notification.sound = 'default';
   }
   notification.payload = {
     ...notification.payload,
     ...rest,
   };
 
   notification.badge = unreadCount;
   notification.threadId = threadID;
   notification.id = uniqueID;
   notification.pushType = 'alert';
   notification.payload.id = uniqueID;
   notification.payload.threadID = threadID;
 
   if (platformDetails.codeVersion && platformDetails.codeVersion > 198) {
     notification.mutableContent = true;
   }
   if (collapseKey && canDecryptAllNotifTypes) {
     notification.payload.collapseID = collapseKey;
   } else if (collapseKey) {
     notification.collapseId = collapseKey;
   }
   const messageInfos = JSON.stringify(newRawMessageInfos);
   // We make a copy before checking notification's length, because calling
   // length compiles the notification and makes it immutable. Further
   // changes to its properties won't be reflected in the final plaintext
   // data that is sent.
   const copyWithMessageInfos = _cloneDeep(notification);
   copyWithMessageInfos.payload = {
     ...copyWithMessageInfos.payload,
     messageInfos,
   };
 
   const notificationSizeValidator = (notif: apn.Notification) =>
     notif.length() <= apnMaxNotificationPayloadByteSize;
 
   if (!shouldBeEncrypted) {
     const notificationToSend = notificationSizeValidator(
       _cloneDeep(copyWithMessageInfos),
     )
       ? copyWithMessageInfos
       : notification;
     return devices.map(({ deviceToken }) => ({
       notification: notificationToSend,
       deviceToken,
     }));
   }
 
   const notifsWithMessageInfos = await prepareEncryptedAPNsNotifications(
     devices,
     copyWithMessageInfos,
     platformDetails.codeVersion,
     notificationSizeValidator,
   );
 
   const devicesWithExcessiveSize = notifsWithMessageInfos
     .filter(({ payloadSizeExceeded }) => payloadSizeExceeded)
     .map(({ deviceToken, cookieID }) => ({ deviceToken, cookieID }));
 
   if (devicesWithExcessiveSize.length === 0) {
     return notifsWithMessageInfos.map(
       ({
         notification: notif,
         deviceToken,
         encryptedPayloadHash,
         encryptionOrder,
       }) => ({
         notification: notif,
         deviceToken,
         encryptedPayloadHash,
         encryptionOrder,
       }),
     );
   }
 
   const notifsWithoutMessageInfos = await prepareEncryptedAPNsNotifications(
     devicesWithExcessiveSize,
     notification,
     platformDetails.codeVersion,
   );
 
   const targetedNotifsWithMessageInfos = notifsWithMessageInfos
     .filter(({ payloadSizeExceeded }) => !payloadSizeExceeded)
     .map(
       ({
         notification: notif,
         deviceToken,
         encryptedPayloadHash,
         encryptionOrder,
       }) => ({
         notification: notif,
         deviceToken,
         encryptedPayloadHash,
         encryptionOrder,
       }),
     );
 
   const targetedNotifsWithoutMessageInfos = notifsWithoutMessageInfos.map(
     ({
       notification: notif,
       deviceToken,
       encryptedPayloadHash,
       encryptionOrder,
     }) => ({
       notification: notif,
       deviceToken,
       encryptedPayloadHash,
       encryptionOrder,
     }),
   );
 
   return [
     ...targetedNotifsWithMessageInfos,
     ...targetedNotifsWithoutMessageInfos,
   ];
 }
 
 type AndroidNotifInputData = {
   ...APNsNotifInputData,
   +dbID: string,
 };
 const androidNotifInputDataValidator = tShape<AndroidNotifInputData>({
   ...apnsNotifInputDataValidator.meta.props,
   dbID: t.String,
 });
 async function prepareAndroidNotification(
   inputData: AndroidNotifInputData,
   devices: $ReadOnlyArray<NotificationTargetDevice>,
 ): Promise<$ReadOnlyArray<TargetedAndroidNotification>> {
   const convertedData = validateOutput(
     inputData.platformDetails,
     androidNotifInputDataValidator,
     inputData,
   );
   const {
     notifTexts,
     newRawMessageInfos,
     threadID,
     collapseKey,
     badgeOnly,
     unreadCount,
     platformDetails: { codeVersion },
     dbID,
   } = convertedData;
   const canDecryptNonCollapsibleTextNotifs = codeVersion && codeVersion > 228;
 
   const isNonCollapsibleTextNotif =
     newRawMessageInfos.every(
       newRawMessageInfo => newRawMessageInfo.type === messageTypes.TEXT,
     ) && !collapseKey;
 
   const canDecryptAllNotifTypes = codeVersion && codeVersion >= 267;
 
   const shouldBeEncrypted =
     canDecryptAllNotifTypes ||
     (canDecryptNonCollapsibleTextNotifs && isNonCollapsibleTextNotif);
 
   const { merged, ...rest } = notifTexts;
   const notification = {
     data: {
       badge: unreadCount.toString(),
       ...rest,
       threadID,
     },
   };
 
   let notifID;
   if (collapseKey && canDecryptAllNotifTypes) {
     notifID = dbID;
     notification.data = {
       ...notification.data,
       collapseKey,
     };
   } else if (collapseKey) {
     notifID = collapseKey;
   } else {
     notifID = dbID;
   }
 
   // The reason we only include `badgeOnly` for newer clients is because older
   // clients don't know how to parse it. The reason we only include `id` for
   // newer clients is that if the older clients see that field, they assume
   // the notif has a full payload, and then crash when trying to parse it.
   // By skipping `id` we allow old clients to still handle in-app notifs and
   // badge updating.
   if (!badgeOnly || (codeVersion && codeVersion >= 69)) {
     notification.data = {
       ...notification.data,
       id: notifID,
       badgeOnly: badgeOnly ? '1' : '0',
     };
   }
 
   const messageInfos = JSON.stringify(newRawMessageInfos);
   const copyWithMessageInfos = {
     ...notification,
     data: { ...notification.data, messageInfos },
   };
 
   if (!shouldBeEncrypted) {
     const notificationToSend =
       Buffer.byteLength(JSON.stringify(copyWithMessageInfos)) <=
       fcmMaxNotificationPayloadByteSize
         ? copyWithMessageInfos
         : notification;
 
     return devices.map(({ deviceToken }) => ({
       notification: notificationToSend,
       deviceToken,
     }));
   }
 
   const notificationsSizeValidator = (notif: AndroidNotification) => {
     const serializedNotif = JSON.stringify(notif);
     return (
       !serializedNotif ||
       Buffer.byteLength(serializedNotif) <= fcmMaxNotificationPayloadByteSize
     );
   };
 
   const notifsWithMessageInfos = await prepareEncryptedAndroidNotifications(
     devices,
     copyWithMessageInfos,
     notificationsSizeValidator,
   );
 
   const devicesWithExcessiveSize = notifsWithMessageInfos
     .filter(({ payloadSizeExceeded }) => payloadSizeExceeded)
     .map(({ cookieID, deviceToken }) => ({ cookieID, deviceToken }));
 
   if (devicesWithExcessiveSize.length === 0) {
     return notifsWithMessageInfos.map(
       ({ notification: notif, deviceToken, encryptionOrder }) => ({
         notification: notif,
         deviceToken,
         encryptionOrder,
       }),
     );
   }
 
   const notifsWithoutMessageInfos = await prepareEncryptedAndroidNotifications(
     devicesWithExcessiveSize,
     notification,
   );
 
   const targetedNotifsWithMessageInfos = notifsWithMessageInfos
     .filter(({ payloadSizeExceeded }) => !payloadSizeExceeded)
     .map(({ notification: notif, deviceToken, encryptionOrder }) => ({
       notification: notif,
       deviceToken,
       encryptionOrder,
     }));
 
   const targetedNotifsWithoutMessageInfos = notifsWithoutMessageInfos.map(
     ({ notification: notif, deviceToken, encryptionOrder }) => ({
       notification: notif,
       deviceToken,
       encryptionOrder,
     }),
   );
 
   return [
     ...targetedNotifsWithMessageInfos,
     ...targetedNotifsWithoutMessageInfos,
   ];
 }
 
 type WebNotifInputData = {
   +notifTexts: ResolvedNotifTexts,
   +threadID: string,
   +unreadCount: number,
   +platformDetails: PlatformDetails,
 };
 const webNotifInputDataValidator = tShape<WebNotifInputData>({
   notifTexts: resolvedNotifTextsValidator,
   threadID: tID,
   unreadCount: t.Number,
   platformDetails: tPlatformDetails,
 });
 async function prepareWebNotification(
   userID: string,
   inputData: WebNotifInputData,
   devices: $ReadOnlyArray<NotificationTargetDevice>,
 ): Promise<$ReadOnlyArray<TargetedWebNotification>> {
   const convertedData = validateOutput(
     inputData.platformDetails,
     webNotifInputDataValidator,
     inputData,
   );
   const { notifTexts, threadID, unreadCount } = convertedData;
   const id = uuidv4();
   const { merged, ...rest } = notifTexts;
   const notification = {
     ...rest,
     unreadCount,
     id,
     threadID,
   };
 
   const isStaffOrDev = isStaff(userID) || isDev;
   const shouldBeEncrypted =
     hasMinCodeVersion(convertedData.platformDetails, {
       web: 43,
     }) && isStaffOrDev;
 
   if (!shouldBeEncrypted) {
     return devices.map(({ deviceToken }) => ({ deviceToken, notification }));
   }
 
   return prepareEncryptedWebNotifications(devices, notification);
 }
 
 type WNSNotifInputData = {
   +notifTexts: ResolvedNotifTexts,
   +threadID: string,
   +unreadCount: number,
   +platformDetails: PlatformDetails,
 };
 const wnsNotifInputDataValidator = tShape<WNSNotifInputData>({
   notifTexts: resolvedNotifTextsValidator,
   threadID: tID,
   unreadCount: t.Number,
   platformDetails: tPlatformDetails,
 });
 async function prepareWNSNotification(
   inputData: WNSNotifInputData,
 ): Promise<WNSNotification> {
   const convertedData = validateOutput(
     inputData.platformDetails,
     wnsNotifInputDataValidator,
     inputData,
   );
   const { notifTexts, threadID, unreadCount } = convertedData;
   const { merged, ...rest } = notifTexts;
   const notification = {
     ...rest,
     unreadCount,
     threadID,
   };
 
   if (
     Buffer.byteLength(JSON.stringify(notification)) >
     wnsMaxNotificationPayloadByteSize
   ) {
     console.warn('WNS notification exceeds size limit');
   }
   return notification;
 }
 
 type NotificationInfo =
   | {
       +source: 'new_message',
       +dbID: string,
       +userID: string,
       +threadID: string,
       +messageID: string,
       +collapseKey: ?string,
       +codeVersion: number,
       +stateVersion: number,
     }
   | {
       +source: 'mark_as_unread' | 'mark_as_read' | 'activity_update',
       +dbID: string,
       +userID: string,
       +codeVersion: number,
       +stateVersion: number,
     };
 
 type APNsDelivery = {
   +source: $PropertyType<NotificationInfo, 'source'>,
   +deviceType: 'ios' | 'macos',
   +iosID: string,
   +deviceTokens: $ReadOnlyArray<string>,
   +codeVersion: number,
   +stateVersion: number,
   +errors?: $ReadOnlyArray<ResponseFailure>,
   +encryptedPayloadHashes?: $ReadOnlyArray<string>,
   +deviceTokensToPayloadHash?: {
     +[deviceToken: string]: string,
   },
 };
 type APNsResult = {
   info: NotificationInfo,
   delivery: APNsDelivery,
   invalidTokens?: $ReadOnlyArray<string>,
 };
 async function sendAPNsNotification(
   platform: 'ios' | 'macos',
   targetedNotifications: $ReadOnlyArray<TargetedAPNsNotification>,
   notificationInfo: NotificationInfo,
 ): Promise<APNsResult> {
   const { source, codeVersion, stateVersion } = notificationInfo;
 
   const response = await apnPush({
     targetedNotifications,
     platformDetails: { platform, codeVersion },
   });
   invariant(
     new Set(targetedNotifications.map(({ notification }) => notification.id))
       .size === 1,
     'Encrypted versions of the same notification must share id value',
   );
   const iosID = targetedNotifications[0].notification.id;
   const deviceTokens = targetedNotifications.map(
     ({ deviceToken }) => deviceToken,
   );
   let delivery: APNsDelivery = {
     source,
     deviceType: platform,
     iosID,
     deviceTokens,
     codeVersion,
     stateVersion,
   };
   if (response.errors) {
     delivery = {
       ...delivery,
       errors: response.errors,
     };
   }
 
   const deviceTokensToPayloadHash: { [string]: string } = {};
   for (const targetedNotification of targetedNotifications) {
     if (targetedNotification.encryptedPayloadHash) {
       deviceTokensToPayloadHash[targetedNotification.deviceToken] =
         targetedNotification.encryptedPayloadHash;
     }
   }
   if (Object.keys(deviceTokensToPayloadHash).length !== 0) {
     delivery = {
       ...delivery,
       deviceTokensToPayloadHash,
     };
   }
 
   const result: APNsResult = {
     info: notificationInfo,
     delivery,
   };
   if (response.invalidTokens) {
     result.invalidTokens = response.invalidTokens;
   }
   return result;
 }
 
 type PushResult = AndroidResult | APNsResult | WebResult | WNSResult;
 type PushDelivery = AndroidDelivery | APNsDelivery | WebDelivery | WNSDelivery;
 type AndroidDelivery = {
   source: $PropertyType<NotificationInfo, 'source'>,
   deviceType: 'android',
   androidIDs: $ReadOnlyArray<string>,
   deviceTokens: $ReadOnlyArray<string>,
   codeVersion: number,
   stateVersion: number,
   errors?: $ReadOnlyArray<Object>,
 };
 type AndroidResult = {
   info: NotificationInfo,
   delivery: AndroidDelivery,
   invalidTokens?: $ReadOnlyArray<string>,
 };
 async function sendAndroidNotification(
   targetedNotifications: $ReadOnlyArray<TargetedAndroidNotification>,
   notificationInfo: NotificationInfo,
 ): Promise<AndroidResult> {
   const collapseKey = notificationInfo.collapseKey
     ? notificationInfo.collapseKey
     : null; // for Flow...
   const { source, codeVersion, stateVersion } = notificationInfo;
   const response = await fcmPush({
     targetedNotifications,
     collapseKey,
     codeVersion,
   });
   const deviceTokens = targetedNotifications.map(
     ({ deviceToken }) => deviceToken,
   );
   const androidIDs = response.fcmIDs ? response.fcmIDs : [];
   const delivery: AndroidDelivery = {
     source,
     deviceType: 'android',
     androidIDs,
     deviceTokens,
     codeVersion,
     stateVersion,
   };
   if (response.errors) {
     delivery.errors = response.errors;
   }
   const result: AndroidResult = {
     info: notificationInfo,
     delivery,
   };
   if (response.invalidTokens) {
     result.invalidTokens = response.invalidTokens;
   }
   return result;
 }
 
 type WebDelivery = {
   +source: $PropertyType<NotificationInfo, 'source'>,
   +deviceType: 'web',
   +deviceTokens: $ReadOnlyArray<string>,
   +codeVersion?: number,
   +stateVersion: number,
   +errors?: $ReadOnlyArray<WebPushError>,
 };
 type WebResult = {
   +info: NotificationInfo,
   +delivery: WebDelivery,
   +invalidTokens?: $ReadOnlyArray<string>,
 };
 async function sendWebNotifications(
   targetedNotifications: $ReadOnlyArray<TargetedWebNotification>,
   notificationInfo: NotificationInfo,
 ): Promise<WebResult> {
   const { source, codeVersion, stateVersion } = notificationInfo;
 
   const response = await webPush(targetedNotifications);
 
   const deviceTokens = targetedNotifications.map(
     ({ deviceToken }) => deviceToken,
   );
   const delivery: WebDelivery = {
     source,
     deviceType: 'web',
     deviceTokens,
     codeVersion,
     errors: response.errors,
     stateVersion,
   };
   const result: WebResult = {
     info: notificationInfo,
     delivery,
     invalidTokens: response.invalidTokens,
   };
   return result;
 }
 
 type WNSDelivery = {
   +source: $PropertyType<NotificationInfo, 'source'>,
   +deviceType: 'windows',
   +wnsIDs: $ReadOnlyArray<string>,
   +deviceTokens: $ReadOnlyArray<string>,
   +codeVersion?: number,
   +stateVersion: number,
   +errors?: $ReadOnlyArray<WNSPushError>,
 };
 type WNSResult = {
   +info: NotificationInfo,
   +delivery: WNSDelivery,
   +invalidTokens?: $ReadOnlyArray<string>,
 };
 async function sendWNSNotification(
   targetedNotifications: $ReadOnlyArray<TargetedWNSNotification>,
   notificationInfo: NotificationInfo,
 ): Promise<WNSResult> {
   const { source, codeVersion, stateVersion } = notificationInfo;
 
   const response = await wnsPush(targetedNotifications);
 
   const deviceTokens = targetedNotifications.map(
     ({ deviceToken }) => deviceToken,
   );
   const wnsIDs = response.wnsIDs ?? [];
   const delivery: WNSDelivery = {
     source,
     deviceType: 'windows',
     wnsIDs,
     deviceTokens,
     codeVersion,
     errors: response.errors,
     stateVersion,
   };
   const result: WNSResult = {
     info: notificationInfo,
     delivery,
     invalidTokens: response.invalidTokens,
   };
   return result;
 }
 
 type InvalidToken = {
   +userID: string,
   +tokens: $ReadOnlyArray<string>,
 };
 async function removeInvalidTokens(
   invalidTokens: $ReadOnlyArray<InvalidToken>,
 ): Promise<void> {
   const sqlTuples = invalidTokens.map(
     invalidTokenUser =>
       SQL`(
       user = ${invalidTokenUser.userID} AND
       device_token IN (${invalidTokenUser.tokens})
     )`,
   );
   const sqlCondition = mergeOrConditions(sqlTuples);
 
   const selectQuery = SQL`
     SELECT id, user, device_token
     FROM cookies
     WHERE
   `;
   selectQuery.append(sqlCondition);
   const [result] = await dbQuery(selectQuery);
 
   const userCookiePairsToInvalidDeviceTokens = new Map<string, Set<string>>();
   for (const row of result) {
     const userCookiePair = `${row.user}|${row.id}`;
     const existing = userCookiePairsToInvalidDeviceTokens.get(userCookiePair);
     if (existing) {
       existing.add(row.device_token);
     } else {
       userCookiePairsToInvalidDeviceTokens.set(
         userCookiePair,
         new Set([row.device_token]),
       );
     }
   }
 
   const time = Date.now();
   const promises: Array<Promise<mixed>> = [];
   for (const entry of userCookiePairsToInvalidDeviceTokens) {
     const [userCookiePair, deviceTokens] = entry;
     const [userID, cookieID] = userCookiePair.split('|');
     const updateDatas = [...deviceTokens].map(deviceToken => ({
       type: updateTypes.BAD_DEVICE_TOKEN,
       userID,
       time,
       deviceToken,
       targetCookie: cookieID,
     }));
     promises.push(createUpdates(updateDatas));
   }
 
   const updateQuery = SQL`
     UPDATE cookies
     SET device_token = NULL
     WHERE
   `;
   updateQuery.append(sqlCondition);
   promises.push(dbQuery(updateQuery));
 
   await Promise.all(promises);
 }
 
 async function updateBadgeCount(
   viewer: Viewer,
   source: 'mark_as_unread' | 'mark_as_read' | 'activity_update',
 ) {
   const { userID } = viewer;
 
   const deviceTokenQuery = SQL`
     SELECT platform, device_token, versions, id
     FROM cookies
     WHERE user = ${userID}
       AND device_token IS NOT NULL
   `;
   if (viewer.data.cookieID) {
     deviceTokenQuery.append(SQL`AND id != ${viewer.cookieID} `);
   }
   const [unreadCounts, [deviceTokenResult], [dbID]] = await Promise.all([
     getUnreadCounts([userID]),
     dbQuery(deviceTokenQuery),
     createIDs('notifications', 1),
   ]);
   const unreadCount = unreadCounts[userID];
   const devices = deviceTokenResult.map(row => {
     const versions = JSON.parse(row.versions);
     return {
       platform: row.platform,
       cookieID: row.id,
       deviceToken: row.device_token,
       codeVersion: versions?.codeVersion,
       stateVersion: versions?.stateVersion,
     };
   });
   const byPlatform = getDevicesByPlatform(devices);
 
   const preparePromises: Array<Promise<$ReadOnlyArray<PreparePushResult>>> = [];
 
   const iosVersionsToTokens = byPlatform.get('ios');
   if (iosVersionsToTokens) {
     for (const [versionKey, deviceInfos] of iosVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const notification = new apn.Notification();
       notification.topic = getAPNsNotificationTopic({
         platform: 'ios',
         codeVersion,
         stateVersion,
       });
       notification.badge = unreadCount;
       notification.pushType = 'alert';
       const preparePromise: Promise<PreparePushResult[]> = (async () => {
         let targetedNotifications: $ReadOnlyArray<TargetedAPNsNotification>;
         if (codeVersion > 222) {
           const notificationsArray = await prepareEncryptedAPNsNotifications(
             deviceInfos,
             notification,
             codeVersion,
           );
           targetedNotifications = notificationsArray.map(
             ({ notification: notif, deviceToken, encryptionOrder }) => ({
               notification: notif,
               deviceToken,
               encryptionOrder,
             }),
           );
         } else {
           targetedNotifications = deviceInfos.map(({ deviceToken }) => ({
             notification,
             deviceToken,
           }));
         }
         return targetedNotifications.map(targetedNotification => ({
           notification: targetedNotification,
           platform: 'ios',
           notificationInfo: {
             source,
             dbID,
             userID,
             codeVersion,
             stateVersion,
           },
         }));
       })();
 
       preparePromises.push(preparePromise);
     }
   }
 
   const androidVersionsToTokens = byPlatform.get('android');
   if (androidVersionsToTokens) {
     for (const [versionKey, deviceInfos] of androidVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const notificationData =
         codeVersion < 69
           ? { badge: unreadCount.toString() }
           : { badge: unreadCount.toString(), badgeOnly: '1' };
       const notification = { data: notificationData };
       const preparePromise: Promise<PreparePushResult[]> = (async () => {
         let targetedNotifications: $ReadOnlyArray<TargetedAndroidNotification>;
         if (codeVersion > 222) {
           const notificationsArray = await prepareEncryptedAndroidNotifications(
             deviceInfos,
             notification,
           );
           targetedNotifications = notificationsArray.map(
             ({ notification: notif, deviceToken, encryptionOrder }) => ({
               notification: notif,
               deviceToken,
               encryptionOrder,
             }),
           );
         } else {
           targetedNotifications = deviceInfos.map(({ deviceToken }) => ({
             deviceToken,
             notification,
           }));
         }
         return targetedNotifications.map(targetedNotification => ({
           notification: targetedNotification,
           platform: 'android',
           notificationInfo: {
             source,
             dbID,
             userID,
             codeVersion,
             stateVersion,
           },
         }));
       })();
       preparePromises.push(preparePromise);
     }
   }
 
   const macosVersionsToTokens = byPlatform.get('macos');
   if (macosVersionsToTokens) {
     for (const [versionKey, deviceInfos] of macosVersionsToTokens) {
       const { codeVersion, stateVersion } = stringToVersionKey(versionKey);
       const notification = new apn.Notification();
       notification.topic = getAPNsNotificationTopic({
         platform: 'macos',
         codeVersion,
         stateVersion,
       });
       notification.badge = unreadCount;
       notification.pushType = 'alert';
       const preparePromise: Promise<PreparePushResult[]> = (async () => {
-        return deviceInfos.map(({ deviceToken }) => ({
-          notification: ({
+        const isStaffOrDev = isStaff(userID) || isDev;
+        const shouldBeEncrypted =
+          isStaffOrDev &&
+          hasMinCodeVersion(viewer.platformDetails, {
+            web: NEXT_CODE_VERSION,
+            majorDesktop: NEXT_CODE_VERSION,
+          });
+        let targetedNotifications: $ReadOnlyArray<TargetedAPNsNotification>;
+        if (shouldBeEncrypted) {
+          const notificationsArray = await prepareEncryptedAPNsNotifications(
+            deviceInfos,
+            notification,
+            codeVersion,
+          );
+          targetedNotifications = notificationsArray.map(
+            ({ notification: notif, deviceToken, encryptionOrder }) => ({
+              notification: notif,
+              deviceToken,
+              encryptionOrder,
+            }),
+          );
+        } else {
+          targetedNotifications = deviceInfos.map(({ deviceToken }) => ({
             deviceToken,
             notification,
-          }: TargetedAPNsNotification),
+          }));
+        }
+
+        return targetedNotifications.map(targetedNotification => ({
+          notification: targetedNotification,
           platform: 'macos',
           notificationInfo: {
             source,
             dbID,
             userID,
             codeVersion,
             stateVersion,
           },
         }));
       })();
       preparePromises.push(preparePromise);
     }
   }
 
   const prepareResults = await Promise.all(preparePromises);
   const flattenedPrepareResults = prepareResults.filter(Boolean).flat();
   const deliveryResults = await deliverPushNotifsInEncryptionOrder(
     flattenedPrepareResults,
   );
   await saveNotifResults(deliveryResults, new Map(), false);
 }
 
 export { sendPushNotifs, sendRescindNotifs, updateBadgeCount };
diff --git a/keyserver/src/session/cookies.js b/keyserver/src/session/cookies.js
index 007a039b5..8c67939ff 100644
--- a/keyserver/src/session/cookies.js
+++ b/keyserver/src/session/cookies.js
@@ -1,793 +1,798 @@
 // @flow
 
 import crypto from 'crypto';
 import type { $Response, $Request } from 'express';
 import invariant from 'invariant';
 import url from 'url';
 
 import { isStaff } from 'lib/shared/staff-utils.js';
-import { hasMinCodeVersion } from 'lib/shared/version-utils.js';
+import {
+  hasMinCodeVersion,
+  NEXT_CODE_VERSION,
+} from 'lib/shared/version-utils.js';
 import type { SignedIdentityKeysBlob } from 'lib/types/crypto-types.js';
 import type { Platform, PlatformDetails } from 'lib/types/device-types.js';
 import type { CalendarQuery } from 'lib/types/entry-types.js';
 import {
   type ServerSessionChange,
   cookieLifetime,
   cookieTypes,
   sessionIdentifierTypes,
   type SessionIdentifierType,
 } from 'lib/types/session-types.js';
 import type { SIWESocialProof } from 'lib/types/siwe-types.js';
 import type { InitialClientSocketMessage } from 'lib/types/socket-types.js';
 import type { UserInfo } from 'lib/types/user-types.js';
 import { isDev } from 'lib/utils/dev-utils.js';
 
 import {
   isBcryptHash,
   getCookieHash,
   verifyCookieHash,
 } from './cookie-hash.js';
 import { Viewer } from './viewer.js';
 import type { AnonymousViewerData, UserViewerData } from './viewer.js';
 import createIDs from '../creators/id-creator.js';
 import { createSession } from '../creators/session-creator.js';
 import { dbQuery, SQL } from '../database/database.js';
 import { deleteCookie } from '../deleters/cookie-deleters.js';
 import { handleAsyncPromise } from '../responders/handlers.js';
 import { clearDeviceToken } from '../updaters/device-token-updaters.js';
 import { assertSecureRequest } from '../utils/security-utils.js';
 import {
   type AppURLFacts,
   getAppURLFactsFromRequestURL,
 } from '../utils/urls.js';
 
 function cookieIsExpired(lastUsed: number) {
   return lastUsed + cookieLifetime <= Date.now();
 }
 
 type SessionParameterInfo = {
   isSocket: boolean,
   sessionID: ?string,
   sessionIdentifierType: SessionIdentifierType,
   ipAddress: string,
   userAgent: ?string,
 };
 
 type FetchViewerResult =
   | { +type: 'valid', +viewer: Viewer }
   | InvalidFetchViewerResult;
 
 type InvalidFetchViewerResult =
   | {
       +type: 'nonexistant',
       +cookieName: ?string,
       +sessionParameterInfo: SessionParameterInfo,
     }
   | {
       +type: 'invalidated',
       +cookieName: string,
       +cookieID: string,
       +sessionParameterInfo: SessionParameterInfo,
       +platformDetails: ?PlatformDetails,
       +deviceToken: ?string,
     };
 
 async function fetchUserViewer(
   cookie: string,
   sessionParameterInfo: SessionParameterInfo,
 ): Promise<FetchViewerResult> {
   const [cookieID, cookiePassword] = cookie.split(':');
   if (!cookieID || !cookiePassword) {
     return {
       type: 'nonexistant',
       cookieName: cookieTypes.USER,
       sessionParameterInfo,
     };
   }
 
   const query = SQL`
     SELECT hash, user, last_used, platform, device_token, versions
     FROM cookies
     WHERE id = ${cookieID} AND user IS NOT NULL
   `;
   const [[result], allSessionInfo] = await Promise.all([
     dbQuery(query),
     fetchSessionInfo(sessionParameterInfo, cookieID),
   ]);
   if (result.length === 0) {
     return {
       type: 'nonexistant',
       cookieName: cookieTypes.USER,
       sessionParameterInfo,
     };
   }
 
   let sessionID = null,
     sessionInfo = null;
   if (allSessionInfo) {
     ({ sessionID, ...sessionInfo } = allSessionInfo);
   }
 
   const cookieRow = result[0];
   let platformDetails = null;
   if (cookieRow.versions) {
     const versions = JSON.parse(cookieRow.versions);
     platformDetails = {
       platform: cookieRow.platform,
       codeVersion: versions.codeVersion,
       stateVersion: versions.stateVersion,
     };
   } else {
     platformDetails = { platform: cookieRow.platform };
   }
   const deviceToken = cookieRow.device_token;
   const cookieHash = cookieRow.hash;
 
   if (
     !verifyCookieHash(cookiePassword, cookieHash) ||
     cookieIsExpired(cookieRow.last_used)
   ) {
     return {
       type: 'invalidated',
       cookieName: cookieTypes.USER,
       cookieID,
       sessionParameterInfo,
       platformDetails,
       deviceToken,
     };
   }
   const userID = cookieRow.user.toString();
   const viewer = new Viewer({
     isSocket: sessionParameterInfo.isSocket,
     loggedIn: true,
     id: userID,
     platformDetails,
     deviceToken,
     userID,
     cookieID,
     cookiePassword,
     cookieHash,
     sessionIdentifierType: sessionParameterInfo.sessionIdentifierType,
     sessionID,
     sessionInfo,
     isScriptViewer: false,
     ipAddress: sessionParameterInfo.ipAddress,
     userAgent: sessionParameterInfo.userAgent,
   });
   return { type: 'valid', viewer };
 }
 
 async function fetchAnonymousViewer(
   cookie: string,
   sessionParameterInfo: SessionParameterInfo,
 ): Promise<FetchViewerResult> {
   const [cookieID, cookiePassword] = cookie.split(':');
   if (!cookieID || !cookiePassword) {
     return {
       type: 'nonexistant',
       cookieName: cookieTypes.ANONYMOUS,
       sessionParameterInfo,
     };
   }
 
   const query = SQL`
     SELECT last_used, hash, platform, device_token, versions
     FROM cookies
     WHERE id = ${cookieID} AND user IS NULL
   `;
   const [[result], allSessionInfo] = await Promise.all([
     dbQuery(query),
     fetchSessionInfo(sessionParameterInfo, cookieID),
   ]);
   if (result.length === 0) {
     return {
       type: 'nonexistant',
       cookieName: cookieTypes.ANONYMOUS,
       sessionParameterInfo,
     };
   }
 
   let sessionID = null,
     sessionInfo = null;
   if (allSessionInfo) {
     ({ sessionID, ...sessionInfo } = allSessionInfo);
   }
 
   const cookieRow = result[0];
   let platformDetails = null;
   if (cookieRow.platform && cookieRow.versions) {
     const versions = JSON.parse(cookieRow.versions);
     platformDetails = {
       platform: cookieRow.platform,
       codeVersion: versions.codeVersion,
       stateVersion: versions.stateVersion,
     };
   } else if (cookieRow.platform) {
     platformDetails = { platform: cookieRow.platform };
   }
   const deviceToken = cookieRow.device_token;
   const cookieHash = cookieRow.hash;
 
   if (
     !verifyCookieHash(cookiePassword, cookieHash) ||
     cookieIsExpired(cookieRow.last_used)
   ) {
     return {
       type: 'invalidated',
       cookieName: cookieTypes.ANONYMOUS,
       cookieID,
       sessionParameterInfo,
       platformDetails,
       deviceToken,
     };
   }
   const viewer = new Viewer({
     isSocket: sessionParameterInfo.isSocket,
     loggedIn: false,
     id: cookieID,
     platformDetails,
     deviceToken,
     cookieID,
     cookiePassword,
     cookieHash,
     sessionIdentifierType: sessionParameterInfo.sessionIdentifierType,
     sessionID,
     sessionInfo,
     isScriptViewer: false,
     ipAddress: sessionParameterInfo.ipAddress,
     userAgent: sessionParameterInfo.userAgent,
   });
   return { type: 'valid', viewer };
 }
 
 type SessionInfo = {
   +sessionID: ?string,
   +lastValidated: number,
   +lastUpdate: number,
   +calendarQuery: CalendarQuery,
 };
 async function fetchSessionInfo(
   sessionParameterInfo: SessionParameterInfo,
   cookieID: string,
 ): Promise<?SessionInfo> {
   const { sessionID } = sessionParameterInfo;
   const session = sessionID !== undefined ? sessionID : cookieID;
   if (!session) {
     return null;
   }
   const query = SQL`
     SELECT query, last_validated, last_update
     FROM sessions
     WHERE id = ${session} AND cookie = ${cookieID}
   `;
   const [result] = await dbQuery(query);
   if (result.length === 0) {
     return null;
   }
   return {
     sessionID,
     lastValidated: result[0].last_validated,
     lastUpdate: result[0].last_update,
     calendarQuery: JSON.parse(result[0].query),
   };
 }
 
 async function fetchViewerFromRequestBody(
   body: mixed,
   sessionParameterInfo: SessionParameterInfo,
 ): Promise<FetchViewerResult> {
   if (!body || typeof body !== 'object') {
     return {
       type: 'nonexistant',
       cookieName: null,
       sessionParameterInfo,
     };
   }
   const cookiePair = body.cookie;
   if (cookiePair === null || cookiePair === '') {
     return {
       type: 'nonexistant',
       cookieName: null,
       sessionParameterInfo,
     };
   }
   if (!cookiePair || typeof cookiePair !== 'string') {
     return {
       type: 'nonexistant',
       cookieName: null,
       sessionParameterInfo,
     };
   }
   const [type, cookie] = cookiePair.split('=');
   if (type === cookieTypes.USER && cookie) {
     return await fetchUserViewer(cookie, sessionParameterInfo);
   } else if (type === cookieTypes.ANONYMOUS && cookie) {
     return await fetchAnonymousViewer(cookie, sessionParameterInfo);
   }
   return {
     type: 'nonexistant',
     cookieName: null,
     sessionParameterInfo,
   };
 }
 
 function getRequestIPAddress(req: $Request) {
   const { proxy } = getAppURLFactsFromRequestURL(req.originalUrl);
   let ipAddress;
   if (proxy === 'none') {
     ipAddress = req.socket.remoteAddress;
   } else if (proxy === 'apache') {
     ipAddress = req.get('X-Forwarded-For');
   }
   invariant(ipAddress, 'could not determine requesting IP address');
   return ipAddress;
 }
 
 function getSessionParameterInfoFromRequestBody(
   req: $Request,
 ): SessionParameterInfo {
   const body = (req.body: any);
   let sessionID =
     body.sessionID !== undefined || req.method !== 'GET'
       ? body.sessionID
       : null;
   if (sessionID === '') {
     sessionID = null;
   }
   const sessionIdentifierType =
     req.method === 'GET' || sessionID !== undefined
       ? sessionIdentifierTypes.BODY_SESSION_ID
       : sessionIdentifierTypes.COOKIE_ID;
   return {
     isSocket: false,
     sessionID,
     sessionIdentifierType,
     ipAddress: getRequestIPAddress(req),
     userAgent: req.get('User-Agent'),
   };
 }
 
 async function fetchViewerForJSONRequest(req: $Request): Promise<Viewer> {
   assertSecureRequest(req);
   const sessionParameterInfo = getSessionParameterInfoFromRequestBody(req);
   const result = await fetchViewerFromRequestBody(
     req.body,
     sessionParameterInfo,
   );
   return await handleFetchViewerResult(result);
 }
 
 async function fetchViewerForSocket(
   req: $Request,
   clientMessage: InitialClientSocketMessage,
 ): Promise<Viewer> {
   assertSecureRequest(req);
   const { sessionIdentification } = clientMessage.payload;
   const { sessionID } = sessionIdentification;
   const sessionParameterInfo = {
     isSocket: true,
     sessionID,
     sessionIdentifierType:
       sessionID !== undefined
         ? sessionIdentifierTypes.BODY_SESSION_ID
         : sessionIdentifierTypes.COOKIE_ID,
     ipAddress: getRequestIPAddress(req),
     userAgent: req.get('User-Agent'),
   };
 
   const result = await fetchViewerFromRequestBody(
     clientMessage.payload.sessionIdentification,
     sessionParameterInfo,
   );
   if (result.type === 'valid') {
     return result.viewer;
   }
 
   const anonymousViewerDataPromise: Promise<AnonymousViewerData> =
     (async () => {
       const platformDetails =
         result.type === 'invalidated' ? result.platformDetails : null;
       const deviceToken =
         result.type === 'invalidated' ? result.deviceToken : null;
       return await createNewAnonymousCookie({
         platformDetails,
         deviceToken,
       });
     })();
   const deleteCookiePromise = (async () => {
     if (result.type === 'invalidated') {
       await deleteCookie(result.cookieID);
     }
   })();
   const [anonymousViewerData] = await Promise.all([
     anonymousViewerDataPromise,
     deleteCookiePromise,
   ]);
 
   return createViewerForInvalidFetchViewerResult(result, anonymousViewerData);
 }
 
 async function handleFetchViewerResult(
   result: FetchViewerResult,
   inputPlatformDetails?: PlatformDetails,
 ) {
   if (result.type === 'valid') {
     return result.viewer;
   }
 
   let platformDetails: ?PlatformDetails = inputPlatformDetails;
   if (!platformDetails && result.type === 'invalidated') {
     platformDetails = result.platformDetails;
   }
   const deviceToken = result.type === 'invalidated' ? result.deviceToken : null;
 
   const deleteCookiePromise = (async () => {
     if (result.type === 'invalidated') {
       await deleteCookie(result.cookieID);
     }
   })();
 
   const [anonymousViewerData] = await Promise.all([
     createNewAnonymousCookie({ platformDetails, deviceToken }),
     deleteCookiePromise,
   ]);
 
   return createViewerForInvalidFetchViewerResult(result, anonymousViewerData);
 }
 
 function createViewerForInvalidFetchViewerResult(
   result: InvalidFetchViewerResult,
   anonymousViewerData: AnonymousViewerData,
 ): Viewer {
   const viewer = new Viewer({
     ...anonymousViewerData,
     sessionIdentifierType: result.sessionParameterInfo.sessionIdentifierType,
     isSocket: result.sessionParameterInfo.isSocket,
     ipAddress: result.sessionParameterInfo.ipAddress,
     userAgent: result.sessionParameterInfo.userAgent,
   });
   viewer.sessionChanged = true;
 
   // If cookieName is falsey, that tells us that there was no cookie specified
   // in the request, which means we can't be invalidating anything.
   if (result.cookieName) {
     viewer.cookieInvalidated = true;
     viewer.initialCookieName = result.cookieName;
   }
 
   return viewer;
 }
 
 function addSessionChangeInfoToResult(
   viewer: Viewer,
   res: $Response,
   result: Object,
 ) {
   let threadInfos = {},
     userInfos: $ReadOnlyArray<UserInfo> = [];
   if (result.cookieChange) {
     ({ threadInfos, userInfos } = result.cookieChange);
   }
   let sessionChange;
   if (viewer.cookieInvalidated) {
     sessionChange = ({
       cookieInvalidated: true,
       threadInfos,
       userInfos,
       currentUserInfo: {
         anonymous: true,
       },
     }: ServerSessionChange);
   } else {
     sessionChange = ({
       cookieInvalidated: false,
       threadInfos,
       userInfos,
     }: ServerSessionChange);
   }
   sessionChange.cookie = viewer.cookiePairString;
   if (viewer.sessionIdentifierType === sessionIdentifierTypes.BODY_SESSION_ID) {
     sessionChange.sessionID = viewer.sessionID ? viewer.sessionID : null;
   }
   result.cookieChange = sessionChange;
 }
 
 type AnonymousCookieCreationParams = Partial<{
   +platformDetails: ?PlatformDetails,
   +deviceToken: ?string,
 }>;
 const defaultPlatformDetails = {};
 
 // The result of this function should not be passed directly to the Viewer
 // constructor. Instead, it should be passed to viewer.setNewCookie. There are
 // several fields on AnonymousViewerData that are not set by this function:
 // sessionIdentifierType, ipAddress, and userAgent. These parameters all depend
 // on the initial request. If the result of this function is passed to the
 // Viewer constructor directly, the resultant Viewer object will throw whenever
 // anybody attempts to access the relevant properties.
 async function createNewAnonymousCookie(
   params: AnonymousCookieCreationParams,
 ): Promise<AnonymousViewerData> {
   const { platformDetails, deviceToken } = params;
   const { platform, ...versions } = platformDetails || defaultPlatformDetails;
   const versionsString =
     Object.keys(versions).length > 0 ? JSON.stringify(versions) : null;
 
   const time = Date.now();
   const cookiePassword = crypto.randomBytes(32).toString('hex');
   const cookieHash = getCookieHash(cookiePassword);
   const [[id]] = await Promise.all([
     createIDs('cookies', 1),
     deviceToken ? clearDeviceToken(deviceToken) : undefined,
   ]);
 
   const cookieRow = [
     id,
     cookieHash,
     null,
     platform,
     time,
     time,
     deviceToken,
     versionsString,
   ];
   const query = SQL`
     INSERT INTO cookies(id, hash, user, platform, creation_time, last_used,
       device_token, versions)
     VALUES ${[cookieRow]}
   `;
   await dbQuery(query);
   return {
     loggedIn: false,
     id,
     platformDetails,
     deviceToken,
     cookieID: id,
     cookiePassword,
     cookieHash,
     sessionID: undefined,
     sessionInfo: null,
     cookieInsertedThisRequest: true,
     isScriptViewer: false,
   };
 }
 
 type UserCookieCreationParams = {
   +platformDetails: PlatformDetails,
   +deviceToken?: ?string,
   +socialProof?: ?SIWESocialProof,
   +signedIdentityKeysBlob?: ?SignedIdentityKeysBlob,
 };
 
 // The result of this function should never be passed directly to the Viewer
 // constructor. Instead, it should be passed to viewer.setNewCookie. There are
 // several fields on UserViewerData that are not set by this function:
 // sessionID, sessionIdentifierType, and ipAddress. These parameters all depend
 // on the initial request. If the result of this function is passed to the
 // Viewer constructor directly, the resultant Viewer object will throw whenever
 // anybody attempts to access the relevant properties.
 async function createNewUserCookie(
   userID: string,
   params: UserCookieCreationParams,
 ): Promise<UserViewerData> {
   const { platformDetails, deviceToken, socialProof, signedIdentityKeysBlob } =
     params;
   const { platform, ...versions } = platformDetails || defaultPlatformDetails;
   const versionsString =
     Object.keys(versions).length > 0 ? JSON.stringify(versions) : null;
 
   const time = Date.now();
   const cookiePassword = crypto.randomBytes(32).toString('hex');
   const cookieHash = getCookieHash(cookiePassword);
   const [[cookieID]] = await Promise.all([
     createIDs('cookies', 1),
     deviceToken ? clearDeviceToken(deviceToken) : undefined,
   ]);
 
   const cookieRow = [
     cookieID,
     cookieHash,
     userID,
     platform,
     time,
     time,
     deviceToken,
     versionsString,
     JSON.stringify(socialProof),
     signedIdentityKeysBlob ? JSON.stringify(signedIdentityKeysBlob) : null,
   ];
   const query = SQL`
     INSERT INTO cookies(id, hash, user, platform, creation_time, last_used,
       device_token, versions, social_proof, signed_identity_keys)
     VALUES ${[cookieRow]}
   `;
   await dbQuery(query);
   return {
     loggedIn: true,
     id: userID,
     platformDetails,
     deviceToken,
     userID,
     cookieID,
     sessionID: undefined,
     sessionInfo: null,
     cookiePassword,
     cookieHash,
     cookieInsertedThisRequest: true,
     isScriptViewer: false,
   };
 }
 
 // This gets called after createNewUserCookie and from websiteResponder. If the
 // Viewer's sessionIdentifierType is COOKIE_ID then the cookieID is used as the
 // session identifier; otherwise, a new ID is created for the session.
 async function setNewSession(
   viewer: Viewer,
   calendarQuery: CalendarQuery,
   initialLastUpdate: number,
 ): Promise<void> {
   if (viewer.sessionIdentifierType !== sessionIdentifierTypes.COOKIE_ID) {
     const [sessionID] = await createIDs('sessions', 1);
     viewer.setSessionID(sessionID);
   }
   await createSession(viewer, calendarQuery, initialLastUpdate);
 }
 
 async function updateCookie(viewer: Viewer) {
   const time = Date.now();
   const { cookieID, cookieHash, cookiePassword } = viewer;
 
   const updateObj: { [string]: string | number } = {};
   updateObj.last_used = time;
   if (isBcryptHash(cookieHash)) {
     updateObj.hash = getCookieHash(cookiePassword);
   }
   const query = SQL`
     UPDATE cookies SET ${updateObj} WHERE id = ${cookieID}
   `;
   await dbQuery(query);
 }
 
 function addCookieToJSONResponse(
   viewer: Viewer,
   res: $Response,
   result: Object,
   expectCookieInvalidation: boolean,
 ) {
   if (expectCookieInvalidation) {
     viewer.cookieInvalidated = false;
   }
   if (!viewer.getData().cookieInsertedThisRequest) {
     handleAsyncPromise(updateCookie(viewer));
   }
   if (viewer.sessionChanged) {
     addSessionChangeInfoToResult(viewer, res, result);
   }
 }
 
 function addCookieToHomeResponse(
   req: $Request,
   res: $Response,
   appURLFacts: AppURLFacts,
 ) {
   const { user, anonymous } = req.cookies;
   if (user) {
     res.cookie(cookieTypes.USER, user, getCookieOptions(appURLFacts));
   }
   if (anonymous) {
     res.cookie(cookieTypes.ANONYMOUS, anonymous, getCookieOptions(appURLFacts));
   }
 }
 
 function getCookieOptions(appURLFacts: AppURLFacts) {
   const { baseDomain, basePath, https } = appURLFacts;
   const domainAsURL = new url.URL(baseDomain);
   return {
     domain: domainAsURL.hostname,
     path: basePath,
     httpOnly: false,
     secure: https,
     maxAge: cookieLifetime,
     sameSite: 'Strict',
   };
 }
 
 async function setCookieSignedIdentityKeysBlob(
   cookieID: string,
   signedIdentityKeysBlob: SignedIdentityKeysBlob,
 ) {
   const signedIdentityKeysStr = JSON.stringify(signedIdentityKeysBlob);
   const query = SQL`
     UPDATE cookies 
     SET signed_identity_keys = ${signedIdentityKeysStr}
     WHERE id = ${cookieID}
   `;
   await dbQuery(query);
 }
 
 // Returns `true` if row with `id = cookieID` exists AND
 // `signed_identity_keys` is `NULL`. Otherwise, returns `false`.
 async function isCookieMissingSignedIdentityKeysBlob(
   cookieID: string,
 ): Promise<boolean> {
   const query = SQL`
     SELECT signed_identity_keys
     FROM cookies 
     WHERE id = ${cookieID}
   `;
   const [queryResult] = await dbQuery(query);
   return (
     queryResult.length === 1 && queryResult[0].signed_identity_keys === null
   );
 }
 
 async function isCookieMissingOlmNotificationsSession(
   viewer: Viewer,
 ): Promise<boolean> {
   const isStaffOrDev = isStaff(viewer.userID) || isDev;
   if (
     !viewer.platformDetails ||
     (viewer.platformDetails.platform !== 'ios' &&
       viewer.platformDetails.platform !== 'android' &&
-      !(viewer.platformDetails.platform === 'web' && isStaffOrDev)) ||
+      !(viewer.platformDetails.platform === 'web' && isStaffOrDev) &&
+      !(viewer.platformDetails.platform === 'macos' && isStaffOrDev)) ||
     !hasMinCodeVersion(viewer.platformDetails, {
       native: 222,
       web: 43,
+      majorDesktop: NEXT_CODE_VERSION,
     })
   ) {
     return false;
   }
   const query = SQL`
     SELECT COUNT(*) AS count
     FROM olm_sessions
     WHERE cookie_id = ${viewer.cookieID} AND is_content = FALSE
   `;
   const [queryResult] = await dbQuery(query);
   return queryResult[0].count === 0;
 }
 
 async function setCookiePlatform(
   viewer: Viewer,
   platform: Platform,
 ): Promise<void> {
   const newPlatformDetails = { ...viewer.platformDetails, platform };
   viewer.setPlatformDetails(newPlatformDetails);
   const query = SQL`
     UPDATE cookies
     SET platform = ${platform}
     WHERE id = ${viewer.cookieID}
   `;
   await dbQuery(query);
 }
 
 async function setCookiePlatformDetails(
   viewer: Viewer,
   platformDetails: PlatformDetails,
 ): Promise<void> {
   viewer.setPlatformDetails(platformDetails);
   const { platform, ...versions } = platformDetails;
   const versionsString =
     Object.keys(versions).length > 0 ? JSON.stringify(versions) : null;
   const query = SQL`
     UPDATE cookies
     SET platform = ${platform}, versions = ${versionsString}
     WHERE id = ${viewer.cookieID}
   `;
   await dbQuery(query);
 }
 
 export {
   fetchViewerForJSONRequest,
   fetchViewerForSocket,
   createNewAnonymousCookie,
   createNewUserCookie,
   setNewSession,
   updateCookie,
   addCookieToJSONResponse,
   addCookieToHomeResponse,
   setCookieSignedIdentityKeysBlob,
   isCookieMissingSignedIdentityKeysBlob,
   setCookiePlatform,
   setCookiePlatformDetails,
   isCookieMissingOlmNotificationsSession,
 };