@schlessera/brain-ui-server 0.17.0 → 0.19.0

package/README.md

@@ -83,6 +83,7 @@ Every variable this package reads, and what happens when it is unset.
 | `BRAIN_UI_MODEL_DISCOVERY` | Model discovery against the Anthropic Models API; "0"/"off"/"false" disables. Defaults ON, except under a test runner (NODE_ENV=test) where it defaults OFF. | on (off under NODE_ENV=test) |
 | `BRAIN_UI_MODEL_TTL_HOURS` | How long a model-discovery result stays fresh, in hours. | 24 |
 | `BRAIN_UI_PASSWORD_HASH` | Bun.password argon2id hash of the shared password. | **required** — AUTH_MODE=password |
+| `BRAIN_UI_TURN_TIMEOUT_MS` | Hard per-turn timeout in ms; the host aborts a turn that runs past it. Raise for agent-heavy research work (e.g. 1800000 for 30 minutes). | 600000 (10 minutes) |
 | `BRAIN_UI_WS_BURST` | Inbound WebSocket frames absorbable in one burst before the sustained rate applies. Opening the app legitimately fires several at once. | 60 |
 | `BRAIN_UI_WS_RATE` | Sustained inbound WebSocket frames per second per connection. 0 disables metering entirely. | 20 |
 | `CLAUDE_CODE_PATH` | Path to the Claude Code native binary handed to the Agent SDK. | /usr/local/bin/claude |

package/dist/activity/digest.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The while-you-were-away digest: a deterministic summary rendered from
+ * per-run rollups, produced by its OWN scheduled job (through the standard
+ * cron wrapper, so its runs land in the record like any other) — never a
+ * side effect of instrumentation.
+ *
+ * The digest's covered-until time is the retention floor: full-detail spans
+ * older than the last covered window are prunable, newer ones are not (the
+ * hard ceiling in the store bounds a broken digest job regardless). Windows
+ * are labeled — the card says WHAT period it covers rather than implying
+ * "now". The digest job's own runs are recorded but excluded from the
+ * notable list, or every digest would feature itself.
+ */
+import type { Database } from "bun:sqlite";
+import { type ActivityDigest } from "@schlessera/brain-ui-sdk/protocol";
+export type { ActivityDigest } from "@schlessera/brain-ui-sdk/protocol";
+export declare const DIGEST_LATEST_KEY = "activity.digest.latest";
+export declare const DIGEST_COVERED_KEY = "activity.digest.coveredUntil";
+export declare const DIGEST_DISMISSED_KEY = "activity.digest.dismissedAt";
+export declare const DIGEST_JOB_NAME = "digest";
+/** Generate and persist the digest for [coveredUntil, now]. */
+export declare function generateActivityDigest(db: Database, now?: number): ActivityDigest;
+/** The latest digest, or null before the first run. */
+export declare function latestActivityDigest(db: Database): ActivityDigest | null;
+/** The retention floor: never prune spans the digest has not covered. */
+export declare function digestRetentionFloor(db: Database): number;
+export declare function dismissActivityDigest(db: Database, at?: number): void;
+export declare function digestDismissedAt(db: Database): number;
+//# sourceMappingURL=digest.d.ts.map

package/dist/activity/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/activity/digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAK1F,YAAY,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAExE,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAC1D,eAAO,MAAM,kBAAkB,iCAAiC,CAAC;AACjE,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAClE,eAAO,MAAM,eAAe,WAAW,CAAC;AAKxC,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,SAAa,GAAG,cAAc,CA2CrF;AAED,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI,CAExE;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,GAAG,MAAM,CAEzD;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAa,GAAG,IAAI,CAEzE;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,GAAG,MAAM,CAEtD"}

package/dist/activity/digest.js

@@ -0,0 +1,61 @@
+import { isFailureOutcome } from "@schlessera/brain-ui-sdk/protocol";
+import { getSetting, setSetting } from "../db/settings.js";
+import { rowToRunRollup } from "./store.js";
+export const DIGEST_LATEST_KEY = "activity.digest.latest";
+export const DIGEST_COVERED_KEY = "activity.digest.coveredUntil";
+export const DIGEST_DISMISSED_KEY = "activity.digest.dismissedAt";
+export const DIGEST_JOB_NAME = "digest";
+/** First run ever: no covered-until marker — cap the window at 24h. */
+const FIRST_WINDOW_MS = 24 * 60 * 60 * 1000;
+/** Generate and persist the digest for [coveredUntil, now]. */
+export function generateActivityDigest(db, now = Date.now()) {
+    const covered = getSetting(db, DIGEST_COVERED_KEY, null);
+    const windowStart = covered ?? now - FIRST_WINDOW_MS;
+    // Windowed on ended_at, not started_at: every FINISHED run gets
+    // exactly-once coverage — a run still open at generation is picked up by
+    // the NEXT digest once it ends, instead of falling between windows.
+    const rows = db
+        .query(`SELECT * FROM activity_run_rollups
+         WHERE ended_at IS NOT NULL AND ended_at >= ? AND ended_at < ?
+         ORDER BY started_at DESC`)
+        .all(windowStart, now).map(rowToRunRollup);
+    const relevant = rows.filter((r) => r.jobName !== DIGEST_JOB_NAME);
+    const failures = relevant.filter((r) => isFailureOutcome(r.outcome));
+    const digest = {
+        generatedAt: now,
+        windowStart,
+        windowEnd: now,
+        runs: relevant.length,
+        failures: failures.length,
+        costUsd: relevant.reduce((a, r) => a + (r.costUsd ?? 0), 0),
+        inputTokens: relevant.reduce((a, r) => a + (r.inputTokens ?? 0), 0),
+        outputTokens: relevant.reduce((a, r) => a + (r.outputTokens ?? 0), 0),
+        notable: failures.slice(0, 10).map((r) => ({
+            runId: r.runId,
+            name: r.name,
+            jobName: r.jobName,
+            sessionId: r.sessionId,
+            outcome: r.outcome,
+            failureReason: r.failureReason,
+            startedAt: r.startedAt,
+        })),
+    };
+    setSetting(db, DIGEST_LATEST_KEY, digest);
+    setSetting(db, DIGEST_COVERED_KEY, now);
+    return digest;
+}
+/** The latest digest, or null before the first run. */
+export function latestActivityDigest(db) {
+    return getSetting(db, DIGEST_LATEST_KEY, null);
+}
+/** The retention floor: never prune spans the digest has not covered. */
+export function digestRetentionFloor(db) {
+    return getSetting(db, DIGEST_COVERED_KEY, 0);
+}
+export function dismissActivityDigest(db, at = Date.now()) {
+    setSetting(db, DIGEST_DISMISSED_KEY, at);
+}
+export function digestDismissedAt(db) {
+    return getSetting(db, DIGEST_DISMISSED_KEY, 0);
+}
+//# sourceMappingURL=digest.js.map

package/dist/activity/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../../src/activity/digest.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,gBAAgB,EAAuB,MAAM,mCAAmC,CAAC;AAE1F,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AACjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC,uEAAuE;AACvE,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C,+DAA+D;AAC/D,MAAM,UAAU,sBAAsB,CAAC,EAAY,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACnE,MAAM,OAAO,GAAG,UAAU,CAAgB,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACxE,MAAM,WAAW,GAAG,OAAO,IAAI,GAAG,GAAG,eAAe,CAAC;IAErD,gEAAgE;IAChE,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,IAAI,GACR,EAAE;SACC,KAAK,CACJ;;kCAE0B,CAC3B;SACA,GAAG,CAAC,WAAW,EAAE,GAAG,CACxB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAErE,MAAM,MAAM,GAAmB;QAC7B,WAAW,EAAE,GAAG;QAChB,WAAW;QACX,SAAS,EAAE,GAAG;QACd,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3D,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QACnE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;KACJ,CAAC;IAEF,UAAU,CAAC,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAC1C,UAAU,CAAC,EAAE,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CAAC,EAAY;IAC/C,OAAO,UAAU,CAAwB,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,oBAAoB,CAAC,EAAY;IAC/C,OAAO,UAAU,CAAS,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,EAAY,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;IACjE,UAAU,CAAC,EAAE,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAY;IAC5C,OAAO,UAAU,CAAS,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/activity/notify.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Notification intents: the at-least-once layer between the activity record
+ * and every delivery channel.
+ *
+ * An intent is persisted when the triggering condition is DETECTED (a
+ * terminal failure span, a stuck run) and carries its own lifecycle:
+ * pending -> sent | send_failed | suppressed. The in-app inbox is the
+ * guaranteed tier — it lists unacknowledged intents regardless of delivery
+ * status — and web push (the accelerator) marks sent/send_failed on top.
+ * Undelivered intents survive restarts by construction; the boot/tick sweep
+ * simply finds them still pending.
+ *
+ * Detection runs on the server's always-on tick with its OWN change-log
+ * cursor (the live stream's cursor only advances for subscribers), so a
+ * foreign writer's failure — the cron wrapper recording an error while
+ * nobody watches — is noticed within one tick, not at the next app open.
+ *
+ * Storm safety: a run-scoped tag deduplicates (one active intent per tag),
+ * per-job debounce collapses repeats, and a global creation rate cap stops
+ * one bad API key from paging for every job at once.
+ */
+import type { Database } from "bun:sqlite";
+import type { Logger } from "@opentelemetry/api-logs";
+import type { ActivityStore } from "./store.js";
+export type IntentKind = "failure" | "completion" | "stuck";
+export interface NotificationIntent {
+    id: number;
+    runId: string;
+    spanId: string | null;
+    kind: IntentKind;
+    tag: string;
+    title: string;
+    body: string;
+    status: "pending" | "sent" | "send_failed" | "suppressed";
+    acknowledged: boolean;
+    createdAt: number;
+}
+export interface ActivityNotifierDeps {
+    db: Database;
+    store: ActivityStore;
+    /** Was anyone watching this run/session when the event was recorded? */
+    isWatched: (scope: {
+        runId?: string;
+        sessionId?: string;
+    }) => boolean;
+    log?: Logger;
+}
+export interface ActivityNotifier {
+    /** Detect new terminal failures + stuck runs; create intents. */
+    tick(now?: number): void;
+    /** Unacknowledged intents, newest first (the inbox). */
+    inbox(limit?: number): NotificationIntent[];
+    /** Intents awaiting delivery (the push sender's queue). */
+    pending(limit?: number): NotificationIntent[];
+    markDelivered(id: number, status: "sent" | "send_failed"): void;
+    acknowledge(id: number): boolean;
+    acknowledgeAll(): number;
+    /** Retention: delete acknowledged intents untouched for longer than this. */
+    pruneAcknowledged(olderThanMs: number): number;
+}
+export declare function createActivityNotifier(deps: ActivityNotifierDeps): ActivityNotifier;
+//# sourceMappingURL=notify.d.ts.map

package/dist/activity/notify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/activity/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,OAAO,KAAK,EAAE,aAAa,EAAW,MAAM,YAAY,CAAC;AAEzD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC;AAE5D,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;IAC1D,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,QAAQ,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;IACrB,wEAAwE;IACxE,SAAS,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wDAAwD;IACxD,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAC5C,2DAA2D;IAC3D,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAC9C,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAAC;IAChE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,cAAc,IAAI,MAAM,CAAC;IACzB,6EAA6E;IAC7E,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;CAChD;AAOD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CAuMnF"}

package/dist/activity/notify.js

@@ -0,0 +1,171 @@
+import { isFailureOutcome } from "@schlessera/brain-ui-sdk/protocol";
+import { getSetting } from "../db/settings.js";
+/** Global cap on intents CREATED per hour — failure-storm circuit. */
+const MAX_INTENTS_PER_HOUR = 20;
+/** Watchdog default: a live root run older than this is flagged as stuck. */
+const DEFAULT_STUCK_THRESHOLD_MS = 45 * 60 * 1000;
+export function createActivityNotifier(deps) {
+    const { db, store, isWatched, log } = deps;
+    let cursor = latestCursor(db);
+    /** Runs already flagged as stuck this process lifetime (tag also guards). */
+    const stuckFlagged = new Set();
+    function latestCursor(database) {
+        const row = database
+            .query("SELECT COALESCE(MAX(change_id), 0) AS hi FROM activity_changes")
+            .get();
+        return row.hi;
+    }
+    function createIntent(input) {
+        const now = Date.now();
+        // Tag dedupe: one live (unacknowledged) intent per tag — repeats coalesce.
+        const existing = db
+            .query("SELECT id FROM notification_intents WHERE tag = ? AND acknowledged = 0 LIMIT 1")
+            .get(input.tag);
+        if (existing)
+            return;
+        // Global creation rate cap.
+        const recent = db
+            .query("SELECT COUNT(*) AS n FROM notification_intents WHERE created_at > ?")
+            .get(now - 60 * 60 * 1000);
+        const status = input.suppressed || recent.n >= MAX_INTENTS_PER_HOUR ? "suppressed" : "pending";
+        db.query(`INSERT INTO notification_intents
+         (run_id, span_id, kind, tag, title, body, status, acknowledged, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?, ?)`).run(input.runId, input.spanId ?? null, input.kind, input.tag, input.title, input.body, status, now, now);
+        log?.emit({
+            severityText: "INFO",
+            body: "notification intent created",
+            attributes: { kind: input.kind, tag: input.tag, status },
+        });
+    }
+    function intentForSpan(span) {
+        if (span.parentSpanId)
+            return;
+        if (isFailureOutcome(span.outcome)) {
+            const label = span.jobName ?? span.name;
+            // "Unwatched" is evaluated when the failure is NOTICED — a live
+            // subscription to the run or its session means the user saw it happen,
+            // so the intent lands acknowledged-free but suppressed for delivery.
+            const watched = isWatched({
+                runId: span.runId,
+                ...(span.sessionId ? { sessionId: span.sessionId } : {}),
+            });
+            // Payload minimization: name + outcome word only. Lock screens render
+            // this outside the app's auth; detail is behind the tap-through.
+            createIntent({
+                runId: span.runId,
+                spanId: span.spanId,
+                kind: "failure",
+                tag: `failure:${span.jobName ?? span.sessionId ?? span.runId}`,
+                title: `${label} ${span.outcome === "interrupted" ? "was interrupted" : "failed"}`,
+                body: "Open to see the run.",
+                suppressed: watched,
+            });
+            return;
+        }
+        if (span.outcome === "success" && span.jobName) {
+            // Completion notifications are opt-in per job.
+            const optIn = getSetting(db, "activity.notify.completions", [], log);
+            if (optIn.includes(span.jobName)) {
+                createIntent({
+                    runId: span.runId,
+                    spanId: span.spanId,
+                    kind: "completion",
+                    tag: `completion:${span.jobName}:${span.runId}`,
+                    title: `${span.jobName} completed`,
+                    body: "Open to see the run.",
+                });
+            }
+        }
+    }
+    return {
+        tick(now) {
+            try {
+                // New committed changes since our own cursor: terminal root spans
+                // among them become intents (SQL-side filter + join in the store).
+                // The head is read BEFORE the detection query so advancing past
+                // non-terminal changes can never skip a terminal write committed
+                // in between; a change seen twice is absorbed by the tag dedupe.
+                const head = latestCursor(db);
+                const rows = store.terminalRootChangesSince(cursor, 500);
+                for (const { span } of rows)
+                    intentForSpan(span);
+                const lastSeen = rows.length > 0 ? rows[rows.length - 1].changeId : cursor;
+                cursor = rows.length === 500 ? lastSeen : Math.max(head, lastSeen);
+                // Watchdog: an over-threshold LIVE root run is stuck — a signal, not
+                // an outcome. Threshold from settings, per-job override supported.
+                const defaultThreshold = getSetting(db, "activity.watchdog.thresholdMs", DEFAULT_STUCK_THRESHOLD_MS, log);
+                const overrides = getSetting(db, "activity.watchdog.perJobMs", {}, log);
+                for (const span of store.findStuck(defaultThreshold, now)) {
+                    if (stuckFlagged.has(span.runId))
+                        continue;
+                    const threshold = span.jobName ? (overrides[span.jobName] ?? defaultThreshold) : defaultThreshold;
+                    if ((now ?? Date.now()) - span.startedAt < threshold)
+                        continue;
+                    stuckFlagged.add(span.runId);
+                    createIntent({
+                        runId: span.runId,
+                        spanId: span.spanId,
+                        kind: "stuck",
+                        tag: `stuck:${span.runId}`,
+                        title: `${span.jobName ?? span.name} is taking unusually long`,
+                        body: "Still running. Open to check on it.",
+                    });
+                }
+            }
+            catch (err) {
+                log?.emit({
+                    severityText: "WARN",
+                    body: "notifier tick failed",
+                    attributes: { error: err instanceof Error ? err.message : String(err) },
+                });
+            }
+        },
+        inbox(limit = 50) {
+            return db
+                .query("SELECT * FROM notification_intents WHERE acknowledged = 0 ORDER BY created_at DESC LIMIT ?")
+                .all(limit).map(rowToIntent);
+        },
+        pending(limit = 20) {
+            // Acknowledged means dismissed in the inbox — never push it later.
+            return db
+                .query("SELECT * FROM notification_intents WHERE status = 'pending' AND acknowledged = 0 ORDER BY created_at LIMIT ?")
+                .all(limit).map(rowToIntent);
+        },
+        markDelivered(id, status) {
+            db.query("UPDATE notification_intents SET status = ?, updated_at = ? WHERE id = ?").run(status, Date.now(), id);
+        },
+        acknowledge(id) {
+            const res = db
+                .query("UPDATE notification_intents SET acknowledged = 1, updated_at = ? WHERE id = ?")
+                .run(Date.now(), id);
+            return res.changes > 0;
+        },
+        acknowledgeAll() {
+            const res = db
+                .query("UPDATE notification_intents SET acknowledged = 1, updated_at = ? WHERE acknowledged = 0")
+                .run(Date.now());
+            return res.changes;
+        },
+        pruneAcknowledged(olderThanMs) {
+            const res = db
+                .query("DELETE FROM notification_intents WHERE acknowledged = 1 AND updated_at < ?")
+                .run(Date.now() - olderThanMs);
+            return res.changes;
+        },
+    };
+}
+function rowToIntent(r) {
+    return {
+        id: r.id,
+        runId: r.run_id,
+        spanId: r.span_id,
+        kind: r.kind,
+        tag: r.tag,
+        title: r.title,
+        body: r.body,
+        status: r.status,
+        acknowledged: r.acknowledged === 1,
+        createdAt: r.created_at,
+    };
+}
+//# sourceMappingURL=notify.js.map

package/dist/activity/notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/activity/notify.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAwC/C,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,6EAA6E;AAC7E,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3C,IAAI,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC9B,6EAA6E;IAC7E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvC,SAAS,YAAY,CAAC,QAAkB;QACtC,MAAM,GAAG,GAAG,QAAQ;aACjB,KAAK,CAAC,gEAAgE,CAAC;aACvE,GAAG,EAAoB,CAAC;QAC3B,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAED,SAAS,YAAY,CAAC,KAQrB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,EAAE;aAChB,KAAK,CACJ,gFAAgF,CACjF;aACA,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,QAAQ;YAAE,OAAO;QACrB,4BAA4B;QAC5B,MAAM,MAAM,GAAG,EAAE;aACd,KAAK,CAAC,qEAAqE,CAAC;aAC5E,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAkB,CAAC;QAC9C,MAAM,MAAM,GACV,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,EAAE,CAAC,KAAK,CACN;;6CAEuC,CACxC,CAAC,GAAG,CACH,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,MAAM,IAAI,IAAI,EACpB,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,EACV,MAAM,EACN,GAAG,EACH,GAAG,CACJ,CAAC;QACF,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EAAE,6BAA6B;YACnC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;IAED,SAAS,aAAa,CAAC,IAAa;QAClC,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO;QAC9B,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC;YACxC,gEAAgE;YAChE,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,OAAO,GAAG,SAAS,CAAC;gBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAC,CAAC;YACH,sEAAsE;YACtE,iEAAiE;YACjE,YAAY,CAAC;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,SAAS;gBACf,GAAG,EAAE,WAAW,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,EAAE;gBAC9D,KAAK,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE;gBAClF,IAAI,EAAE,sBAAsB;gBAC5B,UAAU,EAAE,OAAO;aACpB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/C,+CAA+C;YAC/C,MAAM,KAAK,GAAG,UAAU,CAAW,EAAE,EAAE,6BAA6B,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/E,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,YAAY,CAAC;oBACX,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI,EAAE,YAAY;oBAClB,GAAG,EAAE,cAAc,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE;oBAC/C,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,YAAY;oBAClC,IAAI,EAAE,sBAAsB;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,CAAC,GAAG;YACN,IAAI,CAAC;gBACH,kEAAkE;gBAClE,mEAAmE;gBACnE,gEAAgE;gBAChE,iEAAiE;gBACjE,iEAAiE;gBACjE,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;gBAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBACzD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI;oBAAE,aAAa,CAAC,IAAI,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC5E,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAEnE,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAM,gBAAgB,GAAG,UAAU,CACjC,EAAE,EACF,+BAA+B,EAC/B,0BAA0B,EAC1B,GAAG,CACJ,CAAC;gBACF,MAAM,SAAS,GAAG,UAAU,CAC1B,EAAE,EACF,4BAA4B,EAC5B,EAAE,EACF,GAAG,CACJ,CAAC;gBACF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC1D,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,SAAS;oBAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;oBAClG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,GAAG,SAAS;wBAAE,SAAS;oBAC/D,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC7B,YAAY,CAAC;wBACX,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,IAAI,EAAE,OAAO;wBACb,GAAG,EAAE,SAAS,IAAI,CAAC,KAAK,EAAE;wBAC1B,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,2BAA2B;wBAC9D,IAAI,EAAE,qCAAqC;qBAC5C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,EAAE,IAAI,CAAC;oBACR,YAAY,EAAE,MAAM;oBACpB,IAAI,EAAE,sBAAsB;oBAC5B,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK,GAAG,EAAE;YACd,OACE,EAAE;iBACC,KAAK,CACJ,4FAA4F,CAC7F;iBACA,GAAG,CAAC,KAAK,CACb,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrB,CAAC;QAED,OAAO,CAAC,KAAK,GAAG,EAAE;YAChB,mEAAmE;YACnE,OACE,EAAE;iBACC,KAAK,CACJ,8GAA8G,CAC/G;iBACA,GAAG,CAAC,KAAK,CACb,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrB,CAAC;QAED,aAAa,CAAC,EAAE,EAAE,MAAM;YACtB,EAAE,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC,GAAG,CACrF,MAAM,EACN,IAAI,CAAC,GAAG,EAAE,EACV,EAAE,CACH,CAAC;QACJ,CAAC;QAED,WAAW,CAAC,EAAE;YACZ,MAAM,GAAG,GAAG,EAAE;iBACX,KAAK,CAAC,+EAA+E,CAAC;iBACtF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YACvB,OAAO,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;QACzB,CAAC;QAED,cAAc;YACZ,MAAM,GAAG,GAAG,EAAE;iBACX,KAAK,CAAC,yFAAyF,CAAC;iBAChG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACnB,OAAO,GAAG,CAAC,OAAO,CAAC;QACrB,CAAC;QAED,iBAAiB,CAAC,WAAW;YAC3B,MAAM,GAAG,GAAG,EAAE;iBACX,KAAK,CAAC,4EAA4E,CAAC;iBACnF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,CAAC;YACjC,OAAO,GAAG,CAAC,OAAO,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAM;IACzB,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,MAAM;QACf,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC;AACJ,CAAC"}

package/dist/activity/push-sender.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The accelerator tier: web push delivery for pending notification intents.
+ *
+ * VAPID keys are generated at first boot into their own table (see migration
+ * 008 for why not the settings KV) and never leave the process. Payloads are
+ * MINIMIZED — title + outcome word + a deep link — because push renders on
+ * lock screens outside the app's auth; detail lives behind the authenticated
+ * tap-through.
+ *
+ * Delivery marks the intent sent/send_failed; the inbox (guaranteed tier)
+ * is untouched by any of it. A 404/410 response prunes the subscription —
+ * the push service says that device is gone. When every send in a pass
+ * fails, that is the all-devices signal (VAPID invalidated by a KV
+ * wipe/restore, typically) and it is logged loudly; the client surfaces a
+ * re-enable prompt when its subscription check disagrees with the server.
+ */
+import type { Database } from "bun:sqlite";
+import type { Logger } from "@opentelemetry/api-logs";
+import type { ActivityNotifier } from "./notify.js";
+export interface PushSubscriptionRow {
+    endpoint: string;
+    p256dh: string;
+    auth: string;
+    label: string | null;
+    createdAt: number;
+    lastUsedAt: number | null;
+}
+export interface PushSender {
+    publicKey(): string;
+    subscribe(sub: {
+        endpoint: string;
+        keys: {
+            p256dh: string;
+            auth: string;
+        };
+    }, label?: string): void;
+    unsubscribe(endpoint: string): boolean;
+    subscriptions(): PushSubscriptionRow[];
+    /** Deliver pending intents to every subscription. Returns sends attempted. */
+    deliverPending(notifier: ActivityNotifier): Promise<number>;
+}
+export interface CreatePushSenderOptions {
+    /** Injection seam for tests — the real webpush.sendNotification otherwise. */
+    send?: (subscription: {
+        endpoint: string;
+        keys: {
+            p256dh: string;
+            auth: string;
+        };
+    }, payload: string, options: {
+        vapidDetails: {
+            subject: string;
+            publicKey: string;
+            privateKey: string;
+        };
+        timeout?: number;
+    }) => Promise<unknown>;
+    /** `mailto:` or https contact required by the VAPID spec. */
+    subject?: string;
+    log?: Logger;
+}
+export declare function createPushSender(db: Database, options?: CreatePushSenderOptions): PushSender;
+//# sourceMappingURL=push-sender.d.ts.map

package/dist/activity/push-sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-sender.d.ts","sourceRoot":"","sources":["../../src/activity/push-sender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,IAAI,MAAM,CAAC;IACpB,SAAS,CAAC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnG,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,aAAa,IAAI,mBAAmB,EAAE,CAAC;IACvC,8EAA8E;IAC9E,cAAc,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,CACL,YAAY,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAC1E,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,YAAY,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;QACzE,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,KACE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAMD,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,OAAO,GAAE,uBAA4B,GACpC,UAAU,CAwJZ"}

package/dist/activity/push-sender.js

@@ -0,0 +1,131 @@
+import webpush from "web-push";
+/** Per-send cap: a hung push service rejects instead of wedging the
+ *  delivering guard (the tick's reentrancy flag) forever. */
+const SEND_TIMEOUT_MS = 10_000;
+export function createPushSender(db, options = {}) {
+    const log = options.log;
+    const subject = options.subject ?? "mailto:admin@localhost";
+    const send = options.send ??
+        ((sub, payload, opts) => webpush.sendNotification({ endpoint: sub.endpoint, keys: sub.keys }, payload, { vapidDetails: opts.vapidDetails, timeout: opts.timeout }));
+    // Generate-once VAPID keys. Concurrent first boots are safe: the INSERT is
+    // OR IGNORE and the read-back wins.
+    function vapid() {
+        const row = db
+            .query("SELECT public_key AS publicKey, private_key AS privateKey FROM vapid_keys WHERE id = 1")
+            .get();
+        if (row)
+            return row;
+        const generated = webpush.generateVAPIDKeys();
+        db.query("INSERT OR IGNORE INTO vapid_keys (id, public_key, private_key, created_at) VALUES (1, ?, ?, ?)").run(generated.publicKey, generated.privateKey, Date.now());
+        return vapid();
+    }
+    function rows() {
+        return db.query("SELECT * FROM push_subscriptions ORDER BY created_at").all().map((r) => ({
+            endpoint: r.endpoint,
+            p256dh: r.p256dh,
+            auth: r.auth,
+            label: r.label,
+            createdAt: r.created_at,
+            lastUsedAt: r.last_used_at,
+        }));
+    }
+    return {
+        publicKey() {
+            return vapid().publicKey;
+        },
+        subscribe(sub, label) {
+            db.query(`INSERT INTO push_subscriptions (endpoint, p256dh, auth, label, created_at)
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT(endpoint) DO UPDATE SET p256dh = excluded.p256dh, auth = excluded.auth`).run(sub.endpoint, sub.keys.p256dh, sub.keys.auth, label ?? null, Date.now());
+        },
+        unsubscribe(endpoint) {
+            return db.query("DELETE FROM push_subscriptions WHERE endpoint = ?").run(endpoint)
+                .changes > 0;
+        },
+        subscriptions: rows,
+        async deliverPending(notifier) {
+            const pending = notifier.pending();
+            if (pending.length === 0)
+                return 0;
+            if (rows().length === 0) {
+                // No devices: the inbox already has it; nothing to deliver. Leave
+                // the intents pending so a device subscribing later still gets them
+                // if they are fresh, and the boot sweep can retry.
+                return 0;
+            }
+            const keys = vapid();
+            let attempts = 0;
+            for (const intent of pending) {
+                // Re-read per intent: an endpoint pruned as dead during the previous
+                // intent's pass must not be attempted again in this one.
+                const subs = rows();
+                if (subs.length === 0)
+                    break;
+                // Minimized payload; the tag coalesces repeats per run across devices.
+                const payload = JSON.stringify({
+                    title: intent.title,
+                    body: intent.body,
+                    tag: `brain-activity:${intent.runId}`,
+                    url: `/#/activity/${encodeURIComponent(intent.runId)}`,
+                });
+                attempts += subs.length;
+                const results = await Promise.allSettled(subs.map((sub) => send({ endpoint: sub.endpoint, keys: { p256dh: sub.p256dh, auth: sub.auth } }, payload, {
+                    vapidDetails: { subject, publicKey: keys.publicKey, privateKey: keys.privateKey },
+                    timeout: SEND_TIMEOUT_MS,
+                })));
+                // DB writes only after the whole settled pass — never concurrent
+                // with in-flight sends against the same handle.
+                let delivered = 0;
+                const touched = [];
+                const dead = [];
+                results.forEach((result, i) => {
+                    const sub = subs[i];
+                    if (result.status === "fulfilled") {
+                        delivered++;
+                        touched.push(sub.endpoint);
+                        return;
+                    }
+                    const err = result.reason;
+                    const status = err.statusCode;
+                    if (status === 404 || status === 410) {
+                        // The push service says this device is gone.
+                        dead.push(sub.endpoint);
+                        log?.emit({
+                            severityText: "INFO",
+                            body: "pruned dead push subscription",
+                            attributes: { status: status },
+                        });
+                    }
+                    else {
+                        log?.emit({
+                            severityText: "WARN",
+                            body: "push send failed",
+                            attributes: {
+                                error: err instanceof Error ? err.message : String(err),
+                                ...(status ? { status } : {}),
+                            },
+                        });
+                    }
+                });
+                for (const endpoint of touched) {
+                    db.query("UPDATE push_subscriptions SET last_used_at = ? WHERE endpoint = ?").run(Date.now(), endpoint);
+                }
+                for (const endpoint of dead) {
+                    db.query("DELETE FROM push_subscriptions WHERE endpoint = ?").run(endpoint);
+                }
+                notifier.markDelivered(intent.id, delivered > 0 ? "sent" : "send_failed");
+                if (delivered === 0) {
+                    // Every device failed — the all-devices signal (invalid VAPID after
+                    // a restore, typically). Loud, because it is silent on every phone.
+                    log?.emit({
+                        severityText: "ERROR",
+                        body: "push delivery failed on every subscription",
+                        attributes: { subscriptions: subs.length },
+                    });
+                }
+            }
+            return attempts;
+        },
+    };
+}
+//# sourceMappingURL=push-sender.js.map

package/dist/activity/push-sender.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-sender.js","sourceRoot":"","sources":["../../src/activity/push-sender.ts"],"names":[],"mappings":"AAkBA,OAAO,OAAO,MAAM,UAAU,CAAC;AAqC/B;6DAC6D;AAC7D,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,UAAU,gBAAgB,CAC9B,EAAY,EACZ,UAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;IAC5D,MAAM,IAAI,GACR,OAAO,CAAC,IAAI;QACZ,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CACtB,OAAO,CAAC,gBAAgB,CACtB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAC1C,OAAO,EACP,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAC3D,CAAC,CAAC;IAEP,2EAA2E;IAC3E,oCAAoC;IACpC,SAAS,KAAK;QACZ,MAAM,GAAG,GAAG,EAAE;aACX,KAAK,CAAC,wFAAwF,CAAC;aAC/F,GAAG,EAAsD,CAAC;QAC7D,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9C,EAAE,CAAC,KAAK,CACN,gGAAgG,CACjG,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,OAAO,KAAK,EAAE,CAAC;IACjB,CAAC;IAED,SAAS,IAAI;QACX,OACE,EAAE,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC,GAAG,EACrE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,UAAU,EAAE,CAAC,CAAC,YAAY;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,OAAO;QACL,SAAS;YACP,OAAO,KAAK,EAAE,CAAC,SAAS,CAAC;QAC3B,CAAC;QAED,SAAS,CAAC,GAAG,EAAE,KAAK;YAClB,EAAE,CAAC,KAAK,CACN;;4FAEoF,CACrF,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,WAAW,CAAC,QAAQ;YAClB,OAAO,EAAE,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;iBAC/E,OAAO,GAAG,CAAC,CAAC;QACjB,CAAC;QAED,aAAa,EAAE,IAAI;QAEnB,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YACnC,IAAI,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,kEAAkE;gBAClE,oEAAoE;gBACpE,mDAAmD;gBACnD,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC;YACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;YAEjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,qEAAqE;gBACrE,yDAAyD;gBACzD,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;gBACpB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM;gBAC7B,uEAAuE;gBACvE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;oBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,kBAAkB,MAAM,CAAC,KAAK,EAAE;oBACrC,GAAG,EAAE,eAAe,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBACvD,CAAC,CAAC;gBACH,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC;gBACxB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,IAAI,CACF,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EACxE,OAAO,EACP;oBACE,YAAY,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;oBACjF,OAAO,EAAE,eAAe;iBACzB,CACF,CACF,CACF,CAAC;gBACF,iEAAiE;gBACjE,gDAAgD;gBAChD,IAAI,SAAS,GAAG,CAAC,CAAC;gBAClB,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAa,EAAE,CAAC;gBAC1B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;oBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;oBACrB,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;wBAClC,SAAS,EAAE,CAAC;wBACZ,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;wBAC3B,OAAO;oBACT,CAAC;oBACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;oBAC1B,MAAM,MAAM,GAAI,GAA+B,CAAC,UAAU,CAAC;oBAC3D,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;wBACrC,6CAA6C;wBAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;wBACxB,GAAG,EAAE,IAAI,CAAC;4BACR,YAAY,EAAE,MAAM;4BACpB,IAAI,EAAE,+BAA+B;4BACrC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;yBAC/B,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,GAAG,EAAE,IAAI,CAAC;4BACR,YAAY,EAAE,MAAM;4BACpB,IAAI,EAAE,kBAAkB;4BACxB,UAAU,EAAE;gCACV,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gCACvD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAC9B;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;oBAC/B,EAAE,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC,GAAG,CAC/E,IAAI,CAAC,GAAG,EAAE,EACV,QAAQ,CACT,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;oBAC5B,EAAE,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9E,CAAC;gBACD,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC1E,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;oBACpB,oEAAoE;oBACpE,oEAAoE;oBACpE,GAAG,EAAE,IAAI,CAAC;wBACR,YAAY,EAAE,OAAO;wBACrB,IAAI,EAAE,4CAA4C;wBAClD,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE;qBAC3C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/activity/query.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The agent-facing read over the activity record — the same data the UI
+ * reads, shaped for model consumption and served through the backend
+ * bridge's `queryActivity` seam (the MCP tool calls it).
+ *
+ * Read-only by construction: nothing here writes. Free-text fields that
+ * originated outside the primary agent's own context (failure reasons /
+ * stderr tails, subagent transcript excerpts) are DATA, not instructions —
+ * the tool layer labels them as such before they reach a model.
+ */
+import type { Database } from "bun:sqlite";
+import type { ActivityQuery, ActivityQueryResult } from "@schlessera/brain-ui-sdk/server";
+import type { ActivityNotifier } from "./notify.js";
+import { type ActivityStore } from "./store.js";
+export declare function runActivityQuery(db: Database, store: ActivityStore, query: ActivityQuery, notifier?: ActivityNotifier): ActivityQueryResult;
+//# sourceMappingURL=query.d.ts.map

package/dist/activity/query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.d.ts","sourceRoot":"","sources":["../../src/activity/query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAI1F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAkB,KAAK,aAAa,EAAgB,MAAM,YAAY,CAAC;AAE9E,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,aAAa,EACpB,KAAK,EAAE,aAAa,EACpB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,mBAAmB,CAoHrB"}