@schlessera/brain-ui-server 0.18.0 → 0.20.0

package/README.md

@@ -71,6 +71,7 @@ Every variable this package reads, and what happens when it is unset.
 | --- | --- | --- |
 | `AGENT_BACKEND` | Primary agent backend: "claude" (default) or "pi". | claude |
 | `ALLOWED_ORIGINS` | Comma-separated cross-origin allowlist for a split client/API topology; empty means same-origin only. | (empty) |
+| `ANTHROPIC_API_KEY` | Consulted for PRESENCE only, to classify billing: when set it wins over CLAUDE_CODE_OAUTH_TOKEN (mirroring the Agent SDK's credential precedence), so ambient-credential profiles count as api-billed. | — |
 | `AUTH_MODE` | Authentication mode: password \| tailscale \| proxy \| none. Unset auto-detects (password when a hash is set, else tailscale). | (auto-detect) |
 | `BRAIN_PATH` | Path to the brain repo the server operates on. | $HOME/brain |
 | `BRAIN_UI_ALLOW_LOOPBACK_ORIGIN` | Set "1" to accept loopback Origins for WebAuthn regardless of Host (dev-only, for the vite proxy). | 0 |
@@ -83,9 +84,12 @@ Every variable this package reads, and what happens when it is unset.
 | `BRAIN_UI_MODEL_DISCOVERY` | Model discovery against the Anthropic Models API; "0"/"off"/"false" disables. Defaults ON, except under a test runner (NODE_ENV=test) where it defaults OFF. | on (off under NODE_ENV=test) |
 | `BRAIN_UI_MODEL_TTL_HOURS` | How long a model-discovery result stays fresh, in hours. | 24 |
 | `BRAIN_UI_PASSWORD_HASH` | Bun.password argon2id hash of the shared password. | **required** — AUTH_MODE=password |
+| `BRAIN_UI_PRICING_DISCOVERY` | Remote model-pricing refresh (LiteLLM + OpenRouter catalogs); "0"/"off"/"false" disables, and runs then roll up with unknown effective cost. Defaults ON, except under a test runner (NODE_ENV=test) where it defaults OFF. | on (off under NODE_ENV=test) |
+| `BRAIN_UI_PRICING_TTL_HOURS` | How long a fetched model-pricing table stays fresh, in hours. | 24 |
 | `BRAIN_UI_TURN_TIMEOUT_MS` | Hard per-turn timeout in ms; the host aborts a turn that runs past it. Raise for agent-heavy research work (e.g. 1800000 for 30 minutes). | 600000 (10 minutes) |
 | `BRAIN_UI_WS_BURST` | Inbound WebSocket frames absorbable in one burst before the sustained rate applies. Opening the app legitimately fires several at once. | 60 |
 | `BRAIN_UI_WS_RATE` | Sustained inbound WebSocket frames per second per connection. 0 disables metering entirely. | 20 |
+| `CLAUDE_CODE_OAUTH_TOKEN` | Consulted for PRESENCE only, to classify billing: with it set and no ANTHROPIC_API_KEY, ambient-credential Claude profiles (the built-in default and discovered models) count as subscription-billed. The token itself is consumed by the Claude backend / Agent SDK, not this package. | — |
 | `CLAUDE_CODE_PATH` | Path to the Claude Code native binary handed to the Agent SDK. | /usr/local/bin/claude |
 | `COOKIE_SECRET` | Secret signing the session cookie. | **required** — AUTH_MODE=password |
 | `DB_PATH` | SQLite file for the UI's own database (sessions, passkeys, settings). | ./brain-ui.db |
@@ -93,7 +97,7 @@ Every variable this package reads, and what happens when it is unset.
 | `HOME` | Fallback anchor for the BRAIN_PATH default only. | /root |
 | `HOST` | Bind host; consulted by the auth validation to decide whether AUTH_MODE=none is loopback-safe. | (empty) |
 | `MAX_CONCURRENT_SESSIONS` | Cap on concurrently RUNNING agent sessions. | 3 |
-| `NODE_ENV` | Only consulted for test-runner detection: flips the model-discovery default to off under bun test. Never gates any security behavior. | (unset) |
+| `NODE_ENV` | Only consulted for test-runner detection: flips the model-discovery and pricing-discovery defaults to off under bun test. Never gates any security behavior. | (unset) |
 | `PROXY_AUTH_HEADER` | Header a fronting auth proxy sets for AUTH_MODE=proxy. | x-forwarded-user |
 | `SOURCE_COMMIT` | Git SHA reported by /api/status (baked at image build time). | dev |
 | `TRUST_PROXY` | Set "1" to trust x-forwarded-for/x-real-ip and the proxy auth header; only safe behind a trusted reverse proxy. | **required** — AUTH_MODE=proxy |

package/data/model-prices.json

@@ -0,0 +1,63 @@
+{
+  "version": 1,
+  "fetchedAt": 0,
+  "snapshot": true,
+  "litellm": {
+    "fetchedAt": null,
+    "rates": {
+      "claude-opus-4-6": {
+        "input": 1.5e-5,
+        "output": 7.5e-5,
+        "cacheRead": 1.5e-6,
+        "cacheWrite": 1.875e-5
+      },
+      "claude-sonnet-4-5": {
+        "input": 3e-6,
+        "output": 1.5e-5,
+        "cacheRead": 3e-7,
+        "cacheWrite": 3.75e-6
+      },
+      "claude-haiku-4-5": {
+        "input": 1e-6,
+        "output": 5e-6,
+        "cacheRead": 1e-7,
+        "cacheWrite": 1.25e-6
+      },
+      "gemini/gemini-2.5-pro": {
+        "input": 1.25e-6,
+        "output": 1e-5,
+        "cacheRead": 3.125e-7,
+        "cacheWrite": null
+      },
+      "gemini/gemini-2.5-flash": {
+        "input": 3e-7,
+        "output": 2.5e-6,
+        "cacheRead": 7.5e-8,
+        "cacheWrite": null
+      }
+    }
+  },
+  "openrouter": {
+    "fetchedAt": null,
+    "rates": {
+      "z-ai/glm-4.7": {
+        "input": 6e-7,
+        "output": 2.2e-6,
+        "cacheRead": 1.1e-7,
+        "cacheWrite": null
+      },
+      "openai/gpt-oss-120b": {
+        "input": 1e-7,
+        "output": 5e-7,
+        "cacheRead": null,
+        "cacheWrite": null
+      },
+      "google/gemma-4-31b-it": {
+        "input": 1e-7,
+        "output": 3e-7,
+        "cacheRead": null,
+        "cacheWrite": null
+      }
+    }
+  }
+}

package/dist/activity/digest.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The while-you-were-away digest: a deterministic summary rendered from
+ * per-run rollups, produced by its OWN scheduled job (through the standard
+ * cron wrapper, so its runs land in the record like any other) — never a
+ * side effect of instrumentation.
+ *
+ * The digest's covered-until time is the retention floor: full-detail spans
+ * older than the last covered window are prunable, newer ones are not (the
+ * hard ceiling in the store bounds a broken digest job regardless). Windows
+ * are labeled — the card says WHAT period it covers rather than implying
+ * "now". The digest job's own runs are recorded but excluded from the
+ * notable list, or every digest would feature itself.
+ */
+import type { Database } from "bun:sqlite";
+import { type ActivityDigest } from "@schlessera/brain-ui-sdk/protocol";
+export type { ActivityDigest } from "@schlessera/brain-ui-sdk/protocol";
+export declare const DIGEST_LATEST_KEY = "activity.digest.latest";
+export declare const DIGEST_COVERED_KEY = "activity.digest.coveredUntil";
+export declare const DIGEST_DISMISSED_KEY = "activity.digest.dismissedAt";
+export declare const DIGEST_JOB_NAME = "digest";
+/** Generate and persist the digest for [coveredUntil, now]. */
+export declare function generateActivityDigest(db: Database, now?: number): ActivityDigest;
+/** The latest digest, or null before the first run. */
+export declare function latestActivityDigest(db: Database): ActivityDigest | null;
+/** The retention floor: never prune spans the digest has not covered. */
+export declare function digestRetentionFloor(db: Database): number;
+export declare function dismissActivityDigest(db: Database, at?: number): void;
+export declare function digestDismissedAt(db: Database): number;
+//# sourceMappingURL=digest.d.ts.map

package/dist/activity/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/activity/digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAK1F,YAAY,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAExE,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAC1D,eAAO,MAAM,kBAAkB,iCAAiC,CAAC;AACjE,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAClE,eAAO,MAAM,eAAe,WAAW,CAAC;AAKxC,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,SAAa,GAAG,cAAc,CAQrF;AAiED,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,GAAG,cAAc,GAAG,IAAI,CAExE;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,GAAG,MAAM,CAEzD;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAa,GAAG,IAAI,CAEzE;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,GAAG,MAAM,CAEtD"}

package/dist/activity/digest.js

@@ -0,0 +1,89 @@
+import { isFailureOutcome } from "@schlessera/brain-ui-sdk/protocol";
+import { getSetting, setSetting } from "../db/settings.js";
+import { rowToRunRollup, sumEffectiveCost } from "./store.js";
+export const DIGEST_LATEST_KEY = "activity.digest.latest";
+export const DIGEST_COVERED_KEY = "activity.digest.coveredUntil";
+export const DIGEST_DISMISSED_KEY = "activity.digest.dismissedAt";
+export const DIGEST_JOB_NAME = "digest";
+/** First run ever: no covered-until marker — cap the window at 24h. */
+const FIRST_WINDOW_MS = 24 * 60 * 60 * 1000;
+/** Generate and persist the digest for [coveredUntil, now]. */
+export function generateActivityDigest(db, now = Date.now()) {
+    // The read-compute-write of coveredUntil runs as ONE immediate transaction:
+    // the cron digest job and a manual generation are separate processes on the
+    // same DB, and unserialized they both window from the same coveredUntil —
+    // double-counting the overlap and letting the retention floor regress when
+    // the earlier `now` lands last. BEGIN IMMEDIATE + busy_timeout serializes
+    // them; the loser re-reads the winner's coveredUntil and windows after it.
+    return db.transaction(() => generateInTx(db, now)).immediate();
+}
+function generateInTx(db, now) {
+    const covered = getSetting(db, DIGEST_COVERED_KEY, null);
+    if (covered !== null && now <= covered) {
+        // A newer generation already committed — we serialized behind the race's
+        // winner, or our clock trails coveredUntil. The window would be inverted
+        // and empty; return the winner's digest instead of overwriting it.
+        const latest = latestActivityDigest(db);
+        if (latest)
+            return latest;
+        // Covered set but no stored digest (partial state): degrade to an empty
+        // window at the floor rather than inverting it.
+        now = covered;
+    }
+    const windowStart = covered ?? now - FIRST_WINDOW_MS;
+    // Windowed on ended_at, not started_at: every FINISHED run gets
+    // exactly-once coverage — a run still open at generation is picked up by
+    // the NEXT digest once it ends, instead of falling between windows.
+    const rows = db
+        .query(`SELECT * FROM activity_run_rollups
+         WHERE ended_at IS NOT NULL AND ended_at >= ? AND ended_at < ?
+         ORDER BY started_at DESC`)
+        .all(windowStart, now).map(rowToRunRollup);
+    const relevant = rows.filter((r) => r.jobName !== DIGEST_JOB_NAME);
+    const failures = relevant.filter((r) => isFailureOutcome(r.outcome));
+    // Both cost sums are sum-of-knowns; sumEffectiveCost counts the excluded
+    // unknown-cost runs so the digest never passes an unknown off as $0 (AE3).
+    const effective = sumEffectiveCost(relevant);
+    const digest = {
+        generatedAt: now,
+        windowStart,
+        windowEnd: now,
+        runs: relevant.length,
+        failures: failures.length,
+        costUsd: relevant.reduce((a, r) => a + (r.costUsd ?? 0), 0),
+        effectiveCostUsd: effective.effectiveCostUsd,
+        unpricedRuns: effective.unpricedRuns,
+        inputTokens: relevant.reduce((a, r) => a + (r.inputTokens ?? 0), 0),
+        outputTokens: relevant.reduce((a, r) => a + (r.outputTokens ?? 0), 0),
+        notable: failures.slice(0, 10).map((r) => ({
+            runId: r.runId,
+            name: r.name,
+            jobName: r.jobName,
+            sessionId: r.sessionId,
+            outcome: r.outcome,
+            failureReason: r.failureReason,
+            startedAt: r.startedAt,
+        })),
+    };
+    setSetting(db, DIGEST_LATEST_KEY, digest);
+    // Monotonic: a generator whose clock trails the previous coveredUntil
+    // (skew, or a back-to-back manual run) must not walk the retention floor
+    // backwards and re-expose already-covered spans to double coverage.
+    setSetting(db, DIGEST_COVERED_KEY, Math.max(now, covered ?? 0));
+    return digest;
+}
+/** The latest digest, or null before the first run. */
+export function latestActivityDigest(db) {
+    return getSetting(db, DIGEST_LATEST_KEY, null);
+}
+/** The retention floor: never prune spans the digest has not covered. */
+export function digestRetentionFloor(db) {
+    return getSetting(db, DIGEST_COVERED_KEY, 0);
+}
+export function dismissActivityDigest(db, at = Date.now()) {
+    setSetting(db, DIGEST_DISMISSED_KEY, at);
+}
+export function digestDismissedAt(db) {
+    return getSetting(db, DIGEST_DISMISSED_KEY, 0);
+}
+//# sourceMappingURL=digest.js.map

package/dist/activity/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../../src/activity/digest.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,gBAAgB,EAAuB,MAAM,mCAAmC,CAAC;AAE1F,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAI9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AACjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC,uEAAuE;AACvE,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C,+DAA+D;AAC/D,MAAM,UAAU,sBAAsB,CAAC,EAAY,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACnE,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,YAAY,CAAC,EAAY,EAAE,GAAW;IAC7C,MAAM,OAAO,GAAG,UAAU,CAAgB,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,OAAO,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;QACvC,yEAAyE;QACzE,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,MAAM,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,wEAAwE;QACxE,gDAAgD;QAChD,GAAG,GAAG,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,IAAI,GAAG,GAAG,eAAe,CAAC;IAErD,gEAAgE;IAChE,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,IAAI,GACR,EAAE;SACC,KAAK,CACJ;;kCAE0B,CAC3B;SACA,GAAG,CAAC,WAAW,EAAE,GAAG,CACxB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAmB;QAC7B,WAAW,EAAE,GAAG;QAChB,WAAW;QACX,SAAS,EAAE,GAAG;QACd,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3D,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QACnE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;KACJ,CAAC;IAEF,UAAU,CAAC,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAC1C,sEAAsE;IACtE,yEAAyE;IACzE,oEAAoE;IACpE,UAAU,CAAC,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CAAC,EAAY;IAC/C,OAAO,UAAU,CAAwB,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,oBAAoB,CAAC,EAAY;IAC/C,OAAO,UAAU,CAAS,EAAE,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,EAAY,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;IACjE,UAAU,CAAC,EAAE,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAY;IAC5C,OAAO,UAAU,CAAS,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/activity/notify.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Notification intents: the at-least-once layer between the activity record
+ * and every delivery channel.
+ *
+ * An intent is persisted when the triggering condition is DETECTED (a
+ * terminal failure span, a stuck run) and carries its own lifecycle:
+ * pending -> sent | send_failed | suppressed. The in-app inbox is the
+ * guaranteed tier — it lists unacknowledged intents regardless of delivery
+ * status — and web push (the accelerator) marks sent/send_failed on top.
+ * Undelivered intents survive restarts by construction; the boot/tick sweep
+ * simply finds them still pending.
+ *
+ * Detection runs on the server's always-on tick with its OWN change-log
+ * cursor (the live stream's cursor only advances for subscribers), so a
+ * foreign writer's failure — the cron wrapper recording an error while
+ * nobody watches — is noticed within one tick, not at the next app open.
+ *
+ * Storm safety: a run-scoped tag deduplicates (one active intent per tag),
+ * per-job debounce collapses repeats, and a global creation rate cap stops
+ * one bad API key from paging for every job at once.
+ */
+import type { Database } from "bun:sqlite";
+import type { Logger } from "@opentelemetry/api-logs";
+import type { ActivityStore } from "./store.js";
+export type IntentKind = "failure" | "completion" | "stuck";
+export interface NotificationIntent {
+    id: number;
+    runId: string;
+    spanId: string | null;
+    kind: IntentKind;
+    tag: string;
+    title: string;
+    body: string;
+    status: "pending" | "sent" | "send_failed" | "suppressed";
+    acknowledged: boolean;
+    createdAt: number;
+}
+export interface ActivityNotifierDeps {
+    db: Database;
+    store: ActivityStore;
+    /** Was anyone watching this run/session when the event was recorded? */
+    isWatched: (scope: {
+        runId?: string;
+        sessionId?: string;
+    }) => boolean;
+    log?: Logger;
+}
+export interface ActivityNotifier {
+    /** Detect new terminal failures + stuck runs; create intents. */
+    tick(now?: number): void;
+    /** Unacknowledged intents, newest first (the inbox). */
+    inbox(limit?: number): NotificationIntent[];
+    /** Intents awaiting delivery (the push sender's queue). */
+    pending(limit?: number): NotificationIntent[];
+    markDelivered(id: number, status: "sent" | "send_failed"): void;
+    acknowledge(id: number): boolean;
+    acknowledgeAll(): number;
+    /** Retention: delete acknowledged intents untouched for longer than this. */
+    pruneAcknowledged(olderThanMs: number): number;
+}
+export declare function createActivityNotifier(deps: ActivityNotifierDeps): ActivityNotifier;
+//# sourceMappingURL=notify.d.ts.map

package/dist/activity/notify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/activity/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAItD,OAAO,KAAK,EAAE,aAAa,EAAW,MAAM,YAAY,CAAC;AAEzD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC;AAE5D,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;IAC1D,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,QAAQ,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;IACrB,wEAAwE;IACxE,SAAS,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,iEAAiE;IACjE,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wDAAwD;IACxD,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAC5C,2DAA2D;IAC3D,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAAC;IAC9C,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAAC;IAChE,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,cAAc,IAAI,MAAM,CAAC;IACzB,6EAA6E;IAC7E,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;CAChD;AAaD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CAuNnF"}

package/dist/activity/notify.js

@@ -0,0 +1,193 @@
+import { isFailureOutcome } from "@schlessera/brain-ui-sdk/protocol";
+import { getSetting } from "../db/settings.js";
+/** Global cap on intents CREATED per hour — failure-storm circuit. */
+const MAX_INTENTS_PER_HOUR = 20;
+/** A send_failed intent is retried this many times before push is forfeited
+ *  (the inbox — the guaranteed tier — has it regardless). */
+const MAX_SEND_ATTEMPTS = 3;
+/** Backoff between retry attempts, so a transient push-service outage longer
+ *  than one tick still gets fresh attempts spread over ~15 minutes. */
+const SEND_RETRY_BACKOFF_MS = 5 * 60 * 1000;
+/** Watchdog default: a live root run older than this is flagged as stuck. */
+const DEFAULT_STUCK_THRESHOLD_MS = 45 * 60 * 1000;
+export function createActivityNotifier(deps) {
+    const { db, store, isWatched, log } = deps;
+    let cursor = latestCursor(db);
+    /** Runs already flagged as stuck this process lifetime (tag also guards). */
+    const stuckFlagged = new Set();
+    function latestCursor(database) {
+        const row = database
+            .query("SELECT COALESCE(MAX(change_id), 0) AS hi FROM activity_changes")
+            .get();
+        return row.hi;
+    }
+    function createIntent(input) {
+        const now = Date.now();
+        // Tag dedupe: one live (unacknowledged) intent per tag — repeats coalesce.
+        const existing = db
+            .query("SELECT id FROM notification_intents WHERE tag = ? AND acknowledged = 0 LIMIT 1")
+            .get(input.tag);
+        if (existing)
+            return;
+        // Global creation rate cap.
+        const recent = db
+            .query("SELECT COUNT(*) AS n FROM notification_intents WHERE created_at > ?")
+            .get(now - 60 * 60 * 1000);
+        const status = input.suppressed || recent.n >= MAX_INTENTS_PER_HOUR ? "suppressed" : "pending";
+        db.query(`INSERT INTO notification_intents
+         (run_id, span_id, kind, tag, title, body, status, acknowledged, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, 0, ?, ?)`).run(input.runId, input.spanId ?? null, input.kind, input.tag, input.title, input.body, status, now, now);
+        log?.emit({
+            severityText: "INFO",
+            body: "notification intent created",
+            attributes: { kind: input.kind, tag: input.tag, status },
+        });
+    }
+    function intentForSpan(span) {
+        if (span.parentSpanId)
+            return;
+        if (isFailureOutcome(span.outcome)) {
+            const label = span.jobName ?? span.name;
+            // "Unwatched" is evaluated when the failure is NOTICED — a live
+            // subscription to the run or its session means the user saw it happen,
+            // so the intent lands acknowledged-free but suppressed for delivery.
+            const watched = isWatched({
+                runId: span.runId,
+                ...(span.sessionId ? { sessionId: span.sessionId } : {}),
+            });
+            // Payload minimization: name + outcome word only. Lock screens render
+            // this outside the app's auth; detail is behind the tap-through.
+            createIntent({
+                runId: span.runId,
+                spanId: span.spanId,
+                kind: "failure",
+                tag: `failure:${span.jobName ?? span.sessionId ?? span.runId}`,
+                title: `${label} ${span.outcome === "interrupted" ? "was interrupted" : "failed"}`,
+                body: "Open to see the run.",
+                suppressed: watched,
+            });
+            return;
+        }
+        if (span.outcome === "success" && span.jobName) {
+            // Completion notifications are opt-in per job.
+            const optIn = getSetting(db, "activity.notify.completions", [], log);
+            if (optIn.includes(span.jobName)) {
+                createIntent({
+                    runId: span.runId,
+                    spanId: span.spanId,
+                    kind: "completion",
+                    tag: `completion:${span.jobName}:${span.runId}`,
+                    title: `${span.jobName} completed`,
+                    body: "Open to see the run.",
+                });
+            }
+        }
+    }
+    return {
+        tick(now) {
+            try {
+                // New committed changes since our own cursor: terminal root spans
+                // among them become intents (SQL-side filter + join in the store).
+                // The head is read BEFORE the detection query so advancing past
+                // non-terminal changes can never skip a terminal write committed
+                // in between; a change seen twice is absorbed by the tag dedupe.
+                const head = latestCursor(db);
+                const rows = store.terminalRootChangesSince(cursor, 500);
+                for (const { span } of rows)
+                    intentForSpan(span);
+                const lastSeen = rows.length > 0 ? rows[rows.length - 1].changeId : cursor;
+                cursor = rows.length === 500 ? lastSeen : Math.max(head, lastSeen);
+                // Watchdog: an over-threshold LIVE root run is stuck — a signal, not
+                // an outcome. Threshold from settings, per-job override supported.
+                const defaultThreshold = getSetting(db, "activity.watchdog.thresholdMs", DEFAULT_STUCK_THRESHOLD_MS, log);
+                const overrides = getSetting(db, "activity.watchdog.perJobMs", {}, log);
+                // Scan with the SMALLEST effective threshold: findStuck pre-filters
+                // by age, so a per-job override below the default would otherwise
+                // never see its candidates. The per-span check below still applies
+                // each job's own threshold.
+                const overrideValues = Object.values(overrides).filter((v) => typeof v === "number" && v > 0);
+                const scanThreshold = Math.min(defaultThreshold, ...overrideValues);
+                for (const span of store.findStuck(scanThreshold, now)) {
+                    if (stuckFlagged.has(span.runId))
+                        continue;
+                    const threshold = span.jobName ? (overrides[span.jobName] ?? defaultThreshold) : defaultThreshold;
+                    if ((now ?? Date.now()) - span.startedAt < threshold)
+                        continue;
+                    stuckFlagged.add(span.runId);
+                    createIntent({
+                        runId: span.runId,
+                        spanId: span.spanId,
+                        kind: "stuck",
+                        tag: `stuck:${span.runId}`,
+                        title: `${span.jobName ?? span.name} is taking unusually long`,
+                        body: "Still running. Open to check on it.",
+                    });
+                }
+            }
+            catch (err) {
+                log?.emit({
+                    severityText: "WARN",
+                    body: "notifier tick failed",
+                    attributes: { error: err instanceof Error ? err.message : String(err) },
+                });
+            }
+        },
+        inbox(limit = 50) {
+            return db
+                .query("SELECT * FROM notification_intents WHERE acknowledged = 0 ORDER BY created_at DESC LIMIT ?")
+                .all(limit).map(rowToIntent);
+        },
+        pending(limit = 20) {
+            // Acknowledged means dismissed in the inbox — never push it later.
+            // send_failed is retried with backoff until the attempt budget is
+            // spent: one transient push-service failure must not forfeit push.
+            return db
+                .query(`SELECT * FROM notification_intents
+             WHERE acknowledged = 0
+               AND (status = 'pending'
+                    OR (status = 'send_failed' AND send_attempts < ? AND updated_at < ?))
+             ORDER BY created_at LIMIT ?`)
+                .all(MAX_SEND_ATTEMPTS, Date.now() - SEND_RETRY_BACKOFF_MS, limit).map(rowToIntent);
+        },
+        markDelivered(id, status) {
+            // A failed pass spends one attempt from the retry budget.
+            db.query(`UPDATE notification_intents
+         SET status = ?, updated_at = ?,
+             send_attempts = send_attempts + (CASE WHEN ? = 'send_failed' THEN 1 ELSE 0 END)
+         WHERE id = ?`).run(status, Date.now(), status, id);
+        },
+        acknowledge(id) {
+            const res = db
+                .query("UPDATE notification_intents SET acknowledged = 1, updated_at = ? WHERE id = ?")
+                .run(Date.now(), id);
+            return res.changes > 0;
+        },
+        acknowledgeAll() {
+            const res = db
+                .query("UPDATE notification_intents SET acknowledged = 1, updated_at = ? WHERE acknowledged = 0")
+                .run(Date.now());
+            return res.changes;
+        },
+        pruneAcknowledged(olderThanMs) {
+            const res = db
+                .query("DELETE FROM notification_intents WHERE acknowledged = 1 AND updated_at < ?")
+                .run(Date.now() - olderThanMs);
+            return res.changes;
+        },
+    };
+}
+function rowToIntent(r) {
+    return {
+        id: r.id,
+        runId: r.run_id,
+        spanId: r.span_id,
+        kind: r.kind,
+        tag: r.tag,
+        title: r.title,
+        body: r.body,
+        status: r.status,
+        acknowledged: r.acknowledged === 1,
+        createdAt: r.created_at,
+    };
+}
+//# sourceMappingURL=notify.js.map

package/dist/activity/notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/activity/notify.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAwC/C,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC;6DAC6D;AAC7D,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B;uEACuE;AACvE,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,6EAA6E;AAC7E,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3C,IAAI,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC9B,6EAA6E;IAC7E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvC,SAAS,YAAY,CAAC,QAAkB;QACtC,MAAM,GAAG,GAAG,QAAQ;aACjB,KAAK,CAAC,gEAAgE,CAAC;aACvE,GAAG,EAAoB,CAAC;QAC3B,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAED,SAAS,YAAY,CAAC,KAQrB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,EAAE;aAChB,KAAK,CACJ,gFAAgF,CACjF;aACA,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,QAAQ;YAAE,OAAO;QACrB,4BAA4B;QAC5B,MAAM,MAAM,GAAG,EAAE;aACd,KAAK,CAAC,qEAAqE,CAAC;aAC5E,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAkB,CAAC;QAC9C,MAAM,MAAM,GACV,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,EAAE,CAAC,KAAK,CACN;;6CAEuC,CACxC,CAAC,GAAG,CACH,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,MAAM,IAAI,IAAI,EACpB,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,EACV,MAAM,EACN,GAAG,EACH,GAAG,CACJ,CAAC;QACF,GAAG,EAAE,IAAI,CAAC;YACR,YAAY,EAAE,MAAM;YACpB,IAAI,EAAE,6BAA6B;YACnC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;IAED,SAAS,aAAa,CAAC,IAAa;QAClC,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO;QAC9B,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC;YACxC,gEAAgE;YAChE,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,OAAO,GAAG,SAAS,CAAC;gBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD,CAAC,CAAC;YACH,sEAAsE;YACtE,iEAAiE;YACjE,YAAY,CAAC;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,SAAS;gBACf,GAAG,EAAE,WAAW,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,EAAE;gBAC9D,KAAK,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE;gBAClF,IAAI,EAAE,sBAAsB;gBAC5B,UAAU,EAAE,OAAO;aACpB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/C,+CAA+C;YAC/C,MAAM,KAAK,GAAG,UAAU,CAAW,EAAE,EAAE,6BAA6B,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/E,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,YAAY,CAAC;oBACX,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,IAAI,EAAE,YAAY;oBAClB,GAAG,EAAE,cAAc,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE;oBAC/C,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,YAAY;oBAClC,IAAI,EAAE,sBAAsB;iBAC7B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,CAAC,GAAG;YACN,IAAI,CAAC;gBACH,kEAAkE;gBAClE,mEAAmE;gBACnE,gEAAgE;gBAChE,iEAAiE;gBACjE,iEAAiE;gBACjE,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;gBAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBACzD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI;oBAAE,aAAa,CAAC,IAAI,CAAC,CAAC;gBACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC5E,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAEnE,qEAAqE;gBACrE,mEAAmE;gBACnE,MAAM,gBAAgB,GAAG,UAAU,CACjC,EAAE,EACF,+BAA+B,EAC/B,0BAA0B,EAC1B,GAAG,CACJ,CAAC;gBACF,MAAM,SAAS,GAAG,UAAU,CAC1B,EAAE,EACF,4BAA4B,EAC5B,EAAE,EACF,GAAG,CACJ,CAAC;gBACF,oEAAoE;gBACpE,kEAAkE;gBAClE,mEAAmE;gBACnE,4BAA4B;gBAC5B,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CACpD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,CACnD,CAAC;gBACF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,cAAc,CAAC,CAAC;gBACpE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC;oBACvD,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,SAAS;oBAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC;oBAClG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,GAAG,SAAS;wBAAE,SAAS;oBAC/D,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC7B,YAAY,CAAC;wBACX,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,IAAI,EAAE,OAAO;wBACb,GAAG,EAAE,SAAS,IAAI,CAAC,KAAK,EAAE;wBAC1B,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,2BAA2B;wBAC9D,IAAI,EAAE,qCAAqC;qBAC5C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,EAAE,IAAI,CAAC;oBACR,YAAY,EAAE,MAAM;oBACpB,IAAI,EAAE,sBAAsB;oBAC5B,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK,GAAG,EAAE;YACd,OACE,EAAE;iBACC,KAAK,CACJ,4FAA4F,CAC7F;iBACA,GAAG,CAAC,KAAK,CACb,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrB,CAAC;QAED,OAAO,CAAC,KAAK,GAAG,EAAE;YAChB,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,OACE,EAAE;iBACC,KAAK,CACJ;;;;yCAI6B,CAC9B;iBACA,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,EAAE,KAAK,CACpE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrB,CAAC;QAED,aAAa,CAAC,EAAE,EAAE,MAAM;YACtB,0DAA0D;YAC1D,EAAE,CAAC,KAAK,CACN;;;sBAGc,CACf,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,WAAW,CAAC,EAAE;YACZ,MAAM,GAAG,GAAG,EAAE;iBACX,KAAK,CAAC,+EAA+E,CAAC;iBACtF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YACvB,OAAO,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;QACzB,CAAC;QAED,cAAc;YACZ,MAAM,GAAG,GAAG,EAAE;iBACX,KAAK,CAAC,yFAAyF,CAAC;iBAChG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACnB,OAAO,GAAG,CAAC,OAAO,CAAC;QACrB,CAAC;QAED,iBAAiB,CAAC,WAAW;YAC3B,MAAM,GAAG,GAAG,EAAE;iBACX,KAAK,CAAC,4EAA4E,CAAC;iBACnF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,CAAC;YACjC,OAAO,GAAG,CAAC,OAAO,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAM;IACzB,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,MAAM;QACf,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC;AACJ,CAAC"}

package/dist/activity/push-sender.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The accelerator tier: web push delivery for pending notification intents.
+ *
+ * VAPID keys are generated at first boot into their own table (see migration
+ * 008 for why not the settings KV) and never leave the process. Payloads are
+ * MINIMIZED — title + outcome word + a deep link — because push renders on
+ * lock screens outside the app's auth; detail lives behind the authenticated
+ * tap-through.
+ *
+ * Delivery marks the intent sent/send_failed; the inbox (guaranteed tier)
+ * is untouched by any of it. A 404/410 response prunes the subscription —
+ * the push service says that device is gone. When every send in a pass
+ * fails, that is the all-devices signal (VAPID invalidated by a KV
+ * wipe/restore, typically) and it is logged loudly; the client surfaces a
+ * re-enable prompt when its subscription check disagrees with the server.
+ */
+import type { Database } from "bun:sqlite";
+import type { Logger } from "@opentelemetry/api-logs";
+import type { ActivityNotifier } from "./notify.js";
+export interface PushSubscriptionRow {
+    endpoint: string;
+    p256dh: string;
+    auth: string;
+    label: string | null;
+    createdAt: number;
+    lastUsedAt: number | null;
+}
+export interface PushSender {
+    publicKey(): string;
+    subscribe(sub: {
+        endpoint: string;
+        keys: {
+            p256dh: string;
+            auth: string;
+        };
+    }, label?: string): void;
+    unsubscribe(endpoint: string): boolean;
+    subscriptions(): PushSubscriptionRow[];
+    /** Deliver pending intents to every subscription. Returns sends attempted. */
+    deliverPending(notifier: ActivityNotifier): Promise<number>;
+}
+export interface CreatePushSenderOptions {
+    /** Injection seam for tests — the real webpush.sendNotification otherwise. */
+    send?: (subscription: {
+        endpoint: string;
+        keys: {
+            p256dh: string;
+            auth: string;
+        };
+    }, payload: string, options: {
+        vapidDetails: {
+            subject: string;
+            publicKey: string;
+            privateKey: string;
+        };
+        timeout?: number;
+    }) => Promise<unknown>;
+    /** `mailto:` or https contact required by the VAPID spec. */
+    subject?: string;
+    log?: Logger;
+}
+export declare function createPushSender(db: Database, options?: CreatePushSenderOptions): PushSender;
+//# sourceMappingURL=push-sender.d.ts.map

package/dist/activity/push-sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-sender.d.ts","sourceRoot":"","sources":["../../src/activity/push-sender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,IAAI,MAAM,CAAC;IACpB,SAAS,CAAC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnG,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,aAAa,IAAI,mBAAmB,EAAE,CAAC;IACvC,8EAA8E;IAC9E,cAAc,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,CACL,YAAY,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAC1E,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,YAAY,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;QACzE,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,KACE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAMD,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,OAAO,GAAE,uBAA4B,GACpC,UAAU,CAwJZ"}