@threadbase-sh/streamer 1.37.0 → 1.39.0

package/dist/migrations/013_add_push_token_kind.sql

@@ -0,0 +1,63 @@
+-- Push token kinds, for iOS Live Activities (Feature 12 phase 1b).
+--
+-- push_tokens (012) modelled exactly one token per device: the Expo relay token
+-- used for ordinary notifications. A device now supplies three distinct token
+-- types, and they are NOT interchangeable:
+--
+--   expo             — Expo relay token. Ordinary push notifications.
+--   liveactivity_start — ActivityKit push-to-start token. App-wide, one per
+--                      device, long-lived. Starts an activity when none exists.
+--   liveactivity_update — ActivityKit per-activity update token. Issued by iOS
+--                      AFTER an activity starts, scoped to that one activity,
+--                      and short-lived.
+--
+-- Conflating them silently breaks delivery: an ActivityKit token posted to
+-- Expo's relay is rejected, and an Expo token used to sign a
+-- `.push-type.liveactivity` topic is rejected by APNs. Neither failure is
+-- visible at registration time, which is exactly why kind is stored explicitly
+-- rather than inferred from token shape.
+ALTER TABLE push_tokens ADD COLUMN kind TEXT NOT NULL DEFAULT 'expo';
+
+-- The ActivityKit activity this token updates, for kind =
+-- 'liveactivity_update' only. A device runs several activities at once (one per
+-- live session), so device_id alone cannot identify which row to update or end
+-- — the reason 012's one-row-per-device shape does not stretch to cover this.
+ALTER TABLE push_tokens ADD COLUMN activity_id TEXT;
+
+-- The session this activity is rendering. Sending is driven by session
+-- lifecycle transitions, so the send path looks tokens up by session, not by
+-- device.
+ALTER TABLE push_tokens ADD COLUMN session_id TEXT;
+
+-- Per-activity tokens expire. Retained rather than deleted (matching
+-- revoked_at's reasoning in 012) so the health report can say "expired"
+-- instead of the row simply vanishing.
+ALTER TABLE push_tokens ADD COLUMN expires_at INTEGER;
+
+-- iOS ends a Live Activity ~8h after it starts, so a long session must be
+-- renewed before the cap. Stored per activity rather than derived at read time:
+-- a renewal must survive a restart, and re-arming timers on boot needs a
+-- persisted deadline to read (an in-process timer does not survive).
+ALTER TABLE push_tokens ADD COLUMN stale_date INTEGER;
+
+-- The activity's ORIGINAL start, carried unchanged across every renewal.
+-- iOS renders its own ticking elapsed timer from this value, so a renewal that
+-- stamps a fresh start visibly resets the user's timer to zero. Persisting the
+-- original is what makes elapsed time continuous across a renewal.
+ALTER TABLE push_tokens ADD COLUMN started_at INTEGER;
+
+-- Set once a renewal has been performed for this row, making renewal
+-- idempotent: a restart mid-window re-arms the timer, and this column is what
+-- stops the re-armed timer from sending a second time.
+ALTER TABLE push_tokens ADD COLUMN renewed_at INTEGER;
+
+-- The send path selects by (kind, session) — driven by a session status change,
+-- never by scanning every token.
+CREATE INDEX IF NOT EXISTS idx_push_tokens_kind_session ON push_tokens (kind, session_id);
+
+-- The renewal scheduler scans for activities approaching their cap. Partial
+-- index: only unrenewed rows with a deadline are ever candidates, which keeps
+-- the boot-time re-arm scan proportional to pending renewals rather than to
+-- every token ever registered.
+CREATE INDEX IF NOT EXISTS idx_push_tokens_stale_date ON push_tokens (stale_date)
+  WHERE stale_date IS NOT NULL AND renewed_at IS NULL;

package/dist/migrations/014_add_conversation_meta_file_path_index.sql

@@ -0,0 +1,5 @@
+-- conversation_meta.file_path had no index, so getIdByFilePath /
+-- getProviderByFilePath (called per JSONL line from each active session's
+-- watcher) were full-table scans, blocking the single-threaded event loop
+-- under concurrent active sessions.
+CREATE INDEX IF NOT EXISTS idx_meta_file_path ON conversation_meta(file_path);

package/dist/pg-migrations/007_create_push_tokens.sql

@@ -0,0 +1,93 @@
+-- Push registration and delivery state, mirroring SQLite migrations 012 + 013.
+--
+-- SQLite is the primary persistence layer; Postgres is dormant (see CLAUDE.md).
+-- The two schemas are kept in sync so enabling Postgres later does not require
+-- reconstructing history. SQLite reached this shape in two steps (012 created
+-- the table, 013 added the kind columns); Postgres never had 012, so this
+-- single migration creates the end state directly.
+CREATE TABLE IF NOT EXISTS push_tokens (
+  -- The provider push token. Natural key: re-registering the same token must
+  -- update the existing row rather than accumulate duplicates, which is how one
+  -- device ends up receiving the same notification several times.
+  token             TEXT PRIMARY KEY,
+  platform          TEXT NOT NULL,
+
+  -- Optional device attribution. Nullable because push registration predates
+  -- device identity (C5) and must keep working without it.
+  device_id         TEXT,
+
+  registered_at     BIGINT NOT NULL,
+
+  -- Delivery health. Distinguishing "never tried" from "tried and failed" is
+  -- the difference between "not yet delivered" and "your notifications are
+  -- broken" — the report the user actually needs.
+  last_success_at   BIGINT,
+  last_failure_at   BIGINT,
+  last_failure_code TEXT,
+
+  -- Consecutive failures, reset on success. A token the provider has rejected
+  -- repeatedly is dead (app uninstalled, token rotated) and should stop being
+  -- retried rather than failing forever.
+  failure_streak    INTEGER NOT NULL DEFAULT 0,
+
+  -- Set when the provider reports the token permanently invalid, or the user
+  -- unregisters. Retained rather than deleted so the health report can explain
+  -- why delivery stopped.
+  revoked_at        BIGINT,
+
+  -- Token kind. A device supplies three non-interchangeable types: the Expo
+  -- relay token, the ActivityKit push-to-start token (app-wide), and an
+  -- ActivityKit per-activity update token (short-lived, issued after an
+  -- activity starts). Stored explicitly rather than inferred from token shape,
+  -- because a mismatch is rejected by the provider at send time with no signal
+  -- at registration time.
+  kind              TEXT NOT NULL DEFAULT 'expo',
+
+  -- The ActivityKit activity this token updates (kind =
+  -- 'liveactivity_update'). A device runs several activities at once, one per
+  -- live session, so device_id alone cannot identify which row to update.
+  activity_id       TEXT,
+
+  -- The session this activity renders. Sending is driven by session lifecycle
+  -- transitions, so the send path looks up by session rather than by device.
+  session_id        TEXT,
+
+  -- Per-activity tokens expire. Retained rather than deleted so health can
+  -- report "expired" instead of the row vanishing.
+  expires_at        BIGINT,
+
+  -- iOS ends a Live Activity ~8h after it starts. Persisted per activity
+  -- because a renewal must survive a restart: re-arming timers on boot needs a
+  -- durable deadline to read.
+  stale_date        BIGINT,
+
+  -- The activity's ORIGINAL start, carried unchanged across every renewal. iOS
+  -- renders its own ticking timer from this, so a renewal stamping a fresh
+  -- start visibly resets the user's elapsed time to zero.
+  started_at        BIGINT,
+
+  -- Set once this row has been renewed, making renewal idempotent: a restart
+  -- mid-window re-arms the timer, and this is what stops a second send.
+  renewed_at        BIGINT
+);
+
+-- Delivery attempts keyed by event id so a retry, a reconnect reconciliation,
+-- or a duplicate trigger cannot notify the user twice for one event.
+CREATE TABLE IF NOT EXISTS push_events (
+  event_id     TEXT PRIMARY KEY,
+  session_id   TEXT,
+  created_at   BIGINT NOT NULL,
+  delivered_at BIGINT
+);
+
+CREATE INDEX IF NOT EXISTS idx_push_tokens_revoked ON push_tokens (revoked_at);
+CREATE INDEX IF NOT EXISTS idx_push_events_created ON push_events (created_at);
+
+-- The send path selects by (kind, session), driven by a status change rather
+-- than by scanning every token.
+CREATE INDEX IF NOT EXISTS idx_push_tokens_kind_session ON push_tokens (kind, session_id);
+
+-- Renewal candidates only. Partial index keeps the boot-time re-arm scan
+-- proportional to pending renewals, not to every token ever registered.
+CREATE INDEX IF NOT EXISTS idx_push_tokens_stale_date ON push_tokens (stale_date)
+  WHERE stale_date IS NOT NULL AND renewed_at IS NULL;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@threadbase-sh/streamer",
-  "version": "1.37.0",
+  "version": "1.39.0",
   "description": "PTY session management, WebSocket streaming, and REST API server for Claude Code conversations",
   "license": "MIT",
   "author": "Ronen Mars",