@threadbase-sh/streamer 1.47.3 → 1.49.0

package/dist/index.js

@@ -5550,6 +5550,167 @@ var PushRepository = class {
   }
 };
 
+// src/services/push/apnsClient.ts
+import { createSign } from "crypto";
+import { connect, constants } from "http2";
+var log3 = getLogger("apns");
+var APNS_HOST_SANDBOX = "api.sandbox.push.apple.com";
+var APNS_MAX_PAYLOAD_BYTES = 4096;
+var JWT_TTL_SECONDS = 3e3;
+var DEAD_TOKEN_REASONS = /* @__PURE__ */ new Set([
+  "BadDeviceToken",
+  "DeviceTokenNotForTopic",
+  "Unregistered",
+  "ExpiredToken"
+]);
+function base64url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function readApnsCredentialsFromEnv(env = process.env) {
+  const key = env.APNS_KEY;
+  if (!key || key.trim().length === 0) return null;
+  const keyId = env.APNS_KEY_ID?.trim();
+  const teamId = env.APNS_TEAM_ID?.trim();
+  const bundleId = env.APNS_BUNDLE_ID?.trim();
+  if (!keyId || !teamId || !bundleId) return null;
+  const host = env.APNS_HOST ?? APNS_HOST_SANDBOX;
+  return { key, keyId, teamId, bundleId, host };
+}
+function describeMissingApnsCredentials(env = process.env) {
+  if (!env.APNS_KEY || env.APNS_KEY.trim().length === 0) {
+    return "APNS_KEY is not set, so Live Activity push is disabled. Set it to the p8 key contents (not a path) to enable it.";
+  }
+  const missing = [
+    ["APNS_KEY_ID", env.APNS_KEY_ID],
+    ["APNS_TEAM_ID", env.APNS_TEAM_ID],
+    ["APNS_BUNDLE_ID", env.APNS_BUNDLE_ID]
+  ].filter(([, value]) => !value || value.trim().length === 0).map(([name]) => name);
+  if (missing.length === 0) return null;
+  return `APNS_KEY is set but ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not, so Live Activity push is disabled. Under launchd, APNS_KEY_ID is derived from the AuthKey_<keyId>.p8 filename; the team and bundle ids must be set explicitly.`;
+}
+var ApnsClient = class {
+  constructor(creds) {
+    this.creds = creds;
+  }
+  creds;
+  session = null;
+  cachedJwt = null;
+  /**
+   * The `apns-topic` for Live Activity pushes.
+   *
+   * The `.push-type.liveactivity` suffix is mandatory and is why the signing key
+   * must be Team Scoped (All Topics) — a key scoped to the bundle id alone
+   * cannot sign this topic.
+   */
+  get topic() {
+    return `${this.creds.bundleId}.push-type.liveactivity`;
+  }
+  /**
+   * Mint or reuse the provider JWT.
+   *
+   * ES256 over the p8 key. Cached until shortly before expiry: Apple rejects a
+   * token older than an hour, but minting one per request is wasteful and can
+   * trip APNs' provider-token-update throttle.
+   */
+  getJwt(now = Date.now()) {
+    const nowSeconds = Math.floor(now / 1e3);
+    if (this.cachedJwt && this.cachedJwt.expiresAt > nowSeconds + 60) {
+      return this.cachedJwt.token;
+    }
+    const header = base64url(JSON.stringify({ alg: "ES256", kid: this.creds.keyId, typ: "JWT" }));
+    const payload = base64url(JSON.stringify({ iss: this.creds.teamId, iat: nowSeconds }));
+    const signingInput = `${header}.${payload}`;
+    const signature = createSign("SHA256").update(signingInput).sign({ key: this.creds.key, dsaEncoding: "ieee-p1363" });
+    const token = `${signingInput}.${base64url(signature)}`;
+    this.cachedJwt = { token, expiresAt: nowSeconds + JWT_TTL_SECONDS };
+    return token;
+  }
+  /**
+   * Reuse one HTTP/2 session across sends.
+   *
+   * APNs expects a long-lived connection; a fresh TLS handshake per push is slow
+   * and Apple treats connection churn as abuse.
+   */
+  getSession() {
+    if (this.session && !this.session.closed && !this.session.destroyed) {
+      return this.session;
+    }
+    const session = connect(`https://${this.creds.host}`);
+    session.on("error", (err) => {
+      log3.warn("apns.session_error", { event: "apns.session_error", err: String(err) });
+    });
+    this.session = session;
+    return session;
+  }
+  /**
+   * Send one push.
+   *
+   * Resolves with a result rather than rejecting on an APNs rejection: a
+   * rejected push is an expected outcome the caller must act on (retire the
+   * token), not an exception. Only a genuinely unexpected local failure throws,
+   * and the caller logs it.
+   */
+  async send(args) {
+    const body = Buffer.from(JSON.stringify(args.payload), "utf-8");
+    if (body.byteLength > APNS_MAX_PAYLOAD_BYTES) {
+      throw new Error(
+        `APNs payload is ${body.byteLength} bytes, over the ${APNS_MAX_PAYLOAD_BYTES} byte limit`
+      );
+    }
+    const session = this.getSession();
+    const headers = {
+      [constants.HTTP2_HEADER_METHOD]: "POST",
+      [constants.HTTP2_HEADER_PATH]: `/3/device/${args.deviceToken}`,
+      [constants.HTTP2_HEADER_AUTHORIZATION]: `bearer ${this.getJwt()}`,
+      "apns-push-type": "liveactivity",
+      "apns-topic": this.topic,
+      "apns-priority": String(args.priority ?? 10),
+      ...args.expirationSeconds != null && {
+        "apns-expiration": String(args.expirationSeconds)
+      },
+      [constants.HTTP2_HEADER_CONTENT_TYPE]: "application/json",
+      [constants.HTTP2_HEADER_CONTENT_LENGTH]: String(body.byteLength)
+    };
+    return new Promise((resolve2, reject) => {
+      const req = session.request(headers);
+      req.setTimeout(args.timeoutMs ?? 1e4, () => {
+        req.close(constants.NGHTTP2_CANCEL);
+        resolve2({ ok: false, status: 0, reason: "Timeout", tokenDead: false });
+      });
+      let status = 0;
+      req.on("response", (resHeaders) => {
+        status = Number(resHeaders[constants.HTTP2_HEADER_STATUS] ?? 0);
+      });
+      const chunks = [];
+      req.on("data", (chunk) => chunks.push(chunk));
+      req.on("error", reject);
+      req.on("end", () => {
+        const raw = Buffer.concat(chunks).toString("utf-8");
+        let reason;
+        if (raw.length > 0) {
+          try {
+            reason = JSON.parse(raw).reason;
+          } catch {
+            reason = raw.slice(0, 200);
+          }
+        }
+        resolve2({
+          ok: status === 200,
+          status,
+          reason,
+          tokenDead: reason != null && DEAD_TOKEN_REASONS.has(reason)
+        });
+      });
+      req.end(body);
+    });
+  }
+  /** Close the shared connection. Called on server shutdown. */
+  close() {
+    this.session?.close();
+    this.session = null;
+  }
+};
+
 // src/api/routes/misc.routes.ts
 function numberOrNull(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
@@ -5586,6 +5747,17 @@ function verifyWebhookSignature(body, header, secret) {
   if (a.length !== b.length) return false;
   return timingSafeEqual3(a, b);
 }
+function describePushCapability(liveActivityEnabled, env = process.env) {
+  if (liveActivityEnabled) return { liveActivity: true, notifications: false };
+  return {
+    liveActivity: false,
+    notifications: false,
+    // describeMissingApnsCredentials only explains a *credential* gap and
+    // returns null once the credentials are complete — reachable here, because
+    // an unavailable token store disables the feature with the key still set.
+    liveActivityReason: describeMissingApnsCredentials(env) ?? "APNs credentials are set but the push token store is unavailable, so Live Activity push is disabled."
+  };
+}
 var clientLog = getLogger("client");
 var createMiscRoutes = (deps) => {
   const app = new Hono11();
@@ -5607,7 +5779,12 @@ var createMiscRoutes = (deps) => {
       featureFlags: true,
       // Same contract: this server serves GET /api/projects/summary, which the
       // Hub's grouped views need before they can draw a tree.
-      projectSummary: true
+      projectSummary: true,
+      // Delivery capability, not endpoint support: whether this server can
+      // actually send a push, so mobile can hide an affordance instead of
+      // registering tokens nothing will ever send to. Absent on older servers,
+      // which a client should read as "unknown", not "unavailable".
+      push: describePushCapability(deps.liveActivityPushEnabled())
     });
   });
   app.get("/api/profiles", (c) => c.json([]));
@@ -5668,9 +5845,10 @@ var createMiscRoutes = (deps) => {
     return c.json({ ok: true });
   });
   app.get("/api/push/health", (c) => {
+    const push = describePushCapability(deps.liveActivityPushEnabled());
     const repo = deps.pushRepo();
-    if (!repo) return c.json({ tokens: [], available: false });
-    return c.json({ tokens: repo.listHealth(), available: true });
+    if (!repo) return c.json({ tokens: [], available: false, push });
+    return c.json({ tokens: repo.listHealth(), available: true, push });
   });
   app.post("/api/__update", async (c) => {
     const cfg = loadUpdateConfig();
@@ -6172,7 +6350,7 @@ import { dirname as dirname7 } from "path";
 import { setImmediate as yieldToEventLoop } from "timers/promises";
 
 // src/db/query-timing.ts
-var log3 = getLogger("db");
+var log4 = getLogger("db");
 var DEFAULT_SLOW_QUERY_MS = 35;
 var LABEL = /* @__PURE__ */ Symbol("tbQueryLabel");
 function deriveLabel(sql) {
@@ -6188,15 +6366,15 @@ function resolveSlowMs() {
 }
 function record(label, ms, rows, slowMs) {
   if (slowMs > 0 && ms >= slowMs) {
-    log3.warn(
+    log4.warn(
       `[db] slow query ${label} ${ms.toFixed(1)}ms rows=${rows}`,
       { event: "db.slow_query", stmt: label, ms: Math.round(ms * 100) / 100, rows },
       "pino"
     );
     return;
   }
-  if (log3.pino.isLevelEnabled("debug")) {
-    log3.debug(
+  if (log4.pino.isLevelEnabled("debug")) {
+    log4.debug(
       `[db] ${label} ${ms.toFixed(2)}ms rows=${rows}`,
       { event: "db.query", stmt: label, ms: Math.round(ms * 100) / 100, rows },
       "pino"
@@ -8415,10 +8593,10 @@ function fingerprintOf(ids) {
   return `sha256:${createHash3("sha256").update(sorted.join("\n")).digest("hex")}`;
 }
 var CacheIntegrityMonitor = class {
-  constructor(cache, wsHub, log8, cacheDir, rescan, runDuringReset) {
+  constructor(cache, wsHub, log10, cacheDir, rescan, runDuringReset) {
     this.cache = cache;
     this.wsHub = wsHub;
-    this.log = log8;
+    this.log = log10;
     this.cacheDir = cacheDir;
     this.rescan = rescan;
     this.runDuringReset = runDuringReset;
@@ -9056,165 +9234,99 @@ function deriveProjectChatTitle(input) {
   return `Untitled \xB7 ${input.id.slice(0, 8)}`;
 }
 
-// src/services/push/apnsClient.ts
-import { createSign } from "crypto";
-import { connect, constants } from "http2";
-var log4 = getLogger("apns");
-var APNS_HOST_SANDBOX = "api.sandbox.push.apple.com";
-var APNS_MAX_PAYLOAD_BYTES = 4096;
-var JWT_TTL_SECONDS = 3e3;
-var DEAD_TOKEN_REASONS = /* @__PURE__ */ new Set([
-  "BadDeviceToken",
-  "DeviceTokenNotForTopic",
-  "Unregistered",
-  "ExpiredToken"
-]);
-function base64url(input) {
-  return Buffer.from(input).toString("base64url");
-}
-function readApnsCredentialsFromEnv(env = process.env) {
-  const key = env.APNS_KEY;
-  if (!key || key.trim().length === 0) return null;
-  const keyId = env.APNS_KEY_ID?.trim();
-  const teamId = env.APNS_TEAM_ID?.trim();
-  const bundleId = env.APNS_BUNDLE_ID?.trim();
-  if (!keyId || !teamId || !bundleId) return null;
-  const host = env.APNS_HOST ?? APNS_HOST_SANDBOX;
-  return { key, keyId, teamId, bundleId, host };
-}
-function describeMissingApnsCredentials(env = process.env) {
-  if (!env.APNS_KEY || env.APNS_KEY.trim().length === 0) {
-    return "APNS_KEY is not set, so Live Activity push is disabled. Set it to the p8 key contents (not a path) to enable it.";
-  }
-  const missing = [
-    ["APNS_KEY_ID", env.APNS_KEY_ID],
-    ["APNS_TEAM_ID", env.APNS_TEAM_ID],
-    ["APNS_BUNDLE_ID", env.APNS_BUNDLE_ID]
-  ].filter(([, value]) => !value || value.trim().length === 0).map(([name]) => name);
-  if (missing.length === 0) return null;
-  return `APNS_KEY is set but ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not, so Live Activity push is disabled. Under launchd, APNS_KEY_ID is derived from the AuthKey_<keyId>.p8 filename; the team and bundle ids must be set explicitly.`;
-}
-var ApnsClient = class {
-  constructor(creds) {
-    this.creds = creds;
-  }
-  creds;
-  session = null;
-  cachedJwt = null;
+// src/services/push/expoPushSender.ts
+var log5 = getLogger("expo-push");
+var EXPO_PUSH_ENDPOINT = "https://exp.host/--/api/v2/push/send";
+var EXPO_PUSH_BATCH_SIZE = 100;
+var DEAD_TOKEN_ERROR = "DeviceNotRegistered";
+var ExpoPushSender = class {
   /**
-   * The `apns-topic` for Live Activity pushes.
-   *
-   * The `.push-type.liveactivity` suffix is mandatory and is why the signing key
-   * must be Team Scoped (All Topics) — a key scoped to the bundle id alone
-   * cannot sign this topic.
+   * @param accessToken Expo access token, when the project has enhanced
+   * security enabled. Optional on purpose: a self-hoster does not own the Expo
+   * project and cannot obtain one, so requiring it would break the deployment
+   * this transport exists to serve.
    */
-  get topic() {
-    return `${this.creds.bundleId}.push-type.liveactivity`;
+  constructor(repo, accessToken) {
+    this.repo = repo;
+    this.accessToken = accessToken;
   }
+  repo;
+  accessToken;
   /**
-   * Mint or reuse the provider JWT.
+   * Send one message to every deliverable Expo token.
    *
-   * ES256 over the p8 key. Cached until shortly before expiry: Apple rejects a
-   * token older than an hour, but minting one per request is wasteful and can
-   * trip APNs' provider-token-update throttle.
+   * Sends are independent: Expo returns a ticket per token in one response, so
+   * a dead device is recorded against its own row and never silences the other
+   * devices in the batch.
    */
-  getJwt(now = Date.now()) {
-    const nowSeconds = Math.floor(now / 1e3);
-    if (this.cachedJwt && this.cachedJwt.expiresAt > nowSeconds + 60) {
-      return this.cachedJwt.token;
+  async send(message, now = Date.now()) {
+    const rows = this.repo.listDeliverable();
+    const outcome = { attempted: rows.length, succeeded: 0, retired: 0 };
+    if (rows.length === 0) return outcome;
+    for (let i = 0; i < rows.length; i += EXPO_PUSH_BATCH_SIZE) {
+      const chunk = rows.slice(i, i + EXPO_PUSH_BATCH_SIZE);
+      await this.sendChunk(chunk, message, now, outcome);
     }
-    const header = base64url(JSON.stringify({ alg: "ES256", kid: this.creds.keyId, typ: "JWT" }));
-    const payload = base64url(JSON.stringify({ iss: this.creds.teamId, iat: nowSeconds }));
-    const signingInput = `${header}.${payload}`;
-    const signature = createSign("SHA256").update(signingInput).sign({ key: this.creds.key, dsaEncoding: "ieee-p1363" });
-    const token = `${signingInput}.${base64url(signature)}`;
-    this.cachedJwt = { token, expiresAt: nowSeconds + JWT_TTL_SECONDS };
-    return token;
-  }
-  /**
-   * Reuse one HTTP/2 session across sends.
-   *
-   * APNs expects a long-lived connection; a fresh TLS handshake per push is slow
-   * and Apple treats connection churn as abuse.
-   */
-  getSession() {
-    if (this.session && !this.session.closed && !this.session.destroyed) {
-      return this.session;
-    }
-    const session = connect(`https://${this.creds.host}`);
-    session.on("error", (err) => {
-      log4.warn("apns.session_error", { event: "apns.session_error", err: String(err) });
-    });
-    this.session = session;
-    return session;
+    return outcome;
   }
-  /**
-   * Send one push.
-   *
-   * Resolves with a result rather than rejecting on an APNs rejection: a
-   * rejected push is an expected outcome the caller must act on (retire the
-   * token), not an exception. Only a genuinely unexpected local failure throws,
-   * and the caller logs it.
-   */
-  async send(args) {
-    const body = Buffer.from(JSON.stringify(args.payload), "utf-8");
-    if (body.byteLength > APNS_MAX_PAYLOAD_BYTES) {
-      throw new Error(
-        `APNs payload is ${body.byteLength} bytes, over the ${APNS_MAX_PAYLOAD_BYTES} byte limit`
-      );
-    }
-    const session = this.getSession();
-    const headers = {
-      [constants.HTTP2_HEADER_METHOD]: "POST",
-      [constants.HTTP2_HEADER_PATH]: `/3/device/${args.deviceToken}`,
-      [constants.HTTP2_HEADER_AUTHORIZATION]: `bearer ${this.getJwt()}`,
-      "apns-push-type": "liveactivity",
-      "apns-topic": this.topic,
-      "apns-priority": String(args.priority ?? 10),
-      ...args.expirationSeconds != null && {
-        "apns-expiration": String(args.expirationSeconds)
-      },
-      [constants.HTTP2_HEADER_CONTENT_TYPE]: "application/json",
-      [constants.HTTP2_HEADER_CONTENT_LENGTH]: String(body.byteLength)
-    };
-    return new Promise((resolve2, reject) => {
-      const req = session.request(headers);
-      req.setTimeout(args.timeoutMs ?? 1e4, () => {
-        req.close(constants.NGHTTP2_CANCEL);
-        resolve2({ ok: false, status: 0, reason: "Timeout", tokenDead: false });
-      });
-      let status = 0;
-      req.on("response", (resHeaders) => {
-        status = Number(resHeaders[constants.HTTP2_HEADER_STATUS] ?? 0);
+  async sendChunk(rows, message, now, outcome) {
+    let payload;
+    try {
+      const res = await fetch(EXPO_PUSH_ENDPOINT, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          accept: "application/json",
+          ...this.accessToken && { authorization: `Bearer ${this.accessToken}` }
+        },
+        body: JSON.stringify(rows.map((row) => ({ to: row.token, ...message })))
       });
-      const chunks = [];
-      req.on("data", (chunk) => chunks.push(chunk));
-      req.on("error", reject);
-      req.on("end", () => {
-        const raw = Buffer.concat(chunks).toString("utf-8");
-        let reason;
-        if (raw.length > 0) {
-          try {
-            reason = JSON.parse(raw).reason;
-          } catch {
-            reason = raw.slice(0, 200);
-          }
-        }
-        resolve2({
-          ok: status === 200,
-          status,
-          reason,
-          tokenDead: reason != null && DEAD_TOKEN_REASONS.has(reason)
+      if (!res.ok) {
+        const code = `HTTP_${res.status}`;
+        for (const row of rows) this.repo.recordFailure(row.token, code, now);
+        log5.warn("expo_push.request_rejected", {
+          event: "expo_push.request_rejected",
+          status: res.status,
+          tokens: rows.length
         });
+        return;
+      }
+      payload = await res.json();
+    } catch (err) {
+      for (const row of rows) this.repo.recordFailure(row.token, "SendError", now);
+      log5.error("expo_push.send_failed", {
+        event: "expo_push.send_failed",
+        tokens: rows.length,
+        err: String(err)
+      });
+      return;
+    }
+    const tickets = payload?.data;
+    rows.forEach((row, index) => {
+      const ticket = Array.isArray(tickets) ? tickets[index] : void 0;
+      if (!ticket) {
+        this.repo.recordFailure(row.token, "NoTicket", now);
+        return;
+      }
+      if (ticket.status === "ok") {
+        this.repo.recordSuccess(row.token, now);
+        outcome.succeeded += 1;
+        return;
+      }
+      const code = ticket.details?.error ?? "PushError";
+      this.repo.recordFailure(row.token, code, now);
+      if (code === DEAD_TOKEN_ERROR) {
+        this.repo.revoke(row.token, now);
+        outcome.retired += 1;
+      }
+      log5.warn("expo_push.send_rejected", {
+        event: "expo_push.send_rejected",
+        code,
+        message: ticket.message,
+        retired: code === DEAD_TOKEN_ERROR
       });
-      req.end(body);
     });
   }
-  /** Close the shared connection. Called on server shutdown. */
-  close() {
-    this.session?.close();
-    this.session = null;
-  }
 };
 
 // src/services/push/liveActivityContentState.ts
@@ -9228,7 +9340,7 @@ function truncateLastOutput(raw) {
 }
 
 // src/services/push/liveActivityNotifier.ts
-var log5 = getLogger("live-activity");
+var log6 = getLogger("live-activity");
 function contentStateForSession(args) {
   const status = toLiveActivityStatus(args.session.status);
   if (!status) return null;
@@ -9288,7 +9400,7 @@ var LiveActivityNotifier = class {
       }
       await this.maybeSendName(session);
     } catch (err) {
-      log5.error("live_activity.notify_failed", {
+      log6.error("live_activity.notify_failed", {
         event: "live_activity.notify_failed",
         sessionId: session.id,
         status: session.status,
@@ -9310,7 +9422,7 @@ var LiveActivityNotifier = class {
     });
     this.openActivity.set(session.id, { sessionNameSent: session.sessionName != null });
     if (outcome.attempted > 0) {
-      log5.info("live_activity.updated", {
+      log6.info("live_activity.updated", {
         event: "live_activity.updated",
         sessionId: session.id,
         status: contentState.status,
@@ -9334,7 +9446,7 @@ var LiveActivityNotifier = class {
     });
     open2.sessionNameSent = true;
     if (outcome.attempted > 0) {
-      log5.info("live_activity.updated", {
+      log6.info("live_activity.updated", {
         event: "live_activity.updated",
         sessionId: session.id,
         status: contentState.status,
@@ -9353,7 +9465,7 @@ var LiveActivityNotifier = class {
     if (!contentState) return;
     const outcome = await this.sender.end({ sessionId: session.id, contentState });
     if (outcome.attempted > 0) {
-      log5.info("live_activity.ended", {
+      log6.info("live_activity.ended", {
         event: "live_activity.ended",
         sessionId: session.id,
         ...outcome
@@ -9367,7 +9479,7 @@ var LiveActivityNotifier = class {
 };
 
 // src/services/push/liveActivitySender.ts
-var log6 = getLogger("live-activity");
+var log7 = getLogger("live-activity");
 var ACTIVITY_MAX_LIFETIME_MS = 8 * 60 * 60 * 1e3;
 function buildActivityKitPayload(args) {
   return {
@@ -9431,7 +9543,7 @@ var LiveActivitySender = class {
     );
     for (const { row, result, error } of results) {
       if (error) {
-        log6.error("live_activity.send_failed", {
+        log7.error("live_activity.send_failed", {
           event: "live_activity.send_failed",
           sessionId: args.sessionId,
           activityId: row.activity_id,
@@ -9452,7 +9564,7 @@ var LiveActivitySender = class {
         this.repo.expire(row.token, now);
         outcome.retired += 1;
       }
-      log6.warn("live_activity.send_rejected", {
+      log7.warn("live_activity.send_rejected", {
         event: "live_activity.send_rejected",
         sessionId: args.sessionId,
         activityId: row.activity_id,
@@ -9497,7 +9609,7 @@ var LiveActivitySender = class {
 };
 
 // src/services/push/liveActivityRenewal.ts
-var log7 = getLogger("live-activity");
+var log8 = getLogger("live-activity");
 var RENEWAL_LEAD_MS = 30 * 60 * 1e3;
 var MAX_TIMER_MS = 60 * 60 * 1e3;
 function renewalDueAt(row) {
@@ -9545,7 +9657,7 @@ var LiveActivityRenewalScheduler = class {
         await this.renew(row, now);
       }
     } catch (err) {
-      log7.error("live_activity.renewal_sweep_failed", {
+      log8.error("live_activity.renewal_sweep_failed", {
         event: "live_activity.renewal_sweep_failed",
         err: String(err)
       });
@@ -9574,7 +9686,7 @@ var LiveActivityRenewalScheduler = class {
     if (!session || !status) {
       this.deps.repo.claimRenewal(row.token, now);
       this.deps.repo.expire(row.token, now);
-      log7.info("live_activity.renewal_skipped", {
+      log8.info("live_activity.renewal_skipped", {
         event: "live_activity.renewal_skipped",
         sessionId: row.session_id,
         activityId: row.activity_id,
@@ -9609,7 +9721,7 @@ var LiveActivityRenewalScheduler = class {
         startedAt,
         now
       });
-      log7.info("live_activity.renewed", {
+      log8.info("live_activity.renewed", {
         event: "live_activity.renewed",
         sessionId: session.id,
         activityId: row.activity_id,
@@ -9619,7 +9731,7 @@ var LiveActivityRenewalScheduler = class {
         replacementRequested: started
       });
     } catch (err) {
-      log7.error("live_activity.renewal_failed", {
+      log8.error("live_activity.renewal_failed", {
         event: "live_activity.renewal_failed",
         sessionId: session.id,
         activityId: row.activity_id,
@@ -9664,6 +9776,77 @@ var LiveActivityRenewalScheduler = class {
   }
 };
 
+// src/services/push/waitingInputNotifier.ts
+var log9 = getLogger("expo-push");
+function waitingInputMessage(session, serverId) {
+  return {
+    title: session.projectName || "Threadbase",
+    body: "Waiting for your input",
+    data: { sessionId: session.id, serverId }
+  };
+}
+var WaitingInputNotifier = class {
+  /**
+   * @param isWatched Whether a client is currently subscribed to this session
+   * over WebSocket. Mobile subscribes while the session screen is open and the
+   * socket dies when the app is backgrounded, so this is the available signal
+   * for "the user is already looking" — and a push to someone already reading
+   * the output is pure noise.
+   */
+  constructor(sender, serverId, isWatched) {
+    this.sender = sender;
+    this.serverId = serverId;
+    this.isWatched = isWatched;
+  }
+  sender;
+  serverId;
+  isWatched;
+  /** Sessions with a turn the user started that has not yet been answered. */
+  openTurn = /* @__PURE__ */ new Set();
+  /**
+   * React to a session status change.
+   *
+   * Fire-and-forget by design: a push must never delay or fail a session
+   * transition, so this returns a promise the caller may ignore and every error
+   * is logged rather than propagated.
+   */
+  async onStatusChange(session, previousStatus) {
+    try {
+      if (session.status === "running") {
+        if (previousStatus === "waiting_input") this.openTurn.add(session.id);
+        return;
+      }
+      if (session.status !== "waiting_input") {
+        this.openTurn.delete(session.id);
+        return;
+      }
+      if (!this.openTurn.delete(session.id)) return;
+      if (this.isWatched(session.id)) {
+        log9.debug("expo_push.suppressed_watched", {
+          event: "expo_push.suppressed_watched",
+          sessionId: session.id
+        });
+        return;
+      }
+      const outcome = await this.sender.send(waitingInputMessage(session, this.serverId));
+      if (outcome.attempted > 0) {
+        log9.info("expo_push.waiting_input", {
+          event: "expo_push.waiting_input",
+          sessionId: session.id,
+          ...outcome
+        });
+      }
+    } catch (err) {
+      log9.error("expo_push.notify_failed", {
+        event: "expo_push.notify_failed",
+        sessionId: session.id,
+        status: session.status,
+        err: String(err)
+      });
+    }
+  }
+};
+
 // src/services/questions/parseStatusLine.ts
 var MODEL_RE = /(Opus|Sonnet|Haiku|Fable)\s+[\d.]+(?:\s*\([^)]*\))?/;
 var EFFORT_RE = /●\s*([A-Za-z]+)\s*·\s*\/effort/;
@@ -10974,6 +11157,10 @@ var StreamerServer = class {
   apnsClient = null;
   liveActivityNotifier = null;
   liveActivityRenewal = null;
+  // "Your turn" notifications over Expo's relay (#528). Needs no credential of
+  // its own, so unlike the Live Activity path it is on wherever the cache DB
+  // opened — with no registered device it simply sends nothing.
+  waitingInputNotifier = null;
   discoveryCache = null;
   // Single-flight for process discovery. Mobile polls GET /api/sessions and
   // retries on timeout; without this, every concurrent request starts its own
@@ -11273,6 +11460,7 @@ var StreamerServer = class {
           this.wsHub.broadcast({ type: "session_update", session: resp });
         }
         void this.liveActivityNotifier?.onStatusChange(session, previousStatus);
+        void this.waitingInputNotifier?.onStatusChange(session, previousStatus);
         this.sessionStatusBus.emit(`status:${session.id}`, session.status, session);
       }
     });
@@ -11318,6 +11506,7 @@ var StreamerServer = class {
       cache: () => this.cache,
       cacheMonitor: () => this.cacheMonitor,
       pushRepo: () => this.pushRepo,
+      liveActivityPushEnabled: () => this.liveActivityNotifier !== null,
       devicesRepo: () => this.devicesRepo,
       projectsRepo: () => this.projectsRepo,
       conversationsRepo: () => this.conversationsRepo,
@@ -11585,6 +11774,33 @@ var StreamerServer = class {
       topic: `${creds.bundleId}.push-type.liveactivity`
     });
   }
+  /**
+   * Bring up "your turn" notifications over Expo's relay (#528).
+   *
+   * Unconditional, unlike Live Activity push: Expo holds the app's APNs and FCM
+   * credentials, so a self-hosted streamer needs no credential of its own. The
+   * access token is optional and only relevant if the Expo project has enhanced
+   * security enabled — requiring one would lock out every self-hoster, since
+   * they do not own the project. It is never logged.
+   */
+  initWaitingInputPush(pushRepo) {
+    const sender = new ExpoPushSender(pushRepo, process.env.THREADBASE_EXPO_ACCESS_TOKEN);
+    const serverId = process.env.THREADBASE_INSTANCE_ID ?? hostname3();
+    this.waitingInputNotifier = new WaitingInputNotifier(
+      sender,
+      serverId,
+      (id) => this.hasSessionSubscriber(id)
+    );
+  }
+  /** Whether any live socket is subscribed to this session — "someone is looking". */
+  hasSessionSubscriber(sessionId) {
+    const subs = this.sessionSubscribers.get(sessionId);
+    if (!subs) return false;
+    for (const ws of subs) {
+      if (ws.readyState === ws.OPEN) return true;
+    }
+    return false;
+  }
   /**
    * Classify sessions left behind by previous streamer runs (C1 Phase 3a).
    *
@@ -12187,6 +12403,7 @@ var StreamerServer = class {
           this.pushRepo = new PushRepository(db);
           this.devicesRepo = new DevicesRepository(db);
           this.initLiveActivityPush(this.pushRepo);
+          this.initWaitingInputPush(this.pushRepo);
           this.cacheMonitor = new CacheIntegrityMonitor(
             this.cache,
             this.wsHub,