@threadbase-sh/streamer 1.48.0 → 1.49.0

package/dist/index.d.cts

@@ -1706,6 +1706,13 @@ type ApiDeps = {
     cacheMonitor: () => CacheIntegrityMonitor | null;
     /** Push registration + delivery state (C7). Null when the cache DB is unavailable. */
     pushRepo: () => PushRepository | null;
+    /**
+     * Whether Live Activity push is actually running on this server — the same
+     * fact the boot log reports as `live_activity.enabled`. Asked of the server
+     * rather than re-derived from the environment, because APNs credentials alone
+     * do not enable it: the sender is only wired when the token store opened too.
+     */
+    liveActivityPushEnabled: () => boolean;
     /** Paired-device registry (C5). Null when the cache DB is unavailable. */
     devicesRepo: () => DevicesRepository | null;
     projectsRepo: () => ProjectsRepository | null;

package/dist/index.d.ts

@@ -1706,6 +1706,13 @@ type ApiDeps = {
     cacheMonitor: () => CacheIntegrityMonitor | null;
     /** Push registration + delivery state (C7). Null when the cache DB is unavailable. */
     pushRepo: () => PushRepository | null;
+    /**
+     * Whether Live Activity push is actually running on this server — the same
+     * fact the boot log reports as `live_activity.enabled`. Asked of the server
+     * rather than re-derived from the environment, because APNs credentials alone
+     * do not enable it: the sender is only wired when the token store opened too.
+     */
+    liveActivityPushEnabled: () => boolean;
     /** Paired-device registry (C5). Null when the cache DB is unavailable. */
     devicesRepo: () => DevicesRepository | null;
     projectsRepo: () => ProjectsRepository | null;

package/dist/index.js

@@ -5550,6 +5550,167 @@ var PushRepository = class {
   }
 };
 
+// src/services/push/apnsClient.ts
+import { createSign } from "crypto";
+import { connect, constants } from "http2";
+var log3 = getLogger("apns");
+var APNS_HOST_SANDBOX = "api.sandbox.push.apple.com";
+var APNS_MAX_PAYLOAD_BYTES = 4096;
+var JWT_TTL_SECONDS = 3e3;
+var DEAD_TOKEN_REASONS = /* @__PURE__ */ new Set([
+  "BadDeviceToken",
+  "DeviceTokenNotForTopic",
+  "Unregistered",
+  "ExpiredToken"
+]);
+function base64url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function readApnsCredentialsFromEnv(env = process.env) {
+  const key = env.APNS_KEY;
+  if (!key || key.trim().length === 0) return null;
+  const keyId = env.APNS_KEY_ID?.trim();
+  const teamId = env.APNS_TEAM_ID?.trim();
+  const bundleId = env.APNS_BUNDLE_ID?.trim();
+  if (!keyId || !teamId || !bundleId) return null;
+  const host = env.APNS_HOST ?? APNS_HOST_SANDBOX;
+  return { key, keyId, teamId, bundleId, host };
+}
+function describeMissingApnsCredentials(env = process.env) {
+  if (!env.APNS_KEY || env.APNS_KEY.trim().length === 0) {
+    return "APNS_KEY is not set, so Live Activity push is disabled. Set it to the p8 key contents (not a path) to enable it.";
+  }
+  const missing = [
+    ["APNS_KEY_ID", env.APNS_KEY_ID],
+    ["APNS_TEAM_ID", env.APNS_TEAM_ID],
+    ["APNS_BUNDLE_ID", env.APNS_BUNDLE_ID]
+  ].filter(([, value]) => !value || value.trim().length === 0).map(([name]) => name);
+  if (missing.length === 0) return null;
+  return `APNS_KEY is set but ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not, so Live Activity push is disabled. Under launchd, APNS_KEY_ID is derived from the AuthKey_<keyId>.p8 filename; the team and bundle ids must be set explicitly.`;
+}
+var ApnsClient = class {
+  constructor(creds) {
+    this.creds = creds;
+  }
+  creds;
+  session = null;
+  cachedJwt = null;
+  /**
+   * The `apns-topic` for Live Activity pushes.
+   *
+   * The `.push-type.liveactivity` suffix is mandatory and is why the signing key
+   * must be Team Scoped (All Topics) — a key scoped to the bundle id alone
+   * cannot sign this topic.
+   */
+  get topic() {
+    return `${this.creds.bundleId}.push-type.liveactivity`;
+  }
+  /**
+   * Mint or reuse the provider JWT.
+   *
+   * ES256 over the p8 key. Cached until shortly before expiry: Apple rejects a
+   * token older than an hour, but minting one per request is wasteful and can
+   * trip APNs' provider-token-update throttle.
+   */
+  getJwt(now = Date.now()) {
+    const nowSeconds = Math.floor(now / 1e3);
+    if (this.cachedJwt && this.cachedJwt.expiresAt > nowSeconds + 60) {
+      return this.cachedJwt.token;
+    }
+    const header = base64url(JSON.stringify({ alg: "ES256", kid: this.creds.keyId, typ: "JWT" }));
+    const payload = base64url(JSON.stringify({ iss: this.creds.teamId, iat: nowSeconds }));
+    const signingInput = `${header}.${payload}`;
+    const signature = createSign("SHA256").update(signingInput).sign({ key: this.creds.key, dsaEncoding: "ieee-p1363" });
+    const token = `${signingInput}.${base64url(signature)}`;
+    this.cachedJwt = { token, expiresAt: nowSeconds + JWT_TTL_SECONDS };
+    return token;
+  }
+  /**
+   * Reuse one HTTP/2 session across sends.
+   *
+   * APNs expects a long-lived connection; a fresh TLS handshake per push is slow
+   * and Apple treats connection churn as abuse.
+   */
+  getSession() {
+    if (this.session && !this.session.closed && !this.session.destroyed) {
+      return this.session;
+    }
+    const session = connect(`https://${this.creds.host}`);
+    session.on("error", (err) => {
+      log3.warn("apns.session_error", { event: "apns.session_error", err: String(err) });
+    });
+    this.session = session;
+    return session;
+  }
+  /**
+   * Send one push.
+   *
+   * Resolves with a result rather than rejecting on an APNs rejection: a
+   * rejected push is an expected outcome the caller must act on (retire the
+   * token), not an exception. Only a genuinely unexpected local failure throws,
+   * and the caller logs it.
+   */
+  async send(args) {
+    const body = Buffer.from(JSON.stringify(args.payload), "utf-8");
+    if (body.byteLength > APNS_MAX_PAYLOAD_BYTES) {
+      throw new Error(
+        `APNs payload is ${body.byteLength} bytes, over the ${APNS_MAX_PAYLOAD_BYTES} byte limit`
+      );
+    }
+    const session = this.getSession();
+    const headers = {
+      [constants.HTTP2_HEADER_METHOD]: "POST",
+      [constants.HTTP2_HEADER_PATH]: `/3/device/${args.deviceToken}`,
+      [constants.HTTP2_HEADER_AUTHORIZATION]: `bearer ${this.getJwt()}`,
+      "apns-push-type": "liveactivity",
+      "apns-topic": this.topic,
+      "apns-priority": String(args.priority ?? 10),
+      ...args.expirationSeconds != null && {
+        "apns-expiration": String(args.expirationSeconds)
+      },
+      [constants.HTTP2_HEADER_CONTENT_TYPE]: "application/json",
+      [constants.HTTP2_HEADER_CONTENT_LENGTH]: String(body.byteLength)
+    };
+    return new Promise((resolve2, reject) => {
+      const req = session.request(headers);
+      req.setTimeout(args.timeoutMs ?? 1e4, () => {
+        req.close(constants.NGHTTP2_CANCEL);
+        resolve2({ ok: false, status: 0, reason: "Timeout", tokenDead: false });
+      });
+      let status = 0;
+      req.on("response", (resHeaders) => {
+        status = Number(resHeaders[constants.HTTP2_HEADER_STATUS] ?? 0);
+      });
+      const chunks = [];
+      req.on("data", (chunk) => chunks.push(chunk));
+      req.on("error", reject);
+      req.on("end", () => {
+        const raw = Buffer.concat(chunks).toString("utf-8");
+        let reason;
+        if (raw.length > 0) {
+          try {
+            reason = JSON.parse(raw).reason;
+          } catch {
+            reason = raw.slice(0, 200);
+          }
+        }
+        resolve2({
+          ok: status === 200,
+          status,
+          reason,
+          tokenDead: reason != null && DEAD_TOKEN_REASONS.has(reason)
+        });
+      });
+      req.end(body);
+    });
+  }
+  /** Close the shared connection. Called on server shutdown. */
+  close() {
+    this.session?.close();
+    this.session = null;
+  }
+};
+
 // src/api/routes/misc.routes.ts
 function numberOrNull(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
@@ -5586,6 +5747,17 @@ function verifyWebhookSignature(body, header, secret) {
   if (a.length !== b.length) return false;
   return timingSafeEqual3(a, b);
 }
+function describePushCapability(liveActivityEnabled, env = process.env) {
+  if (liveActivityEnabled) return { liveActivity: true, notifications: false };
+  return {
+    liveActivity: false,
+    notifications: false,
+    // describeMissingApnsCredentials only explains a *credential* gap and
+    // returns null once the credentials are complete — reachable here, because
+    // an unavailable token store disables the feature with the key still set.
+    liveActivityReason: describeMissingApnsCredentials(env) ?? "APNs credentials are set but the push token store is unavailable, so Live Activity push is disabled."
+  };
+}
 var clientLog = getLogger("client");
 var createMiscRoutes = (deps) => {
   const app = new Hono11();
@@ -5607,7 +5779,12 @@ var createMiscRoutes = (deps) => {
       featureFlags: true,
       // Same contract: this server serves GET /api/projects/summary, which the
       // Hub's grouped views need before they can draw a tree.
-      projectSummary: true
+      projectSummary: true,
+      // Delivery capability, not endpoint support: whether this server can
+      // actually send a push, so mobile can hide an affordance instead of
+      // registering tokens nothing will ever send to. Absent on older servers,
+      // which a client should read as "unknown", not "unavailable".
+      push: describePushCapability(deps.liveActivityPushEnabled())
     });
   });
   app.get("/api/profiles", (c) => c.json([]));
@@ -5668,9 +5845,10 @@ var createMiscRoutes = (deps) => {
     return c.json({ ok: true });
   });
   app.get("/api/push/health", (c) => {
+    const push = describePushCapability(deps.liveActivityPushEnabled());
     const repo = deps.pushRepo();
-    if (!repo) return c.json({ tokens: [], available: false });
-    return c.json({ tokens: repo.listHealth(), available: true });
+    if (!repo) return c.json({ tokens: [], available: false, push });
+    return c.json({ tokens: repo.listHealth(), available: true, push });
   });
   app.post("/api/__update", async (c) => {
     const cfg = loadUpdateConfig();
@@ -6172,7 +6350,7 @@ import { dirname as dirname7 } from "path";
 import { setImmediate as yieldToEventLoop } from "timers/promises";
 
 // src/db/query-timing.ts
-var log3 = getLogger("db");
+var log4 = getLogger("db");
 var DEFAULT_SLOW_QUERY_MS = 35;
 var LABEL = /* @__PURE__ */ Symbol("tbQueryLabel");
 function deriveLabel(sql) {
@@ -6188,15 +6366,15 @@ function resolveSlowMs() {
 }
 function record(label, ms, rows, slowMs) {
   if (slowMs > 0 && ms >= slowMs) {
-    log3.warn(
+    log4.warn(
       `[db] slow query ${label} ${ms.toFixed(1)}ms rows=${rows}`,
       { event: "db.slow_query", stmt: label, ms: Math.round(ms * 100) / 100, rows },
       "pino"
     );
     return;
   }
-  if (log3.pino.isLevelEnabled("debug")) {
-    log3.debug(
+  if (log4.pino.isLevelEnabled("debug")) {
+    log4.debug(
       `[db] ${label} ${ms.toFixed(2)}ms rows=${rows}`,
       { event: "db.query", stmt: label, ms: Math.round(ms * 100) / 100, rows },
       "pino"
@@ -9056,167 +9234,6 @@ function deriveProjectChatTitle(input) {
   return `Untitled \xB7 ${input.id.slice(0, 8)}`;
 }
 
-// src/services/push/apnsClient.ts
-import { createSign } from "crypto";
-import { connect, constants } from "http2";
-var log4 = getLogger("apns");
-var APNS_HOST_SANDBOX = "api.sandbox.push.apple.com";
-var APNS_MAX_PAYLOAD_BYTES = 4096;
-var JWT_TTL_SECONDS = 3e3;
-var DEAD_TOKEN_REASONS = /* @__PURE__ */ new Set([
-  "BadDeviceToken",
-  "DeviceTokenNotForTopic",
-  "Unregistered",
-  "ExpiredToken"
-]);
-function base64url(input) {
-  return Buffer.from(input).toString("base64url");
-}
-function readApnsCredentialsFromEnv(env = process.env) {
-  const key = env.APNS_KEY;
-  if (!key || key.trim().length === 0) return null;
-  const keyId = env.APNS_KEY_ID?.trim();
-  const teamId = env.APNS_TEAM_ID?.trim();
-  const bundleId = env.APNS_BUNDLE_ID?.trim();
-  if (!keyId || !teamId || !bundleId) return null;
-  const host = env.APNS_HOST ?? APNS_HOST_SANDBOX;
-  return { key, keyId, teamId, bundleId, host };
-}
-function describeMissingApnsCredentials(env = process.env) {
-  if (!env.APNS_KEY || env.APNS_KEY.trim().length === 0) {
-    return "APNS_KEY is not set, so Live Activity push is disabled. Set it to the p8 key contents (not a path) to enable it.";
-  }
-  const missing = [
-    ["APNS_KEY_ID", env.APNS_KEY_ID],
-    ["APNS_TEAM_ID", env.APNS_TEAM_ID],
-    ["APNS_BUNDLE_ID", env.APNS_BUNDLE_ID]
-  ].filter(([, value]) => !value || value.trim().length === 0).map(([name]) => name);
-  if (missing.length === 0) return null;
-  return `APNS_KEY is set but ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not, so Live Activity push is disabled. Under launchd, APNS_KEY_ID is derived from the AuthKey_<keyId>.p8 filename; the team and bundle ids must be set explicitly.`;
-}
-var ApnsClient = class {
-  constructor(creds) {
-    this.creds = creds;
-  }
-  creds;
-  session = null;
-  cachedJwt = null;
-  /**
-   * The `apns-topic` for Live Activity pushes.
-   *
-   * The `.push-type.liveactivity` suffix is mandatory and is why the signing key
-   * must be Team Scoped (All Topics) — a key scoped to the bundle id alone
-   * cannot sign this topic.
-   */
-  get topic() {
-    return `${this.creds.bundleId}.push-type.liveactivity`;
-  }
-  /**
-   * Mint or reuse the provider JWT.
-   *
-   * ES256 over the p8 key. Cached until shortly before expiry: Apple rejects a
-   * token older than an hour, but minting one per request is wasteful and can
-   * trip APNs' provider-token-update throttle.
-   */
-  getJwt(now = Date.now()) {
-    const nowSeconds = Math.floor(now / 1e3);
-    if (this.cachedJwt && this.cachedJwt.expiresAt > nowSeconds + 60) {
-      return this.cachedJwt.token;
-    }
-    const header = base64url(JSON.stringify({ alg: "ES256", kid: this.creds.keyId, typ: "JWT" }));
-    const payload = base64url(JSON.stringify({ iss: this.creds.teamId, iat: nowSeconds }));
-    const signingInput = `${header}.${payload}`;
-    const signature = createSign("SHA256").update(signingInput).sign({ key: this.creds.key, dsaEncoding: "ieee-p1363" });
-    const token = `${signingInput}.${base64url(signature)}`;
-    this.cachedJwt = { token, expiresAt: nowSeconds + JWT_TTL_SECONDS };
-    return token;
-  }
-  /**
-   * Reuse one HTTP/2 session across sends.
-   *
-   * APNs expects a long-lived connection; a fresh TLS handshake per push is slow
-   * and Apple treats connection churn as abuse.
-   */
-  getSession() {
-    if (this.session && !this.session.closed && !this.session.destroyed) {
-      return this.session;
-    }
-    const session = connect(`https://${this.creds.host}`);
-    session.on("error", (err) => {
-      log4.warn("apns.session_error", { event: "apns.session_error", err: String(err) });
-    });
-    this.session = session;
-    return session;
-  }
-  /**
-   * Send one push.
-   *
-   * Resolves with a result rather than rejecting on an APNs rejection: a
-   * rejected push is an expected outcome the caller must act on (retire the
-   * token), not an exception. Only a genuinely unexpected local failure throws,
-   * and the caller logs it.
-   */
-  async send(args) {
-    const body = Buffer.from(JSON.stringify(args.payload), "utf-8");
-    if (body.byteLength > APNS_MAX_PAYLOAD_BYTES) {
-      throw new Error(
-        `APNs payload is ${body.byteLength} bytes, over the ${APNS_MAX_PAYLOAD_BYTES} byte limit`
-      );
-    }
-    const session = this.getSession();
-    const headers = {
-      [constants.HTTP2_HEADER_METHOD]: "POST",
-      [constants.HTTP2_HEADER_PATH]: `/3/device/${args.deviceToken}`,
-      [constants.HTTP2_HEADER_AUTHORIZATION]: `bearer ${this.getJwt()}`,
-      "apns-push-type": "liveactivity",
-      "apns-topic": this.topic,
-      "apns-priority": String(args.priority ?? 10),
-      ...args.expirationSeconds != null && {
-        "apns-expiration": String(args.expirationSeconds)
-      },
-      [constants.HTTP2_HEADER_CONTENT_TYPE]: "application/json",
-      [constants.HTTP2_HEADER_CONTENT_LENGTH]: String(body.byteLength)
-    };
-    return new Promise((resolve2, reject) => {
-      const req = session.request(headers);
-      req.setTimeout(args.timeoutMs ?? 1e4, () => {
-        req.close(constants.NGHTTP2_CANCEL);
-        resolve2({ ok: false, status: 0, reason: "Timeout", tokenDead: false });
-      });
-      let status = 0;
-      req.on("response", (resHeaders) => {
-        status = Number(resHeaders[constants.HTTP2_HEADER_STATUS] ?? 0);
-      });
-      const chunks = [];
-      req.on("data", (chunk) => chunks.push(chunk));
-      req.on("error", reject);
-      req.on("end", () => {
-        const raw = Buffer.concat(chunks).toString("utf-8");
-        let reason;
-        if (raw.length > 0) {
-          try {
-            reason = JSON.parse(raw).reason;
-          } catch {
-            reason = raw.slice(0, 200);
-          }
-        }
-        resolve2({
-          ok: status === 200,
-          status,
-          reason,
-          tokenDead: reason != null && DEAD_TOKEN_REASONS.has(reason)
-        });
-      });
-      req.end(body);
-    });
-  }
-  /** Close the shared connection. Called on server shutdown. */
-  close() {
-    this.session?.close();
-    this.session = null;
-  }
-};
-
 // src/services/push/expoPushSender.ts
 var log5 = getLogger("expo-push");
 var EXPO_PUSH_ENDPOINT = "https://exp.host/--/api/v2/push/send";
@@ -11489,6 +11506,7 @@ var StreamerServer = class {
       cache: () => this.cache,
       cacheMonitor: () => this.cacheMonitor,
       pushRepo: () => this.pushRepo,
+      liveActivityPushEnabled: () => this.liveActivityNotifier !== null,
       devicesRepo: () => this.devicesRepo,
       projectsRepo: () => this.projectsRepo,
       conversationsRepo: () => this.conversationsRepo,