feat(mobile): push notifications MVP

.env.example

@@ -59,6 +59,12 @@ RELAY_URL=ws://localhost:3000
 # (use `just web` for Vite HMR instead).
 # BUZZ_WEB_DIR=./web/dist
 
+# NIP-PL mobile push is an explicit deployment opt-in. A gateway URL alone
+# never enables it. When enabled and the URL is absent, the canonical
+# https://push.buzz.xyz/v1/deliveries/apns endpoint is used.
+BUZZ_PUSH_ENABLED=false
+# BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
+
 # Optional relay-owned KLIPY key. When set, NIP-11 advertises GIF search and
 # authenticated desktop clients use this relay as the metadata/search proxy.
 # Keep the real value in your deployment's secret manager; never commit it.

.github/workflows/ci.yml

@@ -934,6 +934,20 @@ jobs:
       - name: Build Android debug APK
         run: just mobile-build-android
 
+  mobile-swift:
+    name: Mobile Swift
+    runs-on: macos-latest
+    timeout-minutes: 10
+    needs: [changes]
+    if: needs.changes.outputs.mobile == 'true'
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Build
+        run: swift build --package-path mobile/ios/BuzzPushKit
+      - name: Build release
+        run: swift build -c release --package-path mobile/ios/BuzzPushKit
+      - name: Test
+        run: swift test --package-path mobile/ios/BuzzPushKit
   security:
     name: Security
     runs-on: ubuntu-latest

.intersect/sadscan.yaml

@@ -2,3 +2,14 @@
 exclude_rules_for_files:
   sq.pii.cc.visa:
     - Cargo.lock
+  # Self-signed test fixture generated solely to exercise reqwest identity parsing.
+  kingfisher.privkey.2:
+    - "*apns-test-identity.pem"
+    - "*apns-test-key-only.pem"
+    - "*apns-test-encrypted-identity.pem"
+    - "*apns-test-mismatched-identity.pem"
+  np.pem.1:
+    - "*apns-test-identity.pem"
+    - "*apns-test-key-only.pem"
+    - "*apns-test-encrypted-identity.pem"
+    - "*apns-test-mismatched-identity.pem"

Justfile

@@ -314,9 +314,10 @@ test-unit:
         cargo nextest run -p buzz-voice --lib
         cargo nextest run -p buzz-cli
         # buzz-db migrator/lint tests: pure SQL-parsing unit tests (no infra).
-        # They guard the embedded-migrator invariant (exactly the consolidated
-        # 0001; cutover/backfill stays an operator script, not startup state)
-        # and the tenant-scoping lints. The Postgres-backed buzz-db tests are
+        # They guard the embedded-migrator invariant (the complete checked-in
+        # additive migration set; legacy cutover/backfill remains an operator
+        # script, not startup state) and the tenant-scoping lints. The
+        # Postgres-backed buzz-db tests are
         # #[ignore]d, so --lib runs only the infra-free set. Without this gate a
         # stray file in migrations/ or a broken lint ships green.
         cargo nextest run -p buzz-db --lib

crates/buzz-db/src/migration.rs

@@ -1,8 +1,9 @@
 //! Embedded SQLx migrations for Buzz.
 //!
-//! Fresh deployments apply the checked-in SQL files under `migrations/`. The
-//! multi-tenant rewrite owns a clean consolidated `0001`; legacy single-tenant
-//! cutover/backfill is a separate operator script, not startup migration state.
+//! Fresh deployments apply the checked-in additive SQL files under
+//! `migrations/`. The multi-tenant rewrite begins from a clean consolidated
+//! `0001`; legacy single-tenant cutover/backfill is a separate operator script,
+//! not startup migration state.
 
 use std::future::Future;
 
@@ -645,7 +646,7 @@ mod tests {
         let mut migrations: Vec<_> = MIGRATOR.iter().collect();
         migrations.sort_by_key(|migration| migration.version);
 
-        assert_eq!(migrations.len(), 32);
+        assert_eq!(migrations.len(), 33);
         assert_eq!(migrations[0].version, 1);
         assert_eq!(&*migrations[0].description, "initial schema");
         assert!(migrations[0]
@@ -1109,6 +1110,22 @@ mod tests {
         assert!(include_str!("../../../schema/schema.sql").contains("error_code          TEXT"));
     }
 
+    #[test]
+    fn push_match_trigger_is_narrowed_to_message_kinds_additively() {
+        let mut migrations: Vec<_> = MIGRATOR.iter().collect();
+        migrations.sort_by_key(|migration| migration.version);
+
+        assert_eq!(migrations[32].version, 33);
+        let sql = migrations[32].sql.as_str();
+        assert!(sql.contains("CREATE OR REPLACE FUNCTION enqueue_push_match_job"));
+        assert!(sql.contains("NEW.kind IN (9, 40002, 45001, 45003)"));
+        assert!(!sql.contains("NEW.kind IN (7, 9, 1059, 40007, 46010)"));
+
+        let desired_schema = include_str!("../../../schema/schema.sql");
+        assert!(desired_schema.contains("NEW.kind IN (9, 40002, 45001, 45003)"));
+        assert!(!desired_schema.contains("NEW.kind IN (7, 9, 1059, 40007, 46010)"));
+    }
+
     #[test]
     fn migration_lint_detects_tables_missing_community_id_by_default() {
         let sql = r#"