Delivery

Every account is a single Durable Object on Cloudflare's edge — one isolated queue, one set of WebSocket connections, no shared state.

At-least-once

A message is written to your queue before it is pushed to any connected desktop. The app acknowledges only after persisting the message to its local SQLite; the queue row is deleted on that ack. If the app crashes between receiving and persisting, the message is simply redelivered — duplicates are discarded client-side by id.

Offline & replay

With no desktop connected, /v1/send returns delivered: "queued". On reconnect, all un-acked messages are replayed in order. The queue keeps the most recent 1,000 messages per account.

Isolation

Hubs are addressed by user id (idFromName), so each account's queue, connections and storage are physically separate objects. There is no cross-tenant code path to misconfigure.

Connection lifecycle

The desktop holds one WebSocket, authenticated with a session token. Keepalive pings are answered by the runtime without waking a hibernated hub, so an idle connection costs nothing. Expired sessions close the socket with code 4401 and the app returns to the sign-in screen instead of retrying forever.