@ours.network/messenger-server 1.0.31-nightly.13 → 1.0.31-nightly.15

package/README.md

@@ -411,3 +411,27 @@ The older mock walkthrough and its browser tests describe an earlier design stag
 Set `OURS_NOTIFICATIONS_ORIGIN` and a Messenger-scoped `OURS_NOTIFICATIONS_PRODUCER_TOKEN` to forward incoming messages/files to [ours-notifications](https://github.com/adapt-toolkit/ours-notifications). Both settings must be provided together. The canonical watcher durably queues notifications even without a local push binding, freezes projected content before its first HTTP attempt, and retries the same payload after outages/restarts. Keep the Messenger state directory across restarts. When configured, new events use the dedicated service; legacy pending push jobs may finish. Existing standalone push endpoints remain for compatibility.
 
 Workspace enrollment supports optional `preserveProfile: true` on its protected POST endpoint. This skips human profile creation/replacement (including an absent profile); root checks and the signed binding command remain mandatory. The protected enrollment-identity response advertises `preserveProfile: true` so clients can fail closed against older servers. Omitted/false keeps fresh-host account profile setup.
+
+Messenger may run as the Human root or as a permanent identity under it. For the latter, the enrollment-identity response also carries `rootCid`, the root the daemon describes for the bound identity; `POST /api/identity/profile` accepts both. Only a Messenger bound to the root itself signs the workspace binding on `POST /api/workspace/enroll`; for an identity under the root the caller obtains that signature from the root outside Messenger.
+
+After successful contact removal, the notification producer durably retires that
+conversation through the notification service's scoped `/api/v1/delete-target`
+route. Pending sends for that contact are removed; cleanup follows any already
+inflight send and retries after service outages or restart. Watch replay confirms
+absence against a complete contacts/pending inventory before dropping an event.
+Inventory errors preserve the queue. The gateway and notification service must
+support this producer lifecycle route before source cleanup can be delivered.
+
+Profile-preserving workspace enrollment reuses an already authenticated contact
+with the exact pinned enrollment server CID. This permits a fresh signed account
+challenge after the one-time invitation was used for registration retirement;
+account-side invitation provenance or an exact signed replacement handoff still
+controls proof acceptance.
+
+`POST /api/workspace/unregister` carries the first-party retirement command when
+Messenger already holds the Human root lease. It requires local API/CSRF
+authentication, a permanent root matching `rootCid`, the exact ready enrollment
+server contact, and well-formed workspace/host/nonce identifiers. An optional
+three-field replacement challenge is forwarded unchanged. The account service
+owns retirement authorization and cleanup; this route only sends the signed
+command and acknowledges submission.

package/dist/chunks/{chunk-S6BYVM5Q.js → chunk-YU46BKJ2.js}

@@ -38,7 +38,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var define_MESSENGER_BUILD_INFO_default;
 var init_define_MESSENGER_BUILD_INFO = __esm({
   "<define:__MESSENGER_BUILD_INFO__>"() {
-    define_MESSENGER_BUILD_INFO_default = { name: "@ours.network/messenger-server", version: "1.0.31-nightly.13", sha: "576eb18c8545184db893e09c4dfa4544bb42ba41", dirty: true };
+    define_MESSENGER_BUILD_INFO_default = { name: "@ours.network/messenger-server", version: "1.0.31-nightly.15", sha: "67be7f7cdc2c8fb8d901fb2cb97920da2af048de", dirty: true };
   }
 });
 

package/dist/chunks/{server-EPHTMGZJ.js → server-XMJRG2WC.js}

@@ -10,7 +10,7 @@ import {
   publicEngineError,
   publicInternalError,
   reportFailure
-} from "./chunk-S6BYVM5Q.js";
+} from "./chunk-YU46BKJ2.js";
 
 // node_modules/bn.js/lib/bn.js
 var require_bn = __commonJS({
@@ -11131,11 +11131,12 @@ function producerConfig(env = process.env) {
 }
 var NotificationOutbox = class {
   constructor(file, config, project, warn = () => {
-  }) {
+  }, shouldRetire) {
     this.file = file;
     this.config = config;
     this.project = project;
     this.warn = warn;
+    this.shouldRetire = shouldRetire;
     mkdirSync(dirname(file), { recursive: true, mode: 448 });
     const saved = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : { entries: [] };
     this.entries = Array.isArray(saved) ? saved : saved.entries;
@@ -11186,6 +11187,12 @@ var NotificationOutbox = class {
     this.persist([...this.entries, { id, value }], cursor);
     return true;
   }
+  retireTarget(url, matches) {
+    const id = `delete-target:${url}`;
+    const retained = this.entries.filter((entry) => entry.operation === "delete-target" || !matches(entry.value, entry.payload));
+    if (!retained.some((entry) => entry.id === id)) retained.push({ id, value: { url }, operation: "delete-target" });
+    this.persist(retained);
+  }
   drain() {
     return this.running ??= this.drainOnce().finally(() => {
       this.running = void 0;
@@ -11194,9 +11201,15 @@ var NotificationOutbox = class {
   async drainOnce() {
     for (const entry of [...this.entries].slice(0, 32)) {
       try {
-        const value = entry.payload ?? await this.project(entry.value, entry.id);
-        if (!entry.payload) this.persist(this.entries.map((e2) => e2.id === entry.id ? { ...e2, payload: value } : e2));
-        const response = await fetch(this.config.origin + "/api/v1/send", {
+        if (!this.entries.some((current) => current.id === entry.id)) continue;
+        const value = entry.operation === "delete-target" ? this.shouldRetire && !await this.shouldRetire(entry.value.url) ? void 0 : entry.value : entry.payload ?? await this.project(entry.value, entry.id);
+        if (!this.entries.some((current) => current.id === entry.id)) continue;
+        if (value === void 0) {
+          this.persist(this.entries.filter((current) => current.id !== entry.id));
+          continue;
+        }
+        if (!entry.operation && !entry.payload) this.persist(this.entries.map((e2) => e2.id === entry.id ? { ...e2, payload: value } : e2));
+        const response = await fetch(this.config.origin + (entry.operation === "delete-target" ? "/api/v1/delete-target" : "/api/v1/send"), {
           method: "POST",
           redirect: "error",
           signal: AbortSignal.timeout(1e4),
@@ -11643,8 +11656,15 @@ var PushDeliveryQueue = class {
 var MessengerNotificationProducer = class {
   constructor(stateDir, config, identityCid, client, warn) {
     this.identityCid = identityCid;
+    const knownContact = async (cid) => {
+      if (!client.listContacts) return void 0;
+      const view = await client.listContacts();
+      if (!Array.isArray(view.contacts) || !Array.isArray(view.pending) || [...view.contacts, ...view.pending].some((contact) => typeof contact?.container_id !== "string")) throw Error("Contact inventory unavailable");
+      return [...view.contacts, ...view.pending].some((contact) => contact.container_id.toLowerCase() === cid.toLowerCase());
+    };
     this.outbox = new NotificationOutbox(join(stateDir, "notification-outbox.json"), config, async (value, eventId) => {
       const record = value;
+      if (await knownContact(record.sender_id) === false) return;
       const event = await projectPushEvent(client, {
         contactId: record.sender_id,
         wireId: record.wire_id,
@@ -11657,7 +11677,7 @@ var MessengerNotificationProducer = class {
         body: event.body.slice(0, 512) || "New message",
         url: `/fleet/chats?source=messenger&chat=${encodeURIComponent(record.sender_id)}&detail=1#chat-message-${encodeURIComponent(record.wire_id)}`
       };
-    }, warn);
+    }, warn, async (url) => await knownContact(new URL(url, "https://ours.invalid").searchParams.get("chat")) !== true);
   }
   outbox;
   admit(record) {
@@ -11670,6 +11690,21 @@ var MessengerNotificationProducer = class {
     });
     return { status: admitted ? "queued" : "saturated" };
   }
+  retireContact(cid) {
+    const url = `/fleet/chats?source=messenger&chat=${encodeURIComponent(cid)}`;
+    this.outbox.retireTarget(url, (value, payload) => {
+      const record = value;
+      if (typeof record?.sender_id === "string" && record.sender_id.toLowerCase() === cid.toLowerCase()) return true;
+      if (!payload) return false;
+      try {
+        const target = new URL(payload.url, "https://ours.invalid");
+        return target.pathname === "/fleet/chats" && target.searchParams.get("source") === "messenger" && target.searchParams.get("chat")?.toLowerCase() === cid.toLowerCase();
+      } catch {
+        return false;
+      }
+    });
+    void this.outbox.drain();
+  }
   close() {
     return this.outbox.close();
   }
@@ -20622,6 +20657,15 @@ function inlineBase64(body) {
   }
   return value;
 }
+function humanIdentity(value) {
+  if (value === null || typeof value !== "object") return void 0;
+  const identity = value;
+  if (identity.temporary !== false || typeof identity.cid !== "string") return void 0;
+  if (identity.isRoot === true) return {};
+  const rootCid = identity.rootCid;
+  if (identity.isRoot !== false || identity.described !== true || typeof identity.roleId !== "string" || !identity.roleId || typeof rootCid !== "string" || !/^[a-f0-9]{64}$/i.test(rootCid) || rootCid.toLowerCase() === identity.cid.toLowerCase()) return void 0;
+  return { rootCid };
+}
 function publicIdentity(value) {
   if (value === null || typeof value !== "object") return {};
   const identity = value;
@@ -20990,7 +21034,13 @@ var ROUTES = {
   // operation: roots ride along on the contacts view.
   "GET /api/contacts/roots": async ({ client }) => ({ roots: (await client.listContacts()).roots }),
   "POST /api/contacts/add": async ({ client, body }) => client.addContact({ invite: str(body, "invite"), name: optStr(body, "name") }),
-  "POST /api/contacts/remove": async ({ client, body }) => client.removeContact({ contact: str(body, "contact") }),
+  "POST /api/contacts/remove": async ({ client, body, deps }) => {
+    const contact = str(body, "contact");
+    const canonical3 = deps.retireContactNotifications ? (await resolveContact(client, contact)).cid : contact;
+    const result = await client.removeContact({ contact: canonical3 });
+    deps.retireContactNotifications?.(canonical3);
+    return result;
+  },
   "POST /api/contacts/rename": async ({ client, body }) => client.renameContact({ contact: str(body, "contact"), name: str(body, "name") }),
   "GET /api/contacts/local-book": async ({ client }) => client.listLocalContactBook(),
   "POST /api/contacts/local-book/policy": async ({ client, body }) => client.setLocalBookPolicy({ expose: optBool(body, "expose"), auto_accept: optBool(body, "auto_accept") }),
@@ -21017,15 +21067,42 @@ var ROUTES = {
   // field on this result.
   "GET /api/identity": async ({ client, deps }) => ({ ...publicIdentity(await client.currentIdentity()), humanProfile: readHumanProfile(deps.config.stateDir, deps.identityCid) }),
   "POST /api/identity/profile": async ({ client, deps, body }) => {
-    const identity = await client.currentIdentity();
-    if (!identity.isRoot || identity.temporary) throw bad("Human profile requires the root identity");
+    if (!humanIdentity(await client.currentIdentity())) throw bad("Human profile requires the Human root or a permanent identity under it");
     return writeHumanProfile(deps.config.stateDir, deps.identityCid, { name: profileName(body.name), surname: profileName(body.surname) });
   },
-  // First-party setup operation: daemon signs the command using this bound root.
+  // Who the person is on this host. A Messenger that runs as the Human root can sign the workspace proof
+  // itself; one that runs as the person's own identity under that root names the root the daemon describes
+  // for it, and the proof is then signed by that root outside Messenger.
   "GET /api/workspace/enrollment-identity": async ({ client }) => {
+    const identity = await client.currentIdentity(), human = humanIdentity(identity);
+    if (!human) throw bad("Workspace proof requires the bound Human root or a permanent identity under it");
+    return human.rootCid === void 0 ? { cid: identity.cid, preserveProfile: true } : { cid: identity.cid, rootCid: human.rootCid, preserveProfile: true };
+  },
+  // First-party setup operation: daemon signs the command using this bound root.
+  "POST /api/workspace/unregister": async ({ client, body }) => {
     const identity = await client.currentIdentity();
-    if (!identity.isRoot || identity.temporary) throw bad("Workspace proof requires the bound Human root");
-    return { cid: identity.cid, preserveProfile: true };
+    if (!identity.isRoot || identity.temporary) throw bad("Workspace retirement requires the bound Human root");
+    const rootCid = str(body, "rootCid").toUpperCase(), serverCid = str(body, "serverCid").toUpperCase();
+    if (!/^[A-F0-9]{64}$/.test(rootCid) || !/^[A-F0-9]{64}$/.test(serverCid) || identity.cid.toUpperCase() !== rootCid) throw bad("Workspace retirement identity mismatch");
+    const command = { type: "ours.app.unregister-workspace.v1" };
+    for (const key of ["workspaceId", "hostWorkspaceId", "operationNonce"]) {
+      const value = str(body, key);
+      if (!/^[A-Za-z0-9_-]{43}$/.test(value)) throw bad("Invalid workspace retirement");
+      command[key] = value;
+    }
+    if (body.operationExpiresAt !== void 0) {
+      if (!Number.isSafeInteger(body.operationExpiresAt) || Number(body.operationExpiresAt) <= 0 || Number(body.operationExpiresAt) > Date.now() + 864e5) throw bad("Invalid retirement deadline");
+      command.operationExpiresAt = Number(body.operationExpiresAt);
+    }
+    if (body.replacement !== void 0) {
+      const replacement = body.replacement;
+      if (!replacement || typeof replacement !== "object" || Object.keys(replacement).length !== 3 || !["workspaceId", "accountId", "nonce"].every((key) => typeof replacement[key] === "string" && /^[A-Za-z0-9_-]{43}$/.test(replacement[key]))) throw bad("Invalid replacement challenge");
+      command.replacement = Object.fromEntries(["workspaceId", "accountId", "nonce"].map((key) => [key, replacement[key]]));
+    }
+    if (!(await client.listContacts()).contacts.some((contact) => contact.container_id.toUpperCase() === serverCid)) throw bad("Original enrollment contact is not ready");
+    const outcome = await client.sendCommand({ contact: serverCid, command: "unregister-workspace", arguments: command });
+    if (!("sent" in outcome) || !outcome.sent) throw bad("Workspace retirement was not sent");
+    return { submitted: true, rootCid: identity.cid };
   },
   "POST /api/workspace/enroll": async ({ client, deps, body }) => {
     const identity = await client.currentIdentity();
@@ -21044,8 +21121,11 @@ var ROUTES = {
     const invitation = str(body, "invitation");
     if (invitation.length > 8192) throw bad("Workspace invitation too large");
     if (humanProfile) writeHumanProfile(deps.config.stateDir, deps.identityCid, humanProfile);
-    const peer = await client.addContact({ invite: invitation });
-    if (peer.cid.toUpperCase() !== serverCid) throw bad("Enrollment server identity mismatch");
+    const connected = preserveProfile && (await client.listContacts()).contacts.some((contact) => contact.container_id.toUpperCase() === serverCid);
+    if (!connected) {
+      const peer = await client.addContact({ invite: invitation });
+      if (peer.cid.toUpperCase() !== serverCid) throw bad("Enrollment server identity mismatch");
+    }
     const contactDeadline = Date.now() + 1e4;
     while (!(await client.listContacts()).contacts.some((contact) => contact.container_id.toUpperCase() === serverCid)) {
       if (Date.now() >= contactDeadline) throw bad("Enrollment contact is not ready; obtain a fresh setup payload before retrying");
@@ -23656,7 +23736,8 @@ async function start(cfg, buildInfo, dependencies = DEFAULT_START_DEPENDENCIES)
         presenceSockets: presence.socketCount
       }),
       events,
-      identityCid: bound.cid
+      identityCid: bound.cid,
+      retireContactNotifications: notificationOutbox ? (cid) => notificationOutbox.retireContact(cid) : void 0
     };
     const moduleDir = dirname5(fileURLToPath(import.meta.url));
     const appCandidates = [

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   normalizeBasePath,
   operatorError,
   reportFailure
-} from "./chunks/chunk-S6BYVM5Q.js";
+} from "./chunks/chunk-YU46BKJ2.js";
 
 // src/cli.ts
 init_define_MESSENGER_BUILD_INFO();
@@ -131,7 +131,7 @@ async function main() {
   }
   if (process.argv.length !== 3) throw new ConfigurationError("serve does not accept command-line options");
   const cfg = loadConfig();
-  const { start } = await import("./chunks/server-EPHTMGZJ.js");
+  const { start } = await import("./chunks/server-XMJRG2WC.js");
   const handle = await start(cfg, BUILD_INFO);
   let closing = false;
   const shutdown = (signal) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/messenger-server",
-  "version": "1.0.31-nightly.13",
+  "version": "1.0.31-nightly.15",
   "description": "Self-hosted Messenger REST/SSE backend for one identity on a shared Ours daemon.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -33,7 +33,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test:startup": "node --import tsx tests/startup-readiness.test.mjs",
     "test:runtime-catalog-candidate": "node --import tsx tests/runtime-command-catalog-reopen-e2e.test.mjs",
-    "test:offline": "for f in tests/workspace-profile-preservation.test.mjs tests/notification-producer.test.mjs tests/base-path.test.mjs tests/build-epoch.test.mjs tests/owner-session.test.mjs tests/v1-runtime.test.mjs tests/typed-commands-core.test.mjs tests/shared-daemon-contract.test.mjs tests/room-envelope-matrix.test.mjs tests/bundle-smoke.test.mjs tests/build-metadata.test.mjs tests/production-security.test.mjs tests/conversation-page.test.mjs tests/media-response.test.mjs tests/html-preview-transform.test.mjs tests/html-preview-response.test.mjs tests/push-store.test.mjs tests/push-store-hardening.test.mjs tests/push-delivery.test.mjs tests/push-queue-saturation.test.mjs tests/events.test.mjs tests/watch-cursor.test.mjs tests/watch-reconcile.test.mjs tests/introduction-send-guard.test.mjs tests/sse-e2e.test.mjs tests/presence.test.mjs tests/static-hosting.test.mjs tests/room-preview.test.mjs; do echo \"# $f\"; node --import tsx \"$f\" || exit 1; done",
+    "test:offline": "for f in tests/workspace-profile-preservation.test.mjs tests/notification-producer.test.mjs tests/notification-contact-retirement.test.mjs tests/workspace-root-retirement.test.mjs tests/base-path.test.mjs tests/build-epoch.test.mjs tests/owner-session.test.mjs tests/v1-runtime.test.mjs tests/typed-commands-core.test.mjs tests/shared-daemon-contract.test.mjs tests/room-envelope-matrix.test.mjs tests/bundle-smoke.test.mjs tests/build-metadata.test.mjs tests/production-security.test.mjs tests/conversation-page.test.mjs tests/media-response.test.mjs tests/html-preview-transform.test.mjs tests/html-preview-response.test.mjs tests/push-store.test.mjs tests/push-store-hardening.test.mjs tests/push-delivery.test.mjs tests/push-queue-saturation.test.mjs tests/events.test.mjs tests/watch-cursor.test.mjs tests/watch-reconcile.test.mjs tests/introduction-send-guard.test.mjs tests/sse-e2e.test.mjs tests/presence.test.mjs tests/static-hosting.test.mjs tests/room-preview.test.mjs; do echo \"# $f\"; node --import tsx \"$f\" || exit 1; done",
     "test:loopback": "for f in tests/shared-daemon-e2e.test.mjs tests/typed-command-loopback-e2e.test.mjs tests/introduction-send.test.mjs tests/rest-e2e.test.mjs; do echo \"# $f\"; node --import tsx \"$f\" || exit 1; done",
     "test": "npm run build && npm run test:startup && npm run test:offline && npm run test:loopback"
   },