@ours.network/messenger-server 1.0.31-nightly.14 → 1.0.31-nightly.16

package/README.md

@@ -413,3 +413,25 @@ Set `OURS_NOTIFICATIONS_ORIGIN` and a Messenger-scoped `OURS_NOTIFICATIONS_PRODU
 Workspace enrollment supports optional `preserveProfile: true` on its protected POST endpoint. This skips human profile creation/replacement (including an absent profile); root checks and the signed binding command remain mandatory. The protected enrollment-identity response advertises `preserveProfile: true` so clients can fail closed against older servers. Omitted/false keeps fresh-host account profile setup.
 
 Messenger may run as the Human root or as a permanent identity under it. For the latter, the enrollment-identity response also carries `rootCid`, the root the daemon describes for the bound identity; `POST /api/identity/profile` accepts both. Only a Messenger bound to the root itself signs the workspace binding on `POST /api/workspace/enroll`; for an identity under the root the caller obtains that signature from the root outside Messenger.
+
+After successful contact removal, the notification producer durably retires that
+conversation through the notification service's scoped `/api/v1/delete-target`
+route. Pending sends for that contact are removed; cleanup follows any already
+inflight send and retries after service outages or restart. Watch replay confirms
+absence against a complete contacts/pending inventory before dropping an event.
+Inventory errors preserve the queue. The gateway and notification service must
+support this producer lifecycle route before source cleanup can be delivered.
+
+Profile-preserving workspace enrollment reuses an already authenticated contact
+with the exact pinned enrollment server CID. This permits a fresh signed account
+challenge after the one-time invitation was used for registration retirement;
+account-side invitation provenance or an exact signed replacement handoff still
+controls proof acceptance.
+
+`POST /api/workspace/unregister` carries the first-party retirement command when
+Messenger already holds the Human root lease. It requires local API/CSRF
+authentication, a permanent root matching `rootCid`, the exact ready enrollment
+server contact, and well-formed workspace/host/nonce identifiers. An optional
+three-field replacement challenge is forwarded unchanged. The account service
+owns retirement authorization and cleanup; this route only sends the signed
+command and acknowledges submission.

package/dist/chunks/{chunk-XNYNQSPB.js → chunk-NB6YYTBL.js}

@@ -38,7 +38,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var define_MESSENGER_BUILD_INFO_default;
 var init_define_MESSENGER_BUILD_INFO = __esm({
   "<define:__MESSENGER_BUILD_INFO__>"() {
-    define_MESSENGER_BUILD_INFO_default = { name: "@ours.network/messenger-server", version: "1.0.31-nightly.14", sha: "472ad12fdb461e51398c29e8e224d12caca9a43e", dirty: true };
+    define_MESSENGER_BUILD_INFO_default = { name: "@ours.network/messenger-server", version: "1.0.31-nightly.16", sha: "64376e7737f42d8375850bfb548840977e7250d2", dirty: true };
   }
 });
 

package/dist/chunks/{server-ML4SVL44.js → server-QMB6SIVE.js}

@@ -10,7 +10,7 @@ import {
   publicEngineError,
   publicInternalError,
   reportFailure
-} from "./chunk-XNYNQSPB.js";
+} from "./chunk-NB6YYTBL.js";
 
 // node_modules/bn.js/lib/bn.js
 var require_bn = __commonJS({
@@ -868,23 +868,23 @@ var require_bn = __commonJS({
         var lo = r & 67108863;
         var carry = r / 67108864 | 0;
         out.words[0] = lo;
-        for (var k3 = 1; k3 < len; k3++) {
+        for (var k2 = 1; k2 < len; k2++) {
           var ncarry = carry >>> 26;
           var rword = carry & 67108863;
-          var maxJ = Math.min(k3, num.length - 1);
-          for (var j = Math.max(0, k3 - self.length + 1); j <= maxJ; j++) {
-            var i = k3 - j | 0;
+          var maxJ = Math.min(k2, num.length - 1);
+          for (var j = Math.max(0, k2 - self.length + 1); j <= maxJ; j++) {
+            var i = k2 - j | 0;
             a = self.words[i] | 0;
             b2 = num.words[j] | 0;
             r = a * b2 + rword;
             ncarry += r / 67108864 | 0;
             rword = r & 67108863;
           }
-          out.words[k3] = rword | 0;
+          out.words[k2] = rword | 0;
           carry = ncarry | 0;
         }
         if (carry !== 0) {
-          out.words[k3] = carry | 0;
+          out.words[k2] = carry | 0;
         } else {
           out.length--;
         }
@@ -1450,13 +1450,13 @@ var require_bn = __commonJS({
         out.length = self.length + num.length;
         var carry = 0;
         var hncarry = 0;
-        for (var k3 = 0; k3 < out.length - 1; k3++) {
+        for (var k2 = 0; k2 < out.length - 1; k2++) {
           var ncarry = hncarry;
           hncarry = 0;
           var rword = carry & 67108863;
-          var maxJ = Math.min(k3, num.length - 1);
-          for (var j = Math.max(0, k3 - self.length + 1); j <= maxJ; j++) {
-            var i = k3 - j;
+          var maxJ = Math.min(k2, num.length - 1);
+          for (var j = Math.max(0, k2 - self.length + 1); j <= maxJ; j++) {
+            var i = k2 - j;
             var a = self.words[i] | 0;
             var b2 = num.words[j] | 0;
             var r = a * b2;
@@ -1468,12 +1468,12 @@ var require_bn = __commonJS({
             hncarry += ncarry >>> 26;
             ncarry &= 67108863;
           }
-          out.words[k3] = rword;
+          out.words[k2] = rword;
           carry = ncarry;
           ncarry = hncarry;
         }
         if (carry !== 0) {
-          out.words[k3] = carry;
+          out.words[k2] = carry;
         } else {
           out.length--;
         }
@@ -5479,13 +5479,13 @@ var require_ece = __commonJS({
     var MODE_DECRYPT = "decrypt";
     var keylog;
     if (process.env.ECE_KEYLOG === "1") {
-      keylog = function(m2, k3) {
-        console.warn(m2 + " [" + k3.length + "]: " + k3.toString("base64url"));
-        return k3;
+      keylog = function(m2, k2) {
+        console.warn(m2 + " [" + k2.length + "]: " + k2.toString("base64url"));
+        return k2;
       };
     } else {
-      keylog = function(m2, k3) {
-        return k3;
+      keylog = function(m2, k2) {
+        return k2;
       };
     }
     function decode(b2) {
@@ -6559,8 +6559,8 @@ var require_node2 = __commonJS({
     exports.inspectOpts = Object.keys(process.env).filter((key) => {
       return /^debug_/i.test(key);
     }).reduce((obj, key) => {
-      const prop = key.substring(6).toLowerCase().replace(/_([a-z])/g, (_2, k3) => {
-        return k3.toUpperCase();
+      const prop = key.substring(6).toLowerCase().replace(/_([a-z])/g, (_2, k2) => {
+        return k2.toUpperCase();
       });
       let val = process.env[key];
       if (/^(yes|on|true|enabled)$/i.test(val)) {
@@ -6646,18 +6646,18 @@ var require_helpers = __commonJS({
   "node_modules/agent-base/dist/helpers.js"(exports) {
     "use strict";
     init_define_MESSENGER_BUILD_INFO();
-    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m2, k3, k22) {
-      if (k22 === void 0) k22 = k3;
-      var desc = Object.getOwnPropertyDescriptor(m2, k3);
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m2, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      var desc = Object.getOwnPropertyDescriptor(m2, k2);
       if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
-          return m2[k3];
+          return m2[k2];
         } };
       }
       Object.defineProperty(o, k22, desc);
-    }) : (function(o, m2, k3, k22) {
-      if (k22 === void 0) k22 = k3;
-      o[k22] = m2[k3];
+    }) : (function(o, m2, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      o[k22] = m2[k2];
     }));
     var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v2) {
       Object.defineProperty(o, "default", { enumerable: true, value: v2 });
@@ -6668,7 +6668,7 @@ var require_helpers = __commonJS({
       if (mod && mod.__esModule) return mod;
       var result = {};
       if (mod != null) {
-        for (var k3 in mod) if (k3 !== "default" && Object.prototype.hasOwnProperty.call(mod, k3)) __createBinding(result, mod, k3);
+        for (var k2 in mod) if (k2 !== "default" && Object.prototype.hasOwnProperty.call(mod, k2)) __createBinding(result, mod, k2);
       }
       __setModuleDefault(result, mod);
       return result;
@@ -6717,18 +6717,18 @@ var require_dist = __commonJS({
   "node_modules/agent-base/dist/index.js"(exports) {
     "use strict";
     init_define_MESSENGER_BUILD_INFO();
-    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m2, k3, k22) {
-      if (k22 === void 0) k22 = k3;
-      var desc = Object.getOwnPropertyDescriptor(m2, k3);
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m2, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      var desc = Object.getOwnPropertyDescriptor(m2, k2);
       if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
-          return m2[k3];
+          return m2[k2];
         } };
       }
       Object.defineProperty(o, k22, desc);
-    }) : (function(o, m2, k3, k22) {
-      if (k22 === void 0) k22 = k3;
-      o[k22] = m2[k3];
+    }) : (function(o, m2, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      o[k22] = m2[k2];
     }));
     var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v2) {
       Object.defineProperty(o, "default", { enumerable: true, value: v2 });
@@ -6739,7 +6739,7 @@ var require_dist = __commonJS({
       if (mod && mod.__esModule) return mod;
       var result = {};
       if (mod != null) {
-        for (var k3 in mod) if (k3 !== "default" && Object.prototype.hasOwnProperty.call(mod, k3)) __createBinding(result, mod, k3);
+        for (var k2 in mod) if (k2 !== "default" && Object.prototype.hasOwnProperty.call(mod, k2)) __createBinding(result, mod, k2);
       }
       __setModuleDefault(result, mod);
       return result;
@@ -6971,18 +6971,18 @@ var require_dist2 = __commonJS({
   "node_modules/https-proxy-agent/dist/index.js"(exports) {
     "use strict";
     init_define_MESSENGER_BUILD_INFO();
-    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m2, k3, k22) {
-      if (k22 === void 0) k22 = k3;
-      var desc = Object.getOwnPropertyDescriptor(m2, k3);
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m2, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      var desc = Object.getOwnPropertyDescriptor(m2, k2);
       if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
         desc = { enumerable: true, get: function() {
-          return m2[k3];
+          return m2[k2];
         } };
       }
       Object.defineProperty(o, k22, desc);
-    }) : (function(o, m2, k3, k22) {
-      if (k22 === void 0) k22 = k3;
-      o[k22] = m2[k3];
+    }) : (function(o, m2, k2, k22) {
+      if (k22 === void 0) k22 = k2;
+      o[k22] = m2[k2];
     }));
     var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v2) {
       Object.defineProperty(o, "default", { enumerable: true, value: v2 });
@@ -6993,7 +6993,7 @@ var require_dist2 = __commonJS({
       if (mod && mod.__esModule) return mod;
       var result = {};
       if (mod != null) {
-        for (var k3 in mod) if (k3 !== "default" && Object.prototype.hasOwnProperty.call(mod, k3)) __createBinding(result, mod, k3);
+        for (var k2 in mod) if (k2 !== "default" && Object.prototype.hasOwnProperty.call(mod, k2)) __createBinding(result, mod, k2);
       }
       __setModuleDefault(result, mod);
       return result;
@@ -9656,10 +9656,10 @@ var require_extension = __commonJS({
         if (!Array.isArray(configurations)) configurations = [configurations];
         return configurations.map((params) => {
           return [extension2].concat(
-            Object.keys(params).map((k3) => {
-              let values = params[k3];
+            Object.keys(params).map((k2) => {
+              let values = params[k2];
               if (!Array.isArray(values)) values = [values];
-              return values.map((v2) => v2 === true ? k3 : `${k3}=${v2}`).join("; ");
+              return values.map((v2) => v2 === true ? k2 : `${k2}=${v2}`).join("; ");
             })
           ).join("; ");
         }).join(", ");
@@ -11131,11 +11131,12 @@ function producerConfig(env = process.env) {
 }
 var NotificationOutbox = class {
   constructor(file, config, project, warn = () => {
-  }) {
+  }, shouldRetire) {
     this.file = file;
     this.config = config;
     this.project = project;
     this.warn = warn;
+    this.shouldRetire = shouldRetire;
     mkdirSync(dirname(file), { recursive: true, mode: 448 });
     const saved = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : { entries: [] };
     this.entries = Array.isArray(saved) ? saved : saved.entries;
@@ -11186,6 +11187,12 @@ var NotificationOutbox = class {
     this.persist([...this.entries, { id, value }], cursor);
     return true;
   }
+  retireTarget(url, matches) {
+    const id = `delete-target:${url}`;
+    const retained = this.entries.filter((entry) => entry.operation === "delete-target" || !matches(entry.value, entry.payload));
+    if (!retained.some((entry) => entry.id === id)) retained.push({ id, value: { url }, operation: "delete-target" });
+    this.persist(retained);
+  }
   drain() {
     return this.running ??= this.drainOnce().finally(() => {
       this.running = void 0;
@@ -11194,9 +11201,15 @@ var NotificationOutbox = class {
   async drainOnce() {
     for (const entry of [...this.entries].slice(0, 32)) {
       try {
-        const value = entry.payload ?? await this.project(entry.value, entry.id);
-        if (!entry.payload) this.persist(this.entries.map((e2) => e2.id === entry.id ? { ...e2, payload: value } : e2));
-        const response = await fetch(this.config.origin + "/api/v1/send", {
+        if (!this.entries.some((current) => current.id === entry.id)) continue;
+        const value = entry.operation === "delete-target" ? this.shouldRetire && !await this.shouldRetire(entry.value.url) ? void 0 : entry.value : entry.payload ?? await this.project(entry.value, entry.id);
+        if (!this.entries.some((current) => current.id === entry.id)) continue;
+        if (value === void 0) {
+          this.persist(this.entries.filter((current) => current.id !== entry.id));
+          continue;
+        }
+        if (!entry.operation && !entry.payload) this.persist(this.entries.map((e2) => e2.id === entry.id ? { ...e2, payload: value } : e2));
+        const response = await fetch(this.config.origin + (entry.operation === "delete-target" ? "/api/v1/delete-target" : "/api/v1/send"), {
           method: "POST",
           redirect: "error",
           signal: AbortSignal.timeout(1e4),
@@ -11643,8 +11656,15 @@ var PushDeliveryQueue = class {
 var MessengerNotificationProducer = class {
   constructor(stateDir, config, identityCid, client, warn) {
     this.identityCid = identityCid;
+    const knownContact = async (cid) => {
+      if (!client.listContacts) return void 0;
+      const view = await client.listContacts();
+      if (!Array.isArray(view.contacts) || !Array.isArray(view.pending) || [...view.contacts, ...view.pending].some((contact) => typeof contact?.container_id !== "string")) throw Error("Contact inventory unavailable");
+      return [...view.contacts, ...view.pending].some((contact) => contact.container_id.toLowerCase() === cid.toLowerCase());
+    };
     this.outbox = new NotificationOutbox(join(stateDir, "notification-outbox.json"), config, async (value, eventId) => {
       const record = value;
+      if (await knownContact(record.sender_id) === false) return;
       const event = await projectPushEvent(client, {
         contactId: record.sender_id,
         wireId: record.wire_id,
@@ -11657,7 +11677,7 @@ var MessengerNotificationProducer = class {
         body: event.body.slice(0, 512) || "New message",
         url: `/fleet/chats?source=messenger&chat=${encodeURIComponent(record.sender_id)}&detail=1#chat-message-${encodeURIComponent(record.wire_id)}`
       };
-    }, warn);
+    }, warn, async (url) => await knownContact(new URL(url, "https://ours.invalid").searchParams.get("chat")) !== true);
   }
   outbox;
   admit(record) {
@@ -11670,6 +11690,21 @@ var MessengerNotificationProducer = class {
     });
     return { status: admitted ? "queued" : "saturated" };
   }
+  retireContact(cid) {
+    const url = `/fleet/chats?source=messenger&chat=${encodeURIComponent(cid)}`;
+    this.outbox.retireTarget(url, (value, payload) => {
+      const record = value;
+      if (typeof record?.sender_id === "string" && record.sender_id.toLowerCase() === cid.toLowerCase()) return true;
+      if (!payload) return false;
+      try {
+        const target = new URL(payload.url, "https://ours.invalid");
+        return target.pathname === "/fleet/chats" && target.searchParams.get("source") === "messenger" && target.searchParams.get("chat")?.toLowerCase() === cid.toLowerCase();
+      } catch {
+        return false;
+      }
+    });
+    void this.outbox.drain();
+  }
   close() {
     return this.outbox.close();
   }
@@ -20999,7 +21034,13 @@ var ROUTES = {
   // operation: roots ride along on the contacts view.
   "GET /api/contacts/roots": async ({ client }) => ({ roots: (await client.listContacts()).roots }),
   "POST /api/contacts/add": async ({ client, body }) => client.addContact({ invite: str(body, "invite"), name: optStr(body, "name") }),
-  "POST /api/contacts/remove": async ({ client, body }) => client.removeContact({ contact: str(body, "contact") }),
+  "POST /api/contacts/remove": async ({ client, body, deps }) => {
+    const contact = str(body, "contact");
+    const canonical3 = deps.retireContactNotifications ? (await resolveContact(client, contact)).cid : contact;
+    const result = await client.removeContact({ contact: canonical3 });
+    deps.retireContactNotifications?.(canonical3);
+    return result;
+  },
   "POST /api/contacts/rename": async ({ client, body }) => client.renameContact({ contact: str(body, "contact"), name: str(body, "name") }),
   "GET /api/contacts/local-book": async ({ client }) => client.listLocalContactBook(),
   "POST /api/contacts/local-book/policy": async ({ client, body }) => client.setLocalBookPolicy({ expose: optBool(body, "expose"), auto_accept: optBool(body, "auto_accept") }),
@@ -21038,13 +21079,38 @@ var ROUTES = {
     return human.rootCid === void 0 ? { cid: identity.cid, preserveProfile: true } : { cid: identity.cid, rootCid: human.rootCid, preserveProfile: true };
   },
   // First-party setup operation: daemon signs the command using this bound root.
+  "POST /api/workspace/unregister": async ({ client, body }) => {
+    const identity = await client.currentIdentity();
+    if (!identity.isRoot || identity.temporary) throw bad("Workspace retirement requires the bound Human root");
+    const rootCid = str(body, "rootCid").toUpperCase(), serverCid = str(body, "serverCid").toUpperCase();
+    if (!/^[A-F0-9]{64}$/.test(rootCid) || !/^[A-F0-9]{64}$/.test(serverCid) || identity.cid.toUpperCase() !== rootCid) throw bad("Workspace retirement identity mismatch");
+    const command = { type: "ours.app.unregister-workspace.v1" };
+    for (const key of ["workspaceId", "hostWorkspaceId", "operationNonce"]) {
+      const value = str(body, key);
+      if (!/^[A-Za-z0-9_-]{43}$/.test(value)) throw bad("Invalid workspace retirement");
+      command[key] = value;
+    }
+    if (body.operationExpiresAt !== void 0) {
+      if (!Number.isSafeInteger(body.operationExpiresAt) || Number(body.operationExpiresAt) <= 0 || Number(body.operationExpiresAt) > Date.now() + 864e5) throw bad("Invalid retirement deadline");
+      command.operationExpiresAt = Number(body.operationExpiresAt);
+    }
+    if (body.replacement !== void 0) {
+      const replacement = body.replacement;
+      if (!replacement || typeof replacement !== "object" || Object.keys(replacement).length !== 3 || !["workspaceId", "accountId", "nonce"].every((key) => typeof replacement[key] === "string" && /^[A-Za-z0-9_-]{43}$/.test(replacement[key]))) throw bad("Invalid replacement challenge");
+      command.replacement = Object.fromEntries(["workspaceId", "accountId", "nonce"].map((key) => [key, replacement[key]]));
+    }
+    if (!(await client.listContacts()).contacts.some((contact) => contact.container_id.toUpperCase() === serverCid)) throw bad("Original enrollment contact is not ready");
+    const outcome = await client.sendCommand({ contact: serverCid, command: "unregister-workspace", arguments: command });
+    if (!("sent" in outcome) || !outcome.sent) throw bad("Workspace retirement was not sent");
+    return { submitted: true, rootCid: identity.cid };
+  },
   "POST /api/workspace/enroll": async ({ client, deps, body }) => {
     const identity = await client.currentIdentity();
     if (!identity.isRoot || identity.temporary) throw bad("Workspace proof requires the bound Human root");
     const serverCid = str(body, "serverCid").toUpperCase();
     if (!/^[A-F0-9]{64}$/.test(serverCid) || !/^[A-Za-z0-9_-]{43}$/.test(str(body, "hostWorkspaceId"))) throw bad("Invalid workspace proof");
     const challenge = body.challenge;
-    if (!challenge || !["nonce", "workspaceId", "accountId"].every((k3) => typeof challenge[k3] === "string" && /^[A-Za-z0-9_-]{43}$/.test(String(challenge[k3]))) || !Number.isFinite(challenge.expiresAt) || Number(challenge.expiresAt) <= Date.now() || Number(challenge.expiresAt) > Date.now() + 16 * 6e4) throw bad("Workspace challenge expired or invalid");
+    if (!challenge || !["nonce", "workspaceId", "accountId"].every((k2) => typeof challenge[k2] === "string" && /^[A-Za-z0-9_-]{43}$/.test(String(challenge[k2]))) || !Number.isFinite(challenge.expiresAt) || Number(challenge.expiresAt) <= Date.now() || Number(challenge.expiresAt) > Date.now() + 16 * 6e4) throw bad("Workspace challenge expired or invalid");
     const preserveProfile = optBool(body, "preserveProfile") === true;
     let humanProfile;
     if (!preserveProfile) try {
@@ -21055,8 +21121,11 @@ var ROUTES = {
     const invitation = str(body, "invitation");
     if (invitation.length > 8192) throw bad("Workspace invitation too large");
     if (humanProfile) writeHumanProfile(deps.config.stateDir, deps.identityCid, humanProfile);
-    const peer = await client.addContact({ invite: invitation });
-    if (peer.cid.toUpperCase() !== serverCid) throw bad("Enrollment server identity mismatch");
+    const connected = preserveProfile && (await client.listContacts()).contacts.some((contact) => contact.container_id.toUpperCase() === serverCid);
+    if (!connected) {
+      const peer = await client.addContact({ invite: invitation });
+      if (peer.cid.toUpperCase() !== serverCid) throw bad("Enrollment server identity mismatch");
+    }
     const contactDeadline = Date.now() + 1e4;
     while (!(await client.listContacts()).contacts.some((contact) => contact.container_id.toUpperCase() === serverCid)) {
       if (Date.now() >= contactDeadline) throw bad("Enrollment contact is not ready; obtain a fresh setup payload before retrying");
@@ -21200,15 +21269,15 @@ var ROUTES = {
     if (keys === null || typeof keys !== "object" || Array.isArray(keys)) {
       throw bad("keys must be an object with p256dh and auth");
     }
-    const k3 = keys;
-    if (typeof k3.p256dh !== "string" || typeof k3.auth !== "string") {
+    const k2 = keys;
+    if (typeof k2.p256dh !== "string" || typeof k2.auth !== "string") {
       throw bad("keys.p256dh and keys.auth must be strings");
     }
     let saved;
     try {
       saved = deps.push.ensure({
         endpoint: str(body, "endpoint"),
-        keys: { p256dh: k3.p256dh, auth: k3.auth },
+        keys: { p256dh: k2.p256dh, auth: k2.auth },
         label: optStr(body, "label"),
         preview: body.preview === void 0 ? void 0 : str(body, "preview"),
         bindingId: optStr(body, "binding_id")
@@ -21347,18 +21416,18 @@ import { randomBytes as randomBytes2 } from "node:crypto";
 // node_modules/@ours.network/sdk/dist/index.js
 init_define_MESSENGER_BUILD_INFO();
 
-// node_modules/@ours.network/sdk/dist/chunk-H6U3YRJE.js
+// node_modules/@ours.network/sdk/dist/chunk-VJJU7HLN.js
 init_define_MESSENGER_BUILD_INFO();
 
-// node_modules/@ours.network/sdk/dist/chunk-TQF3UMFZ.js
+// node_modules/@ours.network/sdk/dist/chunk-SHYFSAAM.js
 init_define_MESSENGER_BUILD_INFO();
 import * as e from "node:fs";
-import { randomBytes as g } from "node:crypto";
-import { dirname as p, isAbsolute as _, resolve as w } from "node:path";
-import { homedir as v } from "node:os";
-import { resolve as b, join as A, dirname as h, basename as R } from "node:path";
+import { randomBytes as m } from "node:crypto";
+import { dirname as p, isAbsolute as b, resolve as v } from "node:path";
+import { homedir as T } from "node:os";
+import { resolve as _, join as A, dirname as h, basename as R } from "node:path";
 function u(t, o = false) {
-  if (typeof process.geteuid != "function" || !e.constants.O_NOFOLLOW || !e.constants.O_NONBLOCK || typeof t != "string" || !_(t) || w(t) !== t) throw new Error();
+  if (typeof process.geteuid != "function" || !e.constants.O_NOFOLLOW || !e.constants.O_NONBLOCK || typeof t != "string" || !b(t) || v(t) !== t) throw new Error();
   let s = process.geteuid(), r = [];
   for (let i = p(t); r.unshift(i), i !== p(i); i = p(i)) ;
   return r.map((i, l) => {
@@ -21375,36 +21444,36 @@ function u(t, o = false) {
       n = e.lstatSync(i);
     }
     if (!n.isDirectory() || n.uid !== 0 && n.uid !== s) throw new Error();
-    let c = n.uid === 0 && (n.mode & 512) !== 0;
-    if (n.mode & 18 && !c) throw new Error();
+    let a = n.uid === 0 && (n.mode & 512) !== 0;
+    if (n.mode & 18 && !a) throw new Error();
     if (l === r.length - 1 && (n.uid !== s || (n.mode & 4095) !== 448)) throw new Error();
     return `${n.dev}:${n.ino}:${n.uid}:${n.gid}:${n.mode}`;
   }).join("|");
 }
-function m(t, o = 65536, s = false) {
+function O(t, o = 65536, s = false) {
   let r;
   try {
-    let i = u(t), l = process.geteuid(), n = (a) => {
-      if (!a.isFile() || a.uid !== l || (a.mode & 4095) !== 384 || a.size < 1 || a.size > o) throw new Error();
-      return `${a.dev}:${a.ino}:${a.uid}:${a.gid}:${a.mode}:${a.size}:${a.mtimeMs}:${a.ctimeMs}`;
-    }, c = n(e.lstatSync(t));
+    let i = u(t), l = process.geteuid(), n = (c) => {
+      if (!c.isFile() || c.uid !== l || (c.mode & 4095) !== 384 || c.size < 1 || c.size > o) throw new Error();
+      return `${c.dev}:${c.ino}:${c.uid}:${c.gid}:${c.mode}:${c.size}:${c.mtimeMs}:${c.ctimeMs}`;
+    }, a = n(e.lstatSync(t));
     r = e.openSync(t, e.constants.O_RDONLY | e.constants.O_NOFOLLOW | e.constants.O_NONBLOCK);
     let d2 = e.fstatSync(r);
-    if (n(d2) !== c || u(t) !== i || n(e.lstatSync(t)) !== c) throw new Error();
+    if (n(d2) !== a || u(t) !== i || n(e.lstatSync(t)) !== a) throw new Error();
     let f = Buffer.alloc(d2.size);
-    if (e.readSync(r, f, 0, f.length, 0) !== f.length || n(e.fstatSync(r)) !== c || u(t) !== i || n(e.lstatSync(t)) !== c) throw new Error();
+    if (e.readSync(r, f, 0, f.length, 0) !== f.length || n(e.fstatSync(r)) !== a || u(t) !== i || n(e.lstatSync(t)) !== a) throw new Error();
     if (s) {
       e.fsyncSync(r);
-      for (let a = p(t); ; a = p(a)) {
-        let S = e.openSync(a, e.constants.O_RDONLY | e.constants.O_DIRECTORY | e.constants.O_NOFOLLOW);
+      for (let c = p(t); ; c = p(c)) {
+        let S = e.openSync(c, e.constants.O_RDONLY | e.constants.O_DIRECTORY | e.constants.O_NOFOLLOW);
         try {
           e.fsyncSync(S);
         } finally {
           e.closeSync(S);
         }
-        if (a === p(a)) break;
+        if (c === p(c)) break;
       }
-      if (u(t) !== i || n(e.lstatSync(t)) !== c) throw new Error();
+      if (u(t) !== i || n(e.lstatSync(t)) !== a) throw new Error();
     }
     return f;
   } catch {
@@ -21413,24 +21482,24 @@ function m(t, o = 65536, s = false) {
     r !== void 0 && e.closeSync(r);
   }
 }
-function T(t, o) {
+function w(t, o) {
   let s, r;
   try {
     try {
-      return e.lstatSync(t), { token: O(t), source: "file" };
+      return e.lstatSync(t), { token: g(t), source: "file" };
     } catch (f) {
       if (f.code !== "ENOENT") throw f;
     }
     if (!o) return null;
-    let i = u(t, true), l = g(32).toString("hex"), n = `${t}.${g(16).toString("hex")}.tmp`;
+    let i = u(t, true), l = m(32).toString("hex"), n = `${t}.${m(16).toString("hex")}.tmp`;
     if (r = e.openSync(n, e.constants.O_WRONLY | e.constants.O_CREAT | e.constants.O_EXCL | e.constants.O_NOFOLLOW, 384), s = n, e.fchmodSync(r, 384), e.writeFileSync(r, `${l}
 `), e.fsyncSync(r), e.closeSync(r), r = void 0, u(t) !== i) throw new Error();
-    let c = "generated";
+    let a = "generated";
     try {
       e.linkSync(s, t);
     } catch (f) {
       if (f.code !== "EEXIST") throw f;
-      c = "file";
+      a = "file";
     }
     e.unlinkSync(s), s = void 0;
     let d2 = e.openSync(p(t), e.constants.O_RDONLY | e.constants.O_DIRECTORY | e.constants.O_NOFOLLOW);
@@ -21439,29 +21508,29 @@ function T(t, o) {
     } finally {
       e.closeSync(d2);
     }
-    return { token: O(t), source: c };
+    return { token: g(t), source: a };
   } catch {
     throw new Error("Credential publication or reuse failed; no in-memory fallback or automatic repair");
   } finally {
     r !== void 0 && e.closeSync(r), s !== void 0 && e.unlinkSync(s);
   }
 }
-function O(t) {
-  let o = m(t, 4096).toString("utf8");
+function g(t) {
+  let o = O(t, 4096).toString("utf8");
   if (!/^[\x21-\x7e]+(?:\r?\n)?$/.test(o)) throw new Error("Credential file contains an invalid token");
   return o.trimEnd();
 }
-var k = 100 * 1024 * 1024;
-var $2 = { brokerUrl: "wss://broker1.ours.network", port: 3050, stateDir: b(v(), ".ours"), gcIntervalMs: 36e5, historyMaxBytes: k, apiVisibility: "owner", apiAuthMode: "legacy" };
+var I = 100 * 1024 * 1024;
+var $2 = { brokerUrl: "wss://broker1.ours.network", port: 3050, stateDir: _(T(), ".ours"), gcIntervalMs: 36e5, historyMaxBytes: I, apiVisibility: "owner", apiAuthMode: "legacy" };
 var K = "daemon-token";
 
-// node_modules/@ours.network/sdk/dist/chunk-H6U3YRJE.js
+// node_modules/@ours.network/sdk/dist/chunk-VJJU7HLN.js
 import { homedir as me } from "node:os";
 import { isAbsolute as ye, join as ge, resolve as ne } from "node:path";
 import { randomBytes as V } from "node:crypto";
 import { readFileSync as Ee } from "node:fs";
 import { homedir as ve } from "node:os";
-import { join as M, resolve as P } from "node:path";
+import { join as M2, resolve as P } from "node:path";
 var d = class extends Error {
   constructor(n, r, i) {
     super(r);
@@ -21555,7 +21624,7 @@ var x = class {
   explicitApiToken;
   credentialPath;
   get apiToken() {
-    return this.credentialPath === void 0 ? this.explicitApiToken : O(this.credentialPath);
+    return this.credentialPath === void 0 ? this.explicitApiToken : g(this.credentialPath);
   }
   fetchImpl;
   commandHandlers = /* @__PURE__ */ new Map();
@@ -21897,7 +21966,7 @@ function we(e2) {
 function re(e2 = process.env) {
   let t = he(e2), n;
   try {
-    n = JSON.parse(m(t).toString("utf8"));
+    n = JSON.parse(O(t).toString("utf8"));
   } catch {
     throw new O2("selected profile is missing, invalid JSON or unsafe; require a 0700 directory and a 0600 regular file");
   }
@@ -21928,13 +21997,13 @@ function Oe(e2 = {}) {
   let t = e2.env ?? process.env;
   if (t.OURS_TLS_CERT !== void 0 || t.OURS_TLS_KEY !== void 0) throw new p2("INCOHERENT_SELECTION", "Daemon TLS is not supported in V1; remove OURS_TLS_CERT/OURS_TLS_KEY and explicitly configure HTTP");
   if (e2.endpoint !== void 0 && new URL(e2.endpoint).protocol !== "http:" && new URL(e2.endpoint).protocol !== "https:") throw new p2("INCOHERENT_SELECTION", "Client requires an HTTP or HTTPS daemon endpoint");
-  let n = e2.readTextFile ?? ((E) => Ee(E, "utf8")), r = e2.homeDir ?? ve(), i = k2(t, "OURS_INSTANCE");
+  let n = e2.readTextFile ?? ((E) => Ee(E, "utf8")), r = e2.homeDir ?? ve(), i = k(t, "OURS_INSTANCE");
   if (i !== void 0) throw new p2("INCOHERENT_SELECTION", `OURS_INSTANCE=${JSON.stringify(i)} is set, but named daemon instances are not implemented. Select the daemon with an explicit endpoint/port option or with OURS_PORT, and unset OURS_INSTANCE.`);
   if (e2.stateDir !== void 0 && e2.expectStateDir !== void 0) {
     let E = P(e2.stateDir), T2 = P(e2.expectStateDir);
     if (E !== T2) throw new p2("INCOHERENT_SELECTION", `stateDir ${JSON.stringify(E)} and expectStateDir ${JSON.stringify(T2)} name different directories. The state directory decides which token is read; the expected one decides which daemon that token may be sent to. Reconcile them, or pass only one.`);
   }
-  let o = Re(e2.configPath, k2(t, "OURS_CONFIG")), s = o ? Se(o.value, n) : {}, a = ie(e2.port, Ae(k2(t, "OURS_PORT")), s.port, oe), c = ie(e2.stateDir ?? e2.expectStateDir, k2(t, "OURS_STATE_DIR"), s.stateDir, M(r, _e)), l = { value: P(c.value), source: c.source }, m2 = e2.endpoint !== void 0 ? { value: y(e2.endpoint), source: "explicit" } : { value: `http://127.0.0.1:${a.value}`, source: a.source }, f = k2(t, "OURS_API_TOKEN");
+  let o = Re(e2.configPath, k(t, "OURS_CONFIG")), s = o ? Se(o.value, n) : {}, a = ie(e2.port, Ae(k(t, "OURS_PORT")), s.port, oe), c = ie(e2.stateDir ?? e2.expectStateDir, k(t, "OURS_STATE_DIR"), s.stateDir, M2(r, _e)), l = { value: P(c.value), source: c.source }, m2 = e2.endpoint !== void 0 ? { value: y(e2.endpoint), source: "explicit" } : { value: `http://127.0.0.1:${a.value}`, source: a.source }, f = k(t, "OURS_API_TOKEN");
   Te({ endpointSelected: e2.endpoint !== void 0 || a.source !== "default", endpointSource: m2.source, stateDirIntentional: Ie.includes(l.source), stateDirSource: l.source, hasExplicitToken: e2.token !== void 0 && e2.token !== "", hasEnvToken: f !== void 0, requireExplicitSelection: e2.requireExplicitSelection === true, portSource: a.source });
   let g2 = be(e2.token, f, s, l, e2.readTextFile);
   return { baseUrl: m2, port: a, stateDir: l, expectStateDir: e2.expectStateDir !== void 0 ? P(e2.expectStateDir) : l.value, ...g2 ? { token: g2 } : {}, ...o ? { configPath: o } : {} };
@@ -21957,11 +22026,11 @@ function be(e2, t, n, r, i) {
   let o = n.apiToken?.trim();
   if (o) return { value: o, source: "config-file" };
   if (i === void 0) {
-    let s = T(M(r.value, J), false);
+    let s = w(M2(r.value, J), false);
     return s ? { value: s.token, source: "token-file" } : void 0;
   }
   try {
-    let s = i(M(r.value, J)).trim();
+    let s = i(M2(r.value, J)).trim();
     if (s) return { value: s, source: "token-file" };
   } catch {
   }
@@ -22002,7 +22071,7 @@ function Se(e2, t) {
   }
   return o;
 }
-function k2(e2, t) {
+function k(e2, t) {
   let n = e2[t];
   if (n === void 0) return;
   let r = n.trim();
@@ -22063,18 +22132,18 @@ async function G(e2 = {}) {
     if (i === "external") _2.includes("external-sessions-v1") || _2.push("external-sessions-v1");
     else if (_2.includes("external-sessions-v1")) throw new Error("External capabilities require explicit sessionMode: external; refusing local-mode fallback");
     {
-      let b2 = await globalThis.fetch(u2(T2, "/selection"), { signal: s ? AbortSignal.any([s, AbortSignal.timeout(5e3)]) : AbortSignal.timeout(5e3), redirect: "error" }), I = await F(b2);
-      if (!b2.ok || !I || Object.keys(I).length !== 3 || Object.keys(I).some((S) => !["schema", "instanceId", "capabilities"].includes(S)) || I.schema !== 1 || I.instanceId !== a) throw new Error("Daemon instance selection metadata is absent, incompatible or mismatched");
-      let j = I.capabilities;
+      let b2 = await globalThis.fetch(u2(T2, "/selection"), { signal: s ? AbortSignal.any([s, AbortSignal.timeout(5e3)]) : AbortSignal.timeout(5e3), redirect: "error" }), I2 = await F(b2);
+      if (!b2.ok || !I2 || Object.keys(I2).length !== 3 || Object.keys(I2).some((S) => !["schema", "instanceId", "capabilities"].includes(S)) || I2.schema !== 1 || I2.instanceId !== a) throw new Error("Daemon instance selection metadata is absent, incompatible or mismatched");
+      let j = I2.capabilities;
       if (!Array.isArray(j) || j.some((S) => typeof S != "string") || _2.some((S) => !j.includes(S))) throw new Error("Daemon does not support the required capabilities; refusing local-mode fallback");
     }
-    let H = l === void 0 ? E : O(l);
+    let H = l === void 0 ? E : g(l);
     if (typeof H != "string" || !H.trim()) throw new Error("Instance selection requires an explicit API token after daemon verification");
     return new x({ url: T2, sessionMode: i, requestSignal: s, ...l === void 0 ? { apiToken: H } : { credentialPath: l }, leaseToken: n ?? V(32).toString("hex"), clientPid: r });
   }
   if (c !== void 0) throw new Error("Capability selection requires an expected daemon instance");
   let f = Oe(m2);
-  return await Ne(f, { fetch: o }), new x({ url: f.baseUrl.value, leaseToken: n ?? V(32).toString("hex"), clientPid: r, ...f.token?.source === "token-file" && m2.readTextFile === void 0 ? { credentialPath: M(f.expectStateDir, J) } : { apiToken: f.token?.value }, fetch: o, requestSignal: s });
+  return await Ne(f, { fetch: o }), new x({ url: f.baseUrl.value, leaseToken: n ?? V(32).toString("hex"), clientPid: r, ...f.token?.source === "token-file" && m2.readTextFile === void 0 ? { credentialPath: M2(f.expectStateDir, J) } : { apiToken: f.token?.value }, fetch: o, requestSignal: s });
 }
 
 // src/owner-session.ts
@@ -23667,7 +23736,8 @@ async function start(cfg, buildInfo, dependencies = DEFAULT_START_DEPENDENCIES)
         presenceSockets: presence.socketCount
       }),
       events,
-      identityCid: bound.cid
+      identityCid: bound.cid,
+      retireContactNotifications: notificationOutbox ? (cid) => notificationOutbox.retireContact(cid) : void 0
     };
     const moduleDir = dirname5(fileURLToPath(import.meta.url));
     const appCandidates = [

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   normalizeBasePath,
   operatorError,
   reportFailure
-} from "./chunks/chunk-XNYNQSPB.js";
+} from "./chunks/chunk-NB6YYTBL.js";
 
 // src/cli.ts
 init_define_MESSENGER_BUILD_INFO();
@@ -131,7 +131,7 @@ async function main() {
   }
   if (process.argv.length !== 3) throw new ConfigurationError("serve does not accept command-line options");
   const cfg = loadConfig();
-  const { start } = await import("./chunks/server-ML4SVL44.js");
+  const { start } = await import("./chunks/server-QMB6SIVE.js");
   const handle = await start(cfg, BUILD_INFO);
   let closing = false;
   const shutdown = (signal) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/messenger-server",
-  "version": "1.0.31-nightly.14",
+  "version": "1.0.31-nightly.16",
   "description": "Self-hosted Messenger REST/SSE backend for one identity on a shared Ours daemon.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -33,20 +33,20 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test:startup": "node --import tsx tests/startup-readiness.test.mjs",
     "test:runtime-catalog-candidate": "node --import tsx tests/runtime-command-catalog-reopen-e2e.test.mjs",
-    "test:offline": "for f in tests/workspace-profile-preservation.test.mjs tests/notification-producer.test.mjs tests/base-path.test.mjs tests/build-epoch.test.mjs tests/owner-session.test.mjs tests/v1-runtime.test.mjs tests/typed-commands-core.test.mjs tests/shared-daemon-contract.test.mjs tests/room-envelope-matrix.test.mjs tests/bundle-smoke.test.mjs tests/build-metadata.test.mjs tests/production-security.test.mjs tests/conversation-page.test.mjs tests/media-response.test.mjs tests/html-preview-transform.test.mjs tests/html-preview-response.test.mjs tests/push-store.test.mjs tests/push-store-hardening.test.mjs tests/push-delivery.test.mjs tests/push-queue-saturation.test.mjs tests/events.test.mjs tests/watch-cursor.test.mjs tests/watch-reconcile.test.mjs tests/introduction-send-guard.test.mjs tests/sse-e2e.test.mjs tests/presence.test.mjs tests/static-hosting.test.mjs tests/room-preview.test.mjs; do echo \"# $f\"; node --import tsx \"$f\" || exit 1; done",
+    "test:offline": "for f in tests/workspace-profile-preservation.test.mjs tests/notification-producer.test.mjs tests/notification-contact-retirement.test.mjs tests/workspace-root-retirement.test.mjs tests/base-path.test.mjs tests/build-epoch.test.mjs tests/owner-session.test.mjs tests/v1-runtime.test.mjs tests/typed-commands-core.test.mjs tests/shared-daemon-contract.test.mjs tests/room-envelope-matrix.test.mjs tests/bundle-smoke.test.mjs tests/build-metadata.test.mjs tests/production-security.test.mjs tests/conversation-page.test.mjs tests/media-response.test.mjs tests/html-preview-transform.test.mjs tests/html-preview-response.test.mjs tests/push-store.test.mjs tests/push-store-hardening.test.mjs tests/push-delivery.test.mjs tests/push-queue-saturation.test.mjs tests/events.test.mjs tests/watch-cursor.test.mjs tests/watch-reconcile.test.mjs tests/introduction-send-guard.test.mjs tests/sse-e2e.test.mjs tests/presence.test.mjs tests/static-hosting.test.mjs tests/room-preview.test.mjs; do echo \"# $f\"; node --import tsx \"$f\" || exit 1; done",
     "test:loopback": "for f in tests/shared-daemon-e2e.test.mjs tests/typed-command-loopback-e2e.test.mjs tests/introduction-send.test.mjs tests/rest-e2e.test.mjs; do echo \"# $f\"; node --import tsx \"$f\" || exit 1; done",
     "test": "npm run build && npm run test:startup && npm run test:offline && npm run test:loopback"
   },
   "dependencies": {
     "@eslint-community/regexpp": "4.12.2",
-    "@ours.network/sdk": "3.8.1-nightly.15",
+    "@ours.network/sdk": "3.8.1-nightly.16",
     "parse5": "^8.0.1",
     "web-push": "^3.6.7",
     "ws": "^8.21.0"
   },
   "devDependencies": {
-    "@ours.network/cli": "2.8.1-nightly.13",
-    "@ours.network/daemon": "3.8.1-nightly.7",
+    "@ours.network/cli": "2.8.1-nightly.14",
+    "@ours.network/daemon": "3.8.1-nightly.8",
     "@playwright/test": "^1.62.1",
     "@types/node": "^20.14.0",
     "@types/web-push": "^3.6.4",