@ours.network/messenger-server 1.0.31-nightly.18 → 1.0.31-nightly.19

package/README.md

@@ -435,3 +435,5 @@ server contact, and well-formed workspace/host/nonce identifiers. An optional
 three-field replacement challenge is forwarded unchanged. The account service
 owns retirement authorization and cleanup; this route only sends the signed
 command and acknowledges submission.
+
+Conversation notifications use `/fleet/chats/contacts/:contactId`, escaping the ID once and preserving the matching message anchor. Contact retirement matches canonical contact identity independent of filters and anchors. Deploy the app, notification service, and producers together: old query-based conversation links are intentionally unsupported. Previously frozen delivery URLs replay unchanged for idempotency, and unsupported persisted cleanup URLs remain pending without being sent or blocking canonical cleanup. Contact lifecycle authorization and inventory checks still apply.

package/dist/chunks/{chunk-5YTZQ5NK.js → chunk-SM3QJOAM.js}

@@ -38,7 +38,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var define_MESSENGER_BUILD_INFO_default;
 var init_define_MESSENGER_BUILD_INFO = __esm({
   "<define:__MESSENGER_BUILD_INFO__>"() {
-    define_MESSENGER_BUILD_INFO_default = { name: "@ours.network/messenger-server", version: "1.0.31-nightly.18", sha: "634d1f59d24384e10618c737984067617739550e", dirty: true };
+    define_MESSENGER_BUILD_INFO_default = { name: "@ours.network/messenger-server", version: "1.0.31-nightly.19", sha: "7a5580f5b499aa98d37440492a1611dcb7fc5efb", dirty: true };
   }
 });
 

package/dist/chunks/{server-MKIXAIM7.js → server-DJOMSROR.js}

@@ -10,7 +10,7 @@ import {
   publicEngineError,
   publicInternalError,
   reportFailure
-} from "./chunk-5YTZQ5NK.js";
+} from "./chunk-SM3QJOAM.js";
 
 // node_modules/bn.js/lib/bn.js
 var require_bn = __commonJS({
@@ -11212,10 +11212,22 @@ var NotificationOutbox = class {
     });
   }
   async drainOnce() {
-    for (const entry of [...this.entries].slice(0, 32)) {
+    let attempts = 0;
+    for (const entry of [...this.entries]) {
+      if (attempts >= 32) break;
       try {
         if (!this.entries.some((current) => current.id === entry.id)) continue;
-        const value = entry.operation === "delete-target" ? this.shouldRetire && !await this.shouldRetire(entry.value.url) ? void 0 : entry.value : entry.payload ?? await this.project(entry.value, entry.id);
+        if (entry.operation === "delete-target" && this.shouldRetire) {
+          const retire = await this.shouldRetire(entry.value.url);
+          if (retire === void 0) continue;
+          if (!retire) {
+            attempts++;
+            this.persist(this.entries.filter((current) => current.id !== entry.id));
+            continue;
+          }
+        }
+        attempts++;
+        const value = entry.operation === "delete-target" ? entry.value : entry.payload ?? await this.project(entry.value, entry.id);
         if (!this.entries.some((current) => current.id === entry.id)) continue;
         if (value === void 0) {
           this.persist(this.entries.filter((current) => current.id !== entry.id));
@@ -11666,6 +11678,19 @@ var PushDeliveryQueue = class {
 };
 
 // src/notification-producer.ts
+function contactTargetId(path2) {
+  try {
+    if (typeof path2 !== "string" || /[\\\x00-\x20]|%(?:2f|5c|00|0[ad])/i.test(path2)) return null;
+    const match2 = /^\/fleet\/chats\/contacts\/([^/?#]+)(?:[?#]|$)/.exec(path2);
+    if (!match2) return null;
+    const url = new URL(path2, "https://ours.invalid");
+    if (["source", "chat", "task", "detail"].some((key) => url.searchParams.has(key))) return null;
+    const id = decodeURIComponent(match2[1]);
+    return id && id !== "." && id !== ".." && !/[\x00-\x1f\x7f]/.test(id) ? id : null;
+  } catch {
+    return null;
+  }
+}
 var MessengerNotificationProducer = class {
   constructor(stateDir, config, identityCid, client, warn) {
     this.identityCid = identityCid;
@@ -11688,9 +11713,13 @@ var MessengerNotificationProducer = class {
         eventId,
         title: event.title.slice(0, 160),
         body: event.body.slice(0, 512) || "New message",
-        url: `/fleet/chats?source=messenger&chat=${encodeURIComponent(record.sender_id)}&detail=1#chat-message-${encodeURIComponent(record.wire_id)}`
+        url: `/fleet/chats/contacts/${encodeURIComponent(record.sender_id)}#chat-message-${encodeURIComponent(record.wire_id)}`
       };
-    }, warn, async (url) => await knownContact(new URL(url, "https://ours.invalid").searchParams.get("chat")) !== true);
+    }, warn, async (url) => {
+      const cid = contactTargetId(url);
+      if (!cid) return void 0;
+      return await knownContact(cid) !== true;
+    });
   }
   outbox;
   admit(record) {
@@ -11704,17 +11733,12 @@ var MessengerNotificationProducer = class {
     return { status: admitted ? "queued" : "saturated" };
   }
   retireContact(cid) {
-    const url = `/fleet/chats?source=messenger&chat=${encodeURIComponent(cid)}`;
+    const url = `/fleet/chats/contacts/${encodeURIComponent(cid)}`;
     this.outbox.retireTarget(url, (value, payload) => {
       const record = value;
       if (typeof record?.sender_id === "string" && record.sender_id.toLowerCase() === cid.toLowerCase()) return true;
       if (!payload) return false;
-      try {
-        const target = new URL(payload.url, "https://ours.invalid");
-        return target.pathname === "/fleet/chats" && target.searchParams.get("source") === "messenger" && target.searchParams.get("chat")?.toLowerCase() === cid.toLowerCase();
-      } catch {
-        return false;
-      }
+      return contactTargetId(payload.url)?.toLowerCase() === cid.toLowerCase();
     });
     void this.outbox.drain();
   }

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   normalizeBasePath,
   operatorError,
   reportFailure
-} from "./chunks/chunk-5YTZQ5NK.js";
+} from "./chunks/chunk-SM3QJOAM.js";
 
 // src/cli.ts
 init_define_MESSENGER_BUILD_INFO();
@@ -131,7 +131,7 @@ async function main() {
   }
   if (process.argv.length !== 3) throw new ConfigurationError("serve does not accept command-line options");
   const cfg = loadConfig();
-  const { start } = await import("./chunks/server-MKIXAIM7.js");
+  const { start } = await import("./chunks/server-DJOMSROR.js");
   const handle = await start(cfg, BUILD_INFO);
   let closing = false;
   const shutdown = (signal) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/messenger-server",
-  "version": "1.0.31-nightly.18",
+  "version": "1.0.31-nightly.19",
   "description": "Self-hosted Messenger REST/SSE backend for one identity on a shared Ours daemon.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",