@ours.network/messenger-server 1.0.31-nightly.2 → 1.0.31-nightly.20

package/README.md

@@ -54,7 +54,7 @@ exit unsuccessfully; repeated close calls retain that result.
 
 ## Running
 
-Install and start the shared daemon with `@ours.network/cli`, create the identity
+Install and start the shared daemon with `@ours.network/daemon`, create the identity
 there, then start messenger with the same daemon selection. The following
 example uses the temporary local configuration path:
 
@@ -62,9 +62,9 @@ example uses the temporary local configuration path:
 npm install
 npm run build
 
-# One-time host setup. These commands come from @ours.network/cli.
-ours config setup --port 3070 --state-dir /srv/ours
-ours daemon start
+# One-time host setup: daemon lifecycle is separate from API client commands.
+ours-daemon config setup --port 3070 --state-dir /srv/ours
+ours-daemon start
 ours identity create-root --name 'Ada@server'
 
 OURS_MESSENGER_STATE_DIR=/srv/ours-messenger \
@@ -95,11 +95,11 @@ OURS_MESSENGER_VAPID_PRIVATE_KEY optional secret; never expose to the browser
 OURS_MESSENGER_VAPID_SUBJECT     default mailto:admin@localhost
 ```
 
-The production build is an installable React 18 + TypeScript PWA emitted by Vite under
-`dist/web`: `index.html` is no-cache, while content-hashed `/assets/*` are served
-immutable with explicit MIME types and `nosniff`. During frontend-only work,
-`npm run dev` starts Vite on loopback and proxies `/api` and `/mcp` to the
-messenger server; use `npm run dev:server` for the backend process.
+The browser application is built in the standalone `ours-web` repository. Set
+`OURS_MESSENGER_WEB_DIR` to its `dist/web` directory if this server should host
+that artifact; without it the API remains available and frontend routes report
+503. Static hosting keeps `index.html` uncached and hashed assets immutable.
+Use `npm run dev:server` for backend development.
 
 Every state-changing HTTP request must carry `Content-Type: application/json`,
 an exact single `Origin` equal to `OURS_MESSENGER_PUBLIC_ORIGIN`, and
@@ -134,9 +134,7 @@ The focused client does not persist messages, identities, receipts, or API
 responses in browser storage. Its service worker caches only the application
 shell and static assets for offline launch; all `/api/*` requests bypass it.
 
-The web UI and its same-origin transport adapter are maintained together in
-this repository; their presentation scope and transport exclusions are recorded
-in `web/src/CANONICAL_UI_PROVENANCE.md`. The interface
+The web UI and its same-origin transport adapter now live in the standalone `ours-web` repository. This repository builds only the Messenger backend. To optionally serve a separately built frontend, set `OURS_MESSENGER_WEB_DIR` to its `dist/web` directory; otherwise deploy the API behind the same-origin frontend gateway. The interface
 includes grouped identity-root contacts; contact add, approval, rename and
 removal; one-time/public invite creation and revocation; public bio editing;
 message and attachment replies; drag/drop/paste and picker uploads with bounded
@@ -313,10 +311,11 @@ conversation reads, graceful lease release, bundle execution, token redaction,
 `/mcp` 404, programmatic shutdown and partial-start rollback, receipt semantics,
 REST/WebPush encryption and full payloads, reply correlation, immutable media and
 version round-trips, hostile top-level media navigation, exact voice MIME/bytes,
-sandboxed previews, corrupt push-state preservation/recovery, PWA cache
-isolation/installability/offline launch in Chromium, SSE backpressure and
-reconnect, cursor paging with stable scroll anchoring, invite-dialog reopen,
-focused-client contracts and the exact-dialog read gate.
+sandboxed preview responses, corrupt push-state preservation/recovery and SSE
+backpressure. UI, PWA, browser layout, and client read-gate tests live in `ours-web`.
+The optional `tests/v1-live-push.integration.mjs` service integration requires
+Firefox, public Autopush egress, and an explicit `OURS_MESSENGER_WEB_DIR` pointing
+to a separately built frontend; it is outside the default local test suite.
 
 ## SDK lifecycle boundary
 
@@ -391,3 +390,50 @@ node scripts/check-build-selected.mjs --sdk /artifacts/ours.network-sdk-3.7.2.tg
 ```
 
 For development against the selected, unpublished SDK/CLI sources, see [selected-source development](docs/selected-source-development.md).
+
+### Gateway mount path
+
+Set `OURS_MESSENGER_BASE_PATH=/base/messenger/` when a reverse proxy strips that prefix before forwarding to Messenger. `OURS_MESSENGER_PUBLIC_ORIGIN` remains the exact external origin, for example `https://ours.example`, with no path. Assets, API requests, browser routes, service-worker scope and presence WebSockets retain the configured mount. `ours-messenger-server capabilities` reports `messenger.gateway-prefix-v1`.
+
+Messenger still has no application authentication. Use the installer's loopback gateway or an authenticated external proxy/tunnel. A shared gateway origin trusts every hosted application; path prefixes and Cowork's separate server-token prompt do not isolate or authenticate Messenger. Keep backend ports private and use the installer documentation's browser-authenticated entry configuration.
+
+### Fleet web application
+
+The live local Fleet application is available at `/fleet`; Messenger remains at `/chats`.
+Use the companion Fleet gateway and its local password/session authentication.
+See [Fleet setup and verification](docs/FLEET-PREVIEW.md) for connection requirements,
+current coverage and limitations. `npm run test:fleet` runs the current isolated fixture gates.
+The older mock walkthrough and its browser tests describe an earlier design stage.
+
+
+### Dedicated notification service
+
+Set `OURS_NOTIFICATIONS_ORIGIN` and a Messenger-scoped `OURS_NOTIFICATIONS_PRODUCER_TOKEN` to forward incoming messages/files to [ours-notifications](https://github.com/adapt-toolkit/ours-notifications). Both settings must be provided together. The canonical watcher durably queues notifications even without a local push binding, freezes projected content before its first HTTP attempt, and retries the same payload after outages/restarts. Keep the Messenger state directory across restarts. When configured, new events use the dedicated service; legacy pending push jobs may finish. Existing standalone push endpoints remain for compatibility.
+
+Workspace enrollment supports optional `preserveProfile: true` on its protected POST endpoint. This skips human profile creation/replacement (including an absent profile); root checks and the signed binding command remain mandatory. The protected enrollment-identity response advertises `preserveProfile: true` so clients can fail closed against older servers. Omitted/false keeps fresh-host account profile setup.
+
+Messenger may run as the Human root or as a permanent identity under it. For the latter, the enrollment-identity response also carries `rootCid`, the root the daemon describes for the bound identity; `POST /api/identity/profile` accepts both. Only a Messenger bound to the root itself signs the workspace binding on `POST /api/workspace/enroll`; for an identity under the root the caller obtains that signature from the root outside Messenger.
+
+After successful contact removal, the notification producer durably retires that
+conversation through the notification service's scoped `/api/v1/delete-target`
+route. Pending sends for that contact are removed; cleanup follows any already
+inflight send and retries after service outages or restart. Watch replay confirms
+absence against a complete contacts/pending inventory before dropping an event.
+Inventory errors preserve the queue. The gateway and notification service must
+support this producer lifecycle route before source cleanup can be delivered.
+
+Profile-preserving workspace enrollment reuses an already authenticated contact
+with the exact pinned enrollment server CID. This permits a fresh signed account
+challenge after the one-time invitation was used for registration retirement;
+account-side invitation provenance or an exact signed replacement handoff still
+controls proof acceptance.
+
+`POST /api/workspace/unregister` carries the first-party retirement command when
+Messenger already holds the Human root lease. It requires local API/CSRF
+authentication, a permanent root matching `rootCid`, the exact ready enrollment
+server contact, and well-formed workspace/host/nonce identifiers. An optional
+three-field replacement challenge is forwarded unchanged. The account service
+owns retirement authorization and cleanup; this route only sends the signed
+command and acknowledges submission.
+
+Conversation notifications use `/fleet/chats/contacts/:contactId`, escaping the ID once and preserving the matching message anchor. Contact retirement matches canonical contact identity independent of filters and anchors. Deploy the app, notification service, and producers together: old query-based conversation links are intentionally unsupported. Previously frozen delivery URLs replay unchanged for idempotency, and unsupported persisted cleanup URLs remain pending without being sent or blocking canonical cleanup. Contact lifecycle authorization and inventory checks still apply.

package/dist/chunks/{chunk-LTPYVSZY.js → chunk-UNTKMIUK.js}

@@ -38,10 +38,21 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var define_MESSENGER_BUILD_INFO_default;
 var init_define_MESSENGER_BUILD_INFO = __esm({
   "<define:__MESSENGER_BUILD_INFO__>"() {
-    define_MESSENGER_BUILD_INFO_default = { name: "@ours.network/messenger-server", version: "1.0.31-nightly.2", sha: "19b1aebbc11ef6638c161e3995843539d0fbddbe", dirty: true };
+    define_MESSENGER_BUILD_INFO_default = { name: "@ours.network/messenger-server", version: "1.0.31-nightly.20", sha: "388e6a471fb581f710dcf25c704c973cf05670b7", dirty: true };
   }
 });
 
+// src/base-path.ts
+init_define_MESSENGER_BUILD_INFO();
+function normalizeBasePath(value = "/") {
+  if (!/^\/(?:[A-Za-z0-9_-]+\/)*[A-Za-z0-9_-]*$/.test(value)) throw new Error("Base path must contain plain URL path segments");
+  return value === "/" ? "/" : value.replace(/\/$/, "") + "/";
+}
+function prefixDocument(html, basePath) {
+  const base = normalizeBasePath(basePath);
+  return html.replace("<head>", `<head><meta name="ours-base-path" content="${base}">`).replace(/((?:src|href)=")\.?\/(?!\/)([^"\s]+)(")/g, `$1${base}$2$3`);
+}
+
 // src/security.ts
 init_define_MESSENGER_BUILD_INFO();
 import { randomUUID } from "node:crypto";
@@ -84,6 +95,8 @@ export {
   __toESM,
   init_define_MESSENGER_BUILD_INFO,
   define_MESSENGER_BUILD_INFO_default,
+  normalizeBasePath,
+  prefixDocument,
   ConfigurationError,
   operatorError,
   reportFailure,