@ours.network/messenger-server 1.0.31-nightly.21 → 1.0.31-nightly.23

package/dist/chunks/{chunk-BB74SVTG.js → chunk-ZLMZUBJY.js}

@@ -38,7 +38,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var define_MESSENGER_BUILD_INFO_default;
 var init_define_MESSENGER_BUILD_INFO = __esm({
   "<define:__MESSENGER_BUILD_INFO__>"() {
-    define_MESSENGER_BUILD_INFO_default = { name: "@ours.network/messenger-server", version: "1.0.31-nightly.21", sha: "b475f9a436290a7a67351d7f7641a92685c9007d", dirty: true };
+    define_MESSENGER_BUILD_INFO_default = { name: "@ours.network/messenger-server", version: "1.0.31-nightly.23", sha: "110c44f3d58518346a3e1afa5b070bd47cee862a", dirty: true };
   }
 });
 

package/dist/chunks/{server-BHTSTSPS.js → server-KK2HKPON.js}

@@ -10,7 +10,7 @@ import {
   publicEngineError,
   publicInternalError,
   reportFailure
-} from "./chunk-BB74SVTG.js";
+} from "./chunk-ZLMZUBJY.js";
 
 // node_modules/bn.js/lib/bn.js
 var require_bn = __commonJS({
@@ -5905,8 +5905,8 @@ var require_ece = __commonJS({
       }
       return result;
     }
-    function isFunction(object) {
-      return typeof object === "function";
+    function isFunction(object2) {
+      return typeof object2 === "function";
     }
     module.exports = {
       decrypt,
@@ -6892,18 +6892,18 @@ var require_parse_proxy_response = __commonJS({
           else
             socket.once("readable", read);
         }
-        function cleanup() {
+        function cleanup2() {
           socket.removeListener("end", onend);
           socket.removeListener("error", onerror);
           socket.removeListener("readable", read);
         }
         function onend() {
-          cleanup();
+          cleanup2();
           debug("onend");
           reject(new Error("Proxy connection ended before receiving CONNECT response"));
         }
         function onerror(err) {
-          cleanup();
+          cleanup2();
           debug("onerror %o", err);
           reject(err);
         }
@@ -6947,7 +6947,7 @@ var require_parse_proxy_response = __commonJS({
             }
           }
           debug("got proxy server response: %o %o", firstLine, headers);
-          cleanup();
+          cleanup2();
           resolve4({
             connect: {
               statusCode,
@@ -11133,6 +11133,22 @@ init_define_MESSENGER_BUILD_INFO();
 init_define_MESSENGER_BUILD_INFO();
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
+var object = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+var closed = (value, keys) => Object.keys(value).every((key) => keys.includes(key));
+var text = (value, max) => typeof value === "string" && !!value.trim() && value.length <= max;
+var contactId = (value) => text(value, 512) && !/[\/\\\x00-\x1f\x7f]/.test(value) && value !== "." && value !== "..";
+var contactIdentity = (id) => /^[a-f0-9]{64}$/i.test(id) ? id.toUpperCase() : id;
+function contactTarget(value) {
+  return object(value) && closed(value, ["kind", "contactId"]) && value.kind === "contact" && contactId(value.contactId);
+}
+function notificationInput(value) {
+  if (!object(value) || !closed(value, ["eventId", "title", "body", "target", "anchor"]) || !text(value.eventId, 512) || !text(value.title, 160) || !text(value.body, 512) || !contactTarget(value.target)) return false;
+  return value.anchor === void 0 || object(value.anchor) && closed(value.anchor, ["kind", "wireId"]) && value.anchor.kind === "messenger-message" && text(value.anchor.wireId, 1024) && !/[\x00-\x1f\x7f]/.test(value.anchor.wireId);
+}
+var cleanup = (value) => object(value) && closed(value, ["target"]) && contactTarget(value.target);
+var has = (entry, key) => Object.hasOwn(entry, key);
+var supported = (entry) => object(entry) && typeof entry.id === "string" && (has(entry, "operation") ? entry.operation === "delete-target" && cleanup(entry.value) : has(entry, "payload") ? notificationInput(entry.payload) : entry.targetVersion === 1);
+var same = (id) => (entry) => supported(entry) && entry.id === id;
 function producerConfig(env = process.env) {
   const origin = env.OURS_NOTIFICATIONS_ORIGIN, token = env.OURS_NOTIFICATIONS_PRODUCER_TOKEN;
   if (!origin && !token) return;
@@ -11152,10 +11168,10 @@ var NotificationOutbox = class {
     this.shouldRetire = shouldRetire;
     mkdirSync(dirname(file), { recursive: true, mode: 448 });
     const saved = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : { entries: [] };
-    this.entries = Array.isArray(saved) ? saved : saved.entries;
+    if (!saved || typeof saved !== "object" || Array.isArray(saved) || !Array.isArray(saved.entries)) throw new Error("Unsupported notification outbox state");
+    this.entries = saved.entries;
     this.cursor = saved.cursor;
     this.checkpoint = saved.checkpoint;
-    if (!Array.isArray(this.entries)) throw new Error("invalid notification outbox");
     this.timer = setInterval(() => {
       void this.drain();
     }, 3e3);
@@ -11192,18 +11208,19 @@ var NotificationOutbox = class {
     this.persist(this.entries, this.cursor, checkpoint);
   }
   enqueue(id, value, cursor = this.cursor) {
-    if (this.entries.some((e2) => e2.id === id)) {
+    if (this.entries.some(same(id))) {
       if (cursor !== this.cursor) this.advance(cursor);
       return true;
     }
-    if (this.entries.length >= 2e3) return false;
-    this.persist([...this.entries, { id, value }], cursor);
+    if (this.entries.filter(supported).length >= 2e3) return false;
+    this.persist([...this.entries, { id, value, targetVersion: 1 }], cursor);
     return true;
   }
-  retireTarget(url, matches) {
-    const id = `delete-target:${url}`;
-    const retained = this.entries.filter((entry) => entry.operation === "delete-target" || !matches(entry.value, entry.payload));
-    if (!retained.some((entry) => entry.id === id)) retained.push({ id, value: { url }, operation: "delete-target" });
+  retireTarget(target, matches) {
+    if (!contactTarget(target)) throw new Error("Invalid notification target");
+    const id = `delete-target:${contactIdentity(target.contactId)}`;
+    const retained = this.entries.filter((entry) => !supported(entry) || entry.operation === "delete-target" || !matches(entry.value, entry.payload));
+    if (!retained.some(same(id))) retained.push({ id, value: { target }, operation: "delete-target" });
     this.persist(retained);
   }
   drain() {
@@ -11214,26 +11231,28 @@ var NotificationOutbox = class {
   async drainOnce() {
     let attempts = 0;
     for (const entry of [...this.entries]) {
+      if (!supported(entry)) continue;
       if (attempts >= 32) break;
       try {
-        if (!this.entries.some((current) => current.id === entry.id)) continue;
+        if (!this.entries.some(same(entry.id))) continue;
         if (entry.operation === "delete-target" && this.shouldRetire) {
-          const retire = await this.shouldRetire(entry.value.url);
+          const retire = await this.shouldRetire(entry.value.target);
           if (retire === void 0) continue;
           if (!retire) {
             attempts++;
-            this.persist(this.entries.filter((current) => current.id !== entry.id));
+            this.persist(this.entries.filter((current) => !same(entry.id)(current)));
             continue;
           }
         }
-        attempts++;
         const value = entry.operation === "delete-target" ? entry.value : entry.payload ?? await this.project(entry.value, entry.id);
-        if (!this.entries.some((current) => current.id === entry.id)) continue;
+        if (!this.entries.some(same(entry.id))) continue;
         if (value === void 0) {
-          this.persist(this.entries.filter((current) => current.id !== entry.id));
+          this.persist(this.entries.filter((current) => !same(entry.id)(current)));
           continue;
         }
-        if (!entry.operation && !entry.payload) this.persist(this.entries.map((e2) => e2.id === entry.id ? { ...e2, payload: value } : e2));
+        if (entry.operation ? !cleanup(value) : !notificationInput(value)) continue;
+        attempts++;
+        if (!entry.operation && !entry.payload) this.persist(this.entries.map((e2) => same(entry.id)(e2) ? { ...e2, payload: value } : e2));
         const response = await fetch(this.config.origin + (entry.operation === "delete-target" ? "/api/v1/delete-target" : "/api/v1/send"), {
           method: "POST",
           redirect: "error",
@@ -11243,7 +11262,7 @@ var NotificationOutbox = class {
         });
         await response.body?.cancel();
         if (!response.ok) throw new Error("notification service rejected event");
-        this.persist(this.entries.filter((e2) => e2.id !== entry.id));
+        this.persist(this.entries.filter((e2) => !same(entry.id)(e2)));
       } catch {
         this.warn("Notification producer delivery pending; retrying from durable outbox");
         break;
@@ -11279,9 +11298,9 @@ var MAX_FUTURE_KIND_CHARACTERS = 80;
 var MAX_FUTURE_TEXT_CHARACTERS = 1e3;
 var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var isNonEmptyString = (value) => typeof value === "string" && value.length > 0;
-function parseRoomBodyShape(text, requireSignature) {
-  if (typeof text !== "string") return null;
-  const trimmed = text.trim();
+function parseRoomBodyShape(text2, requireSignature) {
+  if (typeof text2 !== "string") return null;
+  const trimmed = text2.trim();
   if (!trimmed.startsWith("{") || !trimmed.endsWith("}")) return null;
   let parsed;
   try {
@@ -11313,7 +11332,7 @@ function renderRoomMessage(body) {
   if (!isObject(body)) return null;
   const kind = isNonEmptyString(body.kind) ? body.kind : "";
   const author = authorOf(body);
-  const text = typeof body.text === "string" ? body.text : "";
+  const text2 = typeof body.text === "string" ? body.text : "";
   const version = Number.isSafeInteger(body.briefing_version) && body.briefing_version > 0 ? body.briefing_version : null;
   const common = {
     roomName: normalizedRoomName(body.room_name) ?? "",
@@ -11321,18 +11340,18 @@ function renderRoomMessage(body) {
   };
   switch (kind) {
     case "room_msg":
-      return author.role === ROOM_VOICE_ROLE ? systemLine(kind, "Room message", text || "Room notice", { ...common, authoredBy: author.name }) : { variant: "chat", kind, author: author.name || "Unknown member", role: author.role, label: "", text, ...common };
+      return author.role === ROOM_VOICE_ROLE ? systemLine(kind, "Room message", text2 || "Room notice", { ...common, authoredBy: author.name }) : { variant: "chat", kind, author: author.name || "Unknown member", role: author.role, label: "", text: text2, ...common };
     case "room_briefing":
       return systemLine(
         kind,
         version === null ? "Room briefing" : `Room briefing \xB7 v${version}`,
-        text || "The room briefing was updated.",
+        text2 || "The room briefing was updated.",
         { ...common, authoredBy: author.name, presentation: "briefing" }
       );
     case "room_role_briefing": {
       const role = isNonEmptyString(body.briefing_role) ? body.briefing_role : "";
       const label = ["Role briefing", role, version === null ? "" : `v${version}`].filter(Boolean).join(" \xB7 ");
-      return systemLine(kind, label, text || "Your role briefing was updated.", {
+      return systemLine(kind, label, text2 || "Your role briefing was updated.", {
         ...common,
         authoredBy: author.name,
         presentation: "role",
@@ -11347,7 +11366,7 @@ function renderRoomMessage(body) {
         isNonEmptyString(membership.role) ? `Role: ${membership.role}` : "",
         Number.isSafeInteger(membership.epoch) && membership.epoch >= 0 ? `Epoch: ${membership.epoch}` : ""
       ].filter(Boolean);
-      return systemLine(kind, "Membership", text || membershipFallback(membership), {
+      return systemLine(kind, "Membership", text2 || membershipFallback(membership), {
         ...common,
         authoredBy: author.name,
         presentation: "membership",
@@ -11376,23 +11395,23 @@ function renderRoomMessage(body) {
         details: ["Status: Removed"]
       });
     default:
-      return text ? {
+      return text2 ? {
         variant: author.role && author.role !== ROOM_VOICE_ROLE ? "chat" : "system",
         kind,
         author: author.role && author.role !== ROOM_VOICE_ROLE ? author.name || "Unknown member" : "",
         role: author.role && author.role !== ROOM_VOICE_ROLE ? author.role : "",
         label: author.role && author.role !== ROOM_VOICE_ROLE ? "" : humanizeRoomKind(kind),
-        text: boundedFutureText(text),
+        text: boundedFutureText(text2),
         ...common
       } : systemLine(kind, humanizeRoomKind(kind), `${humanizeRoomKind(kind)} from the room.`, common);
   }
 }
-function roomLineForContact(announcedContact, text) {
+function roomLineForContact(announcedContact, text2) {
   if (!isCoworkRoomContact(announcedContact)) return null;
   const expectedRoomId = currentRoomMetadata(announcedContact)?.roomId ?? null;
   const expectedLegacyRoomId = legacyRoomId(announcedContact);
   const namedRoom = namedRoomLabel(announcedContact);
-  const body = parseRoomBodyShape(text, expectedRoomId === null && namedRoom === null);
+  const body = parseRoomBodyShape(text2, expectedRoomId === null && namedRoom === null);
   if (body !== null && expectedRoomId !== null && body.room_id !== expectedRoomId) {
     return rejectedEnvelopeLine("Room provenance mismatch");
   }
@@ -11432,12 +11451,12 @@ function isCoworkRoomContact(announced) {
   const v04 = identity.startsWith(ROOM_IDENTITY_PREFIX) && identity.slice(ROOM_IDENTITY_PREFIX.length).trim().length > 0;
   return v04 || namedRoomLabel(announced) !== null || currentRoomMetadata(announced) !== null || legacyRoomId(announced) !== null;
 }
-function contactMessagePreview(announcedContact, text) {
-  const line = roomLineForContact(announcedContact, text);
-  return line ? roomMessagePreview(line) : String(text ?? "");
+function contactMessagePreview(announcedContact, text2) {
+  const line = roomLineForContact(announcedContact, text2);
+  return line ? roomMessagePreview(line) : String(text2 ?? "");
 }
-function systemLine(kind, label, text, extra = {}) {
-  return { variant: "system", kind, author: "", role: "", label, text, ...extra };
+function systemLine(kind, label, text2, extra = {}) {
+  return { variant: "system", kind, author: "", role: "", label, text: text2, ...extra };
 }
 function humanizeValue(value) {
   return String(value).replace(/_/g, " ").replace(/^./, (character) => character.toUpperCase());
@@ -11469,12 +11488,12 @@ function membershipFallback(membership) {
 function roomMessagePreview(line) {
   if (!line) return "";
   const lead = line.variant === "chat" ? line.author : line.label;
-  const text = collapse(line.text);
-  if (!lead) return text;
-  return text ? `${lead} \xB7 ${text}` : lead;
+  const text2 = collapse(line.text);
+  if (!lead) return text2;
+  return text2 ? `${lead} \xB7 ${text2}` : lead;
 }
-function collapse(text) {
-  return String(text ?? "").replace(/\s+/g, " ").trim();
+function collapse(text2) {
+  return String(text2 ?? "").replace(/\s+/g, " ").trim();
 }
 function roomContactLabel(announced) {
   const identity = String(announced ?? "").trim();
@@ -11508,7 +11527,10 @@ function notificationKind(record) {
   return "file";
 }
 async function projectPushEvent(client, job) {
-  const url = `/chats/${encodeURIComponent(job.contactId)}#chat-message-${encodeURIComponent(job.wireId)}`;
+  if (!contactId(job.contactId) || !bounded(job.wireId, 1024) || /[\x00-\x1f\x7f]/.test(job.wireId))
+    throw new Error("invalid push destination");
+  const target = { kind: "contact", contactId: job.contactId };
+  const anchor = { kind: "messenger-message", wireId: job.wireId };
   if (job.kind === "message") {
     if (!client.getHistoryItem) throw new Error("message projection is unavailable");
     const message = await client.getHistoryItem({ wire_id: job.wireId });
@@ -11523,7 +11545,8 @@ async function projectPushEvent(client, job) {
       body: contactMessagePreview(announcedSender, message.text),
       contact_id: job.contactId,
       wire_id: job.wireId,
-      url
+      target,
+      anchor
     };
   }
   if (!client.getFileInfo) throw new Error("file projection is unavailable");
@@ -11540,7 +11563,8 @@ async function projectPushEvent(client, job) {
     body: `${label}: ${file.filename}`,
     contact_id: job.contactId,
     wire_id: job.wireId,
-    url
+    target,
+    anchor
   };
 }
 var PushDeliveryQueue = class {
@@ -11583,7 +11607,7 @@ var PushDeliveryQueue = class {
     return this.admit(record).status === "queued";
   }
   admit(record, notificationPageNextIndex) {
-    if (!bounded(record.sender_id, 512) || !bounded(record.wire_id, 1024)) return { status: "no_targets" };
+    if (!contactId(record.sender_id) || !bounded(record.wire_id, 1024) || /[\x00-\x1f\x7f]/.test(record.wire_id)) return { status: "no_targets" };
     const kind = notificationKind(record);
     if (!kind || !this.store.hasBindings()) return { status: "no_targets" };
     const admission = this.store.admitJob({
@@ -11678,19 +11702,6 @@ var PushDeliveryQueue = class {
 };
 
 // src/notification-producer.ts
-function contactTargetId(path2) {
-  try {
-    if (typeof path2 !== "string" || /[\\\x00-\x20]|%(?:2f|5c|00|0[ad])/i.test(path2)) return null;
-    const match2 = /^\/fleet\/chats\/contacts\/([^/?#]+)(?:[?#]|$)/.exec(path2);
-    if (!match2) return null;
-    const url = new URL(path2, "https://ours.invalid");
-    if (["source", "chat", "task", "detail"].some((key) => url.searchParams.has(key))) return null;
-    const id = decodeURIComponent(match2[1]);
-    return id && id !== "." && id !== ".." && !/[\x00-\x1f\x7f]/.test(id) ? id : null;
-  } catch {
-    return null;
-  }
-}
 var MessengerNotificationProducer = class {
   constructor(stateDir, config, identityCid, client, warn) {
     this.identityCid = identityCid;
@@ -11698,7 +11709,7 @@ var MessengerNotificationProducer = class {
       if (!client.listContacts) return void 0;
       const view = await client.listContacts();
       if (!Array.isArray(view.contacts) || !Array.isArray(view.pending) || [...view.contacts, ...view.pending].some((contact) => typeof contact?.container_id !== "string")) throw Error("Contact inventory unavailable");
-      return [...view.contacts, ...view.pending].some((contact) => contact.container_id.toLowerCase() === cid.toLowerCase());
+      return [...view.contacts, ...view.pending].some((contact) => contactIdentity(contact.container_id) === contactIdentity(cid));
     };
     this.outbox = new NotificationOutbox(join(stateDir, "notification-outbox.json"), config, async (value, eventId) => {
       const record = value;
@@ -11713,18 +11724,21 @@ var MessengerNotificationProducer = class {
         eventId,
         title: event.title.slice(0, 160),
         body: event.body.slice(0, 512) || "New message",
-        url: `/fleet/chats/contacts/${encodeURIComponent(record.sender_id)}#chat-message-${encodeURIComponent(record.wire_id)}`
+        target: { kind: "contact", contactId: record.sender_id },
+        anchor: { kind: "messenger-message", wireId: record.wire_id }
       };
-    }, warn, async (url) => {
-      const cid = contactTargetId(url);
-      if (!cid) return void 0;
-      return await knownContact(cid) !== true;
+    }, warn, async (target) => {
+      if (!contactTarget(target)) return void 0;
+      const known = await knownContact(target.contactId);
+      return known === void 0 ? void 0 : !known;
     });
   }
   outbox;
   admit(record) {
-    if (!["message_received", "file_received"].includes(String(record.event)) || typeof record.sender_id !== "string" || record.sender_id.length > 512 || typeof record.wire_id !== "string" || record.wire_id.length > 1024) return { status: "no_targets" };
-    const admitted = this.outbox.enqueue(`${this.identityCid}:${record.wire_id}:${record.event}`, {
+    if (!["message_received", "file_received"].includes(String(record.event)) || !contactId(record.sender_id) || typeof record.wire_id !== "string" || !record.wire_id.trim() || record.wire_id.length > 1024 || /[\x00-\x1f\x7f]/.test(record.wire_id)) return { status: "no_targets" };
+    const eventId = `${this.identityCid}:${record.wire_id}:${record.event}`;
+    if (eventId.length > 512) return { status: "no_targets" };
+    const admitted = this.outbox.enqueue(eventId, {
       event: record.event,
       sender_id: record.sender_id,
       wire_id: record.wire_id,
@@ -11733,12 +11747,13 @@ var MessengerNotificationProducer = class {
     return { status: admitted ? "queued" : "saturated" };
   }
   retireContact(cid) {
-    const url = `/fleet/chats/contacts/${encodeURIComponent(cid)}`;
-    this.outbox.retireTarget(url, (value, payload) => {
+    if (!contactId(cid)) throw new Error("Invalid notification contact");
+    const target = { kind: "contact", contactId: cid };
+    this.outbox.retireTarget(target, (value, payload) => {
       const record = value;
-      if (typeof record?.sender_id === "string" && record.sender_id.toLowerCase() === cid.toLowerCase()) return true;
+      if (typeof record?.sender_id === "string" && contactIdentity(record.sender_id) === contactIdentity(cid)) return true;
       if (!payload) return false;
-      return contactTargetId(payload.url)?.toLowerCase() === cid.toLowerCase();
+      return contactIdentity(payload.target.contactId) === contactIdentity(cid);
     });
     void this.outbox.drain();
   }
@@ -12516,7 +12531,7 @@ var ResourceConnections = class {
   open(response) {
     const id = randomUUID2(), controller = new AbortController();
     let resolveClosed;
-    const closed = new Promise((resolve4) => {
+    const closed2 = new Promise((resolve4) => {
       resolveClosed = resolve4;
     });
     let connection;
@@ -12587,7 +12602,7 @@ data: ${JSON.stringify({
     })}
 
 `);
-    return { connectionId: id, close, closed };
+    return { connectionId: id, close, closed: closed2 };
   }
   async register(connectionId, viewId, epoch, input, signal) {
     const connection = this.#get(connectionId);
@@ -17519,22 +17534,22 @@ var defaultTreeAdapter = {
       node.parentNode = null;
     }
   },
-  insertText(parentNode, text) {
+  insertText(parentNode, text2) {
     if (parentNode.childNodes.length > 0) {
       const prevNode = parentNode.childNodes[parentNode.childNodes.length - 1];
       if (defaultTreeAdapter.isTextNode(prevNode)) {
-        prevNode.value += text;
+        prevNode.value += text2;
         return;
       }
     }
-    defaultTreeAdapter.appendChild(parentNode, defaultTreeAdapter.createTextNode(text));
+    defaultTreeAdapter.appendChild(parentNode, defaultTreeAdapter.createTextNode(text2));
   },
-  insertTextBefore(parentNode, text, referenceNode) {
+  insertTextBefore(parentNode, text2, referenceNode) {
     const prevNode = parentNode.childNodes[parentNode.childNodes.indexOf(referenceNode) - 1];
     if (prevNode && defaultTreeAdapter.isTextNode(prevNode)) {
-      prevNode.value += text;
+      prevNode.value += text2;
     } else {
-      defaultTreeAdapter.insertBefore(parentNode, defaultTreeAdapter.createTextNode(text), referenceNode);
+      defaultTreeAdapter.insertBefore(parentNode, defaultTreeAdapter.createTextNode(text2), referenceNode);
     }
   },
   adoptAttributes(recipient, attrs) {
@@ -21548,7 +21563,7 @@ async function serveEvents(req, res, deps) {
   });
   res.flushHeaders?.();
   const subscription = deps.events.subscribe(deps.sseQueueLimit ?? 64);
-  let closed = false;
+  let closed2 = false;
   let drainWait = null;
   let releaseDrain = null;
   const onDrain = () => {
@@ -21566,8 +21581,8 @@ async function serveEvents(req, res, deps) {
     return drainWait;
   };
   const close = () => {
-    if (closed) return;
-    closed = true;
+    if (closed2) return;
+    closed2 = true;
     subscription.close();
     res.removeListener("drain", onDrain);
     const release = releaseDrain;
@@ -21578,7 +21593,7 @@ async function serveEvents(req, res, deps) {
   req.once("close", close);
   res.once("close", close);
   const heartbeat = setInterval(() => {
-    if (!closed && !res.destroyed && !drainWait && !res.write(": keepalive\n\n")) {
+    if (!closed2 && !res.destroyed && !drainWait && !res.write(": keepalive\n\n")) {
       void waitForDrain();
     }
   }, deps.sseHeartbeatMs ?? 2e4);
@@ -21587,11 +21602,11 @@ async function serveEvents(req, res, deps) {
     if (!writeSse(res, { type: "sync_required", reason: "connected" }, deps.identityCid)) {
       await waitForDrain();
     }
-    while (!closed) {
+    while (!closed2) {
       const event = await subscription.next();
-      if (event === null || closed) break;
+      if (event === null || closed2) break;
       if (drainWait) await drainWait;
-      if (closed || res.destroyed) break;
+      if (closed2 || res.destroyed) break;
       if (!writeSse(res, event)) await waitForDrain();
     }
   } finally {
@@ -21679,22 +21694,22 @@ var ROUTES = {
     }
     const controller = new AbortController();
     let installed = false;
-    const cleanup = () => {
+    const cleanup2 = () => {
       req.removeListener("aborted", abort);
       res.removeListener("close", responseClosed);
-      res.removeListener("finish", cleanup);
+      res.removeListener("finish", cleanup2);
     };
     const abort = () => {
       controller.abort();
       if (installed) resourceService(deps).remove(connectionId, viewId, epoch);
-      cleanup();
+      cleanup2();
     };
     req.once("aborted", abort);
     const responseClosed = () => {
       if (!res.writableFinished) abort();
     };
     res.once("close", responseClosed);
-    res.once("finish", cleanup);
+    res.once("finish", cleanup2);
     try {
       const registered = await resourceService(deps).register(connectionId, viewId, epoch, body.descriptor, controller.signal);
       installed = true;
@@ -21707,7 +21722,7 @@ var ROUTES = {
       if (controller.signal.aborted) return void 0;
       throw error;
     } finally {
-      if (controller.signal.aborted || res.writableFinished || res.destroyed) cleanup();
+      if (controller.signal.aborted || res.writableFinished || res.destroyed) cleanup2();
     }
   },
   "DELETE /api/resource-subscriptions": async ({ deps, body }) => {
@@ -24438,18 +24453,18 @@ async function startStartupProbe(cfg, buildInfo) {
   const port = await new Promise((resolveReady, rejectReady) => {
     const onMessage = (message) => {
       if (message?.type !== "listening" || !Number.isInteger(message.port)) return;
-      cleanup();
+      cleanup2();
       resolveReady(message.port);
     };
     const onError = (error) => {
-      cleanup();
+      cleanup2();
       rejectReady(error);
     };
     const onExit = (code) => {
-      cleanup();
+      cleanup2();
       rejectReady(failure ?? new Error(`startup readiness worker exited before listen (code ${code})`));
     };
-    const cleanup = () => {
+    const cleanup2 = () => {
       worker.off("message", onMessage);
       worker.off("error", onError);
       worker.off("exit", onExit);
@@ -24468,18 +24483,18 @@ async function startStartupProbe(cfg, buildInfo) {
         await new Promise((resolveClose, rejectClose) => {
           const onMessage = (message) => {
             if (message?.type !== "closed") return;
-            cleanup();
+            cleanup2();
             resolveClose();
           };
           const onError = (error) => {
-            cleanup();
+            cleanup2();
             rejectClose(error);
           };
           const onExit = (code) => {
-            cleanup();
+            cleanup2();
             rejectClose(failure ?? new Error(`startup readiness worker exited during close (code ${code})`));
           };
-          const cleanup = () => {
+          const cleanup2 = () => {
             worker.off("message", onMessage);
             worker.off("error", onError);
             worker.off("exit", onExit);
@@ -24506,7 +24521,7 @@ async function start(cfg, buildInfo, dependencies = DEFAULT_START_DEPENDENCIES)
   let presenceServer;
   const pendingHandlers = /* @__PURE__ */ new Set();
   let closePromise;
-  const cleanup = () => {
+  const cleanup2 = () => {
     closePromise ??= (async () => {
       await presenceServer?.close().catch((error) => reportFailure(log.warn, "presence close", error));
       presenceServer = void 0;
@@ -24620,10 +24635,10 @@ async function start(cfg, buildInfo, dependencies = DEFAULT_START_DEPENDENCIES)
       });
     });
     log.info("service ready");
-    return { port, runtime, close: cleanup };
+    return { port, runtime, close: cleanup2 };
   } catch (error) {
     try {
-      await cleanup();
+      await cleanup2();
     } catch (cleanupError) {
       reportFailure(log.warn, "startup rollback", cleanupError);
     }

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   normalizeBasePath,
   operatorError,
   reportFailure
-} from "./chunks/chunk-BB74SVTG.js";
+} from "./chunks/chunk-ZLMZUBJY.js";
 
 // src/cli.ts
 init_define_MESSENGER_BUILD_INFO();
@@ -131,7 +131,7 @@ async function main() {
   }
   if (process.argv.length !== 3) throw new ConfigurationError("serve does not accept command-line options");
   const cfg = loadConfig();
-  const { start } = await import("./chunks/server-BHTSTSPS.js");
+  const { start } = await import("./chunks/server-KK2HKPON.js");
   const handle = await start(cfg, BUILD_INFO);
   let closing = false;
   const shutdown = (signal) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/messenger-server",
-  "version": "1.0.31-nightly.21",
+  "version": "1.0.31-nightly.23",
   "description": "Self-hosted Messenger REST/SSE backend for one identity on a shared Ours daemon.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -33,7 +33,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test:startup": "node --import tsx tests/startup-readiness.test.mjs",
     "test:runtime-catalog-candidate": "node --import tsx tests/runtime-command-catalog-reopen-e2e.test.mjs",
-    "test:offline": "for f in tests/resource-views.test.mjs tests/resource-connections.test.mjs tests/resource-http.test.mjs tests/workspace-profile-preservation.test.mjs tests/notification-producer.test.mjs tests/notification-contact-retirement.test.mjs tests/workspace-root-retirement.test.mjs tests/base-path.test.mjs tests/build-epoch.test.mjs tests/owner-session.test.mjs tests/v1-runtime.test.mjs tests/typed-commands-core.test.mjs tests/shared-daemon-contract.test.mjs tests/room-envelope-matrix.test.mjs tests/bundle-smoke.test.mjs tests/build-metadata.test.mjs tests/production-security.test.mjs tests/conversation-page.test.mjs tests/media-response.test.mjs tests/html-preview-transform.test.mjs tests/html-preview-response.test.mjs tests/push-store.test.mjs tests/push-store-hardening.test.mjs tests/push-delivery.test.mjs tests/push-queue-saturation.test.mjs tests/events.test.mjs tests/watch-cursor.test.mjs tests/watch-reconcile.test.mjs tests/introduction-send-guard.test.mjs tests/sse-e2e.test.mjs tests/presence.test.mjs tests/static-hosting.test.mjs tests/room-preview.test.mjs; do echo \"# $f\"; node --import tsx \"$f\" || exit 1; done",
+    "test:offline": "for f in tests/resource-views.test.mjs tests/resource-connections.test.mjs tests/resource-http.test.mjs tests/workspace-profile-preservation.test.mjs tests/notification-producer.test.mjs tests/notification-contact-retirement.test.mjs tests/notification-outbox-contract.test.mjs tests/workspace-root-retirement.test.mjs tests/base-path.test.mjs tests/build-epoch.test.mjs tests/owner-session.test.mjs tests/v1-runtime.test.mjs tests/typed-commands-core.test.mjs tests/shared-daemon-contract.test.mjs tests/room-envelope-matrix.test.mjs tests/bundle-smoke.test.mjs tests/build-metadata.test.mjs tests/production-security.test.mjs tests/conversation-page.test.mjs tests/media-response.test.mjs tests/html-preview-transform.test.mjs tests/html-preview-response.test.mjs tests/push-store.test.mjs tests/push-store-hardening.test.mjs tests/push-delivery.test.mjs tests/push-queue-saturation.test.mjs tests/events.test.mjs tests/watch-cursor.test.mjs tests/watch-reconcile.test.mjs tests/introduction-send-guard.test.mjs tests/sse-e2e.test.mjs tests/presence.test.mjs tests/static-hosting.test.mjs tests/room-preview.test.mjs; do echo \"# $f\"; node --import tsx \"$f\" || exit 1; done",
     "test:loopback": "for f in tests/shared-daemon-e2e.test.mjs tests/typed-command-loopback-e2e.test.mjs tests/introduction-send.test.mjs tests/rest-e2e.test.mjs; do echo \"# $f\"; node --import tsx \"$f\" || exit 1; done",
     "test": "npm run build && npm run test:startup && npm run test:offline && npm run test:loopback",
     "test:resource-daemon": "node --import tsx tests/resource-daemon.test.mjs",
@@ -41,14 +41,14 @@
   },
   "dependencies": {
     "@eslint-community/regexpp": "4.12.2",
-    "@ours.network/sdk": "4.1.1-nightly.1",
+    "@ours.network/sdk": "4.1.1-nightly.2",
     "parse5": "^8.0.1",
     "web-push": "^3.6.7",
     "ws": "^8.21.0"
   },
   "devDependencies": {
-    "@ours.network/cli": "3.1.1-nightly.1",
-    "@ours.network/daemon": "4.1.1-nightly.1",
+    "@ours.network/cli": "3.1.1-nightly.2",
+    "@ours.network/daemon": "4.1.1-nightly.2",
     "@playwright/test": "^1.62.1",
     "@types/node": "^20.14.0",
     "@types/web-push": "^3.6.4",