@ours.network/notifications 0.1.1 → 0.3.1-nightly.1

package/dist/validation.js

@@ -0,0 +1,60 @@
+import { ECDH } from 'node:crypto';
+export class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+export function text(value, max) {
+    if (typeof value !== 'string' || !value.trim() || value.length > max)
+        throw new HttpError(400, 'invalid field');
+    return value;
+}
+export function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new HttpError(400, 'expected object');
+    return value;
+}
+export function target(value) {
+    const path = text(value, 2048);
+    // Only first-party Fleet pages. No scheme-relative URLs, encoded slashes,
+    // backslashes or control characters which browsers could normalize elsewhere.
+    if (!/^\/fleet(?:\/|\?|$)/.test(path) || /[\\\x00-\x20]|%(?:2f|5c|00|0[ad])/i.test(path))
+        throw new HttpError(400, 'invalid navigation target');
+    const url = new URL(path, 'https://ours.invalid');
+    if (url.origin !== 'https://ours.invalid' || !/^\/fleet(?:\/|$)/.test(url.pathname))
+        throw new HttpError(400, 'invalid navigation target');
+    return path;
+}
+export function subscription(value) {
+    const item = object(value);
+    const endpoint = text(item.endpoint, 4096);
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw new HttpError(400, 'invalid push endpoint');
+    }
+    // Deliberately closed provider set: user URLs cannot target a local network,
+    // arbitrary DNS names or redirectors. Delivery does not follow redirects.
+    const host = url.hostname;
+    const allowed = ['fcm.googleapis.com', 'updates.push.services.mozilla.com', 'web.push.apple.com'].includes(host)
+        || /^[a-z0-9-]+\.notify\.windows\.com$/.test(host);
+    if (!allowed || url.protocol !== 'https:' || url.port || url.username || url.password || url.hash || url.search || url.pathname === '/')
+        throw new HttpError(400, 'unsupported push endpoint');
+    const keys = object(item.keys);
+    const p256dh = text(keys.p256dh, 100);
+    const auth = text(keys.auth, 30);
+    if (!/^[A-Za-z0-9_-]+$/.test(p256dh) || !/^[A-Za-z0-9_-]+$/.test(auth)
+        || Buffer.from(p256dh, 'base64url').length !== 65 || Buffer.from(auth, 'base64url').length !== 16)
+        throw new HttpError(400, 'invalid push keys');
+    try {
+        ECDH.convertKey(Buffer.from(p256dh, 'base64url'), 'prime256v1');
+    }
+    catch {
+        throw new HttpError(400, 'invalid push keys');
+    }
+    return { endpoint: url.href, keys: { p256dh, auth } };
+}

package/package.json

@@ -1,43 +1,33 @@
 {
   "name": "@ours.network/notifications",
-  "version": "0.1.1",
-  "description": "ours.network Notifications-as-a-Service — a2a_notifications service packet + WebPush daemon, with a start/stop/status/install-service CLI (ours-notify). Self-provisions identity + VAPID; runs on any host, point DNS at the discovery port.",
-  "license": "FSL-1.1-Apache-2.0",
+  "version": "0.3.1-nightly.1",
+  "description": "Authenticated web push delivery and shared notification inbox",
   "type": "module",
+  "license": "FSL-1.1-Apache-2.0",
+  "engines": {
+    "node": ">=22"
+  },
   "bin": {
-    "ours-notify": "dist/cli.js"
+    "ours-notifications": "dist/cli.js"
   },
   "files": [
     "dist",
-    "mufl_code",
-    "scripts/gen-vapid.mjs",
     "README.md",
     "LICENSE"
   ],
   "scripts": {
+    "typecheck": "tsc --noEmit",
     "build": "tsc",
-    "prepare": "scripts/compile-mufl.sh && tsc",
-    "start": "node dist/cli.js start",
-    "stop": "node dist/cli.js stop",
-    "status": "node dist/cli.js status",
-    "serve": "node dist/cli.js serve",
-    "test": "npm run build && node --test --test-force-exit --test-concurrency=1 tests/*.test.mjs"
-  },
-  "engines": {
-    "node": ">=18"
+    "test": "npm run build && node --test tests/*.test.mjs"
   },
   "dependencies": {
-    "@adapt-toolkit/sdk": "0.10.12",
-    "@adapt-toolkit/sdk-native": "0.10.12",
-    "web-push": "^3.6.7",
-    "ws": "^8.18.0"
+    "web-push": "3.6.7",
+    "ws": "8.22.0"
   },
   "devDependencies": {
-    "@adapt-toolkit/broker": "0.10.12",
-    "@adapt-toolkit/mufl": "0.10.12",
     "@types/node": "^22.0.0",
-    "@types/web-push": "^3.6.3",
-    "playwright": "^1.61.1",
-    "typescript": "^5.5.0"
+    "@types/web-push": "^3.6.4",
+    "@types/ws": "^8.18.1",
+    "typescript": "^5.5.4"
   }
 }

package/dist/config.js

@@ -1,104 +0,0 @@
-// Daemon configuration. Portable and not host-bound: every field resolves by
-// precedence env > config.json > built-in default, so the same build runs as
-// the public instance or any self-hosted one (WebPush needs no vendor creds).
-//
-// config.json lives at $OURS_NOTIFY_CONFIG, else <HOME>/.ours-notifications/
-// config.json (a fixed home path, independent of a custom STATE_DIR — mirrors
-// ours-mcp). STATE_DIR defaults to <HOME>/.ours-notifications. VAPID keys are
-// read from <STATE_DIR>/vapid.{public,private} by default and are
-// self-provisioned on first boot (see provision.ts); inline VAPID_* env still
-// wins. DISCOVERY_PORT has no config-layer default — the CLI supplies the 8890
-// product default so running `dist/daemon.js` directly (and the test suite)
-// never binds a port unless asked.
-import * as fs from 'node:fs';
-import { resolve, dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { homedir } from 'node:os';
-function homeBase(env) {
-    return env.HOME ?? env.USERPROFILE ?? homedir();
-}
-export function defaultStateDir(env = process.env) {
-    return join(homeBase(env), '.ours-notifications');
-}
-function configFilePath(env) {
-    return env.OURS_NOTIFY_CONFIG ?? join(homeBase(env), '.ours-notifications', 'config.json');
-}
-function readConfigFile(env) {
-    try {
-        const raw = fs.readFileSync(configFilePath(env), 'utf8');
-        const parsed = JSON.parse(raw);
-        return parsed && typeof parsed === 'object' ? parsed : {};
-    }
-    catch {
-        return {}; // missing or invalid config.json → no overrides
-    }
-}
-function parsePort(raw, source) {
-    if (raw === undefined || raw === null || raw === '')
-        return undefined;
-    const port = Number(raw);
-    if (!Number.isInteger(port) || port < 1 || port > 65535) {
-        throw new Error(`${source} must be an integer in 1..65535, got: ${raw}`);
-    }
-    return port;
-}
-// Resolve every field by env > config.json > default. Never throws on VAPID
-// (files may not exist yet — provisioning creates them). Broker is left
-// undefined when unset; loadConfig enforces it.
-export function resolveConfig(env = process.env) {
-    const file = readConfigFile(env);
-    const pick = (envKey, fileKey, def) => env[envKey] ?? (file[fileKey] != null ? String(file[fileKey]) : undefined) ?? def;
-    const flag = (envKey, fileKey) => env[envKey] === '1' || file[fileKey] === true || file[fileKey] === '1';
-    const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-    const stateDir = resolve(pick('STATE_DIR', 'stateDir', defaultStateDir(env)));
-    const unitDir = resolve(pick('UNIT_DIR', 'unitDir', join(repoRoot, 'mufl_code')));
-    const vapidPublicFile = resolve(pick('VAPID_PUBLIC_KEY_FILE', 'vapidPublicFile', join(stateDir, 'vapid.public')));
-    const vapidPrivateFile = resolve(pick('VAPID_PRIVATE_KEY_FILE', 'vapidPrivateFile', join(stateDir, 'vapid.private')));
-    return {
-        brokerUrl: pick('BROKER_URL', 'brokerUrl'),
-        stateDir,
-        unitDir,
-        vapidPublicFile,
-        vapidPrivateFile,
-        vapidSubject: pick('VAPID_SUBJECT', 'vapidSubject', 'mailto:ops@ours.network'),
-        pushDisabled: flag('PUSH_DISABLED', 'pushDisabled'),
-        pushTlsInsecure: flag('PUSH_TLS_INSECURE', 'pushTlsInsecure'),
-        discoveryPort: parsePort(env.DISCOVERY_PORT ?? file.discoveryPort, 'DISCOVERY_PORT'),
-        discoveryHost: pick('DISCOVERY_HOST', 'discoveryHost', '127.0.0.1'),
-    };
-}
-// Full config with VAPID key CONTENTS. Inline VAPID_PUBLIC_KEY/PRIVATE_KEY env
-// wins over the files. Throws if the broker is unset or VAPID is still missing
-// (provisioning should have created it — run `ours-notify start`).
-export function loadConfig(env = process.env) {
-    const r = resolveConfig(env);
-    if (!r.brokerUrl) {
-        throw new Error('BROKER_URL is required (env BROKER_URL or config.json "brokerUrl"), e.g. ws://127.0.0.1:9000');
-    }
-    const readFileTrim = (p) => {
-        try {
-            return fs.readFileSync(p, 'utf8').trim();
-        }
-        catch {
-            return '';
-        }
-    };
-    const vapidPublicKey = (env.VAPID_PUBLIC_KEY?.trim()) || readFileTrim(r.vapidPublicFile);
-    const vapidPrivateKey = (env.VAPID_PRIVATE_KEY?.trim()) || readFileTrim(r.vapidPrivateFile);
-    if (!vapidPublicKey || !vapidPrivateKey) {
-        throw new Error(`VAPID keys missing under ${r.stateDir} — run \`ours-notify start\` (auto-provisions) ` +
-            `or generate them with scripts/gen-vapid.mjs`);
-    }
-    return {
-        brokerUrl: r.brokerUrl,
-        stateDir: r.stateDir,
-        unitDir: r.unitDir,
-        vapidPublicKey,
-        vapidPrivateKey,
-        vapidSubject: r.vapidSubject,
-        pushDisabled: r.pushDisabled,
-        pushTlsInsecure: r.pushTlsInsecure,
-        discoveryPort: r.discoveryPort,
-        discoveryHost: r.discoveryHost,
-    };
-}

package/dist/daemon.js

@@ -1,353 +0,0 @@
-// The ours-notifications host daemon: boots the service packet via the
-// @adapt-toolkit SDK, connects to a broker, persists identity + packet state
-// across restarts, consumes the packet's $notify_agent events
-// (notification_posted / marked_read / unregistered), keeps the app-side
-// notification log (notifications.json), and performs WebPush egress.
-//
-// Run directly (node dist/daemon.js) it speaks a JSON-lines control protocol:
-//   stdin  {"cmd":"invite","name":"..."} | {"cmd":"contacts"} | {"cmd":"export_vis"} | {"cmd":"status"}
-//   stdout {"reply":...} for commands; {"event":...} lines for daemon events
-//          (first line after boot: {"event":"ready","cid":...,"version":{...}}).
-import * as fs from 'node:fs';
-import { resolve } from 'node:path';
-import { randomBytes } from 'node:crypto';
-import { createInterface } from 'node:readline';
-import { adapt_wrapper } from '@adapt-toolkit/sdk/executables';
-import { PacketWrapperConfigurator } from '@adapt-toolkit/sdk/wrappers';
-import { object_to_adapt_value } from '@adapt-toolkit/sdk/wrapper';
-import { loadConfig } from './config.js';
-import { LogStore } from './log-store.js';
-import { DisabledPushSender } from './push.js';
-import { WebPushSender } from './web-push-sender.js';
-import { startDiscoveryServer } from './http.js';
-import { PresenceRegistry, attachPresenceServer } from './presence.js';
-const SERVICE_NAME = 'ours notifications service';
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-export async function startDaemon(cfg) {
-    fs.mkdirSync(cfg.stateDir, { recursive: true });
-    const unitFile = fs.readdirSync(cfg.unitDir).find((f) => f.endsWith('.muflo'));
-    if (!unitFile)
-        throw new Error(`no .muflo unit in ${cfg.unitDir} — run scripts/compile-mufl.sh`);
-    const unitHash = unitFile.slice(0, -'.muflo'.length);
-    const unitBytes = new Uint8Array(fs.readFileSync(resolve(cfg.unitDir, unitFile)));
-    const keyPath = resolve(cfg.stateDir, 'identity.key');
-    const dataPath = resolve(cfg.stateDir, 'state_data.bin');
-    const wrapper = await adapt_wrapper.start(['--broker_address', cfg.brokerUrl, '--test_mode',
-        '--logger_config', '--level', 'WARNING', '--stdout', 'stderr', '--logger_config_end']);
-    wrapper.start();
-    await sleep(1500);
-    const logStore = new LogStore(cfg.stateDir);
-    const push = cfg.pushDisabled
-        ? new DisabledPushSender()
-        : new WebPushSender(cfg.vapidSubject, cfg.vapidPublicKey, cfg.vapidPrivateKey, cfg.pushTlsInsecure);
-    const presence = new PresenceRegistry();
-    const listeners = [];
-    const emit = (e) => { for (const cb of listeners)
-        cb(e); };
-    const pending = [];
-    let pw = null;
-    const ro = (name, targ) => pw.packet.ExecuteTransaction(object_to_adapt_value({ name, targ }));
-    const mutate = (name, targ) => new Promise((res, rej) => {
-        const timer = setTimeout(() => rej(new Error(`${name} timed out`)), 20000);
-        pending.push({ resolve: res, reject: rej, timer });
-        pw.add_client_message(object_to_adapt_value({ name, targ }));
-    });
-    function saveState() {
-        try {
-            const bytes = Buffer.from(ro('::actor::export_state').Serialize());
-            // Per-contact tokens grow state O(recipients × contacts) — surface
-            // real-world numbers once the blob crosses 10 MB so capping (LRU/paging)
-            // can be revisited with data.
-            if (bytes.length > 10 * 1024 * 1024) {
-                console.error(`[daemon] state size ${(bytes.length / (1024 * 1024)).toFixed(1)} MB exceeds 10 MB — review per-contact token growth`);
-            }
-            const tmp = `${dataPath}.tmp`;
-            fs.writeFileSync(tmp, bytes);
-            fs.renameSync(tmp, dataPath);
-        }
-        catch (err) {
-            console.error('[daemon] failed to save state:', String(err));
-        }
-    }
-    function readBindings(av) {
-        const out = [];
-        if (av.IsNil())
-            return out;
-        for (let i = 0;; i++) {
-            const b = av.Reduce(i);
-            if (b.IsNil())
-                break;
-            out.push({
-                binding_id: b.Reduce('binding_id').Visualize(),
-                endpoint: b.Reduce('endpoint').Visualize(),
-                p256dh: b.Reduce('p256dh').Visualize(),
-                auth: b.Reduce('auth').Visualize(),
-            });
-        }
-        return out;
-    }
-    function readIds(av) {
-        if (av.IsNil())
-            return null;
-        const out = [];
-        for (let i = 0;; i++) {
-            const e = av.Reduce(i);
-            if (e.IsNil())
-                break;
-            out.push(e.Visualize());
-        }
-        return out;
-    }
-    function handleNotifyAgent(payload) {
-        const event = payload.Reduce('event').Visualize();
-        if (event === 'notification_posted') {
-            const n = payload.Reduce('notification');
-            const record = {
-                notif_id: n.Reduce('notif_id').Visualize(),
-                wire_id: n.Reduce('wire_id').Visualize(),
-                recipient_cid: n.Reduce('recipient_cid').Visualize(),
-                sender_cid: n.Reduce('sender_cid').Visualize(),
-                payload: n.Reduce('payload').Visualize(),
-                date: n.Reduce('date').Visualize(),
-            };
-            const bindings = readBindings(payload.Reduce('bindings'));
-            // BUG-2 foreground gate: a live authed presence socket for the recipient
-            // means their PWA is frontmost — they already got this message in-app, so
-            // SUPPRESS the WebPush. Log it as 'read' for history/badge coherence.
-            // No socket ⇒ recipient is closed/backgrounded ⇒ push as usual. Self-
-            // healing: the socket drop clears presence instantly, so the next post pushes.
-            const suppressed = presence.isOnline(record.recipient_cid);
-            if (suppressed) {
-                logStore.append(record, 'read');
-            }
-            else {
-                logStore.append(record);
-                // One WebPush per binding, log-and-continue on failure (E12) — never
-                // block or crash the ingest on a dead endpoint.
-                void push.sendPushes(bindings, record.payload).then((results) => {
-                    for (const r of results) {
-                        if (!r.ok)
-                            console.error(`[push] ${r.binding_id}: ${r.error ?? r.status}`);
-                    }
-                });
-            }
-            emit({ event, notification: record, bindings, suppressed });
-        }
-        else if (event === 'marked_read') {
-            const recipient = payload.Reduce('recipient_cid').Visualize();
-            const ids = readIds(payload.Reduce('notif_ids'));
-            logStore.markRead(recipient, ids);
-            emit({ event, recipient_cid: recipient, notif_ids: ids });
-        }
-        else if (event === 'unregistered') {
-            const recipient = payload.Reduce('recipient_cid').Visualize();
-            logStore.purgeRecipient(recipient);
-            emit({ event, recipient_cid: recipient });
-        }
-        else {
-            emit({ event });
-        }
-    }
-    function createPacket(seed, signingSecret) {
-        const pcfg = new PacketWrapperConfigurator();
-        const args = ['--unit_hash', unitHash, '--seed_phrase', seed, '--unit_dir_path', cfg.unitDir];
-        if (signingSecret)
-            args.push('--init_trn_argument', JSON.stringify(signingSecret));
-        pcfg.process_arguments(args);
-        return new Promise((res, rej) => {
-            const t = setTimeout(() => rej(new Error('packet creation timed out')), 30000);
-            wrapper.packet_manager.create_packet(pcfg, (p) => {
-                clearTimeout(t);
-                pw = p;
-                pw.on_return_data = (d) => {
-                    const kind = d.Reduce('kind').Visualize();
-                    if (kind === 'save_state') {
-                        saveState();
-                        return;
-                    }
-                    if (kind === 'notify_agent') {
-                        handleNotifyAgent(d.Reduce('payload'));
-                        return;
-                    }
-                    const p2 = pending.shift();
-                    if (p2) {
-                        clearTimeout(p2.timer);
-                        p2.resolve(d.Reduce('payload'));
-                    }
-                };
-                pw.on_transaction_failure = (msg) => {
-                    const p2 = pending.shift();
-                    if (p2) {
-                        clearTimeout(p2.timer);
-                        p2.reject(new Error(msg));
-                    }
-                    else
-                        console.error('[daemon] inbound rejected:', String(msg).split('\n')[0]);
-                };
-                res();
-            }, unitBytes);
-        });
-    }
-    // Boot: restore the persisted identity (same container id via reseed) or
-    // mint a fresh one and persist its SIGN secret + state.
-    if (fs.existsSync(keyPath)) {
-        const secret = fs.readFileSync(keyPath, 'utf8').trim();
-        await createPacket('', secret);
-        if (fs.existsSync(dataPath) && fs.statSync(dataPath).size > 0) {
-            const adaptData = pw.packet.ParseValue(new Uint8Array(fs.readFileSync(dataPath)));
-            await mutate('::actor::import_state', adaptData);
-        }
-    }
-    else {
-        await createPacket(randomBytes(24).toString('hex'));
-        const secretHex = Buffer.from(ro('::actor::export_signing_secret').Serialize()).toString('hex');
-        fs.writeFileSync(keyPath, secretHex, { mode: 0o600 });
-    }
-    // The packet echoes this in every confirm_registration; PRIVATE key stays here.
-    await mutate('::a2a_notifications::set_vapid_public_key', { key: cfg.vapidPublicKey });
-    const cid = pw.packet.GetContainerID().Visualize();
-    const vv = ro('::actor::get_version');
-    const version = {
-        MAJ: Number(vv.Reduce('MAJ').Visualize()),
-        MIN: Number(vv.Reduce('MIN').Visualize()),
-        PATCH: Number(vv.Reduce('PATCH').Visualize()),
-    };
-    const mintInvite = async (name = '') => {
-        const m = await mutate('::a2a_messaging::generate_invite', { name });
-        return Buffer.from(m.Reduce('invite').GetBinary()).toString('hex');
-    };
-    // BUG-2: verify a presence socket belongs to the claimed recipient — PURE TS,
-    // ZERO mufl (app+server-only by design). The panel presents
-    // { recipient, endpoint, auth } from its OWN WebPush subscription; we read the
-    // packet's registration state via the EXISTING ::actor::export_state readonly
-    // and check the pair against a stored binding of registration[recipient]. Runs
-    // only at socket-auth time (foreground reconnect), not per notification, so the
-    // export_state cost is fine. Returns the bound cid on success, else null; never
-    // throws into the WS layer.
-    const verifyPresence = (frame) => {
-        const recipient = frame.recipient;
-        const endpoint = frame.endpoint;
-        const auth = frame.auth;
-        if (typeof recipient !== 'string' || typeof endpoint !== 'string' || typeof auth !== 'string')
-            return null;
-        if (!recipient || !endpoint || !auth)
-            return null;
-        try {
-            const notify = ro('::actor::export_state').Reduce('notify');
-            if (notify.IsNil())
-                return null;
-            const regs = notify.Reduce('notify_registrations');
-            if (regs.IsNil())
-                return null;
-            // notify_registrations is a global_id-keyed map; find the recipient's entry.
-            let reg = null;
-            for (const k of regs.GetKeys()) {
-                if (k.Visualize() === recipient) {
-                    reg = regs.Reduce(k);
-                    break;
-                }
-            }
-            if (!reg || reg.IsNil())
-                return null;
-            const bindings = reg.Reduce('bindings');
-            if (bindings.IsNil())
-                return null;
-            for (let i = 0;; i++) {
-                const b = bindings.Reduce(i);
-                if (b.IsNil())
-                    break;
-                if (b.Reduce('endpoint').Visualize() === endpoint && b.Reduce('auth').Visualize() === auth) {
-                    return recipient;
-                }
-            }
-            return null;
-        }
-        catch (err) {
-            console.error('[presence] verify failed:', String(err).split('\n')[0]);
-            return null;
-        }
-    };
-    let discovery;
-    let presenceServer;
-    if (cfg.discoveryPort !== undefined) {
-        discovery = await startDiscoveryServer(cfg.discoveryPort, cfg.discoveryHost, {
-            serviceName: () => SERVICE_NAME,
-            serviceCid: () => cid,
-            brokerUrl: cfg.brokerUrl,
-            vapidPublicKey: cfg.vapidPublicKey,
-            mintInvite,
-        });
-        // Attach the foreground-presence WebSocket to the SAME server/port (reachable
-        // over the same tunnel as /v1/discovery). No new port, no new tunnel route.
-        presenceServer = attachPresenceServer(discovery, presence, {
-            verify: verifyPresence,
-            onChange: (recipient_cid, online) => emit({ event: 'presence_change', recipient_cid, online }),
-        });
-    }
-    return {
-        cid,
-        version,
-        logStore,
-        onEvent: (cb) => listeners.push(cb),
-        invite: async (name) => {
-            return mintInvite(name);
-        },
-        contacts: () => ro('::a2a_messaging::list_contacts').Visualize(),
-        exportVis: () => ro('::actor::export_state').Visualize(),
-        stop: async () => {
-            saveState();
-            if (presenceServer)
-                await presenceServer.close();
-            if (discovery)
-                await new Promise((res) => discovery.close(() => res()));
-        },
-    };
-}
-// ---- CLI entry (JSON-lines control protocol) --------------------------------
-const isMain = process.argv[1] && resolve(process.argv[1]) === resolve(import.meta.url.replace('file://', ''));
-if (isMain) {
-    const out = (obj) => process.stdout.write(JSON.stringify(obj) + '\n');
-    startDaemon(loadConfig())
-        .then((daemon) => {
-        daemon.onEvent((e) => out(e));
-        out({ event: 'ready', cid: daemon.cid, version: daemon.version });
-        const rl = createInterface({ input: process.stdin });
-        rl.on('line', (line) => {
-            void (async () => {
-                let msg;
-                try {
-                    msg = JSON.parse(line);
-                }
-                catch {
-                    return;
-                }
-                try {
-                    if (msg.cmd === 'invite')
-                        out({ reply: await daemon.invite(msg.name ?? '') });
-                    else if (msg.cmd === 'contacts')
-                        out({ reply: daemon.contacts() });
-                    else if (msg.cmd === 'export_vis')
-                        out({ reply: daemon.exportVis() });
-                    else if (msg.cmd === 'status')
-                        out({ reply: { cid: daemon.cid, version: daemon.version } });
-                    else if (msg.cmd === 'notifications')
-                        out({ reply: daemon.logStore.list() });
-                    else
-                        out({ reply: { error: `unknown cmd ${msg.cmd}` } });
-                }
-                catch (err) {
-                    out({ reply: { error: String(err) } });
-                }
-            })();
-        });
-        const shutdown = () => {
-            void daemon.stop().then(() => process.exit(0));
-        };
-        process.on('SIGTERM', shutdown);
-        process.on('SIGINT', shutdown);
-    })
-        .catch((err) => {
-        console.error('[daemon] boot failed:', err);
-        process.exit(1);
-    });
-}

package/dist/http.js

@@ -1,31 +0,0 @@
-import http from 'node:http';
-const CORS = { 'Access-Control-Allow-Origin': '*' };
-export function startDiscoveryServer(port, host, deps) {
-    const server = http.createServer(async (req, res) => {
-        if (req.method === 'OPTIONS') {
-            res.writeHead(204, CORS);
-            return void res.end();
-        }
-        if (req.method === 'GET' && req.url?.split('?')[0] === '/v1/discovery') {
-            try {
-                const invite = await deps.mintInvite();
-                res.writeHead(200, { 'content-type': 'application/json', ...CORS });
-                return void res.end(JSON.stringify({
-                    version: 1,
-                    service_name: deps.serviceName(),
-                    service_cid: deps.serviceCid(),
-                    broker_url: deps.brokerUrl,
-                    vapid_public_key: deps.vapidPublicKey,
-                    invite,
-                }));
-            }
-            catch (e) {
-                res.writeHead(500, { 'content-type': 'application/json', ...CORS });
-                return void res.end(JSON.stringify({ error: String(e) }));
-            }
-        }
-        res.writeHead(404, CORS);
-        res.end();
-    });
-    return new Promise((resolve) => server.listen(port, host, () => resolve(server)));
-}

package/dist/log-store.js

@@ -1,48 +0,0 @@
-// The app-side notification log (notifications.json): the daemon owns
-// storage + read/unread status; the packet only validates and hands records
-// over. v1: unbounded append (documented; GC is an optional enhancement).
-import * as fs from 'node:fs';
-import { resolve } from 'node:path';
-export class LogStore {
-    path;
-    records = [];
-    constructor(dir) {
-        this.path = resolve(dir, 'notifications.json');
-        try {
-            this.records = JSON.parse(fs.readFileSync(this.path, 'utf8'));
-        }
-        catch {
-            this.records = [];
-        }
-    }
-    flush() {
-        const tmp = `${this.path}.tmp`;
-        fs.writeFileSync(tmp, JSON.stringify(this.records, null, 2));
-        fs.renameSync(tmp, this.path);
-    }
-    // status defaults to 'unread'. Foreground-suppressed posts are appended as
-    // 'read' (BUG-2): the recipient already saw the message in-app, so the record
-    // is kept for history but must not inflate the unread badge.
-    append(rec, status = 'unread') {
-        this.records.push({ ...rec, status });
-        this.flush();
-    }
-    // ids === null ⇒ mark ALL of this recipient's notifications read.
-    // Unknown / foreign ids are ignored (E7 — idempotent).
-    markRead(recipientCid, ids) {
-        for (const r of this.records) {
-            if (r.recipient_cid !== recipientCid)
-                continue;
-            if (ids === null || ids.includes(r.notif_id))
-                r.status = 'read';
-        }
-        this.flush();
-    }
-    purgeRecipient(recipientCid) {
-        this.records = this.records.filter((r) => r.recipient_cid !== recipientCid);
-        this.flush();
-    }
-    list() {
-        return this.records;
-    }
-}