@ours.network/notifications 0.1.1

package/mufl_code/core/version.mm

@@ -0,0 +1,24 @@
+/*
+This library provides a simple version tracking mechanism for the shared
+ours mufl core. It contains a hardcoded read-only version that can be
+accessed by any library or application that loads it.
+This library has no dependencies and can be included in any packet.
+*/
+library version
+{
+    metadef version_t: (
+        $MAJ -> int,
+        $MIN -> int,
+        $PATCH -> int
+    ).
+
+    fn create_version (maj: int, min: int, patch: int) = ($MIN -> min, $MAJ -> maj, $PATCH -> patch).
+
+
+    // This MUST be updated every time we update ANY code in the shared core.
+    hidden {
+        core_version = create_version 0 9 0.
+    }
+
+    fn get_core_version(_) = core_version.
+}

package/mufl_code/packet.mu

@@ -0,0 +1,170 @@
+// ours-notifications service packet — the Notifications-as-a-Service node.
+//
+// Plays the SERVICE half of a2a_notifications (registration + token state,
+// post_notification ingest) plus the ordinary a2a_messaging surface so
+// recipients can connect via invites. Storage and WebPush egress live in the
+// HOST DAEMON (src/daemon.ts): the notification hooks below emit $notify_agent
+// events the daemon consumes ("notification_posted" / "marked_read" /
+// "unregistered"); the daemon owns notifications.json and the web-push calls.
+//
+// The manifest advertises core.notifications (a2a_capabilities), with a no-op
+// verb handler — the capability defines no control verbs in v1
+// (NOTIFICATIONS_CONTRACT.md in the shared core).
+application actor loads libraries
+    identity_proof_document,
+    attestation_document,
+    native_attestation_document,
+    transaction_message_decoder,
+    address_document,
+    address_document_types,
+    key_utils,
+    key_storage,
+    continuation,
+    encrypted_channel,
+    a2a_protocol,
+    a2a_messaging,
+    a2a_notifications,
+    a2a_capabilities,
+    current_transaction_info,
+    protocol_container,
+    registration_proof,
+    version
+    uses transactions
+{
+    hidden
+    {
+        // Minimal inbox — the service is not a chat endpoint, but the core's
+        // receive path requires a storage hook; kept for operator debugging.
+        metadef msg_t: ($sender -> global_id, $text -> str, $wire_id -> str).
+        inbox is msg_t[] = [].
+
+        _read_or_abort = grab( _read_or_abort ).
+        key_storage::init ($_read_or_abort -> _read_or_abort).
+        encrypted_channel::init ($_read_or_abort -> _read_or_abort).
+
+        fn _save_state (_) = (transaction::action::return_data ($kind -> $save_state)).
+        fn _return_data (payload: any) = (transaction::action::return_data ($kind -> $data, $payload -> payload)).
+        fn _notify_agent (payload: any) = (transaction::action::return_data ($kind -> $notify_agent, $payload -> payload)).
+
+        // Messaging hooks: storage-minimum (deposit inbound text, no-ops else).
+        a2a_messaging::init (
+            $_read_or_abort -> _read_or_abort,
+            $on_message_received -> fn (arg: any) -> transaction::action::type[]
+            {
+                sid = (arg $sender_id) safe global_id.
+                txt = (arg $text) safe str.
+                wid is str = "".
+                if (arg $wire_id) != NIL { wid -> (arg $wire_id) safe str. }
+                inbox (_count inbox|) -> ($sender -> sid, $text -> txt, $wire_id -> wid).
+                return [ _notify_agent ($event -> "message_received"), _save_state NIL ].
+            },
+            $on_message_sent -> fn (_: any) -> transaction::action::type[] { return []. },
+            $on_contact_removed -> fn (_: any) -> transaction::action::type[] { return []. },
+            $on_file_received -> fn (_: any) -> transaction::action::type[] { return []. },
+            $on_file_sent -> fn (_: any) -> transaction::action::type[] { return []. }
+        ).
+
+        // Notification hooks: hand each event to the daemon (the app-side
+        // storage/egress owner) as a $notify_agent action.
+        a2a_notifications::init (
+            $_read_or_abort -> _read_or_abort,
+            $on_notification_posted -> fn (arg: any) -> transaction::action::type[]
+            {
+                return [ _notify_agent (
+                    $event        -> "notification_posted",
+                    $notification -> (arg $notification),
+                    $bindings     -> (arg $bindings)
+                ) ].
+            },
+            $on_notifications_marked_read -> fn (arg: any) -> transaction::action::type[]
+            {
+                return [ _notify_agent (
+                    $event         -> "marked_read",
+                    $recipient_cid -> (arg $recipient_cid),
+                    $notif_ids     -> (arg $notif_ids)
+                ) ].
+            },
+            $on_unregistered -> fn (arg: any) -> transaction::action::type[]
+            {
+                return [ _notify_agent (
+                    $event         -> "unregistered",
+                    $recipient_cid -> (arg $recipient_cid)
+                ) ].
+            },
+            // Client-side hook — this packet never registers WITH a service.
+            $on_notify_registration -> fn (_: any) -> transaction::action::type[] { return []. }
+        ).
+
+        // Manifest: advertise core.notifications. No control verbs in v1, so
+        // the handler is a declared no-op (init fail-fasts without one).
+        cap_handlers is (str ->> (any -> transaction::action::type[])) = (,).
+        cap_handlers (a2a_capabilities::cap_notifications) -> fn (_: any) -> transaction::action::type[] { return []. }
+        cap_supported is str[] = [ a2a_capabilities::cap_notifications ].
+
+        a2a_capabilities::init (
+            $describe -> fn (_: any) -> a2a_capabilities::app_manifest_t {
+                caps is (str ->> a2a_capabilities::capability_t) = (,).
+                caps (a2a_capabilities::cap_notifications) -> (
+                    $cap -> a2a_capabilities::cap_notifications, $version -> 1, $params -> "", $secrets -> (,)
+                ).
+                return (
+                    $version           -> 1,
+                    $app_id            -> "network.ours.notifications",
+                    $name              -> "ours notifications service",
+                    $description       -> "Notifications-as-a-Service node: accepts token-authorized notification posts and pushes them out-of-band (WebPush).",
+                    $monitoring_status -> "off",
+                    $capabilities      -> caps
+                ).
+            },
+            $authorizer -> a2a_messaging::authorize_control,
+            $supported  -> cap_supported,
+            $handlers   -> cap_handlers,
+            $on_unknown -> fn (_: any) -> transaction::action::type[] { return []. }
+        ).
+    }
+
+    // On recreation the daemon injects the persisted SIGN secret as init_arg
+    // (Serialize()-hex of the secretkey_sign); reseeding restores the container
+    // id so registrations/tokens survive a restart (adapt #77).
+    trn __init arg
+    {
+        if _typeof arg == "STRING" {
+            key_storage::reseed_identity_from_secret
+                ((_read_or_abort (_hex_string_to_binary (arg SAFE(str)))) SAFE(secretkey_sign)).
+        }
+        return ::transaction::success[].
+    }
+
+    // ---- host surface (daemon-driven) ------------------------------------
+
+    trn readonly get_version _ { return version::get_core_version NIL. }
+    trn readonly export_address_document _ { return (_write address_document::get_my_address_document()). }
+
+    // Identity persistence: the daemon stores this beside the state blob and
+    // reinjects it via __init on restart.
+    trn readonly export_signing_secret _
+    {
+        return key_storage::export_identity_signing_secret().
+    }
+
+    // The core's send_message delivers to the legacy ::actor::receive_message
+    // name; route it into the shared handler (→ inbox hook above).
+    trn receive_message args: any { return a2a_messaging::handle_receive_message args. }
+    trn readonly list_incoming_messages _ { return ($inbox -> inbox). }
+
+    // Full persisted state: BOTH the messaging core half and the notify half.
+    trn readonly export_state _
+    {
+        return (
+            $core   -> (a2a_messaging::export_core_state NIL),
+            $notify -> (a2a_notifications::export_notify_state NIL)
+        ).
+    }
+    trn import_state data: any
+    {
+        current_transaction_info::validate_origin_or_abort (transaction::envelope::origin::user,).
+        a2a_messaging::import_core_state (data $core).
+        if (data $notify) != NIL { a2a_notifications::import_notify_state (data $notify). }
+        return transaction::success [ _return_data ($imported -> TRUE), _save_state NIL ].
+    }
+}

package/mufl_code/protocol_container.mm

@@ -0,0 +1,18 @@
+// Minimal protocol_container library — provides ::protocol_container::init_my_ipd,
+// which the ADAPT wrapper runs on every packet during broker registration
+// (possession-proof / identity-proof-document setup, adapt #77). Mirrors the
+// toolkit's per-unit protocol_container stub; deps resolve from the stdlib.
+library protocol_container loads libraries
+    identity_proof_document,
+    identity_proof_document_types,
+    native_attestation_document,
+    browser_attestation_document,
+    current_transaction_info
+    uses transactions
+{
+    trn init_my_ipd _ {
+        current_transaction_info::validate_origin (::transaction::envelope::origin::user,).
+        identity_proof_document_types::set_my_ipd(identity_proof_document::create()).
+        return ::transaction::success [].
+    }
+}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@ours.network/notifications",
+  "version": "0.1.1",
+  "description": "ours.network Notifications-as-a-Service — a2a_notifications service packet + WebPush daemon, with a start/stop/status/install-service CLI (ours-notify). Self-provisions identity + VAPID; runs on any host, point DNS at the discovery port.",
+  "license": "FSL-1.1-Apache-2.0",
+  "type": "module",
+  "bin": {
+    "ours-notify": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "mufl_code",
+    "scripts/gen-vapid.mjs",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepare": "scripts/compile-mufl.sh && tsc",
+    "start": "node dist/cli.js start",
+    "stop": "node dist/cli.js stop",
+    "status": "node dist/cli.js status",
+    "serve": "node dist/cli.js serve",
+    "test": "npm run build && node --test --test-force-exit --test-concurrency=1 tests/*.test.mjs"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "@adapt-toolkit/sdk": "0.10.12",
+    "@adapt-toolkit/sdk-native": "0.10.12",
+    "web-push": "^3.6.7",
+    "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "@adapt-toolkit/broker": "0.10.12",
+    "@adapt-toolkit/mufl": "0.10.12",
+    "@types/node": "^22.0.0",
+    "@types/web-push": "^3.6.3",
+    "playwright": "^1.61.1",
+    "typescript": "^5.5.0"
+  }
+}

package/scripts/gen-vapid.mjs

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+// Generate a VAPID keypair for this service instance.
+//   node scripts/gen-vapid.mjs [outdir]   (default: ./vapid)
+// Writes outdir/vapid.public (0644) and outdir/vapid.private (0600).
+// The PRIVATE key is daemon-side only — it must never reach packet state
+// (the daemon injects only the public half via set_vapid_public_key).
+import webpush from 'web-push';
+import * as fs from 'node:fs';
+import { resolve } from 'node:path';
+
+const outDir = resolve(process.argv[2] || 'vapid');
+fs.mkdirSync(outDir, { recursive: true });
+const { publicKey, privateKey } = webpush.generateVAPIDKeys();
+fs.writeFileSync(resolve(outDir, 'vapid.public'), publicKey + '\n', { mode: 0o644 });
+fs.writeFileSync(resolve(outDir, 'vapid.private'), privateKey + '\n', { mode: 0o600 });
+console.log(`VAPID keypair written to ${outDir}/vapid.public + ${outDir}/vapid.private (0600)`);