@ours.network/notifications 0.3.1-nightly.1 → 0.3.1-nightly.2

package/README.md

@@ -55,15 +55,29 @@ Responses are never cached. User and producer credentials have separate scopes.
 | POST `/api/v1/devices/delete` | User | `{ "id": "device-id" }`, only that user's device |
 | GET `/api/v1/devices/status?id=...` | User | `{ "active": true }` |
 | GET `/api/v1/inbox?limit=50&before=...` | User | Items, shared unread count, revision, next cursor |
-| GET `/api/v1/summary` | User | Shared unread count, revision, and per-chat source/identity/count |
+| GET `/api/v1/summary` | User | Shared unread count, revision, per-chat source/identity/count, and `sections: {chats, tasks}` |
 | POST `/api/v1/read-target` | User | `{ "url": "/fleet/chats?chat=agent", "revision": OBSERVED_REVISION }`, reads only this chat up to the revision captured before its history load |
 | POST `/api/v1/read` | User | `{ "ids": ["notification-id"] }`, idempotent shared read |
+| POST `/api/v1/delete` | User | `{ "ids": ["notification-id"] }` → `{ "removed": COUNT }`; persistently removes only this user’s entries and queued deliveries after the client has confirmed target absence |
+| POST `/api/v1/delete-target` | Producer | `{ "url": "/fleet/chats?chat=agent" }` → `{ "removed": COUNT }`; only its credential’s user/source and exact canonical conversation, including filter/anchor variants |
 | POST `/api/v1/send` | Producer | `{ "eventId": "stable-event-id", "title": "Agent completed", "body": "Open the chat", "url": "/fleet/chats?chat=agent&detail=1" }` |
 
 Inbox admission and queued delivery are one fsynced atomic snapshot. The service
 deduplicates by user/source/event ID; replay must retain identical title/body/URL
 or it receives 409. Inbox entries survive failed pushes and service restart.
-Reading stops remaining queued deliveries. Device endpoints cannot transfer
+Producer send payloads may include `taskId`: a stable task ID for an associated
+ACP agent, or `null` for an explicitly standalone agent. Omission remains supported.
+The association is persisted and cannot change when replaying the same event ID.
+Summary section counts are independent of browser inventories: task-page URLs,
+encoded work task rooms and explicit task associations count under Tasks. An explicit
+task association takes precedence over the source. Messenger destinations, including
+room CIDs that open in Messenger, and explicit standalone agents count under Chats.
+Legacy ACP notifications without association
+and unknown destinations remain in the total and Notifications inbox only. Each
+unread contributes at most once to a section. Reading or deletion updates these
+counts with the same durable revision as the total.
+
+Reading stops remaining queued deliveries. Deleting confirmed stale inbox records updates the shared revision, unread summary and presence subscribers atomically. Generic loading, permission or network failures do not establish target absence; callers must validate absence through the owning service. Device endpoints cannot transfer
 between users, and only supported HTTPS push-provider hosts and valid P-256
 subscription keys are accepted. Navigation stays within `/fleet`.
 

package/dist/chat-target.js

@@ -9,4 +9,7 @@ export function chatTarget(path) {
     }
     return null;
 }
-export function chatKey(value) { return JSON.stringify([value.source, value.chat]); }
+export function chatKey(value) {
+    const chat = value.source === 'messenger' && /^[a-f0-9]{64}$/i.test(value.chat) ? value.chat.toUpperCase() : value.chat;
+    return JSON.stringify([value.source, chat]);
+}

package/dist/server.js

@@ -44,7 +44,7 @@ export function createNotificationService(config, send) {
             if (req.headers.origin || req.headers.cookie || req.headers['sec-fetch-site'])
                 throw new HttpError(403, 'use authenticated gateway');
             const url = new URL(req.url ?? '/', 'http://localhost');
-            const producerRoute = url.pathname === '/api/v1/send';
+            const producerRoute = ['/api/v1/send', '/api/v1/delete-target'].includes(url.pathname);
             const authorization = req.headers.authorization ?? '';
             const credential = (producerRoute ? config.producers : config.users).find(c => same(authorization, `Bearer ${c.token}`));
             if (!credential)
@@ -88,16 +88,31 @@ export function createNotificationService(config, send) {
                 store.read(user, ids.map(id => text(id, 100)));
                 result = { ok: true };
             }
-            else if (req.method === 'POST' && producerRoute) {
+            else if (req.method === 'POST' && url.pathname === '/api/v1/delete') {
+                const value = await body(req), ids = value.ids;
+                if ('userId' in value || 'source' in value || !Array.isArray(ids) || ids.length > 100)
+                    throw new HttpError(400, 'invalid notification ids');
+                result = { removed: store.deleteNotifications(user, ids.map(id => text(id, 100))) };
+            }
+            else if (req.method === 'POST' && url.pathname === '/api/v1/delete-target') {
+                const value = await body(req);
+                if ('userId' in value || 'source' in value)
+                    throw new HttpError(400, 'recipient and source are credential scoped');
+                result = { removed: store.deleteTarget(user, credential.source, target(value.url)) };
+            }
+            else if (req.method === 'POST' && url.pathname === '/api/v1/send') {
                 const value = await body(req);
                 if ('userId' in value || 'source' in value)
                     throw new HttpError(400, 'recipient and source are credential scoped');
-                result = store.produce({ userId: user, source: credential.source, eventId: text(value.eventId, 512),
+                const taskId = value.taskId === undefined ? undefined : value.taskId === null ? null : text(value.taskId, 120);
+                if (typeof taskId === 'string' && !/^[A-Za-z0-9_-]+$/.test(taskId))
+                    throw new HttpError(400, 'invalid task identity');
+                result = store.produce({ ...(taskId === undefined ? {} : { taskId }), userId: user, source: credential.source, eventId: text(value.eventId, 512),
                     title: text(value.title, 160), body: text(value.body, 512), url: target(value.url) });
             }
             else
                 throw new HttpError(404, 'route not found');
-            if (req.method === 'POST' && ['/api/v1/send', '/api/v1/read', '/api/v1/read-target'].includes(url.pathname))
+            if (req.method === 'POST' && ['/api/v1/send', '/api/v1/read', '/api/v1/read-target', '/api/v1/delete', '/api/v1/delete-target'].includes(url.pathname))
                 presence.notify(user);
             res.end(JSON.stringify(result));
         }

package/dist/store.d.ts

@@ -10,6 +10,7 @@ export interface Notification {
     createdAt: string;
     createdRevision?: number;
     readAt: string | null;
+    taskId?: string | null;
 }
 interface Device {
     id: string;
@@ -45,9 +46,17 @@ export declare class Store {
             chat: string;
             count: number;
         }[];
+        sections: {
+            chats: number;
+            tasks: number;
+        };
     };
     readTarget(userId: string, url: string, revision: number): void;
     read(userId: string, ids: string[]): void;
+    /** Delete only this user's confirmed stale entries and their pending deliveries. */
+    deleteNotifications(userId: string, ids: string[]): number;
+    /** A producer may retire only its own notifications for the canonical conversation. */
+    deleteTarget(userId: string, source: string, url: string): number;
     produce(value: Omit<Notification, 'id' | 'createdAt' | 'readAt'>): Notification;
     due(now: number): {
         device: Device | undefined;

package/dist/store.js

@@ -104,7 +104,20 @@ export class Store {
     summary(userId) {
         const unread = this.state.notifications.filter(n => n.userId === userId && !n.readAt);
         const groups = new Map();
+        const sections = { chats: 0, tasks: 0 };
         for (const n of unread) {
+            const url = new URL(n.url, 'https://ours.invalid'), targetForSection = chatTarget(n.url);
+            if (/^\/fleet\/tasks\/[^/]+\/?$/.test(url.pathname))
+                sections.tasks++;
+            else if (targetForSection) {
+                if (typeof n.taskId === 'string' || targetForSection.source === 'work' && /^room-[^:]+(?::[^:]+)?$/.test(targetForSection.chat))
+                    sections.tasks++;
+                else if (targetForSection.source === 'messenger')
+                    sections.chats++;
+                else if (n.taskId === null)
+                    sections.chats++;
+                // Older ACP records carry no association: leave them in the total only.
+            }
             const target = chatTarget(n.url);
             if (!target)
                 continue;
@@ -112,7 +125,7 @@ export class Store {
             group.count++;
             groups.set(key, group);
         }
-        return { unread: unread.length, revision: this.state.revision, chats: [...groups.values()] };
+        return { unread: unread.length, revision: this.state.revision, chats: [...groups.values()], sections };
     }
     readTarget(userId, url, revision) {
         if (!Number.isSafeInteger(revision) || revision < 0 || revision > this.state.revision)
@@ -138,10 +151,34 @@ export class Store {
             s.jobs = s.jobs.filter(j => !s.notifications.find(n => n.id === j.notificationId)?.readAt);
         });
     }
+    /** Delete only this user's confirmed stale entries and their pending deliveries. */
+    deleteNotifications(userId, ids) {
+        const chosen = new Set(ids);
+        const removed = new Set(this.state.notifications.filter(n => n.userId === userId && chosen.has(n.id)).map(n => n.id));
+        if (!removed.size)
+            return 0;
+        this.commit(s => {
+            s.notifications = s.notifications.filter(n => !removed.has(n.id));
+            s.jobs = s.jobs.filter(j => !removed.has(j.notificationId));
+        });
+        return removed.size;
+    }
+    /** A producer may retire only its own notifications for the canonical conversation. */
+    deleteTarget(userId, source, url) {
+        const target = chatTarget(url);
+        if (!target)
+            throw new HttpError(400, 'expected chat target');
+        const key = chatKey(target);
+        const ids = this.state.notifications.filter(n => n.userId === userId && n.source === source && (() => {
+            const other = chatTarget(n.url);
+            return other && chatKey(other) === key;
+        })()).map(n => n.id);
+        return this.deleteNotifications(userId, ids);
+    }
     produce(value) {
         const previous = this.state.notifications.find(n => n.userId === value.userId && n.source === value.source && n.eventId === value.eventId);
         if (previous) {
-            if (previous.title !== value.title || previous.body !== value.body || previous.url !== value.url)
+            if (previous.title !== value.title || previous.body !== value.body || previous.url !== value.url || previous.taskId !== value.taskId)
                 throw new HttpError(409, 'event id reused');
             return previous;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/notifications",
-  "version": "0.3.1-nightly.1",
+  "version": "0.3.1-nightly.2",
   "description": "Authenticated web push delivery and shared notification inbox",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",