Luno turns an Android device into a secure, self-hosted communication node
you drive from your own backend — over a versioned, real-time protocol.
The entire gateway is a native Android foreground service: queue, socket, telephony, retries and crypto. Kill the UI and it keeps running — that is the acceptance test for the boundary.
The node prescribes no server technology. It depends only on a published JSON envelope, so any backend that speaks it — in any language — can drive a fleet.
{ "kind": "command", "type": "send_sms" }Every command is written to a durable Room outbox before an ack is sent, and every inbound message before it is reported. The rest is a state machine draining that store.
Android and OEM skins will kill your process. Luno plans for recovery instead of immortality: boot receiver, WorkManager backstop, and a resync handshake that makes reconnection lossless and duplicate-free.
The device credential is sealed by the Android Keystore, message bodies and phone numbers are encrypted at rest, and a single central redactor keeps PII out of every log line. Rate limits are backend-authoritative but enforced client-side too, so a compromised server still cannot turn a SIM into a spam cannon.
The @luno-oss/* SDK packages implement the server half for you — a framework-independent core plus thin adapters for Hono, Express, Fastify, NestJS and Cloudflare Workers.
Messages fan out to parts, each part carries its own correlation id, and rollup is time-bounded — so a carrier that never sends a report degrades to UNDELIVERED instead of hanging forever.
SMS is what v1 ships. The Transport interface and the wire protocol are both transport-neutral, so MMS, USSD and non-Android nodes slot in without reshaping the queue, the protocol or the UI.