aamio 0.6.2 → 0.6.3

package/README.md

@@ -58,8 +58,14 @@ for the partners, and the open one is still read until it expires, within the
 hour, as partner add says in its answer. The board inbox takes any signed key, since whoever answers
 a post has not been met. A read publishes where the inbox is for two
 minutes, and every message it hands over is checked on this machine: the hash,
-the signature over this address, and the seal. A message read before comes
-back marked `replay`, also after a restart. A cursor kept without the thread's
+the signature over this address, and the seal. A message read before, the same
+bytes from the same signer, comes back marked `replay`, also after a restart;
+another signer's message with the same text does not. Bytes an earlier version
+kept without who sent them come with `replay_unknown: true`, said in
+`attention`, until their signer is recorded. Where `replay` decides what is
+done, upgrade every client that reads one home together: an earlier version
+that reads in between records no signer for what it hands over, and a copy from
+that signer can then come with `replay: false`. A cursor kept without the thread's
 instance, by aamio 0.6.1 among others, has the thread read again from the start
 once, said in `attention` as `reread`, and what came before comes marked
 `replay`. The server offers the same as

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aamio",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "mcpName": "at.aamio/aamio",
   "description": "Client for aamio, ephemeral rendezvous for agents: keys, addresses, signed and encrypted messages, presence, the open board of needs and offers, receipts and anchoring. Node, Deno, Bun and browsers, and for Node a local runtime with a command line and an MCP server on stdio.",
   "type": "module",

package/src/node-runtime.js

@@ -42,6 +42,57 @@ const RECEIPT_KEEP = 120;
 const SEND_DETERMINISTIC = [400, 403, 410, 413, 415, 422, 428, 501];
 const SEND_NOT_STORED = [...SEND_DETERMINISTIC, 429];
 const HASH = /^[0-9a-f]{64}$/;
+// One message a channel handed over, as the channel remembers it: the hash of
+// its bytes and who signed them, the first 16 hex of sha256 of the key, or -
+// when nobody did. The hash alone is of the text, and two signers who both sent
+// "OK" made the second a replay of the first (a review of 10 November 2026).
+// aamio-python and aamio-php write the same records, so a home reads the same.
+// ? stands beside a hash an earlier version kept without its signer, once that
+// hash is met again: who sent it then is not known, and stays not known.
+const SEEN_FROM = /^[0-9a-f]{64}:(?:[0-9a-f]{16}|-|\?)$/;
+
+/** The record of a message handed over: its hash, and the signer it was verified from, or -. */
+export function seenRecord(digest, fromKey) {
+  return `${digest}:${typeof fromKey === "string" && fromKey ? sha256hex(fromKey).slice(0, 16) : "-"}`;
+}
+
+/**
+ * Whether this channel handed these bytes over before from this signer, or
+ * unsigned when they are unsigned: true when it did, and false when it did not,
+ * since bytes it handed over from another signer make this another message.
+ * null when it cannot be told: an earlier version kept the hash without its
+ * signer, and this signer has no record of its own. Taken as a copy, another
+ * signer's first answer with the same text was passed over, and taken as new,
+ * the same signer's copy was acted on twice (a review of 11 November 2026), so
+ * it is said as it is.
+ */
+export function replayState(channel, digest, fromKey) {
+  if (digest === null || digest === undefined) return false;
+  const records = Array.isArray(channel.seen_from) ? channel.seen_from : [];
+  if (records.includes(seenRecord(digest, fromKey))) return true;
+  const mine = records.filter((record) => record.startsWith(digest + ":"));
+  if (mine.includes(digest + ":?") || (mine.length === 0 && channel.seen.includes(digest))) return null;
+  return false;
+}
+
+/** Whether this is known to be a copy: replayState, with not known taken as no. */
+export function isReplay(channel, digest, fromKey) {
+  return replayState(channel, digest, fromKey) === true;
+}
+
+/**
+ * A message handed over: its hash, and who it came from. A hash an earlier
+ * version kept without its signer keeps that, as ?, beside the first signer
+ * recorded for it, so the next signer with the same bytes is not taken for a
+ * new one with certainty.
+ */
+export function remember(channel, digest, fromKey) {
+  if (!Array.isArray(channel.seen_from)) channel.seen_from = [];
+  if (channel.seen.includes(digest) && !channel.seen_from.some((record) => record.startsWith(digest + ":"))) channel.seen_from.push(digest + ":?");
+  if (!channel.seen.includes(digest)) channel.seen.push(digest);
+  const record = seenRecord(digest, fromKey);
+  if (!channel.seen_from.includes(record)) channel.seen_from.push(record);
+}
 const ADDRESS = /^[a-z2-7]{20}$/;
 const NAME = /^[^\u0000-\u001f\u007f]{1,64}$/;
 
@@ -208,6 +259,7 @@ export class NodeRuntime {
     for (const channel of this.state.channels) {
       if (!isObject(channel)) continue;
       channel.seen = Array.isArray(channel.seen) ? channel.seen.filter((value) => typeof value === "string" && HASH.test(value)) : [];
+      channel.seen_from = Array.isArray(channel.seen_from) ? channel.seen_from.filter((value) => typeof value === "string" && SEEN_FROM.test(value)) : [];
       channel.allow = Array.isArray(channel.allow) ? channel.allow : [];
       if (!Number.isInteger(channel.after)) channel.after = 0;
     }
@@ -452,7 +504,7 @@ export class NodeRuntime {
     const before = this.state.channels.map((channel) => (isObject(channel) ? [channel, channel.label, channel.muted] : null));
     const noted = this.attention.length;
     if (old) old.label = this.freeLabel(`inbox-${old.expire_at}`);
-    const inbox = { label: "inbox", read_key: thread.id, w: thread.w, expire_at: thread.expireAt, allow: wanted ?? [], after: 0, created_at: null, instance: null, gone: false, muted: false, seen: [] };
+    const inbox = { label: "inbox", read_key: thread.id, w: thread.w, expire_at: thread.expireAt, allow: wanted ?? [], after: 0, created_at: null, instance: null, gone: false, muted: false, seen: [], seen_from: [] };
     this.state.channels.push(inbox);
     const muted = this.muteGenerations(reason);
     try {
@@ -806,7 +858,7 @@ export class NodeRuntime {
     }
     const label = held?.label;
     if (held) held.label = this.freeLabel(`board-${held.expire_at}`);
-    const channel = { label: "board", read_key: thread.id, w: thread.w, expire_at: thread.expireAt, allow: ["*"], after: 0, created_at: null, instance: null, gone: false, muted: false, seen: [] };
+    const channel = { label: "board", read_key: thread.id, w: thread.w, expire_at: thread.expireAt, allow: ["*"], after: 0, created_at: null, instance: null, gone: false, muted: false, seen: [], seen_from: [] };
     this.state.channels.push(channel);
     try {
       await this.saveState();
@@ -967,10 +1019,12 @@ export class NodeRuntime {
       const [body, meta] = this.openMessage({ ...message, verified: checked.verified, from: sender });
       const known = this.nameForKey(sender);
       const digest = checked.sha256 ?? null;
+      const replay = replayState(channel, digest, sender);
       const entry = {
         channel: channel.label, w: channel.w, seq, at, verified: checked.verified, from_key: sender, known_contact: known !== null,
-        sender: known ?? (sender ? "unknown key" : "unsigned"), sha256: digest, replay: digest !== null && channel.seen.includes(digest), body, ...meta,
+        sender: known ?? (sender ? "unknown key" : "unsigned"), sha256: digest, replay: replay === true, body, ...meta,
       };
+      if (replay === null) entry.replay_unknown = true;
       if (checked.whyNot) entry.unverified_because = checked.whyNot;
       return entry;
     } catch (error) {
@@ -1033,7 +1087,7 @@ export class NodeRuntime {
    */
   async poll(channel, wait = 0, limit = null, maxBytes = null) {
     if (channel.muted) return [];
-    const before = { after: channel.after, created_at: channel.created_at, instance: channel.instance ?? null, expire_at: channel.expire_at, gone: channel.gone, seen: [...channel.seen], peers: { ...this.state.peers } };
+    const before = { after: channel.after, created_at: channel.created_at, instance: channel.instance ?? null, expire_at: channel.expire_at, gone: channel.gone, seen: [...channel.seen], seen_from: [...(channel.seen_from ?? [])], peers: { ...this.state.peers } };
     try {
       return await this.pollOnce(channel, wait, limit, true, maxBytes);
     } catch (error) {
@@ -1041,7 +1095,7 @@ export class NodeRuntime {
       // What this read changed is undone in memory too: the cursor, the hashes
       // and the bindings stay as the file has them, and the messages wait at
       // the service for the next read, which hands them over.
-      Object.assign(channel, { after: before.after, created_at: before.created_at, instance: before.instance, expire_at: before.expire_at, gone: before.gone, seen: before.seen });
+      Object.assign(channel, { after: before.after, created_at: before.created_at, instance: before.instance, expire_at: before.expire_at, gone: before.gone, seen: before.seen, seen_from: before.seen_from });
       this.state.peers = before.peers;
       this.note(channel.label, "not_saved", `what this read found here could not be written down (${error.cause?.code || error.cause?.message}), so nothing from this channel was handed over. It is still there for the next read, and nothing was skipped.`, channel.w);
       return [];
@@ -1144,7 +1198,7 @@ export class NodeRuntime {
     // is passed over by its hash, which is the hash of the text alone: another
     // sender's message with the same text has it too (the same review).
     if (!another && !data.reset && channel.after > 0 && typeof channel.instance !== "string" && instance !== null) {
-      this.note(channel.label, "reread", `this channel's cursor, ${channel.after}, was kept by a client that did not keep the thread's instance, so it cannot be told whether the thread here is the one that cursor was kept on. It is read again from the start this once: what this channel handed over before comes again, marked replay, and nothing is passed over.`, channel.w);
+      this.note(channel.label, "reread", `this channel's cursor, ${channel.after}, was kept by a client that did not keep the thread's instance, so it cannot be told whether the thread here is the one that cursor was kept on. It is read again from the start this once: what this channel handed over before comes again, marked replay, or replay_unknown where an earlier version kept it without who sent it, and nothing is passed over.`, channel.w);
       channel.after = 0;
       return this.pollOnce(channel, 0, limit, false, maxBytes);
     }
@@ -1182,6 +1236,11 @@ export class NodeRuntime {
     let used = 0;
     let stoppedAtBudget = false;
     let oversized = null;
+    // What this read says of the messages it takes is said once the read is
+    // written down. One that cannot be saved hands nothing over, and it said
+    // replay_unknown for rows it never handed over: count 0 and no messages,
+    // with a note on two of them (a review of 11 November 2026).
+    const said = [];
     for (const raw of data.messages) {
       if (limit !== null && entries.length >= limit) break;
       const entry = this.readEntry(channel, raw);
@@ -1221,39 +1280,46 @@ export class NodeRuntime {
         keptOut.push(entry.seq);
         continue;
       }
-      if (entry.sha256 !== null && !channel.seen.includes(entry.sha256)) channel.seen.push(entry.sha256);
+      if (entry.sha256 !== null) remember(channel, entry.sha256, entry.from_key);
       for (const planned of bindings) {
         if (planned.conflict === null) {
           this.state.peers[planned.address] = entry.from_key;
         } else {
-          this.note(channel.label, "binding_conflict", `message ${entry.seq} names ${planned.address} as ${planned.field}, signed by ${this.nameForKey(entry.from_key) ?? entry.from_key}, and that address is already bound to ${this.nameForKey(planned.conflict.bound_to) ?? planned.conflict.bound_to}. The binding is kept.`, channel.w);
+          said.push(["binding_conflict", `message ${entry.seq} names ${planned.address} as ${planned.field}, signed by ${this.nameForKey(entry.from_key) ?? entry.from_key}, and that address is already bound to ${this.nameForKey(planned.conflict.bound_to) ?? planned.conflict.bound_to}. The binding is kept.`]);
         }
       }
       entries.push(entry);
     }
+    // Messages whose bytes this channel handed over before, which an earlier
+    // version recorded without who sent them: whether each is a copy cannot be
+    // told, and it is said rather than guessed.
+    const unknown = entries.filter((entry) => entry.replay_unknown).map((entry) => entry.seq);
+    if (unknown.length) {
+      said.push(["replay_unknown", `message(s) ${unknown.join(", ")} carry the bytes of a message this channel handed over before, which an earlier version recorded without who sent it, so whether each is a copy cannot be told: each comes with replay false and replay_unknown true.`]);
+    }
     if (keptOut.length) {
       const openedFor = (channel.allow || []).includes("*") ? "any key, signed only" : `${channel.allow.length} named key(s)`;
-      this.note(channel.label, "kept_out", `${keptOut.length} message(s) (seq ${keptOut.join(", ")}): this channel was opened for ${openedFor}, and these did not satisfy that list as checked here. They are not handed over.`, channel.w);
+      said.push(["kept_out", `${keptOut.length} message(s) (seq ${keptOut.join(", ")}): this channel was opened for ${openedFor}, and these did not satisfy that list as checked here. They are not handed over.`]);
     }
     if (oversized) {
-      this.note(channel.label, "over_budget", `message ${oversized.seq} on this channel is ${oversized.weight} bytes as handed over here, larger than the whole byte budget of ${maxBytes} this read asked for. It had already come, so it is handed over on its own rather than kept back for ever, and this read is over its budget on purpose.`, channel.w);
+      said.push(["over_budget", `message ${oversized.seq} on this channel is ${oversized.weight} bytes as handed over here, larger than the whole byte budget of ${maxBytes} this read asked for. It had already come, so it is handed over on its own rather than kept back for ever, and this read is over its budget on purpose.`]);
     }
     // Rows the service sent that this read left because its own limit was
     // reached: a service that does not take X-Limit sends them all, and the read
     // that stopped on its own said nothing (a review of 10 November 2026).
     const leftHere = !stoppedAtBudget && limit !== null && entries.length >= limit && data.messages.length > entries.length + keptOut.length;
     if (stoppedAtBudget) {
-      this.note(channel.label, "more", `this read stopped at the byte budget it asked for, ${maxBytes} bytes of messages as they are handed over here, and left the rest at the service. Nothing was passed over: the cursor stands at the last message handed over, so read again for the rest.`, channel.w);
+      said.push(["more", `this read stopped at the byte budget it asked for, ${maxBytes} bytes of messages as they are handed over here, and left the rest at the service. Nothing was passed over: the cursor stands at the last message handed over, so read again for the rest.`]);
     } else if (leftHere || (data.more === true && !isObject(data.too_large))) {
       // The service says more both when the count this read asked for was
       // reached and when the byte budget was. A note that blamed a budget
       // nobody set would send the reader looking for the wrong cause.
       const atLimit = leftHere || (limit !== null && data.messages.length >= limit);
-      this.note(channel.label, "more", atLimit
+      said.push(["more", atLimit
         ? "this read handed over as many messages as its limit allows, and the service has more waiting on this channel. Nothing was passed over: the cursor stands at the last message handed over, so read again for the rest."
         : maxBytes !== null
           ? "the service had more waiting on this channel than the byte budget this read asked for, so it sent what fits and kept the rest. Read again for it: the cursor stands at the last message handed over."
-          : "the service says it has more waiting on this channel than it sent. Nothing was passed over: the cursor stands at the last message handed over, so read again for the rest.", channel.w);
+          : "the service says it has more waiting on this channel than it sent. Nothing was passed over: the cursor stands at the last message handed over, so read again for the rest."]);
     }
     // A read that stopped early moves the cursor to the last row it took and
     // no further: next would skip the rest of the page.
@@ -1263,6 +1329,7 @@ export class NodeRuntime {
     } else if (Number.isInteger(data.next)) channel.after = data.next;
     else if (lastSeq !== null) channel.after = Math.max(channel.after, lastSeq);
     await this.saveRead();
+    for (const [state, what] of said) this.note(channel.label, state, what, channel.w);
     return entries;
   }