Kjell Tore Guttormsen
316b8acdd2
Nothing could remove a message from _broadcast/inbox/. coord-done is directed-only and never touches the broadcast queue, so the backlog could only grow: every new repo received the entire standing history at its first session, including announcements that had since become false. --retract <filename> archives the message into _broadcast/archive/, so no future repo is served it. Three deliberate limits, all pinned by tests: - Un-send, not recall. Repos that already received it keep it; _broadcast/seen/ is delivery history and is left untouched. - Only the sender may retract (from: must match the repo identity). --from overrides it, as everywhere else in the engine, which makes the check an accident guard rather than a security boundary. - Nothing is deleted, mirroring coord-done. Retracting twice is a no-op. The branch runs before every send-side validation and before the stdin body read, since a retract carries no subject and no body. Selftest 70 -> 82 (new section 19). Also fixes two README defects the feature exposed: the install command still named coord@ after the v0.3.0 rename, and the docs advised pruning _broadcast/inbox/ by hand, which contradicted the rule that the script owns mailbox files.
12 lines
192 B
JSON
12 lines
192 B
JSON
{
|
|
"name": "repo-mailbox",
|
|
"version": "0.4.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"engines": {
|
|
"node": ">=18"
|
|
},
|
|
"scripts": {
|
|
"test": "node --test tests/*.test.mjs"
|
|
}
|
|
}
|