8130cd9fc7
## Summary Editing attachment messages through `buzz messages edit` can remove their files from the effective message. Preserve the latest live imeta set across successive edits and add `--clear-attachments` for explicit removal. Add an SDK builder for complete replacement attachment sets while preserving the existing API. The relay provides a versioned effective-edit lookup on `/query` for kinds 9/40002/40008/45001/45003; media reads fold the same set. It uses the existing normalized-target index, fresh channel authorization, and a primary snapshot. Generic `#e` matching is unchanged. Mixed-case historical edits cannot restore removed files, including when another reference would allow republication. ### Related issue Fixes #3022. Follows #9077. Related open attempts: #3062 and #3065. ### Testing Published head: `c630c4ebf0b20a9618f4844629eec1e666699cbe`, through all mandatory push hooks. The governed-five snapshot passed all four PostgreSQL/HTTP acceptance tests with `RUST_MIN_STACK` unset and 3,333 affected-package tests. The committed test-only array correction passed clippy and the preflight rerun. Independent mutations detected dropped read/lookup kinds, the CLI two-kind split, and preflight ordering, channel and live-edit errors. The published follow-up adds forum preview retention/suppression and a deleted-original preflight fixture; both surviving mutations now fail as intended. Independent review verified the fixes. All four acceptance tests pass; the full DB/relay run had two NIP-FI failures that passed in isolation. The actual standalone MCP workflow passed against this relay and clean local app `5b583b8c69596353bc37e9f3938eca1aabcd081e`: 15 MCP edits, 10 direct publications and 60 member GET/HEAD checks across five isolated blob pairs. Both tested heads are now published. Relay hosted checks report 80 successful and 31 skipped, with none pending or failed; app hosted checks and human upload → edit → clear → edit → GET/HEAD confirmation remain pending. No human acceptance is claimed. ### Rollout The lookup, CLI preservation/clear and media reads use kinds 9/40002/40008/45001/45003. Deploy the relay before releasing the CLI and paired [MCP producer](https://github.com/block/buzz-app/pull/2937). New clients abort without publishing against an unsupported relay. Old CLI edits emit empty imeta and now revoke diff/forum attachments that previously remained readable. Other channel-tagged kinds retain the historical plain-edit path. No additional schema change is needed beyond migration 0086. Readiness remains blocked by mobile edits that omit imeta, the app UI fold that can restore older files, unaudited SDK/direct callers and unmeasured historical exposure. Run `docs/sql/private-media-edit-preflight.sql` for each community; producer updates do not repair signed historical edits. No enforce activation is authorized. `off` skips policy checks, `shadow` changes policy metrics while allowing policy failures, and `enforce` denies inaccessible references. Observe `buzz_media_publication_access_total{mode="shadow",reason="denied"}`. Prefer rolling back the client release while retaining the additive lookup. A relay rollback makes new CLI/MCP edits fail closed; already-published imeta remains valid under the older reference rules. Concurrent edits still use `(created_at,id)` without compare-and-swap. Generated with Codex --------- Signed-off-by: Brad Seiler <seiler@squareup.com> Co-authored-by: Honor <e0bf479eeebe47dde1e35705212a4df70616a7bc834d907ddfb18cf0405f8b1b@seiler-test.communities.public.builderlabstaging.xyz>
3.3 KiB
Effective message edits
For kinds 9/40002/40008/45001/45003, text edits replace a message's complete attachment set. To retain files, a
writer needs the latest live edit's imeta, or the original's when no edit exists.
A plain #e query is an exact tag match and can miss valid historical targets
whose hex casing differs. This extension leaves generic NIP-01 matching intact.
Other channel-tagged kinds keep the historical plain-edit behavior, without the
lookup or a relay-version dependency. The CLI rejects --clear-attachments for
those kinds because their attachments are not edit-governed.
Request and response
An authenticated POST /query accepts one exact filter:
[{"kinds":[9,40002,40008,45001,45003],"ids":["<original event id, lowercase hex>"],"#h":["<channel UUID>"],"effective_edit":1,"consistency":"strong"}]
The version-1 envelope is:
{"effective_edit":1,"original":{"id":"...","kind":9,"tags":[],"content":"...","pubkey":"...","created_at":0,"sig":"..."},"edit":null}
original and a non-null edit are complete signed Nostr events. edit is the
latest live kind 40003 in the same channel targeting the live original of kind
9, 40002, 40008, 45001 or 45003. Targets use the first valid 64-character hex e tag in signed order,
ignoring casing. The greatest (created_at,id) wins. Upload proof can still authorize
republication by the uploader after removal; correct state resolution prevents
accidental restoration even when publication would be authorized. An empty imeta set on that
edit is authoritative; it never falls back to original attachments.
Original liveness, fresh channel authorization, and edit selection share a repeatable-read transaction on the primary. Ordinary per-event visibility gates also apply. Missing and inaccessible targets both return the same 404. Lookup failure returns an error, never an empty state. The normalized-target index from migration 0086 bounds the latest-edit probe; unrelated channel edits are not read.
The CLI requires the versioned envelope, checks the returned target/channel, and aborts without signing or publishing when an older relay returns an ordinary array. Deploy the relay first, then release the CLI. Old clients retain their existing behavior against the new relay. No schema change is needed beyond 0086.
The CLI stamps its replacement after the observed state, including same-second
edits. A head more than 60 seconds ahead of its clock causes an error until the
clock catches up. Concurrent writers still use (created_at,id) ordering; the
lookup does not create a compare-and-swap precondition on publication.
The same five kinds govern the lookup, CLI attachment preservation and media read authorization. A superseded original no longer grants access; the latest live edit's full imeta set controls that reference. A file remains readable if another live readable reference or upload authority grants access. An empty replacement set does not fall back to the original.
The v1 request uses the exact five-kind filter above.
Deploy the relay before releasing the CLI or paired MCP producer. Edits of any
of these five kinds fail closed on community relays that lack the lookup. The
CLI and MCP both preserve the latest metadata, including an empty set; the CLI's
--clear-attachments covers all five kinds.