@palbase/web 1.4.0 → 1.6.0

package/dist/next/index.cjs

@@ -2628,6 +2628,47 @@ var PalbeFlags = class {
   }
 };
 
+// src/messaging/deadline-calculator.ts
+function remainingSeconds(args) {
+  const ttl = args.ttlSeconds;
+  const wallDeltaSec = (args.nowWallEpochMs - args.anchor.wAnchorEpochMs) / 1e3;
+  let elapsed;
+  if (args.nowBootToken === args.anchor.bAnchorToken) {
+    const monoDeltaSec = Math.max(0, args.nowMonotonicMs - args.anchor.mAnchorMs) / 1e3;
+    elapsed = Math.max(monoDeltaSec, wallDeltaSec);
+  } else {
+    elapsed = wallDeltaSec;
+  }
+  const remaining = Math.min(ttl, ttl - elapsed);
+  return remaining <= 0 ? { kind: "purgeNow" } : { kind: "remaining", seconds: remaining };
+}
+var cachedBootToken = null;
+var MonotonicClock = {
+  nowMs() {
+    return typeof performance !== "undefined" ? performance.now() : Date.now();
+  },
+  nowWallEpochMs() {
+    return Date.now();
+  },
+  bootToken() {
+    if (cachedBootToken !== null) return cachedBootToken;
+    try {
+      const existing = typeof sessionStorage !== "undefined" ? sessionStorage.getItem("pb_boot_token") : null;
+      if (existing) {
+        cachedBootToken = existing;
+        return existing;
+      }
+      const fresh = crypto.randomUUID();
+      if (typeof sessionStorage !== "undefined") sessionStorage.setItem("pb_boot_token", fresh);
+      cachedBootToken = fresh;
+      return fresh;
+    } catch {
+      cachedBootToken = crypto.randomUUID();
+      return cachedBootToken;
+    }
+  }
+};
+
 // src/messaging/delete-fold.ts
 var DeleteFold = class {
   // targets with a confirmed valid tombstone — MONOTONIC (never removed within retention).
@@ -2640,17 +2681,24 @@ var DeleteFold = class {
   // keyed by eventClientMsgId so a re-delivered unverifiable event is held exactly once.
   held = [];
   /**
-   * Ingest one tombstone. `authorOfTarget` resolves the target message's AUTHOR
-   * userId (null = target absent locally → defer).
+   * Ingest one tombstone. `authorOfTarget` resolves the target message's author via
+   * {@link AuthorResolution}: `'author'` → run the author-gate; `'unknown'` → defer
+   * (target absent locally → pending/held); `'purged'` → NO-OP, mark seen (the target
+   * was TTL-purged — a delete of an already-gone message is already satisfied; never
+   * park in pending, never re-attempt).
    */
   ingest(e, authorOfTarget) {
     if (this.tombstoned.has(e.targetClientMsgId)) return;
     if (this.seen.has(e.eventClientMsgId)) return;
     if (this.heldContains(e.eventClientMsgId)) return;
-    const author = authorOfTarget(e.targetClientMsgId);
-    if (author !== null) {
+    const res = authorOfTarget(e.targetClientMsgId);
+    if (res.kind === "purged") {
       this.seen.add(e.eventClientMsgId);
-      if (e.actorUserId === null || e.actorUserId !== author) return;
+      return;
+    }
+    if (res.kind === "author") {
+      this.seen.add(e.eventClientMsgId);
+      if (e.actorUserId === null || e.actorUserId !== res.userId) return;
       this.tombstoned.add(e.targetClientMsgId);
     } else if (e.actorUserId !== null) {
       this.seen.add(e.eventClientMsgId);
@@ -2670,12 +2718,13 @@ var DeleteFold = class {
    * the in-order path.
    */
   reevaluatePending(target, author) {
+    const res = author;
     const actor = this.pending.get(target);
     if (actor !== void 0) {
-      if (author !== null && actor === author) {
-        this.tombstoned.add(target);
+      if (res.kind === "author") {
+        if (actor === res.userId) this.tombstoned.add(target);
         this.pending.delete(target);
-      } else if (author !== null) {
+      } else if (res.kind === "purged") {
         this.pending.delete(target);
       }
     }
@@ -2683,7 +2732,7 @@ var DeleteFold = class {
     const pendingHeld = this.held;
     this.held = [];
     for (const e of pendingHeld) {
-      this.ingest(e, (t) => t === target ? author : null);
+      this.ingest(e, (t) => t === target ? res : { kind: "unknown" });
     }
   }
   heldContains(eventClientMsgId) {
@@ -2709,15 +2758,23 @@ var EditFold = class {
   // targets that have had ≥1 valid edit applied (write-once)
   editedTargets = /* @__PURE__ */ new Set();
   /**
-   * Ingest one edit. `authorOfTarget` resolves the target message's AUTHOR userId
-   * (null = target unknown/dangling → HOLD).
+   * Ingest one edit. `authorOfTarget` resolves the target message's author via
+   * {@link AuthorResolution}: `'author'` → run the author-gate; `'unknown'` → HOLD
+   * (target/author not yet known); `'purged'` → DROP (the target was TTL-purged —
+   * editing a disappeared message is a no-op; mark the event seen so it never re-holds
+   * and a later author "resolution" cannot resurrect it).
    */
   ingest(e, authorOfTarget) {
-    const author = authorOfTarget(e.targetClientMsgId);
-    if (author === null) {
+    const res = authorOfTarget(e.targetClientMsgId);
+    if (res.kind === "unknown") {
       this.holdIfNew(e);
       return;
     }
+    if (res.kind === "purged") {
+      this.seenEvents.add(e.eventClientMsgId);
+      return;
+    }
+    const author = res.userId;
     if (e.editorUserId === null) {
       this.holdIfNew(e);
       return;
@@ -2736,7 +2793,8 @@ var EditFold = class {
       orderEpoch: e.epoch,
       orderSeq: e.serverSeq,
       lastEventId: e.eventClientMsgId,
-      text: e.newText
+      text: e.newText,
+      bodyRanges: e.bodyRanges ?? null
     });
     this.editedTargets.add(e.targetClientMsgId);
   }
@@ -2757,6 +2815,15 @@ var EditFold = class {
   isEdited(targetClientMsgId) {
     return this.editedTargets.has(targetClientMsgId);
   }
+  /**
+   * The WINNING edit's replacement mention ranges for a target (raw, un-normalized),
+   * or null when no valid edit applied or the winning edit carried none. The Chat
+   * normalizes these against the edited text to compute the edited message's mentions
+   * (mentions T6). LWW-consistent: always the same edit that `text(...)` returns.
+   */
+  bodyRanges(targetClientMsgId) {
+    return this.states.get(targetClientMsgId)?.bodyRanges ?? null;
+  }
   /**
    * Re-run HELD edits when the roster/target newly resolves (call on member/roster
    * change and when a target message arrives). Clears `held` and re-ingests each
@@ -2930,7 +2997,14 @@ function encodeEdit(args) {
       type: "edit",
       client_msg_id: args.clientMsgId,
       target_client_msg_id: args.targetClientMsgId,
-      new_text: args.newText
+      new_text: args.newText,
+      ...args.bodyRanges && args.bodyRanges.length > 0 ? {
+        body_ranges: args.bodyRanges.map((r) => ({
+          start: r.start,
+          length: r.length,
+          mentioned_user_id: r.mentionedUserId
+        }))
+      } : {}
     })
   );
 }
@@ -2952,14 +3026,53 @@ function encodeEnvelope(args) {
     type: "text",
     client_msg_id: args.clientMsgId,
     text: args.text,
-    ...args.replyTo ? { reply_to: args.replyTo } : {}
+    ...args.replyTo ? { reply_to: args.replyTo } : {},
+    ...args.bodyRanges && args.bodyRanges.length > 0 ? {
+      body_ranges: args.bodyRanges.map((r) => ({
+        start: r.start,
+        length: r.length,
+        mentioned_user_id: r.mentionedUserId
+      }))
+    } : {},
+    ...args.expiry ? {
+      expiry: {
+        v: args.expiry.v,
+        ttl_seconds: args.expiry.ttlSeconds,
+        start: args.expiry.start,
+        // present IFF send (drop a stray senderSendTs on a read anchor)
+        ...args.expiry.start === "send" && args.expiry.senderSendTs != null ? { sender_send_ts: args.expiry.senderSendTs } : {}
+      }
+    } : {}
   };
   return encodeUtf8(JSON.stringify(env));
 }
+function encodeTimerSet(args) {
+  return encodeUtf8(
+    JSON.stringify({
+      v: 1,
+      type: "timer_set",
+      client_msg_id: args.clientMsgId,
+      ...args.ttlSeconds != null ? { ttl_seconds: args.ttlSeconds } : {},
+      start: args.start
+    })
+  );
+}
 function decodeEnvelope(bytes) {
   const s = decodeUtf8(bytes);
   try {
     const o = JSON.parse(s);
+    if (typeof o === "object" && o !== null && o.type === "timer_set") {
+      return {
+        type: "timer_set",
+        text: null,
+        clientMsgId: o.client_msg_id ?? "",
+        replyTo: null,
+        timer: {
+          ttlSeconds: typeof o.ttl_seconds === "number" ? o.ttl_seconds : null,
+          start: o.start === "read" ? "read" : "send"
+        }
+      };
+    }
     if (typeof o === "object" && o !== null && o.type === "delete") {
       return {
         type: "delete",
@@ -2986,6 +3099,7 @@ function decodeEnvelope(bytes) {
       };
     }
     if (typeof o === "object" && o !== null && o.type === "edit") {
+      const editRanges = decodeBodyRanges(o.body_ranges);
       return {
         type: "edit",
         text: null,
@@ -2994,15 +3108,20 @@ function decodeEnvelope(bytes) {
         edit: {
           targetClientMsgId: o.target_client_msg_id ?? "",
           newText: o.new_text ?? ""
-        }
+        },
+        ...editRanges ? { bodyRanges: editRanges } : {}
       };
     }
     if (typeof o === "object" && o !== null && o.type === "text" && typeof o.v === "number") {
+      const textRanges = decodeBodyRanges(o.body_ranges);
+      const expiry = decodeExpiry(o.expiry);
       return {
         type: "text",
         text: o.text ?? null,
         clientMsgId: o.client_msg_id ?? "",
-        replyTo: o.reply_to ?? null
+        replyTo: o.reply_to ?? null,
+        ...textRanges ? { bodyRanges: textRanges } : {},
+        ...expiry ? { expiry } : {}
       };
     }
     if (typeof o === "object" && o !== null && o.type === "text") {
@@ -3014,6 +3133,27 @@ function decodeEnvelope(bytes) {
   }
   return { text: s, clientMsgId: "", replyTo: null };
 }
+function decodeExpiry(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const o = raw;
+  if (typeof o.ttl_seconds !== "number") return void 0;
+  const start = o.start === "read" ? "read" : "send";
+  return {
+    v: typeof o.v === "number" ? o.v : 1,
+    ttlSeconds: o.ttl_seconds,
+    start,
+    // tolerant: only honor sender_send_ts on a send anchor; null otherwise.
+    senderSendTs: start === "send" && typeof o.sender_send_ts === "number" ? o.sender_send_ts : null
+  };
+}
+function decodeBodyRanges(raw) {
+  if (!raw || raw.length === 0) return void 0;
+  return raw.map((r) => ({
+    start: r.start,
+    length: r.length,
+    mentionedUserId: r.mentioned_user_id
+  }));
+}
 function resolveReply(ref, lookup) {
   const parent = lookup(ref.client_msg_id);
   if (parent !== null) {
@@ -3225,9 +3365,9 @@ var GroupMessaging = class {
   /** Send a text message. Encrypt at the current epoch, POST, return the receipt +
    * the client-minted `clientMsgId` (needed by the Chat layer for reply indexing).
    * NEVER rebases (a 422 stale_application surfaces to the caller). */
-  async sendText(group, text, replyTo) {
+  async sendText(group, text, replyTo, bodyRanges, expiry) {
     const clientMsgId = mintClientMsgId();
-    const plaintext = encodeEnvelope({ text, clientMsgId, replyTo });
+    const plaintext = encodeEnvelope({ text, clientMsgId, replyTo, bodyRanges, expiry });
     const ct = await this.engine.encryptApplication(fromBase64(group.rfcGroupId), plaintext);
     const body = {
       ciphertext_b64: toBase64(ct),
@@ -3253,7 +3393,13 @@ var GroupMessaging = class {
         previewBody: replyTo.preview?.body ?? null,
         previewAuthorUserId: replyTo.preview?.author_user_id ?? null,
         previewKind: replyTo.preview?.kind ?? "text"
-      } : null
+      } : null,
+      // Persist the OUTGOING bubble's mention ranges so an own-sent mention re-resolves
+      // onto its bubble after a reload (own-send reload parity — the T4-reviewer Minor).
+      ...bodyRanges && bodyRanges.length > 0 ? { bodyRanges } : {},
+      // Disappearing T10: persist the per-message TTL so the own-send re-arms its purge
+      // after a cold launch (the projection derives the deadline from this row's expiry).
+      ...expiry ? { expiry } : {}
     };
     try {
       await this.messageStore.append(group.rfcGroupId, stored);
@@ -3261,6 +3407,51 @@ var GroupMessaging = class {
     }
     return { receipt: { serverSeq: wire.server_seq, epoch: wire.epoch }, clientMsgId };
   }
+  /** Send a per-chat default disappearing-timer control envelope (`timer_set`). Encrypts
+   * a `type:'timer_set'` envelope at the current epoch and sends through the SAME MLS
+   * application path as `sendText` (the server stays blind — it's an opaque app message,
+   * NEVER a bubble). `ttlSeconds === null` disables the default (omitted from the wire).
+   * Persists the outgoing `timer_set` row so the chat default re-folds on cold launch
+   * (the page-local TimerFold in projectHistory). NEVER rebases (epoch-bound). */
+  async sendTimerSet(group, args) {
+    const plaintext = encodeTimerSet({
+      clientMsgId: args.clientMsgId,
+      ttlSeconds: args.ttlSeconds,
+      start: args.start
+    });
+    const ct = await this.engine.encryptApplication(fromBase64(group.rfcGroupId), plaintext);
+    const body = {
+      ciphertext_b64: toBase64(ct),
+      client_idem_key: randomId()
+    };
+    const wire = await palbeRequest(
+      this.rt,
+      "POST",
+      MessagingPaths.groupMessages(group.displayId),
+      { body }
+    );
+    const stored = {
+      id: `${group.rfcGroupId}#${wire.server_seq}`,
+      direction: "outgoing",
+      text: null,
+      senderDeviceId: this.selfDeviceId,
+      epoch: wire.epoch,
+      serverSeq: wire.server_seq,
+      at: Date.now(),
+      clientMsgId: args.clientMsgId,
+      replyTo: null,
+      envelopeType: "timer_set",
+      timer: { ttlSeconds: args.ttlSeconds, start: args.start }
+    };
+    try {
+      await this.messageStore.append(group.rfcGroupId, stored);
+    } catch {
+    }
+    return {
+      receipt: { serverSeq: wire.server_seq, epoch: wire.epoch },
+      clientMsgId: args.clientMsgId
+    };
+  }
   /** Send a reaction (add/remove of an emoji on a target message). Encrypts a
    * `type:'reaction'` envelope at the current epoch and sends through the SAME
    * MLS application path as `sendText` (the server stays blind — a reaction is
@@ -3321,7 +3512,8 @@ var GroupMessaging = class {
     const plaintext = encodeEdit({
       clientMsgId: args.clientMsgId,
       targetClientMsgId: args.targetClientMsgId,
-      newText: args.newText
+      newText: args.newText,
+      bodyRanges: args.bodyRanges
     });
     const ct = await this.engine.encryptApplication(fromBase64(group.rfcGroupId), plaintext);
     const body = {
@@ -3347,7 +3539,10 @@ var GroupMessaging = class {
       envelopeType: "edit",
       edit: {
         targetClientMsgId: args.targetClientMsgId,
-        newText: args.newText
+        newText: args.newText,
+        // Persist the edit's REPLACEMENT ranges so the edited message's mentions
+        // re-resolve from this edit after a reload (own-send reload parity — T6).
+        ...args.bodyRanges && args.bodyRanges.length > 0 ? { bodyRanges: args.bodyRanges } : {}
       }
     };
     try {
@@ -3469,6 +3664,41 @@ var GroupMessaging = class {
   }
 };
 
+// src/messaging/mention-ranges.ts
+function normalizeMentionRangesUtf16(ranges, text) {
+  const n = text.length;
+  function splitsSurrogatePair(index) {
+    if (index <= 0 || index >= n) return false;
+    const before = text.charCodeAt(index - 1);
+    const at = text.charCodeAt(index);
+    const beforeIsHigh = before >= 55296 && before <= 56319;
+    const atIsLow = at >= 56320 && at <= 57343;
+    return beforeIsHigh && atIsLow;
+  }
+  const survivors = [];
+  for (let idx = 0; idx < ranges.length; idx++) {
+    const r = ranges[idx];
+    if (r === void 0) continue;
+    if (r.start < 0 || r.length <= 0 || r.start + r.length > n) continue;
+    if (splitsSurrogatePair(r.start) || splitsSurrogatePair(r.start + r.length)) continue;
+    survivors.push({ idx, range: r });
+  }
+  survivors.sort((lhs, rhs) => {
+    if (lhs.range.start !== rhs.range.start) return lhs.range.start - rhs.range.start;
+    if (lhs.range.length !== rhs.range.length) return rhs.range.length - lhs.range.length;
+    return lhs.idx - rhs.idx;
+  });
+  const kept = [];
+  let prevEnd = Number.NEGATIVE_INFINITY;
+  for (const s of survivors) {
+    if (s.range.start >= prevEnd) {
+      kept.push(s.range);
+      prevEnd = s.range.start + s.range.length;
+    }
+  }
+  return kept;
+}
+
 // src/messaging/reaction-fold.ts
 function orderLte(aEpoch, aSeq, bEpoch, bSeq) {
   if (aEpoch !== bEpoch) return aEpoch < bEpoch;
@@ -3524,6 +3754,43 @@ var ReactionFold = class {
   }
 };
 
+// src/messaging/timer-fold.ts
+function orderLte2(aEpoch, aSeq, bEpoch, bSeq) {
+  if (aEpoch !== bEpoch) return aEpoch < bEpoch;
+  return aSeq <= bSeq;
+}
+var TimerFold = class {
+  cell = null;
+  seenEvents = /* @__PURE__ */ new Set();
+  ingest(e) {
+    if (this.seenEvents.has(e.eventClientMsgId)) return;
+    this.seenEvents.add(e.eventClientMsgId);
+    if (this.cell !== null && orderLte2(e.epoch, e.serverSeq, this.cell.orderEpoch, this.cell.orderSeq)) {
+      return;
+    }
+    this.cell = {
+      orderEpoch: e.epoch,
+      orderSeq: e.serverSeq,
+      ttlSeconds: e.ttlSeconds,
+      start: e.start,
+      actor: e.actorUserId
+    };
+  }
+  /**
+   * The active chat default, or null if no timer_set has applied.
+   * `ttlSeconds === null` means DISABLED (still applied — distinct from "never
+   * set"). `start` is meaningful only when ttlSeconds !== null.
+   */
+  active() {
+    if (this.cell === null) return null;
+    return { ttlSeconds: this.cell.ttlSeconds, start: this.cell.start };
+  }
+  /** The userId behind the winning timer_set (for the optional system line). null if unset. */
+  lastActor() {
+    return this.cell?.actor ?? null;
+  }
+};
+
 // src/messaging/chat.ts
 var DELETED_DESCRIPTOR = "\u{1F6AB} This message was deleted";
 var Chat = class {
@@ -3550,12 +3817,35 @@ var Chat = class {
   /** The single authoritative delete-for-everyone fold (live + own-send + history).
    * A tombstone scrubs its target in place (delete DOMINATES edit at render). */
   deleteFold = new DeleteFold();
+  /** The per-chat default disappearing-timer fold — the latest valid `timer_set` (LWW
+   * on (epoch, serverSeq), author = the resolved MLS sender). A `timer_set` is NEVER a
+   * bubble; it routes here. The active default governs a subsequent bubble that carries
+   * no per-message expiry (disappearing T10). */
+  timerFold = new TimerFold();
+  /** Advisory in-memory purge timers, keyed by serverSeq. The DURABLE truth is the
+   * persisted anchor + a re-check on every load; this just drives live eviction while
+   * the tab is open. Cancelled when the message purges (disappearing T10). */
+  purgeTimers = /* @__PURE__ */ new Map();
+  /** In-memory mirror of the durable `purgedClientMsgIds` set (the STRING namespace),
+   * hydrated from `backend.purgedClientMsgIds` and grown by each live purge. Consulted
+   * by `authorOfTarget` so a late edit/delete targeting a TTL-purged message resolves to
+   * `'purged'` (DROP / no-op — never resurrects). Namespace-separate from the int seq
+   * tombstone (disappearing T10). */
+  purgedCids = /* @__PURE__ */ new Set();
+  purgedLoaded = false;
   /** delete-for-me suppression keys (clientMsgId, or `seq:<serverSeq>` for legacy)
    * — the message is OMITTED from this view. Local + persisted per chat, NO wire. */
   suppressed = /* @__PURE__ */ new Set();
   /** True once the persisted suppression set has been loaded (so the omit applies
    * even on the cold-launch hydrate path before a fresh deleteForMe). */
   suppressedLoaded = false;
+  /** Self-elevation dedup keys (`<selfUserId>|<clientMsgId or seq:n>`). Once a
+   * mention of me from another sender fires `onMentionElevation`, its key lands here
+   * + is persisted, so a re-delivery / cold-launch re-hydrate never re-fires. */
+  elevated = /* @__PURE__ */ new Set();
+  /** True once the persisted elevation set has been loaded (so a re-delivered mention
+   * on the cold-launch hydrate path dedups against the persisted decision). */
+  elevatedLoaded = false;
   /** Per-target BASE (original) text, so the rendered text is `edit ?? original`.
    * Seeded once per target (write-once base) so a 2nd own edit can't corrupt it. */
   originalTextByClientMsgId = /* @__PURE__ */ new Map();
@@ -3567,6 +3857,14 @@ var Chat = class {
   wired = false;
   liveUnsub = null;
   listeners = /* @__PURE__ */ new Set();
+  /**
+   * Fires ONCE per `(selfUserId, clientMsgId)` when an INCOMING message mentions THIS
+   * user from ANOTHER sender (not an edit). The dedup survives re-delivery + reload
+   * via the persisted elevation set, so this never double-fires for one mention. The
+   * app wires it to a buzz/badge (e.g. an in-app banner). Best-effort cooperative —
+   * the SDK guarantees the DECISION, not the buzz. Mirrors iOS `Chat.onMentionElevation`.
+   */
+  onMentionElevation;
   /** @internal — obtain via pb.messaging.directChat / groupChat / chat(id). */
   constructor(args) {
     this.backend = args.backend;
@@ -3644,7 +3942,10 @@ var Chat = class {
           reactions: {},
           replyTo: null,
           edited: false,
-          isDeleted: true
+          isDeleted: true,
+          mentions: [],
+          // delete DOMINATES disappearing too — a tombstoned message carries no deadline.
+          expiresAt: null
         });
         continue;
       }
@@ -3680,9 +3981,22 @@ var Chat = class {
     this.wired = true;
     this.liveUnsub = this.backend.subscribeLive(this._group, this);
     void this.loadSuppressed();
-    void this.hydrateHistory();
+    void this.loadElevated();
+    void this.loadPurged().then(() => this.hydrateHistory());
     void this.refreshMembers();
   }
+  /** Hydrate the durable `purgedClientMsgIds` set (once) into the in-memory mirror so the
+   * live Edit/Delete fold author-gate sees TTL-purged targets as 'purged' on cold launch
+   * (disappearing T10). No re-emit: it only gates the orphan-fold resolution. */
+  async loadPurged() {
+    if (this.purgedLoaded || !this._group) return;
+    this.purgedLoaded = true;
+    try {
+      const ids = await this.backend.purgedClientMsgIds(this._group);
+      for (const id of ids) this.purgedCids.add(id);
+    } catch {
+    }
+  }
   /** Hydrate the persisted delete-for-me suppression keys (once), then re-emit so
    * any already-surfaced suppressed message is omitted (cold-launch parity). */
   async loadSuppressed() {
@@ -3701,6 +4015,17 @@ var Chat = class {
     } catch {
     }
   }
+  /** Hydrate the persisted self-elevation dedup keys (once). No re-emit: the set only
+   * gates the elevation DECISION, it does not change what renders. */
+  async loadElevated() {
+    if (this.elevatedLoaded || !this._group) return;
+    this.elevatedLoaded = true;
+    try {
+      const keys = await this.backend.loadElevated(this._group);
+      for (const k of keys) this.elevated.add(k);
+    } catch {
+    }
+  }
   async hydrateHistory() {
     if (this.historyLoaded || !this._group) return;
     this.historyLoaded = true;
@@ -3728,11 +4053,16 @@ var Chat = class {
       if (this.seenKeys.has(key)) continue;
       this.seenKeys.add(key);
       if (m.clientMsgId && !m.isDeleted) {
-        this.deleteFold.reevaluatePending(m.clientMsgId, m.senderUserId);
+        this.deleteFold.reevaluatePending(m.clientMsgId, this.authorOfTarget(m.clientMsgId));
       }
-      this.messageList.push(this.applyEditOverlay(this.applyReactionTally(m)));
+      this.messageList.push(
+        this.applyEditOverlay(this.applyReactionTally(this.resolveMentionNames(m)))
+      );
       changed = true;
       this.loadedEarliestSeq = Math.min(this.loadedEarliestSeq ?? m.serverSeq, m.serverSeq);
+      if (m.expiresAt && m.clientMsgId && !m.isDeleted) {
+        void this.armFromDeadline(m.expiresAt, m.serverSeq, m.clientMsgId);
+      }
     }
     if (changed) {
       this.messageList.sort((a, b) => a.serverSeq - b.serverSeq);
@@ -3747,6 +4077,7 @@ var Chat = class {
       return;
     }
     if (incoming.serverSeq <= 0) return;
+    if ((await this.backend.tombstonedSeqs(this._group)).has(incoming.serverSeq)) return;
     const key = this.internalKey(incoming.serverSeq);
     if (this.seenKeys.has(key)) return;
     this.seenKeys.add(key);
@@ -3755,6 +4086,20 @@ var Chat = class {
       senderUser = await this.backend.userIdForDevice(this._group, incoming.senderDeviceId);
     }
     const direction = senderUser !== null && senderUser === this.backend.selfUserId ? "outgoing" : "incoming";
+    if (incoming.envelopeType === "timer_set" && incoming.timer) {
+      const actorUserId = direction === "outgoing" ? this.backend.selfUserId : senderUser;
+      if (actorUserId !== null) {
+        this.timerFold.ingest({
+          ttlSeconds: incoming.timer.ttlSeconds,
+          start: incoming.timer.start,
+          actorUserId,
+          epoch: incoming.epoch,
+          serverSeq: incoming.serverSeq,
+          eventClientMsgId: incoming.clientMsgId
+        });
+      }
+      return;
+    }
     if (incoming.envelopeType === "reaction" && incoming.reaction) {
       const actorUserId = direction === "outgoing" ? this.backend.selfUserId : senderUser;
       if (actorUserId !== null) {
@@ -3780,7 +4125,10 @@ var Chat = class {
           newText: incoming.edit.newText,
           epoch: incoming.epoch,
           serverSeq: incoming.serverSeq,
-          eventClientMsgId: incoming.clientMsgId
+          eventClientMsgId: incoming.clientMsgId,
+          // Mentions T6: carry the edit's REPLACEMENT ranges so the edited message's
+          // mentions reflect them (recomputed against the new text on recomputeEdit).
+          bodyRanges: incoming.bodyRanges
         },
         this.authorOfTarget
       );
@@ -3808,6 +4156,7 @@ var Chat = class {
     if (incomingReplyRef) {
       resolvedReplyTo = resolveReply(incomingReplyRef, (id) => this.byClientMsgId.get(id) ?? null);
     }
+    const mentions = this.resolveMentions(incoming.text, incoming.bodyRanges);
     const msg = {
       id: this.publicId(incoming.serverSeq),
       kind: this.kindOf(incoming),
@@ -3824,8 +4173,13 @@ var Chat = class {
       // Default false; applyEditOverlay below folds any edit that arrived first.
       edited: false,
       // Default false; surfaced() applies the tombstone scrub if a delete folded.
-      isDeleted: false
+      isDeleted: false,
+      mentions,
+      // Disappearing T10: the LOCAL deadline (own per-message expiry ELSE the chat default
+      // active AS OF arrival). null when this message is non-disappearing.
+      expiresAt: this.deadlineFor(this.toExpirySpec(incoming.expiry) ?? this.defaultExpiry())
     };
+    this.elevateIfMentioned(msg, mentions, senderUser, incoming.envelopeType);
     if (incomingClientMsgId && incoming.text !== null) {
       this.byClientMsgId.set(incomingClientMsgId, {
         text: incoming.text,
@@ -3835,7 +4189,10 @@ var Chat = class {
     if (incomingClientMsgId) {
       this.seedEditBase(incomingClientMsgId, incoming.text, senderUser);
       this.editFold.reevaluateHeld(this.authorOfTarget);
-      this.deleteFold.reevaluatePending(incomingClientMsgId, senderUser);
+      this.deleteFold.reevaluatePending(
+        incomingClientMsgId,
+        this.authorOfTarget(incomingClientMsgId)
+      );
     }
     this.messageList.push(this.applyEditOverlay(msg));
     this.messageList.sort((a, b) => a.serverSeq - b.serverSeq);
@@ -3844,11 +4201,200 @@ var Chat = class {
       incoming.serverSeq
     );
     this.emit();
+    void this.armPurge(
+      this.toExpirySpec(incoming.expiry) ?? this.defaultExpiry(),
+      incoming.serverSeq,
+      incomingClientMsgId
+    );
+  }
+  // ── Disappearing (TTL — T10) ──
+  /** Normalize a decoded `IncomingMessage.expiry` / `StoredMessage.expiry` into the
+   * `ExpirySpec` the arm path consumes (or null when absent). */
+  toExpirySpec(e) {
+    return e ? { v: e.v, ttlSeconds: e.ttlSeconds, start: e.start, senderSendTs: e.senderSendTs } : null;
+  }
+  /** The chat-default expiry derived from the active `timer_set` fold, as an `ExpirySpec`
+   * so a bubble with no per-message expiry inherits it. null when no default is active or
+   * the default was explicitly DISABLED (`ttlSeconds === null`). `senderSendTs` is null —
+   * the default has no per-message sender clock; the arrival anchor drives the deadline
+   * (mirrors iOS `defaultExpiry()`). */
+  defaultExpiry() {
+    const active = this.timerFold.active();
+    if (!active || active.ttlSeconds === null) return null;
+    return { v: 1, ttlSeconds: active.ttlSeconds, start: active.start, senderSendTs: null };
+  }
+  /** The surfaced display deadline for an effective expiry (a local, monotonic-derived
+   * value — the wall-clock projection of the TTL from now). null for a non-disappearing
+   * message. The durable purge is driven by `armPurge`'s write-once anchor; this is the
+   * UI countdown baseline. */
+  deadlineFor(expiry) {
+    if (!expiry) return null;
+    return new Date(Date.now() + expiry.ttlSeconds * 1e3);
+  }
+  /** Arm a message's TTL purge on first decrypt-and-display. Captures the WRITE-ONCE
+   * monotonic/wall/boot anchor (so the deadline survives a reload — a re-arm after relaunch
+   * reads back the ORIGINAL capture, never a fresh one → the deadline never resets),
+   * computes the remaining time via `remainingSeconds`, applies the send-anchor clamp
+   * `min(sender_send_ts+ttl, first_arrival+ttl)` (read-anchor uses the write-once first-read
+   * capture), then either purges immediately or schedules an advisory `setTimeout`. A null
+   * expiry / empty clientMsgId is a no-op. Mirrors iOS `armPurge`. */
+  async armPurge(expiry, serverSeq, clientMsgId) {
+    if (!expiry || !clientMsgId || !this._group) return;
+    const group = this._group;
+    const fresh = {
+      mAnchorMs: MonotonicClock.nowMs(),
+      wAnchorEpochMs: MonotonicClock.nowWallEpochMs(),
+      bAnchorToken: MonotonicClock.bootToken()
+    };
+    await this.backend.writeAnchorOnce(group, clientMsgId, fresh);
+    const effective = await this.backend.anchor(group, clientMsgId) ?? fresh;
+    const result = remainingSeconds({
+      ttlSeconds: expiry.ttlSeconds,
+      anchor: effective,
+      nowMonotonicMs: MonotonicClock.nowMs(),
+      nowWallEpochMs: MonotonicClock.nowWallEpochMs(),
+      nowBootToken: MonotonicClock.bootToken()
+    });
+    let purgeInSeconds;
+    if (result.kind === "purgeNow") {
+      purgeInSeconds = 0;
+    } else if (expiry.start === "send" && expiry.senderSendTs !== null) {
+      const sendRemaining = expiry.senderSendTs + expiry.ttlSeconds - MonotonicClock.nowWallEpochMs() / 1e3;
+      purgeInSeconds = sendRemaining <= 0 ? 0 : Math.min(result.seconds, sendRemaining);
+    } else {
+      purgeInSeconds = result.seconds;
+    }
+    const prior = this.purgeTimers.get(serverSeq);
+    if (prior) clearTimeout(prior);
+    this.purgeTimers.delete(serverSeq);
+    if (purgeInSeconds <= 0) {
+      await this.purge(serverSeq, clientMsgId);
+      return;
+    }
+    const handle = setTimeout(() => {
+      void this.purge(serverSeq, clientMsgId);
+    }, purgeInSeconds * 1e3);
+    this.purgeTimers.set(serverSeq, handle);
+  }
+  /** Re-arm a purge from a derived deadline (cold-launch hydrate path). The deadline is
+   * the projection's monotonic-derived `expiresAt`; schedule an advisory timer for the
+   * remaining time (purge immediately if the deadline has already passed). The durable
+   * tombstone is written by `purge` when it fires (the crash-safe commit point). */
+  async armFromDeadline(deadline, serverSeq, clientMsgId) {
+    if (!this._group) return;
+    const remainingMs = deadline.getTime() - Date.now();
+    const prior = this.purgeTimers.get(serverSeq);
+    if (prior) clearTimeout(prior);
+    this.purgeTimers.delete(serverSeq);
+    if (remainingMs <= 0) {
+      await this.purge(serverSeq, clientMsgId);
+      return;
+    }
+    const handle = setTimeout(() => {
+      void this.purge(serverSeq, clientMsgId);
+    }, remainingMs);
+    this.purgeTimers.set(serverSeq, handle);
+  }
+  /** Purge message M (TTL eviction). TOMBSTONE-FIRST (the crash-safe commit point):
+   * persist the `server_seq` tombstone + the `client_msg_id` purge id in ONE durable
+   * record, THEN drop M's body from `messageList` + `emit()`, then re-evaluate any HELD
+   * edit / PARKED delete targeting the now-purged cid so an orphan annotation DROPs/no-ops
+   * (the resolver now returns `'purged'`). Idempotent. Mirrors iOS `purge`. */
+  async purge(serverSeq, clientMsgId) {
+    if (!this._group) return;
+    const prior = this.purgeTimers.get(serverSeq);
+    if (prior) clearTimeout(prior);
+    this.purgeTimers.delete(serverSeq);
+    await this.backend.tombstone(this._group, serverSeq, clientMsgId);
+    if (clientMsgId) this.purgedCids.add(clientMsgId);
+    this.messageList = this.messageList.filter((m) => m.serverSeq !== serverSeq);
+    this.seenKeys.delete(this.internalKey(serverSeq));
+    this.emit();
+    this.editFold.reevaluateHeld(this.authorOfTarget);
+    if (clientMsgId) {
+      this.deleteFold.reevaluatePending(clientMsgId, this.authorOfTarget(clientMsgId));
+    }
+  }
+  /** The Edit/Delete fold author-gate input via {@link AuthorResolution} (disappearing
+   * T10 — the orphan-aware resolver): `'purged'` when the target's clientMsgId is in the
+   * durable purge set (a late edit DROPs / a late delete no-ops — never resurrects a
+   * disappeared message); `'author'` when its author is locally known → run the
+   * author-gate; `'unknown'` otherwise → HOLD. The live twin of `projectHistory`'s
+   * resolver. Captured as a bound arrow so it can be passed to the pure folds. */
+  authorOfTarget = (targetClientMsgId) => {
+    if (this.purgedCids.has(targetClientMsgId)) return { kind: "purged" };
+    const a = this.authorByClientMsgId.get(targetClientMsgId);
+    return a !== void 0 ? { kind: "author", userId: a } : { kind: "unknown" };
+  };
+  // ── Mentions (mentions T6) ──
+  /** Resolve a message's decode-time mention spans: NORMALIZE the raw `body_ranges`
+   * against `text` (the pinned `normalizeMentionRangesUtf16` cross-SDK contract) then
+   * resolve each surviving range's `mentionedUserId` to a roster display name. An id
+   * not in the roster resolves to `null` (the renderer falls back to the `text` slice).
+   * Pure over (text, bodyRanges, memberCache); never throws. Mirrors iOS T3. */
+  resolveMentions(text, bodyRanges) {
+    if (text === null || !bodyRanges || bodyRanges.length === 0) return [];
+    const normalized = normalizeMentionRangesUtf16(bodyRanges, text);
+    if (normalized.length === 0) return [];
+    return normalized.map((r) => ({
+      start: r.start,
+      length: r.length,
+      mentionedUserId: r.mentionedUserId,
+      displayName: this.displayNameOf(r.mentionedUserId)
+    }));
+  }
+  /** Re-resolve the roster display name on already-NORMALIZED spans (the history
+   * projection produces them with null names — resolution is LIVE, not snapshotted).
+   * A member rename then reflects on old messages. Returns the message unchanged when
+   * it has no mentions (the common case) or no name changed. Mirrors iOS T3. */
+  resolveMentionNames(m) {
+    if (!m.mentions || m.mentions.length === 0) {
+      return m.mentions ? m : { ...m, mentions: [] };
+    }
+    let changed = false;
+    const reresolved = m.mentions.map((span) => {
+      const name = this.displayNameOf(span.mentionedUserId);
+      if (name === span.displayName) return span;
+      changed = true;
+      return { ...span, displayName: name };
+    });
+    if (!changed) return m;
+    return { ...m, mentions: reresolved };
+  }
+  /** The WINNING edit's resolved mentions for a target (normalize its replacement
+   * ranges against the new text + roster names), or `[]` if no winning edit / no
+   * ranges. The edited message's mentions reflect the EDIT's ranges (mirrors iOS T3). */
+  editMentions(targetClientMsgId, newText) {
+    const ranges = this.editFold.bodyRanges(targetClientMsgId);
+    if (!ranges) return [];
+    return this.resolveMentions(newText, ranges);
+  }
+  /** Resolve a userId → its roster display name (null if not a known member). */
+  displayNameOf(userId) {
+    return this.memberCache.find((mm) => mm.userId === userId)?.displayName ?? null;
+  }
+  /** Compute the SELF-ELEVATION decision for a freshly-ingested INCOMING bubble and,
+   * when it fires, record the dedup key (persisted) + invoke `onMentionElevation`.
+   * Gate (mirrors iOS T3): a surviving mention targets THIS user AND the sender is not
+   * me AND it's NOT an edit AND the `(selfUserId, clientMsgId|seq)` key isn't already
+   * elevated. Dedup-once: the in-memory set gates the session, the persisted set
+   * survives reload. An EDIT never reaches here (it folds, not a bubble) — the
+   * `envelopeType !== 'edit'` guard is belt-and-braces. */
+  elevateIfMentioned(message, mentions, senderUserId, envelopeType) {
+    const me = this.backend.selfUserId;
+    if (envelopeType === "edit") return;
+    if (senderUserId === me) return;
+    if (!mentions.some((mm) => mm.mentionedUserId === me)) return;
+    const idPart = message.clientMsgId ? message.clientMsgId : `seq:${message.serverSeq}`;
+    const key = `${me}|${idPart}`;
+    if (this.elevated.has(key)) return;
+    this.elevated.add(key);
+    if (this._group) {
+      void this.backend.saveElevated(this._group, [...this.elevated]).catch(() => {
+      });
+    }
+    this.onMentionElevation?.(message);
   }
-  /** The EditFold author-gate input: the target message's resolved author userId
-   * (null = target unknown/dangling → the fold HOLDs). Captured as a bound arrow
-   * so it can be passed to the pure EditFold. */
-  authorOfTarget = (targetClientMsgId) => this.authorByClientMsgId.get(targetClientMsgId) ?? null;
   /** Seed the per-target base text + author for the edit fold. Base is write-once
    * (a later own/peer edit must not overwrite the original we render against). The
    * author is (re)recorded whenever a non-empty resolution is available. */
@@ -3905,9 +4451,10 @@ var Chat = class {
       const base = this.originalTextByClientMsgId.has(targetClientMsgId) ? this.originalTextByClientMsgId.get(targetClientMsgId) ?? null : m.text;
       const text = editText ?? base;
       const edited = foldEdited || m.edited;
-      if (m.text === text && m.edited === edited) return m;
+      const mentions = editText !== null ? this.editMentions(targetClientMsgId, text) : m.mentions;
+      if (m.text === text && m.edited === edited && sameMentions(m.mentions, mentions)) return m;
       changed = true;
-      return { ...m, text, edited };
+      return { ...m, text, edited, mentions };
     });
     if (changed) this.emit();
   }
@@ -3924,8 +4471,9 @@ var Chat = class {
     if (editText === null && !foldEdited) return m;
     const text = editText ?? m.text;
     const edited = foldEdited || m.edited;
-    if (m.text === text && m.edited === edited) return m;
-    return { ...m, text, edited };
+    const mentions = editText !== null ? this.editMentions(m.clientMsgId, text) : m.mentions;
+    if (m.text === text && m.edited === edited && sameMentions(m.mentions, mentions)) return m;
+    return { ...m, text, edited, mentions };
   }
   /** @internal — called by the backend's conv subscription. */
   applyConv(event, payload) {
@@ -3983,6 +4531,18 @@ var Chat = class {
     }
     this.editFold.reevaluateHeld(this.authorOfTarget);
     for (const cid of this.originalTextByClientMsgId.keys()) this.recomputeEdit(cid);
+    this.reresolveAllMentionNames();
+  }
+  /** Re-resolve roster display names across the whole transcript (called on a roster
+   * change). Re-emits only if any name actually changed. */
+  reresolveAllMentionNames() {
+    let changed = false;
+    this.messageList = this.messageList.map((m) => {
+      const reresolved = this.resolveMentionNames(m);
+      if (reresolved !== m) changed = true;
+      return reresolved;
+    });
+    if (changed) this.emit();
   }
   seedMembersFromGroup(group) {
     const seed = [
@@ -4050,11 +4610,50 @@ var Chat = class {
       };
       resolvedReplyTo = resolveReply(replyRef, (id) => this.byClientMsgId.get(id) ?? null);
     }
-    const { receipt, clientMsgId } = await this.backend.sendText(group, text, replyRef);
-    this.appendOwnSend(text, receipt, clientMsgId, resolvedReplyTo);
+    const bodyRanges = opts?.mentions ?? null;
+    const start = opts?.expiresIn?.start ?? "send";
+    const expiry = opts?.expiresIn ? {
+      v: 1,
+      ttlSeconds: opts.expiresIn.ttlSeconds,
+      start,
+      senderSendTs: start === "send" ? Math.floor(Date.now() / 1e3) : null
+    } : null;
+    const { receipt, clientMsgId } = await this.backend.sendText(
+      group,
+      text,
+      replyRef,
+      bodyRanges,
+      expiry
+    );
+    this.appendOwnSend(text, receipt, clientMsgId, resolvedReplyTo, bodyRanges);
+    if (expiry) void this.armPurge(expiry, receipt.serverSeq, clientMsgId);
     return receipt;
   }
-  appendOwnSend(text, receipt, clientMsgId, resolvedReplyTo) {
+  /** Set (or DISABLE) this chat's DEFAULT disappearing timer. Emits a `timer_set` control
+   * envelope (server-blind — an opaque application message, NEVER a bubble) and folds the
+   * own-set locally so the default applies immediately to subsequent sends that carry no
+   * per-message expiry. `ttlSeconds === null` DISABLES the default. FIRE-AND-FORGET
+   * ADVISORY: returns on the LOCAL emit only; it exposes NO "active for all peers" signal.
+   * Mirrors iOS `setDisappearing(ttlSeconds:start:)`. */
+  async setDisappearing(opts) {
+    const group = await this.materializeIfNeeded();
+    const clientMsgId = mintClientMsgId();
+    const start = opts.start ?? "send";
+    const { receipt } = await this.backend.sendTimerSet(group, {
+      clientMsgId,
+      ttlSeconds: opts.ttlSeconds,
+      start
+    });
+    this.timerFold.ingest({
+      ttlSeconds: opts.ttlSeconds,
+      start,
+      actorUserId: this.backend.selfUserId,
+      epoch: receipt.epoch,
+      serverSeq: receipt.serverSeq,
+      eventClientMsgId: clientMsgId
+    });
+  }
+  appendOwnSend(text, receipt, clientMsgId, resolvedReplyTo, bodyRanges) {
     if (receipt.serverSeq <= 0) return;
     const key = this.internalKey(receipt.serverSeq);
     if (this.seenKeys.has(key)) return;
@@ -4079,7 +4678,13 @@ var Chat = class {
       // Own-sent edits fold via edit() after the fact; new sends start unedited.
       edited: false,
       // Own-sent deletes fold via deleteForEveryone() after the fact; start live.
-      isDeleted: false
+      isDeleted: false,
+      // Mentions T6: resolve the own-sent bubble's mentions for its own render (the
+      // sender never gets a wire echo of its own message — this is the only local copy).
+      mentions: this.resolveMentions(text, bodyRanges),
+      // Disappearing T10: the surfaced deadline is set by armPurge (own-send with a TTL)
+      // via the messageList overlay; default null here (a plain own-send has no deadline).
+      expiresAt: null
     });
     this.messageList.sort((a, b) => a.serverSeq - b.serverSeq);
     this.emit();
@@ -4167,15 +4772,18 @@ var Chat = class {
    * instantly; the durable echo on the next pump is a fold no-op (dedup on the
    * SAME wire clientMsgId). Never appends a bubble; PRESERVES the target's
    * reactions + reply context. Only the original author's edits count — for an own
-   * message self IS the author, so the author-gate passes. */
-  async edit(message, newText) {
+   * message self IS the author, so the author-gate passes. `opts.mentions` carries the
+   * edit's REPLACEMENT mention ranges → the edited message's mentions reflect them. */
+  async edit(message, newText, opts) {
     if (!message.clientMsgId || message.kind !== "text") return;
     const group = await this.materializeIfNeeded();
     const clientMsgId = mintClientMsgId();
+    const bodyRanges = opts?.mentions ?? null;
     const { receipt } = await this.backend.sendEdit(group, {
       clientMsgId,
       targetClientMsgId: message.clientMsgId,
-      newText
+      newText,
+      bodyRanges
     });
     this.seedEditBase(message.clientMsgId, message.text, this.backend.selfUserId);
     this.editFold.ingest(
@@ -4185,7 +4793,8 @@ var Chat = class {
         newText,
         epoch: receipt.epoch,
         serverSeq: receipt.serverSeq,
-        eventClientMsgId: clientMsgId
+        eventClientMsgId: clientMsgId,
+        bodyRanges
       },
       this.authorOfTarget
     );
@@ -4238,6 +4847,18 @@ var Chat = class {
     }
   }
 };
+function sameMentions(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) {
+    const x = a[i];
+    const y = b[i];
+    if (!x || !y) return false;
+    if (x.start !== y.start || x.length !== y.length || x.mentionedUserId !== y.mentionedUserId || x.displayName !== y.displayName) {
+      return false;
+    }
+  }
+  return true;
+}
 function sameReactions(a, b) {
   const ak = Object.keys(a);
   const bk = Object.keys(b);
@@ -4418,6 +5039,7 @@ var MessageDeliverySource = class {
         const isReaction = decoded.type === "reaction" && decoded.reaction != null;
         const isEdit = decoded.type === "edit" && decoded.edit != null;
         const isDelete = decoded.type === "delete" && decoded.delete != null;
+        const isTimerSet = decoded.type === "timer_set" && decoded.timer != null;
         const senderDeviceId = row.sender_device_id ?? decodeSenderDeviceId(received.sender);
         const stored = {
           id: `${group.rfcGroupId}#${row.server_seq}`,
@@ -4449,14 +5071,21 @@ var MessageDeliverySource = class {
           // Thread the edit discriminator + new text through the persisted row so an
           // edit folded LIVE re-folds onto its target after a reload (the reload-parity
           // boundary — mirrors iOS T3). Omitted for non-edits → old rows hydrate as
-          // `'text'`/no-edit (backward-compat).
+          // `'text'`/no-edit (backward-compat). The edit's replacement body_ranges ride
+          // along so the edited message's mentions re-resolve on cold launch (T6).
           ...isEdit && decoded.edit ? {
             envelopeType: "edit",
             edit: {
               targetClientMsgId: decoded.edit.targetClientMsgId,
-              newText: decoded.edit.newText
+              newText: decoded.edit.newText,
+              ...decoded.bodyRanges ? { bodyRanges: decoded.bodyRanges } : {}
             }
           } : {},
+          // Thread the TEXT bubble's mention ranges (raw) through the persisted row so a
+          // mention surfaced LIVE re-resolves onto its bubble after a reload (the
+          // reload-parity boundary for mentions — T6, mirrors iOS T3). Only on a text
+          // bubble (not a reaction/edit/delete row); omitted when absent (backward-compat).
+          ...!isReaction && !isEdit && !isDelete && decoded.bodyRanges ? { bodyRanges: decoded.bodyRanges } : {},
           // Thread the delete discriminator + target through the persisted row so a
           // delete-for-everyone tombstone folded LIVE re-folds onto its target after
           // a reload (the reload-parity boundary — the iOS-review CRITICAL lesson;
@@ -4468,7 +5097,18 @@ var MessageDeliverySource = class {
               targetClientMsgId: decoded.delete.targetClientMsgId,
               scope: decoded.delete.scope
             }
-          } : {}
+          } : {},
+          // Disappearing T10: thread the timer_set discriminator + payload through the
+          // persisted row so the chat default re-folds on cold launch (the page-local
+          // TimerFold in projectHistory). Omitted for non-timer_set rows (backward-compat).
+          ...isTimerSet && decoded.timer ? {
+            envelopeType: "timer_set",
+            timer: { ttlSeconds: decoded.timer.ttlSeconds, start: decoded.timer.start }
+          } : {},
+          // Disappearing T10: thread a TEXT bubble's per-message expiry through the persisted
+          // row so the message re-arms its purge on cold launch (the projection derives the
+          // deadline from this). Only on a text bubble; omitted when absent (backward-compat).
+          ...!isReaction && !isEdit && !isDelete && !isTimerSet && decoded.expiry ? { expiry: decoded.expiry } : {}
         };
         try {
           await this.messageStore.append(group.rfcGroupId, stored);
@@ -4488,7 +5128,15 @@ var MessageDeliverySource = class {
           envelopeType: decoded.type ?? "text",
           reaction: isReaction ? decoded.reaction : null,
           edit: isEdit ? decoded.edit : null,
-          delete: isDelete ? decoded.delete : null
+          delete: isDelete ? decoded.delete : null,
+          // The raw mention ranges (text bubble or the edit's replacement ranges); the
+          // Chat normalizes + resolves names → ChatMessage.mentions (T6).
+          bodyRanges: decoded.bodyRanges ?? null,
+          // Disappearing T10: the decoded timer_set payload (chat default control) + a text
+          // bubble's per-message expiry. The Chat routes timer_set into its TimerFold and
+          // arms a bubble's purge from the expiry (or the active default).
+          timer: isTimerSet ? decoded.timer : null,
+          expiry: !isReaction && !isEdit && !isDelete && !isTimerSet ? decoded.expiry ?? null : null
         });
         return true;
       }
@@ -4567,6 +5215,67 @@ function isOwnEchoOrConsumed(e) {
   return msg.includes("message from self") || msg.includes("key not available, invalid generation");
 }
 
+// src/messaging/disappearing.ts
+var DisappearingStore = class {
+  constructor(kv) {
+    this.kv = kv;
+  }
+  kv;
+  key(rfc) {
+    return `disappear:${rfc}`;
+  }
+  async load(rfc) {
+    const raw = await this.kv.get(this.key(rfc));
+    if (!raw) return { tombstonedSeqs: [], purgedClientMsgIds: [], anchors: {} };
+    try {
+      const r = JSON.parse(decodeUtf8(raw));
+      return {
+        tombstonedSeqs: r.tombstonedSeqs ?? [],
+        purgedClientMsgIds: r.purgedClientMsgIds ?? [],
+        anchors: r.anchors ?? {}
+      };
+    } catch {
+      return { tombstonedSeqs: [], purgedClientMsgIds: [], anchors: {} };
+    }
+  }
+  async save(rfc, rec) {
+    await this.kv.set(this.key(rfc), encodeUtf8(JSON.stringify(rec)));
+  }
+  /** The persisted INTEGER `server_seq` tombstone set for a chat (transcript exclusion + redelivery drop). */
+  async tombstonedSeqs(rfc) {
+    return new Set((await this.load(rfc)).tombstonedSeqs);
+  }
+  /** The persisted STRING `client_msg_id` purge set for a chat (orphan-fold → `'purged'`). */
+  async purgedClientMsgIds(rfc) {
+    return new Set((await this.load(rfc)).purgedClientMsgIds);
+  }
+  /**
+   * Tombstone-first commit point: the INTEGER seq and the STRING client_msg_id are
+   * written together in ONE durable record. Idempotent (re-tombstoning the same seq /
+   * id is a no-op). This write is THE purge commit — once it lands, a transcript rebuilt
+   * from the store excludes the seq and a redelivery is dropped, even across a crash.
+   */
+  async tombstone(rfc, serverSeq, clientMsgId) {
+    const rec = await this.load(rfc);
+    if (!rec.tombstonedSeqs.includes(serverSeq)) rec.tombstonedSeqs.push(serverSeq);
+    if (clientMsgId && !rec.purgedClientMsgIds.includes(clientMsgId)) {
+      rec.purgedClientMsgIds.push(clientMsgId);
+    }
+    await this.save(rfc, rec);
+  }
+  /** The persisted write-once anchor triple for a `clientMsgId`, or null if none. */
+  async anchor(rfc, clientMsgId) {
+    return (await this.load(rfc)).anchors[clientMsgId] ?? null;
+  }
+  /** Write-once: a second call for the same `clientMsgId` is a no-op (deadline never resets). */
+  async writeAnchorOnce(rfc, clientMsgId, a) {
+    const rec = await this.load(rfc);
+    if (rec.anchors[clientMsgId]) return;
+    rec.anchors[clientMsgId] = a;
+    await this.save(rfc, rec);
+  }
+};
+
 // src/messaging/history.ts
 var MessageStore = class {
   constructor(kv) {
@@ -4643,6 +5352,36 @@ var GroupCatalog = class {
   }
 };
 
+// src/messaging/mention-elevation.ts
+var MentionElevationStore = class {
+  constructor(kv) {
+    this.kv = kv;
+  }
+  kv;
+  key(rfcGroupId) {
+    return `elev:${rfcGroupId}`;
+  }
+  /** Load the persisted elevation keys for a chat (empty array if none). */
+  async load(rfcGroupId) {
+    const raw = await this.kv.get(this.key(rfcGroupId));
+    if (!raw) return [];
+    try {
+      const parsed = JSON.parse(decodeUtf8(raw));
+      return Array.isArray(parsed) ? parsed : [];
+    } catch {
+      return [];
+    }
+  }
+  /** Persist the full elevation key set for a chat (deterministic, deduped order). */
+  async save(rfcGroupId, keys) {
+    const sorted = [...new Set(keys)].sort();
+    await this.kv.set(this.key(rfcGroupId), encodeUtf8(JSON.stringify(sorted)));
+  }
+  async wipe() {
+    for (const k of await this.kv.keys("elev:")) await this.kv.delete(k);
+  }
+};
+
 // src/messaging/wasm/pkg/palbe_mls_bg.js
 var palbe_mls_bg_exports = {};
 __export(palbe_mls_bg_exports, {
@@ -6350,6 +7089,8 @@ var MessagingCoordinator = class {
     this.groupStore = new GroupStateStorage(this.kv);
     this.kpStore = new KeyPackageStorage(this.kv);
     this.suppressionStore = new SuppressionStore(this.kv);
+    this.elevationStore = new MentionElevationStore(this.kv);
+    this.disappearingStore = new DisappearingStore(this.kv);
     this.registry.attachChatList(
       (chats) => {
         this.chatList = chats;
@@ -6365,6 +7106,8 @@ var MessagingCoordinator = class {
   groupStore;
   kpStore;
   suppressionStore;
+  elevationStore;
+  disappearingStore;
   registry = new GroupRegistry();
   resolved = null;
   resolvePromise = null;
@@ -6520,9 +7263,9 @@ var MessagingCoordinator = class {
     });
     return group;
   }
-  async sendText(group, text, replyTo) {
+  async sendText(group, text, replyTo, bodyRanges) {
     const r = await this.resolve();
-    return r.groups.sendText(group, text, replyTo);
+    return r.groups.sendText(group, text, replyTo, bodyRanges);
   }
   async sendReaction(group, args) {
     const r = await this.resolve();
@@ -6536,6 +7279,10 @@ var MessagingCoordinator = class {
     const r = await this.resolve();
     return r.groups.sendDelete(group, args);
   }
+  async sendTimerSet(group, args) {
+    const r = await this.resolve();
+    return r.groups.sendTimerSet(group, args);
+  }
   /** Load this chat's persisted delete-for-me suppression keys (durable-only). */
   loadSuppressed(group) {
     return this.suppressionStore.load(group.rfcGroupId);
@@ -6544,10 +7291,36 @@ var MessagingCoordinator = class {
   saveSuppressed(group, keys) {
     return this.suppressionStore.save(group.rfcGroupId, keys);
   }
+  /** Load this chat's persisted self-elevation dedup keys (durable-only). */
+  loadElevated(group) {
+    return this.elevationStore.load(group.rfcGroupId);
+  }
+  /** Persist this chat's self-elevation dedup keys (durable-only, no wire). */
+  saveElevated(group, keys) {
+    return this.elevationStore.save(group.rfcGroupId, keys);
+  }
+  // ── Disappearing / TTL seam (durable-only, no wire) ──
+  tombstonedSeqs(group) {
+    return this.disappearingStore.tombstonedSeqs(group.rfcGroupId);
+  }
+  purgedClientMsgIds(group) {
+    return this.disappearingStore.purgedClientMsgIds(group.rfcGroupId);
+  }
+  anchor(group, clientMsgId) {
+    return this.disappearingStore.anchor(group.rfcGroupId, clientMsgId);
+  }
+  writeAnchorOnce(group, clientMsgId, a) {
+    return this.disappearingStore.writeAnchorOnce(group.rfcGroupId, clientMsgId, a);
+  }
+  tombstone(group, serverSeq, clientMsgId) {
+    return this.disappearingStore.tombstone(group.rfcGroupId, serverSeq, clientMsgId);
+  }
   async history(group, limit, before) {
     const r = await this.resolve();
     const rows = await r.messageStore.history(group.rfcGroupId, limit, before);
-    return projectHistory(group.displayId, rows, this.selfUserId);
+    const tombstoned = await this.disappearingStore.tombstonedSeqs(group.rfcGroupId);
+    const purged = await this.disappearingStore.purgedClientMsgIds(group.rfcGroupId);
+    return projectHistory(group.displayId, rows, this.selfUserId, void 0, tombstoned, purged);
   }
   async members(group) {
     const r = await this.resolve();
@@ -6624,9 +7397,10 @@ var MessagingCoordinator = class {
     return res.devices.map((d) => d.device_id);
   }
 };
-function projectHistory(displayId, rows, selfUserId, resolveActor) {
+function projectHistory(displayId, rows, selfUserId, resolveActor, tombstonedSeqs = /* @__PURE__ */ new Set(), purgedClientMsgIds = /* @__PURE__ */ new Set()) {
+  const visible = rows.filter((s) => !tombstonedSeqs.has(s.serverSeq));
   const fold = new ReactionFold();
-  for (const s of rows) {
+  for (const s of visible) {
     if (s.envelopeType !== "reaction" || !s.reaction) continue;
     const actor = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null) ?? null;
     if (actor === null) continue;
@@ -6642,17 +7416,22 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
   }
   const editFold = new EditFold();
   const deleteFold = new DeleteFold();
+  const pageTimerFold = new TimerFold();
   const authorByClientMsgId = /* @__PURE__ */ new Map();
-  for (const s of rows) {
-    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete")
+  for (const s of visible) {
+    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete" || s.envelopeType === "timer_set")
       continue;
     const cid = s.clientMsgId ?? "";
     if (!cid) continue;
     const author = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null);
     if (author != null) authorByClientMsgId.set(cid, author);
   }
-  const authorOfTarget = (cid) => authorByClientMsgId.get(cid) ?? null;
-  for (const s of rows) {
+  const authorOfTarget = (cid) => {
+    if (purgedClientMsgIds.has(cid)) return { kind: "purged" };
+    const a = authorByClientMsgId.get(cid);
+    return a !== void 0 ? { kind: "author", userId: a } : { kind: "unknown" };
+  };
+  for (const s of visible) {
     if (s.envelopeType !== "edit" || !s.edit) continue;
     const editor = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null) ?? null;
     editFold.ingest(
@@ -6662,13 +7441,16 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
         newText: s.edit.newText,
         epoch: s.epoch,
         serverSeq: s.serverSeq,
-        eventClientMsgId: s.clientMsgId ?? `${s.id}`
+        eventClientMsgId: s.clientMsgId ?? `${s.id}`,
+        // Mentions T6: the edit's replacement ranges ride the fold so the WINNING
+        // edit's ranges drive the edited message's mentions on cold launch.
+        bodyRanges: s.edit.bodyRanges ?? null
       },
       authorOfTarget
     );
   }
   editFold.reevaluateHeld(authorOfTarget);
-  for (const s of rows) {
+  for (const s of visible) {
     if (s.envelopeType !== "delete" || !s.delete) continue;
     const actor = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null) ?? null;
     deleteFold.ingest(
@@ -6682,10 +7464,10 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
       authorOfTarget
     );
   }
-  for (const [cid, author] of authorByClientMsgId) deleteFold.reevaluatePending(cid, author);
+  for (const [cid] of authorByClientMsgId) deleteFold.reevaluatePending(cid, authorOfTarget(cid));
   const lookup = /* @__PURE__ */ new Map();
-  for (const s of rows) {
-    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete")
+  for (const s of visible) {
+    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete" || s.envelopeType === "timer_set")
       continue;
     const cid = s.clientMsgId ?? "";
     if (cid && s.text !== null) {
@@ -6694,7 +7476,21 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
     }
   }
   const out = [];
-  for (const s of rows) {
+  for (const s of visible) {
+    if (s.envelopeType === "timer_set") {
+      const actor = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null) ?? null;
+      if (actor !== null && s.timer) {
+        pageTimerFold.ingest({
+          ttlSeconds: s.timer.ttlSeconds,
+          start: s.timer.start,
+          actorUserId: actor,
+          epoch: s.epoch,
+          serverSeq: s.serverSeq,
+          eventClientMsgId: s.clientMsgId ?? `${s.id}`
+        });
+      }
+      continue;
+    }
     if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete")
       continue;
     const clientMsgId = s.clientMsgId ?? "";
@@ -6712,10 +7508,23 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
         replyTo: null,
         reactions: {},
         edited: false,
-        isDeleted: true
+        isDeleted: true,
+        // Mentions T6: delete DOMINATES mentions too — a tombstoned message has none.
+        mentions: [],
+        // delete DOMINATES disappearing too — a tombstoned message carries no deadline.
+        expiresAt: null
       });
       continue;
     }
+    let expiresAt = null;
+    if (s.expiry) {
+      expiresAt = new Date(s.at + s.expiry.ttlSeconds * 1e3);
+    } else {
+      const active = pageTimerFold.active();
+      if (active && active.ttlSeconds !== null) {
+        expiresAt = new Date(s.at + active.ttlSeconds * 1e3);
+      }
+    }
     let replyTo = null;
     if (s.replyTo) {
       const ref = {
@@ -6732,23 +7541,37 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
     }
     const editText = clientMsgId ? editFold.text(clientMsgId) : null;
     const edited = clientMsgId ? editFold.isEdited(clientMsgId) : false;
+    const text = editText ?? s.text;
+    const rawRanges = editText !== null ? editFold.bodyRanges(clientMsgId) : s.bodyRanges;
+    const mentions = normalizeMentionsNullNames(rawRanges, text);
     out.push({
       id: `${displayId}#${s.serverSeq}`,
       kind: s.text != null ? "text" : "system",
       direction: s.direction,
       senderUserId: s.direction === "outgoing" ? selfUserId : null,
-      text: editText ?? s.text,
+      text,
       serverSeq: s.serverSeq,
       sentAt: new Date(s.at),
       clientMsgId,
       replyTo,
       reactions: clientMsgId ? fold.tally(clientMsgId) : {},
       edited,
-      isDeleted: false
+      isDeleted: false,
+      mentions,
+      expiresAt
     });
   }
   return out;
 }
+function normalizeMentionsNullNames(raw, text) {
+  if (text === null || !raw || raw.length === 0) return [];
+  return normalizeMentionRangesUtf16(raw, text).map((r) => ({
+    start: r.start,
+    length: r.length,
+    mentionedUserId: r.mentionedUserId,
+    displayName: null
+  }));
+}
 
 // src/messaging/facade.ts
 var PalbeMessaging = class {
@@ -7482,7 +8305,7 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "1.4.0";
+var VERSION = "1.6.0";
 
 // src/runtime.ts
 function buildRuntime(config) {