@palbase/web 1.5.0 → 1.6.0

package/dist/next/index.cjs

@@ -2628,6 +2628,47 @@ var PalbeFlags = class {
   }
 };
 
+// src/messaging/deadline-calculator.ts
+function remainingSeconds(args) {
+  const ttl = args.ttlSeconds;
+  const wallDeltaSec = (args.nowWallEpochMs - args.anchor.wAnchorEpochMs) / 1e3;
+  let elapsed;
+  if (args.nowBootToken === args.anchor.bAnchorToken) {
+    const monoDeltaSec = Math.max(0, args.nowMonotonicMs - args.anchor.mAnchorMs) / 1e3;
+    elapsed = Math.max(monoDeltaSec, wallDeltaSec);
+  } else {
+    elapsed = wallDeltaSec;
+  }
+  const remaining = Math.min(ttl, ttl - elapsed);
+  return remaining <= 0 ? { kind: "purgeNow" } : { kind: "remaining", seconds: remaining };
+}
+var cachedBootToken = null;
+var MonotonicClock = {
+  nowMs() {
+    return typeof performance !== "undefined" ? performance.now() : Date.now();
+  },
+  nowWallEpochMs() {
+    return Date.now();
+  },
+  bootToken() {
+    if (cachedBootToken !== null) return cachedBootToken;
+    try {
+      const existing = typeof sessionStorage !== "undefined" ? sessionStorage.getItem("pb_boot_token") : null;
+      if (existing) {
+        cachedBootToken = existing;
+        return existing;
+      }
+      const fresh = crypto.randomUUID();
+      if (typeof sessionStorage !== "undefined") sessionStorage.setItem("pb_boot_token", fresh);
+      cachedBootToken = fresh;
+      return fresh;
+    } catch {
+      cachedBootToken = crypto.randomUUID();
+      return cachedBootToken;
+    }
+  }
+};
+
 // src/messaging/delete-fold.ts
 var DeleteFold = class {
   // targets with a confirmed valid tombstone — MONOTONIC (never removed within retention).
@@ -2640,17 +2681,24 @@ var DeleteFold = class {
   // keyed by eventClientMsgId so a re-delivered unverifiable event is held exactly once.
   held = [];
   /**
-   * Ingest one tombstone. `authorOfTarget` resolves the target message's AUTHOR
-   * userId (null = target absent locally → defer).
+   * Ingest one tombstone. `authorOfTarget` resolves the target message's author via
+   * {@link AuthorResolution}: `'author'` → run the author-gate; `'unknown'` → defer
+   * (target absent locally → pending/held); `'purged'` → NO-OP, mark seen (the target
+   * was TTL-purged — a delete of an already-gone message is already satisfied; never
+   * park in pending, never re-attempt).
    */
   ingest(e, authorOfTarget) {
     if (this.tombstoned.has(e.targetClientMsgId)) return;
     if (this.seen.has(e.eventClientMsgId)) return;
     if (this.heldContains(e.eventClientMsgId)) return;
-    const author = authorOfTarget(e.targetClientMsgId);
-    if (author !== null) {
+    const res = authorOfTarget(e.targetClientMsgId);
+    if (res.kind === "purged") {
+      this.seen.add(e.eventClientMsgId);
+      return;
+    }
+    if (res.kind === "author") {
       this.seen.add(e.eventClientMsgId);
-      if (e.actorUserId === null || e.actorUserId !== author) return;
+      if (e.actorUserId === null || e.actorUserId !== res.userId) return;
       this.tombstoned.add(e.targetClientMsgId);
     } else if (e.actorUserId !== null) {
       this.seen.add(e.eventClientMsgId);
@@ -2670,12 +2718,13 @@ var DeleteFold = class {
    * the in-order path.
    */
   reevaluatePending(target, author) {
+    const res = author;
     const actor = this.pending.get(target);
     if (actor !== void 0) {
-      if (author !== null && actor === author) {
-        this.tombstoned.add(target);
+      if (res.kind === "author") {
+        if (actor === res.userId) this.tombstoned.add(target);
         this.pending.delete(target);
-      } else if (author !== null) {
+      } else if (res.kind === "purged") {
         this.pending.delete(target);
       }
     }
@@ -2683,7 +2732,7 @@ var DeleteFold = class {
     const pendingHeld = this.held;
     this.held = [];
     for (const e of pendingHeld) {
-      this.ingest(e, (t) => t === target ? author : null);
+      this.ingest(e, (t) => t === target ? res : { kind: "unknown" });
     }
   }
   heldContains(eventClientMsgId) {
@@ -2709,15 +2758,23 @@ var EditFold = class {
   // targets that have had ≥1 valid edit applied (write-once)
   editedTargets = /* @__PURE__ */ new Set();
   /**
-   * Ingest one edit. `authorOfTarget` resolves the target message's AUTHOR userId
-   * (null = target unknown/dangling → HOLD).
+   * Ingest one edit. `authorOfTarget` resolves the target message's author via
+   * {@link AuthorResolution}: `'author'` → run the author-gate; `'unknown'` → HOLD
+   * (target/author not yet known); `'purged'` → DROP (the target was TTL-purged —
+   * editing a disappeared message is a no-op; mark the event seen so it never re-holds
+   * and a later author "resolution" cannot resurrect it).
    */
   ingest(e, authorOfTarget) {
-    const author = authorOfTarget(e.targetClientMsgId);
-    if (author === null) {
+    const res = authorOfTarget(e.targetClientMsgId);
+    if (res.kind === "unknown") {
       this.holdIfNew(e);
       return;
     }
+    if (res.kind === "purged") {
+      this.seenEvents.add(e.eventClientMsgId);
+      return;
+    }
+    const author = res.userId;
     if (e.editorUserId === null) {
       this.holdIfNew(e);
       return;
@@ -2976,14 +3033,46 @@ function encodeEnvelope(args) {
         length: r.length,
         mentioned_user_id: r.mentionedUserId
       }))
+    } : {},
+    ...args.expiry ? {
+      expiry: {
+        v: args.expiry.v,
+        ttl_seconds: args.expiry.ttlSeconds,
+        start: args.expiry.start,
+        // present IFF send (drop a stray senderSendTs on a read anchor)
+        ...args.expiry.start === "send" && args.expiry.senderSendTs != null ? { sender_send_ts: args.expiry.senderSendTs } : {}
+      }
     } : {}
   };
   return encodeUtf8(JSON.stringify(env));
 }
+function encodeTimerSet(args) {
+  return encodeUtf8(
+    JSON.stringify({
+      v: 1,
+      type: "timer_set",
+      client_msg_id: args.clientMsgId,
+      ...args.ttlSeconds != null ? { ttl_seconds: args.ttlSeconds } : {},
+      start: args.start
+    })
+  );
+}
 function decodeEnvelope(bytes) {
   const s = decodeUtf8(bytes);
   try {
     const o = JSON.parse(s);
+    if (typeof o === "object" && o !== null && o.type === "timer_set") {
+      return {
+        type: "timer_set",
+        text: null,
+        clientMsgId: o.client_msg_id ?? "",
+        replyTo: null,
+        timer: {
+          ttlSeconds: typeof o.ttl_seconds === "number" ? o.ttl_seconds : null,
+          start: o.start === "read" ? "read" : "send"
+        }
+      };
+    }
     if (typeof o === "object" && o !== null && o.type === "delete") {
       return {
         type: "delete",
@@ -3025,12 +3114,14 @@ function decodeEnvelope(bytes) {
     }
     if (typeof o === "object" && o !== null && o.type === "text" && typeof o.v === "number") {
       const textRanges = decodeBodyRanges(o.body_ranges);
+      const expiry = decodeExpiry(o.expiry);
       return {
         type: "text",
         text: o.text ?? null,
         clientMsgId: o.client_msg_id ?? "",
         replyTo: o.reply_to ?? null,
-        ...textRanges ? { bodyRanges: textRanges } : {}
+        ...textRanges ? { bodyRanges: textRanges } : {},
+        ...expiry ? { expiry } : {}
       };
     }
     if (typeof o === "object" && o !== null && o.type === "text") {
@@ -3042,6 +3133,19 @@ function decodeEnvelope(bytes) {
   }
   return { text: s, clientMsgId: "", replyTo: null };
 }
+function decodeExpiry(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const o = raw;
+  if (typeof o.ttl_seconds !== "number") return void 0;
+  const start = o.start === "read" ? "read" : "send";
+  return {
+    v: typeof o.v === "number" ? o.v : 1,
+    ttlSeconds: o.ttl_seconds,
+    start,
+    // tolerant: only honor sender_send_ts on a send anchor; null otherwise.
+    senderSendTs: start === "send" && typeof o.sender_send_ts === "number" ? o.sender_send_ts : null
+  };
+}
 function decodeBodyRanges(raw) {
   if (!raw || raw.length === 0) return void 0;
   return raw.map((r) => ({
@@ -3261,9 +3365,9 @@ var GroupMessaging = class {
   /** Send a text message. Encrypt at the current epoch, POST, return the receipt +
    * the client-minted `clientMsgId` (needed by the Chat layer for reply indexing).
    * NEVER rebases (a 422 stale_application surfaces to the caller). */
-  async sendText(group, text, replyTo, bodyRanges) {
+  async sendText(group, text, replyTo, bodyRanges, expiry) {
     const clientMsgId = mintClientMsgId();
-    const plaintext = encodeEnvelope({ text, clientMsgId, replyTo, bodyRanges });
+    const plaintext = encodeEnvelope({ text, clientMsgId, replyTo, bodyRanges, expiry });
     const ct = await this.engine.encryptApplication(fromBase64(group.rfcGroupId), plaintext);
     const body = {
       ciphertext_b64: toBase64(ct),
@@ -3292,7 +3396,10 @@ var GroupMessaging = class {
       } : null,
       // Persist the OUTGOING bubble's mention ranges so an own-sent mention re-resolves
       // onto its bubble after a reload (own-send reload parity — the T4-reviewer Minor).
-      ...bodyRanges && bodyRanges.length > 0 ? { bodyRanges } : {}
+      ...bodyRanges && bodyRanges.length > 0 ? { bodyRanges } : {},
+      // Disappearing T10: persist the per-message TTL so the own-send re-arms its purge
+      // after a cold launch (the projection derives the deadline from this row's expiry).
+      ...expiry ? { expiry } : {}
     };
     try {
       await this.messageStore.append(group.rfcGroupId, stored);
@@ -3300,6 +3407,51 @@ var GroupMessaging = class {
     }
     return { receipt: { serverSeq: wire.server_seq, epoch: wire.epoch }, clientMsgId };
   }
+  /** Send a per-chat default disappearing-timer control envelope (`timer_set`). Encrypts
+   * a `type:'timer_set'` envelope at the current epoch and sends through the SAME MLS
+   * application path as `sendText` (the server stays blind — it's an opaque app message,
+   * NEVER a bubble). `ttlSeconds === null` disables the default (omitted from the wire).
+   * Persists the outgoing `timer_set` row so the chat default re-folds on cold launch
+   * (the page-local TimerFold in projectHistory). NEVER rebases (epoch-bound). */
+  async sendTimerSet(group, args) {
+    const plaintext = encodeTimerSet({
+      clientMsgId: args.clientMsgId,
+      ttlSeconds: args.ttlSeconds,
+      start: args.start
+    });
+    const ct = await this.engine.encryptApplication(fromBase64(group.rfcGroupId), plaintext);
+    const body = {
+      ciphertext_b64: toBase64(ct),
+      client_idem_key: randomId()
+    };
+    const wire = await palbeRequest(
+      this.rt,
+      "POST",
+      MessagingPaths.groupMessages(group.displayId),
+      { body }
+    );
+    const stored = {
+      id: `${group.rfcGroupId}#${wire.server_seq}`,
+      direction: "outgoing",
+      text: null,
+      senderDeviceId: this.selfDeviceId,
+      epoch: wire.epoch,
+      serverSeq: wire.server_seq,
+      at: Date.now(),
+      clientMsgId: args.clientMsgId,
+      replyTo: null,
+      envelopeType: "timer_set",
+      timer: { ttlSeconds: args.ttlSeconds, start: args.start }
+    };
+    try {
+      await this.messageStore.append(group.rfcGroupId, stored);
+    } catch {
+    }
+    return {
+      receipt: { serverSeq: wire.server_seq, epoch: wire.epoch },
+      clientMsgId: args.clientMsgId
+    };
+  }
   /** Send a reaction (add/remove of an emoji on a target message). Encrypts a
    * `type:'reaction'` envelope at the current epoch and sends through the SAME
    * MLS application path as `sendText` (the server stays blind — a reaction is
@@ -3602,6 +3754,43 @@ var ReactionFold = class {
   }
 };
 
+// src/messaging/timer-fold.ts
+function orderLte2(aEpoch, aSeq, bEpoch, bSeq) {
+  if (aEpoch !== bEpoch) return aEpoch < bEpoch;
+  return aSeq <= bSeq;
+}
+var TimerFold = class {
+  cell = null;
+  seenEvents = /* @__PURE__ */ new Set();
+  ingest(e) {
+    if (this.seenEvents.has(e.eventClientMsgId)) return;
+    this.seenEvents.add(e.eventClientMsgId);
+    if (this.cell !== null && orderLte2(e.epoch, e.serverSeq, this.cell.orderEpoch, this.cell.orderSeq)) {
+      return;
+    }
+    this.cell = {
+      orderEpoch: e.epoch,
+      orderSeq: e.serverSeq,
+      ttlSeconds: e.ttlSeconds,
+      start: e.start,
+      actor: e.actorUserId
+    };
+  }
+  /**
+   * The active chat default, or null if no timer_set has applied.
+   * `ttlSeconds === null` means DISABLED (still applied — distinct from "never
+   * set"). `start` is meaningful only when ttlSeconds !== null.
+   */
+  active() {
+    if (this.cell === null) return null;
+    return { ttlSeconds: this.cell.ttlSeconds, start: this.cell.start };
+  }
+  /** The userId behind the winning timer_set (for the optional system line). null if unset. */
+  lastActor() {
+    return this.cell?.actor ?? null;
+  }
+};
+
 // src/messaging/chat.ts
 var DELETED_DESCRIPTOR = "\u{1F6AB} This message was deleted";
 var Chat = class {
@@ -3628,6 +3817,22 @@ var Chat = class {
   /** The single authoritative delete-for-everyone fold (live + own-send + history).
    * A tombstone scrubs its target in place (delete DOMINATES edit at render). */
   deleteFold = new DeleteFold();
+  /** The per-chat default disappearing-timer fold — the latest valid `timer_set` (LWW
+   * on (epoch, serverSeq), author = the resolved MLS sender). A `timer_set` is NEVER a
+   * bubble; it routes here. The active default governs a subsequent bubble that carries
+   * no per-message expiry (disappearing T10). */
+  timerFold = new TimerFold();
+  /** Advisory in-memory purge timers, keyed by serverSeq. The DURABLE truth is the
+   * persisted anchor + a re-check on every load; this just drives live eviction while
+   * the tab is open. Cancelled when the message purges (disappearing T10). */
+  purgeTimers = /* @__PURE__ */ new Map();
+  /** In-memory mirror of the durable `purgedClientMsgIds` set (the STRING namespace),
+   * hydrated from `backend.purgedClientMsgIds` and grown by each live purge. Consulted
+   * by `authorOfTarget` so a late edit/delete targeting a TTL-purged message resolves to
+   * `'purged'` (DROP / no-op — never resurrects). Namespace-separate from the int seq
+   * tombstone (disappearing T10). */
+  purgedCids = /* @__PURE__ */ new Set();
+  purgedLoaded = false;
   /** delete-for-me suppression keys (clientMsgId, or `seq:<serverSeq>` for legacy)
    * — the message is OMITTED from this view. Local + persisted per chat, NO wire. */
   suppressed = /* @__PURE__ */ new Set();
@@ -3738,7 +3943,9 @@ var Chat = class {
           replyTo: null,
           edited: false,
           isDeleted: true,
-          mentions: []
+          mentions: [],
+          // delete DOMINATES disappearing too — a tombstoned message carries no deadline.
+          expiresAt: null
         });
         continue;
       }
@@ -3775,9 +3982,21 @@ var Chat = class {
     this.liveUnsub = this.backend.subscribeLive(this._group, this);
     void this.loadSuppressed();
     void this.loadElevated();
-    void this.hydrateHistory();
+    void this.loadPurged().then(() => this.hydrateHistory());
     void this.refreshMembers();
   }
+  /** Hydrate the durable `purgedClientMsgIds` set (once) into the in-memory mirror so the
+   * live Edit/Delete fold author-gate sees TTL-purged targets as 'purged' on cold launch
+   * (disappearing T10). No re-emit: it only gates the orphan-fold resolution. */
+  async loadPurged() {
+    if (this.purgedLoaded || !this._group) return;
+    this.purgedLoaded = true;
+    try {
+      const ids = await this.backend.purgedClientMsgIds(this._group);
+      for (const id of ids) this.purgedCids.add(id);
+    } catch {
+    }
+  }
   /** Hydrate the persisted delete-for-me suppression keys (once), then re-emit so
    * any already-surfaced suppressed message is omitted (cold-launch parity). */
   async loadSuppressed() {
@@ -3834,13 +4053,16 @@ var Chat = class {
       if (this.seenKeys.has(key)) continue;
       this.seenKeys.add(key);
       if (m.clientMsgId && !m.isDeleted) {
-        this.deleteFold.reevaluatePending(m.clientMsgId, m.senderUserId);
+        this.deleteFold.reevaluatePending(m.clientMsgId, this.authorOfTarget(m.clientMsgId));
       }
       this.messageList.push(
         this.applyEditOverlay(this.applyReactionTally(this.resolveMentionNames(m)))
       );
       changed = true;
       this.loadedEarliestSeq = Math.min(this.loadedEarliestSeq ?? m.serverSeq, m.serverSeq);
+      if (m.expiresAt && m.clientMsgId && !m.isDeleted) {
+        void this.armFromDeadline(m.expiresAt, m.serverSeq, m.clientMsgId);
+      }
     }
     if (changed) {
       this.messageList.sort((a, b) => a.serverSeq - b.serverSeq);
@@ -3855,6 +4077,7 @@ var Chat = class {
       return;
     }
     if (incoming.serverSeq <= 0) return;
+    if ((await this.backend.tombstonedSeqs(this._group)).has(incoming.serverSeq)) return;
     const key = this.internalKey(incoming.serverSeq);
     if (this.seenKeys.has(key)) return;
     this.seenKeys.add(key);
@@ -3863,6 +4086,20 @@ var Chat = class {
       senderUser = await this.backend.userIdForDevice(this._group, incoming.senderDeviceId);
     }
     const direction = senderUser !== null && senderUser === this.backend.selfUserId ? "outgoing" : "incoming";
+    if (incoming.envelopeType === "timer_set" && incoming.timer) {
+      const actorUserId = direction === "outgoing" ? this.backend.selfUserId : senderUser;
+      if (actorUserId !== null) {
+        this.timerFold.ingest({
+          ttlSeconds: incoming.timer.ttlSeconds,
+          start: incoming.timer.start,
+          actorUserId,
+          epoch: incoming.epoch,
+          serverSeq: incoming.serverSeq,
+          eventClientMsgId: incoming.clientMsgId
+        });
+      }
+      return;
+    }
     if (incoming.envelopeType === "reaction" && incoming.reaction) {
       const actorUserId = direction === "outgoing" ? this.backend.selfUserId : senderUser;
       if (actorUserId !== null) {
@@ -3937,7 +4174,10 @@ var Chat = class {
       edited: false,
       // Default false; surfaced() applies the tombstone scrub if a delete folded.
       isDeleted: false,
-      mentions
+      mentions,
+      // Disappearing T10: the LOCAL deadline (own per-message expiry ELSE the chat default
+      // active AS OF arrival). null when this message is non-disappearing.
+      expiresAt: this.deadlineFor(this.toExpirySpec(incoming.expiry) ?? this.defaultExpiry())
     };
     this.elevateIfMentioned(msg, mentions, senderUser, incoming.envelopeType);
     if (incomingClientMsgId && incoming.text !== null) {
@@ -3949,7 +4189,10 @@ var Chat = class {
     if (incomingClientMsgId) {
       this.seedEditBase(incomingClientMsgId, incoming.text, senderUser);
       this.editFold.reevaluateHeld(this.authorOfTarget);
-      this.deleteFold.reevaluatePending(incomingClientMsgId, senderUser);
+      this.deleteFold.reevaluatePending(
+        incomingClientMsgId,
+        this.authorOfTarget(incomingClientMsgId)
+      );
     }
     this.messageList.push(this.applyEditOverlay(msg));
     this.messageList.sort((a, b) => a.serverSeq - b.serverSeq);
@@ -3958,11 +4201,131 @@ var Chat = class {
       incoming.serverSeq
     );
     this.emit();
+    void this.armPurge(
+      this.toExpirySpec(incoming.expiry) ?? this.defaultExpiry(),
+      incoming.serverSeq,
+      incomingClientMsgId
+    );
+  }
+  // ── Disappearing (TTL — T10) ──
+  /** Normalize a decoded `IncomingMessage.expiry` / `StoredMessage.expiry` into the
+   * `ExpirySpec` the arm path consumes (or null when absent). */
+  toExpirySpec(e) {
+    return e ? { v: e.v, ttlSeconds: e.ttlSeconds, start: e.start, senderSendTs: e.senderSendTs } : null;
+  }
+  /** The chat-default expiry derived from the active `timer_set` fold, as an `ExpirySpec`
+   * so a bubble with no per-message expiry inherits it. null when no default is active or
+   * the default was explicitly DISABLED (`ttlSeconds === null`). `senderSendTs` is null —
+   * the default has no per-message sender clock; the arrival anchor drives the deadline
+   * (mirrors iOS `defaultExpiry()`). */
+  defaultExpiry() {
+    const active = this.timerFold.active();
+    if (!active || active.ttlSeconds === null) return null;
+    return { v: 1, ttlSeconds: active.ttlSeconds, start: active.start, senderSendTs: null };
+  }
+  /** The surfaced display deadline for an effective expiry (a local, monotonic-derived
+   * value — the wall-clock projection of the TTL from now). null for a non-disappearing
+   * message. The durable purge is driven by `armPurge`'s write-once anchor; this is the
+   * UI countdown baseline. */
+  deadlineFor(expiry) {
+    if (!expiry) return null;
+    return new Date(Date.now() + expiry.ttlSeconds * 1e3);
+  }
+  /** Arm a message's TTL purge on first decrypt-and-display. Captures the WRITE-ONCE
+   * monotonic/wall/boot anchor (so the deadline survives a reload — a re-arm after relaunch
+   * reads back the ORIGINAL capture, never a fresh one → the deadline never resets),
+   * computes the remaining time via `remainingSeconds`, applies the send-anchor clamp
+   * `min(sender_send_ts+ttl, first_arrival+ttl)` (read-anchor uses the write-once first-read
+   * capture), then either purges immediately or schedules an advisory `setTimeout`. A null
+   * expiry / empty clientMsgId is a no-op. Mirrors iOS `armPurge`. */
+  async armPurge(expiry, serverSeq, clientMsgId) {
+    if (!expiry || !clientMsgId || !this._group) return;
+    const group = this._group;
+    const fresh = {
+      mAnchorMs: MonotonicClock.nowMs(),
+      wAnchorEpochMs: MonotonicClock.nowWallEpochMs(),
+      bAnchorToken: MonotonicClock.bootToken()
+    };
+    await this.backend.writeAnchorOnce(group, clientMsgId, fresh);
+    const effective = await this.backend.anchor(group, clientMsgId) ?? fresh;
+    const result = remainingSeconds({
+      ttlSeconds: expiry.ttlSeconds,
+      anchor: effective,
+      nowMonotonicMs: MonotonicClock.nowMs(),
+      nowWallEpochMs: MonotonicClock.nowWallEpochMs(),
+      nowBootToken: MonotonicClock.bootToken()
+    });
+    let purgeInSeconds;
+    if (result.kind === "purgeNow") {
+      purgeInSeconds = 0;
+    } else if (expiry.start === "send" && expiry.senderSendTs !== null) {
+      const sendRemaining = expiry.senderSendTs + expiry.ttlSeconds - MonotonicClock.nowWallEpochMs() / 1e3;
+      purgeInSeconds = sendRemaining <= 0 ? 0 : Math.min(result.seconds, sendRemaining);
+    } else {
+      purgeInSeconds = result.seconds;
+    }
+    const prior = this.purgeTimers.get(serverSeq);
+    if (prior) clearTimeout(prior);
+    this.purgeTimers.delete(serverSeq);
+    if (purgeInSeconds <= 0) {
+      await this.purge(serverSeq, clientMsgId);
+      return;
+    }
+    const handle = setTimeout(() => {
+      void this.purge(serverSeq, clientMsgId);
+    }, purgeInSeconds * 1e3);
+    this.purgeTimers.set(serverSeq, handle);
   }
-  /** The EditFold author-gate input: the target message's resolved author userId
-   * (null = target unknown/dangling → the fold HOLDs). Captured as a bound arrow
-   * so it can be passed to the pure EditFold. */
-  authorOfTarget = (targetClientMsgId) => this.authorByClientMsgId.get(targetClientMsgId) ?? null;
+  /** Re-arm a purge from a derived deadline (cold-launch hydrate path). The deadline is
+   * the projection's monotonic-derived `expiresAt`; schedule an advisory timer for the
+   * remaining time (purge immediately if the deadline has already passed). The durable
+   * tombstone is written by `purge` when it fires (the crash-safe commit point). */
+  async armFromDeadline(deadline, serverSeq, clientMsgId) {
+    if (!this._group) return;
+    const remainingMs = deadline.getTime() - Date.now();
+    const prior = this.purgeTimers.get(serverSeq);
+    if (prior) clearTimeout(prior);
+    this.purgeTimers.delete(serverSeq);
+    if (remainingMs <= 0) {
+      await this.purge(serverSeq, clientMsgId);
+      return;
+    }
+    const handle = setTimeout(() => {
+      void this.purge(serverSeq, clientMsgId);
+    }, remainingMs);
+    this.purgeTimers.set(serverSeq, handle);
+  }
+  /** Purge message M (TTL eviction). TOMBSTONE-FIRST (the crash-safe commit point):
+   * persist the `server_seq` tombstone + the `client_msg_id` purge id in ONE durable
+   * record, THEN drop M's body from `messageList` + `emit()`, then re-evaluate any HELD
+   * edit / PARKED delete targeting the now-purged cid so an orphan annotation DROPs/no-ops
+   * (the resolver now returns `'purged'`). Idempotent. Mirrors iOS `purge`. */
+  async purge(serverSeq, clientMsgId) {
+    if (!this._group) return;
+    const prior = this.purgeTimers.get(serverSeq);
+    if (prior) clearTimeout(prior);
+    this.purgeTimers.delete(serverSeq);
+    await this.backend.tombstone(this._group, serverSeq, clientMsgId);
+    if (clientMsgId) this.purgedCids.add(clientMsgId);
+    this.messageList = this.messageList.filter((m) => m.serverSeq !== serverSeq);
+    this.seenKeys.delete(this.internalKey(serverSeq));
+    this.emit();
+    this.editFold.reevaluateHeld(this.authorOfTarget);
+    if (clientMsgId) {
+      this.deleteFold.reevaluatePending(clientMsgId, this.authorOfTarget(clientMsgId));
+    }
+  }
+  /** The Edit/Delete fold author-gate input via {@link AuthorResolution} (disappearing
+   * T10 — the orphan-aware resolver): `'purged'` when the target's clientMsgId is in the
+   * durable purge set (a late edit DROPs / a late delete no-ops — never resurrects a
+   * disappeared message); `'author'` when its author is locally known → run the
+   * author-gate; `'unknown'` otherwise → HOLD. The live twin of `projectHistory`'s
+   * resolver. Captured as a bound arrow so it can be passed to the pure folds. */
+  authorOfTarget = (targetClientMsgId) => {
+    if (this.purgedCids.has(targetClientMsgId)) return { kind: "purged" };
+    const a = this.authorByClientMsgId.get(targetClientMsgId);
+    return a !== void 0 ? { kind: "author", userId: a } : { kind: "unknown" };
+  };
   // ── Mentions (mentions T6) ──
   /** Resolve a message's decode-time mention spans: NORMALIZE the raw `body_ranges`
    * against `text` (the pinned `normalizeMentionRangesUtf16` cross-SDK contract) then
@@ -4248,10 +4611,48 @@ var Chat = class {
       resolvedReplyTo = resolveReply(replyRef, (id) => this.byClientMsgId.get(id) ?? null);
     }
     const bodyRanges = opts?.mentions ?? null;
-    const { receipt, clientMsgId } = await this.backend.sendText(group, text, replyRef, bodyRanges);
+    const start = opts?.expiresIn?.start ?? "send";
+    const expiry = opts?.expiresIn ? {
+      v: 1,
+      ttlSeconds: opts.expiresIn.ttlSeconds,
+      start,
+      senderSendTs: start === "send" ? Math.floor(Date.now() / 1e3) : null
+    } : null;
+    const { receipt, clientMsgId } = await this.backend.sendText(
+      group,
+      text,
+      replyRef,
+      bodyRanges,
+      expiry
+    );
     this.appendOwnSend(text, receipt, clientMsgId, resolvedReplyTo, bodyRanges);
+    if (expiry) void this.armPurge(expiry, receipt.serverSeq, clientMsgId);
     return receipt;
   }
+  /** Set (or DISABLE) this chat's DEFAULT disappearing timer. Emits a `timer_set` control
+   * envelope (server-blind — an opaque application message, NEVER a bubble) and folds the
+   * own-set locally so the default applies immediately to subsequent sends that carry no
+   * per-message expiry. `ttlSeconds === null` DISABLES the default. FIRE-AND-FORGET
+   * ADVISORY: returns on the LOCAL emit only; it exposes NO "active for all peers" signal.
+   * Mirrors iOS `setDisappearing(ttlSeconds:start:)`. */
+  async setDisappearing(opts) {
+    const group = await this.materializeIfNeeded();
+    const clientMsgId = mintClientMsgId();
+    const start = opts.start ?? "send";
+    const { receipt } = await this.backend.sendTimerSet(group, {
+      clientMsgId,
+      ttlSeconds: opts.ttlSeconds,
+      start
+    });
+    this.timerFold.ingest({
+      ttlSeconds: opts.ttlSeconds,
+      start,
+      actorUserId: this.backend.selfUserId,
+      epoch: receipt.epoch,
+      serverSeq: receipt.serverSeq,
+      eventClientMsgId: clientMsgId
+    });
+  }
   appendOwnSend(text, receipt, clientMsgId, resolvedReplyTo, bodyRanges) {
     if (receipt.serverSeq <= 0) return;
     const key = this.internalKey(receipt.serverSeq);
@@ -4280,7 +4681,10 @@ var Chat = class {
       isDeleted: false,
       // Mentions T6: resolve the own-sent bubble's mentions for its own render (the
       // sender never gets a wire echo of its own message — this is the only local copy).
-      mentions: this.resolveMentions(text, bodyRanges)
+      mentions: this.resolveMentions(text, bodyRanges),
+      // Disappearing T10: the surfaced deadline is set by armPurge (own-send with a TTL)
+      // via the messageList overlay; default null here (a plain own-send has no deadline).
+      expiresAt: null
     });
     this.messageList.sort((a, b) => a.serverSeq - b.serverSeq);
     this.emit();
@@ -4635,6 +5039,7 @@ var MessageDeliverySource = class {
         const isReaction = decoded.type === "reaction" && decoded.reaction != null;
         const isEdit = decoded.type === "edit" && decoded.edit != null;
         const isDelete = decoded.type === "delete" && decoded.delete != null;
+        const isTimerSet = decoded.type === "timer_set" && decoded.timer != null;
         const senderDeviceId = row.sender_device_id ?? decodeSenderDeviceId(received.sender);
         const stored = {
           id: `${group.rfcGroupId}#${row.server_seq}`,
@@ -4692,7 +5097,18 @@ var MessageDeliverySource = class {
               targetClientMsgId: decoded.delete.targetClientMsgId,
               scope: decoded.delete.scope
             }
-          } : {}
+          } : {},
+          // Disappearing T10: thread the timer_set discriminator + payload through the
+          // persisted row so the chat default re-folds on cold launch (the page-local
+          // TimerFold in projectHistory). Omitted for non-timer_set rows (backward-compat).
+          ...isTimerSet && decoded.timer ? {
+            envelopeType: "timer_set",
+            timer: { ttlSeconds: decoded.timer.ttlSeconds, start: decoded.timer.start }
+          } : {},
+          // Disappearing T10: thread a TEXT bubble's per-message expiry through the persisted
+          // row so the message re-arms its purge on cold launch (the projection derives the
+          // deadline from this). Only on a text bubble; omitted when absent (backward-compat).
+          ...!isReaction && !isEdit && !isDelete && !isTimerSet && decoded.expiry ? { expiry: decoded.expiry } : {}
         };
         try {
           await this.messageStore.append(group.rfcGroupId, stored);
@@ -4715,7 +5131,12 @@ var MessageDeliverySource = class {
           delete: isDelete ? decoded.delete : null,
           // The raw mention ranges (text bubble or the edit's replacement ranges); the
           // Chat normalizes + resolves names → ChatMessage.mentions (T6).
-          bodyRanges: decoded.bodyRanges ?? null
+          bodyRanges: decoded.bodyRanges ?? null,
+          // Disappearing T10: the decoded timer_set payload (chat default control) + a text
+          // bubble's per-message expiry. The Chat routes timer_set into its TimerFold and
+          // arms a bubble's purge from the expiry (or the active default).
+          timer: isTimerSet ? decoded.timer : null,
+          expiry: !isReaction && !isEdit && !isDelete && !isTimerSet ? decoded.expiry ?? null : null
         });
         return true;
       }
@@ -4794,6 +5215,67 @@ function isOwnEchoOrConsumed(e) {
   return msg.includes("message from self") || msg.includes("key not available, invalid generation");
 }
 
+// src/messaging/disappearing.ts
+var DisappearingStore = class {
+  constructor(kv) {
+    this.kv = kv;
+  }
+  kv;
+  key(rfc) {
+    return `disappear:${rfc}`;
+  }
+  async load(rfc) {
+    const raw = await this.kv.get(this.key(rfc));
+    if (!raw) return { tombstonedSeqs: [], purgedClientMsgIds: [], anchors: {} };
+    try {
+      const r = JSON.parse(decodeUtf8(raw));
+      return {
+        tombstonedSeqs: r.tombstonedSeqs ?? [],
+        purgedClientMsgIds: r.purgedClientMsgIds ?? [],
+        anchors: r.anchors ?? {}
+      };
+    } catch {
+      return { tombstonedSeqs: [], purgedClientMsgIds: [], anchors: {} };
+    }
+  }
+  async save(rfc, rec) {
+    await this.kv.set(this.key(rfc), encodeUtf8(JSON.stringify(rec)));
+  }
+  /** The persisted INTEGER `server_seq` tombstone set for a chat (transcript exclusion + redelivery drop). */
+  async tombstonedSeqs(rfc) {
+    return new Set((await this.load(rfc)).tombstonedSeqs);
+  }
+  /** The persisted STRING `client_msg_id` purge set for a chat (orphan-fold → `'purged'`). */
+  async purgedClientMsgIds(rfc) {
+    return new Set((await this.load(rfc)).purgedClientMsgIds);
+  }
+  /**
+   * Tombstone-first commit point: the INTEGER seq and the STRING client_msg_id are
+   * written together in ONE durable record. Idempotent (re-tombstoning the same seq /
+   * id is a no-op). This write is THE purge commit — once it lands, a transcript rebuilt
+   * from the store excludes the seq and a redelivery is dropped, even across a crash.
+   */
+  async tombstone(rfc, serverSeq, clientMsgId) {
+    const rec = await this.load(rfc);
+    if (!rec.tombstonedSeqs.includes(serverSeq)) rec.tombstonedSeqs.push(serverSeq);
+    if (clientMsgId && !rec.purgedClientMsgIds.includes(clientMsgId)) {
+      rec.purgedClientMsgIds.push(clientMsgId);
+    }
+    await this.save(rfc, rec);
+  }
+  /** The persisted write-once anchor triple for a `clientMsgId`, or null if none. */
+  async anchor(rfc, clientMsgId) {
+    return (await this.load(rfc)).anchors[clientMsgId] ?? null;
+  }
+  /** Write-once: a second call for the same `clientMsgId` is a no-op (deadline never resets). */
+  async writeAnchorOnce(rfc, clientMsgId, a) {
+    const rec = await this.load(rfc);
+    if (rec.anchors[clientMsgId]) return;
+    rec.anchors[clientMsgId] = a;
+    await this.save(rfc, rec);
+  }
+};
+
 // src/messaging/history.ts
 var MessageStore = class {
   constructor(kv) {
@@ -6608,6 +7090,7 @@ var MessagingCoordinator = class {
     this.kpStore = new KeyPackageStorage(this.kv);
     this.suppressionStore = new SuppressionStore(this.kv);
     this.elevationStore = new MentionElevationStore(this.kv);
+    this.disappearingStore = new DisappearingStore(this.kv);
     this.registry.attachChatList(
       (chats) => {
         this.chatList = chats;
@@ -6624,6 +7107,7 @@ var MessagingCoordinator = class {
   kpStore;
   suppressionStore;
   elevationStore;
+  disappearingStore;
   registry = new GroupRegistry();
   resolved = null;
   resolvePromise = null;
@@ -6795,6 +7279,10 @@ var MessagingCoordinator = class {
     const r = await this.resolve();
     return r.groups.sendDelete(group, args);
   }
+  async sendTimerSet(group, args) {
+    const r = await this.resolve();
+    return r.groups.sendTimerSet(group, args);
+  }
   /** Load this chat's persisted delete-for-me suppression keys (durable-only). */
   loadSuppressed(group) {
     return this.suppressionStore.load(group.rfcGroupId);
@@ -6811,10 +7299,28 @@ var MessagingCoordinator = class {
   saveElevated(group, keys) {
     return this.elevationStore.save(group.rfcGroupId, keys);
   }
+  // ── Disappearing / TTL seam (durable-only, no wire) ──
+  tombstonedSeqs(group) {
+    return this.disappearingStore.tombstonedSeqs(group.rfcGroupId);
+  }
+  purgedClientMsgIds(group) {
+    return this.disappearingStore.purgedClientMsgIds(group.rfcGroupId);
+  }
+  anchor(group, clientMsgId) {
+    return this.disappearingStore.anchor(group.rfcGroupId, clientMsgId);
+  }
+  writeAnchorOnce(group, clientMsgId, a) {
+    return this.disappearingStore.writeAnchorOnce(group.rfcGroupId, clientMsgId, a);
+  }
+  tombstone(group, serverSeq, clientMsgId) {
+    return this.disappearingStore.tombstone(group.rfcGroupId, serverSeq, clientMsgId);
+  }
   async history(group, limit, before) {
     const r = await this.resolve();
     const rows = await r.messageStore.history(group.rfcGroupId, limit, before);
-    return projectHistory(group.displayId, rows, this.selfUserId);
+    const tombstoned = await this.disappearingStore.tombstonedSeqs(group.rfcGroupId);
+    const purged = await this.disappearingStore.purgedClientMsgIds(group.rfcGroupId);
+    return projectHistory(group.displayId, rows, this.selfUserId, void 0, tombstoned, purged);
   }
   async members(group) {
     const r = await this.resolve();
@@ -6891,9 +7397,10 @@ var MessagingCoordinator = class {
     return res.devices.map((d) => d.device_id);
   }
 };
-function projectHistory(displayId, rows, selfUserId, resolveActor) {
+function projectHistory(displayId, rows, selfUserId, resolveActor, tombstonedSeqs = /* @__PURE__ */ new Set(), purgedClientMsgIds = /* @__PURE__ */ new Set()) {
+  const visible = rows.filter((s) => !tombstonedSeqs.has(s.serverSeq));
   const fold = new ReactionFold();
-  for (const s of rows) {
+  for (const s of visible) {
     if (s.envelopeType !== "reaction" || !s.reaction) continue;
     const actor = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null) ?? null;
     if (actor === null) continue;
@@ -6909,17 +7416,22 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
   }
   const editFold = new EditFold();
   const deleteFold = new DeleteFold();
+  const pageTimerFold = new TimerFold();
   const authorByClientMsgId = /* @__PURE__ */ new Map();
-  for (const s of rows) {
-    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete")
+  for (const s of visible) {
+    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete" || s.envelopeType === "timer_set")
       continue;
     const cid = s.clientMsgId ?? "";
     if (!cid) continue;
     const author = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null);
     if (author != null) authorByClientMsgId.set(cid, author);
   }
-  const authorOfTarget = (cid) => authorByClientMsgId.get(cid) ?? null;
-  for (const s of rows) {
+  const authorOfTarget = (cid) => {
+    if (purgedClientMsgIds.has(cid)) return { kind: "purged" };
+    const a = authorByClientMsgId.get(cid);
+    return a !== void 0 ? { kind: "author", userId: a } : { kind: "unknown" };
+  };
+  for (const s of visible) {
     if (s.envelopeType !== "edit" || !s.edit) continue;
     const editor = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null) ?? null;
     editFold.ingest(
@@ -6938,7 +7450,7 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
     );
   }
   editFold.reevaluateHeld(authorOfTarget);
-  for (const s of rows) {
+  for (const s of visible) {
     if (s.envelopeType !== "delete" || !s.delete) continue;
     const actor = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null) ?? null;
     deleteFold.ingest(
@@ -6952,10 +7464,10 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
       authorOfTarget
     );
   }
-  for (const [cid, author] of authorByClientMsgId) deleteFold.reevaluatePending(cid, author);
+  for (const [cid] of authorByClientMsgId) deleteFold.reevaluatePending(cid, authorOfTarget(cid));
   const lookup = /* @__PURE__ */ new Map();
-  for (const s of rows) {
-    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete")
+  for (const s of visible) {
+    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete" || s.envelopeType === "timer_set")
       continue;
     const cid = s.clientMsgId ?? "";
     if (cid && s.text !== null) {
@@ -6964,7 +7476,21 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
     }
   }
   const out = [];
-  for (const s of rows) {
+  for (const s of visible) {
+    if (s.envelopeType === "timer_set") {
+      const actor = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null) ?? null;
+      if (actor !== null && s.timer) {
+        pageTimerFold.ingest({
+          ttlSeconds: s.timer.ttlSeconds,
+          start: s.timer.start,
+          actorUserId: actor,
+          epoch: s.epoch,
+          serverSeq: s.serverSeq,
+          eventClientMsgId: s.clientMsgId ?? `${s.id}`
+        });
+      }
+      continue;
+    }
     if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete")
       continue;
     const clientMsgId = s.clientMsgId ?? "";
@@ -6984,10 +7510,21 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
         edited: false,
         isDeleted: true,
         // Mentions T6: delete DOMINATES mentions too — a tombstoned message has none.
-        mentions: []
+        mentions: [],
+        // delete DOMINATES disappearing too — a tombstoned message carries no deadline.
+        expiresAt: null
       });
       continue;
     }
+    let expiresAt = null;
+    if (s.expiry) {
+      expiresAt = new Date(s.at + s.expiry.ttlSeconds * 1e3);
+    } else {
+      const active = pageTimerFold.active();
+      if (active && active.ttlSeconds !== null) {
+        expiresAt = new Date(s.at + active.ttlSeconds * 1e3);
+      }
+    }
     let replyTo = null;
     if (s.replyTo) {
       const ref = {
@@ -7020,7 +7557,8 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
       reactions: clientMsgId ? fold.tally(clientMsgId) : {},
       edited,
       isDeleted: false,
-      mentions
+      mentions,
+      expiresAt
     });
   }
   return out;
@@ -7767,7 +8305,7 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "1.5.0";
+var VERSION = "1.6.0";
 
 // src/runtime.ts
 function buildRuntime(config) {