agentic-comments 0.5.1 → 0.6.0

package/README.md

@@ -53,6 +53,39 @@ normal sync, and every replica sees the same threads.
 - A malformed thread from a bad replica is skipped. A bad message is left out, and `skipped` on the
   thread counts those. `problems()` names them.
 
+## Edit, delete, export, and erase
+
+- `comments.editMessage(threadId, messageId, { body, mentions? }, actor)` changes a body. The id, author,
+  time, and place stay. The message gets `editedAt` and `editedBy`. A resolved thread refuses an edit.
+- `comments.deleteMessage(threadId, messageId, actor)` removes one message. The last message of a thread
+  stays: delete the thread instead.
+- `comments.deleteThread(threadId, actor)` removes a thread. Its author can do it while every message is theirs.
+- `comments.exportPerson(name, actor)` returns the messages a person wrote, the status change of theirs that
+  stands, and their edits to other people's messages. It holds no one else's words. `unread` counts stored
+  entries with their name that the read cannot show (a bad message, an unreadable thread). When it is not 0,
+  the export is not complete. `suggestions.exportPerson` lists their suggestions and decisions, with its own `unread` count.
+- `comments.erasePerson(name, actor)` replaces each message of that person with a tombstone: the body is
+  `[erased]`, the author name is `erased`, and mentions go. The author kind stays, so machine-made work stays
+  marked. The thread keeps its shape, order, and times. It works on the stored entries, so it also reaches a bad
+  message, a message past the read limit, and a copy that a merge hid. A status change of theirs and their name
+  as an editor get the tombstone name. `suggestions.erasePerson` does the same for their suggestions
+  (it drops the summary, and the change of a pending or rejected one, which can then no longer be accepted)
+  and their decisions. No principal can have the name `erased`.
+
+A self-export or self-erase covers only the actor's own kind: a message that `human:ada` wrote and one that
+`user_token:ada` wrote are two principals, and `unread` does not count the other kind. Ask a moderator for
+both. Erase rewrites a status record, so an erase and a real status change made at once on two replicas keep
+only one of them. An accepted suggestion keeps its `change`, which is still the author's text.
+
+Only the author can edit or delete a message, and a person can export or erase their own data: the same kind
+and name. A principal with the `comments:moderate` scope (`MODERATE_SCOPE`) can do it for anyone, and an
+export or erase by a moderator covers every kind with that name. The host gives that scope to an owner or
+admin. An edit made by a moderator records the moderator in `editedBy`. Nobody but a moderator can delete an
+erased message or a thread that holds one.
+
+Replicas that edit one message at once leave a copy each. When the copies agree on the author kind and time,
+the read keeps the erased copy, or else the latest edit. An edit and a delete made at once keep the edit.
+
 ## Anchors for plain text
 
 `agentic-comments/anchor` pins a range of a plain string. It needs no Yjs and no framework.
@@ -173,8 +206,8 @@ AGENTIC_COMMENTS_AS=agent_of_human:scribe npx agentic-comments suggest --text-qu
 npx agentic-comments accept <id>
 ```
 
-- Commands: `init`, `list`, `show`, `comment`, `reply`, `resolve`, `reopen`, `relocate`, `suggestions`,
-  `suggest`, `accept`, `reject`, `mcp`. Run `npx agentic-comments --help` for flags.
+- Commands: `init`, `list`, `show`, `comment`, `reply`, `resolve`, `reopen`, `relocate`, `edit-message`,
+  `delete-message`, `delete-thread`, `export-person`, `erase-person`, `suggestions`, `suggest`, `accept`, `reject`, `mcp`. Run `npx agentic-comments --help` for flags.
 - Every result is JSON. An error is JSON on stderr with a `code`, and the exit code is 1. A usage error
   exits 2.
 - The principal comes from `--as` or `AGENTIC_COMMENTS_AS`, as `kind:name`. The name starts with A-Z a-z 0-9 `_` `-`, then uses A-Z a-z 0-9 `.` `_` `-`, and is at most 128 characters. Scopes come only from
@@ -185,8 +218,10 @@ npx agentic-comments accept <id>
   the MCP server on stdio. The operator fixes the principal and the
   scopes when the server starts. No tool takes an author or a scope. A call with any key a tool does not list is refused, so an agent
   cannot pick its own kind or rights. Tools: `list_threads`, `get_thread`, `add_comment`, `reply_to_thread`, `resolve_thread`,
-  `reopen_thread`, `relocate_thread`, `list_suggestions`, `suggest_change`, `accept_suggestion`,
-  `reject_suggestion`.
+  `reopen_thread`, `relocate_thread`, `edit_message`, `delete_message`, `delete_thread`, `export_person`,
+  `erase_person`, `list_suggestions`, `suggest_change`, `accept_suggestion`, `reject_suggestion`.
+  Another person's message, thread, or data needs `comments:moderate` in `AGENTIC_COMMENTS_SCOPES`. The delete
+  tools and `erase_person` carry the destructive hint.
 - A text change is `{"replace": "new text"}`. A change for a cell, slide, or canvas anchor is
   `{"value": <JSON>}`.
 - From code: `import { FileStore, CommentsService, operatorActor } from "agentic-comments/local"`.
@@ -197,17 +232,26 @@ npx agentic-comments accept <id>
 document in a D1 database through the `Store` port of `agentic-identity`. It checks every request with the
 `Auth` port, so the host picks who the caller is and no request carries an author.
 
-Set the principals as a secret. It is JSON from a bearer token to `kind:name`, or to
-`{ "as": "kind:name", "scopes": [...] }`. A token is 32 to 512 bytes, from A-Z a-z 0-9 `_` `-`, so a base64 token with `+` or `/` is refused.
-A name starts with A-Z a-z 0-9 `_` `-`, then uses A-Z a-z 0-9 `.` `_` `-`, and is at most 128 characters.
-One bad entry refuses the whole table. A request with no valid token gets `401`.
+By default the Worker signs requests in with `agentic-identity`. Principals and their credentials live in the same
+`Store` as the documents (`createStoreAuth`). A request sends `Authorization: Bearer <key>`. The scopes of the
+principal decide what it may do (see the table below). A request with no valid credential gets `401`. A valid
+credential whose scopes fall short gets `403`. A store failure while the credential is read gets `503`, never `401`.
+Issue credentials with `issueCredential` from `agentic-identity`.
 A request whose `Authorization` header is not `Bearer` followed by 1 to 512 bytes of A-Z a-z 0-9 `_` `-` gets `401`, before any custom `Auth` runs.
 A write with no `Authorization` header (a session cookie, for example) gets `403` unless its `Origin` is in the `origins`
 option of `createApp`. The default lists none.
 
+**Static token list (dev fallback).** `AGENTIC_COMMENTS_TOKENS` is read only when `AGENTIC_COMMENTS_UNSAFE_STATIC_TOKENS=1`.
+Identity credentials are tried first, then the list. A Worker that sets the list without the switch answers every
+`/api/v1` request with `503 NOT_CONFIGURED`. The list is JSON from a bearer token to `kind:name`, or to
+`{ "as": "kind:name", "scopes": [...] }`. A token is 32 to 512 bytes, from A-Z a-z 0-9 `_` `-`.
+A name starts with A-Z a-z 0-9 `_` `-`, then uses A-Z a-z 0-9 `.` `_` `-`, and is at most 128 characters.
+One bad entry refuses the whole table. A token with no scopes holds `comments:comment`. Never use the list in production.
+
 ```sh
 wrangler secret put AGENTIC_COMMENTS_TOKENS
 # {"<openssl rand -hex 32>": {"as": "human:ada", "scopes": ["comments:write"]}, "<another>": "agent_of_human:scribe"}
+wrangler secret put AGENTIC_COMMENTS_UNSAFE_STATIC_TOKENS   # the value is 1
 ```
 
 Also set `AGENTIC_COMMENTS_REGION` to `eu` or `us`. Without it every document route fails with `500 MISCONFIGURED`. Use `unknown` with
@@ -216,9 +260,13 @@ Also set `AGENTIC_COMMENTS_REGION` to `eu` or `us`. Without it every document ro
 | Scope | Allows |
 | --- | --- |
 | `comments:read` | Read documents, threads, and suggestions. |
-| `comments:comment` | Also add threads, reply, resolve, reopen, and suggest. This is the default for a token with no scopes. |
+| `comments:comment` | Also add threads, reply, resolve, reopen, and suggest. This is the default for a static-list token with no scopes. |
 | `comments:write` | Also create documents, relocate, and accept or reject. |
-| `comments:admin` | Also let an agent accept or reject (the `comments:accept` right). |
+| `comments:admin` | Also let an agent accept or reject (the `comments:accept` right), and edit, delete, export, or erase what another person wrote (the `comments:moderate` right). |
+
+With `comments:comment` a principal edits and deletes its own messages, deletes a thread when every message is
+its own, and erases its own data. With `comments:read` it can export its own data, and it cannot change anything.
+Export of another person's data and any change to another person's words need `comments:admin`.
 
 | Route | Action |
 | --- | --- |
@@ -229,6 +277,10 @@ Also set `AGENTIC_COMMENTS_REGION` to `eu` or `us`. Without it every document ro
 | `GET /api/v1/docs/:doc/threads/:id` | Read one thread. |
 | `POST /api/v1/docs/:doc/threads/:id/replies` | Reply. |
 | `POST .../threads/:id/resolve`, `reopen`, `relocate` | Change a thread. |
+| `PATCH`, `DELETE .../threads/:id/messages/:message` | Edit (`{body, mentions?}`) or delete a message. |
+| `DELETE .../threads/:id` | Delete a thread. |
+| `GET .../people/:name/export` | Export what a person wrote in this document (`comments:read` for yourself, `comments:admin` for anyone). |
+| `DELETE .../people/:name` | Erase what a person wrote in this document: replace it with a tombstone (`comments:comment` for yourself, `comments:admin` for anyone). |
 | `GET`, `POST /api/v1/docs/:doc/suggestions` | List or suggest. |
 | `POST .../suggestions/:id/accept`, `reject` | Decide. An agent never decides its own suggestion. |
 
@@ -261,7 +313,7 @@ try {
 ```
 
 - The methods match the routes: `me`, `createDocument`, `getDocument`, `listThreads`, `getThread`, `addThread`, `reply`,
-  `resolve`, `reopen`, `relocate`, `listSuggestions`, `suggest`, `accept`, `reject`. Each takes an optional `{ signal }`.
+  `resolve`, `reopen`, `relocate`, `editMessage`, `deleteMessage`, `deleteThread`, `exportPerson`, `erasePerson`, `listSuggestions`, `suggest`, `accept`, `reject`. Each takes an optional `{ signal }`.
 - `baseUrl` is the Worker URL, `http` or `https`, with no query, hash, or credentials.
 - The client never sends an author. The Worker stamps one from the token.
 - A failed call throws `CommentsApiError`. `code` is the API error code, or `UNKNOWN` when the reply is not an API
@@ -280,7 +332,7 @@ To deploy your own copy, log in with `wrangler login` or set `CLOUDFLARE_API_TOK
 
 ```sh
 npx wrangler d1 create agentic-comments-demo --location weur   # once. Put the id in wrangler.demo.jsonc.
-npx wrangler secret put AGENTIC_COMMENTS_TOKENS --config wrangler.demo.jsonc   # see HTTP API
+npx wrangler secret put AGENTIC_COMMENTS_TOKENS --config wrangler.demo.jsonc   # the demo uses the static list. See HTTP API
 npm run deploy:demo
 ```
 
@@ -361,7 +413,8 @@ const stop = notifications.subscribe(async (event) => {
 - Events come from the data and not from the calls, so a status change that two replicas make at once gives
   each replica its own event, and a thread that arrives whole gives events for its current state only.
 - Every replica of a document must register the same custom anchor kinds.
-- A repeated message id hides every copy. A peer that appends a copy of a thread's only message makes
+- Export and erase work on one document. A person who wrote in many documents needs one call for each.
+- A repeated message id hides every copy, unless every copy is an edit: then the read keeps one. A peer that appends a copy of a thread's only message makes
   the thread unreadable.
 - The quoted text of a text anchor is not checked when a thread is read. A peer can store any text there.
   `textAnchor` refuses a quote whose JSON form passes 4,096 characters. Quotes with many newlines or
@@ -372,6 +425,14 @@ const stop = notifications.subscribe(async (event) => {
 - A body mentions anyone named as `@handle`. Put `@` text in backticks to avoid that. Any two backticks in a body pair up, so a loose backtick
   can hide a real mention that sits between two of them. A scoped
   package name such as `@scope/pkg` is not a mention.
+- Erase does not touch a name that another person typed in their own message.
+- Replicas that delete two messages of one thread at once can leave a thread with no message. Only a moderator
+  can delete it. A reply made on another replica at the same time as `deleteThread` is lost with the thread.
+- After you merge replicas, run `exportPerson`. When `unread` is not 0, a copy that the merge hid or a bad entry
+  still holds the person's name: run `erasePerson` again. An entry whose author is not valid cannot be tied to
+  a person, so export and erase skip it. An edit or an erase makes no notification event, also when two replicas edit one message at once. A delete works on a resolved thread, and an edit does not.
+- Yjs drops the old text of a deleted or replaced message only when the document has garbage collection on
+  (the default). A copy that you saved before an erase or delete still holds it.
 - Mentions are stored in lowercase, with no leading `@`. A handle holds up to 64 letters, digits, marks,
   and `. _ -`. A longer handle in a body is refused.
 

package/SKILL.md

@@ -25,8 +25,12 @@ Check `thread.anchorState`. An `orphaned` thread has lost its content. Read it,
 Suggest a change with `suggestions.add({ anchor, change, summary }, actor)`. Accept needs a person or
 the `comments:accept` scope. You never accept or reject your own suggestion.
 
+Change your own words with `edit_message`, `delete_message`, and `delete_thread`. Another person's messages need the
+`comments:moderate` scope. `export_person` and `erase_person` read or tombstone what one person wrote (your own, or
+anyone's with that scope). Check `unread` in an export.
+
 Over MCP, call `list_threads`, `add_comment`, `reply_to_thread`, `resolve_thread`, `suggest_change`,
-`accept_suggestion`, and `reject_suggestion`. You never pass an author or a scope.
+`accept_suggestion`, `reject_suggestion`, and the tools above. You never pass an author or a scope.
 
 ## Rules
 

package/dist/{chunk-QJXI3P5D.js → chunk-2NBFTJ47.js}

@@ -2,7 +2,7 @@ import {
   CommentsError,
   PRINCIPAL_KINDS,
   stamp
-} from "./chunk-BSNBDKR2.js";
+} from "./chunk-VAVKBAHM.js";
 
 // src/file-store.ts
 import { createHash } from "crypto";

package/dist/{chunk-REFQNIEP.js → chunk-ES3NZ7SX.js}

@@ -1,6 +1,6 @@
 // src/version.ts
 import { createRequire } from "module";
-var VERSION = true ? "0.5.1" : readPackageVersion();
+var VERSION = true ? "0.6.0" : readPackageVersion();
 
 export {
   VERSION

package/dist/{chunk-TFRLOBJW.js → chunk-SR2A5OZW.js}

@@ -1,12 +1,12 @@
 import {
   VERSION
-} from "./chunk-REFQNIEP.js";
+} from "./chunk-ES3NZ7SX.js";
 import {
   CommentsService
-} from "./chunk-NQWRFKJ6.js";
+} from "./chunk-T77DPNIV.js";
 import {
   CommentsError
-} from "./chunk-BSNBDKR2.js";
+} from "./chunk-VAVKBAHM.js";
 
 // src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -21,6 +21,8 @@ var anchor = z.discriminatedUnion("type", [
 ]).describe("Where the thread or suggestion points.");
 var id = z.string().describe("The thread or suggestion id.");
 var body = z.string().describe("The message text. Write @handle to mention someone.");
+var messageId = z.string().describe("The message id, from get_thread.");
+var person = z.string().describe("The name of the person, as shown on their messages.");
 var mentions = z.array(z.string()).optional().describe("Extra handles to mention.");
 function ok(value) {
   return { content: [{ type: "text", text: JSON.stringify(value) }] };
@@ -33,10 +35,10 @@ function createMcpServer(store, actor) {
   const service = new CommentsService(store, actor);
   const server = new McpServer({ name: "agentic-comments", version: VERSION });
   const tools = /* @__PURE__ */ new Map();
-  const tool = (name, description, shape, readOnly, run) => {
+  const tool = (name, description, shape, readOnly, run, destructive = false) => {
     const strict = z.object(shape).strict();
     tools.set(name, { strict, run });
-    server.registerTool(name, { description, inputSchema: strict, annotations: { readOnlyHint: readOnly, destructiveHint: false, openWorldHint: false } }, (() => {
+    server.registerTool(name, { description, inputSchema: strict, annotations: { readOnlyHint: readOnly, destructiveHint: destructive, openWorldHint: false } }, (() => {
       throw new Error("calls are handled by the server");
     }));
   };
@@ -48,6 +50,11 @@ function createMcpServer(store, actor) {
   tool("resolve_thread", "Resolve a thread.", { id }, false, (i) => service.resolve(i.id));
   tool("reopen_thread", "Reopen a resolved thread.", { id }, false, (i) => service.reopen(i.id));
   tool("relocate_thread", "Move a text anchor to its quote when the quote occurs exactly once.", { id }, false, (i) => service.relocate(i.id));
+  tool("edit_message", "Change the body of a message you wrote. Needs the moderate scope for another person's message.", { id, messageId, body, mentions }, false, (i) => service.editMessage(i.id, i.messageId, { body: i.body, mentions: i.mentions }), true);
+  tool("delete_message", "Delete a message you wrote. The last message of a thread stays: delete the thread instead.", { id, messageId }, false, (i) => service.deleteMessage(i.id, i.messageId), true);
+  tool("delete_thread", "Delete a thread. Works while every message is yours. Otherwise it needs the moderate scope.", { id }, false, (i) => service.deleteThread(i.id), true);
+  tool("export_person", "Export the messages, status changes, and suggestions one person wrote. Your own, or any with the moderate scope.", { person }, true, (i) => service.exportPerson(i.person));
+  tool("erase_person", "Replace everything one person wrote with a tombstone. The thread shape stays. Your own, or any with the moderate scope.", { person }, false, (i) => service.erasePerson(i.person), true);
   tool("list_suggestions", "List suggested changes.", { status: z.enum(["pending", "accepted", "rejected"]).optional(), anchorState: state }, true, (i) => service.suggestions(i));
   tool(
     "suggest_change",

package/dist/{chunk-NQWRFKJ6.js → chunk-T77DPNIV.js}

@@ -7,7 +7,7 @@ import {
   textAnchor,
   textOf,
   textRange
-} from "./chunk-BSNBDKR2.js";
+} from "./chunk-VAVKBAHM.js";
 
 // src/local-host.ts
 import * as Y from "yjs";
@@ -144,6 +144,26 @@ var CommentsService = class {
   relocate(threadId) {
     return this.write(({ comments }) => comments.relocate(threadId, this.actor));
   }
+  editMessage(threadId, messageId, input) {
+    return this.write(({ comments }) => comments.editMessage(threadId, messageId, exact(input, ["body", "mentions"], "an edit"), this.actor));
+  }
+  deleteMessage(threadId, messageId) {
+    return this.write(({ comments }) => comments.deleteMessage(threadId, messageId, this.actor));
+  }
+  deleteThread(threadId) {
+    return this.write(({ comments }) => comments.deleteThread(threadId, this.actor));
+  }
+  /** Everything the store holds that this person wrote: messages, status changes, and suggestions. */
+  exportPerson(person) {
+    return this.read(({ comments, suggestions }) => ({ ...comments.exportPerson(person, this.actor), suggestions: suggestions.exportPerson(person, this.actor) }));
+  }
+  /** Tombstone everything this person wrote. Both parts are checked before either is written. */
+  erasePerson(person) {
+    return this.write(({ comments, suggestions }) => {
+      comments.checkPerson(person, this.actor);
+      return { ...comments.erasePerson(person, this.actor), ...suggestions.erasePerson(person, this.actor) };
+    });
+  }
   suggestions(filter = {}) {
     const given = exact(filter, ["status", "anchorState"], "a filter");
     return this.read(({ suggestions }) => suggestions.list(given));

package/dist/{chunk-BSNBDKR2.js → chunk-VAVKBAHM.js}

@@ -115,6 +115,7 @@ function onlyOccurrence(type, quote) {
 
 // src/principal.ts
 import { PRINCIPAL_KINDS } from "agentic-identity";
+var ERASED_NAME = "erased";
 var MAX_NAME = 128;
 var issued = /* @__PURE__ */ new WeakSet();
 var Actor = class _Actor {
@@ -131,6 +132,7 @@ var Actor = class _Actor {
     const author = readAuthor(input);
     const given = author ? input.scopes : void 0;
     const scopes = given === void 0 ? [] : Array.isArray(given) ? Array.from(given) : void 0;
+    if (author?.name === ERASED_NAME) throw new CommentsError("INVALID_AUTHOR", `the name "${ERASED_NAME}" is kept for erased authors`);
     if (!author || !scopes || !scopes.every((s) => typeof s === "string" && s !== "")) {
       throw new CommentsError("INVALID_AUTHOR", `an author needs a kind (${PRINCIPAL_KINDS.join(", ")}), a name, and scopes that are a list of text`);
     }
@@ -187,7 +189,7 @@ var MAX_SUMMARY = 1e3;
 var SUGGESTIONS = "comments.suggestions";
 var APPLIED = "comments.suggestion-applied";
 var REJECTED = "comments.suggestion-rejected";
-var decidesOwn = (author, decider) => author.kind !== "human" && decider.kind !== "human" && author.name === decider.name;
+var decidesOwn = (author, decider) => author.name !== ERASED_NAME && author.kind !== "human" && decider.kind !== "human" && author.name === decider.name;
 var clientOf = (text) => /^(0|[1-9]\d{0,9})$/.test(text) && Number(text) <= 4294967295 ? Number(text) : void 0;
 var thenable = (value) => typeof value?.then === "function";
 var Suggestions = class {
@@ -308,6 +310,66 @@ var Suggestions = class {
     if (typeof id2 !== "string" || !ID.test(id2) || !this.map.has(id2)) throw new CommentsError("NO_SUGGESTION", `no suggestion with id ${shown(id2)}`);
     return { id: id2, fields: this.map.get(id2) };
   }
+  /**
+   * The suggestions a person wrote, and the decisions they made, in this document. `unread` counts stored
+   * suggestions and decision records with their name that this export cannot show: a suggestion that cannot
+   * be read, a decision that lost a merge, a refused decision, or a decision with no suggestion. When it is not
+   * 0 the export is not complete. A person may export their own data.
+   */
+  exportPerson(person, actor) {
+    const { match } = this.comments.checkPerson(person, actor);
+    const all = this.list();
+    const authored = all.filter((s) => match(s.author));
+    const decided = all.flatMap((s) => s.decidedBy && s.decidedAt && s.status !== "pending" && match(s.decidedBy) ? [{ id: s.id, status: s.status, at: s.decidedAt }] : []);
+    let found = 0;
+    for (const fields of this.map.values()) if (fields instanceof Y2.Map && this.named(fields.get("author"), match)) found++;
+    for (const map of [this.applied, this.rejected]) for (const raw of map.values()) if (this.named(raw?.by, match)) found++;
+    return { authored, decided, unread: Math.max(0, found - authored.length - decided.length) };
+  }
+  named(value, match) {
+    const author = readAuthor(value);
+    return author !== void 0 && match(author);
+  }
+  /**
+   * Give every suggestion a person wrote a tombstone author and drop its summary. An accepted one keeps its
+   * change, because that change is already part of the content. A pending or rejected one loses its change, and
+   * can no longer be accepted. A decision they made gets a tombstone decider. A decision that a read refuses (a
+   * principal that decided its own work) is deleted, so erase never turns it into a valid one. Returns how many
+   * suggestions and decisions it changed.
+   */
+  erasePerson(person, actor) {
+    const { match } = this.comments.checkPerson(person, actor);
+    const out = { suggestions: 0, decisions: 0 };
+    const authors = /* @__PURE__ */ new Map();
+    for (const [id2, fields] of this.map.entries()) {
+      const author = fields instanceof Y2.Map ? readAuthor(fields.get("author")) : void 0;
+      if (author) authors.set(id2, author);
+    }
+    const status = new Map(this.list().map((s) => [s.id, s.status]));
+    this.ydoc.transact(() => {
+      for (const map of [this.applied, this.rejected]) {
+        for (const [key2, raw] of [...map.entries()]) {
+          const by = readAuthor(raw?.by);
+          const author = authors.get(key2.slice(0, key2.lastIndexOf(":")));
+          if (!by || !(match(by) || author && match(author))) continue;
+          if (author && decidesOwn(author, by)) map.delete(key2);
+          else if (match(by)) {
+            map.set(key2, { ...raw, by: { kind: by.kind, name: ERASED_NAME } });
+            out.decisions++;
+          }
+        }
+      }
+      for (const [id2, author] of authors) {
+        if (!match(author)) continue;
+        const fields = this.map.get(id2);
+        fields.set("author", { kind: author.kind, name: ERASED_NAME });
+        fields.delete("summary");
+        if (status.get(id2) !== "accepted") fields.set("change", null);
+        out.suggestions++;
+      }
+    });
+    return out;
+  }
   /** Propose a change. Anyone can suggest. The host stamps the author. */
   add(input, actor) {
     const who = assertActor(actor);
@@ -335,6 +397,7 @@ var Suggestions = class {
   mayDecide(who, s, verb) {
     const ok = !decidesOwn(s.author, who) && (who.kind === "human" || who.scopes.includes(ACCEPT_SCOPE));
     if (!ok) throw new CommentsError("FORBIDDEN", `${who.kind}:${shown(who.name)} cannot ${verb} this suggestion: a signed-in person, or a principal with the ${ACCEPT_SCOPE} scope that did not write it, can`);
+    if (verb === "accept" && s.author.name === ERASED_NAME && s.status !== "accepted") throw new CommentsError("FORBIDDEN", "an erased suggestion has no change left and cannot be accepted");
   }
   /**
    * Apply the change as the accepting author and record the decision, in one step. Accepting an
@@ -461,6 +524,8 @@ var Suggestions = class {
 
 // src/threads.ts
 import * as Y3 from "yjs";
+var MODERATE_SCOPE = "comments:moderate";
+var ERASED_BODY = "[erased]";
 var THREADS = "comments.threads";
 var MAX_BODY = 1e4;
 var MAX_MENTIONS = 50;
@@ -605,7 +670,20 @@ var Comments = class {
       throw new Error("a message has no id, ISO time, valid author, or body");
     }
     if (!Array.isArray(m.mentions) || m.mentions.length > MAX_MENTIONS || !m.mentions.every(validHandle)) throw new Error("a message has bad mentions");
-    return { id: m.id, at: m.at, author, body: m.body, mentions: [...m.mentions] };
+    const editor = m.editedBy === void 0 ? void 0 : readAuthor(m.editedBy);
+    if (m.editedAt === void 0 !== (m.editedBy === void 0) || m.editedAt !== void 0 && !validDate(m.editedAt) || m.editedBy !== void 0 && !editor) {
+      throw new Error("a message has a bad edit stamp");
+    }
+    if (m.erased !== void 0 && (m.erased !== true || m.body !== ERASED_BODY || author.name !== ERASED_NAME || m.mentions.length > 0)) throw new Error("a message has a bad erased flag");
+    return {
+      id: m.id,
+      at: m.at,
+      author,
+      body: m.body,
+      mentions: [...m.mentions],
+      ...editor ? { editedAt: m.editedAt, editedBy: editor } : {},
+      ...m.erased ? { erased: true } : {}
+    };
   }
   /** A thread with a bad anchor or status is malformed. A bad message is skipped and named in `issues`. */
   read(id2, fields) {
@@ -622,11 +700,32 @@ var Comments = class {
       const raw = list.toArray();
       const counts = /* @__PURE__ */ new Map();
       for (const m of raw) counts.set(m?.id, (counts.get(m?.id) ?? 0) + 1);
+      const parsed = raw.map((entry) => {
+        try {
+          return { message: this.readMessage(entry) };
+        } catch (error) {
+          return { error };
+        }
+      });
+      const copies = (id3) => parsed.flatMap((p) => p.message?.id === id3 ? [p.message] : []);
       let past = 0;
-      raw.forEach((entry, index) => {
+      let superseded = 0;
+      parsed.forEach((entry, index) => {
         try {
-          const message = this.readMessage(entry);
-          if (counts.get(message.id) > 1) throw new Error("a message id repeats");
+          if (entry.error) throw entry.error;
+          const message = entry.message;
+          if (counts.get(message.id) > 1) {
+            const same = copies(message.id);
+            const names = new Set(same.filter((c) => !c.erased).map((c) => c.author.name));
+            const agree = same.every((c) => c.editedAt !== void 0 && c.at === message.at && c.author.kind === message.author.kind) && names.size <= 1;
+            if (same.length !== counts.get(message.id) || !agree) throw new Error("a message id repeats");
+            const rank = (c) => `${c.erased ? 1 : 0}${c.editedAt}${JSON.stringify(c)}`;
+            const best = same.reduce((a, b) => rank(b) > rank(a) ? b : a);
+            if (best !== message) {
+              superseded++;
+              return;
+            }
+          }
           if (messages.length >= READ_LIMIT) past++;
           else messages.push(message);
         } catch (error) {
@@ -636,7 +735,7 @@ var Comments = class {
       if (past > 0) issues.push(`${past} valid messages past the read limit are not shown`);
       if (messages.length === 0) throw new Error("the thread has no valid message");
       const anchor = this.parseAnchor(fields.get("anchor"));
-      const thread = { id: id2, anchor, anchorState: this.anchorState(anchor), status: state.status, statusBy: by, statusAt: state.at, messages, skipped: raw.length - messages.length };
+      const thread = { id: id2, anchor, anchorState: this.anchorState(anchor), status: state.status, statusBy: by, statusAt: state.at, messages, skipped: raw.length - messages.length - superseded };
       return { thread, issues };
     } catch (error) {
       throw new CommentsError("CORRUPT", `thread ${shown(id2)} is malformed: ${safeText(error instanceof Error ? error.message : error)}`);
@@ -715,6 +814,176 @@ var Comments = class {
   reopen(threadId, actor) {
     return this.setStatus(threadId, "open", actor);
   }
+  /** A principal may change what it wrote. A principal with the moderate scope may change what anyone wrote. A tombstone is nobody's. */
+  mayChange(who, message) {
+    return who.scopes.includes(MODERATE_SCOPE) || !message.erased && who.kind === message.author.kind && who.name === message.author.name;
+  }
+  forbid(who, what) {
+    throw new CommentsError("FORBIDDEN", `${who.kind}:${shown(who.name)} cannot ${what}: only its author, or a principal with the ${MODERATE_SCOPE} scope, can`);
+  }
+  /** Replace every stored copy of a message with `next`, or remove it when `next` is undefined. */
+  rewrite(fields, messageId, next) {
+    const list = fields.get("messages");
+    const at = list.toArray().flatMap((m, i) => m?.id === messageId ? [i] : []);
+    this.ydoc.transact(() => {
+      for (const i of [...at].reverse()) list.delete(i, 1);
+      if (next) list.insert(at[0], [copy(next)]);
+    });
+  }
+  find(threadId, messageId) {
+    const { id: id2, fields } = this.fields(threadId);
+    const { thread } = this.read(id2, fields);
+    const message = thread.messages.find((m) => m.id === messageId);
+    if (!message) throw new CommentsError("NO_MESSAGE", `thread ${shown(id2)} has no message with id ${shown(messageId)}`);
+    return { id: id2, fields, thread, message };
+  }
+  /** Change the body of a message. Its author and time stay, and it records who edited it and when. */
+  editMessage(threadId, messageId, input, actor) {
+    const who = assertActor(actor);
+    const given = exact(input, ["body", "mentions"], "an edit");
+    const text = body(given.body);
+    const { id: id2, fields, thread, message } = this.find(threadId, messageId);
+    if (message.erased) throw new CommentsError("FORBIDDEN", "an erased message cannot be edited");
+    if (!this.mayChange(who, message)) this.forbid(who, "edit this message");
+    if (thread.status === "resolved") throw new CommentsError("THREAD_RESOLVED", `thread ${shown(id2)} is resolved; reopen it to edit`);
+    const next = this.readEdited(message, text, given.mentions, who);
+    this.rewrite(fields, message.id, next);
+    return this.find(id2, message.id).message;
+  }
+  readEdited(message, text, explicit, who) {
+    const edited = { ...message, body: text, mentions: mentionsOf(text, explicit), editedAt: this.time(), editedBy: { kind: who.kind, name: who.name } };
+    try {
+      return this.readMessage(copy(edited));
+    } catch (error) {
+      return invalid(`the message cannot be stored: ${error.message}`);
+    }
+  }
+  /**
+   * Remove one message, also from a resolved thread. The last message of a thread stays: delete the thread instead. Replicas that delete
+   * two messages at once can leave a thread with none. A moderator can still delete that thread.
+   */
+  deleteMessage(threadId, messageId, actor) {
+    const who = assertActor(actor);
+    const { id: id2, fields, thread, message } = this.find(threadId, messageId);
+    if (!this.mayChange(who, message)) this.forbid(who, "delete this message");
+    if (thread.messages.length === 1) invalid(`thread ${shown(id2)} has only this message; delete the thread instead`);
+    this.rewrite(fields, message.id, void 0);
+    return { threadId: id2, messageId: message.id };
+  }
+  /**
+   * Remove a thread and all its messages. Its author may do it when every message is theirs. Once someone
+   * else replied, a message is erased, or a stored message cannot be read, it needs the moderate scope. A
+   * moderator can also remove a thread that cannot be read at all.
+   */
+  deleteThread(threadId, actor) {
+    const who = assertActor(actor);
+    const { id: id2, fields } = this.fields(threadId);
+    if (!who.scopes.includes(MODERATE_SCOPE)) {
+      const { thread } = this.read(id2, fields);
+      if (thread.skipped > 0 || !thread.messages.every((m) => this.mayChange(who, m))) this.forbid(who, "delete this thread");
+    }
+    this.map.delete(id2);
+    return { threadId: id2 };
+  }
+  /**
+   * Check who an export or erase is for, and that the actor may. A person may act on their own data: the same
+   * kind and name. A principal with the moderate scope may act on anyone's, and then every kind with that name is
+   * included. Returns the name and a test for an author. Used by `Suggestions`.
+   */
+  checkPerson(person, actor) {
+    const who = assertActor(actor);
+    if (typeof person !== "string" || person === "" || person !== person.trim() || person.length > 128) invalid("a person is a name of 1 to 128 characters");
+    if (person === ERASED_NAME) invalid("a tombstone is not a person");
+    const moderator = who.scopes.includes(MODERATE_SCOPE);
+    if (who.name !== person && !moderator) {
+      throw new CommentsError("FORBIDDEN", `${who.kind}:${shown(who.name)} cannot read or erase the data of another person without the ${MODERATE_SCOPE} scope`);
+    }
+    return { name: person, match: (a) => a.name === person && (moderator || a.kind === who.kind) };
+  }
+  /** The raw stored threads, for the code that must see data a read hides. `list` is missing when the message field is bad. */
+  stored() {
+    return [...this.map.entries()].flatMap(([id2, fields]) => fields instanceof Y3.Map ? [{ id: id2, fields, list: fields.get("messages") instanceof Y3.Array ? fields.get("messages") : void 0 }] : []);
+  }
+  /**
+   * What a person wrote in this document: their messages, the status change of theirs that stands, and the
+   * edits they made to other people's messages. `unread` counts stored entries with their name that this read
+   * cannot show: a bad message, a thread that cannot be read, a message past the read limit, or a copy that
+   * lost a merge. When it is not 0 the export is not complete. A person may export their own data.
+   */
+  exportPerson(person, actor) {
+    const { name, match } = this.checkPerson(person, actor);
+    const threads = [];
+    const edits = [];
+    let shownCount = 0;
+    for (const thread of this.list()) {
+      const messages = thread.messages.filter((m) => match(m.author));
+      shownCount += messages.length;
+      const status = match(thread.statusBy);
+      if (status) shownCount++;
+      for (const m of thread.messages) if (m.editedBy && match(m.editedBy) && !match(m.author)) edits.push({ threadId: thread.id, messageId: m.id, at: m.editedAt });
+      if (messages.length === 0 && !status) continue;
+      threads.push({
+        threadId: thread.id,
+        anchor: copy(thread.anchor),
+        messages: copy(messages),
+        ...status ? { statusChange: { status: thread.status, at: thread.statusAt, by: copy(thread.statusBy) } } : {}
+      });
+    }
+    let found = 0;
+    const named = (value) => {
+      const author = readAuthor(value);
+      return author !== void 0 && match(author);
+    };
+    for (const { fields, list } of this.stored()) {
+      for (const raw of list?.toArray() ?? []) if (named(raw?.author) || named(raw?.editedBy)) found++;
+      if (named(fields.get("state")?.by)) found++;
+    }
+    return { person: name, exportedAt: this.time(), threads, edits, unread: Math.max(0, found - shownCount - edits.length) };
+  }
+  /**
+   * Replace every message a person wrote with a tombstone: the body becomes "[erased]", the author name
+   * becomes "erased", and the mentions go. The author kind stays, so machine-made work stays marked. Thread
+   * shape, order, and times stay. A status change of theirs, and their name as the editor of another person's
+   * message, get the tombstone name. It works on the stored entries, so it reaches a bad message, a message past
+   * the read limit, a thread that cannot be read, and every copy that a merge hid. Names inside other people's
+   * messages are not touched. Returns how many messages, status changes, and edit stamps it erased.
+   */
+  erasePerson(person, actor) {
+    const { match } = this.checkPerson(person, actor);
+    const tomb = (a) => ({ kind: a.kind, name: ERASED_NAME });
+    const out = { messages: 0, statuses: 0, edits: 0 };
+    this.ydoc.transact(() => {
+      for (const { fields, list } of this.stored()) {
+        const entries = list?.toArray() ?? [];
+        for (let i = entries.length - 1; i >= 0; i--) {
+          const raw = entries[i];
+          if (typeof raw !== "object" || raw === null) continue;
+          const author = readAuthor(raw.author);
+          const editor = readAuthor(raw.editedBy);
+          let next;
+          if (author && match(author)) {
+            const id2 = typeof raw.id === "string" && ID.test(raw.id) ? raw.id : globalThis.crypto.randomUUID();
+            const at = validDate(raw.at) ? raw.at : this.time();
+            next = { id: id2, at, author: tomb(author), body: ERASED_BODY, mentions: [], editedAt: this.time(), editedBy: tomb(author), erased: true };
+            out.messages++;
+          } else if (editor && match(editor)) {
+            next = { ...raw, editedBy: tomb(editor) };
+            out.edits++;
+          }
+          if (!next) continue;
+          list.delete(i, 1);
+          list.insert(i, [next]);
+        }
+        const state = fields.get("state");
+        const by = readAuthor(state?.by);
+        if (state && by && match(by)) {
+          fields.set("state", { ...state, by: tomb(by) });
+          out.statuses++;
+        }
+      }
+    });
+    return out;
+  }
   get(threadId) {
     const { id: id2, fields } = this.fields(threadId);
     return this.read(id2, fields).thread;
@@ -755,6 +1024,7 @@ export {
   textAnchor,
   textRange,
   PRINCIPAL_KINDS,
+  ERASED_NAME,
   Actor,
   stamp,
   readAuthor,
@@ -764,5 +1034,7 @@ export {
   validDate,
   ACCEPT_SCOPE,
   Suggestions,
+  MODERATE_SCOPE,
+  ERASED_BODY,
   Comments
 };