meta-sovereign 0.49.4 → 0.49.6

package/js/src/cli/index.js

@@ -36,6 +36,7 @@ import {
   openDualStore,
   bulkPurge,
   isTombstone,
+  deletedAtOf,
   createVault,
 } from '../storage/index.js';
 import {
@@ -702,7 +703,7 @@ const purgeTombstonesCmd = async (args, log) => {
       if (idPrefix && !link.id?.startsWith(idPrefix)) {
         return false;
       }
-      if (olderThan && (link.deleted?.at ?? '') > olderThan) {
+      if (olderThan && (deletedAtOf(link) ?? '') > olderThan) {
         return false;
       }
       return true;

package/js/src/server/audience-sync.js

@@ -0,0 +1,230 @@
+/**
+ * Audience membership sync (R-X13; wired by R-Z7).
+ *
+ * An audience such as `friends:vk & chat:vk:2000000001` only finds people
+ * when their `member:` links are in the store. This reads, through each
+ * network's official API and the user's own token, the friends, chat members
+ * and community members that the saved audiences and the automations name,
+ * and stores them (`syncMembership`). It only reads; nothing is sent.
+ *
+ *   POST /api/audience/sync { source? }  -> { ok, sources: [{ source, ok,
+ *        groups, members, error? }] }  now, for one network or every one
+ *        the audiences name
+ *
+ * It also runs by itself once a day (`MS_AUDIENCE_SYNC_HOURS`, 0 = off,
+ * default 24) while the server is up. A network without a token, or one
+ * that cannot list a kind of group (Telegram's Bot API has no friends and
+ * lists only a chat's administrators), reports that and the rest goes on.
+ */
+
+import { clearInterval, setInterval } from 'node:timers';
+import { fail, json, readBody } from './util.js';
+import { isTrustedMutation } from './routes-auto-import.js';
+import { safeMessage } from './redact.js';
+import { toAudienceSpec } from '../crm/people.js';
+import {
+  getSource,
+  liveOptionsFrom,
+  syncMembership,
+} from '../sources/index.js';
+
+const HOUR_MS = 3_600_000;
+const SOURCE_NAME = /^[a-z][a-z0-9-]{0,30}$/;
+
+// The groups a spec names: `friends:vk`, `chat:vk:<id>`, `community:vk:<id>`,
+// through saved audiences too (each followed once).
+const collect = (spec, byId, found, seen = new Set()) => {
+  if (!spec || typeof spec !== 'object') {
+    return;
+  }
+  if (Array.isArray(spec.of)) {
+    spec.of.forEach((child) => collect(child, byId, found, seen));
+  } else if (spec.kind === 'friends' && spec.source) {
+    found.set(`${spec.source}\0friends`, [spec.source, { kind: 'friends' }]);
+  } else if (['chat', 'community'].includes(spec.kind) && spec.source) {
+    const id = String(spec[spec.kind]);
+    found.set(`${spec.source}\0${spec.kind}\0${id}`, [
+      spec.source,
+      { kind: spec.kind, id },
+    ]);
+  } else if (spec.kind === 'saved' && !seen.has(spec.id)) {
+    seen.add(spec.id);
+    const link = byId.get(`audience:${spec.id}`);
+    safeSpec(link?.spec ?? link?.text, (inner) =>
+      collect(inner, byId, found, seen)
+    );
+  }
+};
+
+const safeSpec = (value, use) => {
+  try {
+    use(toAudienceSpec(value));
+  } catch {
+    // An audience that does not parse names no group.
+  }
+};
+
+/** `Map<source, group[]>` named by the saved audiences and automations. */
+export const audienceGroups = (links) => {
+  const byId = new Map(links.map((l) => [l?.id, l]));
+  const found = new Map();
+  for (const link of links) {
+    const id = String(link?.id ?? '');
+    if (id.startsWith('audience:')) {
+      safeSpec(link.spec ?? link.text, (s) => collect(s, byId, found));
+    } else if (id.startsWith('automation:') && link.audience) {
+      safeSpec(link.audience, (s) => collect(s, byId, found));
+    }
+  }
+  const out = new Map();
+  for (const [source, group] of found.values()) {
+    out.set(source, [...(out.get(source) ?? []), group]);
+  }
+  return out;
+};
+
+// The network's live API and the user's saved options for it, or an error.
+const liveFor = async (store, source, resolve) => {
+  try {
+    return {
+      live: resolve(source).live,
+      options: await liveOptionsFrom(store, source),
+    };
+  } catch (error) {
+    return { error: safeMessage(error) };
+  }
+};
+
+// One group at a time, so a group the network refuses does not stop the rest.
+const syncSource = async (store, source, groups, resolve, now) => {
+  const result = { source, ok: true, groups: 0, members: 0 };
+  const prepared = await liveFor(store, source, resolve);
+  if (prepared.error) {
+    return { ...result, ok: false, error: prepared.error };
+  }
+  const { live, options } = prepared;
+  if (!options.token) {
+    return { ...result, ok: false, error: 'no token saved for this network' };
+  }
+  const errors = [];
+  for (const group of groups) {
+    try {
+      const done = await syncMembership({
+        source,
+        live,
+        groups: [group],
+        put: (link) => store.put(link),
+        now,
+        options,
+      });
+      result.groups += done.groups.length;
+      result.members += done.members;
+    } catch (error) {
+      // The token itself never appears in what is reported.
+      errors.push(safeMessage(error).split(options.token).join('***'));
+    }
+  }
+  return errors.length > 0
+    ? { ...result, ok: false, error: errors.join('; ').slice(0, 300) }
+    : result;
+};
+
+/** Sync every network the audiences name (or just `only`); never throws. */
+export const syncAudiences = async ({
+  store,
+  resolve = getSource,
+  only = null,
+  now = Date.now(),
+}) => {
+  const wanted = audienceGroups(await store.query());
+  const sources = [];
+  for (const [source, groups] of wanted) {
+    if (!only || only === source) {
+      sources.push(await syncSource(store, source, groups, resolve, now));
+    }
+  }
+  return { ok: sources.every((s) => s.ok), sources };
+};
+
+const DEFAULT_HOURS = 24;
+
+// `MS_AUDIENCE_SYNC_HOURS`: hours between runs, `0` = off, unset = daily.
+// Nonsense is ignored for the default with one log line.
+const audienceHours = (env, log) => {
+  const raw = env?.MS_AUDIENCE_SYNC_HOURS;
+  if (raw === undefined || raw === null || raw === '') {
+    return DEFAULT_HOURS;
+  }
+  const n = Number(raw);
+  if (Number.isFinite(n) && n >= 0) {
+    return n;
+  }
+  log?.({
+    level: 'warn',
+    event: 'audience_sync_setting_ignored',
+    name: 'MS_AUDIENCE_SYNC_HOURS',
+  });
+  return DEFAULT_HOURS;
+};
+
+/** Once a day, once the port is ours; `{ stopAudienceSync }` for the context. */
+export const audienceSyncFor = ({
+  store,
+  log,
+  later,
+  resolve = getSource,
+  env = process.env,
+}) => {
+  const hours = audienceHours(env, log);
+  let timer = null;
+  if (hours > 0) {
+    later.push(() => {
+      timer = setInterval(
+        () =>
+          syncAudiences({ store, resolve })
+            .then((done) =>
+              log?.({
+                level: 'info',
+                event: 'audience_sync',
+                sources: done.sources.length,
+                ok: done.ok,
+              })
+            )
+            .catch((error) =>
+              log?.({
+                level: 'warn',
+                event: 'audience_sync_failed',
+                error: safeMessage(error),
+              })
+            ),
+        hours * HOUR_MS
+      );
+      timer.unref?.();
+    });
+  }
+  return { stopAudienceSync: () => clearInterval(timer) };
+};
+
+export const handleAudienceSyncRoute = async (store, req, res, p, ctx) => {
+  if (p !== '/api/audience/sync' || req.method !== 'POST') {
+    return false;
+  }
+  if (!isTrustedMutation(req, ctx.allowOrigins)) {
+    return (
+      fail(res, 403, 'forbidden', 'must come from the meta-sovereign app') ??
+      true
+    );
+  }
+  const body = await readBody(req);
+  if (body.source !== undefined && !SOURCE_NAME.test(String(body.source))) {
+    return (
+      fail(res, 400, 'bad-request', 'source must be a network name') ?? true
+    );
+  }
+  const done = await syncAudiences({
+    store,
+    resolve: ctx.audienceSources ?? getSource,
+    only: body.source ?? null,
+  });
+  return json(res, 200, done) ?? true;
+};

package/js/src/server/background-jobs.js

@@ -0,0 +1,91 @@
+/**
+ * The jobs that run by themselves while the server is up, started once the
+ * port is really ours (R-Z7; a second `serve` on a busy port must not run
+ * them on the same store):
+ *
+ *   automatic backup          ./backup-job.js          daily, keep 7 (R-A4)
+ *   audience membership sync  ./audience-sync.js       daily (R-X13)
+ *   24-hour cache purge       here                     hourly (R-S12, R-T12)
+ *
+ * `backgroundJobs(...)` returns the part of the context holding `stopJobs`.
+ */
+import {
+  clearInterval,
+  clearTimeout,
+  setInterval,
+  setTimeout,
+} from 'node:timers';
+import { backupJobFor } from './backup-job.js';
+import { audienceSyncFor } from './audience-sync.js';
+import { safeMessage } from './redact.js';
+import { softCacheRetention as upworkRetention } from '../sources/upwork.js';
+import { softCacheRetention as pphRetention } from '../sources/peopleperhour.js';
+
+const HOUR_MS = 3_600_000;
+// The first purge, a minute after start, so a start-up is not slowed by a
+// scan of the store; `MS_CACHE_PURGE_DELAY_MS` changes it (tests).
+const FIRST_PURGE_MS = 60_000;
+
+/**
+ * Upwork and PeoplePerHour content pulled live from their APIs is deleted
+ * 24 hours after it was pulled; what the user imported from an export stays.
+ */
+export const purgeSoftCaches = async (store, now = Date.now()) => {
+  const upwork = await upworkRetention(store, { now });
+  const peoplePerHour = await pphRetention(store, { now });
+  return { upwork: upwork.purged, peopleperhour: peoplePerHour.purged };
+};
+
+const cachePurgeFor = ({ store, log, later }) => {
+  let timer = null;
+  let first = null;
+  const run = () =>
+    purgeSoftCaches(store)
+      .then((purged) =>
+        purged.upwork + purged.peopleperhour > 0
+          ? log?.({ level: 'info', event: 'soft_cache_purged', ...purged })
+          : null
+      )
+      .catch((error) =>
+        log?.({
+          level: 'warn',
+          event: 'soft_cache_purge_failed',
+          error: safeMessage(error),
+        })
+      );
+  later.push(() => {
+    const delay = Number(process.env.MS_CACHE_PURGE_DELAY_MS ?? FIRST_PURGE_MS);
+    first = setTimeout(run, delay);
+    timer = setInterval(run, HOUR_MS);
+    first.unref?.();
+    timer.unref?.();
+  });
+  return {
+    stopCachePurge: () => {
+      clearTimeout(first);
+      clearInterval(timer);
+    },
+  };
+};
+
+export const backgroundJobs = ({ ctx, store, log, later, backups }) => {
+  const backup = backupJobFor({ ctx, store, log, later, backups });
+  const audience = audienceSyncFor({
+    store,
+    log,
+    later,
+    resolve: ctx.audienceSources,
+  });
+  const purge = cachePurgeFor({ store, log, later });
+  return {
+    stopJobs: () => {
+      backup.stopBackups();
+      audience.stopAudienceSync();
+      purge.stopCachePurge();
+      // The other timers and pollers the server started with the port.
+      ctx.autoImport?.close();
+      ctx.whatsappSignIn?.stop().catch(() => {});
+      ctx.stopPulls?.();
+    },
+  };
+};

package/js/src/server/backup-job.js

@@ -0,0 +1,91 @@
+/**
+ * The automatic backup, started once the port is ours (R-A4, R-Z7).
+ *
+ * OFF by default (the streaming backups of R-Z16 switch it on).
+ * `MS_BACKUP_INTERVAL_HOURS` (or the `backups.intervalHours` option) sets
+ * the interval in hours, `0` or unset means off; `MS_BACKUP_KEEP` (or
+ * `backups.keep`) sets how many archives are kept (default 7, `0` keeps
+ * all). A value that is not a number >= 0 is ignored for the default and
+ * logged once.
+ * The archive is encrypted, and holds the secrets, only when the server has
+ * a passphrase (`MS_SECRET_PASSPHRASE`); otherwise it leaves them out.
+ * The first run is one interval after start, never at start. A nearly full
+ * disk skips the run (R-Z14) and the log says so.
+ */
+import { createBackupScheduler } from '../storage/backup.js';
+
+const HOUR_MS = 3_600_000;
+export const DEFAULT_INTERVAL_HOURS = 0;
+export const DEFAULT_KEEP = 7;
+
+// A number >= 0, or the fallback; `bad` collects the names that were wrong.
+const number = (value, fallback, name, bad) => {
+  if (value === undefined || value === null || value === '') {
+    return fallback;
+  }
+  const n = Number(value);
+  if (Number.isFinite(n) && n >= 0) {
+    return n;
+  }
+  bad.push(name);
+  return fallback;
+};
+
+/**
+ * `{ intervalMs, keep, invalid }` from options and the environment; an
+ * interval of 0 is off; `invalid` names the settings that were ignored.
+ */
+export const backupSettings = (options = {}, env = process.env) => {
+  const invalid = [];
+  const hours = number(
+    options.intervalHours ?? env.MS_BACKUP_INTERVAL_HOURS,
+    DEFAULT_INTERVAL_HOURS,
+    'MS_BACKUP_INTERVAL_HOURS',
+    invalid
+  );
+  const keep = number(
+    options.keep ?? env.MS_BACKUP_KEEP,
+    DEFAULT_KEEP,
+    'MS_BACKUP_KEEP',
+    invalid
+  );
+  return {
+    intervalMs: Math.round(hours * HOUR_MS),
+    keep: Math.floor(keep),
+    invalid,
+  };
+};
+
+/** The context part: `{ stopBackups }`; the timer starts with `later`. */
+export const backupJobFor = ({ ctx, store, log, later, backups }) => {
+  const { archiveDir, secretPassphrase: passphrase } = ctx;
+  const measureFree = ctx.diskFree;
+  const { intervalMs, keep, invalid } = backupSettings(backups);
+  if (invalid.length > 0) {
+    log?.({ level: 'warn', event: 'backup_setting_ignored', names: invalid });
+  }
+  let scheduler = null;
+  if (archiveDir && intervalMs > 0) {
+    later.push(() => {
+      scheduler = createBackupScheduler({
+        store,
+        archiveDir,
+        intervalMs,
+        keep,
+        passphrase,
+        measureFree,
+        onEvent: (event) => log?.(event),
+        onBackup: () => log?.({ level: 'info', event: 'backup_done' }),
+        // Never the text of a secret: only the message the backup raised.
+        onError: (error) =>
+          log?.({
+            level: 'warn',
+            event: 'backup_failed',
+            code: error.code ?? null,
+            error: String(error.message).slice(0, 200),
+          }),
+      });
+    });
+  }
+  return { stopBackups: () => scheduler?.stop() };
+};

package/js/src/server/chat-index.js

@@ -20,6 +20,7 @@
  */
 
 import { chatKey, networkMessageId } from '../web/chat-model.js';
+import { isTombstone } from '../storage/soft-delete.js';
 import { splitTopicKey, topicOfMessage } from '../web/forum-topics.js';
 
 const isMessage = (link) =>
@@ -115,13 +116,14 @@ export const createChatIndex = (store) => {
   const chatOf = (key) => {
     let chat = chats.get(key);
     if (!chat) {
-      chat = { entries: new Map(), sorted: null, head: null };
+      chat = { entries: new Map(), sorted: null, head: null, gone: new Set() };
       chats.set(key, chat);
     }
     return chat;
   };
 
   const remove = (chat, id) => {
+    chat.gone.delete(id);
     if (!chat.entries.delete(id)) {
       return;
     }
@@ -135,10 +137,13 @@ export const createChatIndex = (store) => {
   const add = (link) => {
     const chat = chatOf(chatKey(link.source, link.chat));
     const known = chat.entries.has(link.id);
-    if (link.deleted) {
+    if (isTombstone(link)) {
       remove(chat, link.id);
+      // Kept apart for the "deleted messages" view (R-Z7).
+      chat.gone.add(link.id);
       return 'update';
     }
+    chat.gone.delete(link.id);
     const entry = entryOf(link);
     chat.entries.set(link.id, entry);
     chat.sorted = null;
@@ -178,7 +183,7 @@ export const createChatIndex = (store) => {
 
   const linksOf = async (entries) =>
     (await Promise.all(entries.map((e) => store.get(e.id)))).filter(
-      (link) => link && !link.deleted
+      (link) => link && !isTombstone(link)
     );
 
   const sortedOf = (chat) => {
@@ -242,6 +247,11 @@ export const createChatIndex = (store) => {
         ...(range.at || range.around ? { target } : {}),
       };
     },
+    /** The ids of a chat's deleted (tombstoned) messages (R-Z7). */
+    async deleted(key) {
+      await ready;
+      return [...(chats.get(key)?.gone ?? [])];
+    },
     /** How many messages of a chat the store holds. */
     count: (key) => chats.get(key)?.entries.size ?? 0,
     close: () => unsubscribe(),

package/js/src/server/index.js

@@ -81,6 +81,9 @@ import {
 import { createDefaultSender } from '../sources/browser-sender.js';
 import { createAutopilot } from '../automation/autopilot.js';
 import { recoverOutbox } from '../automation/outbox.js';
+import { backgroundJobs } from './background-jobs.js';
+import { handleDeletedRoutes } from './routes-deleted.js';
+import { handleAudienceSyncRoute } from './audience-sync.js';
 import { setTypingFor } from '../sources/live-links.js';
 import { createReplyService } from '../replies/reply-service.js';
 import { createChatIndex } from './chat-index.js';
@@ -583,6 +586,8 @@ const routeOn = async (store, req, res, ctx, url, p) => {
     () => handleTelegramRoutes(req, res, p, ctx),
     () => handleMessageRoutes(store, req, res, p, url, ctx),
     () => handleEmailGets(store, req, res, p, url, ctx),
+    () => handleDeletedRoutes(store, req, res, p, url, ctx),
+    () => handleAudienceSyncRoute(store, req, res, p, ctx),
     () => handleChatRoutes(req, res, p, url, ctx),
     () => ctx.learned?.(store, req, res, p, url, ctx) ?? false,
     () => handleDerivedRoutes(store, req, res, p, url, ctx),
@@ -771,16 +776,16 @@ export const startServer = async ({
   emailLiveFactory = null,
   emailPoll,
   cv = {},
-  // `{ self?, clink? }` for the reply-graph autocomplete (/api/suggest).
+  // replies: `{ self?, clink? }` for /api/suggest; automations: `{ send?,
+  // setTyping?, resolveAudience?, self?, scheduler?, tickMs? }`.
   replies,
-  // `{ send?, setTyping?, resolveAudience?, self?, scheduler?, tickMs? }`.
   automations,
   greetings,
   allowOrigins,
   autoImportLauncher,
-  // Tests inject a fake `createSignIns()` (no real browsers are read).
+  // Tests inject a fake `createSignIns()` and a fake MTProto (no real browsers
+  // or network are used).
   autoImportSignIns,
-  // Tests inject a fake MTProto (no real GramJS / network for Telegram login).
   telegramMtproto,
   telegramCreds,
   // A `createTelegramAccount()` (or `false` for none); see telegramAccountFor.
@@ -796,9 +801,11 @@ export const startServer = async ({
   localUi,
   // HTTPS on the same port for Safari (./local-tls.js, R-Y64); `serve` sets it.
   tls,
-  // Tests: a fake `(dir) => bytes|null` for the free disk space (R-Z14).
+  // diskFree: a test fake `(dir) => bytes|null` (R-Z14); backups:
+  // `{ intervalHours?, keep? }` for the automatic backup (R-Z7).
   diskFree,
   pulls,
+  backups,
 } = {}) => {
   const { store, resolvedArchiveDir, flush, storeHealth } = await initStore({
     providedStore,
@@ -858,6 +865,7 @@ export const startServer = async ({
     chatIndex,
     ...pullContext(store, log, pulls, later),
   };
+  Object.assign(ctx, backgroundJobs({ ctx, store, log, later, backups }));
   const server = createHttpServer(store, ctx, log);
   const sockets = trackSockets(server);
   const bus = enableHandlers
@@ -904,9 +912,7 @@ export const startServer = async ({
         ctx.emailPoller.stop();
         ctx.replies.close().catch(() => {});
         ctx.closeAutomations().catch(() => {});
-        ctx.autoImport?.close();
-        ctx.whatsappSignIn?.stop().catch(() => {});
-        ctx.stopPulls?.();
+        ctx.stopJobs();
         ctx.chatIndex.close();
         stopAll(telegramAccount, ctx.telegramAccounts, ctx.telegramExtras);
         wsHandle?.close();

package/js/src/server/routes-deleted.js

@@ -0,0 +1,108 @@
+/**
+ * The deleted messages of a chat: kept, never lost, and the user's to
+ * bring back or to remove (R-K1, R-K2, R-K4; wired to a page by R-Z7).
+ * These are local actions only: nothing is sent to any network.
+ *
+ *   GET  /api/chat/deleted?key=<chat key>   -> { messages }  the chat's
+ *                                              tombstoned messages, oldest
+ *                                              first (at most 500)
+ *   POST /api/chat/deleted/recover { ids }  -> { ok, recovered }  the
+ *                                              messages show in the chat
+ *                                              again
+ *   POST /api/chat/deleted/purge { ids, confirm: true }
+ *                                           -> { ok, purged }  erased from
+ *                                              this device for good
+ *
+ * Only a message that is already deleted can be recovered or purged; a live
+ * one is never touched, whatever ids a request names.
+ */
+
+import { fail as failWith, json, readBody } from './util.js';
+import { isTrustedMutation } from './routes-auto-import.js';
+import { isTombstone, unmarkDeleted } from '../storage/soft-delete.js';
+import { byTime } from '../web/chat-model.js';
+
+const fail = (res, status, code, error) =>
+  failWith(res, status, code, error) ?? true;
+
+const PREFIX = '/api/chat/deleted';
+const MAX_LIST = 500;
+const MAX_IDS = 500;
+
+const idsOf = (body) =>
+  Array.isArray(body.ids) &&
+  body.ids.length > 0 &&
+  body.ids.length <= MAX_IDS &&
+  body.ids.every((id) => typeof id === 'string' && id.startsWith('msg:'))
+    ? body.ids
+    : null;
+
+// The tombstoned message links among `ids`.
+const deletedAmong = async (store, ids) => {
+  const found = [];
+  for (const id of ids) {
+    const link = await store.get(id);
+    if (link && isTombstone(link)) {
+      found.push(link);
+    }
+  }
+  return found;
+};
+
+const list = async (store, res, url, ctx) => {
+  const key = url.searchParams.get('key');
+  if (!key || !ctx.chatIndex) {
+    return fail(res, 400, 'bad-request', 'key is required');
+  }
+  const ids = await ctx.chatIndex.deleted(key);
+  const links = await deletedAmong(store, ids.slice(0, MAX_LIST));
+  return json(res, 200, { messages: links.sort(byTime) }) ?? true;
+};
+
+const recover = async (store, res, ids) => {
+  const links = await deletedAmong(store, ids);
+  for (const link of links) {
+    await store.put(unmarkDeleted(link));
+  }
+  return (
+    json(res, 200, { ok: true, recovered: links.map((l) => l.id) }) ?? true
+  );
+};
+
+const purge = async (store, res, ids) => {
+  const purged = [];
+  for (const link of await deletedAmong(store, ids)) {
+    if (await store.delete(link.id)) {
+      purged.push(link.id);
+    }
+  }
+  return json(res, 200, { ok: true, purged }) ?? true;
+};
+
+export const handleDeletedRoutes = async (store, req, res, p, url, ctx) => {
+  if (!p.startsWith(PREFIX)) {
+    return false;
+  }
+  if (p === PREFIX && req.method === 'GET') {
+    return list(store, res, url, ctx);
+  }
+  const action = p.slice(PREFIX.length + 1);
+  if (req.method !== 'POST' || !['recover', 'purge'].includes(action)) {
+    return false;
+  }
+  if (!isTrustedMutation(req, ctx.allowOrigins)) {
+    return fail(res, 403, 'forbidden', 'must come from the meta-sovereign app');
+  }
+  const body = await readBody(req, { allowEmpty: false });
+  const ids = idsOf(body);
+  if (!ids) {
+    return fail(res, 400, 'bad-request', 'ids: message ids are needed');
+  }
+  if (action === 'purge') {
+    if (body.confirm !== true) {
+      return fail(res, 400, 'confirm-required', 'purging needs confirm: true');
+    }
+    return purge(store, res, ids);
+  }
+  return recover(store, res, ids);
+};

package/js/src/server/routes-messages.js

@@ -24,6 +24,8 @@ import { json, readBody } from './util.js';
 import { isTrustedMutation } from './routes-auto-import.js';
 import { previewFields } from '../sources/telegram-link-preview.js';
 
+import { markDeleted as tombstone } from '../storage/soft-delete.js';
+
 const PREFIX = '/api/message/';
 const MAX_IDS = 100;
 
@@ -102,7 +104,9 @@ const ACTIONS = {
     }),
     after: async (store, body, links) => {
       for (const link of links) {
-        await store.put({ ...link, deleted: true, deletedAt: now() });
+        await store.put(
+          tombstone(link, { by: 'user', reason: 'deleted-in-app', at: now() })
+        );
       }
     },
   },