v4: a moderator's or an admin's @everyone in the chat notifies every user — there was no way to reach everyone at once. The new chat:everyone permission, held by moderators and admins, lets a chat message saying @everyone notify every user but its author and those reading the chat, through notifyEveryone, after notifyMentions, so a user also named is told once, by name; the notification is a user_mentioned with everyone set, which the notifications page and the digest word as "mentioned everyone in the chat". chat_messages.mentions_everyone, sent as ChatMessage.mentionsEveryone, is set from the author's role each time the body is written, so a user's @everyone reaches no one, a moderator's edit of a user's message can't make it reach everyone, and a demoted author's next edit loses it. Only an edit that adds @everyone notifies, so fixing an announcement's typo reaches no one new. The client highlights and chimes by the flag, never by the text; Markdown shows @everyone as a mention only in a flagged message, and never links it to a profile. The chat composer offers @everyone first to those who may say it. No account may be named everyone, in any case: migration 0023 adds the column, flags the moderators' and admins' past @everyone messages, renames a user named everyone to everyone_N and drops an alias everyone. 265 backend tests and 681 frontend tests pass, and deno check, tsc, eslint, doc:lint and i18n:compile --strict are clean; checked in screenshots of the chat at 1280 and 390px, with a moderator's and a user's @everyone and the suggestions open.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/services/chat-service.ts

@@ -14,6 +14,9 @@ import { chatMessageRowToApi, isChatMessageRow } from "../model/chat.ts";
 import { db } from "../db/connection.ts";
 import { linkAttachments } from "./attachment-service.ts";
 import { VALIDATION } from "../../shared/validation.ts";
+import { mentionsEveryone } from "../../shared/mention.ts";
+import { hasPermission } from "../../shared/permissions.ts";
+import { isRole } from "../../shared/user.ts";
 
 const DEFAULT_LIMIT = 50;
 const MAX_LIMIT = 100;
@@ -28,7 +31,7 @@ const REPLY_SNIPPET_LEN = 300;
 /** The columns of a `ChatMessageRow`, to select over {@link FROM_JOINS}. */
 const SELECT_COLS =
   `m.id, m.user_id, m.body, m.created_at, m.updated_at, m.reply_to_id,
-  u.username as author_username, u.avatar_mime as author_avatar_mime,
+  m.mentions_everyone, u.username as author_username, u.avatar_mime as author_avatar_mime,
   ru.username as reply_to_author, substr(rm.body, 1, ${REPLY_SNIPPET_LEN}) as reply_to_body`;
 
 /**
@@ -51,10 +54,27 @@ function fetchMessage(id: string): ChatMessage {
   return chatMessageRowToApi(row);
 }
 
+/**
+ * Returns 1 when `body`, written by `authorId`, reaches everyone: it says
+ * `@everyone` and the author's role, read now, has `chat:everyone`. Else 0,
+ * for `chat_messages.mentions_everyone`.
+ */
+function everyoneFlag(authorId: string, body: string): number {
+  if (!mentionsEveryone(body)) return 0;
+  const row = db.prepare(`SELECT role FROM users WHERE id = ?;`).get(
+    authorId,
+  ) as { role: unknown } | undefined;
+  return row && isRole(row.role) && hasPermission(row.role, "chat:everyone")
+    ? 1
+    : 0;
+}
+
 /**
  * Stores a message from `userId` on a `chat_send`, and claims the pasted images
  * it links to. A `replyToId` naming no message is dropped, and the message is
- * posted as no reply. The caller broadcasts the result.
+ * posted as no reply. The message `mentionsEveryone` when it says `@everyone`
+ * and `userId` may. The caller broadcasts the result, and notifies everyone
+ * when it is flagged.
  *
  * @throws {APIException} 400 when the body is blank or longer than
  * `VALIDATION.CHAT_MESSAGE_MAX`.
@@ -84,8 +104,9 @@ export function createChatMessage(
   const id = crypto.randomUUID();
   const createdAt = new Date().toISOString();
   db.prepare(
-    `INSERT INTO chat_messages (id, user_id, body, created_at, reply_to_id) VALUES (?, ?, ?, ?, ?);`,
-  ).run(id, userId, trimmed, createdAt, replyTo);
+    `INSERT INTO chat_messages (id, user_id, body, created_at, reply_to_id, mentions_everyone)
+     VALUES (?, ?, ?, ?, ?, ?);`,
+  ).run(id, userId, trimmed, createdAt, replyTo, everyoneFlag(userId, trimmed));
   // Unclaimed attachments are deleted as orphans at startup.
   linkAttachments(trimmed, "chat", id);
   return fetchMessage(id);
@@ -102,10 +123,24 @@ function getMessageOwner(id: string): string {
   return row.user_id;
 }
 
+/**
+ * Checks whether message `id` is flagged `mentionsEveryone`, false when there
+ * is no such message. The WebSocket route reads it before an edit, to notify
+ * everyone only when the edit adds `@everyone`.
+ */
+export function chatMessageMentionsEveryone(id: string): boolean {
+  const row = db.prepare(
+    `SELECT mentions_everyone FROM chat_messages WHERE id = ?;`,
+  ).get(id) as { mentions_everyone: number } | undefined;
+  return row?.mentions_everyone === 1;
+}
+
 /**
  * Replaces a message's body on a `chat_edit`, and claims any image the new body
- * links to. `canModerate` lets a moderator edit anyone's message. The caller
- * broadcasts the result.
+ * links to. `canModerate` lets a moderator edit anyone's message. The flag
+ * `mentionsEveryone` is set again from the new body and the author's role, not
+ * the editor's: a moderator's edit can't make a user's message reach everyone.
+ * The caller broadcasts the result.
  *
  * @throws {APIException} 404 when there is no such message, 403 when the user
  * is neither its author nor a moderator, 400 when the body is blank or too
@@ -131,8 +166,10 @@ export function updateChatMessage(
       `Message exceeds ${VALIDATION.CHAT_MESSAGE_MAX} characters`,
     );
   }
-  db.prepare(`UPDATE chat_messages SET body = ?, updated_at = ? WHERE id = ?;`)
-    .run(trimmed, new Date().toISOString(), id);
+  db.prepare(
+    `UPDATE chat_messages SET body = ?, updated_at = ?, mentions_everyone = ?
+      WHERE id = ?;`,
+  ).run(trimmed, new Date().toISOString(), everyoneFlag(ownerId, trimmed), id);
   linkAttachments(trimmed, "chat", id);
   return fetchMessage(id);
 }

api/services/digest-service.ts

@@ -263,7 +263,7 @@ function highlightOf(
           };
         case "chat":
           return {
-            kind: "mentionChat",
+            kind: d.everyone ? "mentionEveryone" : "mentionChat",
             who: d.mentionerUsername,
             quote: quoteOf(
               (db.prepare(`SELECT body FROM chat_messages WHERE id = ?;`)

api/services/notification-service.ts

@@ -379,6 +379,50 @@ export function notifyMentions(
   }
 }
 
+/**
+ * Notifies every user but its author of chat message `messageId`, which says
+ * `@everyone`. The WebSocket route calls it, after {@link notifyMentions} so
+ * that a user also named is told by name, when the message is sent flagged
+ * `mentionsEveryone`, or when an edit flags it. Each user is notified once per
+ * message, however often it is edited. `skipUserId` spares the users who have
+ * the chat open, as for a mention.
+ */
+export function notifyEveryone(
+  mentionerUserId: string,
+  messageId: string,
+  skipUserId?: (userId: string) => boolean,
+): void {
+  const mentionerRow = db.prepare(
+    `SELECT username FROM users WHERE id = ?;`,
+  ).get(mentionerUserId) as { username: string } | undefined;
+  if (!mentionerRow) return;
+
+  const userRows = db.prepare(`SELECT id FROM users WHERE id != ?;`).all(
+    mentionerUserId,
+  ) as { id: string }[];
+
+  // One transaction for the fan-out, as for a dump's followers.
+  transaction(() => {
+    for (const row of userRows) {
+      if (skipUserId?.(row.id)) continue;
+      createNotification(
+        row.id,
+        "user_mentioned",
+        {
+          mentionerId: mentionerUserId,
+          mentionerUsername: mentionerRow.username,
+          contextType: "chat",
+          contextId: messageId,
+          contextTitle: "",
+          everyone: true,
+        },
+        // The key of a mention by name, so a user named too gets one.
+        `mention:chat:${messageId}:${row.id}`,
+      );
+    }
+  });
+}
+
 /**
  * Notifies a dump's poster that `commenterId` commented on it, unless they are
  * the poster. `createComment` calls it for replies too, but not on an edit.

api/services/user-service.ts

@@ -33,6 +33,7 @@ import { parseRows } from "../model/rows.ts";
 import { isEmailEnabled, sendEmail } from "./email-service.ts";
 import { renderWelcomeEmail } from "../mail/welcome.ts";
 import { USERNAME_RE, VALIDATION } from "../../shared/validation.ts";
+import { EVERYONE } from "../../shared/mention.ts";
 
 /** Selects full `UserRow`s from `users u`, with the inviter's name joined. */
 const USER_SELECT =
@@ -43,13 +44,17 @@ const USER_SELECT =
 
 /**
  * Throws a 409 when `username` is, in any case, the name or a former name of
- * an account other than `exceptUserId`. A former name stays its user's for
- * good, so that old links and old @mentions can't be taken over.
+ * an account other than `exceptUserId`, or `everyone`, which the chat's
+ * `@everyone` takes. A former name stays its user's for good, so that old
+ * links and old @mentions can't be taken over.
  */
 function assertUsernameAvailable(
   username: string,
   exceptUserId?: string,
 ): void {
+  if (username.toLowerCase() === EVERYONE) {
+    throw new APIException(409, "Username already exists");
+  }
   const row = db.prepare(
     `SELECT id FROM users WHERE lower(username) = lower(?) AND id != ?
      UNION ALL