@palbase/web 1.2.1 → 1.4.0

package/dist/next/index.cjs

@@ -2628,6 +2628,151 @@ var PalbeFlags = class {
   }
 };
 
+// src/messaging/delete-fold.ts
+var DeleteFold = class {
+  // targets with a confirmed valid tombstone — MONOTONIC (never removed within retention).
+  tombstoned = /* @__PURE__ */ new Set();
+  // target → the tombstone's authenticated actor userId, awaiting the target's arrival.
+  pending = /* @__PURE__ */ new Map();
+  // dedup of real wire events the fold could evaluate (tombstoned or parked in pending).
+  seen = /* @__PURE__ */ new Set();
+  // events parked because NEITHER the actor NOR the target's author was resolvable at ingest;
+  // keyed by eventClientMsgId so a re-delivered unverifiable event is held exactly once.
+  held = [];
+  /**
+   * Ingest one tombstone. `authorOfTarget` resolves the target message's AUTHOR
+   * userId (null = target absent locally → defer).
+   */
+  ingest(e, authorOfTarget) {
+    if (this.tombstoned.has(e.targetClientMsgId)) return;
+    if (this.seen.has(e.eventClientMsgId)) return;
+    if (this.heldContains(e.eventClientMsgId)) return;
+    const author = authorOfTarget(e.targetClientMsgId);
+    if (author !== null) {
+      this.seen.add(e.eventClientMsgId);
+      if (e.actorUserId === null || e.actorUserId !== author) return;
+      this.tombstoned.add(e.targetClientMsgId);
+    } else if (e.actorUserId !== null) {
+      this.seen.add(e.eventClientMsgId);
+      this.pending.set(e.targetClientMsgId, e.actorUserId);
+    } else {
+      this.held.push(e);
+    }
+  }
+  /** True once a valid tombstone has absorbed this target. */
+  isTombstoned(targetClientMsgId) {
+    return this.tombstoned.has(targetClientMsgId);
+  }
+  /**
+   * When a target message newly arrives with a resolved `author`, re-check any
+   * pending tombstone for it AND re-attempt any held (unverifiable) tombstones
+   * whose target is now resolvable. The deferred gate is the SAME comparison as
+   * the in-order path.
+   */
+  reevaluatePending(target, author) {
+    const actor = this.pending.get(target);
+    if (actor !== void 0) {
+      if (author !== null && actor === author) {
+        this.tombstoned.add(target);
+        this.pending.delete(target);
+      } else if (author !== null) {
+        this.pending.delete(target);
+      }
+    }
+    if (this.held.length === 0) return;
+    const pendingHeld = this.held;
+    this.held = [];
+    for (const e of pendingHeld) {
+      this.ingest(e, (t) => t === target ? author : null);
+    }
+  }
+  heldContains(eventClientMsgId) {
+    return this.held.some((h) => h.eventClientMsgId === eventClientMsgId);
+  }
+};
+
+// src/messaging/edit-fold.ts
+function orderLt(aEpoch, aSeq, bEpoch, bSeq) {
+  if (aEpoch !== bEpoch) return aEpoch < bEpoch;
+  return aSeq < bSeq;
+}
+function orderEq(aEpoch, aSeq, bEpoch, bSeq) {
+  return aEpoch === bEpoch && aSeq === bSeq;
+}
+var EditFold = class {
+  // target → winning edit state
+  states = /* @__PURE__ */ new Map();
+  // dedup of real wire events that reached (and were resolvable enough to evaluate at) the fold
+  seenEvents = /* @__PURE__ */ new Set();
+  // events parked because target/author or sender was unresolved at ingest time
+  held = [];
+  // targets that have had ≥1 valid edit applied (write-once)
+  editedTargets = /* @__PURE__ */ new Set();
+  /**
+   * Ingest one edit. `authorOfTarget` resolves the target message's AUTHOR userId
+   * (null = target unknown/dangling → HOLD).
+   */
+  ingest(e, authorOfTarget) {
+    const author = authorOfTarget(e.targetClientMsgId);
+    if (author === null) {
+      this.holdIfNew(e);
+      return;
+    }
+    if (e.editorUserId === null) {
+      this.holdIfNew(e);
+      return;
+    }
+    if (e.editorUserId !== author) return;
+    if (this.seenEvents.has(e.eventClientMsgId)) return;
+    this.seenEvents.add(e.eventClientMsgId);
+    const prev = this.states.get(e.targetClientMsgId);
+    if (prev !== void 0) {
+      if (orderLt(e.epoch, e.serverSeq, prev.orderEpoch, prev.orderSeq)) return;
+      if (orderEq(e.epoch, e.serverSeq, prev.orderEpoch, prev.orderSeq) && e.eventClientMsgId <= prev.lastEventId) {
+        return;
+      }
+    }
+    this.states.set(e.targetClientMsgId, {
+      orderEpoch: e.epoch,
+      orderSeq: e.serverSeq,
+      lastEventId: e.eventClientMsgId,
+      text: e.newText
+    });
+    this.editedTargets.add(e.targetClientMsgId);
+  }
+  /**
+   * Park an event for later re-attempt, deduping held re-deliveries by
+   * eventClientMsgId so a repeatedly-delivered unresolvable edit is held exactly
+   * once (and never double-applies when it finally resolves on reevaluate).
+   */
+  holdIfNew(e) {
+    if (this.held.some((h) => h.eventClientMsgId === e.eventClientMsgId)) return;
+    this.held.push(e);
+  }
+  /** The winning edit text for a target, or null if no valid edit has applied. */
+  text(targetClientMsgId) {
+    return this.states.get(targetClientMsgId)?.text ?? null;
+  }
+  /** Write-once: true once any valid edit applied to the target. */
+  isEdited(targetClientMsgId) {
+    return this.editedTargets.has(targetClientMsgId);
+  }
+  /**
+   * Re-run HELD edits when the roster/target newly resolves (call on member/roster
+   * change and when a target message arrives). Clears `held` and re-ingests each
+   * event with the fresh `authorOfTarget` — events that still don't resolve are
+   * simply re-held; events that now resolve fold via the normal LWW path.
+   * Idempotent: re-ingest is deduped by `seenEvents` (applied events) and by
+   * `holdIfNew` (still-held events), so reevaluating repeatedly can neither
+   * double-apply nor lose an edit.
+   */
+  reevaluateHeld(authorOfTarget) {
+    const pending = this.held;
+    this.held = [];
+    for (const e of pending) this.ingest(e, authorOfTarget);
+  }
+};
+
 // src/messaging/util.ts
 function toBase64(bytes) {
   if (typeof Buffer !== "undefined") {
@@ -2767,6 +2912,28 @@ async function listDevices(rt, userId) {
 }
 
 // src/messaging/group-messaging.ts
+function encodeDelete(args) {
+  return encodeUtf8(
+    JSON.stringify({
+      v: 1,
+      type: "delete",
+      client_msg_id: args.clientMsgId,
+      target_client_msg_id: args.targetClientMsgId,
+      scope: "everyone"
+    })
+  );
+}
+function encodeEdit(args) {
+  return encodeUtf8(
+    JSON.stringify({
+      v: 1,
+      type: "edit",
+      client_msg_id: args.clientMsgId,
+      target_client_msg_id: args.targetClientMsgId,
+      new_text: args.newText
+    })
+  );
+}
 function encodeReaction(args) {
   return encodeUtf8(
     JSON.stringify({
@@ -2793,6 +2960,18 @@ function decodeEnvelope(bytes) {
   const s = decodeUtf8(bytes);
   try {
     const o = JSON.parse(s);
+    if (typeof o === "object" && o !== null && o.type === "delete") {
+      return {
+        type: "delete",
+        text: null,
+        clientMsgId: o.client_msg_id ?? "",
+        replyTo: null,
+        delete: {
+          targetClientMsgId: o.target_client_msg_id ?? "",
+          scope: o.scope ?? "everyone"
+        }
+      };
+    }
     if (typeof o === "object" && o !== null && o.type === "reaction") {
       return {
         type: "reaction",
@@ -2806,6 +2985,18 @@ function decodeEnvelope(bytes) {
         }
       };
     }
+    if (typeof o === "object" && o !== null && o.type === "edit") {
+      return {
+        type: "edit",
+        text: null,
+        clientMsgId: o.client_msg_id ?? "",
+        replyTo: null,
+        edit: {
+          targetClientMsgId: o.target_client_msg_id ?? "",
+          newText: o.new_text ?? ""
+        }
+      };
+    }
     if (typeof o === "object" && o !== null && o.type === "text" && typeof o.v === "number") {
       return {
         type: "text",
@@ -3120,6 +3311,103 @@ var GroupMessaging = class {
       clientMsgId: args.clientMsgId
     };
   }
+  /** Send an edit (edit-by-supersession on a target message). Encrypts a
+   * `type:'edit'` envelope at the current epoch and sends through the SAME MLS
+   * application path as `sendText` (the server stays blind — an edit is just
+   * another application message). Persists the outgoing edit row so it re-folds
+   * onto its target's text after a reload (the own-send half of the reload
+   * parity). NEVER rebases (epoch-bound like any application message). */
+  async sendEdit(group, args) {
+    const plaintext = encodeEdit({
+      clientMsgId: args.clientMsgId,
+      targetClientMsgId: args.targetClientMsgId,
+      newText: args.newText
+    });
+    const ct = await this.engine.encryptApplication(fromBase64(group.rfcGroupId), plaintext);
+    const body = {
+      ciphertext_b64: toBase64(ct),
+      client_idem_key: randomId()
+    };
+    const wire = await palbeRequest(
+      this.rt,
+      "POST",
+      MessagingPaths.groupMessages(group.displayId),
+      { body }
+    );
+    const stored = {
+      id: `${group.rfcGroupId}#${wire.server_seq}`,
+      direction: "outgoing",
+      text: null,
+      senderDeviceId: this.selfDeviceId,
+      epoch: wire.epoch,
+      serverSeq: wire.server_seq,
+      at: Date.now(),
+      clientMsgId: args.clientMsgId,
+      replyTo: null,
+      envelopeType: "edit",
+      edit: {
+        targetClientMsgId: args.targetClientMsgId,
+        newText: args.newText
+      }
+    };
+    try {
+      await this.messageStore.append(group.rfcGroupId, stored);
+    } catch {
+    }
+    return {
+      receipt: { serverSeq: wire.server_seq, epoch: wire.epoch },
+      clientMsgId: args.clientMsgId
+    };
+  }
+  /** Send a delete-for-everyone tombstone on a target message. Encrypts a
+   * `type:'delete'` envelope at the current epoch and sends through the SAME MLS
+   * application path as `sendText` (the server stays blind — a delete is just
+   * another opaque application message; the original ciphertext row is NOT
+   * removed). Persists the outgoing delete row so the tombstone re-folds onto its
+   * target after a reload (the own-send half of the reload parity — the iOS-review
+   * CRITICAL boundary; the projection's `.delete` branch re-folds it). NEVER
+   * rebases (epoch-bound like any application message). */
+  async sendDelete(group, args) {
+    const plaintext = encodeDelete({
+      clientMsgId: args.clientMsgId,
+      targetClientMsgId: args.targetClientMsgId
+    });
+    const ct = await this.engine.encryptApplication(fromBase64(group.rfcGroupId), plaintext);
+    const body = {
+      ciphertext_b64: toBase64(ct),
+      client_idem_key: randomId()
+    };
+    const wire = await palbeRequest(
+      this.rt,
+      "POST",
+      MessagingPaths.groupMessages(group.displayId),
+      { body }
+    );
+    const stored = {
+      id: `${group.rfcGroupId}#${wire.server_seq}`,
+      direction: "outgoing",
+      text: null,
+      senderDeviceId: this.selfDeviceId,
+      epoch: wire.epoch,
+      serverSeq: wire.server_seq,
+      at: Date.now(),
+      clientMsgId: args.clientMsgId,
+      replyTo: null,
+      envelopeType: "delete",
+      delete: {
+        targetClientMsgId: args.targetClientMsgId,
+        scope: "everyone"
+      }
+    };
+    try {
+      await this.messageStore.append(group.rfcGroupId, stored);
+    } catch {
+    }
+    return {
+      receipt: { serverSeq: wire.server_seq, epoch: wire.epoch },
+      clientMsgId: args.clientMsgId
+    };
+  }
   // ── The rebase loop ──
   async commitWithRebase(rfcGroupId, build) {
     const gidBytes = fromBase64(rfcGroupId);
@@ -3237,6 +3525,7 @@ var ReactionFold = class {
 };
 
 // src/messaging/chat.ts
+var DELETED_DESCRIPTOR = "\u{1F6AB} This message was deleted";
 var Chat = class {
   /** Stable, URL/log-safe id (the grp_ display id once active; a reserved local id while draft). */
   id;
@@ -3256,6 +3545,23 @@ var Chat = class {
   byClientMsgId = /* @__PURE__ */ new Map();
   /** The single authoritative reaction fold for this chat (live + own-send + history). */
   reactionFold = new ReactionFold();
+  /** The single authoritative edit fold for this chat (live + own-send + history). */
+  editFold = new EditFold();
+  /** The single authoritative delete-for-everyone fold (live + own-send + history).
+   * A tombstone scrubs its target in place (delete DOMINATES edit at render). */
+  deleteFold = new DeleteFold();
+  /** delete-for-me suppression keys (clientMsgId, or `seq:<serverSeq>` for legacy)
+   * — the message is OMITTED from this view. Local + persisted per chat, NO wire. */
+  suppressed = /* @__PURE__ */ new Set();
+  /** True once the persisted suppression set has been loaded (so the omit applies
+   * even on the cold-launch hydrate path before a fresh deleteForMe). */
+  suppressedLoaded = false;
+  /** Per-target BASE (original) text, so the rendered text is `edit ?? original`.
+   * Seeded once per target (write-once base) so a 2nd own edit can't corrupt it. */
+  originalTextByClientMsgId = /* @__PURE__ */ new Map();
+  /** Per-target AUTHOR userId — the EditFold author-gate input (filled at bubble
+   * projection time from senderUserId; '' = resolved-but-unknown peer). */
+  authorByClientMsgId = /* @__PURE__ */ new Map();
   loadedEarliestSeq = null;
   historyLoaded = false;
   wired = false;
@@ -3298,7 +3604,7 @@ var Chat = class {
     return this.kind === "direct";
   }
   get messages() {
-    return this.messageList;
+    return this.surfaced();
   }
   get members() {
     return this.memberCache;
@@ -3307,13 +3613,49 @@ var Chat = class {
     return this.typingList;
   }
   get lastMessage() {
-    return this.messageList.at(-1) ?? null;
+    return this.surfaced().at(-1) ?? null;
   }
   get unreadCount() {
-    return this.messageList.filter(
-      (m) => m.direction === "incoming" && m.serverSeq > this.readWatermark
+    return this.surfaced().filter(
+      (m) => m.direction === "incoming" && !m.isDeleted && m.serverSeq > this.readWatermark
     ).length;
   }
+  /**
+   * The RENDER PRECEDENCE — the single composition point (live AND history project
+   * through it identically). Over the raw `messageList` (which already carries the
+   * folded edit text + reactions + reply):
+   *   (1) in the delete-for-me suppression set → OMIT the message entirely;
+   *   (2) else tombstoned (delete-for-everyone) → the neutral "deleted" descriptor
+   *       with reactions/reply/edit HIDDEN (delete DOMINATES edit — short-circuit);
+   *   (3) else the row as-is (edit overlay + reactions + reply already applied).
+   * Pure over (messageList, deleteFold, suppressed) — recomputed on every read so a
+   * just-folded delete / just-suppressed key takes effect without rewriting rows.
+   */
+  surfaced() {
+    const out = [];
+    for (const m of this.messageList) {
+      const key = this.suppressionKey(m);
+      if (this.suppressed.has(key)) continue;
+      const tombstoned = m.clientMsgId && this.deleteFold.isTombstoned(m.clientMsgId) || m.isDeleted;
+      if (tombstoned) {
+        out.push({
+          ...m,
+          text: DELETED_DESCRIPTOR,
+          reactions: {},
+          replyTo: null,
+          edited: false,
+          isDeleted: true
+        });
+        continue;
+      }
+      out.push(m);
+    }
+    return out;
+  }
+  /** The delete-for-me suppression key: clientMsgId when present, else `seq:<n>`. */
+  suppressionKey(m) {
+    return m.clientMsgId ? m.clientMsgId : `seq:${m.serverSeq}`;
+  }
   get title() {
     if (this.titleOverride) return this.titleOverride;
     if (this._group?.name) return this._group.name;
@@ -3337,9 +3679,28 @@ var Chat = class {
     if (this.wired || this._state !== "active" || !this._group) return;
     this.wired = true;
     this.liveUnsub = this.backend.subscribeLive(this._group, this);
+    void this.loadSuppressed();
     void this.hydrateHistory();
     void this.refreshMembers();
   }
+  /** Hydrate the persisted delete-for-me suppression keys (once), then re-emit so
+   * any already-surfaced suppressed message is omitted (cold-launch parity). */
+  async loadSuppressed() {
+    if (this.suppressedLoaded || !this._group) return;
+    this.suppressedLoaded = true;
+    try {
+      const keys = await this.backend.loadSuppressed(this._group);
+      let changed = false;
+      for (const k of keys) {
+        if (!this.suppressed.has(k)) {
+          this.suppressed.add(k);
+          changed = true;
+        }
+      }
+      if (changed) this.emit();
+    } catch {
+    }
+  }
   async hydrateHistory() {
     if (this.historyLoaded || !this._group) return;
     this.historyLoaded = true;
@@ -3350,19 +3711,26 @@ var Chat = class {
     let changed = false;
     for (const m of incoming) {
       if (m.serverSeq <= 0) continue;
-      if (m.clientMsgId && m.text !== null) {
+      if (m.clientMsgId && m.text !== null && !m.isDeleted) {
         this.byClientMsgId.set(m.clientMsgId, {
           text: m.text,
           senderUserId: m.senderUserId ?? ""
         });
       }
+      if (m.clientMsgId && !m.isDeleted) {
+        this.seedEditBase(m.clientMsgId, m.text, m.senderUserId ?? "");
+      }
     }
+    this.editFold.reevaluateHeld(this.authorOfTarget);
     for (const m of incoming) {
       if (m.serverSeq <= 0) continue;
       const key = this.internalKey(m.serverSeq);
       if (this.seenKeys.has(key)) continue;
       this.seenKeys.add(key);
-      this.messageList.push(this.applyReactionTally(m));
+      if (m.clientMsgId && !m.isDeleted) {
+        this.deleteFold.reevaluatePending(m.clientMsgId, m.senderUserId);
+      }
+      this.messageList.push(this.applyEditOverlay(this.applyReactionTally(m)));
       changed = true;
       this.loadedEarliestSeq = Math.min(this.loadedEarliestSeq ?? m.serverSeq, m.serverSeq);
     }
@@ -3403,6 +3771,37 @@ var Chat = class {
       }
       return;
     }
+    if (incoming.envelopeType === "edit" && incoming.edit) {
+      const editorUserId = direction === "outgoing" ? this.backend.selfUserId : senderUser;
+      this.editFold.ingest(
+        {
+          targetClientMsgId: incoming.edit.targetClientMsgId,
+          editorUserId,
+          newText: incoming.edit.newText,
+          epoch: incoming.epoch,
+          serverSeq: incoming.serverSeq,
+          eventClientMsgId: incoming.clientMsgId
+        },
+        this.authorOfTarget
+      );
+      this.recomputeEdit(incoming.edit.targetClientMsgId);
+      return;
+    }
+    if (incoming.envelopeType === "delete" && incoming.delete) {
+      const actorUserId = direction === "outgoing" ? this.backend.selfUserId : senderUser;
+      this.deleteFold.ingest(
+        {
+          targetClientMsgId: incoming.delete.targetClientMsgId,
+          actorUserId,
+          epoch: incoming.epoch,
+          serverSeq: incoming.serverSeq,
+          eventClientMsgId: incoming.clientMsgId
+        },
+        this.authorOfTarget
+      );
+      this.emit();
+      return;
+    }
     const incomingClientMsgId = incoming.clientMsgId;
     const incomingReplyRef = incoming.replyRef;
     let resolvedReplyTo = null;
@@ -3421,7 +3820,11 @@ var Chat = class {
       replyTo: resolvedReplyTo,
       // Attach any tally already folded for this message (a reaction that arrived
       // BEFORE its target — the dangling case — renders the moment the target lands).
-      reactions: incomingClientMsgId ? this.reactionFold.tally(incomingClientMsgId) : {}
+      reactions: incomingClientMsgId ? this.reactionFold.tally(incomingClientMsgId) : {},
+      // Default false; applyEditOverlay below folds any edit that arrived first.
+      edited: false,
+      // Default false; surfaced() applies the tombstone scrub if a delete folded.
+      isDeleted: false
     };
     if (incomingClientMsgId && incoming.text !== null) {
       this.byClientMsgId.set(incomingClientMsgId, {
@@ -3429,7 +3832,12 @@ var Chat = class {
         senderUserId: senderUser ?? ""
       });
     }
-    this.messageList.push(msg);
+    if (incomingClientMsgId) {
+      this.seedEditBase(incomingClientMsgId, incoming.text, senderUser);
+      this.editFold.reevaluateHeld(this.authorOfTarget);
+      this.deleteFold.reevaluatePending(incomingClientMsgId, senderUser);
+    }
+    this.messageList.push(this.applyEditOverlay(msg));
     this.messageList.sort((a, b) => a.serverSeq - b.serverSeq);
     this.loadedEarliestSeq = Math.min(
       this.loadedEarliestSeq ?? incoming.serverSeq,
@@ -3437,6 +3845,19 @@ var Chat = class {
     );
     this.emit();
   }
+  /** The EditFold author-gate input: the target message's resolved author userId
+   * (null = target unknown/dangling → the fold HOLDs). Captured as a bound arrow
+   * so it can be passed to the pure EditFold. */
+  authorOfTarget = (targetClientMsgId) => this.authorByClientMsgId.get(targetClientMsgId) ?? null;
+  /** Seed the per-target base text + author for the edit fold. Base is write-once
+   * (a later own/peer edit must not overwrite the original we render against). The
+   * author is (re)recorded whenever a non-empty resolution is available. */
+  seedEditBase(clientMsgId, text, author) {
+    if (!this.originalTextByClientMsgId.has(clientMsgId)) {
+      this.originalTextByClientMsgId.set(clientMsgId, text);
+    }
+    if (author !== null) this.authorByClientMsgId.set(clientMsgId, author);
+  }
   /**
    * Rebuild the target message's `reactions` from the authoritative fold and
    * re-emit. No-op when the target isn't present yet (its tally is attached the
@@ -3466,6 +3887,46 @@ var Chat = class {
     if (sameReactions(m.reactions, tally)) return m;
     return { ...m, reactions: tally };
   }
+  /**
+   * Rebuild the target message's rendered `text` + `edited` flag from the
+   * authoritative edit fold and re-emit, PRESERVING `.reactions` and `.replyTo`
+   * (the reaction-polish lesson — never clobber). text = `editFold.text(cid) ??
+   * base`; base is the seeded original so a forged/ignored edit leaves it intact.
+   * No-op when the target isn't present yet (the fold already recorded it; the
+   * overlay applies the moment the target lands) or when unchanged.
+   */
+  recomputeEdit(targetClientMsgId) {
+    if (!targetClientMsgId) return;
+    const editText = this.editFold.text(targetClientMsgId);
+    const foldEdited = this.editFold.isEdited(targetClientMsgId);
+    let changed = false;
+    this.messageList = this.messageList.map((m) => {
+      if (m.clientMsgId !== targetClientMsgId) return m;
+      const base = this.originalTextByClientMsgId.has(targetClientMsgId) ? this.originalTextByClientMsgId.get(targetClientMsgId) ?? null : m.text;
+      const text = editText ?? base;
+      const edited = foldEdited || m.edited;
+      if (m.text === text && m.edited === edited) return m;
+      changed = true;
+      return { ...m, text, edited };
+    });
+    if (changed) this.emit();
+  }
+  /**
+   * Overlay the authoritative edit fold's winning text + flag onto a message as it
+   * is appended/merged. The fold WINS when it has an edit for this target;
+   * otherwise the upstream `text`/`edited` (e.g. the coordinator's page-local
+   * history fold) is preserved. PRESERVES reactions + replyTo.
+   */
+  applyEditOverlay(m) {
+    if (!m.clientMsgId) return m;
+    const editText = this.editFold.text(m.clientMsgId);
+    const foldEdited = this.editFold.isEdited(m.clientMsgId);
+    if (editText === null && !foldEdited) return m;
+    const text = editText ?? m.text;
+    const edited = foldEdited || m.edited;
+    if (m.text === text && m.edited === edited) return m;
+    return { ...m, text, edited };
+  }
   /** @internal — called by the backend's conv subscription. */
   applyConv(event, payload) {
     const userId = typeof payload.user_id === "string" ? payload.user_id : null;
@@ -3520,6 +3981,8 @@ var Chat = class {
       this.memberCache = m;
       this.emit();
     }
+    this.editFold.reevaluateHeld(this.authorOfTarget);
+    for (const cid of this.originalTextByClientMsgId.keys()) this.recomputeEdit(cid);
   }
   seedMembersFromGroup(group) {
     const seed = [
@@ -3598,6 +4061,7 @@ var Chat = class {
     this.seenKeys.add(key);
     if (clientMsgId) {
       this.byClientMsgId.set(clientMsgId, { text, senderUserId: this.backend.selfUserId });
+      this.seedEditBase(clientMsgId, text, this.backend.selfUserId);
     }
     this.messageList.push({
       id: this.publicId(receipt.serverSeq),
@@ -3611,7 +4075,11 @@ var Chat = class {
       replyTo: resolvedReplyTo,
       // Attach any tally already folded for this own-sent message (rare, but keeps
       // the dangling-target invariant uniform across every append path).
-      reactions: clientMsgId ? this.reactionFold.tally(clientMsgId) : {}
+      reactions: clientMsgId ? this.reactionFold.tally(clientMsgId) : {},
+      // Own-sent edits fold via edit() after the fact; new sends start unedited.
+      edited: false,
+      // Own-sent deletes fold via deleteForEveryone() after the fact; start live.
+      isDeleted: false
     });
     this.messageList.sort((a, b) => a.serverSeq - b.serverSeq);
     this.emit();
@@ -3692,6 +4160,83 @@ var Chat = class {
     });
     this.recomputeReactions(message.clientMsgId);
   }
+  // ── Edit ──
+  /** Edit an own text message (edit-by-supersession). No-op if the message isn't
+   * editable (empty clientMsgId, or not a `text` kind). The edit folds locally
+   * with the server receipt's `(epoch, serverSeq)` so the target's text updates
+   * instantly; the durable echo on the next pump is a fold no-op (dedup on the
+   * SAME wire clientMsgId). Never appends a bubble; PRESERVES the target's
+   * reactions + reply context. Only the original author's edits count — for an own
+   * message self IS the author, so the author-gate passes. */
+  async edit(message, newText) {
+    if (!message.clientMsgId || message.kind !== "text") return;
+    const group = await this.materializeIfNeeded();
+    const clientMsgId = mintClientMsgId();
+    const { receipt } = await this.backend.sendEdit(group, {
+      clientMsgId,
+      targetClientMsgId: message.clientMsgId,
+      newText
+    });
+    this.seedEditBase(message.clientMsgId, message.text, this.backend.selfUserId);
+    this.editFold.ingest(
+      {
+        targetClientMsgId: message.clientMsgId,
+        editorUserId: this.backend.selfUserId,
+        newText,
+        epoch: receipt.epoch,
+        serverSeq: receipt.serverSeq,
+        eventClientMsgId: clientMsgId
+      },
+      this.authorOfTarget
+    );
+    this.recomputeEdit(message.clientMsgId);
+  }
+  // ── Delete ──
+  /** Delete a message for EVERYONE (a cooperative encrypted tombstone). Only the
+   * ORIGINAL SENDER can do this — for an own message self IS the author, so the
+   * author-gate passes. Legacy messages (empty clientMsgId) are DISABLED (a
+   * tombstone keys on the target's clientMsgId, which they lack) — no-op. Sends a
+   * `type:'delete'` envelope through the SAME MLS path as a text message (the
+   * server stays blind), folds the own delete locally so the target scrubs in
+   * place instantly (the durable echo dedups on the SAME wire clientMsgId), and
+   * re-emits. NEVER appends a bubble. delete-for-me'ing the target becomes moot. */
+  async deleteForEveryone(message) {
+    if (!message.clientMsgId) return;
+    const group = await this.materializeIfNeeded();
+    const clientMsgId = mintClientMsgId();
+    const { receipt } = await this.backend.sendDelete(group, {
+      clientMsgId,
+      targetClientMsgId: message.clientMsgId
+    });
+    this.seedEditBase(message.clientMsgId, message.text, this.backend.selfUserId);
+    this.deleteFold.ingest(
+      {
+        targetClientMsgId: message.clientMsgId,
+        actorUserId: this.backend.selfUserId,
+        epoch: receipt.epoch,
+        serverSeq: receipt.serverSeq,
+        eventClientMsgId: clientMsgId
+      },
+      this.authorOfTarget
+    );
+    this.emit();
+  }
+  /** Delete a message for ME only — a LOCAL, per-device suppression. NO wire, NO
+   * attribution, no server contact: the message is OMITTED from THIS view and the
+   * suppression key persists per chat (survives reload). The key is the message's
+   * clientMsgId when present, else `seq:<serverSeq>` for legacy messages. */
+  async deleteForMe(message) {
+    const key = message.clientMsgId ? message.clientMsgId : `seq:${message.serverSeq}`;
+    if (this.suppressed.has(key)) return;
+    this.suppressed.add(key);
+    this.emit();
+    if (this._group) {
+      try {
+        await this.backend.saveSuppressed(this._group, [...this.suppressed]);
+      } catch {
+      }
+    }
+  }
 };
 function sameReactions(a, b) {
   const ak = Object.keys(a);
@@ -3871,6 +4416,8 @@ var MessageDeliverySource = class {
         const decoded = decodeEnvelope(received.data);
         const { text, clientMsgId, replyTo } = decoded;
         const isReaction = decoded.type === "reaction" && decoded.reaction != null;
+        const isEdit = decoded.type === "edit" && decoded.edit != null;
+        const isDelete = decoded.type === "delete" && decoded.delete != null;
         const senderDeviceId = row.sender_device_id ?? decodeSenderDeviceId(received.sender);
         const stored = {
           id: `${group.rfcGroupId}#${row.server_seq}`,
@@ -3898,6 +4445,29 @@ var MessageDeliverySource = class {
               emoji: decoded.reaction.emoji,
               op: decoded.reaction.op
             }
+          } : {},
+          // Thread the edit discriminator + new text through the persisted row so an
+          // edit folded LIVE re-folds onto its target after a reload (the reload-parity
+          // boundary — mirrors iOS T3). Omitted for non-edits → old rows hydrate as
+          // `'text'`/no-edit (backward-compat).
+          ...isEdit && decoded.edit ? {
+            envelopeType: "edit",
+            edit: {
+              targetClientMsgId: decoded.edit.targetClientMsgId,
+              newText: decoded.edit.newText
+            }
+          } : {},
+          // Thread the delete discriminator + target through the persisted row so a
+          // delete-for-everyone tombstone folded LIVE re-folds onto its target after
+          // a reload (the reload-parity boundary — the iOS-review CRITICAL lesson;
+          // the projection's `.delete` branch re-folds it so it never leaks a blank
+          // bubble). Omitted for non-deletes → old rows hydrate as `'text'`/no-delete.
+          ...isDelete && decoded.delete ? {
+            envelopeType: "delete",
+            delete: {
+              targetClientMsgId: decoded.delete.targetClientMsgId,
+              scope: decoded.delete.scope
+            }
           } : {}
         };
         try {
@@ -3916,7 +4486,9 @@ var MessageDeliverySource = class {
           clientMsgId,
           replyRef: replyTo,
           envelopeType: decoded.type ?? "text",
-          reaction: isReaction ? decoded.reaction : null
+          reaction: isReaction ? decoded.reaction : null,
+          edit: isEdit ? decoded.edit : null,
+          delete: isDelete ? decoded.delete : null
         });
         return true;
       }
@@ -5738,6 +6310,36 @@ var SignatureKeyStore = class {
   }
 };
 
+// src/messaging/suppression.ts
+var SuppressionStore = class {
+  constructor(kv) {
+    this.kv = kv;
+  }
+  kv;
+  key(rfcGroupId) {
+    return `supp:${rfcGroupId}`;
+  }
+  /** Load the persisted suppression keys for a chat (empty array if none). */
+  async load(rfcGroupId) {
+    const raw = await this.kv.get(this.key(rfcGroupId));
+    if (!raw) return [];
+    try {
+      const parsed = JSON.parse(decodeUtf8(raw));
+      return Array.isArray(parsed) ? parsed : [];
+    } catch {
+      return [];
+    }
+  }
+  /** Persist the full suppression key set for a chat (deterministic order). */
+  async save(rfcGroupId, keys) {
+    const sorted = [...new Set(keys)].sort();
+    await this.kv.set(this.key(rfcGroupId), encodeUtf8(JSON.stringify(sorted)));
+  }
+  async wipe() {
+    for (const k of await this.kv.keys("supp:")) await this.kv.delete(k);
+  }
+};
+
 // src/messaging/coordinator.ts
 var MessagingCoordinator = class {
   constructor(rt) {
@@ -5747,6 +6349,7 @@ var MessagingCoordinator = class {
     this.sigStore = new SignatureKeyStore(this.kv);
     this.groupStore = new GroupStateStorage(this.kv);
     this.kpStore = new KeyPackageStorage(this.kv);
+    this.suppressionStore = new SuppressionStore(this.kv);
     this.registry.attachChatList(
       (chats) => {
         this.chatList = chats;
@@ -5761,6 +6364,7 @@ var MessagingCoordinator = class {
   sigStore;
   groupStore;
   kpStore;
+  suppressionStore;
   registry = new GroupRegistry();
   resolved = null;
   resolvePromise = null;
@@ -5924,6 +6528,22 @@ var MessagingCoordinator = class {
     const r = await this.resolve();
     return r.groups.sendReaction(group, args);
   }
+  async sendEdit(group, args) {
+    const r = await this.resolve();
+    return r.groups.sendEdit(group, args);
+  }
+  async sendDelete(group, args) {
+    const r = await this.resolve();
+    return r.groups.sendDelete(group, args);
+  }
+  /** Load this chat's persisted delete-for-me suppression keys (durable-only). */
+  loadSuppressed(group) {
+    return this.suppressionStore.load(group.rfcGroupId);
+  }
+  /** Persist this chat's delete-for-me suppression keys (durable-only, no wire). */
+  saveSuppressed(group, keys) {
+    return this.suppressionStore.save(group.rfcGroupId, keys);
+  }
   async history(group, limit, before) {
     const r = await this.resolve();
     const rows = await r.messageStore.history(group.rfcGroupId, limit, before);
@@ -6020,9 +6640,53 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
       eventClientMsgId: s.clientMsgId ?? `${s.id}`
     });
   }
+  const editFold = new EditFold();
+  const deleteFold = new DeleteFold();
+  const authorByClientMsgId = /* @__PURE__ */ new Map();
+  for (const s of rows) {
+    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete")
+      continue;
+    const cid = s.clientMsgId ?? "";
+    if (!cid) continue;
+    const author = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null);
+    if (author != null) authorByClientMsgId.set(cid, author);
+  }
+  const authorOfTarget = (cid) => authorByClientMsgId.get(cid) ?? null;
+  for (const s of rows) {
+    if (s.envelopeType !== "edit" || !s.edit) continue;
+    const editor = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null) ?? null;
+    editFold.ingest(
+      {
+        targetClientMsgId: s.edit.targetClientMsgId,
+        editorUserId: editor,
+        newText: s.edit.newText,
+        epoch: s.epoch,
+        serverSeq: s.serverSeq,
+        eventClientMsgId: s.clientMsgId ?? `${s.id}`
+      },
+      authorOfTarget
+    );
+  }
+  editFold.reevaluateHeld(authorOfTarget);
+  for (const s of rows) {
+    if (s.envelopeType !== "delete" || !s.delete) continue;
+    const actor = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null) ?? null;
+    deleteFold.ingest(
+      {
+        targetClientMsgId: s.delete.targetClientMsgId,
+        actorUserId: actor,
+        epoch: s.epoch,
+        serverSeq: s.serverSeq,
+        eventClientMsgId: s.clientMsgId ?? `${s.id}`
+      },
+      authorOfTarget
+    );
+  }
+  for (const [cid, author] of authorByClientMsgId) deleteFold.reevaluatePending(cid, author);
   const lookup = /* @__PURE__ */ new Map();
   for (const s of rows) {
-    if (s.envelopeType === "reaction") continue;
+    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete")
+      continue;
     const cid = s.clientMsgId ?? "";
     if (cid && s.text !== null) {
       const senderUserId = s.direction === "outgoing" ? selfUserId : "";
@@ -6031,8 +6695,27 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
   }
   const out = [];
   for (const s of rows) {
-    if (s.envelopeType === "reaction") continue;
+    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete")
+      continue;
     const clientMsgId = s.clientMsgId ?? "";
+    const isDeleted = clientMsgId ? deleteFold.isTombstoned(clientMsgId) : false;
+    if (isDeleted) {
+      out.push({
+        id: `${displayId}#${s.serverSeq}`,
+        kind: "text",
+        direction: s.direction,
+        senderUserId: s.direction === "outgoing" ? selfUserId : null,
+        text: DELETED_DESCRIPTOR,
+        serverSeq: s.serverSeq,
+        sentAt: new Date(s.at),
+        clientMsgId,
+        replyTo: null,
+        reactions: {},
+        edited: false,
+        isDeleted: true
+      });
+      continue;
+    }
     let replyTo = null;
     if (s.replyTo) {
       const ref = {
@@ -6047,17 +6730,21 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
       };
       replyTo = resolveReply(ref, (id) => lookup.get(id) ?? null);
     }
+    const editText = clientMsgId ? editFold.text(clientMsgId) : null;
+    const edited = clientMsgId ? editFold.isEdited(clientMsgId) : false;
     out.push({
       id: `${displayId}#${s.serverSeq}`,
       kind: s.text != null ? "text" : "system",
       direction: s.direction,
       senderUserId: s.direction === "outgoing" ? selfUserId : null,
-      text: s.text,
+      text: editText ?? s.text,
       serverSeq: s.serverSeq,
       sentAt: new Date(s.at),
       clientMsgId,
       replyTo,
-      reactions: clientMsgId ? fold.tally(clientMsgId) : {}
+      reactions: clientMsgId ? fold.tally(clientMsgId) : {},
+      edited,
+      isDeleted: false
     });
   }
   return out;
@@ -6795,7 +7482,7 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "1.2.1";
+var VERSION = "1.4.0";
 
 // src/runtime.ts
 function buildRuntime(config) {