@palbase/web 1.3.0 → 1.4.0

package/dist/{analytics-facade-Cq7R-VH_.d.ts → analytics-facade-CbXprYrS.d.ts}

@@ -764,6 +764,16 @@ interface ChatMessage {
      * a visible message of its own — it only overlays the target's text + flag.
      */
     readonly edited: boolean;
+    /**
+     * Whether this message has been deleted-for-everyone (a cooperative encrypted
+     * tombstone from the original sender). Defaults to `false`. Once a valid
+     * tombstone folds onto this message it stays `true` (absorbing/sticky within
+     * retention). A deleted message renders ONLY the neutral "deleted" descriptor
+     * as its `text`, with reactions + reply + edit HIDDEN — delete DOMINATES edit.
+     * A delete is never a visible message of its own. (delete-for-me is a separate,
+     * local-only suppression that omits the message from this view entirely.)
+     */
+    readonly isDeleted: boolean;
 }
 /** The receipt from a send — the server's monotonic sequence + accepted epoch. */
 interface SentReceipt {
@@ -813,6 +823,10 @@ interface EditPayload {
     targetClientMsgId: string;
     newText: string;
 }
+interface DeletePayload {
+    targetClientMsgId: string;
+    scope: string;
+}
 
 /** A decoded incoming message handed to chat listeners. */
 interface IncomingMessage {
@@ -839,6 +853,10 @@ interface IncomingMessage {
     /** The decoded edit payload, present only when `envelopeType === 'edit'`. Lets
      * the Chat route an edit into its EditFold instead of appending a visible bubble. */
     edit?: EditPayload | null;
+    /** The decoded delete payload, present only when `envelopeType === 'delete'`. Lets
+     * the Chat route a delete-for-everyone tombstone into its DeleteFold instead of
+     * appending a visible bubble. */
+    delete?: DeletePayload | null;
 }
 
 /** The intended participants of a draft chat (held until the first send). */
@@ -883,6 +901,16 @@ interface ChatBackend {
         receipt: SentReceipt;
         clientMsgId: string;
     }>;
+    /** Send a delete-for-everyone tombstone on a target message through the same MLS
+     * application path as `sendText` (the server stays blind — a delete is just
+     * another opaque application message). Returns the receipt + the wire clientMsgId. */
+    sendDelete(group: MessagingGroup, args: {
+        clientMsgId: string;
+        targetClientMsgId: string;
+    }): Promise<{
+        receipt: SentReceipt;
+        clientMsgId: string;
+    }>;
     history(group: MessagingGroup, limit: number, before?: number): Promise<ChatMessage[]>;
     members(group: MessagingGroup): Promise<ChatMember[]>;
     addMember(group: MessagingGroup, userId: string): Promise<void>;
@@ -895,6 +923,10 @@ interface ChatBackend {
     subscribeLive(group: MessagingGroup, chat: Chat): Unsubscribe$1;
     /** Resolve a sender device id → its owning user id (for senderUserId). */
     userIdForDevice(group: MessagingGroup, deviceId: string): Promise<string | null>;
+    /** Load this chat's persisted delete-for-me suppression keys (durable, no wire). */
+    loadSuppressed(group: MessagingGroup): Promise<string[]>;
+    /** Persist this chat's delete-for-me suppression keys (durable, no wire). */
+    saveSuppressed(group: MessagingGroup, keys: string[]): Promise<void>;
 }
 declare class Chat {
     /** Stable, URL/log-safe id (the grp_ display id once active; a reserved local id while draft). */
@@ -917,6 +949,15 @@ declare class Chat {
     private readonly reactionFold;
     /** The single authoritative edit fold for this chat (live + own-send + history). */
     private readonly editFold;
+    /** The single authoritative delete-for-everyone fold (live + own-send + history).
+     * A tombstone scrubs its target in place (delete DOMINATES edit at render). */
+    private readonly deleteFold;
+    /** delete-for-me suppression keys (clientMsgId, or `seq:<serverSeq>` for legacy)
+     * — the message is OMITTED from this view. Local + persisted per chat, NO wire. */
+    private readonly suppressed;
+    /** True once the persisted suppression set has been loaded (so the omit applies
+     * even on the cold-launch hydrate path before a fresh deleteForMe). */
+    private suppressedLoaded;
     /** Per-target BASE (original) text, so the rendered text is `edit ?? original`.
      * Seeded once per target (write-once base) so a 2nd own edit can't corrupt it. */
     private readonly originalTextByClientMsgId;
@@ -948,9 +989,26 @@ declare class Chat {
     get typing(): readonly ChatMember[];
     get lastMessage(): ChatMessage | null;
     get unreadCount(): number;
+    /**
+     * The RENDER PRECEDENCE — the single composition point (live AND history project
+     * through it identically). Over the raw `messageList` (which already carries the
+     * folded edit text + reactions + reply):
+     *   (1) in the delete-for-me suppression set → OMIT the message entirely;
+     *   (2) else tombstoned (delete-for-everyone) → the neutral "deleted" descriptor
+     *       with reactions/reply/edit HIDDEN (delete DOMINATES edit — short-circuit);
+     *   (3) else the row as-is (edit overlay + reactions + reply already applied).
+     * Pure over (messageList, deleteFold, suppressed) — recomputed on every read so a
+     * just-folded delete / just-suppressed key takes effect without rewriting rows.
+     */
+    private surfaced;
+    /** The delete-for-me suppression key: clientMsgId when present, else `seq:<n>`. */
+    private suppressionKey;
     get title(): string;
     presence(userId: string): PresenceState | null;
     private ensureWired;
+    /** Hydrate the persisted delete-for-me suppression keys (once), then re-emit so
+     * any already-surfaced suppressed message is omitted (cold-launch parity). */
+    private loadSuppressed;
     private hydrateHistory;
     private mergeHistory;
     /** @internal — called by the backend's live subscription. */
@@ -1028,6 +1086,20 @@ declare class Chat {
      * reactions + reply context. Only the original author's edits count — for an own
      * message self IS the author, so the author-gate passes. */
     edit(message: ChatMessage, newText: string): Promise<void>;
+    /** Delete a message for EVERYONE (a cooperative encrypted tombstone). Only the
+     * ORIGINAL SENDER can do this — for an own message self IS the author, so the
+     * author-gate passes. Legacy messages (empty clientMsgId) are DISABLED (a
+     * tombstone keys on the target's clientMsgId, which they lack) — no-op. Sends a
+     * `type:'delete'` envelope through the SAME MLS path as a text message (the
+     * server stays blind), folds the own delete locally so the target scrubs in
+     * place instantly (the durable echo dedups on the SAME wire clientMsgId), and
+     * re-emits. NEVER appends a bubble. delete-for-me'ing the target becomes moot. */
+    deleteForEveryone(message: ChatMessage): Promise<void>;
+    /** Delete a message for ME only — a LOCAL, per-device suppression. NO wire, NO
+     * attribution, no server contact: the message is OMITTED from THIS view and the
+     * suppression key persists per chat (survives reload). The key is the message's
+     * clientMsgId when present, else `seq:<serverSeq>` for legacy messages. */
+    deleteForMe(message: ChatMessage): Promise<void>;
 }
 
 declare class PalbeMessaging {

package/dist/{analytics-facade-B8UATgS4.d.cts → analytics-facade-DA9TGKLF.d.cts}

@@ -764,6 +764,16 @@ interface ChatMessage {
      * a visible message of its own — it only overlays the target's text + flag.
      */
     readonly edited: boolean;
+    /**
+     * Whether this message has been deleted-for-everyone (a cooperative encrypted
+     * tombstone from the original sender). Defaults to `false`. Once a valid
+     * tombstone folds onto this message it stays `true` (absorbing/sticky within
+     * retention). A deleted message renders ONLY the neutral "deleted" descriptor
+     * as its `text`, with reactions + reply + edit HIDDEN — delete DOMINATES edit.
+     * A delete is never a visible message of its own. (delete-for-me is a separate,
+     * local-only suppression that omits the message from this view entirely.)
+     */
+    readonly isDeleted: boolean;
 }
 /** The receipt from a send — the server's monotonic sequence + accepted epoch. */
 interface SentReceipt {
@@ -813,6 +823,10 @@ interface EditPayload {
     targetClientMsgId: string;
     newText: string;
 }
+interface DeletePayload {
+    targetClientMsgId: string;
+    scope: string;
+}
 
 /** A decoded incoming message handed to chat listeners. */
 interface IncomingMessage {
@@ -839,6 +853,10 @@ interface IncomingMessage {
     /** The decoded edit payload, present only when `envelopeType === 'edit'`. Lets
      * the Chat route an edit into its EditFold instead of appending a visible bubble. */
     edit?: EditPayload | null;
+    /** The decoded delete payload, present only when `envelopeType === 'delete'`. Lets
+     * the Chat route a delete-for-everyone tombstone into its DeleteFold instead of
+     * appending a visible bubble. */
+    delete?: DeletePayload | null;
 }
 
 /** The intended participants of a draft chat (held until the first send). */
@@ -883,6 +901,16 @@ interface ChatBackend {
         receipt: SentReceipt;
         clientMsgId: string;
     }>;
+    /** Send a delete-for-everyone tombstone on a target message through the same MLS
+     * application path as `sendText` (the server stays blind — a delete is just
+     * another opaque application message). Returns the receipt + the wire clientMsgId. */
+    sendDelete(group: MessagingGroup, args: {
+        clientMsgId: string;
+        targetClientMsgId: string;
+    }): Promise<{
+        receipt: SentReceipt;
+        clientMsgId: string;
+    }>;
     history(group: MessagingGroup, limit: number, before?: number): Promise<ChatMessage[]>;
     members(group: MessagingGroup): Promise<ChatMember[]>;
     addMember(group: MessagingGroup, userId: string): Promise<void>;
@@ -895,6 +923,10 @@ interface ChatBackend {
     subscribeLive(group: MessagingGroup, chat: Chat): Unsubscribe$1;
     /** Resolve a sender device id → its owning user id (for senderUserId). */
     userIdForDevice(group: MessagingGroup, deviceId: string): Promise<string | null>;
+    /** Load this chat's persisted delete-for-me suppression keys (durable, no wire). */
+    loadSuppressed(group: MessagingGroup): Promise<string[]>;
+    /** Persist this chat's delete-for-me suppression keys (durable, no wire). */
+    saveSuppressed(group: MessagingGroup, keys: string[]): Promise<void>;
 }
 declare class Chat {
     /** Stable, URL/log-safe id (the grp_ display id once active; a reserved local id while draft). */
@@ -917,6 +949,15 @@ declare class Chat {
     private readonly reactionFold;
     /** The single authoritative edit fold for this chat (live + own-send + history). */
     private readonly editFold;
+    /** The single authoritative delete-for-everyone fold (live + own-send + history).
+     * A tombstone scrubs its target in place (delete DOMINATES edit at render). */
+    private readonly deleteFold;
+    /** delete-for-me suppression keys (clientMsgId, or `seq:<serverSeq>` for legacy)
+     * — the message is OMITTED from this view. Local + persisted per chat, NO wire. */
+    private readonly suppressed;
+    /** True once the persisted suppression set has been loaded (so the omit applies
+     * even on the cold-launch hydrate path before a fresh deleteForMe). */
+    private suppressedLoaded;
     /** Per-target BASE (original) text, so the rendered text is `edit ?? original`.
      * Seeded once per target (write-once base) so a 2nd own edit can't corrupt it. */
     private readonly originalTextByClientMsgId;
@@ -948,9 +989,26 @@ declare class Chat {
     get typing(): readonly ChatMember[];
     get lastMessage(): ChatMessage | null;
     get unreadCount(): number;
+    /**
+     * The RENDER PRECEDENCE — the single composition point (live AND history project
+     * through it identically). Over the raw `messageList` (which already carries the
+     * folded edit text + reactions + reply):
+     *   (1) in the delete-for-me suppression set → OMIT the message entirely;
+     *   (2) else tombstoned (delete-for-everyone) → the neutral "deleted" descriptor
+     *       with reactions/reply/edit HIDDEN (delete DOMINATES edit — short-circuit);
+     *   (3) else the row as-is (edit overlay + reactions + reply already applied).
+     * Pure over (messageList, deleteFold, suppressed) — recomputed on every read so a
+     * just-folded delete / just-suppressed key takes effect without rewriting rows.
+     */
+    private surfaced;
+    /** The delete-for-me suppression key: clientMsgId when present, else `seq:<n>`. */
+    private suppressionKey;
     get title(): string;
     presence(userId: string): PresenceState | null;
     private ensureWired;
+    /** Hydrate the persisted delete-for-me suppression keys (once), then re-emit so
+     * any already-surfaced suppressed message is omitted (cold-launch parity). */
+    private loadSuppressed;
     private hydrateHistory;
     private mergeHistory;
     /** @internal — called by the backend's live subscription. */
@@ -1028,6 +1086,20 @@ declare class Chat {
      * reactions + reply context. Only the original author's edits count — for an own
      * message self IS the author, so the author-gate passes. */
     edit(message: ChatMessage, newText: string): Promise<void>;
+    /** Delete a message for EVERYONE (a cooperative encrypted tombstone). Only the
+     * ORIGINAL SENDER can do this — for an own message self IS the author, so the
+     * author-gate passes. Legacy messages (empty clientMsgId) are DISABLED (a
+     * tombstone keys on the target's clientMsgId, which they lack) — no-op. Sends a
+     * `type:'delete'` envelope through the SAME MLS path as a text message (the
+     * server stays blind), folds the own delete locally so the target scrubs in
+     * place instantly (the durable echo dedups on the SAME wire clientMsgId), and
+     * re-emits. NEVER appends a bubble. delete-for-me'ing the target becomes moot. */
+    deleteForEveryone(message: ChatMessage): Promise<void>;
+    /** Delete a message for ME only — a LOCAL, per-device suppression. NO wire, NO
+     * attribution, no server contact: the message is OMITTED from THIS view and the
+     * suppression key persists per chat (survives reload). The key is the message's
+     * clientMsgId when present, else `seq:<serverSeq>` for legacy messages. */
+    deleteForMe(message: ChatMessage): Promise<void>;
 }
 
 declare class PalbeMessaging {