@palbase/web 1.3.0 → 1.4.0

package/dist/index.cjs

@@ -1607,6 +1607,69 @@ var PalbeFlags = class {
   }
 };
 
+// src/messaging/delete-fold.ts
+var DeleteFold = class {
+  // targets with a confirmed valid tombstone — MONOTONIC (never removed within retention).
+  tombstoned = /* @__PURE__ */ new Set();
+  // target → the tombstone's authenticated actor userId, awaiting the target's arrival.
+  pending = /* @__PURE__ */ new Map();
+  // dedup of real wire events the fold could evaluate (tombstoned or parked in pending).
+  seen = /* @__PURE__ */ new Set();
+  // events parked because NEITHER the actor NOR the target's author was resolvable at ingest;
+  // keyed by eventClientMsgId so a re-delivered unverifiable event is held exactly once.
+  held = [];
+  /**
+   * Ingest one tombstone. `authorOfTarget` resolves the target message's AUTHOR
+   * userId (null = target absent locally → defer).
+   */
+  ingest(e, authorOfTarget) {
+    if (this.tombstoned.has(e.targetClientMsgId)) return;
+    if (this.seen.has(e.eventClientMsgId)) return;
+    if (this.heldContains(e.eventClientMsgId)) return;
+    const author = authorOfTarget(e.targetClientMsgId);
+    if (author !== null) {
+      this.seen.add(e.eventClientMsgId);
+      if (e.actorUserId === null || e.actorUserId !== author) return;
+      this.tombstoned.add(e.targetClientMsgId);
+    } else if (e.actorUserId !== null) {
+      this.seen.add(e.eventClientMsgId);
+      this.pending.set(e.targetClientMsgId, e.actorUserId);
+    } else {
+      this.held.push(e);
+    }
+  }
+  /** True once a valid tombstone has absorbed this target. */
+  isTombstoned(targetClientMsgId) {
+    return this.tombstoned.has(targetClientMsgId);
+  }
+  /**
+   * When a target message newly arrives with a resolved `author`, re-check any
+   * pending tombstone for it AND re-attempt any held (unverifiable) tombstones
+   * whose target is now resolvable. The deferred gate is the SAME comparison as
+   * the in-order path.
+   */
+  reevaluatePending(target, author) {
+    const actor = this.pending.get(target);
+    if (actor !== void 0) {
+      if (author !== null && actor === author) {
+        this.tombstoned.add(target);
+        this.pending.delete(target);
+      } else if (author !== null) {
+        this.pending.delete(target);
+      }
+    }
+    if (this.held.length === 0) return;
+    const pendingHeld = this.held;
+    this.held = [];
+    for (const e of pendingHeld) {
+      this.ingest(e, (t) => t === target ? author : null);
+    }
+  }
+  heldContains(eventClientMsgId) {
+    return this.held.some((h) => h.eventClientMsgId === eventClientMsgId);
+  }
+};
+
 // src/messaging/edit-fold.ts
 function orderLt(aEpoch, aSeq, bEpoch, bSeq) {
   if (aEpoch !== bEpoch) return aEpoch < bEpoch;
@@ -1828,6 +1891,17 @@ async function listDevices(rt, userId) {
 }
 
 // src/messaging/group-messaging.ts
+function encodeDelete(args) {
+  return encodeUtf8(
+    JSON.stringify({
+      v: 1,
+      type: "delete",
+      client_msg_id: args.clientMsgId,
+      target_client_msg_id: args.targetClientMsgId,
+      scope: "everyone"
+    })
+  );
+}
 function encodeEdit(args) {
   return encodeUtf8(
     JSON.stringify({
@@ -1865,6 +1939,18 @@ function decodeEnvelope(bytes) {
   const s = decodeUtf8(bytes);
   try {
     const o = JSON.parse(s);
+    if (typeof o === "object" && o !== null && o.type === "delete") {
+      return {
+        type: "delete",
+        text: null,
+        clientMsgId: o.client_msg_id ?? "",
+        replyTo: null,
+        delete: {
+          targetClientMsgId: o.target_client_msg_id ?? "",
+          scope: o.scope ?? "everyone"
+        }
+      };
+    }
     if (typeof o === "object" && o !== null && o.type === "reaction") {
       return {
         type: "reaction",
@@ -2252,6 +2338,55 @@ var GroupMessaging = class {
       clientMsgId: args.clientMsgId
     };
   }
+  /** Send a delete-for-everyone tombstone on a target message. Encrypts a
+   * `type:'delete'` envelope at the current epoch and sends through the SAME MLS
+   * application path as `sendText` (the server stays blind — a delete is just
+   * another opaque application message; the original ciphertext row is NOT
+   * removed). Persists the outgoing delete row so the tombstone re-folds onto its
+   * target after a reload (the own-send half of the reload parity — the iOS-review
+   * CRITICAL boundary; the projection's `.delete` branch re-folds it). NEVER
+   * rebases (epoch-bound like any application message). */
+  async sendDelete(group, args) {
+    const plaintext = encodeDelete({
+      clientMsgId: args.clientMsgId,
+      targetClientMsgId: args.targetClientMsgId
+    });
+    const ct = await this.engine.encryptApplication(fromBase64(group.rfcGroupId), plaintext);
+    const body = {
+      ciphertext_b64: toBase64(ct),
+      client_idem_key: randomId()
+    };
+    const wire = await palbeRequest(
+      this.rt,
+      "POST",
+      MessagingPaths.groupMessages(group.displayId),
+      { body }
+    );
+    const stored = {
+      id: `${group.rfcGroupId}#${wire.server_seq}`,
+      direction: "outgoing",
+      text: null,
+      senderDeviceId: this.selfDeviceId,
+      epoch: wire.epoch,
+      serverSeq: wire.server_seq,
+      at: Date.now(),
+      clientMsgId: args.clientMsgId,
+      replyTo: null,
+      envelopeType: "delete",
+      delete: {
+        targetClientMsgId: args.targetClientMsgId,
+        scope: "everyone"
+      }
+    };
+    try {
+      await this.messageStore.append(group.rfcGroupId, stored);
+    } catch {
+    }
+    return {
+      receipt: { serverSeq: wire.server_seq, epoch: wire.epoch },
+      clientMsgId: args.clientMsgId
+    };
+  }
   // ── The rebase loop ──
   async commitWithRebase(rfcGroupId, build) {
     const gidBytes = fromBase64(rfcGroupId);
@@ -2369,6 +2504,7 @@ var ReactionFold = class {
 };
 
 // src/messaging/chat.ts
+var DELETED_DESCRIPTOR = "\u{1F6AB} This message was deleted";
 var Chat = class {
   /** Stable, URL/log-safe id (the grp_ display id once active; a reserved local id while draft). */
   id;
@@ -2390,6 +2526,15 @@ var Chat = class {
   reactionFold = new ReactionFold();
   /** The single authoritative edit fold for this chat (live + own-send + history). */
   editFold = new EditFold();
+  /** The single authoritative delete-for-everyone fold (live + own-send + history).
+   * A tombstone scrubs its target in place (delete DOMINATES edit at render). */
+  deleteFold = new DeleteFold();
+  /** delete-for-me suppression keys (clientMsgId, or `seq:<serverSeq>` for legacy)
+   * — the message is OMITTED from this view. Local + persisted per chat, NO wire. */
+  suppressed = /* @__PURE__ */ new Set();
+  /** True once the persisted suppression set has been loaded (so the omit applies
+   * even on the cold-launch hydrate path before a fresh deleteForMe). */
+  suppressedLoaded = false;
   /** Per-target BASE (original) text, so the rendered text is `edit ?? original`.
    * Seeded once per target (write-once base) so a 2nd own edit can't corrupt it. */
   originalTextByClientMsgId = /* @__PURE__ */ new Map();
@@ -2438,7 +2583,7 @@ var Chat = class {
     return this.kind === "direct";
   }
   get messages() {
-    return this.messageList;
+    return this.surfaced();
   }
   get members() {
     return this.memberCache;
@@ -2447,13 +2592,49 @@ var Chat = class {
     return this.typingList;
   }
   get lastMessage() {
-    return this.messageList.at(-1) ?? null;
+    return this.surfaced().at(-1) ?? null;
   }
   get unreadCount() {
-    return this.messageList.filter(
-      (m) => m.direction === "incoming" && m.serverSeq > this.readWatermark
+    return this.surfaced().filter(
+      (m) => m.direction === "incoming" && !m.isDeleted && m.serverSeq > this.readWatermark
     ).length;
   }
+  /**
+   * The RENDER PRECEDENCE — the single composition point (live AND history project
+   * through it identically). Over the raw `messageList` (which already carries the
+   * folded edit text + reactions + reply):
+   *   (1) in the delete-for-me suppression set → OMIT the message entirely;
+   *   (2) else tombstoned (delete-for-everyone) → the neutral "deleted" descriptor
+   *       with reactions/reply/edit HIDDEN (delete DOMINATES edit — short-circuit);
+   *   (3) else the row as-is (edit overlay + reactions + reply already applied).
+   * Pure over (messageList, deleteFold, suppressed) — recomputed on every read so a
+   * just-folded delete / just-suppressed key takes effect without rewriting rows.
+   */
+  surfaced() {
+    const out = [];
+    for (const m of this.messageList) {
+      const key = this.suppressionKey(m);
+      if (this.suppressed.has(key)) continue;
+      const tombstoned = m.clientMsgId && this.deleteFold.isTombstoned(m.clientMsgId) || m.isDeleted;
+      if (tombstoned) {
+        out.push({
+          ...m,
+          text: DELETED_DESCRIPTOR,
+          reactions: {},
+          replyTo: null,
+          edited: false,
+          isDeleted: true
+        });
+        continue;
+      }
+      out.push(m);
+    }
+    return out;
+  }
+  /** The delete-for-me suppression key: clientMsgId when present, else `seq:<n>`. */
+  suppressionKey(m) {
+    return m.clientMsgId ? m.clientMsgId : `seq:${m.serverSeq}`;
+  }
   get title() {
     if (this.titleOverride) return this.titleOverride;
     if (this._group?.name) return this._group.name;
@@ -2477,9 +2658,28 @@ var Chat = class {
     if (this.wired || this._state !== "active" || !this._group) return;
     this.wired = true;
     this.liveUnsub = this.backend.subscribeLive(this._group, this);
+    void this.loadSuppressed();
     void this.hydrateHistory();
     void this.refreshMembers();
   }
+  /** Hydrate the persisted delete-for-me suppression keys (once), then re-emit so
+   * any already-surfaced suppressed message is omitted (cold-launch parity). */
+  async loadSuppressed() {
+    if (this.suppressedLoaded || !this._group) return;
+    this.suppressedLoaded = true;
+    try {
+      const keys = await this.backend.loadSuppressed(this._group);
+      let changed = false;
+      for (const k of keys) {
+        if (!this.suppressed.has(k)) {
+          this.suppressed.add(k);
+          changed = true;
+        }
+      }
+      if (changed) this.emit();
+    } catch {
+    }
+  }
   async hydrateHistory() {
     if (this.historyLoaded || !this._group) return;
     this.historyLoaded = true;
@@ -2490,13 +2690,13 @@ var Chat = class {
     let changed = false;
     for (const m of incoming) {
       if (m.serverSeq <= 0) continue;
-      if (m.clientMsgId && m.text !== null) {
+      if (m.clientMsgId && m.text !== null && !m.isDeleted) {
         this.byClientMsgId.set(m.clientMsgId, {
           text: m.text,
           senderUserId: m.senderUserId ?? ""
         });
       }
-      if (m.clientMsgId) {
+      if (m.clientMsgId && !m.isDeleted) {
         this.seedEditBase(m.clientMsgId, m.text, m.senderUserId ?? "");
       }
     }
@@ -2506,6 +2706,9 @@ var Chat = class {
       const key = this.internalKey(m.serverSeq);
       if (this.seenKeys.has(key)) continue;
       this.seenKeys.add(key);
+      if (m.clientMsgId && !m.isDeleted) {
+        this.deleteFold.reevaluatePending(m.clientMsgId, m.senderUserId);
+      }
       this.messageList.push(this.applyEditOverlay(this.applyReactionTally(m)));
       changed = true;
       this.loadedEarliestSeq = Math.min(this.loadedEarliestSeq ?? m.serverSeq, m.serverSeq);
@@ -2563,6 +2766,21 @@ var Chat = class {
       this.recomputeEdit(incoming.edit.targetClientMsgId);
       return;
     }
+    if (incoming.envelopeType === "delete" && incoming.delete) {
+      const actorUserId = direction === "outgoing" ? this.backend.selfUserId : senderUser;
+      this.deleteFold.ingest(
+        {
+          targetClientMsgId: incoming.delete.targetClientMsgId,
+          actorUserId,
+          epoch: incoming.epoch,
+          serverSeq: incoming.serverSeq,
+          eventClientMsgId: incoming.clientMsgId
+        },
+        this.authorOfTarget
+      );
+      this.emit();
+      return;
+    }
     const incomingClientMsgId = incoming.clientMsgId;
     const incomingReplyRef = incoming.replyRef;
     let resolvedReplyTo = null;
@@ -2583,7 +2801,9 @@ var Chat = class {
       // BEFORE its target — the dangling case — renders the moment the target lands).
       reactions: incomingClientMsgId ? this.reactionFold.tally(incomingClientMsgId) : {},
       // Default false; applyEditOverlay below folds any edit that arrived first.
-      edited: false
+      edited: false,
+      // Default false; surfaced() applies the tombstone scrub if a delete folded.
+      isDeleted: false
     };
     if (incomingClientMsgId && incoming.text !== null) {
       this.byClientMsgId.set(incomingClientMsgId, {
@@ -2594,6 +2814,7 @@ var Chat = class {
     if (incomingClientMsgId) {
       this.seedEditBase(incomingClientMsgId, incoming.text, senderUser);
       this.editFold.reevaluateHeld(this.authorOfTarget);
+      this.deleteFold.reevaluatePending(incomingClientMsgId, senderUser);
     }
     this.messageList.push(this.applyEditOverlay(msg));
     this.messageList.sort((a, b) => a.serverSeq - b.serverSeq);
@@ -2835,7 +3056,9 @@ var Chat = class {
       // the dangling-target invariant uniform across every append path).
       reactions: clientMsgId ? this.reactionFold.tally(clientMsgId) : {},
       // Own-sent edits fold via edit() after the fact; new sends start unedited.
-      edited: false
+      edited: false,
+      // Own-sent deletes fold via deleteForEveryone() after the fact; start live.
+      isDeleted: false
     });
     this.messageList.sort((a, b) => a.serverSeq - b.serverSeq);
     this.emit();
@@ -2947,6 +3170,52 @@ var Chat = class {
     );
     this.recomputeEdit(message.clientMsgId);
   }
+  // ── Delete ──
+  /** Delete a message for EVERYONE (a cooperative encrypted tombstone). Only the
+   * ORIGINAL SENDER can do this — for an own message self IS the author, so the
+   * author-gate passes. Legacy messages (empty clientMsgId) are DISABLED (a
+   * tombstone keys on the target's clientMsgId, which they lack) — no-op. Sends a
+   * `type:'delete'` envelope through the SAME MLS path as a text message (the
+   * server stays blind), folds the own delete locally so the target scrubs in
+   * place instantly (the durable echo dedups on the SAME wire clientMsgId), and
+   * re-emits. NEVER appends a bubble. delete-for-me'ing the target becomes moot. */
+  async deleteForEveryone(message) {
+    if (!message.clientMsgId) return;
+    const group = await this.materializeIfNeeded();
+    const clientMsgId = mintClientMsgId();
+    const { receipt } = await this.backend.sendDelete(group, {
+      clientMsgId,
+      targetClientMsgId: message.clientMsgId
+    });
+    this.seedEditBase(message.clientMsgId, message.text, this.backend.selfUserId);
+    this.deleteFold.ingest(
+      {
+        targetClientMsgId: message.clientMsgId,
+        actorUserId: this.backend.selfUserId,
+        epoch: receipt.epoch,
+        serverSeq: receipt.serverSeq,
+        eventClientMsgId: clientMsgId
+      },
+      this.authorOfTarget
+    );
+    this.emit();
+  }
+  /** Delete a message for ME only — a LOCAL, per-device suppression. NO wire, NO
+   * attribution, no server contact: the message is OMITTED from THIS view and the
+   * suppression key persists per chat (survives reload). The key is the message's
+   * clientMsgId when present, else `seq:<serverSeq>` for legacy messages. */
+  async deleteForMe(message) {
+    const key = message.clientMsgId ? message.clientMsgId : `seq:${message.serverSeq}`;
+    if (this.suppressed.has(key)) return;
+    this.suppressed.add(key);
+    this.emit();
+    if (this._group) {
+      try {
+        await this.backend.saveSuppressed(this._group, [...this.suppressed]);
+      } catch {
+      }
+    }
+  }
 };
 function sameReactions(a, b) {
   const ak = Object.keys(a);
@@ -3127,6 +3396,7 @@ var MessageDeliverySource = class {
         const { text, clientMsgId, replyTo } = decoded;
         const isReaction = decoded.type === "reaction" && decoded.reaction != null;
         const isEdit = decoded.type === "edit" && decoded.edit != null;
+        const isDelete = decoded.type === "delete" && decoded.delete != null;
         const senderDeviceId = row.sender_device_id ?? decodeSenderDeviceId(received.sender);
         const stored = {
           id: `${group.rfcGroupId}#${row.server_seq}`,
@@ -3165,6 +3435,18 @@ var MessageDeliverySource = class {
               targetClientMsgId: decoded.edit.targetClientMsgId,
               newText: decoded.edit.newText
             }
+          } : {},
+          // Thread the delete discriminator + target through the persisted row so a
+          // delete-for-everyone tombstone folded LIVE re-folds onto its target after
+          // a reload (the reload-parity boundary — the iOS-review CRITICAL lesson;
+          // the projection's `.delete` branch re-folds it so it never leaks a blank
+          // bubble). Omitted for non-deletes → old rows hydrate as `'text'`/no-delete.
+          ...isDelete && decoded.delete ? {
+            envelopeType: "delete",
+            delete: {
+              targetClientMsgId: decoded.delete.targetClientMsgId,
+              scope: decoded.delete.scope
+            }
           } : {}
         };
         try {
@@ -3184,7 +3466,8 @@ var MessageDeliverySource = class {
           replyRef: replyTo,
           envelopeType: decoded.type ?? "text",
           reaction: isReaction ? decoded.reaction : null,
-          edit: isEdit ? decoded.edit : null
+          edit: isEdit ? decoded.edit : null,
+          delete: isDelete ? decoded.delete : null
         });
         return true;
       }
@@ -5006,6 +5289,36 @@ var SignatureKeyStore = class {
   }
 };
 
+// src/messaging/suppression.ts
+var SuppressionStore = class {
+  constructor(kv) {
+    this.kv = kv;
+  }
+  kv;
+  key(rfcGroupId) {
+    return `supp:${rfcGroupId}`;
+  }
+  /** Load the persisted suppression keys for a chat (empty array if none). */
+  async load(rfcGroupId) {
+    const raw = await this.kv.get(this.key(rfcGroupId));
+    if (!raw) return [];
+    try {
+      const parsed = JSON.parse(decodeUtf8(raw));
+      return Array.isArray(parsed) ? parsed : [];
+    } catch {
+      return [];
+    }
+  }
+  /** Persist the full suppression key set for a chat (deterministic order). */
+  async save(rfcGroupId, keys) {
+    const sorted = [...new Set(keys)].sort();
+    await this.kv.set(this.key(rfcGroupId), encodeUtf8(JSON.stringify(sorted)));
+  }
+  async wipe() {
+    for (const k of await this.kv.keys("supp:")) await this.kv.delete(k);
+  }
+};
+
 // src/messaging/coordinator.ts
 var MessagingCoordinator = class {
   constructor(rt) {
@@ -5015,6 +5328,7 @@ var MessagingCoordinator = class {
     this.sigStore = new SignatureKeyStore(this.kv);
     this.groupStore = new GroupStateStorage(this.kv);
     this.kpStore = new KeyPackageStorage(this.kv);
+    this.suppressionStore = new SuppressionStore(this.kv);
     this.registry.attachChatList(
       (chats) => {
         this.chatList = chats;
@@ -5029,6 +5343,7 @@ var MessagingCoordinator = class {
   sigStore;
   groupStore;
   kpStore;
+  suppressionStore;
   registry = new GroupRegistry();
   resolved = null;
   resolvePromise = null;
@@ -5196,6 +5511,18 @@ var MessagingCoordinator = class {
     const r = await this.resolve();
     return r.groups.sendEdit(group, args);
   }
+  async sendDelete(group, args) {
+    const r = await this.resolve();
+    return r.groups.sendDelete(group, args);
+  }
+  /** Load this chat's persisted delete-for-me suppression keys (durable-only). */
+  loadSuppressed(group) {
+    return this.suppressionStore.load(group.rfcGroupId);
+  }
+  /** Persist this chat's delete-for-me suppression keys (durable-only, no wire). */
+  saveSuppressed(group, keys) {
+    return this.suppressionStore.save(group.rfcGroupId, keys);
+  }
   async history(group, limit, before) {
     const r = await this.resolve();
     const rows = await r.messageStore.history(group.rfcGroupId, limit, before);
@@ -5293,9 +5620,11 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
     });
   }
   const editFold = new EditFold();
+  const deleteFold = new DeleteFold();
   const authorByClientMsgId = /* @__PURE__ */ new Map();
   for (const s of rows) {
-    if (s.envelopeType === "reaction" || s.envelopeType === "edit") continue;
+    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete")
+      continue;
     const cid = s.clientMsgId ?? "";
     if (!cid) continue;
     const author = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null);
@@ -5318,9 +5647,25 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
     );
   }
   editFold.reevaluateHeld(authorOfTarget);
+  for (const s of rows) {
+    if (s.envelopeType !== "delete" || !s.delete) continue;
+    const actor = s.direction === "outgoing" ? selfUserId : resolveActor?.(s.senderDeviceId ?? null) ?? null;
+    deleteFold.ingest(
+      {
+        targetClientMsgId: s.delete.targetClientMsgId,
+        actorUserId: actor,
+        epoch: s.epoch,
+        serverSeq: s.serverSeq,
+        eventClientMsgId: s.clientMsgId ?? `${s.id}`
+      },
+      authorOfTarget
+    );
+  }
+  for (const [cid, author] of authorByClientMsgId) deleteFold.reevaluatePending(cid, author);
   const lookup = /* @__PURE__ */ new Map();
   for (const s of rows) {
-    if (s.envelopeType === "reaction") continue;
+    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete")
+      continue;
     const cid = s.clientMsgId ?? "";
     if (cid && s.text !== null) {
       const senderUserId = s.direction === "outgoing" ? selfUserId : "";
@@ -5329,8 +5674,27 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
   }
   const out = [];
   for (const s of rows) {
-    if (s.envelopeType === "reaction" || s.envelopeType === "edit") continue;
+    if (s.envelopeType === "reaction" || s.envelopeType === "edit" || s.envelopeType === "delete")
+      continue;
     const clientMsgId = s.clientMsgId ?? "";
+    const isDeleted = clientMsgId ? deleteFold.isTombstoned(clientMsgId) : false;
+    if (isDeleted) {
+      out.push({
+        id: `${displayId}#${s.serverSeq}`,
+        kind: "text",
+        direction: s.direction,
+        senderUserId: s.direction === "outgoing" ? selfUserId : null,
+        text: DELETED_DESCRIPTOR,
+        serverSeq: s.serverSeq,
+        sentAt: new Date(s.at),
+        clientMsgId,
+        replyTo: null,
+        reactions: {},
+        edited: false,
+        isDeleted: true
+      });
+      continue;
+    }
     let replyTo = null;
     if (s.replyTo) {
       const ref = {
@@ -5358,7 +5722,8 @@ function projectHistory(displayId, rows, selfUserId, resolveActor) {
       clientMsgId,
       replyTo,
       reactions: clientMsgId ? fold.tally(clientMsgId) : {},
-      edited
+      edited,
+      isDeleted: false
     });
   }
   return out;
@@ -6215,7 +6580,7 @@ function localStorageSessionStorage(key = DEFAULT_KEY) {
 }
 
 // src/version.ts
-var VERSION = "1.3.0";
+var VERSION = "1.4.0";
 
 // src/internal.ts
 function getRuntime() {