@antzsoft/chat-core 1.0.9 → 1.1.1

package/README.md

@@ -733,7 +733,7 @@ import { messagesApi } from '@antzsoft/chat-core';
 | `unpin` | `(messageId: string) => Promise<Message>` | Unpin a message. |
 | `getPinned` | `(conversationId: string) => Promise<Message[]>` | List pinned messages in a conversation. |
 
-> **Delete permissions** — `delete()` (for everyone) requires either: the message belongs to the current user AND was sent within the delete window, OR the current user is a group admin. The server default window is **1800 s (30 min)** when `conversation.settings.messageConfig.deleteWindowSeconds` is not set. DMs have no admin role — only the sender can delete for everyone in a DM. `deleteForMe()` is always allowed for any message. See the [integration guide — Edit & Delete section](docs/integration-guide.html#step-edit) for a ready-to-use `getDeleteOptions()` helper.
+> **Delete permissions** — `delete()` (for everyone) requires either: the message belongs to the current user AND was sent within the delete window, OR the current user is a group admin. The server default window is **216,000 s (60 hours)** when `conversation.settings.messageConfig.deleteWindowSeconds` is not set. DMs have no admin role — only the sender can delete for everyone in a DM. `deleteForMe()` is always allowed for any message. See the [integration guide — Edit & Delete section](docs/integration-guide.html#step-edit) for a ready-to-use `getDeleteOptions()` helper.
 
 ```typescript
 interface ListMessagesParams {
@@ -847,12 +847,12 @@ import { conversationsApi } from '@antzsoft/chat-core';
 | `update` | `(conversationId: string, data: UpdateConversationData) => Promise<Conversation>` | Update group name or description. |
 | `uploadIcon` | `(conversationId: string, fileId: string) => Promise<Conversation>` | Set the group icon from an already-uploaded file (admin only). Call `client.uploadFiles()` first to get the `fileId`, then pass it here. Server copies `storageKey` into `conversation.iconMeta`, deletes the `chat_files` record, and returns the conversation with a fresh `iconUrl`. |
 | `delete` | `(conversationId: string) => Promise<void>` | Delete a conversation (admin only). |
-| `addParticipants` | `(conversationId: string, userIds: string[]) => Promise<Conversation>` | Add one or more participants. |
+| `addParticipants` | `(conversationId: string, userIds: string[], role?: 'admin' \| 'member') => Promise<Conversation>` | Add one or more participants. `role` defaults to `'member'`. Previously removed members who are re-added always receive the specified role — a former admin re-added without `role: 'admin'` comes back as a member. |
 | `removeParticipant` | `(conversationId: string, userId: string) => Promise<Conversation>` | Remove a participant. |
 | `updateParticipantRole` | `(conversationId: string, userId: string, role: 'admin' \| 'member') => Promise<Conversation>` | Promote or demote a participant. |
 | `mute` | `(conversationId: string, mutedUntil?: string) => Promise<void>` | Mute notifications. Pass an ISO date string to mute until a specific time. |
 | `unmute` | `(conversationId: string) => Promise<void>` | Unmute a conversation. |
-| `pin` | `(conversationId: string) => Promise<void>` | Pin a conversation to the top of the list. |
+| `pin` | `(conversationId: string) => Promise<void>` | Pin a conversation to the top of the list. Max 5 pins — server returns `400` if the limit is reached. |
 | `unpin` | `(conversationId: string) => Promise<void>` | Unpin a conversation. |
 | `leave` | `(conversationId: string) => Promise<void>` | Leave a group conversation. |
 | `getMembers` | `(conversationId: string) => Promise<User[]>` | Fetch full user profiles for all participants. |
@@ -971,9 +971,12 @@ console.log(updated.iconUrl); // fresh signed URL, regenerated on every response
 // - Previous icon deleted from storage automatically on replace
 // - Non-admins get 403 Forbidden
 
-// Add members
+// Add members (default role: member)
 await conversationsApi.addParticipants(group.id, ['user-d', 'user-e']);
 
+// Add members as admins
+await conversationsApi.addParticipants(group.id, ['user-f'], 'admin');
+
 // Mute for 8 hours
 const mutedUntil = new Date(Date.now() + 8 * 60 * 60 * 1000).toISOString();
 await conversationsApi.mute(group.id, mutedUntil);
@@ -1554,6 +1557,33 @@ console.log(user.displayName, user.externalId);
 
 ---
 
+### App Config API (`appConfigApi`)
+
+Returns server-side configuration constants. Call once on init and cache the result.
+
+```typescript
+import { appConfigApi } from '@antzsoft/chat-core';
+```
+
+| Method | Signature | Description |
+|---|---|---|
+| `get` | `() => Promise<AppConfig>` | Fetch app-level config from the server. |
+
+```typescript
+interface AppConfig {
+  maxPinnedConversations: number; // currently 5
+}
+```
+
+```typescript
+const config = await appConfigApi.get();
+// Use config.maxPinnedConversations to gate the pin UI
+```
+
+> The SDK caches this under the `['app-config']` React Query key with `staleTime: Infinity` — it is only fetched once per session. `useConversations()` exposes `maxPinnedConversations` directly.
+
+---
+
 ### Socket
 
 #### Connection management
@@ -1606,12 +1636,14 @@ This means:
 
 **When to call `joinRoom`:**
 
-There is only one real use case — when the **user is added to a conversation while their socket is already connected** (either someone created a new group and added them, or they were added to an existing group). The server does not auto-join the user's socket to the new room — it only emits `conversation_created` to the user's personal room. The client must call `joinRoom` in response, otherwise the socket will not receive any `new_message`, `typing_indicator`, or other room events for that conversation.
+When the **user is added to a conversation while their socket is already connected**, the server now automatically joins their active sockets into the new room and emits `conversation_created` to their personal room. No `joinRoom` call is required — the user will receive `new_message`, `typing_indicator`, and all other room events immediately.
+
+Calling `joinRoom` on `conversation_created` is still safe (idempotent) and can be kept for defensive compatibility, but it is no longer necessary:
 
 ```typescript
+// Optional — server already handles this automatically
 client.socket.on('conversation_created', (conv) => {
-  // Fires when you're added to a new or existing conversation at runtime
-  client.socket.emit.joinRoom(conv.id);
+  client.socket.emit.joinRoom(conv.id); // safe no-op if already in room
 });
 ```
 
@@ -1663,7 +1695,7 @@ All emit methods that have server responses use a 5-second ack timeout and retur
 | `leaveRoom` | `(conversationId: string) => void` | Leave a conversation room. Fire-and-forget. |
 | `sendMessage` | `(payload: SendMessagePayload) => Promise<unknown>` | Send a message. Ack-based. |
 | `updateMessage` | `(messageId: string, text: string) => Promise<unknown>` | Edit a message. Ack-based. |
-| `deleteMessage` | `(messageId: string) => Promise<unknown>` | Delete a message for everyone. Own messages must be within the delete window (default 30 min); group admins can delete any message with no time restriction. Ack-based. |
+| `deleteMessage` | `(messageId: string) => Promise<unknown>` | Delete a message for everyone. Own messages must be within the delete window (default 60 hours); group admins can delete any message with no time restriction. Ack-based. |
 | `deleteMessageForMe` | `(messageId: string) => Promise<unknown>` | Hide a message for the current user only. Ack-based. |
 | `addReaction` | `(messageId: string, emoji: string) => Promise<unknown>` | Add a reaction. Ack-based. |
 | `removeReaction` | `(messageId: string, emoji: string) => Promise<unknown>` | Remove a reaction. Ack-based. |
@@ -2045,10 +2077,21 @@ interface MessageReaction {
 ### `MessageReplyReference`
 
 ```typescript
+interface ReplyAttachmentSnapshot {
+  type: FileType;           // 'image' | 'video' | 'document' | 'audio'
+  filename: string;
+  mimeType: string;
+  size: number;
+  duration?: number;        // seconds — audio/video only
+  dimensions?: { width: number; height: number };
+  url: string;              // signed URL for the first attachment of the quoted message
+}
+
 interface MessageReplyReference {
   messageId?: string;
-  contentPreview?: string;
+  contentPreview?: string;  // text snippet, filename, or "3 Photos" / "3 Attachments" etc.
   senderName?: string;
+  attachmentSnapshot?: ReplyAttachmentSnapshot; // present only when quoted message had attachments
   // Present on optimistic messages before server confirmation
   id?: string;
   content?: MessageContent;
@@ -2056,6 +2099,8 @@ interface MessageReplyReference {
 }
 ```
 
+`attachmentSnapshot` is a denormalized copy of the first attachment from the quoted message, stored at write time. This means the reply bubble can render an attachment preview (thumbnail, filename, type icon) without fetching the original message — even if it has scrolled far out of the paginated window. The `url` is a signed URL regenerated on every response, identical to how `content.attachments[].url` works.
+
 ### `Conversation`
 
 ```typescript
@@ -2356,19 +2401,35 @@ document.querySelectorAll('[data-conv-id]').forEach((el) => {
 
 ## Changelog
 
+### v1.1.1
+- **New: `attachmentSnapshot` on reply messages** — `replyTo` now includes a snapshot of the first attachment from the quoted message (`type`, `filename`, `mimeType`, `size`, `duration`, `dimensions`, signed `url`). Stored at write time so reply bubbles render without fetching the original message.
+- **Fix: `contentPreview` for multi-attachment replies** — Now reflects attachment count: `"photo.jpg +2 more"`, `"3 Photos"`, `"3 Attachments"` (mixed types). Previously always showed only the first filename.
+- **New: exported `ReplyAttachmentSnapshot` type.**
+
+### v1.1.0
+- **Fix: 500 error on device token registration** — Registering a push token that was previously registered under a different user or device ID (e.g. after app reinstall, account switch, or UUID rotation) now succeeds. The stale token record is removed before the upsert, preventing a duplicate key violation on the global `token_unique` index.
+- **Fix: 500 error on remove participant** — Removing a participant no longer errors for the removed user's subsequent actions. Message stops and socket events now correctly target only remaining active members.
+- **Fix: Leave group now works for removed members** — Calling `conversationsApi.leave()` after being removed from a group (kicked by admin) now hides the conversation from the user's list instead of returning a 403. Previously, removed members (`isActive: false`) were blocked by the active-participant guard.
+- **Fix: Group auto-disbands when last member leaves or is removed** — When the last active participant leaves or is removed, the conversation is now marked inactive (`isActive: false`) automatically. Previously the group persisted as an orphan with zero members.
+- **Fix: `lastMessage` content not updating after message edit** — Editing a message now correctly updates `conversation.lastMessage.contentPreview` if the edited message is the current last message.
+- **Fix: Reply attachment preview shows `[Attachment]`** — When replying to a message that contains an attachment, the quoted preview now returns the filename if available, otherwise the file type (e.g. `image`, `video`). Clients should use the parent message's attachment data to render a visual preview for previewable types.
+- **Fix: Remove reaction returns error** — Removing a reaction that does not exist no longer throws a 500. The operation is now idempotent.
+- **New: Pin limit — max 5 pinned conversations** — Server enforces a limit of 5 pinned conversations per user and returns `400` if exceeded. A new `GET /app/config` endpoint and `appConfigApi.get()` return `{ maxPinnedConversations: 5 }` so clients can gate the UI before hitting the API. `useConversations()` (Web + RN) fetches config automatically, blocks the pin mutation if the limit is reached, and exposes `maxPinnedConversations`. RN `ConversationList` now supports long-press to pin/unpin.
+
 ### v1.0.9
-- **Socket reconnect resilience for `sendMessage`** — On Android, the OS suspends idle WebSocket connections during long audio recordings. `sendMessage` now waits up to 15 seconds for Socket.IO to auto-reconnect before sending, instead of immediately failing with "Socket not connected". Audio messages go through without error after upload. **No API change.**
-- **`settings` and `participantCount` now returned in conversation responses** — All conversation API responses and socket events (`conversation_created`, `conversation_updated`, etc.) now include `settings` (`onlyAdminsCanMessage`, `onlyAdminsCanAddMembers`, `messageConfig.editWindowSeconds`, `messageConfig.deleteWindowSeconds`) and `participantCount`. Previously these were server-side only. **No SDK change required — fields were already in the `Conversation` type as optional.**
-- **Fix: 500 error when leaving a group** — Leaving a group conversation returned an internal server error (leave still succeeded) for groups with no `messageId` in their stored `lastMessage`. The response builder now safely skips `lastMessage` when its `messageId` is missing. **No SDK change required.**
-- **Fix: empty `text: ""` stored on attachment-only messages** — Sending a message with an attachment and `text: ""` was persisting an empty string instead of `undefined`, causing the conversation-list preview to show blank instead of the filename or "Attachment". Both the HTTP and socket paths now trim and treat empty strings as absent before saving. **No SDK change required.**
-- **Fix: `participant_left` not received by users outside the open conversation** — The `participant_left` socket event was only broadcast to the `conversation:<id>` room, which users only join when they open that specific conversation. Users on the conversation-list screen never received it and saw stale participant counts. The server now also emits directly to each remaining participant's personal `user:<tenantId>:<userId>` room (joined on connect), skipping users already in the conversation room to avoid double-delivery. **No SDK change required.**
+- **Socket reconnect resilience for `sendMessage`** — On Android, the OS suspends idle WebSocket connections during long audio recordings. `sendMessage` now waits up to 15 seconds for Socket.IO to auto-reconnect before sending, instead of immediately failing with "Socket not connected". Audio messages go through without error after upload.
+- **`settings` and `participantCount` now returned in conversation responses** — All conversation API responses and socket events (`conversation_created`, `conversation_updated`, etc.) now include `settings` (`onlyAdminsCanMessage`, `onlyAdminsCanAddMembers`, `messageConfig.editWindowSeconds`, `messageConfig.deleteWindowSeconds`) and `participantCount`. Previously these were server-side only. Fields were already in the `Conversation` type as optional.
+- **Fix: `participant_left` not received by users outside the open conversation** — The event was only sent to users who had the conversation room joined. Users on the conversation-list screen now receive it via their personal socket room. **No client action required.**
+- **Fix: Removed user could re-enter conversation room via `joinRoom`** — The socket access check was missing `isActive`, letting removed users slip back into the room and receive messages. Fixed server-side. **No client action required.**
+- **Fix: Re-added user's conversation missing from list after deletion** — If a user deleted a conversation and was re-added by an admin, it never reappeared. The server now resets `isHidden`, auto-joins the socket room, and pushes `conversation_created` to the user's personal room. **No client action required.** Existing `conversation_created → joinRoom` listeners are safe (idempotent).
+- **New: `role` parameter on `addParticipants`** — Optional third argument (`'admin' | 'member'`, default `'member'`). Re-added users always receive the specified role — a former admin re-added without `role: 'admin'` comes back as a member. **Backward compatible.**
 
 ### v1.0.8
 - **`duration` field in `SendMessageAttachment`** — Pass `duration` (seconds) when sending audio or video. Server now stores and returns it in `new_message` and message list responses. **Action required (RN):** Omitting it on React Native can crash native audio player libraries on the receiver side; always pass it for audio/video. Web is unaffected.
 - **File compression** — `uploadBatch` now accepts optional `platformCompressFn` + `compressionConfig` args. Fully backward compatible — existing callers unchanged. Web/RN SDKs wire this in automatically; Node.js users can supply `nodeCompressFn` manually. No action required unless opting in on Node.
-- **Removed members keep read-only access** — Server behavior change. Removed participants stay in their conversation list and can read history but cannot write. Socket room membership ends immediately on removal. **No SDK change required.**
-- **Admin delete is hide-only** — Server behavior change. Deleting a conversation sets `isHidden` for the requester only; other participants are unaffected. **No SDK change required.**
-- **Fix: `lastMessage.status` stuck as `deleted`** — Server now explicitly resets `status: 'active'` on both REST and WebSocket paths when a new message is sent. **No client action required.**
+- **Removed members keep read-only access** — Server behavior change. Removed participants stay in their conversation list and can read history but cannot write. Socket room membership ends immediately on removal.
+- **Admin delete is hide-only** — Server behavior change. Deleting a conversation sets `isHidden` for the requester only; other participants are unaffected.
+- **Fix: `lastMessage.status` stuck as `deleted`** — Server now explicitly resets `status: 'active'` on both REST and WebSocket paths when a new message is sent.
 - **Fix: `duration` stored from sender payload** — `SendMessageAttachment.duration` is now persisted and echoed back. The `SendMessageAttachment` interface in this package is unchanged (field was already present as optional).
 
 ### v1.0.7

package/dist/index.cjs

@@ -94,6 +94,7 @@ var init_chat_store = __esm({
 var src_exports = {};
 __export(src_exports, {
   AntzChatClient: () => AntzChatClient,
+  appConfigApi: () => appConfigApi,
   authApi: () => authApi,
   connectSocket: () => connectSocket,
   conversationsApi: () => conversationsApi,
@@ -372,6 +373,14 @@ var authApi = {
   }
 };
 
+// src/api/app-config.ts
+var appConfigApi = {
+  async get() {
+    const { data } = await getApiClient().get("/app/config");
+    return data;
+  }
+};
+
 // src/api/messages.ts
 var messagesApi = {
   async list(conversationId, params = {}) {
@@ -526,10 +535,10 @@ var conversationsApi = {
   async delete(conversationId) {
     await getApiClient().delete(`/conversations/${conversationId}`);
   },
-  async addParticipants(conversationId, userIds) {
+  async addParticipants(conversationId, userIds, role) {
     const { data } = await getApiClient().post(
       `/conversations/${conversationId}/participants`,
-      { userIds }
+      { userIds, ...role && { role } }
     );
     return normalizeConversation(data);
   },
@@ -649,14 +658,7 @@ async function uploadBatch(files, platformUploadFn, conversationId, onProgress,
     filename: f.name,
     mimeType: f.type,
     size: f.size,
-    conversationId,
-    ...f.compressed && {
-      metadata: {
-        compressed: true,
-        originalSize: f.originalSize,
-        compressionAlgorithm: f.compressionAlgorithm
-      }
-    }
+    conversationId
   }));
   const { urls, errors: requestErrors } = await storageApi.requestPresignedUrlBatch(requests);
   const progressMap = {};
@@ -1108,6 +1110,7 @@ var AntzChatClient = class {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AntzChatClient,
+  appConfigApi,
   authApi,
   connectSocket,
   conversationsApi,