@antzsoft/chat-core 1.1.1 → 1.1.2

package/README.md

@@ -320,10 +320,14 @@ interface AntzChatConfig {
   tenantId?: string;
 
   /**
-   * Encryption mode. Must match the server's ENCRYPTION_MODE env var.
-   * Default: 'none'.
+   * Enable payload-level transit encryption for all HTTP and socket traffic.
+   * Uses ECDH key exchange (X25519/P-256) + AES-256-GCM to encrypt every
+   * request, response, and socket event on the wire — independent of TLS.
+   * Server must have TRANSIT_ENCRYPTION_ENABLED=true (default).
+   * Default: true. Set false only for local development or debugging.
+   * Safe to toggle anytime — no data migration needed (wire-only, never stored).
    */
-  encryptionMode?: 'none' | 'server';
+  transitEncryption?: boolean;
 
   /**
    * The user's ID in the external auth system.
@@ -747,7 +751,6 @@ interface SendData {
   attachments?: SendMessageAttachment[];
   replyTo?: string;      // messageId of the message being replied to
   tempId?: string;       // Client-generated ID for optimistic UI
-  isEncrypted?: boolean;
 }
 
 interface SearchParams {
@@ -1108,6 +1111,8 @@ const presigned = await storageApi.requestPresignedUrl({
   mimeType: 'application/pdf',
   size: 512000,
   conversationId: 'conv-abc',
+  // optional — stored on the server file record
+  metadata: { compressed: true, originalSize: 900000, compressionAlgorithm: 'gzip' },
 });
 await platformUploadFn(presigned, file, (pct) => console.log(`${pct * 100}%`));
 const fileRecord = await storageApi.confirmUpload(presigned.fileId);
@@ -1136,9 +1141,9 @@ When `platformCompressFn` is provided and `compression.enabled` is `true` (the d
 1. Determine strategy per file (`image` → WebP/JPEG resize+encode, `gzip` → text/doc compression, `skip` → no-op)
 2. Run `platformCompressFn(file, compressionConfig)` — returns a `CompressedFile`
 3. If compressed result is **larger** than the original, the original is used instead (automatic fallback)
-4. Request presigned URL with the compressed size and MIME type
+4. Request presigned URL with the compressed size, MIME type, and compression metadata (`compressed`, `originalSize`, `compressionAlgorithm`)
 5. Upload the compressed bytes
-6. Store `metadata.compressed`, `metadata.originalSize`, `metadata.compressionAlgorithm` on the file record
+6. Server persists `metadata.compressed`, `metadata.originalSize`, `metadata.compressionAlgorithm` on the file record alongside system fields (`userId`, `tenantId`)
 
 ### Strategy by file type
 
@@ -2048,9 +2053,6 @@ interface Message {
   sender?: User;
   readBy?: Array<{ userId: string; readAt: string }>;
   deliveredTo?: Array<{ userId: string; deliveredAt: string }>;
-  isEncrypted?: boolean;
-  encryptionMode?: 'none' | 'server' | 'e2ee';
-  encryptedContent?: EncryptedContent;
 }
 ```
 
@@ -2123,9 +2125,6 @@ interface Conversation {
   isPinned?: boolean;
   isMuted?: boolean;
   mutedUntil?: string;
-  encryptionMode?: 'none' | 'server' | 'e2ee';
-  isEncryptionEnabled?: boolean;
-  encryptionKey?: string;
 }
 
 interface ConversationSettings {
@@ -2192,8 +2191,6 @@ interface SendMessagePayload {
   attachments?: SendMessageAttachment[];
   replyTo?: string;           // messageId
   tempId: string;             // client-generated; echoed back in message_ack
-  encryptedContent?: EncryptedContent;
-  isEncrypted?: boolean;
 }
 
 interface SendMessageAttachment {
@@ -2401,10 +2398,21 @@ document.querySelectorAll('[data-conv-id]').forEach((el) => {
 
 ## Changelog
 
+### v1.1.2
+- **New: Participants stored in a dedicated collection** — Participants are no longer embedded inside conversation documents. Each participant is now its own document in a separate collection, removing the MongoDB 16 MB document size ceiling for large groups and eliminating write contention on high-membership conversations. No client API changes.
+- **New: Transit encryption** — All socket payloads are now encrypted end-to-end using a per-session symmetric key negotiated on connect. Transparent to callers — no SDK API changes required.
+- **Fix: Disbanded groups now visible in read-only mode for removed members** — Previously removed members' views of disbanded groups were inconsistent. Removed participants now always see the conversation in read-only mode until they explicitly call `leave()`.
+- **Fix: Removed participant access hardened** — Removed users can no longer view messages sent after their removal via the REST API. Message history is now capped at the exact moment of removal. Removed users were also incorrectly able to search messages, view starred messages, and fetch unread counts from conversations they were removed from — all three are now blocked.
+- **Fix: Unread badge drops to zero immediately on removal** — When an admin removes a user from a group, all unread messages in that conversation are automatically marked as read for the removed user at the moment of removal. Previously the badge stayed non-zero until the user manually opened the conversation.
+- **Fix: Compression metadata now stored on the server** — When a compressed image is uploaded, the file record now correctly saves `compressed`, `originalSize`, and `compressionAlgorithm`. Previously this metadata was silently dropped by DTO validation. No changes needed on the client — handled automatically by `uploadBatch`.
+- **Fix: Delete for me also removes the message from your starred list** — Calling `deleteForMe` on a starred message now removes the star. Previously the message remained in the starred list even after being hidden.
+
 ### v1.1.1
 - **New: `attachmentSnapshot` on reply messages** — `replyTo` now includes a snapshot of the first attachment from the quoted message (`type`, `filename`, `mimeType`, `size`, `duration`, `dimensions`, signed `url`). Stored at write time so reply bubbles render without fetching the original message.
 - **Fix: `contentPreview` for multi-attachment replies** — Now reflects attachment count: `"photo.jpg +2 more"`, `"3 Photos"`, `"3 Attachments"` (mixed types). Previously always showed only the first filename.
 - **New: exported `ReplyAttachmentSnapshot` type.**
+- **Fix: Pin, unpin, and unmute operations** — Server-side issues causing pin, unpin, and unmute to fail in certain states are resolved.
+- **Fix: Various backend fixes** — Stability and correctness improvements across multiple server-side paths.
 
 ### v1.1.0
 - **Fix: 500 error on device token registration** — Registering a push token that was previously registered under a different user or device ID (e.g. after app reinstall, account switch, or UUID rotation) now succeeds. The stale token record is removed before the upsert, preventing a duplicate key violation on the global `token_unique` index.

package/dist/index.cjs

@@ -116,6 +116,7 @@ __export(src_exports, {
   resetAuthStore: () => resetAuthStore,
   resolveConfig: () => resolveConfig,
   setApiClientInstance: () => setApiClientInstance,
+  setTransitSession: () => setTransitSession,
   socketEmit: () => socketEmit,
   storageApi: () => storageApi,
   tryGetSocket: () => tryGetSocket,
@@ -161,7 +162,7 @@ function resolveConfig(config) {
     userId: config.userId,
     tenantId: config.tenantId,
     avatar: config.avatar,
-    encryptionMode: config.encryptionMode ?? "none",
+    transitEncryption: config.transitEncryption ?? true,
     upload: {
       maxFileSizeMB: limits,
       maxFilesPerMessage: config.upload?.maxFilesPerMessage ?? 10,
@@ -248,6 +249,100 @@ async function compressFile(file, platformCompressFn, config) {
 
 // src/api/client.ts
 var import_axios = __toESM(require("axios"), 1);
+
+// src/crypto/transit.ts
+async function encryptPayload(data, sessionKey) {
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  const plaintext = new TextEncoder().encode(JSON.stringify(data));
+  const encrypted = await globalThis.crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    sessionKey,
+    plaintext
+  );
+  const ct = encrypted.slice(0, encrypted.byteLength - 16);
+  const tag = encrypted.slice(encrypted.byteLength - 16);
+  return {
+    v: 1,
+    iv: bufToB64(iv),
+    tag: bufToB64(tag),
+    ct: bufToB64(ct)
+  };
+}
+async function decryptPayload(envelope, sessionKey) {
+  const iv = b64ToBuf(envelope.iv);
+  const tag = b64ToBuf(envelope.tag);
+  const ct = b64ToBuf(envelope.ct);
+  const combined = new Uint8Array(ct.byteLength + tag.byteLength);
+  combined.set(new Uint8Array(ct), 0);
+  combined.set(new Uint8Array(tag), ct.byteLength);
+  const decrypted = await globalThis.crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: new Uint8Array(iv) },
+    sessionKey,
+    combined
+  );
+  return JSON.parse(new TextDecoder().decode(decrypted));
+}
+function isTransitEnvelope(v) {
+  return typeof v === "object" && v !== null && v.v === 1 && typeof v.iv === "string" && typeof v.tag === "string" && typeof v.ct === "string";
+}
+function bufToB64(buf) {
+  const bytes = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
+  let str = "";
+  bytes.forEach((b) => {
+    str += String.fromCharCode(b);
+  });
+  return btoa(str);
+}
+function b64ToBuf(b64) {
+  const bin = atob(b64);
+  const buf = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) buf[i] = bin.charCodeAt(i);
+  return buf.buffer;
+}
+
+// src/crypto/session.ts
+var _session = null;
+var _readyResolve = null;
+var _readyPromise = null;
+var _transitConfigured = null;
+function configureTransit(enabled) {
+  _transitConfigured = enabled;
+  if (!enabled) {
+    _readyResolve?.();
+    _readyResolve = null;
+  }
+}
+function waitForTransitReady() {
+  if (!_transitConfigured) return Promise.resolve();
+  if (_session) return Promise.resolve();
+  if (!_readyPromise) {
+    _readyPromise = new Promise((resolve) => {
+      _readyResolve = resolve;
+    });
+  }
+  return _readyPromise;
+}
+function setTransitSession(session) {
+  _session = session;
+  _readyResolve?.();
+  _readyResolve = null;
+}
+function clearTransitSession() {
+  _session = null;
+  _readyPromise = null;
+  _readyResolve = null;
+}
+function isTransitEnabled() {
+  return _session?.enabled === true;
+}
+function getSessionKey() {
+  return _session?.sessionKey ?? null;
+}
+function getSessionId() {
+  return _session?.sessionId ?? null;
+}
+
+// src/api/client.ts
 var _tokenStore = null;
 var _config = null;
 var _avatarSent = false;
@@ -259,7 +354,8 @@ function initApiClient(config, tokenStore) {
     baseURL: config.apiUrl,
     headers: { "Content-Type": "application/json" }
   });
-  client.interceptors.request.use((req) => {
+  configureTransit(config.transitEncryption);
+  client.interceptors.request.use(async (req) => {
     const token = _tokenStore?.getAccessToken();
     if (token) req.headers["Authorization"] = `Bearer ${token}`;
     if (_config?.userId) req.headers["x-user-id"] = _config.userId;
@@ -269,18 +365,54 @@ function initApiClient(config, tokenStore) {
       else if (_config.avatar.url) req.headers["x-avatar-url"] = _config.avatar.url;
       _avatarSent = true;
     }
+    await waitForTransitReady();
+    if (isTransitEnabled()) {
+      const sessionId = getSessionId();
+      const key = getSessionKey();
+      if (sessionId && key) {
+        req.headers["x-transit-session"] = sessionId;
+        if (req.data !== void 0 && req.data !== null) {
+          const envelope = await encryptPayload(req.data, key);
+          req.data = envelope;
+          req.headers["x-transit-encrypted"] = "1";
+        }
+      }
+    }
     return req;
   });
   let isRefreshing = false;
   let refreshQueue = [];
   client.interceptors.response.use(
-    (response) => {
+    async (response) => {
+      if (isTransitEnabled()) {
+        const key = getSessionKey();
+        if (key) {
+          if (isTransitEnvelope(response.data)) {
+            response.data = await decryptPayload(response.data, key);
+          } else if (response.data?.data && isTransitEnvelope(response.data.data)) {
+            response.data.data = await decryptPayload(response.data.data, key);
+          }
+        }
+      }
       if (response.data && typeof response.data === "object" && "success" in response.data && "data" in response.data) {
         response.data = response.data.data;
       }
       return response;
     },
     async (error) => {
+      if (isTransitEnabled() && error.response?.data) {
+        const key = getSessionKey();
+        if (key) {
+          try {
+            if (isTransitEnvelope(error.response.data)) {
+              error.response.data = await decryptPayload(error.response.data, key);
+            } else if (error.response.data?.data && isTransitEnvelope(error.response.data.data)) {
+              error.response.data.data = await decryptPayload(error.response.data.data, key);
+            }
+          } catch {
+          }
+        }
+      }
       const original = error.config;
       if (error.response?.status === 401 && !original._retry) {
         const refreshToken = _tokenStore?.getRefreshToken();
@@ -658,7 +790,14 @@ async function uploadBatch(files, platformUploadFn, conversationId, onProgress,
     filename: f.name,
     mimeType: f.type,
     size: f.size,
-    conversationId
+    conversationId,
+    ...f.compressed && {
+      metadata: {
+        compressed: f.compressed,
+        originalSize: f.originalSize,
+        compressionAlgorithm: f.compressionAlgorithm
+      }
+    }
   }));
   const { urls, errors: requestErrors } = await storageApi.requestPresignedUrlBatch(requests);
   const progressMap = {};
@@ -755,6 +894,95 @@ var usersApi = {
 
 // src/socket/socket.ts
 var import_socket = require("socket.io-client");
+
+// src/crypto/detect.ts
+var _cached = null;
+async function detectTransitAlgo() {
+  if (_cached) return _cached;
+  try {
+    await globalThis.crypto.subtle.generateKey(
+      { name: "X25519" },
+      false,
+      ["deriveKey"]
+    );
+    _cached = "x25519";
+  } catch {
+    _cached = "p256";
+  }
+  return _cached;
+}
+function resetAlgoCache() {
+  _cached = null;
+}
+
+// src/crypto/handshake.ts
+async function fetchServerKeys(apiUrl) {
+  const res = await fetch(`${apiUrl}/crypto/pubkey`);
+  if (!res.ok) throw new Error(`[AntzChat] Failed to fetch server public key: ${res.status}`);
+  const body = await res.json();
+  return body?.data ?? body;
+}
+async function performHandshake(algo, serverKeys, socketHandshakeAuth) {
+  const ephemeral = await globalThis.crypto.subtle.generateKey(
+    algo === "x25519" ? { name: "X25519" } : { name: "ECDH", namedCurve: "P-256" },
+    false,
+    ["deriveBits"]
+  );
+  const pubRaw = await globalThis.crypto.subtle.exportKey("raw", ephemeral.publicKey);
+  socketHandshakeAuth["transitEphemeralPub"] = bufToB642(pubRaw);
+  socketHandshakeAuth["transitAlgo"] = algo;
+  const ephemeralPriv = ephemeral.privateKey;
+  return (sessionId) => deriveSessionKey(ephemeralPriv, algo, serverKeys, sessionId);
+}
+async function deriveSessionKey(ephemeralPriv, algo, serverKeys, sessionId) {
+  const serverPubB64 = algo === "x25519" ? serverKeys.x25519 : serverKeys.p256;
+  const serverPubRaw = b64ToBuf2(serverPubB64);
+  const keyAlgoParams = algo === "x25519" ? { name: "X25519" } : { name: "ECDH", namedCurve: "P-256" };
+  const serverPubKey = await globalThis.crypto.subtle.importKey(
+    "raw",
+    serverPubRaw,
+    keyAlgoParams,
+    false,
+    []
+  );
+  const sharedBits = await globalThis.crypto.subtle.deriveBits(
+    { name: algo === "x25519" ? "X25519" : "ECDH", public: serverPubKey },
+    ephemeralPriv,
+    256
+  );
+  const hkdfKey = await globalThis.crypto.subtle.importKey(
+    "raw",
+    sharedBits,
+    "HKDF",
+    false,
+    ["deriveKey"]
+  );
+  const salt = new TextEncoder().encode(sessionId);
+  const info = new TextEncoder().encode("antz-transit-v1");
+  return globalThis.crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+function bufToB642(buf) {
+  const bytes = new Uint8Array(buf);
+  let str = "";
+  bytes.forEach((b) => {
+    str += String.fromCharCode(b);
+  });
+  return btoa(str);
+}
+function b64ToBuf2(b64) {
+  const bin = atob(b64);
+  const buf = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) buf[i] = bin.charCodeAt(i);
+  return buf.buffer;
+}
+
+// src/socket/socket.ts
 var _socket = null;
 var _status = "disconnected";
 var _statusListeners = /* @__PURE__ */ new Set();
@@ -779,23 +1007,96 @@ function onSocketStatus(listener) {
   _statusListeners.add(listener);
   return () => _statusListeners.delete(listener);
 }
+async function secureEmit(socket, event, payload, ack) {
+  if (isTransitEnabled()) {
+    const key = getSessionKey();
+    if (key) {
+      const envelope = await encryptPayload(payload, key);
+      if (ack) {
+        socket.emit(event, envelope, async (encryptedResponse) => {
+          if (isTransitEnvelope(encryptedResponse)) {
+            try {
+              const decrypted = await decryptPayload(encryptedResponse, key);
+              ack(decrypted);
+            } catch {
+              ack(encryptedResponse);
+            }
+          } else {
+            ack(encryptedResponse);
+          }
+        });
+      } else {
+        socket.emit(event, envelope);
+      }
+      return;
+    }
+  }
+  if (ack) {
+    socket.emit(event, payload, ack);
+  } else {
+    socket.emit(event, payload);
+  }
+}
+function secureOn(socket, event, handler) {
+  socket.on(event, async (raw) => {
+    if (isTransitEnabled() && isTransitEnvelope(raw)) {
+      const key = getSessionKey();
+      if (key) {
+        try {
+          const data = await decryptPayload(raw, key);
+          handler(data);
+          return;
+        } catch {
+          console.error(`[AntzChat] Transit decryption failed for event: ${event}`);
+          return;
+        }
+      }
+    }
+    handler(raw);
+  });
+}
 async function connectSocket(config, getToken) {
   if (_socket && !_socket.disconnected) return _socket;
   _getToken = getToken;
   _userId = config.userId;
   _tenantId = config.tenantId;
   const token = getToken();
+  const socketHandshakeAuth = {
+    token: token ? `Bearer ${token}` : "",
+    ...config.userId && { userId: config.userId },
+    ...config.tenantId && { tenantId: config.tenantId },
+    ...config.avatar?.url && { avatarUrl: config.avatar.url },
+    ...config.avatar?.base64 && { avatarBase64: config.avatar.base64 }
+  };
+  let boundDeriveSessionKey = null;
+  if (config.transitEncryption) {
+    try {
+      const serverKeys = await fetchServerKeys(config.apiUrl);
+      if (!serverKeys.enabled) {
+        throw new Error(
+          "[AntzChat] Transit encryption mismatch: SDK has transitEncryption=true but server has TRANSIT_ENCRYPTION_ENABLED=false. Align the config on both sides."
+        );
+      }
+      const algo = await detectTransitAlgo();
+      boundDeriveSessionKey = await performHandshake(algo, serverKeys, socketHandshakeAuth);
+    } catch (err) {
+      if (err.message?.startsWith("[AntzChat] Transit encryption mismatch")) throw err;
+      console.warn("[AntzChat] Transit handshake setup failed, connecting without transit encryption:", err.message);
+    }
+  } else {
+    try {
+      const serverKeys = await fetchServerKeys(config.apiUrl);
+      if (serverKeys.enabled) {
+        throw new Error(
+          "[AntzChat] Transit encryption mismatch: SDK has transitEncryption=false but server has TRANSIT_ENCRYPTION_ENABLED=true. Align the config on both sides."
+        );
+      }
+    } catch (err) {
+      if (err.message?.startsWith("[AntzChat] Transit encryption mismatch")) throw err;
+    }
+  }
   _socket = (0, import_socket.io)(`${config.socketOrigin}/chat`, {
-    auth: {
-      token: token ? `Bearer ${token}` : "",
-      ...config.userId && { userId: config.userId },
-      ...config.tenantId && { tenantId: config.tenantId },
-      ...config.avatar?.url && { avatarUrl: config.avatar.url },
-      ...config.avatar?.base64 && { avatarBase64: config.avatar.base64 }
-    },
-    // path must match SOCKET_IO_PATH on the server (default '/socket.io').
-    // Set socketPath in SDK config when the server is behind a reverse proxy
-    // that adds a path prefix (e.g. '/chat-api/socket.io' for UAT).
+    auth: socketHandshakeAuth,
     path: config.socketPath,
     transports: ["websocket", "polling"],
     reconnection: true,
@@ -806,32 +1107,80 @@ async function connectSocket(config, getToken) {
   });
   setStatus("connecting");
   _socket.on("connect", () => setStatus("connected"));
-  _socket.on("disconnect", () => setStatus("disconnected"));
+  _socket.on("disconnect", () => {
+    setStatus("disconnected");
+    clearTransitSession();
+  });
   _socket.on("connect_error", (err) => {
     console.error("[AntzChat] Socket connect_error:", err?.message, err?.data);
     setStatus("error");
   });
   _socket.on("reconnecting", () => setStatus("reconnecting"));
   _socket.on("reconnect", () => setStatus("connected"));
-  _socket.on("read_receipt", (event) => {
+  if (config.transitEncryption && boundDeriveSessionKey) {
+    await new Promise((resolve) => {
+      const done = () => {
+        clearTimeout(timeout);
+        resolve();
+      };
+      const timeout = setTimeout(() => {
+        console.warn("[AntzChat] transit_session timeout \u2014 unblocking HTTP without transit encryption");
+        configureTransit(false);
+        done();
+      }, 5e3);
+      _socket.on("transit_session", async ({ sessionId }) => {
+        try {
+          if (boundDeriveSessionKey) {
+            const sessionKey = await boundDeriveSessionKey(sessionId);
+            const algo = socketHandshakeAuth["transitAlgo"] ?? "p256";
+            setTransitSession({ sessionKey, algo, sessionId, enabled: true });
+          }
+        } catch (err) {
+          console.error("[AntzChat] Failed to derive transit session key:", err.message);
+        }
+        done();
+      });
+      _socket.on("connect_error", () => done());
+    });
+  }
+  secureOn(_socket, "read_receipt", (event) => {
     Promise.resolve().then(() => (init_chat_store(), chat_store_exports)).then(({ useChatStore: useChatStore2 }) => {
-      useChatStore2.getState().setLastRead(event.conversationId, event.messageId, event.readAt);
+      const e = event;
+      useChatStore2.getState().setLastRead(e.conversationId, e.messageId, e.readAt);
     });
   });
-  _socket.on("user_online", (event) => {
+  secureOn(_socket, "user_online", (event) => {
     Promise.resolve().then(() => (init_chat_store(), chat_store_exports)).then(({ useChatStore: useChatStore2 }) => {
-      const store = useChatStore2.getState();
-      store.setUserOnline(event.userId);
+      useChatStore2.getState().setUserOnline(event.userId);
     });
   });
-  _socket.on("user_offline", (event) => {
+  secureOn(_socket, "user_offline", (event) => {
     Promise.resolve().then(() => (init_chat_store(), chat_store_exports)).then(({ useChatStore: useChatStore2 }) => {
+      const e = event;
       const store = useChatStore2.getState();
-      store.setUserOffline(event.userId);
-      if (event.lastSeenAt) store.setLastSeen(event.userId, event.lastSeenAt);
+      store.setUserOffline(e.userId);
+      if (e.lastSeenAt) store.setLastSeen(e.userId, e.lastSeenAt);
     });
   });
-  return _socket;
+  return createSecureSocketProxy(_socket);
+}
+function createSecureSocketProxy(socket) {
+  return new Proxy(socket, {
+    get(target, prop) {
+      if (prop === "on") {
+        return (event, handler) => {
+          const internal = ["connect", "disconnect", "connect_error", "reconnect", "reconnecting", "error"];
+          if (internal.includes(event)) {
+            return target.on(event, handler);
+          }
+          secureOn(target, event, handler);
+          return socket;
+        };
+      }
+      const val = target[prop];
+      return typeof val === "function" ? val.bind(target) : val;
+    }
+  });
 }
 function disconnectSocket() {
   if (_socket) {
@@ -839,6 +1188,8 @@ function disconnectSocket() {
     _socket = null;
     setStatus("disconnected");
   }
+  clearTransitSession();
+  resetAlgoCache();
   _getToken = null;
   _userId = void 0;
   _tenantId = void 0;
@@ -896,7 +1247,7 @@ async function withAck(event, payload) {
   if (!socket) return Promise.reject(new Error(`[AntzChat] Socket not connected (event: ${event})`));
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => reject(new Error(`Socket ack timeout: ${event}`)), ACK_TIMEOUT);
-    socket.emit(event, payload, (response) => {
+    secureEmit(socket, event, payload, (response) => {
       clearTimeout(timer);
       resolve(response);
     });
@@ -905,7 +1256,7 @@ async function withAck(event, payload) {
 function fireAndForget(event, payload) {
   const socket = tryGetSocket();
   if (!socket) return;
-  socket.emit(event, payload);
+  secureEmit(socket, event, payload);
 }
 var socketEmit = {
   joinRoom(conversationId) {
@@ -950,7 +1301,7 @@ var socketEmit = {
     if (!socket) return Promise.resolve([]);
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => reject(new Error("get_online_users timeout")), ACK_TIMEOUT);
-      socket.emit("get_online_users", { userIds }, (response) => {
+      secureEmit(socket, "get_online_users", { userIds }, (response) => {
         clearTimeout(timer);
         if (response && typeof response === "object" && "onlineStatus" in response) {
           const status = response.onlineStatus;
@@ -1132,6 +1483,7 @@ var AntzChatClient = class {
   resetAuthStore,
   resolveConfig,
   setApiClientInstance,
+  setTransitSession,
   socketEmit,
   storageApi,
   tryGetSocket,