@antzsoft/chat-core 1.3.3 → 1.3.4

package/README.md

@@ -1746,6 +1746,7 @@ interface CrossConversationSyncResponse {
   deliveredReceipts: SyncDeliveredReceipt[];  // delivery receipts since `since`
   reactions: SyncReactions;      // v1.3.1+ — full current state for messages with reaction activity
   stars: SyncStarEntry[];        // v1.3.1+ — star/unstar records since `since`
+  deletedConversationIds: string[]; // v1.3.4+ — conversations the user deleted from their list since `since`
 }
 
 interface SyncDeletedForMe {
@@ -1861,6 +1862,7 @@ The built-in `SyncService.syncConversation()` in the RN app uses the backward di
 | `participantChanges` | ✅ | ✅ | Role changes, mute/unmute, removals (`isActive: false`) |
 | `readReceipts` | ✅ | ✅ | Read receipts — merge into `msg.readBy[]`, recompute status |
 | `deliveredReceipts` | ✅ | ✅ | Delivery receipts — merge into `msg.deliveredTo[]`, recompute status |
+| `deletedConversationIds` | ✅ v1.3.4 | — | Conversations this user deleted from their list — remove from local DB. Cursor-safe: won't reappear on next `pull()` |
 
 #### Stale handling
 
@@ -3054,6 +3056,28 @@ document.querySelectorAll('[data-conv-id]').forEach((el) => {
 
 ## Changelog
 
+### v1.3.4
+
+- **New: `deletedConversationIds` in `CrossConversationSyncResponse`** — `syncApi.pull(since)` now returns `deletedConversationIds: string[]`. Contains the IDs of conversations this user explicitly deleted from their list (via the delete-conversation action) since the `since` cursor. The client should remove these from local SQLite and the UI conversation list.
+
+  ```typescript
+  const result = await syncApi.pull(lastSyncedAt);
+
+  // Remove conversations the user deleted from their list
+  for (const convId of result.deletedConversationIds) {
+    await db.conversations.delete(convId);
+  }
+  ```
+
+  **Scoped to the requesting user only** — if another user deletes their copy of a shared DM, it does not appear in your `deletedConversationIds`. **Cursor-safe** — once the client saves the returned `syncedAt` as the new cursor, the same IDs will not reappear on the next `pull()` call. On the server side, this is detected via `participant.isHidden = true AND updatedAt > since` — the same flag set by `DELETE /conversations/:id`.
+
+- **Fix: Sync access guard parity with message listing API** — All three sync paths now enforce the same access rules as `GET /messages`:
+  - **`membershipPeriods` windows** — users who deleted and were re-added only see messages from their active membership periods; a deleted conversation with no periods returns no messages.
+  - **`status` filter** — active messages and deleted-for-everyone tombstones (so clients can render "This message was deleted") are included; `failed`-status messages are excluded.
+  - **`isHidden` group check** — hidden group participants (exit+delete) receive `403 Forbidden` on per-conversation sync, matching message listing behaviour. Hidden DM participants are still allowed.
+  - **Removed-member read access** — removed members (`isActive: false`) can still call per-conversation sync to retrieve history, matching the message listing API's `validateConversationAccess` which does not require `isActive: true` for reads.
+  - **No integration changes required.** These are server-side enforcement fixes — the response shape is unchanged, only the set of messages returned is now correctly filtered.
+
 ### v1.3.3
 
 - **New: `metadata` and `sender` fields in all sync message responses** — Messages returned by all three sync paths (`crossConversationSync`, `conversationSync`, `conversationSyncBySeq`) now include `metadata` (system message metadata — `actorUserId`, `targetUserId`, `action`) and `sender` (displayName, avatarUrl snapshot at send time). Both fields were already optional on the core SDK `Message` type so no SDK type changes were required. Previously absent from sync responses, meaning system message text could not be rendered and sender avatars were blank after an offline sync. The server batch-fetches sender profiles in a single `findByIds` call per sync request — one extra DB round trip per sync, not one per message. **No integration changes required.**

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { R as ResolvedCompressionConfig, L as LoginCredentials, A as AuthResponse, a as RegisterData, b as AuthTokens, U as User, C as CrossConversationSyncResponse, c as ConversationSyncResponse, d as AppConfig, S as SendMessagePayload, e as CursorPaginatedResponse, M as Message, f as MessageReactionsResponse, P as PaginatedResponse, g as MessageReceiptsResponse, h as ConversationListParams, i as Conversation, j as Participant, k as ConversationUnreadCount, l as UnreadSummary, m as UserPreferences, n as ResolvedConfig, o as PersistStorage, p as PresignedUrlRequest, q as PresignedUrlResponse, F as FileResponse, r as CompletedPart, s as FileType, t as AntzChatConfig, u as UploadableFile, B as BatchUploadResult } from './storage-DdHsneZR.cjs';
-export { v as Attachment, w as CompressedFile, x as CompressionAlgorithm, y as CompressionConfig, z as ConversationType, D as ConversationUpdatedEvent, E as FileSizeLimits, G as LastReaction, H as MessageAckEvent, I as MessageContent, J as MessageDeletedEvent, K as MessageDeletedForMeEvent, N as MessageDeliveredEvent, O as MessageMetadata, Q as MessageReaction, T as MessageReceiptEntry, V as MessageReplyReference, W as MessageStarUpdatedEvent, X as MessageUpdatedEvent, Y as MessagesDeliveredEvent, Z as MultipartPartUrl, _ as MultipartUploadInfo, $ as NewMessageEvent, a0 as OptimisticAttachment, a1 as PlatformCompressFn, a2 as PlatformUploadFn, a3 as PlatformUploadPartFn, a4 as QuietHours, a5 as ReactionGroup, a6 as ReactionUpdatedEvent, a7 as ReactionUser, a8 as ReadReceiptEvent, a9 as ReplyAttachmentSnapshot, aa as ResolvedFileSizeLimits, ab as SendMessageAttachment, ac as SyncDeletedForMe, ad as SyncDeliveredReceipt, ae as SyncParticipantChange, af as SyncReactionEntry, ag as SyncReactions, ah as SyncReadReceipt, ai as SyncStarEntry, aj as SystemMessageMetadata, ak as TypingIndicatorEvent, al as UploadConfig, am as UploadProgress, an as UserStatusEvent, ao as resolveConfig, ap as storageApi, aq as uploadBatch } from './storage-DdHsneZR.cjs';
+import { R as ResolvedCompressionConfig, L as LoginCredentials, A as AuthResponse, a as RegisterData, b as AuthTokens, U as User, C as CrossConversationSyncResponse, c as ConversationSyncResponse, d as AppConfig, S as SendMessagePayload, e as CursorPaginatedResponse, M as Message, f as MessageReactionsResponse, P as PaginatedResponse, g as MessageReceiptsResponse, h as ConversationListParams, i as Conversation, j as Participant, k as ConversationUnreadCount, l as UnreadSummary, m as UserPreferences, n as ResolvedConfig, o as PersistStorage, p as PresignedUrlRequest, q as PresignedUrlResponse, F as FileResponse, r as CompletedPart, s as FileType, t as AntzChatConfig, u as UploadableFile, B as BatchUploadResult } from './storage-DJh54pps.cjs';
+export { v as Attachment, w as CompressedFile, x as CompressionAlgorithm, y as CompressionConfig, z as ConversationType, D as ConversationUpdatedEvent, E as FileSizeLimits, G as LastReaction, H as MessageAckEvent, I as MessageContent, J as MessageDeletedEvent, K as MessageDeletedForMeEvent, N as MessageDeliveredEvent, O as MessageMetadata, Q as MessageReaction, T as MessageReceiptEntry, V as MessageReplyReference, W as MessageStarUpdatedEvent, X as MessageUpdatedEvent, Y as MessagesDeliveredEvent, Z as MultipartPartUrl, _ as MultipartUploadInfo, $ as NewMessageEvent, a0 as OptimisticAttachment, a1 as PlatformCompressFn, a2 as PlatformUploadFn, a3 as PlatformUploadPartFn, a4 as QuietHours, a5 as ReactionGroup, a6 as ReactionUpdatedEvent, a7 as ReactionUser, a8 as ReadReceiptEvent, a9 as ReplyAttachmentSnapshot, aa as ResolvedFileSizeLimits, ab as SendMessageAttachment, ac as SyncDeletedForMe, ad as SyncDeliveredReceipt, ae as SyncParticipantChange, af as SyncReactionEntry, ag as SyncReactions, ah as SyncReadReceipt, ai as SyncStarEntry, aj as SystemMessageMetadata, ak as TypingIndicatorEvent, al as UploadConfig, am as UploadProgress, an as UserStatusEvent, ao as resolveConfig, ap as storageApi, aq as uploadBatch } from './storage-DJh54pps.cjs';
 import { AxiosInstance } from 'axios';
 import { Socket } from 'socket.io-client';
 import * as zustand_middleware from 'zustand/middleware';

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as ResolvedCompressionConfig, L as LoginCredentials, A as AuthResponse, a as RegisterData, b as AuthTokens, U as User, C as CrossConversationSyncResponse, c as ConversationSyncResponse, d as AppConfig, S as SendMessagePayload, e as CursorPaginatedResponse, M as Message, f as MessageReactionsResponse, P as PaginatedResponse, g as MessageReceiptsResponse, h as ConversationListParams, i as Conversation, j as Participant, k as ConversationUnreadCount, l as UnreadSummary, m as UserPreferences, n as ResolvedConfig, o as PersistStorage, p as PresignedUrlRequest, q as PresignedUrlResponse, F as FileResponse, r as CompletedPart, s as FileType, t as AntzChatConfig, u as UploadableFile, B as BatchUploadResult } from './storage-DdHsneZR.js';
-export { v as Attachment, w as CompressedFile, x as CompressionAlgorithm, y as CompressionConfig, z as ConversationType, D as ConversationUpdatedEvent, E as FileSizeLimits, G as LastReaction, H as MessageAckEvent, I as MessageContent, J as MessageDeletedEvent, K as MessageDeletedForMeEvent, N as MessageDeliveredEvent, O as MessageMetadata, Q as MessageReaction, T as MessageReceiptEntry, V as MessageReplyReference, W as MessageStarUpdatedEvent, X as MessageUpdatedEvent, Y as MessagesDeliveredEvent, Z as MultipartPartUrl, _ as MultipartUploadInfo, $ as NewMessageEvent, a0 as OptimisticAttachment, a1 as PlatformCompressFn, a2 as PlatformUploadFn, a3 as PlatformUploadPartFn, a4 as QuietHours, a5 as ReactionGroup, a6 as ReactionUpdatedEvent, a7 as ReactionUser, a8 as ReadReceiptEvent, a9 as ReplyAttachmentSnapshot, aa as ResolvedFileSizeLimits, ab as SendMessageAttachment, ac as SyncDeletedForMe, ad as SyncDeliveredReceipt, ae as SyncParticipantChange, af as SyncReactionEntry, ag as SyncReactions, ah as SyncReadReceipt, ai as SyncStarEntry, aj as SystemMessageMetadata, ak as TypingIndicatorEvent, al as UploadConfig, am as UploadProgress, an as UserStatusEvent, ao as resolveConfig, ap as storageApi, aq as uploadBatch } from './storage-DdHsneZR.js';
+import { R as ResolvedCompressionConfig, L as LoginCredentials, A as AuthResponse, a as RegisterData, b as AuthTokens, U as User, C as CrossConversationSyncResponse, c as ConversationSyncResponse, d as AppConfig, S as SendMessagePayload, e as CursorPaginatedResponse, M as Message, f as MessageReactionsResponse, P as PaginatedResponse, g as MessageReceiptsResponse, h as ConversationListParams, i as Conversation, j as Participant, k as ConversationUnreadCount, l as UnreadSummary, m as UserPreferences, n as ResolvedConfig, o as PersistStorage, p as PresignedUrlRequest, q as PresignedUrlResponse, F as FileResponse, r as CompletedPart, s as FileType, t as AntzChatConfig, u as UploadableFile, B as BatchUploadResult } from './storage-DJh54pps.js';
+export { v as Attachment, w as CompressedFile, x as CompressionAlgorithm, y as CompressionConfig, z as ConversationType, D as ConversationUpdatedEvent, E as FileSizeLimits, G as LastReaction, H as MessageAckEvent, I as MessageContent, J as MessageDeletedEvent, K as MessageDeletedForMeEvent, N as MessageDeliveredEvent, O as MessageMetadata, Q as MessageReaction, T as MessageReceiptEntry, V as MessageReplyReference, W as MessageStarUpdatedEvent, X as MessageUpdatedEvent, Y as MessagesDeliveredEvent, Z as MultipartPartUrl, _ as MultipartUploadInfo, $ as NewMessageEvent, a0 as OptimisticAttachment, a1 as PlatformCompressFn, a2 as PlatformUploadFn, a3 as PlatformUploadPartFn, a4 as QuietHours, a5 as ReactionGroup, a6 as ReactionUpdatedEvent, a7 as ReactionUser, a8 as ReadReceiptEvent, a9 as ReplyAttachmentSnapshot, aa as ResolvedFileSizeLimits, ab as SendMessageAttachment, ac as SyncDeletedForMe, ad as SyncDeliveredReceipt, ae as SyncParticipantChange, af as SyncReactionEntry, ag as SyncReactions, ah as SyncReadReceipt, ai as SyncStarEntry, aj as SystemMessageMetadata, ak as TypingIndicatorEvent, al as UploadConfig, am as UploadProgress, an as UserStatusEvent, ao as resolveConfig, ap as storageApi, aq as uploadBatch } from './storage-DJh54pps.js';
 import { AxiosInstance } from 'axios';
 import { Socket } from 'socket.io-client';
 import * as zustand_middleware from 'zustand/middleware';

package/dist/internal.d.cts

@@ -1,4 +1,4 @@
-export { ar as uploadBatchWithSlots } from './storage-DdHsneZR.cjs';
+export { ar as uploadBatchWithSlots } from './storage-DJh54pps.cjs';
 
 declare function generateUUID(): string;
 

package/dist/internal.d.ts

@@ -1,4 +1,4 @@
-export { ar as uploadBatchWithSlots } from './storage-DdHsneZR.js';
+export { ar as uploadBatchWithSlots } from './storage-DJh54pps.js';
 
 declare function generateUUID(): string;
 

package/dist/{storage-DdHsneZR.d.cts → storage-DJh54pps.d.cts}

@@ -484,6 +484,13 @@ interface CrossConversationSyncResponse {
     participantChanges: SyncParticipantChange[];
     readReceipts: SyncReadReceipt[];
     deliveredReceipts: SyncDeliveredReceipt[];
+    /**
+     * Conversation IDs the client should remove from its local list.
+     * Set when the user explicitly deleted their own copy of a conversation
+     * (DM or group) via the delete action. Scoped to this user only — other
+     * participants are not affected.
+     */
+    deletedConversationIds: string[];
 }
 interface ConversationSyncResponse {
     syncedAt: string;

package/dist/{storage-DdHsneZR.d.ts → storage-DJh54pps.d.ts}

@@ -484,6 +484,13 @@ interface CrossConversationSyncResponse {
     participantChanges: SyncParticipantChange[];
     readReceipts: SyncReadReceipt[];
     deliveredReceipts: SyncDeliveredReceipt[];
+    /**
+     * Conversation IDs the client should remove from its local list.
+     * Set when the user explicitly deleted their own copy of a conversation
+     * (DM or group) via the delete action. Scoped to this user only — other
+     * participants are not affected.
+     */
+    deletedConversationIds: string[];
 }
 interface ConversationSyncResponse {
     syncedAt: string;

package/docs/integration-guide.html

@@ -155,7 +155,7 @@ section.sec>h2:hover{color:#fff}
 
   <div class="section-label">What's New</div>
   <ul>
-    <li><a href="#whats-new">v1.3.3 Release Notes</a></li>
+    <li><a href="#whats-new">v1.3.4 Release Notes</a></li>
   </ul>
 
   <div class="section-label">Getting Started</div>
@@ -250,12 +250,72 @@ section.sec>h2:hover{color:#fff}
   <h2>What's New</h2>
   <p style="color:var(--muted);font-size:13px;margin-bottom:20px">Version history and release notes. Click a version to expand.</p>
 
-  <!-- ── v1.3.3 (current) ── -->
+  <!-- ── v1.3.4 (current) ── -->
+  <div class="wn-version open" id="wn-134">
+    <div class="wn-header" onclick="toggleVersion('wn-134')">
+      <div class="wn-title">
+        <span class="wn-ver">v1.3.4</span>
+        <span class="wn-badge current">Current</span>
+        <span class="wn-date">July 2026</span>
+      </div>
+      <span class="wn-chevron">▲</span>
+    </div>
+    <div class="wn-body">
+
+      <div class="wn-item" id="wn-134-deleted-conv-ids">
+        <div class="wn-item-header" onclick="toggleItem('wn-134-deleted-conv-ids')">
+          <span class="wn-tag new">New</span>
+          <span class="wn-item-title"><code>deletedConversationIds</code> in <code>CrossConversationSyncResponse</code></span>
+          <span class="wn-chevron-sm">▾</span>
+        </div>
+        <div class="wn-item-body">
+          <p><code>syncApi.pull(since)</code> now returns <code>deletedConversationIds: string[]</code> — IDs of conversations this user explicitly deleted from their list (via the delete-conversation action) since the <code>since</code> cursor. The client should remove these from local storage and the UI conversation list.</p>
+          <table>
+            <thead><tr><th>Property</th><th>Type</th><th>Description</th></tr></thead>
+            <tbody>
+              <tr><td><code>deletedConversationIds</code></td><td><code>string[]</code></td><td>Conversation IDs to remove from local list. Empty array when none were deleted in the sync window.</td></tr>
+            </tbody>
+          </table>
+          <pre><code><span class="kw">const</span> result = <span class="kw">await</span> syncApi.<span class="fn">pull</span>(lastSyncedAt);
+
+<span class="cm">// Remove conversations the user deleted from their list</span>
+<span class="kw">for</span> (<span class="kw">const</span> convId <span class="kw">of</span> result.deletedConversationIds) {
+  <span class="kw">await</span> db.conversations.<span class="fn">delete</span>(convId);
+}</code></pre>
+          <p><strong>Scoped to the requesting user only</strong> — if another user deletes their copy of a shared DM, it does not appear in your <code>deletedConversationIds</code>. <strong>Cursor-safe</strong> — once the client saves the returned <code>syncedAt</code> as the new cursor, the same IDs will not reappear on the next <code>pull()</code>. No acknowledged-receipt tracking needed.</p>
+          <p><strong>No integration changes required</strong> beyond consuming the new field. The field is always present (empty array when nothing was deleted).</p>
+        </div>
+      </div>
+
+      <div class="wn-item" id="wn-134-sync-guards">
+        <div class="wn-item-header" onclick="toggleItem('wn-134-sync-guards')">
+          <span class="wn-tag fix">Fix</span>
+          <span class="wn-item-title">Sync access guard parity with message listing API</span>
+          <span class="wn-chevron-sm">▾</span>
+        </div>
+        <div class="wn-item-body">
+          <p>All three sync paths now enforce the same access rules as <code>GET /messages</code>. Previously sync could return messages that message listing would not show.</p>
+          <table>
+            <thead><tr><th>Guard</th><th>Before</th><th>After</th></tr></thead>
+            <tbody>
+              <tr><td><code>membershipPeriods</code> windows</td><td>Not enforced — all messages returned regardless of when user was a member</td><td>Messages outside the user's active membership windows are excluded. Re-added users only see messages from their active periods.</td></tr>
+              <tr><td><code>status</code> filter</td><td>Only <code>deletedFor</code> checked — <code>failed</code>-status messages leaked through</td><td>Only <code>active</code> and <code>deleted</code> (tombstone) messages returned, matching message listing</td></tr>
+              <tr><td><code>isHidden</code> group check</td><td>Not checked — hidden group members could still sync</td><td>Hidden group participants (exit+delete) receive <code>403</code>. Hidden DM participants still allowed (consistent with message listing).</td></tr>
+              <tr><td>Removed-member read access</td><td><code>isActive: true</code> required — removed members blocked from syncing history</td><td>Removed members can sync read-only history, matching message listing <code>validateConversationAccess</code></td></tr>
+            </tbody>
+          </table>
+          <p><strong>No integration changes required.</strong> Response shape is unchanged — only the correctness of the returned message set improves.</p>
+        </div>
+      </div>
+
+    </div>
+  </div><!-- /.wn-version -->
+
+  <!-- ── v1.3.3 ── -->
   <div class="wn-version open" id="wn-133">
     <div class="wn-header" onclick="toggleVersion('wn-133')">
       <div class="wn-title">
         <span class="wn-ver">v1.3.3</span>
-        <span class="wn-badge current">Current</span>
         <span class="wn-date">June 2026</span>
       </div>
       <span class="wn-chevron">▲</span>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antzsoft/chat-core",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "description": "Platform-agnostic core for Antz Chat — API, socket, stores, types. Works in browser, React Native (Expo or bare), and Node.js.",
   "author": "Antz",
   "license": "MIT",