@devchitchat/chat 0.0.0

package/src/ws/handlers/authHandlers.js

@@ -0,0 +1,152 @@
+/**
+ * Auth & admin WS handlers.
+ *
+ * Each function receives (ws, msg, ctx) where ctx is the shared context
+ * object built in ChatServer — services, state maps, and bound helpers.
+ */
+
+export function handleHello(ws, msg, ctx) {
+  const { auth, botService, sendWs, sendDigest, attachUser } = ctx
+  const { session_token, bot_token } = msg.body?.resume ?? {}
+  let user = null
+  let lastSeenAt = null
+
+  if (bot_token) {
+    const bot = botService.authenticateToken(bot_token)
+    user = { user_id: bot.userId, handle: bot.handle, display_name: bot.displayName, roles: bot.roles }
+    attachUser(ws, user, null)
+  } else if (session_token) {
+    const session = auth.validateSession(session_token)
+    if (session) {
+      user = session.user
+      lastSeenAt = session.last_seen_at
+      attachUser(ws, user, session.session_id)
+    }
+  }
+
+  sendWs(ws, {
+    t: 'hello_ack', reply_to: msg.id, ok: true,
+    body: {
+      server: { name: 'devchitchat', ver: '2.0.0' },
+      session: { authenticated: !!user, user: user ?? null, session_token: session_token ?? null },
+      limits: { max_channels: 200, max_group_members: 20, max_message_bytes: 8000, max_signaling_bytes: 64000 }
+    }
+  })
+
+  if (user) sendDigest(ws, user.user_id, lastSeenAt)
+}
+
+export async function handleInviteRedeem(ws, msg, ctx) {
+  const { auth, sendWs, sendDigest, attachUser } = ctx
+  const { invite_token, profile, password } = msg.body || {}
+  const result = await auth.redeemInvite({ inviteToken: invite_token, profile, password })
+  const session = auth.validateSession(result.sessionToken)
+  attachUser(ws, session.user, session.session_id)
+  sendWs(ws, { t: 'auth.session', reply_to: msg.id, ok: true, body: { session_token: result.sessionToken, user: result.user } })
+  sendDigest(ws, session.user.user_id, null)
+}
+
+export async function handleSignIn(ws, msg, ctx) {
+  const { auth, sendWs, sendDigest, attachUser } = ctx
+  const { handle, password } = msg.body || {}
+  const result = await auth.signInWithPassword({ handle, password })
+  const session = auth.validateSession(result.sessionToken)
+  attachUser(ws, session.user, session.session_id)
+  sendWs(ws, { t: 'auth.session', reply_to: msg.id, ok: true, body: { session_token: result.sessionToken, user: result.user } })
+  sendDigest(ws, session.user.user_id, session.last_seen_at)
+}
+
+export function handleSignOut(ws, msg, ctx) {
+  const { auth, sendWs } = ctx
+  if (ws.data.sessionId) auth.revokeSession(ws.data.sessionId)
+  ws.data.userId = null
+  ws.data.sessionId = null
+  sendWs(ws, { t: 'auth.signed_out', reply_to: msg.id, ok: true, body: {} })
+}
+
+// ── Admin — invites ────────────────────────────────────────────────────────────
+
+export function handleAdminInviteCreate(ws, msg, ctx) {
+  const { auth, sendWs } = ctx
+  const { ttl_ms, max_uses, note, roles } = msg.body || {}
+  const invite = auth.createInvite({ createdByUserId: ws.data.userId, ttlMs: ttl_ms, maxUses: max_uses, note, roles })
+  sendWs(ws, { t: 'admin.invite', reply_to: msg.id, ok: true, body: { invite_token: invite.inviteToken, expires_at: invite.expiresAt, max_uses: invite.maxUses, roles: invite.roles } })
+}
+
+export function handleAdminInviteList(ws, msg, ctx) {
+  const { auth, sendWs } = ctx
+  const invites = auth.listInvites({ requestingUserId: ws.data.userId })
+  sendWs(ws, { t: 'admin.invite_list_result', reply_to: msg.id, ok: true, body: { invites } })
+}
+
+export function handleAdminInviteRevoke(ws, msg, ctx) {
+  const { auth, sendWs } = ctx
+  const { invite_id } = msg.body || {}
+  auth.revokeInvite({ inviteId: invite_id, requestingUserId: ws.data.userId })
+  sendWs(ws, { t: 'admin.invite_revoked', reply_to: msg.id, ok: true, body: { invite_id } })
+}
+
+// ── Admin — users ──────────────────────────────────────────────────────────────
+
+export function handleAdminUserList(ws, msg, ctx) {
+  const { auth, sendWs } = ctx
+  const users = auth.listUsers({ requestingUserId: ws.data.userId })
+  sendWs(ws, { t: 'admin.user_list_result', reply_to: msg.id, ok: true, body: { users } })
+}
+
+export function handleAdminUserSetRoles(ws, msg, ctx) {
+  const { auth, sendWs } = ctx
+  const { user_id, roles } = msg.body || {}
+  auth.setUserRoles({ targetUserId: user_id, roles, requestingUserId: ws.data.userId })
+  sendWs(ws, { t: 'admin.user_updated', reply_to: msg.id, ok: true, body: { user_id } })
+}
+
+export async function handleAdminUserSetPassword(ws, msg, ctx) {
+  const { auth, sendWs } = ctx
+  const { user_id, new_password } = msg.body || {}
+  await auth.adminSetPassword({ targetUserId: user_id, newPassword: new_password, requestingUserId: ws.data.userId })
+  sendWs(ws, { t: 'admin.user_updated', reply_to: msg.id, ok: true, body: { user_id } })
+}
+
+export function handleAdminUserSetDisplayName(ws, msg, ctx) {
+  const { auth, sendWs } = ctx
+  const { user_id, display_name } = msg.body || {}
+  auth.adminUpdateDisplayName({ targetUserId: user_id, displayName: display_name, requestingUserId: ws.data.userId })
+  sendWs(ws, { t: 'admin.user_updated', reply_to: msg.id, ok: true, body: { user_id } })
+}
+
+// ── Admin — bots ───────────────────────────────────────────────────────────────
+
+export function handleAdminBotCreate(ws, msg, ctx) {
+  const { botService, sendWs } = ctx
+  const { handle, display_name, token_label } = msg.body || {}
+  const result = botService.createBot({ handle, displayName: display_name, tokenLabel: token_label, requestingUserId: ws.data.userId })
+  sendWs(ws, { t: 'admin.bot_created', reply_to: msg.id, ok: true, body: result })
+}
+
+export function handleAdminBotList(ws, msg, ctx) {
+  const { botService, sendWs } = ctx
+  const bots = botService.listBots({ requestingUserId: ws.data.userId })
+  sendWs(ws, { t: 'admin.bot_list_result', reply_to: msg.id, ok: true, body: { bots } })
+}
+
+export function handleAdminBotTokenCreate(ws, msg, ctx) {
+  const { botService, sendWs } = ctx
+  const { user_id, label } = msg.body || {}
+  const result = botService.createToken({ userId: user_id, label, requestingUserId: ws.data.userId })
+  sendWs(ws, { t: 'admin.bot_token_created', reply_to: msg.id, ok: true, body: result })
+}
+
+export function handleAdminBotTokenRevoke(ws, msg, ctx) {
+  const { botService, sendWs } = ctx
+  const { token_id } = msg.body || {}
+  botService.revokeToken({ tokenId: token_id, requestingUserId: ws.data.userId })
+  sendWs(ws, { t: 'admin.bot_token_revoked', reply_to: msg.id, ok: true, body: { token_id } })
+}
+
+export function handleAdminBotSetChannels(ws, msg, ctx) {
+  const { botService, sendWs } = ctx
+  const { user_id, channel_ids } = msg.body || {}
+  botService.setBotChannels({ userId: user_id, channelIds: channel_ids, requestingUserId: ws.data.userId })
+  sendWs(ws, { t: 'admin.bot_updated', reply_to: msg.id, ok: true, body: { user_id } })
+}

package/src/ws/handlers/channelHandlers.js

@@ -0,0 +1,166 @@
+/**
+ * Channel, user, and DM WS handlers.
+ */
+
+export function handleChannelList(ws, msg, ctx) {
+  const { auth, channelService, sendWs } = ctx
+  const user = auth.getUser(ws.data.userId)
+  const channels = channelService.listChannels(ws.data.userId, user?.roles || [], msg.body?.hub_id)
+  sendWs(ws, { t: 'channel.list_result', reply_to: msg.id, ok: true, body: { channels, hub_id: msg.body?.hub_id } })
+}
+
+export function handleChannelCreate(ws, msg, ctx) {
+  const { auth, hubService, channelService, sendWs, broadcastToChannelAudience } = ctx
+  const user = auth.getUser(ws.data.userId)
+  let { hub_id, kind, name, topic, visibility } = msg.body || {}
+  if (!hub_id || hub_id === 'default') {
+    hub_id = hubService.ensureDefaultHub(ws.data.userId).hub_id
+  }
+  const channel = channelService.createChannel({ hubId: hub_id, kind, name, topic, visibility, createdByUserId: ws.data.userId, userRoles: user?.roles || [] })
+  sendWs(ws, { t: 'channel.created', reply_to: msg.id, ok: true, body: { channel } })
+  broadcastToChannelAudience(channel.channel_id, { t: 'channel.created', ok: true, body: { channel } }, ws)
+}
+
+export function handleChannelUpdate(ws, msg, ctx) {
+  const { auth, channelService, sendWs, publishChannel } = ctx
+  const user = auth.getUser(ws.data.userId)
+  const { channel_id, name, topic, visibility } = msg.body || {}
+  const channel = channelService.updateChannel({ channelId: channel_id, userId: ws.data.userId, roles: user?.roles || [], name, topic, visibility })
+  sendWs(ws, { t: 'channel.updated', reply_to: msg.id, ok: true, body: { channel } })
+  publishChannel(channel_id, { t: 'channel.updated', ok: true, body: { channel } })
+}
+
+export function handleChannelDelete(ws, msg, ctx) {
+  const { auth, channelService, sendWs, collectChannelAudience } = ctx
+  const user = auth.getUser(ws.data.userId)
+  const { channel_id } = msg.body || {}
+  // Collect audience before deletion — access checks fail once deleted_at is set,
+  // and publishChannel only reaches pub/sub subscribers (not sidebar connections)
+  const audience = collectChannelAudience(channel_id, ws)
+  const result = channelService.deleteChannel({ channelId: channel_id, userId: ws.data.userId, roles: user?.roles || [] })
+  sendWs(ws, { t: 'channel.deleted', reply_to: msg.id, ok: true, body: result })
+  audience.forEach(conn => sendWs(conn, { t: 'channel.deleted', ok: true, body: result }))
+}
+
+export function handleChannelJoin(ws, msg, ctx) {
+  const { auth, channelService, deliveryService, presenceService, signalingService, sendWs } = ctx
+  const user = auth.getUser(ws.data.userId)
+  const { channel_id } = msg.body || {}
+  const result = channelService.joinChannel({ channelId: channel_id, userId: ws.data.userId, userRoles: user?.roles || [] })
+  ws.subscribe(`channel:${channel_id}`)
+  presenceService.joinChannel(ws.data.connectionId, channel_id)
+  deliveryService.getOrCreate({ channelId: channel_id, userId: ws.data.userId })
+  sendWs(ws, { t: 'channel.joined', reply_to: msg.id, ok: true, body: result })
+
+  // Push current call state so the joining client immediately sees "N in call" or nothing
+  const activeCall = signalingService.getActiveCallForChannel(channel_id)
+  const peers = activeCall ? Array.from(activeCall.peers.values()) : []
+  sendWs(ws, {
+    t: 'rtc.call_state', ok: true,
+    body: { channel_id, call_id: activeCall?.call_id ?? null, count: peers.length, users: peers.map(p => ({ user_id: p.user_id })) }
+  })
+}
+
+export function handleChannelLeave(ws, msg, ctx) {
+  const { channelService, presenceService, sendWs } = ctx
+  const { channel_id } = msg.body || {}
+  channelService.leaveChannel({ channelId: channel_id, userId: ws.data.userId })
+  ws.unsubscribe(`channel:${channel_id}`)
+  presenceService.leaveChannel(ws.data.connectionId, channel_id)
+  sendWs(ws, { t: 'channel.left', reply_to: msg.id, ok: true, body: { channel_id } })
+}
+
+export function handleChannelReorder(ws, msg, ctx) {
+  const { auth, channelService, broadcastToHubAudience } = ctx
+  const user = auth.getUser(ws.data.userId)
+  const { hub_id, channel_ids } = msg.body || {}
+  const channels = channelService.reorderChannels({ hubId: hub_id, channelIds: channel_ids, userId: ws.data.userId, userRoles: user?.roles || [] })
+  broadcastToHubAudience(hub_id, { t: 'channel.reordered', ok: true, body: { hub_id, channels } }, null)
+}
+
+export function handleChannelAddMember(ws, msg, ctx) {
+  const { channelService, sendWs } = ctx
+  const { channel_id, user_id } = msg.body || {}
+  const result = channelService.addMember({ channelId: channel_id, createdByUserId: ws.data.userId, targetUserId: user_id })
+  sendWs(ws, { t: 'channel.member_added', reply_to: msg.id, ok: true, body: result })
+}
+
+export function handleChannelRemoveMember(ws, msg, ctx) {
+  const { channelService, sendWs, publishChannel } = ctx
+  const { channel_id, user_id } = msg.body || {}
+  const result = channelService.removeMember({ channelId: channel_id, removedByUserId: ws.data.userId, targetUserId: user_id })
+  sendWs(ws, { t: 'channel.member_removed', reply_to: msg.id, ok: true, body: result })
+  publishChannel(channel_id, { t: 'channel.member_removed', ok: true, body: result })
+}
+
+export function handleChannelListMembers(ws, msg, ctx) {
+  const { auth, channelService, sendWs } = ctx
+  const { channel_id } = msg.body || {}
+  const user = auth.getUser(ws.data.userId)
+  const roles = user?.roles || []
+  if (!channelService.canAccessChannel(channel_id, ws.data.userId, roles)) {
+    return sendWs(ws, { t: 'error', reply_to: msg.id, ok: false, body: { code: 'FORBIDDEN', message: 'Access denied' } })
+  }
+  const members = channelService.listChannelMembers(channel_id)
+  const enriched = members.map(m => {
+    const u = auth.getUser(m.user_id)
+    return { user_id: m.user_id, handle: u?.handle ?? null, display_name: u?.display_name ?? null, role: m.role }
+  })
+  sendWs(ws, { t: 'channel.list_members_result', reply_to: msg.id, ok: true, body: { channel_id, members: enriched } })
+}
+
+// ── Users ──────────────────────────────────────────────────────────────────────
+
+export function handleUserList(ws, msg, ctx) {
+  const { auth, sendWs } = ctx
+  const users = auth.listUsersBasic().filter(u => !u.roles.includes('bot'))
+  sendWs(ws, { t: 'user.list_result', reply_to: msg.id, ok: true, body: { users } })
+}
+
+export function handleBotList(ws, msg, ctx) {
+  const { auth, sendWs } = ctx
+  const bots = auth.listUsersBasic().filter(u => u.roles.includes('bot'))
+  sendWs(ws, { t: 'bot.list_result', reply_to: msg.id, ok: true, body: { bots } })
+}
+
+// ── Direct messages ────────────────────────────────────────────────────────────
+
+export function handleDmOpen(ws, msg, ctx) {
+  const { auth, channelService, sendWs, subscribeUserToChannel } = ctx
+  const { target_user_id } = msg.body || {}
+  const result = channelService.findOrCreateDm({ userId: ws.data.userId, targetUserId: target_user_id })
+  const targetUser = auth.getUser(target_user_id)
+
+  // Subscribe all active connections for both users to the DM channel topic.
+  subscribeUserToChannel(ws.data.userId, result.channel_id)
+  subscribeUserToChannel(target_user_id, result.channel_id)
+
+  // Tell the initiating connection to navigate (no notify_only)
+  sendWs(ws, {
+    t: 'dm.opened', reply_to: msg.id, ok: true,
+    body: { channel_id: result.channel_id, is_new: result.is_new, with_user: { user_id: target_user_id, display_name: targetUser?.display_name ?? null } }
+  })
+
+  // Notify the initiating user's OTHER connections (sidebar) so the DM appears in the list
+  ctx.server?.publish(`user:${ws.data.userId}`, JSON.stringify({
+    v: 1, server_ts: Date.now(), t: 'dm.opened', ok: true,
+    body: { channel_id: result.channel_id, is_new: result.is_new, notify_only: true, with_user: { user_id: target_user_id, display_name: targetUser?.display_name ?? null } }
+  }))
+
+  // Notify the target user's connections — add to DM list, show unread dot, don't navigate
+  ctx.server?.publish(`user:${target_user_id}`, JSON.stringify({
+    v: 1, server_ts: Date.now(), t: 'dm.opened', ok: true,
+    body: { channel_id: result.channel_id, is_new: result.is_new, notify_only: true, with_user: { user_id: ws.data.userId, display_name: ws.data.displayName } }
+  }))
+}
+
+export function handleDmList(ws, msg, ctx) {
+  const { auth, channelService, sendWs } = ctx
+  const dms = channelService.listDms({ userId: ws.data.userId })
+  for (const dm of dms) ws.subscribe(`channel:${dm.channel_id}`)
+  const enriched = dms.map(dm => {
+    const other = auth.getUser(dm.other_user_id)
+    return { channel_id: dm.channel_id, with_user: { user_id: dm.other_user_id, display_name: other?.display_name ?? dm.other_user_id } }
+  })
+  sendWs(ws, { t: 'dm.list_result', reply_to: msg.id, ok: true, body: { dms: enriched } })
+}

package/src/ws/handlers/hubHandlers.js

@@ -0,0 +1,82 @@
+/**
+ * Hub WS handlers.
+ */
+
+export function handleHubList(ws, msg, ctx) {
+  const { auth, hubService, sendWs } = ctx
+  const user = auth.getUser(ws.data.userId)
+  const hubs = hubService.listHubs(ws.data.userId, user?.roles || [])
+  sendWs(ws, { t: 'hub.list_result', reply_to: msg.id, ok: true, body: { hubs } })
+}
+
+export function handleHubCreate(ws, msg, ctx) {
+  const { hubService, sendWs, broadcastToHubAudience } = ctx
+  const { name, description, visibility } = msg.body || {}
+  const hub = hubService.createHub({ name, description, visibility, createdByUserId: ws.data.userId })
+  sendWs(ws, { t: 'hub.created', reply_to: msg.id, ok: true, body: { hub } })
+  broadcastToHubAudience(hub.hub_id, { t: 'hub.created', ok: true, body: { hub } }, ws)
+}
+
+export function handleHubUpdate(ws, msg, ctx) {
+  const { auth, hubService, sendWs, broadcastToHubAudience } = ctx
+  const user = auth.getUser(ws.data.userId)
+  const { hub_id, name, description, visibility } = msg.body || {}
+  const hub = hubService.updateHub({ hubId: hub_id, userId: ws.data.userId, roles: user?.roles || [], name, description, visibility })
+  sendWs(ws, { t: 'hub.updated', reply_to: msg.id, ok: true, body: { hub } })
+  broadcastToHubAudience(hub.hub_id, { t: 'hub.updated', ok: true, body: { hub } }, ws)
+}
+
+export function handleHubDelete(ws, msg, ctx) {
+  const { auth, hubService, sendWs, collectHubAudience } = ctx
+  const user = auth.getUser(ws.data.userId)
+  const { hub_id } = msg.body || {}
+  // Collect audience before deletion — access checks fail once deleted_at is set
+  const audience = collectHubAudience(hub_id, ws)
+  const result = hubService.deleteHub({ hubId: hub_id, userId: ws.data.userId, roles: user?.roles || [] })
+  sendWs(ws, { t: 'hub.deleted', reply_to: msg.id, ok: true, body: result })
+  audience.forEach(conn => sendWs(conn, { t: 'hub.deleted', ok: true, body: result }))
+}
+
+export function handleHubAddMember(ws, msg, ctx) {
+  const { auth, hubService, sendWs, broadcastToHubAudience } = ctx
+  const user = auth.getUser(ws.data.userId)
+  const { hub_id, user_id } = msg.body || {}
+  const result = hubService.addHubMember({ hubId: hub_id, targetUserId: user_id, requestingUserId: ws.data.userId, requestingRoles: user?.roles || [] })
+  sendWs(ws, { t: 'hub.member_added', reply_to: msg.id, ok: true, body: result })
+  ctx.server?.publish(`user:${user_id}`, JSON.stringify({ v: 1, server_ts: Date.now(), t: 'hub.member_added', ok: true, body: result }))
+  broadcastToHubAudience(hub_id, { t: 'hub.member_added', ok: true, body: result }, ws)
+}
+
+export function handleHubRemoveMember(ws, msg, ctx) {
+  const { auth, hubService, sendWs, broadcastToHubAudience } = ctx
+  const user = auth.getUser(ws.data.userId)
+  const { hub_id, user_id } = msg.body || {}
+  const result = hubService.removeHubMember({ hubId: hub_id, targetUserId: user_id, requestingUserId: ws.data.userId, requestingRoles: user?.roles || [] })
+  sendWs(ws, { t: 'hub.member_removed', reply_to: msg.id, ok: true, body: result })
+  ctx.server?.publish(`user:${user_id}`, JSON.stringify({ v: 1, server_ts: Date.now(), t: 'hub.member_removed', ok: true, body: result }))
+  broadcastToHubAudience(hub_id, { t: 'hub.member_removed', ok: true, body: result }, ws)
+}
+
+export function handleHubReorder(ws, msg, ctx) {
+  const { auth, hubService, sendWs, connections } = ctx
+  const user = auth.getUser(ws.data.userId)
+  const { hub_ids } = msg.body || {}
+  const hubs = hubService.reorderHubs({ hubIds: hub_ids, userId: ws.data.userId, userRoles: user?.roles || [] })
+  // Broadcast to all authenticated connections — every sidebar needs to update
+  for (const [, conn] of connections) {
+    if (conn.data.userId) sendWs(conn, { t: 'hub.reordered', ok: true, body: { hubs } })
+  }
+}
+
+export function handleHubListMembers(ws, msg, ctx) {
+  const { auth, hubService, sendWs } = ctx
+  const user = auth.getUser(ws.data.userId)
+  const { hub_id } = msg.body || {}
+  const members = hubService.listHubMembers({ hubId: hub_id, requestingUserId: ws.data.userId, requestingRoles: user?.roles || [] })
+  const enriched = members.map(m => {
+    if (m.handle) return m  // SqliteHubRepository joins users — already enriched
+    const u = auth.getUser(m.user_id)
+    return { user_id: m.user_id, handle: u?.handle ?? null, display_name: u?.display_name ?? null, joined_at: m.joined_at }
+  })
+  sendWs(ws, { t: 'hub.list_members_result', reply_to: msg.id, ok: true, body: { hub_id, members: enriched } })
+}

package/src/ws/handlers/messageHandlers.js

@@ -0,0 +1,88 @@
+/**
+ * Message, search, and presence WS handlers.
+ */
+import { renderMarkdown } from '@devchitchat/index97/markdown'
+
+export function handleMsgSend(ws, msg, ctx) {
+  const { messageService, deliveryService, sendWs, publishChannel, dispatchMentions } = ctx
+  const { channel_id, text, client_msg_id, priority, attachments } = msg.body || {}
+  const result = messageService.sendMessage({
+    channelId: channel_id, userId: ws.data.userId, text, clientMsgId: client_msg_id, priority,
+    attachments: Array.isArray(attachments) ? attachments : []
+  })
+
+  sendWs(ws, { t: 'msg.ack', reply_to: msg.id, ok: true, body: { msg_id: result.msg_id, seq: result.seq, client_msg_id, priority: result.priority } })
+
+  publishChannel(channel_id, {
+    t: 'msg.event', ok: true,
+    body: {
+      msg_id: result.msg_id, channel_id, seq: result.seq,
+      user_id: ws.data.userId, user_display_name: ws.data.displayName,
+      ts: result.ts, text, rendered_text: renderMarkdown(text).html,
+      priority: result.priority, attachments: result.attachments ?? []
+    }
+  })
+
+  deliveryService.advance({ channelId: channel_id, userId: ws.data.userId, afterSeq: result.seq })
+  dispatchMentions({ channelId: channel_id, senderId: ws.data.userId, text, seq: result.seq, priority: result.priority })
+}
+
+export function handleMsgEdit(ws, msg, ctx) {
+  const { messageService, publishChannel } = ctx
+  const { msg_id, channel_id, text } = msg.body ?? {}
+  const result = messageService.editMessage({ msgId: msg_id, channelId: channel_id, userId: ws.data.userId, newText: text })
+  const renderedText = renderMarkdown(result.text).html
+  publishChannel(channel_id, {
+    t: 'msg.edited', ok: true,
+    body: { msg_id: result.msgId, channel_id: result.channelId, text: result.text, edited_at: result.editedAt, rendered_text: renderedText },
+  })
+}
+
+export function handleMsgList(ws, msg, ctx) {
+  const { messageService, sendWs } = ctx
+  const { channel_id, after_seq, before_seq, limit } = msg.body || {}
+
+  if (before_seq != null) {
+    const result = messageService.listMessagesBefore({
+      channelId: channel_id,
+      userId: ws.data.userId,
+      beforeSeq: before_seq,
+      limit: limit ?? 50,
+    })
+    sendWs(ws, { t: 'msg.list_result', reply_to: msg.id, ok: true, body: { ...result, channel_id, direction: 'before' } })
+    return
+  }
+
+  const result = messageService.listMessages({ channelId: channel_id, userId: ws.data.userId, afterSeq: after_seq ?? 0, limit: limit ?? 50 })
+  sendWs(ws, { t: 'msg.list_result', reply_to: msg.id, ok: true, body: { ...result, channel_id, direction: 'after' } })
+}
+
+export function handleMsgDelete(ws, msg, ctx) {
+  const { messageService, publishChannel } = ctx
+  const { msg_id, channel_id } = msg.body ?? {}
+  const result = messageService.deleteMessage({ msgId: msg_id, channelId: channel_id, userId: ws.data.userId })
+  publishChannel(channel_id, {
+    t: 'msg.deleted', ok: true,
+    body: { msg_id: result.msgId, channel_id: result.channelId, seq: result.seq },
+  })
+}
+
+export function handleSearchQuery(ws, msg, ctx) {
+  const { auth, channelService, searchService, sendWs } = ctx
+  const { channel_id, q, limit } = msg.body || {}
+  const roles = auth.getUser(ws.data.userId)?.roles || []
+  if (!channelService.canAccessChannel(channel_id, ws.data.userId, roles)) {
+    return sendWs(ws, { t: 'error', reply_to: msg.id, ok: false, body: { code: 'FORBIDDEN', message: 'Access denied' } })
+  }
+  const hits = searchService.searchMessages({ channelId: channel_id, query: q, limit })
+  sendWs(ws, { t: 'search.result', reply_to: msg.id, ok: true, body: { hits } })
+}
+
+export function handlePresenceSubscribe(ws, msg, ctx) {
+  const { auth, channelService, presenceService, sendWs } = ctx
+  const roles = auth.getUser(ws.data.userId)?.roles || []
+  const accessibleChannels = channelService.listChannels(ws.data.userId, roles)
+  const channelIds = accessibleChannels.map(c => c.channel_id)
+  const users = presenceService.listOnlineUsersInChannels(channelIds)
+  sendWs(ws, { t: 'presence.snapshot', reply_to: msg.id, ok: true, body: { users } })
+}

package/src/ws/handlers/pushHandlers.js

@@ -0,0 +1,25 @@
+/**
+ * Web Push subscription WS handlers.
+ */
+
+export function handlePushSubscribe(ws, msg, ctx) {
+  const { pushRepo, sendWs } = ctx
+  const { subscription } = msg.body ?? {}
+  const endpoint = subscription?.endpoint
+  const p256dh   = subscription?.keys?.p256dh
+  const auth     = subscription?.keys?.auth
+
+  if (!endpoint || !p256dh || !auth) {
+    return sendWs(ws, { t: 'error', reply_to: msg.id, ok: false, body: { code: 'BAD_REQUEST', message: 'Invalid push subscription' } })
+  }
+
+  pushRepo.upsertSubscription({ userId: ws.data.userId, endpoint, p256dh, auth })
+  sendWs(ws, { t: 'push.subscribed', reply_to: msg.id, ok: true, body: {} })
+}
+
+export function handlePushUnsubscribe(ws, msg, ctx) {
+  const { pushRepo, sendWs } = ctx
+  const { endpoint } = msg.body ?? {}
+  if (endpoint) pushRepo.removeSubscription(endpoint)
+  sendWs(ws, { t: 'push.unsubscribed', reply_to: msg.id, ok: true, body: {} })
+}

package/src/ws/handlers/reactionHandlers.js

@@ -0,0 +1,27 @@
+/**
+ * Reaction WS handlers.
+ */
+
+export function handleReactionAdd(ws, msg, ctx) {
+  const { reactionService, publishChannel } = ctx
+  const { msg_id, channel_id, emoji } = msg.body ?? {}
+  const reactions = reactionService.addReaction({
+    msgId: msg_id, channelId: channel_id, userId: ws.data.userId, emoji,
+  })
+  publishChannel(channel_id, {
+    t: 'reaction.event', ok: true,
+    body: { msg_id, channel_id, emoji, user_id: ws.data.userId, action: 'add', reactions },
+  })
+}
+
+export function handleReactionRemove(ws, msg, ctx) {
+  const { reactionService, publishChannel } = ctx
+  const { msg_id, channel_id, emoji } = msg.body ?? {}
+  const reactions = reactionService.removeReaction({
+    msgId: msg_id, channelId: channel_id, userId: ws.data.userId, emoji,
+  })
+  publishChannel(channel_id, {
+    t: 'reaction.event', ok: true,
+    body: { msg_id, channel_id, emoji, user_id: ws.data.userId, action: 'remove', reactions },
+  })
+}

package/src/ws/handlers/rtcHandlers.js

@@ -0,0 +1,126 @@
+/**
+ * WebRTC signaling WS handlers.
+ */
+
+export function handleRtcCallCreate(ws, msg, ctx) {
+  const { auth, channelService, signalingService, sendWs, getIceServers } = ctx
+  const { channel_id, kind = 'mesh' } = msg.body || {}
+  const roles = auth.getUser(ws.data.userId)?.roles || []
+  if (!channelService.canAccessChannel(channel_id, ws.data.userId, roles)) {
+    return sendWs(ws, { t: 'error', reply_to: msg.id, ok: false, body: { code: 'FORBIDDEN', message: 'Access denied' } })
+  }
+  const result = signalingService.createCall({ roomId: channel_id, createdByUserId: ws.data.userId, topology: kind })
+  sendWs(ws, { t: 'rtc.call', reply_to: msg.id, ok: true, body: { ...result, channel_id, ice_servers: getIceServers() } })
+}
+
+export function handleRtcJoin(ws, msg, ctx) {
+  const { auth, channelService, signalingService, sendWs, publishCall, publishChannel, publishCallState, getIceServers, peerConnections } = ctx
+  const { call_id } = msg.body || {}
+
+  // Guard: verify user can access the channel this call belongs to
+  const call = signalingService.getCall(call_id)
+  if (call) {
+    const roles = auth.getUser(ws.data.userId)?.roles || []
+    if (!channelService.canAccessChannel(call.room_id, ws.data.userId, roles)) {
+      return sendWs(ws, { t: 'error', reply_to: msg.id, ok: false, body: { code: 'FORBIDDEN', message: 'Access denied' } })
+    }
+  }
+
+  const result = signalingService.joinOrSwitch({
+    callId: call_id,
+    userId: ws.data.userId,
+    displayName: ws.data.displayName,
+    currentPeerId: ws.data.peerId,
+    currentCallId: ws.data.callId,
+  })
+
+  if (result.status === 'already_in_call') {
+    sendWs(ws, { t: 'rtc.joined', reply_to: msg.id, ok: true, body: { call_id, peer_id: result.peerId, peers: result.peers, ice_servers: getIceServers() } })
+    return
+  }
+
+  // Publish transport side effects for previous call departure (status === 'switched')
+  if (result.previousLeft) {
+    const { call_id: prevCallId, room_id, peerId: prevPeerId, removed, ended } = result.previousLeft
+    peerConnections.delete(prevPeerId)
+    ws.unsubscribe(`call:${prevCallId}`)
+    if (removed) {
+      publishCall(prevCallId, { t: 'rtc.peer_event', ok: true, body: { call_id: prevCallId, kind: 'leave', peer: { peer_id: prevPeerId, user_id: ws.data.userId } } })
+    }
+    if (ended) {
+      publishChannel(room_id, { t: 'rtc.call_end', ok: true, body: { call_id: prevCallId, channel_id: room_id } })
+      publishCallState(room_id, null, [])
+    }
+  }
+
+  ws.data.peerId = result.peerId
+  ws.data.callId = call_id
+  peerConnections.set(result.peerId, ws.data.connectionId)
+  ws.subscribe(`call:${call_id}`)
+  sendWs(ws, { t: 'rtc.joined', reply_to: msg.id, ok: true, body: { call_id, peer_id: result.peerId, peers: result.peers, ice_servers: getIceServers() } })
+  publishCall(call_id, { t: 'rtc.peer_event', ok: true, body: { call_id, kind: 'join', peer: { peer_id: result.peerId, user_id: ws.data.userId, display_name: ws.data.displayName } } })
+
+  const updatedCall = signalingService.getCall(call_id)
+  if (updatedCall) publishCallState(updatedCall.room_id, call_id, Array.from(updatedCall.peers.values()))
+}
+
+export function handleRtcOffer(ws, msg, ctx) {
+  const { signalingService } = ctx
+  const { call_id, to_peer_id, sdp } = msg.body || {}
+  if (!ws.data.peerId || ws.data.callId !== call_id) return
+  signalingService.routeOffer({ callId: call_id, fromPeerId: ws.data.peerId, toPeerId: to_peer_id, sdp })
+}
+
+export function handleRtcAnswer(ws, msg, ctx) {
+  const { signalingService } = ctx
+  const { call_id, to_peer_id, sdp } = msg.body || {}
+  if (!ws.data.peerId || ws.data.callId !== call_id) return
+  signalingService.routeAnswer({ callId: call_id, fromPeerId: ws.data.peerId, toPeerId: to_peer_id, sdp })
+}
+
+export function handleRtcIce(ws, msg, ctx) {
+  const { signalingService } = ctx
+  const { call_id, to_peer_id, candidate } = msg.body || {}
+  if (!ws.data.peerId || ws.data.callId !== call_id) return
+  signalingService.routeIce({ callId: call_id, fromPeerId: ws.data.peerId, toPeerId: to_peer_id, candidate })
+}
+
+export function handleRtcStreamPublish(ws, msg, ctx) {
+  const { publishCall } = ctx
+  const { call_id, stream } = msg.body || {}
+  publishCall(call_id, { t: 'rtc.stream_event', ok: true, body: { call_id, peer_id: ws.data.peerId, stream } })
+}
+
+export function handleRtcLeave(ws, msg, ctx) {
+  const { signalingService, sendWs, publishCall, publishChannel, publishCallState, peerConnections } = ctx
+  const { call_id } = msg.body || {}
+  if (!ws.data.peerId) return
+  const leavingPeerId = ws.data.peerId
+  const result = signalingService.leaveCall({ callId: call_id, peerId: leavingPeerId })
+  ws.unsubscribe(`call:${call_id}`)
+  peerConnections.delete(leavingPeerId)
+  ws.data.peerId = null
+  ws.data.callId = null
+  sendWs(ws, { t: 'rtc.left', reply_to: msg.id, ok: true, body: { call_id } })
+  if (result.removed) {
+    publishCall(call_id, { t: 'rtc.peer_event', ok: true, body: { call_id, kind: 'leave', peer: { peer_id: leavingPeerId, user_id: ws.data.userId } } })
+  }
+  if (result.ended && result.room_id) {
+    publishChannel(result.room_id, { t: 'rtc.call_end', ok: true, body: { call_id, channel_id: result.room_id } })
+    publishCallState(result.room_id, null, [])
+  } else if (result.removed && result.room_id) {
+    const call = signalingService.getCall(call_id)
+    publishCallState(result.room_id, call_id, call ? Array.from(call.peers.values()) : [])
+  }
+}
+
+export function handleRtcEndCall(ws, msg, ctx) {
+  const { signalingService, sendWs, publishCall, publishChannel, publishCallState } = ctx
+  const { call_id } = msg.body || {}
+  const result = signalingService.endCall({ callId: call_id })
+  if (!result) return
+  publishCall(call_id, { t: 'rtc.call_end', ok: true, body: { call_id, channel_id: result.room_id } })
+  publishChannel(result.room_id, { t: 'rtc.call_end', ok: true, body: { call_id, channel_id: result.room_id } })
+  publishCallState(result.room_id, null, [])
+  sendWs(ws, { t: 'rtc.call_ended', reply_to: msg.id, ok: true, body: { call_id } })
+}