@openora/core 0.4.1-canary.15 → 0.4.1-canary.151

package/dist/engagement/chat/service/chat.service.js

@@ -1,16 +1,83 @@
-import { createDomainError, assertOwnership, findOneOrThrow, serializeRow, } from '@openora/core/server';
-import { eq, and, isNull, lt, desc, asc, notInArray } from 'drizzle-orm';
+import { randomInt, randomUUID } from 'node:crypto';
+import { createLogger, makeOwnershipError, makeConflictError, createDomainError, assertOwnership, findOneOrThrow, serializeRow, mapConcurrent, pageToOffset, withAdvisoryXactLock, } from '@openora/core/server';
+import { CommandMetadataSchema, chatBlockLockKey, chatChannel, GLOBAL_CHAT_ROOM_ID, MONEY_SCALE, } from '@openora/core/contracts';
+import { eq, and, isNull, or, gt, lt, desc, asc, notInArray, inArray, count, ne, ilike, } from 'drizzle-orm';
 import { user } from '@openora/core/pam/schema/identity';
-import { chatRoom, chatMessage, chatUserBlock } from '../schema/index.js';
-import { moderateContent } from '../moderation/index.js';
-export function chatChannel(roomId) {
-    return roomId ? `chat:room:${roomId}` : 'chat:global';
-}
-export const ChatRoomNotFoundError = createDomainError('ChatRoomNotFoundError', (id) => `Chat room not found: ${id}`);
-export const ChatMessageNotFoundError = createDomainError('ChatMessageNotFoundError', (id) => `Chat message not found: ${id}`);
-export const ChatMessageOwnershipError = createDomainError('ChatMessageOwnershipError', (id) => `Not authorized to delete message: ${id}`);
+import { player } from '@openora/core/pam/schema/profile';
+import { chatRoom, chatMessage, chatUserBlock, chatUserIgnore, chatRoomMember, chatRoomBan, chatRoomRule, chatRoomConfiguration, chatPlatformBan, } from '../schema/index.js';
+import { ChatMessageNotFoundError, ChatRoomNotFoundError } from './chat-moderation.service.js';
+export { ChatRoomNotMemberError, ChatRoomNotModeratorError, ChatRoomSelfModerationError, ChatRoomLastModeratorError, ChatRoomOwnerCannotLeaveError, ChatRoomJoinCodeNotFoundError, ChatRoomBannedError, ChatPlayerBannedError, } from './errors/chat-moderation.errors.js';
+import { ChatRoomNotMemberError, ChatRoomNotModeratorError, ChatPlayerBannedError, } from './errors/chat-moderation.errors.js';
+import { DEFAULT_MESSAGE_LIMIT, JOIN_CODE_ALPHABET, JOIN_CODE_LENGTH, MAX_PRIVATE_ROOMS_PER_PLAYER, PRIVATE_ROOM_SLUG_PREFIX, } from '../contract/constants.js';
+import { moderateContent, validateAttachment } from '../moderation/index.js';
+const logger = createLogger('chat');
+const MENTION_USERNAME_PATTERN = /(?<![\w.])@([a-zA-Z0-9_]{2,32})/g;
+const MAX_MENTIONS_PER_MESSAGE = 20;
+const MENTION_RESOLVE_CONCURRENCY = 5;
+const ROOM_REVOKE_CONCURRENCY = 10;
+function parseMentionedUsernames(content) {
+    const usernames = new Set();
+    for (const match of content.matchAll(MENTION_USERNAME_PATTERN)) {
+        const username = match[1];
+        if (username) {
+            usernames.add(username.toLowerCase());
+        }
+        if (usernames.size >= MAX_MENTIONS_PER_MESSAGE) {
+            break;
+        }
+    }
+    return [...usernames];
+}
+function hideStaffExceptOwner(canSeeAdminUsers, creatorId) {
+    if (canSeeAdminUsers) {
+        return undefined;
+    }
+    return or(isNull(user.id), notInArray(user.role, ['admin', 'super-admin']), eq(chatRoomMember.role, 'owner'), creatorId ? eq(chatRoomMember.userId, creatorId) : undefined);
+}
+function emitMentions({ events, directory, isBlockedByMentioned, content, byUserId, roomId, messageId, }) {
+    const usernames = parseMentionedUsernames(content);
+    if (usernames.length === 0) {
+        return;
+    }
+    void mapConcurrent(usernames, MENTION_RESOLVE_CONCURRENCY, async (username) => {
+        const summary = await directory.getPlayerByUsername(username).catch((err) => {
+            logger.error({ err, username, messageId }, 'chat mention lookup failed');
+            return null;
+        });
+        if (!summary || summary.userId === byUserId) {
+            return;
+        }
+        const mentionedUserId = summary.userId;
+        const blocked = await isBlockedByMentioned(mentionedUserId).catch((err) => {
+            logger.error({ err, mentionedUserId, messageId }, 'chat mention block check failed');
+            return true;
+        });
+        if (blocked) {
+            return;
+        }
+        events.emit('chat.user.mentioned', { mentionedUserId, byUserId, roomId, messageId });
+    }).catch((err) => {
+        logger.error({ err, messageId }, 'chat mention resolution failed');
+    });
+}
+function publishChatEvent(transport, roomId, event) {
+    void Promise.resolve()
+        .then(() => transport.publish(chatChannel(roomId), event))
+        .catch((err) => {
+        logger.error({ err, roomId }, 'chat realtime publish failed');
+    });
+}
+export const ChatRoomOwnershipError = makeOwnershipError('ChatRoom');
 export const ChatMessageBlockedError = createDomainError('ChatMessageBlockedError', () => 'Message blocked: it contains prohibited language');
+export const ChatAttachmentRejectedError = createDomainError('ChatAttachmentRejectedError', (reason) => `Attachment rejected: ${reason}`);
 export const ChatSelfBlockError = createDomainError('ChatSelfBlockError', () => 'You cannot block yourself');
+export const ChatSelfIgnoreError = createDomainError('ChatSelfIgnoreError', () => 'You cannot ignore yourself');
+export const ChatRoomSlugConflictError = makeConflictError('ChatRoomSlugConflictError', 'A room with this slug already exists');
+export const ChatRoomLimitReachedError = makeConflictError('ChatRoomLimitReachedError', 'Private room limit reached');
+export const ChatRoomProtectedError = makeConflictError('ChatRoomProtectedError', 'The global chat room cannot be deleted');
+export const ChatRoomRuleNotFoundError = createDomainError('ChatRoomRuleNotFoundError', (id) => `Chat room rule not found: ${id}`);
+export const ChatRoomConfigurationNotFoundError = createDomainError('ChatRoomConfigurationNotFoundError', (id) => `Chat room configuration not found: ${id}`);
+const CHAT_MODERATOR_ROLES = ['moderator', 'owner'];
 function gateContent(content) {
     const result = moderateContent(content);
     if (!result.ok) {
@@ -18,22 +85,134 @@ function gateContent(content) {
     }
     return result.content;
 }
+function assertAttachmentAllowed(attachment, allowedHosts) {
+    if (!attachment) {
+        return;
+    }
+    const result = validateAttachment(attachment, allowedHosts);
+    if (!result.ok) {
+        throw new ChatAttachmentRejectedError(result.reason);
+    }
+}
 function toRoom(record) {
-    return serializeRow(record, { dateFields: ['createdAt'] });
+    const { deletedAt: _deletedAt, ...room } = record;
+    return serializeRow({ ...room, isBanned: false, bannedUntil: null }, { dateFields: ['createdAt', 'bannedUntil', 'scheduledDeletionAt'] });
 }
 function toMessage(record) {
     return serializeRow(record, { dateFields: ['createdAt'] });
 }
+function toRule(record) {
+    return serializeRow(record, { dateFields: ['createdAt', 'updatedAt'] });
+}
+function toConfiguration(record) {
+    return serializeRow(record, { dateFields: ['createdAt', 'updatedAt'] });
+}
+const COMMAND_METADATA_MONEY_KEYS = ['amount', 'perRecipient'];
+function canonicalizeMoneyString(value) {
+    if (!/^\d+\.\d+$/.test(value)) {
+        return value;
+    }
+    const [whole, fraction] = value.split('.');
+    if (fraction.length <= MONEY_SCALE) {
+        return value;
+    }
+    const trimmed = fraction.slice(0, MONEY_SCALE).replace(/0+$/, '');
+    return trimmed ? `${whole}.${trimmed}` : whole;
+}
+function sanitizeCommandMetadata(metadata) {
+    if (!metadata || typeof metadata !== 'object') {
+        return metadata;
+    }
+    const entries = Object.entries(metadata).map(([key, value]) => COMMAND_METADATA_MONEY_KEYS.includes(key) && typeof value === 'string'
+        ? [key, canonicalizeMoneyString(value)]
+        : [key, value]);
+    return Object.fromEntries(entries);
+}
+// A system message IS its command metadata, and the column is jsonb - a shape Postgres never
+// enforced, so a row can outlive the contract that wrote it. Sanitizing first keeps the
+// deliberate repair path (legacy money strings) working; what still fails to parse cannot be
+// rendered as any system message the contract describes.
+function toSystemMessage(record) {
+    const message = toMessage(record);
+    const metadata = CommandMetadataSchema.safeParse(sanitizeCommandMetadata(message.metadata));
+    if (!metadata.success) {
+        logger.warn({ messageId: record.id, issues: metadata.error.issues.slice(0, 3) }, 'system message metadata no longer matches its contract, omitted from listing');
+        return null;
+    }
+    return { ...message, metadata: metadata.data, actorId: message.userId };
+}
+function toPublicMessage(record) {
+    if (record.type === 'system') {
+        return toSystemMessage(record);
+    }
+    return toMessage(record);
+}
+// One unreadable system message drops out of the page; the rest of the history is still
+// served. Failing the whole listing would take a room's chat down over a single old row.
+function toPublicMessages(records) {
+    return records.map(toPublicMessage).filter((message) => message !== null);
+}
+// The message this service just inserted, which is always a `user` row.
+function toSentMessage(record) {
+    return toMessage(record);
+}
+// A system message this service just wrote: its metadata came in typed by the contract, so
+// it needs neither the legacy repair nor the re-parse a stored row does.
+function toWrittenSystemMessage(record, metadata) {
+    const message = toMessage(record);
+    return { ...message, metadata, actorId: message.userId };
+}
+const BLOCKED_USER_SORT_COLUMNS = { createdAt: chatUserBlock.createdAt };
+const IGNORED_USER_SORT_COLUMNS = {
+    createdAt: chatUserIgnore.createdAt,
+};
+function generateJoinCode() {
+    return Array.from({ length: JOIN_CODE_LENGTH }, () => {
+        const ch = JOIN_CODE_ALPHABET[randomInt(0, JOIN_CODE_ALPHABET.length)];
+        return ch ?? 'A';
+    }).join('');
+}
+function generatePrivateRoomSlug(joinCode) {
+    const normalizedJoinCode = joinCode.toLowerCase();
+    let slug = `${PRIVATE_ROOM_SLUG_PREFIX}${randomUUID()}`;
+    while (slug.includes(normalizedJoinCode)) {
+        slug = `${PRIVATE_ROOM_SLUG_PREFIX}${randomUUID()}`;
+    }
+    return slug;
+}
+function isUniqueConstraintViolation(e) {
+    if (typeof e !== 'object' || e === null || !('code' in e)) {
+        return false;
+    }
+    return e.code === '23505';
+}
 export class ChatService {
     drizzle;
     events;
     transport;
-    constructor(drizzle, events, transport) {
+    directory;
+    audit;
+    moderation;
+    identityReader;
+    allowedAttachmentHosts;
+    socialCommands;
+    constructor({ drizzle, events, transport, directory, audit, moderation, identityReader, allowedAttachmentHosts, socialCommands, }) {
         this.drizzle = drizzle;
         this.events = events;
         this.transport = transport;
+        this.directory = directory;
+        this.audit = audit;
+        this.moderation = moderation;
+        this.identityReader = identityReader;
+        this.allowedAttachmentHosts = allowedAttachmentHosts;
+        this.socialCommands = socialCommands;
     }
-    subscribeMessages(roomId, listener, viewerId) {
+    subscribeMessages(roomId, listener, viewerId, connectionId = randomUUID()) {
+        const channel = chatChannel(roomId);
+        const presenceMemberId = viewerId ?? `anonymous:${connectionId}`;
+        const presence = this.transport.presence;
+        presence?.join(channel, presenceMemberId, connectionId);
+        let active = true;
         let blocked = viewerId ? null : new Set();
         const pending = [];
         const deliver = (message) => {
@@ -42,9 +221,12 @@ export class ChatService {
             }
         };
         if (viewerId) {
-            this.blockedIdsFor(viewerId)
+            this.excludedSenderIdsFor(viewerId)
                 .catch(() => new Set())
                 .then((ids) => {
+                if (!active) {
+                    return;
+                }
                 blocked = ids;
                 for (const message of pending) {
                     deliver(message);
@@ -52,68 +234,533 @@ export class ChatService {
                 pending.length = 0;
             });
         }
-        return this.transport.subscribe(chatChannel(roomId), (message) => {
+        const unsubscribe = this.transport.subscribe(channel, (message) => {
+            if (!active) {
+                return;
+            }
             if (blocked === null) {
                 pending.push(message);
             }
             else {
                 deliver(message);
             }
-        });
+        }, viewerId);
+        return () => {
+            active = false;
+            unsubscribe();
+            presence?.leave(channel, presenceMemberId, connectionId);
+        };
+    }
+    subscribeSignals(roomId, listener, viewerId) {
+        return this.transport.subscribeSignal?.(chatChannel(roomId), listener, viewerId) ?? (() => { });
+    }
+    async getOnlineCount(roomId) {
+        const onlineUserIds = await this.transport.getOnlineUserIds(chatChannel(roomId));
+        const onlineUsers = await this.directory.lookupUsers(onlineUserIds);
+        const playerCount = onlineUsers.filter((onlineUser) => onlineUser.role !== 'admin' && onlineUser.role !== 'super-admin').length;
+        return { count: playerCount };
     }
     async blockedIdsFor(viewerId) {
         const rows = await this.drizzle.db
             .select({ blockedId: chatUserBlock.blockedId })
             .from(chatUserBlock)
-            .where(eq(chatUserBlock.blockerId, viewerId));
+            .where(and(eq(chatUserBlock.blockerId, viewerId), isNull(chatUserBlock.removedAt)));
         return new Set(rows.map((r) => r.blockedId));
     }
-    async resolveDisplayName(userId, fallback) {
+    async ignoredIdsFor(viewerId) {
+        const rows = await this.drizzle.db
+            .select({ ignoredId: chatUserIgnore.ignoredId })
+            .from(chatUserIgnore)
+            .where(and(eq(chatUserIgnore.ignorerId, viewerId), isNull(chatUserIgnore.removedAt)));
+        return new Set(rows.map((r) => r.ignoredId));
+    }
+    async excludedSenderIdsFor(viewerId) {
+        const [blocked, ignored] = await Promise.all([
+            this.blockedIdsFor(viewerId),
+            this.ignoredIdsFor(viewerId),
+        ]);
+        return new Set([...blocked, ...ignored]);
+    }
+    async usernamesFor(userIds) {
+        const summaries = await this.directory.lookupPlayers(userIds);
+        return new Map(summaries.map((s) => [s.userId, s.username]));
+    }
+    async resolveUsername(userId, fallback) {
         const [row] = await this.drizzle.db
-            .select({ name: user.name })
+            .select({ username: user.username })
             .from(user)
             .where(eq(user.id, userId))
             .limit(1);
-        return row?.name?.trim() || fallback || 'anonymous';
+        return row?.username.trim() || fallback || 'anonymous';
+    }
+    /** Throws ChatRoomNotFoundError or ChatRoomNotMemberError; returns the room on success. */
+    async verifyRoomAccess(roomId, viewerId) {
+        const [room] = await this.drizzle.db
+            .select()
+            .from(chatRoom)
+            .where(and(eq(chatRoom.id, roomId), isNull(chatRoom.deletedAt)))
+            .limit(1);
+        if (!room) {
+            throw new ChatRoomNotFoundError(roomId);
+        }
+        if (viewerId) {
+            const now = new Date();
+            const [roomBan] = await this.drizzle.db
+                .select({ expiresAt: chatRoomBan.expiresAt })
+                .from(chatRoomBan)
+                .where(and(eq(chatRoomBan.roomId, roomId), eq(chatRoomBan.userId, viewerId), isNull(chatRoomBan.liftedAt), or(isNull(chatRoomBan.expiresAt), gt(chatRoomBan.expiresAt, now))))
+                .limit(1);
+            if (roomBan) {
+                throw new ChatPlayerBannedError(roomBan.expiresAt);
+            }
+            const [platformBan] = await this.drizzle.db
+                .select({ expiresAt: chatPlatformBan.expiresAt })
+                .from(chatPlatformBan)
+                .where(and(eq(chatPlatformBan.userId, viewerId), isNull(chatPlatformBan.liftedAt), or(isNull(chatPlatformBan.expiresAt), gt(chatPlatformBan.expiresAt, now)), room.isPublic
+                ? or(eq(chatPlatformBan.scope, '__all'), eq(chatPlatformBan.scope, '__all_public'), and(eq(chatPlatformBan.scope, 'room'), eq(chatPlatformBan.roomId, roomId)))
+                : or(eq(chatPlatformBan.scope, '__all'), and(eq(chatPlatformBan.scope, 'room'), eq(chatPlatformBan.roomId, roomId)))))
+                .limit(1);
+            if (platformBan) {
+                throw new ChatPlayerBannedError(platformBan.expiresAt);
+            }
+        }
+        if (!room.isPublic) {
+            if (!viewerId) {
+                throw new ChatRoomNotMemberError(roomId);
+            }
+            const [member] = await this.drizzle.db
+                .select({ id: chatRoomMember.id })
+                .from(chatRoomMember)
+                .where(and(eq(chatRoomMember.roomId, roomId), eq(chatRoomMember.userId, viewerId)))
+                .limit(1);
+            if (!member) {
+                throw new ChatRoomNotMemberError(roomId);
+            }
+        }
+        return room;
+    }
+    async verifyGlobalAccess(viewerId) {
+        if (!viewerId) {
+            return;
+        }
+        const [platformBan] = await this.drizzle.db
+            .select({ expiresAt: chatPlatformBan.expiresAt })
+            .from(chatPlatformBan)
+            .where(and(eq(chatPlatformBan.userId, viewerId), isNull(chatPlatformBan.liftedAt), or(isNull(chatPlatformBan.expiresAt), gt(chatPlatformBan.expiresAt, new Date())), or(eq(chatPlatformBan.scope, '__global'), eq(chatPlatformBan.scope, '__all_public'), eq(chatPlatformBan.scope, '__all'))))
+            .limit(1);
+        if (platformBan) {
+            throw new ChatPlayerBannedError(platformBan.expiresAt);
+        }
+    }
+    async listRooms(viewerId) {
+        const publicRooms = await this.drizzle.db
+            .select()
+            .from(chatRoom)
+            .where(and(eq(chatRoom.isPublic, true), isNull(chatRoom.deletedAt)))
+            .orderBy(asc(chatRoom.createdAt));
+        if (!viewerId) {
+            return publicRooms.map(toRoom);
+        }
+        const memberIds = await this.drizzle.db
+            .select({ roomId: chatRoomMember.roomId })
+            .from(chatRoomMember)
+            .where(eq(chatRoomMember.userId, viewerId));
+        const now = new Date();
+        const bans = await this.drizzle.db
+            .select({ roomId: chatRoomBan.roomId, expiresAt: chatRoomBan.expiresAt })
+            .from(chatRoomBan)
+            .where(and(eq(chatRoomBan.userId, viewerId), isNull(chatRoomBan.liftedAt), or(isNull(chatRoomBan.expiresAt), gt(chatRoomBan.expiresAt, now))));
+        const roomBanById = new Map(bans.map((ban) => [ban.roomId, ban.expiresAt]));
+        const bannedPrivateIds = bans.map((ban) => ban.roomId);
+        const platformBans = await this.drizzle.db
+            .select({
+            scope: chatPlatformBan.scope,
+            roomId: chatPlatformBan.roomId,
+            expiresAt: chatPlatformBan.expiresAt,
+        })
+            .from(chatPlatformBan)
+            .where(and(eq(chatPlatformBan.userId, viewerId), isNull(chatPlatformBan.liftedAt), or(isNull(chatPlatformBan.expiresAt), gt(chatPlatformBan.expiresAt, now))));
+        const allPublicBan = platformBans.find((ban) => ban.scope === '__all_public' || ban.scope === '__all');
+        const allPrivateBan = platformBans.find((ban) => ban.scope === '__all');
+        const globalBan = platformBans.find((ban) => ban.scope === '__global');
+        for (const ban of platformBans) {
+            if (ban.scope === 'room' && ban.roomId) {
+                roomBanById.set(ban.roomId, ban.expiresAt);
+            }
+        }
+        const privateRooms = await this.drizzle.db
+            .select()
+            .from(chatRoom)
+            .where(and(eq(chatRoom.isPublic, false), isNull(chatRoom.deletedAt), inArray(chatRoom.id, memberIds.map((r) => r.roomId))))
+            .orderBy(asc(chatRoom.createdAt));
+        const privateBannedRooms = bannedPrivateIds.length
+            ? await this.drizzle.db
+                .select()
+                .from(chatRoom)
+                .where(and(eq(chatRoom.isPublic, false), isNull(chatRoom.deletedAt), inArray(chatRoom.id, bannedPrivateIds)))
+            : [];
+        const uniqueRooms = [...publicRooms, ...privateRooms, ...privateBannedRooms].filter((room, index, rows) => rows.findIndex((candidate) => candidate.id === room.id) === index);
+        return uniqueRooms.map((room) => {
+            const roomBanUntil = roomBanById.get(room.id) ?? null;
+            const platformBanUntil = room.isPublic
+                ? (allPublicBan?.expiresAt ?? null)
+                : (allPrivateBan?.expiresAt ?? null);
+            return serializeRow({
+                ...room,
+                isBanned: room.slug === GLOBAL_CHAT_ROOM_ID
+                    ? Boolean(globalBan || allPublicBan)
+                    : roomBanById.has(room.id) || Boolean(room.isPublic ? allPublicBan : allPrivateBan),
+                bannedUntil: roomBanById.has(room.id) ? roomBanUntil : platformBanUntil,
+            }, { dateFields: ['createdAt', 'bannedUntil', 'scheduledDeletionAt'] });
+        });
+    }
+    async listAdminRooms({ page, limit, name, sortBy, sortOrder, }) {
+        const dir = sortOrder === 'asc' ? asc : desc;
+        const col = sortBy === 'name' ? chatRoom.name : chatRoom.createdAt;
+        const where = and(eq(chatRoom.isPublic, true), isNull(chatRoom.deletedAt), name ? ilike(chatRoom.name, `%${name}%`) : undefined);
+        const [rows, [{ n }]] = await Promise.all([
+            this.drizzle.db
+                .select()
+                .from(chatRoom)
+                .where(where)
+                .orderBy(dir(col))
+                .limit(limit)
+                .offset(pageToOffset(page, limit)),
+            this.drizzle.db.select({ n: count() }).from(chatRoom).where(where),
+        ]);
+        return { items: rows.map(toRoom), total: Number(n), page, limit };
+    }
+    async listModeratedRooms({ viewerId, page, limit, name, sortBy, sortOrder, }) {
+        const dir = sortOrder === 'asc' ? asc : desc;
+        const col = sortBy === 'name' ? chatRoom.name : chatRoom.createdAt;
+        const where = and(eq(chatRoomMember.userId, viewerId), inArray(chatRoomMember.role, ['owner', 'moderator']), isNull(chatRoom.deletedAt), name ? ilike(chatRoom.name, `%${name}%`) : undefined);
+        const [rows, [{ n }]] = await Promise.all([
+            this.drizzle.db
+                .select({ room: chatRoom })
+                .from(chatRoomMember)
+                .innerJoin(chatRoom, eq(chatRoom.id, chatRoomMember.roomId))
+                .where(where)
+                .orderBy(dir(col))
+                .limit(limit)
+                .offset(pageToOffset(page, limit)),
+            this.drizzle.db
+                .select({ n: count() })
+                .from(chatRoomMember)
+                .innerJoin(chatRoom, eq(chatRoom.id, chatRoomMember.roomId))
+                .where(where),
+        ]);
+        return { items: rows.map(({ room }) => toRoom(room)), total: Number(n), page, limit };
+    }
+    async getRoom({ roomId, viewerId }) {
+        const room = await this.verifyRoomAccess(roomId, viewerId);
+        return toRoom(room);
+    }
+    async assertRoomModerator(roomId, actorId, targetId) {
+        const [actor] = await this.drizzle.db
+            .select({ role: chatRoomMember.role })
+            .from(chatRoomMember)
+            .where(and(eq(chatRoomMember.roomId, roomId), eq(chatRoomMember.userId, actorId)))
+            .limit(1);
+        if (!actor || !CHAT_MODERATOR_ROLES.includes(actor.role)) {
+            throw new ChatRoomNotModeratorError(roomId);
+        }
+        if (targetId) {
+            const [target] = await this.drizzle.db
+                .select({ role: chatRoomMember.role })
+                .from(chatRoomMember)
+                .where(and(eq(chatRoomMember.roomId, roomId), eq(chatRoomMember.userId, targetId)))
+                .limit(1);
+            if (actor.role !== 'owner' && target && target.role !== 'member') {
+                throw new ChatRoomNotModeratorError(roomId);
+            }
+        }
+        return actor.role;
+    }
+    async listRoomRules(roomReference, viewerId) {
+        const isGlobalRoom = roomReference === GLOBAL_CHAT_ROOM_ID;
+        const [room] = await this.drizzle.db
+            .select({ id: chatRoom.id, slug: chatRoom.slug, isPublic: chatRoom.isPublic })
+            .from(chatRoom)
+            .where(and(isGlobalRoom ? eq(chatRoom.slug, GLOBAL_CHAT_ROOM_ID) : eq(chatRoom.id, roomReference), isNull(chatRoom.deletedAt)))
+            .limit(1);
+        if (!room) {
+            throw new ChatRoomNotFoundError(roomReference);
+        }
+        if (!room.isPublic) {
+            if (!viewerId) {
+                throw new ChatRoomNotMemberError(room.id);
+            }
+            const [member] = await this.drizzle.db
+                .select({ id: chatRoomMember.id })
+                .from(chatRoomMember)
+                .where(and(eq(chatRoomMember.roomId, room.id), eq(chatRoomMember.userId, viewerId)))
+                .limit(1);
+            if (!member) {
+                throw new ChatRoomNotMemberError(room.id);
+            }
+        }
+        const rows = await this.drizzle.db
+            .select()
+            .from(chatRoomRule)
+            .where(eq(chatRoomRule.roomId, room.id))
+            .orderBy(asc(chatRoomRule.orderNum), asc(chatRoomRule.createdAt));
+        return rows.map(toRule);
+    }
+    async createRoomRule({ roomId, actorId, orderNum, content, }) {
+        await this.assertRoomModerator(roomId, actorId);
+        let nextOrder = orderNum;
+        if (nextOrder === undefined) {
+            const [last] = await this.drizzle.db
+                .select({ orderNum: chatRoomRule.orderNum })
+                .from(chatRoomRule)
+                .where(eq(chatRoomRule.roomId, roomId))
+                .orderBy(desc(chatRoomRule.orderNum))
+                .limit(1);
+            nextOrder = (last?.orderNum ?? 0) + 1;
+        }
+        const [created] = await this.drizzle.db
+            .insert(chatRoomRule)
+            .values({ roomId, createdBy: actorId, orderNum: nextOrder, content })
+            .returning();
+        return toRule(created);
+    }
+    async updateRoomRule({ roomId, id, actorId, orderNum, content, }) {
+        await this.assertRoomModerator(roomId, actorId);
+        const patch = { updatedAt: new Date() };
+        if (orderNum !== undefined) {
+            patch.orderNum = orderNum;
+        }
+        if (content !== undefined) {
+            patch.content = content;
+        }
+        const updated = findOneOrThrow(await this.drizzle.db
+            .update(chatRoomRule)
+            .set(patch)
+            .where(and(eq(chatRoomRule.id, id), eq(chatRoomRule.roomId, roomId)))
+            .returning(), new ChatRoomRuleNotFoundError(id));
+        return toRule(updated);
+    }
+    async deleteRoomRule({ roomId, id, actorId, }) {
+        await this.assertRoomModerator(roomId, actorId);
+        findOneOrThrow(await this.drizzle.db
+            .delete(chatRoomRule)
+            .where(and(eq(chatRoomRule.id, id), eq(chatRoomRule.roomId, roomId)))
+            .returning({ id: chatRoomRule.id }), new ChatRoomRuleNotFoundError(id));
+        return { success: true };
+    }
+    async getRoomConfiguration(roomId, viewerId) {
+        await this.verifyRoomAccess(roomId, viewerId);
+        let [config] = await this.drizzle.db
+            .select()
+            .from(chatRoomConfiguration)
+            .where(eq(chatRoomConfiguration.roomId, roomId))
+            .limit(1);
+        if (!config) {
+            [config] = await this.drizzle.db.insert(chatRoomConfiguration).values({ roomId }).returning();
+        }
+        return toConfiguration(config);
+    }
+    async updateRoomConfiguration({ roomId, actorId, ...patch }) {
+        await this.assertRoomModerator(roomId, actorId);
+        const [config] = await this.drizzle.db
+            .insert(chatRoomConfiguration)
+            .values({ roomId, ...patch, updatedAt: new Date() })
+            .onConflictDoUpdate({
+            target: chatRoomConfiguration.roomId,
+            set: { ...patch, updatedAt: new Date() },
+        })
+            .returning();
+        return toConfiguration(config);
+    }
+    async listRoomUsers({ roomId, actorId, status, }) {
+        await this.assertRoomModerator(roomId, actorId);
+        const role = status === 'all' ? undefined : status;
+        const canSeeAdminUsers = await this.canSeeAdminUsers(actorId);
+        const [room] = await this.drizzle.db
+            .select({ creatorId: chatRoom.creatorId })
+            .from(chatRoom)
+            .where(eq(chatRoom.id, roomId))
+            .limit(1);
+        const members = await this.drizzle.db
+            .select({ member: chatRoomMember, username: user.name })
+            .from(chatRoomMember)
+            .leftJoin(user, eq(user.id, chatRoomMember.userId))
+            .where(and(eq(chatRoomMember.roomId, roomId), role ? eq(chatRoomMember.role, role) : undefined, hideStaffExceptOwner(canSeeAdminUsers, room?.creatorId ?? null)))
+            .orderBy(asc(chatRoomMember.joinedAt));
+        const bans = await this.drizzle.db
+            .select()
+            .from(chatRoomBan)
+            .where(and(eq(chatRoomBan.roomId, roomId), isNull(chatRoomBan.liftedAt)));
+        const now = Date.now();
+        const activeBans = new Map(bans
+            .filter((ban) => !ban.expiresAt || ban.expiresAt.getTime() > now)
+            .map((ban) => [ban.userId, ban]));
+        const names = await this.directory.lookupPlayers(members.map(({ member }) => member.userId));
+        const nameById = new Map(names.map((name) => [name.userId, name.username]));
+        return members.map(({ member, username }) => {
+            const ban = activeBans.get(member.userId);
+            return serializeRow({
+                userId: member.userId,
+                username: nameById.get(member.userId) ?? username ?? null,
+                role: member.role,
+                joinedAt: member.joinedAt,
+                blocked: Boolean(ban),
+                banId: ban?.id ?? null,
+                banExpiresAt: ban?.expiresAt ?? null,
+                isDeletedAccount: member.accountClosedAt !== null,
+            }, { dateFields: ['joinedAt', 'banExpiresAt'] });
+        });
     }
-    async listRooms() {
-        const rooms = await this.drizzle.db.select().from(chatRoom).orderBy(asc(chatRoom.createdAt));
-        return rooms.map(toRoom);
+    async listRoomBlockedUsers({ roomId, actorId }) {
+        await this.assertRoomModerator(roomId, actorId);
+        const rows = await this.drizzle.db
+            .select()
+            .from(chatRoomBan)
+            .where(and(eq(chatRoomBan.roomId, roomId), isNull(chatRoomBan.liftedAt), or(isNull(chatRoomBan.expiresAt), gt(chatRoomBan.expiresAt, new Date()))))
+            .orderBy(desc(chatRoomBan.createdAt));
+        const latest = new Map();
+        for (const row of rows) {
+            if (!latest.has(row.userId)) {
+                latest.set(row.userId, row);
+            }
+        }
+        return [...latest.values()].map((row) => serializeRow(row, { dateFields: ['createdAt', 'expiresAt', 'liftedAt'] }));
     }
-    async getRoomMessages({ roomId, limit = 50, before, viewerId, }) {
-        const conditions = [eq(chatMessage.roomId, roomId), eq(chatMessage.isDeleted, false)];
+    async getRoomMessages({ roomId, limit = DEFAULT_MESSAGE_LIMIT, before, viewerId, }) {
+        await this.verifyRoomAccess(roomId, viewerId);
+        const conditions = [
+            eq(chatMessage.roomId, roomId),
+            eq(chatMessage.isDeleted, false),
+            isNull(chatMessage.deletedAt),
+        ];
         if (before) {
             conditions.push(lt(chatMessage.createdAt, new Date(before)));
         }
-        await this.appendBlockFilter(conditions, viewerId);
+        await this.appendExcludedSendersFilter(conditions, viewerId);
         const messages = await this.drizzle.db
             .select()
             .from(chatMessage)
             .where(and(...conditions))
             .orderBy(desc(chatMessage.createdAt))
             .limit(limit);
-        return messages.map(toMessage);
+        return toPublicMessages(messages);
+    }
+    async listAdminRoomMessages({ roomId, page, limit, senderId, playerId, includeDeleted, }) {
+        const roomWhere = roomId === GLOBAL_CHAT_ROOM_ID
+            ? and(eq(chatRoom.slug, GLOBAL_CHAT_ROOM_ID), isNull(chatRoom.deletedAt))
+            : and(eq(chatRoom.id, roomId), isNull(chatRoom.deletedAt));
+        const [room] = await this.drizzle.db
+            .select({ id: chatRoom.id })
+            .from(chatRoom)
+            .where(roomWhere)
+            .limit(1);
+        if (!room) {
+            throw new ChatRoomNotFoundError(roomId);
+        }
+        const where = and(roomId === GLOBAL_CHAT_ROOM_ID ? isNull(chatMessage.roomId) : eq(chatMessage.roomId, roomId), includeDeleted ? undefined : eq(chatMessage.isDeleted, false), senderId ? eq(chatMessage.userId, senderId) : undefined, playerId ? eq(player.id, playerId) : undefined);
+        const [rows, [{ n }]] = await Promise.all([
+            this.drizzle.db
+                .select({ message: chatMessage, playerId: player.id })
+                .from(chatMessage)
+                .leftJoin(player, eq(player.userId, chatMessage.userId))
+                .where(where)
+                .orderBy(desc(chatMessage.createdAt))
+                .limit(limit)
+                .offset(pageToOffset(page, limit)),
+            this.drizzle.db
+                .select({ n: count() })
+                .from(chatMessage)
+                .leftJoin(player, eq(player.userId, chatMessage.userId))
+                .where(where),
+        ]);
+        return {
+            items: rows.flatMap(({ message, playerId }) => {
+                const mapped = toPublicMessage(message);
+                return mapped ? [{ ...mapped, playerId }] : [];
+            }),
+            total: Number(n),
+            page,
+            limit,
+        };
+    }
+    async listAdminMessages({ page, limit, roomId, senderId, playerId, search, includeDeleted, sortOrder, }) {
+        const roomCondition = roomId === GLOBAL_CHAT_ROOM_ID
+            ? isNull(chatMessage.roomId)
+            : roomId
+                ? eq(chatMessage.roomId, roomId)
+                : undefined;
+        const where = and(eq(chatMessage.type, 'user'), roomCondition, senderId ? eq(chatMessage.userId, senderId) : undefined, playerId ? eq(player.id, playerId) : undefined, search ? ilike(chatMessage.content, `%${search}%`) : undefined, includeDeleted
+            ? undefined
+            : and(eq(chatMessage.isDeleted, false), isNull(chatMessage.deletedAt)));
+        const direction = sortOrder === 'asc' ? asc : desc;
+        const [rows, [{ n }]] = await Promise.all([
+            this.drizzle.db
+                .select({
+                id: chatMessage.id,
+                createdAt: chatMessage.createdAt,
+                roomId: chatMessage.roomId,
+                playerId: player.id,
+                roomName: chatRoom.name,
+                content: chatMessage.content,
+                attachment: chatMessage.attachment,
+            })
+                .from(chatMessage)
+                .leftJoin(player, eq(player.userId, chatMessage.userId))
+                .leftJoin(chatRoom, eq(chatRoom.id, chatMessage.roomId))
+                .where(where)
+                .orderBy(direction(chatMessage.createdAt))
+                .limit(limit)
+                .offset(pageToOffset(page, limit)),
+            this.drizzle.db
+                .select({ n: count() })
+                .from(chatMessage)
+                .leftJoin(player, eq(player.userId, chatMessage.userId))
+                .leftJoin(chatRoom, eq(chatRoom.id, chatMessage.roomId))
+                .where(where),
+        ]);
+        return {
+            items: rows.map((row) => {
+                const date = row.createdAt.toISOString();
+                return {
+                    id: row.id,
+                    date,
+                    roomId: row.roomId ?? GLOBAL_CHAT_ROOM_ID,
+                    playerId: row.playerId,
+                    roomName: row.roomName ?? 'Global',
+                    content: row.content,
+                    attachment: row.attachment,
+                    time: date.slice(11, 19),
+                };
+            }),
+            total: Number(n),
+            page,
+            limit,
+        };
     }
-    async appendBlockFilter(conditions, viewerId) {
+    async appendExcludedSendersFilter(conditions, viewerId) {
         if (!viewerId) {
             return;
         }
-        const blocked = await this.blockedIdsFor(viewerId);
-        if (blocked.size > 0) {
-            conditions.push(notInArray(chatMessage.userId, [...blocked]));
+        const excluded = await this.excludedSenderIdsFor(viewerId);
+        if (excluded.size > 0) {
+            conditions.push(notInArray(chatMessage.userId, [...excluded]));
         }
     }
-    async sendRoomMessage({ userId, username, roomId, content, }) {
-        findOneOrThrow(await this.drizzle.db.select().from(chatRoom).where(eq(chatRoom.id, roomId)), new ChatRoomNotFoundError(roomId));
+    async sendRoomMessage({ userId, username, roomId, content, attachment = null, }) {
+        // TODO: check RG_SELF_EXCLUSION_SERVICE before send (sealed token not yet implemented)
+        const room = await this.verifyRoomAccess(roomId, userId);
+        await this.moderation.assertCanSend(userId, roomId, room.isPublic);
+        assertAttachmentAllowed(attachment, this.allowedAttachmentHosts);
         const safeContent = gateContent(content);
-        const displayName = await this.resolveDisplayName(userId, username);
+        const resolvedUsername = await this.resolveUsername(userId, username);
         const [record] = await this.drizzle.db
             .insert(chatMessage)
             .values({
             roomId,
             userId,
-            username: displayName,
+            username: resolvedUsername,
             content: safeContent,
+            attachment,
         })
             .returning();
         this.events.emit('chat.message.sent', {
@@ -121,40 +768,66 @@ export class ChatService {
             roomId,
             userId,
         });
-        const message = toMessage(record);
-        void this.transport.publish(chatChannel(roomId), message);
+        const message = toSentMessage(record);
+        publishChatEvent(this.transport, roomId, message);
+        emitMentions({
+            events: this.events,
+            directory: this.directory,
+            isBlockedByMentioned: (mentionedUserId) => this.isBlocked(this.drizzle.db, mentionedUserId, userId),
+            content: safeContent,
+            byUserId: userId,
+            roomId,
+            messageId: record.id,
+        });
         return message;
     }
-    async deleteMessage(id, userId) {
+    async deleteMessage(id, userId, meta) {
         const message = findOneOrThrow(await this.drizzle.db.select().from(chatMessage).where(eq(chatMessage.id, id)), new ChatMessageNotFoundError(id));
-        assertOwnership(message.userId, userId, new ChatMessageOwnershipError(id));
-        await this.drizzle.db
-            .update(chatMessage)
-            .set({ isDeleted: true })
-            .where(eq(chatMessage.id, id));
-        return { success: true };
+        let roomId = message.roomId;
+        if (roomId === null) {
+            const [globalRoom] = await this.drizzle.db
+                .select({ id: chatRoom.id })
+                .from(chatRoom)
+                .where(and(eq(chatRoom.slug, '__global'), isNull(chatRoom.deletedAt)))
+                .limit(1);
+            if (!globalRoom) {
+                throw new ChatRoomNotFoundError('__global');
+            }
+            roomId = globalRoom.id;
+        }
+        await this.assertRoomModerator(roomId, userId);
+        return this.moderation.deleteMessage(id, userId, meta, 'player');
     }
-    async getGlobalMessages(limit = 50, viewerId) {
-        const conditions = [isNull(chatMessage.roomId), eq(chatMessage.isDeleted, false)];
-        await this.appendBlockFilter(conditions, viewerId);
+    async getGlobalMessages(limit = DEFAULT_MESSAGE_LIMIT, viewerId) {
+        await this.verifyGlobalAccess(viewerId);
+        const conditions = [
+            isNull(chatMessage.roomId),
+            eq(chatMessage.isDeleted, false),
+            isNull(chatMessage.deletedAt),
+        ];
+        await this.appendExcludedSendersFilter(conditions, viewerId);
         const messages = await this.drizzle.db
             .select()
             .from(chatMessage)
             .where(and(...conditions))
             .orderBy(desc(chatMessage.createdAt))
             .limit(limit);
-        return messages.map(toMessage);
+        return toPublicMessages(messages);
     }
-    async sendGlobalMessage(userId, username, content) {
+    async sendGlobalMessage({ userId, username, content, attachment = null, }) {
+        // TODO: check RG_SELF_EXCLUSION_SERVICE before send (sealed token not yet implemented)
+        await this.moderation.assertCanSend(userId, null);
+        assertAttachmentAllowed(attachment, this.allowedAttachmentHosts);
         const safeContent = gateContent(content);
-        const displayName = await this.resolveDisplayName(userId, username);
+        const resolvedUsername = await this.resolveUsername(userId, username);
         const [record] = await this.drizzle.db
             .insert(chatMessage)
             .values({
             roomId: null,
             userId,
-            username: displayName,
+            username: resolvedUsername,
             content: safeContent,
+            attachment,
         })
             .returning();
         this.events.emit('chat.message.sent', {
@@ -162,42 +835,542 @@ export class ChatService {
             roomId: null,
             userId,
         });
-        const message = toMessage(record);
-        void this.transport.publish(chatChannel(null), message);
+        const message = toSentMessage(record);
+        publishChatEvent(this.transport, null, message);
+        emitMentions({
+            events: this.events,
+            directory: this.directory,
+            isBlockedByMentioned: (mentionedUserId) => this.isBlocked(this.drizzle.db, mentionedUserId, userId),
+            content: safeContent,
+            byUserId: userId,
+            roomId: null,
+            messageId: record.id,
+        });
         return message;
     }
-    async listBlockedUsers(blockerId) {
-        const rows = await this.drizzle.db
-            .select({ blockedId: chatUserBlock.blockedId, createdAt: chatUserBlock.createdAt })
-            .from(chatUserBlock)
-            .where(eq(chatUserBlock.blockerId, blockerId))
-            .orderBy(desc(chatUserBlock.createdAt));
-        return rows.map((r) => serializeRow(r, { dateFields: ['createdAt'] }));
+    async listBlockedUsers({ blockerId, page, limit, sortBy, sortOrder, }) {
+        const dir = sortOrder === 'asc' ? asc : desc;
+        const col = BLOCKED_USER_SORT_COLUMNS[sortBy];
+        const where = and(eq(chatUserBlock.blockerId, blockerId), isNull(chatUserBlock.removedAt));
+        const [rows, [{ n }]] = await Promise.all([
+            this.drizzle.db
+                .select({ blockedId: chatUserBlock.blockedId, createdAt: chatUserBlock.createdAt })
+                .from(chatUserBlock)
+                .where(where)
+                .orderBy(dir(col))
+                .limit(limit)
+                .offset(pageToOffset(page, limit)),
+            this.drizzle.db.select({ n: count() }).from(chatUserBlock).where(where),
+        ]);
+        const usernameByUserId = await this.usernamesFor(rows.map((r) => r.blockedId));
+        return {
+            items: rows.map((r) => serializeRow({ ...r, username: usernameByUserId.get(r.blockedId) ?? null }, { dateFields: ['createdAt'] })),
+            total: Number(n),
+            page,
+            limit,
+        };
+    }
+    /** Backoffice-only, site-wide: every active block relationship, not just the caller's. */
+    async adminListBlockedUsers({ page, limit, sortBy, sortOrder, }) {
+        const dir = sortOrder === 'asc' ? asc : desc;
+        const col = BLOCKED_USER_SORT_COLUMNS[sortBy];
+        const where = isNull(chatUserBlock.removedAt);
+        const [rows, [{ n }]] = await Promise.all([
+            this.drizzle.db
+                .select({
+                blockerId: chatUserBlock.blockerId,
+                blockedId: chatUserBlock.blockedId,
+                createdAt: chatUserBlock.createdAt,
+            })
+                .from(chatUserBlock)
+                .where(where)
+                .orderBy(dir(col))
+                .limit(limit)
+                .offset(pageToOffset(page, limit)),
+            this.drizzle.db.select({ n: count() }).from(chatUserBlock).where(where),
+        ]);
+        return {
+            items: rows.map((r) => serializeRow(r, { dateFields: ['createdAt'] })),
+            total: Number(n),
+            page,
+            limit,
+        };
     }
-    async blockUser(blockerId, blockedId) {
+    async blockUser(blockerId, blockedId, meta) {
         if (blockerId === blockedId) {
             throw new ChatSelfBlockError();
         }
-        // Idempotent: re-blocking is a no-op, so only the first block emits an event.
+        // Idempotent: re-blocking while already (actively) blocked is a no-op, so only
+        // the first block emits an event. The pair unique index is partial (removedAt
+        // IS NULL), so a block after a prior unblock conflicts with nothing and inserts
+        // a fresh active row - the removed row stays as history. No explicit conflict
+        // target: this table has exactly one unique constraint (the partial pair index).
+        // Any active friendship dissolves on the same tx as the block insert, so a block
+        // can never leave a friendship (and the blocked user) still reachable from
+        // /social/friends.
+        const { inserted, dissolvedFriendship } = await this.drizzle.db.transaction((tx) => withAdvisoryXactLock(tx, chatBlockLockKey(blockerId, blockedId), async () => {
+            const rows = await tx
+                .insert(chatUserBlock)
+                .values({ blockerId, blockedId })
+                .onConflictDoNothing()
+                .returning();
+            const dissolved = rows.length > 0
+                ? ((await this.socialCommands?.dissolveFriendshipOnBlock(tx, blockerId, blockedId)) ??
+                    null)
+                : null;
+            return { inserted: rows, dissolvedFriendship: dissolved };
+        }));
+        if (dissolvedFriendship) {
+            this.events.emit('social.friendship.removed', dissolvedFriendship);
+        }
+        if (inserted.length > 0) {
+            this.events.emit('chat.user.blocked', {
+                blockerId,
+                actorPlayerId: await this.identityReader.getPlayerIdByUserIdSafe(blockerId),
+                blockedId,
+                playerId: await this.identityReader.getPlayerIdByUserIdSafe(blockedId),
+                ip: meta?.ip ?? null,
+                userAgent: meta?.userAgent ?? null,
+            });
+        }
+        return { success: true };
+    }
+    async unblockUser(blockerId, blockedId, meta) {
+        // Soft-delete: the partial unique index guarantees at most one active (removedAt
+        // IS NULL) row per pair, so this is that row, or no-op if already unblocked.
+        const removed = await this.drizzle.db.transaction((tx) => withAdvisoryXactLock(tx, chatBlockLockKey(blockerId, blockedId), () => tx
+            .update(chatUserBlock)
+            .set({ removedAt: new Date() })
+            .where(and(eq(chatUserBlock.blockerId, blockerId), eq(chatUserBlock.blockedId, blockedId), isNull(chatUserBlock.removedAt)))
+            .returning()));
+        if (removed.length > 0) {
+            this.events.emit('chat.user.unblocked', {
+                blockerId,
+                actorPlayerId: await this.identityReader.getPlayerIdByUserIdSafe(blockerId),
+                blockedId,
+                playerId: await this.identityReader.getPlayerIdByUserIdSafe(blockedId),
+                ip: meta?.ip ?? null,
+                userAgent: meta?.userAgent ?? null,
+            });
+        }
+        return { success: true };
+    }
+    async listIgnoredUsers({ ignorerId, page, limit, sortBy, sortOrder, }) {
+        const dir = sortOrder === 'asc' ? asc : desc;
+        const col = IGNORED_USER_SORT_COLUMNS[sortBy];
+        const where = and(eq(chatUserIgnore.ignorerId, ignorerId), isNull(chatUserIgnore.removedAt));
+        const [rows, [{ n }]] = await Promise.all([
+            this.drizzle.db
+                .select({ ignoredId: chatUserIgnore.ignoredId, createdAt: chatUserIgnore.createdAt })
+                .from(chatUserIgnore)
+                .where(where)
+                .orderBy(dir(col))
+                .limit(limit)
+                .offset(pageToOffset(page, limit)),
+            this.drizzle.db.select({ n: count() }).from(chatUserIgnore).where(where),
+        ]);
+        const usernameByUserId = await this.usernamesFor(rows.map((r) => r.ignoredId));
+        return {
+            items: rows.map((r) => serializeRow({ ...r, username: usernameByUserId.get(r.ignoredId) ?? null }, { dateFields: ['createdAt'] })),
+            total: Number(n),
+            page,
+            limit,
+        };
+    }
+    /** Backoffice-only, site-wide: every active ignore relationship, not just the caller's. */
+    async adminListIgnoredUsers({ page, limit, sortBy, sortOrder, }) {
+        const dir = sortOrder === 'asc' ? asc : desc;
+        const col = IGNORED_USER_SORT_COLUMNS[sortBy];
+        const where = isNull(chatUserIgnore.removedAt);
+        const [rows, [{ n }]] = await Promise.all([
+            this.drizzle.db
+                .select({
+                ignorerId: chatUserIgnore.ignorerId,
+                ignoredId: chatUserIgnore.ignoredId,
+                createdAt: chatUserIgnore.createdAt,
+            })
+                .from(chatUserIgnore)
+                .where(where)
+                .orderBy(dir(col))
+                .limit(limit)
+                .offset(pageToOffset(page, limit)),
+            this.drizzle.db.select({ n: count() }).from(chatUserIgnore).where(where),
+        ]);
+        return {
+            items: rows.map((r) => serializeRow(r, { dateFields: ['createdAt'] })),
+            total: Number(n),
+            page,
+            limit,
+        };
+    }
+    async ignoreUser(ignorerId, ignoredId, meta) {
+        if (ignorerId === ignoredId) {
+            throw new ChatSelfIgnoreError();
+        }
+        // Idempotent + soft-delete-aware - see blockUser's comment, same pattern.
         const inserted = await this.drizzle.db
-            .insert(chatUserBlock)
-            .values({ blockerId, blockedId })
-            .onConflictDoNothing({ target: [chatUserBlock.blockerId, chatUserBlock.blockedId] })
+            .insert(chatUserIgnore)
+            .values({ ignorerId, ignoredId })
+            .onConflictDoNothing()
             .returning();
         if (inserted.length > 0) {
-            this.events.emit('chat.user.blocked', { blockerId, blockedId });
+            this.events.emit('chat.user.ignored', {
+                ignorerId,
+                actorPlayerId: await this.identityReader.getPlayerIdByUserIdSafe(ignorerId),
+                ignoredId,
+                playerId: await this.identityReader.getPlayerIdByUserIdSafe(ignoredId),
+                ip: meta?.ip ?? null,
+                userAgent: meta?.userAgent ?? null,
+            });
         }
         return { success: true };
     }
-    async unblockUser(blockerId, blockedId) {
+    async unignoreUser(ignorerId, ignoredId, meta) {
+        // Soft-delete - see unblockUser's comment, same pattern.
         const removed = await this.drizzle.db
-            .delete(chatUserBlock)
-            .where(and(eq(chatUserBlock.blockerId, blockerId), eq(chatUserBlock.blockedId, blockedId)))
+            .update(chatUserIgnore)
+            .set({ removedAt: new Date() })
+            .where(and(eq(chatUserIgnore.ignorerId, ignorerId), eq(chatUserIgnore.ignoredId, ignoredId), isNull(chatUserIgnore.removedAt)))
             .returning();
         if (removed.length > 0) {
-            this.events.emit('chat.user.unblocked', { blockerId, blockedId });
+            this.events.emit('chat.user.unignored', {
+                ignorerId,
+                actorPlayerId: await this.identityReader.getPlayerIdByUserIdSafe(ignorerId),
+                ignoredId,
+                playerId: await this.identityReader.getPlayerIdByUserIdSafe(ignoredId),
+                ip: meta?.ip ?? null,
+                userAgent: meta?.userAgent ?? null,
+            });
         }
         return { success: true };
     }
+    async getExcludedUserIds(viewerId) {
+        return [...(await this.excludedSenderIdsFor(viewerId))];
+    }
+    async getBlockedUserIds(viewerId) {
+        return [...(await this.blockedIdsFor(viewerId))];
+    }
+    async isBlocked(tx, blockerId, blockedId) {
+        const [row] = await tx
+            .select({ blockedId: chatUserBlock.blockedId })
+            .from(chatUserBlock)
+            .where(and(eq(chatUserBlock.blockerId, blockerId), eq(chatUserBlock.blockedId, blockedId), isNull(chatUserBlock.removedAt)))
+            .limit(1);
+        return row !== undefined;
+    }
+    async createRoom({ name, slug, category, actorId, ip, userAgent, }) {
+        let record;
+        try {
+            record = await this.drizzle.db.transaction(async (tx) => {
+                const [existing] = await tx
+                    .select({ id: chatRoom.id })
+                    .from(chatRoom)
+                    .where(eq(chatRoom.slug, slug))
+                    .limit(1);
+                if (existing) {
+                    throw new ChatRoomSlugConflictError();
+                }
+                const [created] = await tx
+                    .insert(chatRoom)
+                    .values({ name, slug, category, joinCode: generateJoinCode() })
+                    .returning();
+                await tx.insert(chatRoomConfiguration).values({ roomId: created.id });
+                if (actorId) {
+                    await tx.insert(chatRoomMember).values({
+                        roomId: created.id,
+                        userId: actorId,
+                        role: 'owner',
+                        roleAssignedAt: new Date(),
+                    });
+                }
+                return created;
+            });
+        }
+        catch (error) {
+            if (isUniqueConstraintViolation(error)) {
+                throw new ChatRoomSlugConflictError();
+            }
+            throw error;
+        }
+        this.events.emit('chat.room.created', {
+            roomId: record.id,
+            name,
+            slug,
+            category,
+            actorId,
+            ip: ip ?? null,
+            userAgent: userAgent ?? null,
+        });
+        return toRoom(record);
+    }
+    async updateRoom({ id, name, slug, category, actorId, ip, userAgent, }) {
+        const existing = findOneOrThrow(await this.drizzle.db
+            .select()
+            .from(chatRoom)
+            .where(and(eq(chatRoom.id, id), isNull(chatRoom.deletedAt)))
+            .limit(1), new ChatRoomNotFoundError(id));
+        if (slug !== undefined && slug !== existing.slug && existing.slug === GLOBAL_CHAT_ROOM_ID) {
+            throw new ChatRoomProtectedError();
+        }
+        if (slug !== undefined) {
+            const [clash] = await this.drizzle.db
+                .select({ id: chatRoom.id })
+                .from(chatRoom)
+                .where(and(eq(chatRoom.slug, slug), ne(chatRoom.id, id)))
+                .limit(1);
+            if (clash) {
+                throw new ChatRoomSlugConflictError();
+            }
+        }
+        const patch = {};
+        if (name !== undefined) {
+            patch.name = name;
+        }
+        if (slug !== undefined) {
+            patch.slug = slug;
+        }
+        if (category !== undefined) {
+            patch.category = category;
+        }
+        let updated;
+        try {
+            updated = findOneOrThrow(await this.drizzle.db
+                .update(chatRoom)
+                .set(patch)
+                .where(and(eq(chatRoom.id, id), isNull(chatRoom.deletedAt)))
+                .returning(), new ChatRoomNotFoundError(id));
+        }
+        catch (error) {
+            if (isUniqueConstraintViolation(error)) {
+                throw new ChatRoomSlugConflictError();
+            }
+            throw error;
+        }
+        this.events.emit('chat.room.updated', {
+            roomId: id,
+            actorId,
+            before: { name: existing.name, slug: existing.slug, category: existing.category },
+            after: { name: updated.name, slug: updated.slug, category: updated.category },
+            ip: ip ?? null,
+            userAgent: userAgent ?? null,
+        });
+        return toRoom(updated);
+    }
+    async updatePrivateRoom({ id, name, actorId, ip, userAgent, }) {
+        const room = findOneOrThrow(await this.drizzle.db
+            .select()
+            .from(chatRoom)
+            .where(and(eq(chatRoom.id, id), eq(chatRoom.isPublic, false), isNull(chatRoom.deletedAt)))
+            .limit(1), new ChatRoomNotFoundError(id));
+        if (!room.creatorId) {
+            throw new ChatRoomOwnershipError();
+        }
+        assertOwnership(room.creatorId, actorId, new ChatRoomOwnershipError());
+        return this.updateRoom({ id, name, actorId, ip, userAgent });
+    }
+    async deletePrivateRoom({ roomId, userId, ip, userAgent, }) {
+        const deletedAt = new Date();
+        // Validation runs inside the lock, not before it: two concurrent deletes would otherwise
+        // both pass the active-room check and both emit a deletion event for one room. The lock
+        // is the same one join/leave take, so a member joining concurrently either lands before
+        // the roster snapshot (and gets revoked) or after the soft-delete (and is rejected).
+        const deleted = await this.drizzle.db.transaction((t) => withAdvisoryXactLock(t, `chat-room:${roomId}`, async () => {
+            const room = findOneOrThrow(await t
+                .select()
+                .from(chatRoom)
+                .where(and(eq(chatRoom.id, roomId), eq(chatRoom.isPublic, false), isNull(chatRoom.deletedAt)))
+                .limit(1), new ChatRoomNotFoundError(roomId));
+            if (!room.creatorId) {
+                throw new ChatRoomOwnershipError();
+            }
+            assertOwnership(room.creatorId, userId, new ChatRoomOwnershipError());
+            const members = await t
+                .select({ userId: chatRoomMember.userId })
+                .from(chatRoomMember)
+                .where(eq(chatRoomMember.roomId, roomId));
+            const updated = await t
+                .update(chatRoom)
+                .set({ deletedAt })
+                .where(and(eq(chatRoom.id, roomId), isNull(chatRoom.deletedAt)))
+                .returning({ id: chatRoom.id });
+            return updated.length === 1 ? { room, members } : null;
+        }));
+        if (!deleted) {
+            throw new ChatRoomNotFoundError(roomId);
+        }
+        // Before the realtime cleanup: the deletion is committed, and an audit trail that depends
+        // on a transport call succeeding would go missing exactly when the transport is down.
+        this.events.emit('chat.private_room.deleted', {
+            roomId,
+            creatorId: userId,
+            playerId: await this.identityReader.getPlayerIdByUserIdSafe(userId),
+            before: {
+                name: deleted.room.name,
+                slug: deleted.room.slug,
+                category: deleted.room.category,
+            },
+            after: { deletedAt: deletedAt.toISOString() },
+            ip: ip ?? null,
+            userAgent: userAgent ?? null,
+        });
+        // The room is gone, so cut every member off the room channel rather than leaving them
+        // subscribed to a room that 404s on every call. Per-member best-effort: one unreachable
+        // client must not fail a delete that has already happened and cannot be retried.
+        await mapConcurrent(deleted.members, ROOM_REVOKE_CONCURRENCY, async ({ userId: memberId }) => {
+            try {
+                await this.transport.revokeUserFromChannel?.(memberId, chatChannel(roomId));
+            }
+            catch (err) {
+                logger.error({ err, roomId, memberId }, 'chat room channel revoke failed');
+            }
+        });
+        return { success: true };
+    }
+    async deleteRoom(id, actorId, meta) {
+        const existing = findOneOrThrow(await this.drizzle.db
+            .select({ slug: chatRoom.slug })
+            .from(chatRoom)
+            .where(and(eq(chatRoom.id, id), isNull(chatRoom.deletedAt)))
+            .limit(1), new ChatRoomNotFoundError(id));
+        if (existing.slug === GLOBAL_CHAT_ROOM_ID) {
+            throw new ChatRoomProtectedError();
+        }
+        const deleted = findOneOrThrow(await this.drizzle.db
+            .update(chatRoom)
+            .set({ deletedAt: new Date() })
+            .where(and(eq(chatRoom.id, id), isNull(chatRoom.deletedAt)))
+            .returning({
+            id: chatRoom.id,
+            name: chatRoom.name,
+            slug: chatRoom.slug,
+            category: chatRoom.category,
+        }), new ChatRoomNotFoundError(id));
+        this.events.emit('chat.room.deleted', {
+            roomId: id,
+            actorId,
+            before: { name: deleted.name, slug: deleted.slug, category: deleted.category },
+            ip: meta?.ip ?? null,
+            userAgent: meta?.userAgent ?? null,
+        });
+        return { success: true };
+    }
+    async createPrivateRoom({ userId, name, ip, userAgent, }) {
+        const playerId = await this.identityReader.getPlayerIdByUserIdSafe(userId);
+        for (let attempt = 1; attempt <= 3; attempt++) {
+            const joinCode = generateJoinCode();
+            const slug = generatePrivateRoomSlug(joinCode);
+            try {
+                const record = await this.drizzle.db.transaction((t) => withAdvisoryXactLock(t, userId, async () => {
+                    const [{ total }] = await t
+                        .select({ total: count() })
+                        .from(chatRoom)
+                        .where(and(eq(chatRoom.creatorId, userId), eq(chatRoom.isPublic, false), isNull(chatRoom.deletedAt)));
+                    if (Number(total) >= MAX_PRIVATE_ROOMS_PER_PLAYER) {
+                        throw new ChatRoomLimitReachedError();
+                    }
+                    const [room] = await t
+                        .insert(chatRoom)
+                        .values({
+                        name,
+                        slug,
+                        category: 'private-channels',
+                        isPublic: false,
+                        joinCode,
+                        creatorId: userId,
+                    })
+                        .returning();
+                    await t.insert(chatRoomConfiguration).values({ roomId: room.id });
+                    await t
+                        .insert(chatRoomMember)
+                        .values({ roomId: room.id, userId, role: 'owner', roleAssignedAt: new Date() })
+                        .onConflictDoNothing();
+                    return room;
+                }));
+                this.events.emit('chat.private_room.created', {
+                    roomId: record.id,
+                    creatorId: userId,
+                    playerId,
+                    ip: ip ?? null,
+                    userAgent: userAgent ?? null,
+                });
+                return toRoom(record);
+            }
+            catch (e) {
+                if (attempt < 3 && isUniqueConstraintViolation(e)) {
+                    continue;
+                }
+                throw e;
+            }
+        }
+        // unreachable: loop returns or rethrows on every iteration
+        throw new ChatRoomSlugConflictError();
+    }
+    async postSystemMessage(args) {
+        const db = args.tx ?? this.drizzle.db;
+        const [record] = await db
+            .insert(chatMessage)
+            .values({
+            roomId: args.roomId,
+            userId: args.actorId,
+            username: args.username,
+            content: '',
+            type: 'system',
+            metadata: args.metadata,
+        })
+            .returning();
+        const msg = toWrittenSystemMessage(record, args.metadata);
+        // Only auto-publish when this call owns the write (no caller-managed transaction).
+        // When `tx` is passed, the caller's transaction hasn't committed yet - publishing
+        // here would leak a message to clients before (or even if) it actually commits.
+        // The caller must publish itself after its transaction resolves.
+        if (!args.tx) {
+            publishChatEvent(this.transport, args.roomId, msg);
+        }
+        return msg;
+    }
+    async updateSystemMessage(args) {
+        const db = args.tx ?? this.drizzle.db;
+        const [record] = await db
+            .update(chatMessage)
+            .set({ metadata: args.metadata })
+            .where(eq(chatMessage.id, args.messageId))
+            .returning();
+        const message = toWrittenSystemMessage(record, args.metadata);
+        if (!args.tx) {
+            publishChatEvent(this.transport, message.roomId, message);
+        }
+        return message;
+    }
+    async listRoomMembers({ roomId, viewerId }) {
+        const room = await this.verifyRoomAccess(roomId, viewerId);
+        const canSeeAdminUsers = viewerId ? await this.canSeeAdminUsers(viewerId) : false;
+        const members = await this.drizzle.db
+            .select({
+            userId: chatRoomMember.userId,
+            role: chatRoomMember.role,
+            joinedAt: chatRoomMember.joinedAt,
+            accountClosedAt: chatRoomMember.accountClosedAt,
+            username: user.name,
+        })
+            .from(chatRoomMember)
+            .leftJoin(user, eq(user.id, chatRoomMember.userId))
+            .where(and(eq(chatRoomMember.roomId, roomId), hideStaffExceptOwner(canSeeAdminUsers, room.creatorId)))
+            .orderBy(asc(chatRoomMember.joinedAt));
+        const summaries = await this.directory.lookupPlayers(members.map((m) => m.userId));
+        const usernameByUserId = new Map(summaries.map((s) => [s.userId, s.username]));
+        return members.map(({ accountClosedAt, ...m }) => serializeRow({
+            ...m,
+            username: usernameByUserId.get(m.userId) ?? m.username ?? null,
+            isDeletedAccount: accountClosedAt !== null,
+        }, { dateFields: ['joinedAt'] }));
+    }
+    async canSeeAdminUsers(viewerId) {
+        const [viewer] = await this.drizzle.db
+            .select({ role: user.role })
+            .from(user)
+            .where(eq(user.id, viewerId))
+            .limit(1);
+        return viewer?.role === 'admin' || viewer?.role === 'super-admin';
+    }
 }
 //# sourceMappingURL=chat.service.js.map