@pmate/chat-sdk 0.12.0-next.2 → 0.12.0-next.21

package/lib/runtime/messageClient.js

@@ -5,6 +5,8 @@ export class MessageClient {
     options;
     storage;
     watches = new Map();
+    accessListeners = new Set();
+    allListeners = new Set();
     reads = new Map();
     syncing = new Map();
     paging = new Map();
@@ -18,46 +20,177 @@ export class MessageClient {
     closing = false;
     revoked = new Set();
     batchSize;
+    transactionBytes;
+    queueBytes;
+    pendingBytes = 0;
+    pendingRecords = 0;
+    legacyImports = 0;
+    revokingScope;
+    scopeReady;
+    scopeVersion = 0;
+    scopeAllowed = true;
+    scopeDenied = false;
+    enqueuing = new Set();
+    ensureScope() {
+        return this.scopeReady ??= this.storage.scopeAccess().then(access => { this.scopeVersion = access.version; this.scopeAllowed = !access.revoked && !this.scopeDenied; });
+    }
     constructor(options) {
         this.options = options;
         this.storage = options.storage ?? new IndexedDbMessageStore(options.scope, options.merge ?? mergeStoredMessage);
         this.batchSize = options.batchSize ?? 128;
+        this.transactionBytes = options.transactionBytes ?? 1_048_576;
+        this.queueBytes = options.queueBytes ?? 8_388_608;
+        if (!Number.isSafeInteger(this.transactionBytes) || this.transactionBytes < 1 || !Number.isSafeInteger(this.queueBytes) || this.queueBytes < this.transactionBytes)
+            throw new Error("INVALID_MESSAGE_BYTE_LIMIT");
         if (!Number.isSafeInteger(this.batchSize) || this.batchSize < 1 || this.batchSize > 1000)
             throw new Error("INVALID_MESSAGE_BATCH_SIZE");
-        this.writeTasks = new WindowedTasks(options.writeWindowMs ?? 16, (error, thread) => options.onError?.(error, thread));
+        this.writeTasks = new WindowedTasks(options.writeWindowMs ?? 16, (error, thread) => { if (String(error).includes("MESSAGE_PROJECTION_CHANGED"))
+            this.invalidate(thread);
+        else
+            options.onError?.(error, thread); });
         this.syncTasks = new WindowedTasks(options.syncWindowMs ?? 1000, (error, thread) => options.onError?.(error, thread));
         if (typeof BroadcastChannel !== "undefined") {
-            this.channel = new BroadcastChannel(`pmate-chat:${messageScopeKey(options.scope)}`);
-            this.channel.onmessage = event => { if (typeof event.data === "string" && this.watches.has(event.data))
-                void this.reload(event.data).catch(error => options.onError?.(error, event.data)); };
+            this.channel = new BroadcastChannel(`pmate-chat:${messageScopeKey(options.scope)}${this.storage.namespace === "pmate-chat-messages" ? "" : `:${this.storage.namespace}`}`);
+            this.channel.onmessage = event => {
+                if (this.closed)
+                    return;
+                if (event.data?.type === "scope-revoked" && Number.isSafeInteger(event.data.version)) {
+                    const version = event.data.version;
+                    void this.ensureScope().then(async () => {
+                        const current = await this.storage.scopeAccess();
+                        if (!this.closed && (this.scopeVersion < version || current.revoked)) {
+                            this.denyScope();
+                            options.onError?.(Object.assign(new Error("MESSAGE_ACCESS_REVOKED"), { status: 403 }), "");
+                        }
+                    }).catch(error => options.onError?.(error, ""));
+                }
+                else if (event.data?.type === "revoked" && typeof event.data.thread === "string" && Number.isSafeInteger(event.data.version)) {
+                    const denied = event.data;
+                    void (async () => {
+                        const current = await this.storage.read(denied.thread, 1).then(page => page.coverage).catch(() => undefined);
+                        if ((current?.scopeVersion ?? 0) !== (denied.scopeVersion ?? 0))
+                            return;
+                        if (this.closed || (current && !current.revoked && (current.resetVersion ?? 0) >= denied.version))
+                            return;
+                        this.denyView(denied.thread, denied.version);
+                        options.onError?.(Object.assign(new Error("MESSAGE_ACCESS_REVOKED"), { status: 403 }), denied.thread);
+                    })();
+                }
+                else if (event.data?.type === "legacy" && typeof event.data.thread === "string" && this.watches.has(event.data.thread)) {
+                    const thread = event.data.thread;
+                    void this.storage.read(thread, 1).then(page => this.reload(thread, !page.coverage?.complete)).catch(error => { if (!this.closed)
+                        options.onError?.(error, thread); });
+                }
+                else if (typeof event.data === "string" && this.watches.has(event.data))
+                    void this.reload(event.data).catch(error => { if (!this.closed)
+                        options.onError?.(error, event.data); });
+            };
         }
     }
+    /** Shared guard for sibling caches; it never authorizes a denied old instance. */
+    subscribeAccessRevoked(listener) { this.accessListeners.add(listener); return () => { this.accessListeners.delete(listener); }; }
+    async scopeAccess() {
+        await this.ensureScope();
+        if (this.closed)
+            return { version: this.scopeVersion, allowed: false };
+        const current = await this.storage.scopeAccess();
+        return { version: current.version, allowed: !this.scopeDenied && !current.revoked && current.version === this.scopeVersion };
+    }
     getSnapshot(thread) { return this.watches.get(thread)?.snapshot; }
     subscribe(thread, listener) {
         let watch = this.watches.get(thread);
         if (!watch) {
-            watch = { limit: 100, snapshot: { messages: [], hasEarlier: false }, listeners: new Set() };
+            watch = { snapshot: { messages: [], hasEarlier: false, resetVersion: 0, complete: false }, listeners: new Set() };
             this.watches.set(thread, watch);
         }
         watch.listeners.add(listener);
         return () => { watch.listeners.delete(listener); };
     }
-    read(thread, limit = 100) {
-        if (this.closed || this.closing || this.revoked.has(thread))
+    subscribeAll(listener) { this.allListeners.add(listener); return () => { this.allListeners.delete(listener); }; }
+    /** Close the connection gap for saved windows with four bounded background lanes. */
+    async restore(since, threadId) {
+        const queue = (await this.storage.windows()).filter(window => (window.syncedAt ?? 0) < since && !window.revoked && (threadId === undefined || window.thread === threadId));
+        await Promise.all(Array.from({ length: Math.min(4, queue.length) }, async () => {
+            while (queue.length && !this.closed && !this.closing) {
+                const window = queue.shift();
+                try {
+                    await this.synchronize(window.thread);
+                }
+                catch (error) {
+                    if (!this.closed && !this.closing)
+                        this.options.onError?.(error, window.thread);
+                }
+            }
+        }));
+    }
+    read(thread, limit = 100, refresh = false) {
+        if (this.closed || this.closing)
             return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
         if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000)
             return Promise.reject(new Error("INVALID_MESSAGE_LIMIT"));
-        const key = JSON.stringify([thread, limit]), running = this.reads.get(key);
+        const key = JSON.stringify([thread, limit, refresh]), running = this.reads.get(key);
         if (running)
             return running;
         const task = (async () => {
+            await this.ensureScope();
+            if (this.scopeDenied)
+                throw new Error("MESSAGE_ACCESS_REVOKED");
             const local = await this.storage.read(thread, limit);
-            if (!local.coverage?.complete)
-                await this.synchronize(thread);
+            if ((local.coverage?.scopeVersion ?? 0) !== this.scopeVersion) {
+                this.denyScope();
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            }
+            if (refresh || !local.coverage?.complete || local.coverage.revoked || this.revoked.has(thread)) {
+                if (typeof navigator !== "undefined" && navigator.onLine === false) {
+                    if (!refresh && !local.coverage?.revoked) {
+                        const fallback = await this.fallback(thread, limit);
+                        if (fallback.messages.length)
+                            return fallback;
+                    }
+                    throw new Error("MESSAGE_OFFLINE_UNAVAILABLE");
+                }
+                this.revoked.delete(thread);
+                try {
+                    await this.synchronize(thread);
+                }
+                catch (error) {
+                    if (String(error).includes("MESSAGE_SCOPE_CHANGED")) {
+                        this.denyScope();
+                        throw error;
+                    }
+                    if (refresh || [401, 403].includes(error?.status ?? 0))
+                        throw error;
+                    const fallback = await this.fallback(thread, limit);
+                    if (!fallback.messages.length)
+                        throw error;
+                    this.options.onError?.(error, thread);
+                    return fallback;
+                }
+            }
             if (this.closed)
                 throw new Error("MESSAGE_CLIENT_CLOSED");
-            await this.fillWindow(thread, limit);
-            return this.reload(thread, limit);
+            let result;
+            try {
+                result = await this.fillWindow(thread, limit);
+            }
+            catch (error) {
+                if (String(error).includes("MESSAGE_SCOPE_CHANGED")) {
+                    this.denyScope();
+                    throw error;
+                }
+                if ([401, 403].includes(error?.status ?? 0))
+                    throw error;
+                const cached = await this.fallback(thread, limit);
+                if (!cached.messages.length)
+                    throw error;
+                this.options.onError?.(error, thread);
+                return cached;
+            }
+            const snapshot = await this.reload(thread);
+            if (local.coverage?.complete && Date.now() - (local.coverage.syncedAt ?? 0) > (this.options.freshnessMs ?? 30_000)
+                && (typeof navigator === "undefined" || navigator.onLine !== false))
+                this.invalidate(thread);
+            return limit === 100 ? snapshot : result;
         })().finally(() => { if (this.reads.get(key) === task)
             this.reads.delete(key); });
         this.reads.set(key, task);
@@ -68,10 +201,61 @@ export class MessageClient {
         if (!this.closed && !this.closing && !this.revoked.has(thread))
             this.syncTasks.schedule(thread, () => this.synchronize(thread));
     }
-    async reload(thread, limit = this.watches.get(thread)?.limit ?? 100) {
-        const page = await this.storage.read(thread, limit);
+    async fallback(thread, limit, before) {
+        await this.ensureScope();
+        const page = await this.storage.readFallback(thread, limit, before);
+        if ((page.coverage?.scopeVersion ?? 0) !== this.scopeVersion) {
+            this.denyScope();
+            throw new Error("MESSAGE_SCOPE_CHANGED");
+        }
+        if (!before && page.messages.length)
+            await this.reload(thread, true);
+        return { messages: page.messages, hasEarlier: true, complete: false, resetVersion: page.coverage?.resetVersion ?? 0 };
+    }
+    /** Migration batches remain separate from authoritative message coverage. */
+    importLegacy(thread, messages) {
+        if (this.closed || this.closing)
+            return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
+        if (messages.length > 128)
+            return Promise.reject(new Error("MESSAGE_BATCH_TOO_LARGE"));
+        if (this.legacyImports >= 4)
+            return Promise.reject(new Error("MESSAGE_STORAGE_BACKPRESSURE"));
+        let records;
+        try {
+            let bytes = 0;
+            for (const message of messages) {
+                bytes += this.messageBytes(message);
+                if (bytes > Math.min(this.transactionBytes, 1_048_576))
+                    throw new Error("MESSAGE_BATCH_TOO_LARGE");
+            }
+            records = structuredClone(messages);
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        this.legacyImports++;
+        const task = this.storage.importLegacy(thread, records).then(async () => {
+            const page = await this.storage.read(thread, 1);
+            await this.reload(thread, !page.coverage?.complete);
+            this.channel?.postMessage({ type: "legacy", thread });
+        }).finally(() => { this.legacyImports--; this.activeWrites.delete(task); });
+        this.activeWrites.add(task);
+        return task;
+    }
+    async reload(thread, fallback = false) {
+        await this.ensureScope();
+        const limit = 100;
+        const page = await (fallback ? this.storage.readFallback(thread, limit) : this.storage.read(thread, limit));
         if (this.closed)
             throw new Error("MESSAGE_CLIENT_CLOSED");
+        if ((page.coverage?.scopeVersion ?? 0) !== this.scopeVersion) {
+            this.denyScope();
+            throw new Error("MESSAGE_SCOPE_CHANGED");
+        }
+        if (this.scopeDenied || this.revoked.has(thread)) {
+            page.messages = [];
+            page.hasEarlier = false;
+        }
         let watch = this.watches.get(thread);
         const oldById = new Map(watch?.snapshot.messages.map(message => [message.id, message]));
         const messages = page.messages.map(message => {
@@ -79,49 +263,108 @@ export class MessageClient {
             return old && JSON.stringify(old) === JSON.stringify(message) ? old : message;
         });
         const old = watch?.snapshot;
-        if (old && old.hasEarlier === (page.hasEarlier || Boolean(page.coverage?.nextBefore)) && old.messages.length === messages.length && old.messages.every((message, index) => message === messages[index]))
+        const resetVersion = Math.max(page.coverage?.resetVersion ?? 0, this.revoked.has(thread) ? watch?.snapshot.resetVersion ?? 0 : 0), complete = !fallback && !this.scopeDenied && !this.revoked.has(thread) && (page.coverage?.complete ?? false);
+        const hasEarlier = !this.revoked.has(thread) && (page.hasEarlier || Boolean(page.coverage?.nextBefore));
+        if (old && old.resetVersion === resetVersion && old.complete === complete && old.hasEarlier === hasEarlier && old.messages.length === messages.length && old.messages.every((message, index) => message === messages[index]))
             return old;
-        const snapshot = { messages, hasEarlier: page.hasEarlier || Boolean(page.coverage?.nextBefore) };
+        const snapshot = { messages, resetVersion, complete, hasEarlier };
         if (!watch) {
-            watch = { limit, snapshot, listeners: new Set() };
+            watch = { snapshot, listeners: new Set() };
             this.watches.set(thread, watch);
         }
-        watch.limit = limit;
         watch.snapshot = snapshot;
         watch.listeners.forEach(listener => listener());
+        this.allListeners.forEach(listener => listener(thread));
         return snapshot;
     }
     /** Events are visible only after their atomic batch commits. */
     receive(thread, messages) {
-        if (this.closed || this.closing || this.revoked.has(thread))
+        if (this.closed || this.closing)
             return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
-        const queue = this.writes.get(thread) ?? [];
-        if (messages.length > 1000 || queue.reduce((count, write) => count + write.messages.length, messages.length) > 4096)
+        if (this.revoked.has(thread))
+            return Promise.reject(new Error("MESSAGE_ACCESS_REVOKED"));
+        if (messages.length > 1000 || this.pendingRecords + messages.length > 4096)
             return Promise.reject(new Error("MESSAGE_STORAGE_BACKPRESSURE"));
-        const promise = new Promise((resolve, reject) => queue.push({ messages, resolve, reject }));
-        this.writes.set(thread, queue);
-        this.writeTasks.schedule(thread, () => this.flushWrites(thread));
-        return promise;
+        let bytes = 0;
+        try {
+            for (const message of messages) {
+                bytes += this.messageBytes(message);
+                if (this.pendingBytes + bytes > this.queueBytes)
+                    throw new Error("MESSAGE_STORAGE_BACKPRESSURE");
+            }
+            messages = structuredClone(messages);
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        this.pendingBytes += bytes;
+        this.pendingRecords += messages.length;
+        let resolve, reject;
+        const committed = new Promise((yes, no) => { resolve = yes; reject = no; });
+        const enqueue = this.ensureScope().then(() => {
+            if (this.closed || this.scopeDenied)
+                throw new Error("MESSAGE_ACCESS_REVOKED");
+            if (!this.scopeAllowed)
+                throw new Error("MESSAGE_SCOPE_NOT_READY");
+            const queue = this.writes.get(thread) ?? [];
+            queue.push({ messages, bytes, version: this.watches.get(thread)?.snapshot.resetVersion ?? 0, scopeVersion: this.scopeVersion, resolve, reject });
+            this.writes.set(thread, queue);
+            this.writeTasks.schedule(thread, () => this.flushWrites(thread));
+        }).catch(error => { this.pendingBytes -= bytes; this.pendingRecords -= messages.length; reject(error); }).finally(() => this.enqueuing.delete(enqueue));
+        this.enqueuing.add(enqueue);
+        return committed;
     }
-    async persist(thread, messages, checkpoint, complete, nextBefore) {
+    async persist(thread, messages, checkpoint, complete, nextBefore, syncedAt, expectedVersion, expectedScopeVersion) {
+        const initial = (await this.storage.read(thread, 1)).coverage;
+        const version = expectedVersion ?? initial?.resetVersion ?? 0;
+        const guard = { version, scopeVersion: expectedScopeVersion ?? this.scopeVersion, authoritative: complete === true };
         let changed = 0;
+        let navigationChanged = false;
         // Coverage advances only after all bounded batches have durably committed.
-        for (let offset = 0; offset < messages.length; offset += this.batchSize) {
-            if (this.closed || this.revoked.has(thread))
+        let batch = [], bytes = 0;
+        const commit = async () => {
+            if (!batch.length)
+                return;
+            if (this.closed || this.scopeDenied || this.revoked.has(thread))
                 throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
-            changed += await this.storage.commit(thread, messages.slice(offset, offset + this.batchSize));
+            changed += await this.storage.commit(thread, batch, undefined, guard);
+            batch = [];
+            bytes = 0;
+        };
+        for (const message of messages) {
+            const size = this.messageBytes(message);
+            if (batch.length >= this.batchSize || bytes + size > this.transactionBytes)
+                await commit();
+            batch.push(message);
+            bytes += size;
         }
+        await commit();
         if (complete !== undefined || checkpoint !== undefined) {
             const old = (await this.storage.read(thread, 1)).coverage;
-            if (this.closed || this.revoked.has(thread))
+            if (this.closed || this.scopeDenied || this.revoked.has(thread))
                 throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
-            await this.storage.commit(thread, [], { complete: complete ?? old?.complete ?? false, checkpoint: checkpoint ?? old?.checkpoint, nextBefore: nextBefore === undefined ? old?.nextBefore : nextBefore });
+            navigationChanged = (nextBefore !== undefined && nextBefore !== old?.nextBefore) || (complete !== undefined && complete !== old?.complete);
+            await this.storage.commit(thread, [], { resetVersion: version, revoked: complete === true ? false : old?.revoked, syncedAt: syncedAt ?? old?.syncedAt, complete: complete ?? old?.complete ?? false, checkpoint: checkpoint ?? old?.checkpoint, nextBefore: nextBefore === undefined ? old?.nextBefore : nextBefore }, guard);
         }
-        if (changed) {
+        if (complete === true)
+            this.scopeAllowed = true;
+        if (changed || navigationChanged) {
             await this.reload(thread);
             this.channel?.postMessage(thread);
         }
     }
+    messageBytes(message) {
+        const bytes = new TextEncoder().encode(JSON.stringify(message)).byteLength;
+        if (bytes > this.transactionBytes)
+            throw new Error("MESSAGE_RECORD_TOO_LARGE");
+        return bytes;
+    }
+    release(queue) {
+        for (const write of queue) {
+            this.pendingBytes -= write.bytes;
+            this.pendingRecords -= write.messages.length;
+        }
+    }
     flushWrites(thread) {
         const task = this.runWrites(thread).finally(() => this.activeWrites.delete(task));
         this.activeWrites.add(task);
@@ -133,39 +376,63 @@ export class MessageClient {
             return;
         this.writes.delete(thread);
         try {
-            await this.persist(thread, queue.flatMap(write => write.messages));
-            queue.forEach(write => write.resolve());
+            const groups = new Map();
+            for (const write of queue) {
+                const key = `${write.version}:${write.scopeVersion}`, group = groups.get(key) ?? [];
+                group.push(write);
+                groups.set(key, group);
+            }
+            let failed = false, failure;
+            for (const writes of groups.values()) {
+                try {
+                    await this.persist(thread, writes.flatMap(write => write.messages), undefined, undefined, undefined, undefined, writes[0].version, writes[0].scopeVersion);
+                    writes.forEach(write => write.resolve());
+                }
+                catch (error) {
+                    failed = true;
+                    failure = error;
+                    writes.forEach(write => write.reject(error));
+                }
+            }
+            if (failed)
+                throw failure;
         }
-        catch (error) {
-            queue.forEach(write => write.reject(error));
-            throw error;
+        finally {
+            this.release(queue);
         }
     }
     synchronize(thread) {
-        if (this.closed || this.closing || this.revoked.has(thread))
+        if (this.closed || this.closing || this.scopeDenied || this.revoked.has(thread))
             return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
         const running = this.syncing.get(thread);
         if (running)
             return running;
         const task = (async () => {
+            await this.ensureScope();
             const coverage = (await this.storage.read(thread, 1)).coverage;
+            const scopeVersion = coverage?.scopeVersion ?? 0;
+            if (scopeVersion !== this.scopeVersion) {
+                this.denyScope();
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            }
+            let version = coverage?.resetVersion ?? 0;
             let after = coverage?.complete ? coverage.checkpoint : undefined;
             let page = after && this.options.transport.changes
                 ? await this.options.transport.changes(thread, after, this.abort.signal)
                 : await this.options.transport.load(thread, this.abort.signal);
             if (page.resetRequired) {
-                if (this.closed || this.revoked.has(thread))
+                if (this.closed || this.scopeDenied || this.revoked.has(thread))
                     throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
-                await this.storage.removeThread(thread);
+                version = await this.storage.resetThread(thread, false, scopeVersion);
                 after = undefined;
                 page = await this.options.transport.load(thread, this.abort.signal);
             }
             for (;;) {
-                if (this.closed || this.revoked.has(thread))
+                if (this.closed || this.scopeDenied || this.revoked.has(thread))
                     throw new Error("MESSAGE_ACCESS_REVOKED");
                 if (page.resetRequired)
                     throw new Error("MESSAGE_SYNC_RESET_REQUIRED");
-                await this.persist(thread, page.messages, page.checkpoint, true, after ? undefined : page.nextBefore);
+                await this.persist(thread, page.messages, page.checkpoint, true, after ? undefined : page.nextBefore, Date.now(), version, scopeVersion);
                 if (!page.hasMoreChanges)
                     break;
                 if (!page.checkpoint || page.checkpoint === after || !this.options.transport.changes)
@@ -173,22 +440,56 @@ export class MessageClient {
                 after = page.checkpoint;
                 page = await this.options.transport.changes(thread, after, this.abort.signal);
             }
-        })().finally(() => { if (this.syncing.get(thread) === task)
+        })().catch(async (error) => {
+            if (String(error).includes("MESSAGE_SCOPE_CHANGED"))
+                this.denyScope();
+            if (!this.closed && !this.closing && error?.status === 403) {
+                try {
+                    await this.revoke(thread);
+                }
+                catch (cacheError) {
+                    Object.assign(error, { cacheError });
+                }
+            }
+            throw error;
+        }).finally(() => { if (this.syncing.get(thread) === task)
             this.syncing.delete(thread); });
         this.syncing.set(thread, task);
         return task;
     }
     async earlier(thread, before, limit = 100) {
+        await this.ensureScope();
+        if (this.scopeDenied)
+            throw new Error("MESSAGE_ACCESS_REVOKED");
         if (this.closed)
             throw new Error("MESSAGE_CLIENT_CLOSED");
         if (this.revoked.has(thread))
             throw new Error("MESSAGE_ACCESS_REVOKED");
-        if (!(await this.storage.read(thread, 1)).coverage?.complete)
-            await this.synchronize(thread);
-        return this.fillWindow(thread, limit, before);
+        try {
+            if (!(await this.storage.read(thread, 1)).coverage?.complete) {
+                if (typeof navigator !== "undefined" && navigator.onLine === false)
+                    throw new Error("MESSAGE_OFFLINE_UNAVAILABLE");
+                await this.synchronize(thread);
+            }
+            return await this.fillWindow(thread, limit, before);
+        }
+        catch (error) {
+            if (String(error).includes("MESSAGE_SCOPE_CHANGED")) {
+                this.denyScope();
+                throw error;
+            }
+            if ([401, 403].includes(error?.status ?? 0))
+                throw error;
+            const fallback = await this.fallback(thread, limit, before);
+            if (!fallback.messages.length)
+                throw error;
+            this.options.onError?.(error, thread);
+            return fallback;
+        }
     }
     async fillWindow(thread, limit, before) {
         let page = await this.storage.read(thread, limit, before);
+        let resets = 0;
         while (page.messages.length < limit && page.coverage?.nextBefore && this.options.transport.older) {
             const pending = this.paging.get(thread);
             if (pending) {
@@ -196,46 +497,124 @@ export class MessageClient {
                 page = await this.storage.read(thread, limit, before);
                 continue;
             }
-            const token = page.coverage.nextBefore;
+            const token = page.coverage.nextBefore, version = page.coverage.resetVersion ?? 0, scopeVersion = page.coverage.scopeVersion ?? 0;
             const task = (async () => {
                 const remote = await this.options.transport.older(thread, token, this.abort.signal);
-                if (this.closed || this.revoked.has(thread))
+                if (this.closed || this.scopeDenied || this.revoked.has(thread))
                     throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
                 if (remote.resetRequired) {
-                    await this.storage.removeThread(thread);
-                    throw new Error("MESSAGE_SYNC_RESET_REQUIRED");
+                    if (++resets > 2)
+                        throw new Error("MESSAGE_SYNC_RESET_REQUIRED");
+                    await this.storage.resetThread(thread, false, scopeVersion);
+                    await this.synchronize(thread);
+                    return;
                 }
                 if (remote.nextBefore === token)
                     throw new Error("MESSAGE_SYNC_NO_PROGRESS");
-                await this.persist(thread, remote.messages, undefined, true, remote.nextBefore ?? null);
-            })().finally(() => { if (this.paging.get(thread) === task)
+                await this.persist(thread, remote.messages, undefined, true, remote.nextBefore ?? null, undefined, version, scopeVersion);
+            })().catch(async (error) => {
+                if (!this.closed && !this.closing && error?.status === 403) {
+                    try {
+                        await this.revoke(thread);
+                    }
+                    catch (cacheError) {
+                        Object.assign(error, { cacheError });
+                    }
+                }
+                throw error;
+            }).finally(() => { if (this.paging.get(thread) === task)
                 this.paging.delete(thread); });
             this.paging.set(thread, task);
             await task;
             page = await this.storage.read(thread, limit, before);
         }
-        return { messages: page.messages, hasEarlier: page.hasEarlier || Boolean(page.coverage?.nextBefore) };
+        return { messages: page.messages, hasEarlier: page.hasEarlier || Boolean(page.coverage?.nextBefore), resetVersion: page.coverage?.resetVersion ?? 0, complete: page.coverage?.complete ?? false };
     }
-    async revoke(thread) {
+    denyView(thread, version) {
         this.revoked.add(thread);
+        const watch = this.watches.get(thread);
+        const snapshot = { messages: [], hasEarlier: false, complete: false, resetVersion: Math.max(watch?.snapshot.resetVersion ?? 0, version ?? (watch?.snapshot.resetVersion ?? 0) + 1) };
+        if (watch && !watch.snapshot.messages.length && !watch.snapshot.complete && !watch.snapshot.hasEarlier && watch.snapshot.resetVersion === snapshot.resetVersion)
+            return;
+        if (watch) {
+            watch.snapshot = snapshot;
+            watch.listeners.forEach(listener => listener());
+        }
+        else
+            this.watches.set(thread, { snapshot, listeners: new Set() });
+        this.allListeners.forEach(listener => listener(thread));
+    }
+    denyScope() {
+        const notify = !this.scopeDenied;
+        this.scopeDenied = true;
+        this.scopeAllowed = false;
+        this.abort.abort();
+        this.syncTasks.close();
+        this.writeTasks.close();
+        for (const thread of this.watches.keys())
+            this.denyView(thread);
+        for (const queue of this.writes.values()) {
+            queue.forEach(write => write.reject(new Error("MESSAGE_ACCESS_REVOKED")));
+            this.release(queue);
+        }
+        this.writes.clear();
+        if (notify)
+            this.accessListeners.forEach(listener => listener());
+    }
+    revokeScope() {
+        if (this.closed || this.closing)
+            return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
+        return this.revokingScope ??= (async () => {
+            this.denyScope();
+            try {
+                await this.ensureScope();
+                return await this.storage.revokeScope(this.scopeVersion);
+            }
+            finally {
+                const access = await this.storage.scopeAccess();
+                this.channel?.postMessage({ type: "scope-revoked", version: access.version });
+            }
+        })();
+    }
+    async revoke(thread) {
+        this.denyView(thread);
         const queue = this.writes.get(thread);
         this.writes.delete(thread);
-        queue?.forEach(write => write.reject(new Error("MESSAGE_ACCESS_REVOKED")));
-        await this.storage.removeThread(thread);
-        await this.reload(thread);
-        this.channel?.postMessage(thread);
+        if (queue) {
+            queue.forEach(write => write.reject(new Error("MESSAGE_ACCESS_REVOKED")));
+            this.release(queue);
+        }
+        try {
+            await this.storage.resetThread(thread, true, this.scopeVersion);
+            await this.reload(thread);
+        }
+        finally {
+            this.channel?.postMessage({ type: "revoked", thread, version: this.watches.get(thread)?.snapshot.resetVersion, scopeVersion: this.scopeVersion });
+        }
     }
-    async close() {
-        // Flush accepted event batches before closing; new requests are rejected afterwards.
+    async close(beforeDispose) {
+        if (this.closed)
+            return;
         this.closing = true;
-        this.syncTasks.close();
-        this.writeTasks.close();
-        await Promise.all([...this.writes.keys()].map(thread => this.flushWrites(thread)));
-        await Promise.all([...this.activeWrites]);
-        this.closed = true;
-        this.abort.abort();
-        this.channel?.close();
-        this.watches.clear();
-        this.storage.close();
+        try {
+            await Promise.all([...this.enqueuing]);
+            this.syncTasks.close();
+            this.writeTasks.close();
+            const flushes = [...this.writes.keys()].map(thread => this.flushWrites(thread));
+            const results = await Promise.allSettled([...flushes, ...this.activeWrites, ...(this.revokingScope ? [this.revokingScope] : [])]);
+            const failed = results.find((result) => result.status === "rejected");
+            if (failed)
+                throw failed.reason;
+            await beforeDispose;
+        }
+        finally {
+            this.closed = true;
+            this.abort.abort();
+            this.channel?.close();
+            this.watches.clear();
+            this.allListeners.clear();
+            this.accessListeners.clear();
+            this.storage.close();
+        }
     }
 }