@pmate/chat-sdk 0.12.0-next.20 → 0.12.0-next.21

package/lib/runtime/messageClient.js

@@ -5,6 +5,7 @@ export class MessageClient {
     options;
     storage;
     watches = new Map();
+    accessListeners = new Set();
     allListeners = new Set();
     reads = new Map();
     syncing = new Map();
@@ -24,6 +25,15 @@ export class MessageClient {
     pendingBytes = 0;
     pendingRecords = 0;
     legacyImports = 0;
+    revokingScope;
+    scopeReady;
+    scopeVersion = 0;
+    scopeAllowed = true;
+    scopeDenied = false;
+    enqueuing = new Set();
+    ensureScope() {
+        return this.scopeReady ??= this.storage.scopeAccess().then(access => { this.scopeVersion = access.version; this.scopeAllowed = !access.revoked && !this.scopeDenied; });
+    }
     constructor(options) {
         this.options = options;
         this.storage = options.storage ?? new IndexedDbMessageStore(options.scope, options.merge ?? mergeStoredMessage);
@@ -44,10 +54,22 @@ export class MessageClient {
             this.channel.onmessage = event => {
                 if (this.closed)
                     return;
-                if (event.data?.type === "revoked" && typeof event.data.thread === "string" && Number.isSafeInteger(event.data.version)) {
+                if (event.data?.type === "scope-revoked" && Number.isSafeInteger(event.data.version)) {
+                    const version = event.data.version;
+                    void this.ensureScope().then(async () => {
+                        const current = await this.storage.scopeAccess();
+                        if (!this.closed && (this.scopeVersion < version || current.revoked)) {
+                            this.denyScope();
+                            options.onError?.(Object.assign(new Error("MESSAGE_ACCESS_REVOKED"), { status: 403 }), "");
+                        }
+                    }).catch(error => options.onError?.(error, ""));
+                }
+                else if (event.data?.type === "revoked" && typeof event.data.thread === "string" && Number.isSafeInteger(event.data.version)) {
                     const denied = event.data;
                     void (async () => {
                         const current = await this.storage.read(denied.thread, 1).then(page => page.coverage).catch(() => undefined);
+                        if ((current?.scopeVersion ?? 0) !== (denied.scopeVersion ?? 0))
+                            return;
                         if (this.closed || (current && !current.revoked && (current.resetVersion ?? 0) >= denied.version))
                             return;
                         this.denyView(denied.thread, denied.version);
@@ -65,6 +87,15 @@ export class MessageClient {
             };
         }
     }
+    /** Shared guard for sibling caches; it never authorizes a denied old instance. */
+    subscribeAccessRevoked(listener) { this.accessListeners.add(listener); return () => { this.accessListeners.delete(listener); }; }
+    async scopeAccess() {
+        await this.ensureScope();
+        if (this.closed)
+            return { version: this.scopeVersion, allowed: false };
+        const current = await this.storage.scopeAccess();
+        return { version: current.version, allowed: !this.scopeDenied && !current.revoked && current.version === this.scopeVersion };
+    }
     getSnapshot(thread) { return this.watches.get(thread)?.snapshot; }
     subscribe(thread, listener) {
         let watch = this.watches.get(thread);
@@ -101,7 +132,14 @@ export class MessageClient {
         if (running)
             return running;
         const task = (async () => {
+            await this.ensureScope();
+            if (this.scopeDenied)
+                throw new Error("MESSAGE_ACCESS_REVOKED");
             const local = await this.storage.read(thread, limit);
+            if ((local.coverage?.scopeVersion ?? 0) !== this.scopeVersion) {
+                this.denyScope();
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            }
             if (refresh || !local.coverage?.complete || local.coverage.revoked || this.revoked.has(thread)) {
                 if (typeof navigator !== "undefined" && navigator.onLine === false) {
                     if (!refresh && !local.coverage?.revoked) {
@@ -116,6 +154,10 @@ export class MessageClient {
                     await this.synchronize(thread);
                 }
                 catch (error) {
+                    if (String(error).includes("MESSAGE_SCOPE_CHANGED")) {
+                        this.denyScope();
+                        throw error;
+                    }
                     if (refresh || [401, 403].includes(error?.status ?? 0))
                         throw error;
                     const fallback = await this.fallback(thread, limit);
@@ -132,6 +174,10 @@ export class MessageClient {
                 result = await this.fillWindow(thread, limit);
             }
             catch (error) {
+                if (String(error).includes("MESSAGE_SCOPE_CHANGED")) {
+                    this.denyScope();
+                    throw error;
+                }
                 if ([401, 403].includes(error?.status ?? 0))
                     throw error;
                 const cached = await this.fallback(thread, limit);
@@ -156,7 +202,12 @@ export class MessageClient {
             this.syncTasks.schedule(thread, () => this.synchronize(thread));
     }
     async fallback(thread, limit, before) {
+        await this.ensureScope();
         const page = await this.storage.readFallback(thread, limit, before);
+        if ((page.coverage?.scopeVersion ?? 0) !== this.scopeVersion) {
+            this.denyScope();
+            throw new Error("MESSAGE_SCOPE_CHANGED");
+        }
         if (!before && page.messages.length)
             await this.reload(thread, true);
         return { messages: page.messages, hasEarlier: true, complete: false, resetVersion: page.coverage?.resetVersion ?? 0 };
@@ -192,11 +243,16 @@ export class MessageClient {
         return task;
     }
     async reload(thread, fallback = false) {
+        await this.ensureScope();
         const limit = 100;
         const page = await (fallback ? this.storage.readFallback(thread, limit) : this.storage.read(thread, limit));
         if (this.closed)
             throw new Error("MESSAGE_CLIENT_CLOSED");
-        if (this.revoked.has(thread)) {
+        if ((page.coverage?.scopeVersion ?? 0) !== this.scopeVersion) {
+            this.denyScope();
+            throw new Error("MESSAGE_SCOPE_CHANGED");
+        }
+        if (this.scopeDenied || this.revoked.has(thread)) {
             page.messages = [];
             page.hasEarlier = false;
         }
@@ -207,7 +263,7 @@ export class MessageClient {
             return old && JSON.stringify(old) === JSON.stringify(message) ? old : message;
         });
         const old = watch?.snapshot;
-        const resetVersion = Math.max(page.coverage?.resetVersion ?? 0, this.revoked.has(thread) ? watch?.snapshot.resetVersion ?? 0 : 0), complete = !fallback && !this.revoked.has(thread) && (page.coverage?.complete ?? false);
+        const resetVersion = Math.max(page.coverage?.resetVersion ?? 0, this.revoked.has(thread) ? watch?.snapshot.resetVersion ?? 0 : 0), complete = !fallback && !this.scopeDenied && !this.revoked.has(thread) && (page.coverage?.complete ?? false);
         const hasEarlier = !this.revoked.has(thread) && (page.hasEarlier || Boolean(page.coverage?.nextBefore));
         if (old && old.resetVersion === resetVersion && old.complete === complete && old.hasEarlier === hasEarlier && old.messages.length === messages.length && old.messages.every((message, index) => message === messages[index]))
             return old;
@@ -227,7 +283,6 @@ export class MessageClient {
             return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
         if (this.revoked.has(thread))
             return Promise.reject(new Error("MESSAGE_ACCESS_REVOKED"));
-        const queue = this.writes.get(thread) ?? [];
         if (messages.length > 1000 || this.pendingRecords + messages.length > 4096)
             return Promise.reject(new Error("MESSAGE_STORAGE_BACKPRESSURE"));
         let bytes = 0;
@@ -244,15 +299,25 @@ export class MessageClient {
         }
         this.pendingBytes += bytes;
         this.pendingRecords += messages.length;
-        const promise = new Promise((resolve, reject) => queue.push({ messages, bytes, version: this.watches.get(thread)?.snapshot.resetVersion ?? 0, resolve, reject }));
-        this.writes.set(thread, queue);
-        this.writeTasks.schedule(thread, () => this.flushWrites(thread));
-        return promise;
+        let resolve, reject;
+        const committed = new Promise((yes, no) => { resolve = yes; reject = no; });
+        const enqueue = this.ensureScope().then(() => {
+            if (this.closed || this.scopeDenied)
+                throw new Error("MESSAGE_ACCESS_REVOKED");
+            if (!this.scopeAllowed)
+                throw new Error("MESSAGE_SCOPE_NOT_READY");
+            const queue = this.writes.get(thread) ?? [];
+            queue.push({ messages, bytes, version: this.watches.get(thread)?.snapshot.resetVersion ?? 0, scopeVersion: this.scopeVersion, resolve, reject });
+            this.writes.set(thread, queue);
+            this.writeTasks.schedule(thread, () => this.flushWrites(thread));
+        }).catch(error => { this.pendingBytes -= bytes; this.pendingRecords -= messages.length; reject(error); }).finally(() => this.enqueuing.delete(enqueue));
+        this.enqueuing.add(enqueue);
+        return committed;
     }
-    async persist(thread, messages, checkpoint, complete, nextBefore, syncedAt, expectedVersion) {
+    async persist(thread, messages, checkpoint, complete, nextBefore, syncedAt, expectedVersion, expectedScopeVersion) {
         const initial = (await this.storage.read(thread, 1)).coverage;
         const version = expectedVersion ?? initial?.resetVersion ?? 0;
-        const guard = { version, authoritative: complete === true };
+        const guard = { version, scopeVersion: expectedScopeVersion ?? this.scopeVersion, authoritative: complete === true };
         let changed = 0;
         let navigationChanged = false;
         // Coverage advances only after all bounded batches have durably committed.
@@ -260,7 +325,7 @@ export class MessageClient {
         const commit = async () => {
             if (!batch.length)
                 return;
-            if (this.closed || this.revoked.has(thread))
+            if (this.closed || this.scopeDenied || this.revoked.has(thread))
                 throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
             changed += await this.storage.commit(thread, batch, undefined, guard);
             batch = [];
@@ -276,11 +341,13 @@ export class MessageClient {
         await commit();
         if (complete !== undefined || checkpoint !== undefined) {
             const old = (await this.storage.read(thread, 1)).coverage;
-            if (this.closed || this.revoked.has(thread))
+            if (this.closed || this.scopeDenied || this.revoked.has(thread))
                 throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
             navigationChanged = (nextBefore !== undefined && nextBefore !== old?.nextBefore) || (complete !== undefined && complete !== old?.complete);
             await this.storage.commit(thread, [], { resetVersion: version, revoked: complete === true ? false : old?.revoked, syncedAt: syncedAt ?? old?.syncedAt, complete: complete ?? old?.complete ?? false, checkpoint: checkpoint ?? old?.checkpoint, nextBefore: nextBefore === undefined ? old?.nextBefore : nextBefore }, guard);
         }
+        if (complete === true)
+            this.scopeAllowed = true;
         if (changed || navigationChanged) {
             await this.reload(thread);
             this.channel?.postMessage(thread);
@@ -311,14 +378,14 @@ export class MessageClient {
         try {
             const groups = new Map();
             for (const write of queue) {
-                const group = groups.get(write.version) ?? [];
+                const key = `${write.version}:${write.scopeVersion}`, group = groups.get(key) ?? [];
                 group.push(write);
-                groups.set(write.version, group);
+                groups.set(key, group);
             }
             let failed = false, failure;
-            for (const [version, writes] of groups) {
+            for (const writes of groups.values()) {
                 try {
-                    await this.persist(thread, writes.flatMap(write => write.messages), undefined, undefined, undefined, undefined, version);
+                    await this.persist(thread, writes.flatMap(write => write.messages), undefined, undefined, undefined, undefined, writes[0].version, writes[0].scopeVersion);
                     writes.forEach(write => write.resolve());
                 }
                 catch (error) {
@@ -335,31 +402,37 @@ export class MessageClient {
         }
     }
     synchronize(thread) {
-        if (this.closed || this.closing || this.revoked.has(thread))
+        if (this.closed || this.closing || this.scopeDenied || this.revoked.has(thread))
             return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
         const running = this.syncing.get(thread);
         if (running)
             return running;
         const task = (async () => {
+            await this.ensureScope();
             const coverage = (await this.storage.read(thread, 1)).coverage;
+            const scopeVersion = coverage?.scopeVersion ?? 0;
+            if (scopeVersion !== this.scopeVersion) {
+                this.denyScope();
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            }
             let version = coverage?.resetVersion ?? 0;
             let after = coverage?.complete ? coverage.checkpoint : undefined;
             let page = after && this.options.transport.changes
                 ? await this.options.transport.changes(thread, after, this.abort.signal)
                 : await this.options.transport.load(thread, this.abort.signal);
             if (page.resetRequired) {
-                if (this.closed || this.revoked.has(thread))
+                if (this.closed || this.scopeDenied || this.revoked.has(thread))
                     throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
-                version = await this.storage.resetThread(thread);
+                version = await this.storage.resetThread(thread, false, scopeVersion);
                 after = undefined;
                 page = await this.options.transport.load(thread, this.abort.signal);
             }
             for (;;) {
-                if (this.closed || this.revoked.has(thread))
+                if (this.closed || this.scopeDenied || this.revoked.has(thread))
                     throw new Error("MESSAGE_ACCESS_REVOKED");
                 if (page.resetRequired)
                     throw new Error("MESSAGE_SYNC_RESET_REQUIRED");
-                await this.persist(thread, page.messages, page.checkpoint, true, after ? undefined : page.nextBefore, Date.now(), version);
+                await this.persist(thread, page.messages, page.checkpoint, true, after ? undefined : page.nextBefore, Date.now(), version, scopeVersion);
                 if (!page.hasMoreChanges)
                     break;
                 if (!page.checkpoint || page.checkpoint === after || !this.options.transport.changes)
@@ -368,6 +441,8 @@ export class MessageClient {
                 page = await this.options.transport.changes(thread, after, this.abort.signal);
             }
         })().catch(async (error) => {
+            if (String(error).includes("MESSAGE_SCOPE_CHANGED"))
+                this.denyScope();
             if (!this.closed && !this.closing && error?.status === 403) {
                 try {
                     await this.revoke(thread);
@@ -383,6 +458,9 @@ export class MessageClient {
         return task;
     }
     async earlier(thread, before, limit = 100) {
+        await this.ensureScope();
+        if (this.scopeDenied)
+            throw new Error("MESSAGE_ACCESS_REVOKED");
         if (this.closed)
             throw new Error("MESSAGE_CLIENT_CLOSED");
         if (this.revoked.has(thread))
@@ -396,6 +474,10 @@ export class MessageClient {
             return await this.fillWindow(thread, limit, before);
         }
         catch (error) {
+            if (String(error).includes("MESSAGE_SCOPE_CHANGED")) {
+                this.denyScope();
+                throw error;
+            }
             if ([401, 403].includes(error?.status ?? 0))
                 throw error;
             const fallback = await this.fallback(thread, limit, before);
@@ -415,21 +497,21 @@ export class MessageClient {
                 page = await this.storage.read(thread, limit, before);
                 continue;
             }
-            const token = page.coverage.nextBefore, version = page.coverage.resetVersion ?? 0;
+            const token = page.coverage.nextBefore, version = page.coverage.resetVersion ?? 0, scopeVersion = page.coverage.scopeVersion ?? 0;
             const task = (async () => {
                 const remote = await this.options.transport.older(thread, token, this.abort.signal);
-                if (this.closed || this.revoked.has(thread))
+                if (this.closed || this.scopeDenied || this.revoked.has(thread))
                     throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
                 if (remote.resetRequired) {
                     if (++resets > 2)
                         throw new Error("MESSAGE_SYNC_RESET_REQUIRED");
-                    await this.storage.resetThread(thread);
+                    await this.storage.resetThread(thread, false, scopeVersion);
                     await this.synchronize(thread);
                     return;
                 }
                 if (remote.nextBefore === token)
                     throw new Error("MESSAGE_SYNC_NO_PROGRESS");
-                await this.persist(thread, remote.messages, undefined, true, remote.nextBefore ?? null, undefined, version);
+                await this.persist(thread, remote.messages, undefined, true, remote.nextBefore ?? null, undefined, version, scopeVersion);
             })().catch(async (error) => {
                 if (!this.closed && !this.closing && error?.status === 403) {
                     try {
@@ -462,6 +544,38 @@ export class MessageClient {
             this.watches.set(thread, { snapshot, listeners: new Set() });
         this.allListeners.forEach(listener => listener(thread));
     }
+    denyScope() {
+        const notify = !this.scopeDenied;
+        this.scopeDenied = true;
+        this.scopeAllowed = false;
+        this.abort.abort();
+        this.syncTasks.close();
+        this.writeTasks.close();
+        for (const thread of this.watches.keys())
+            this.denyView(thread);
+        for (const queue of this.writes.values()) {
+            queue.forEach(write => write.reject(new Error("MESSAGE_ACCESS_REVOKED")));
+            this.release(queue);
+        }
+        this.writes.clear();
+        if (notify)
+            this.accessListeners.forEach(listener => listener());
+    }
+    revokeScope() {
+        if (this.closed || this.closing)
+            return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
+        return this.revokingScope ??= (async () => {
+            this.denyScope();
+            try {
+                await this.ensureScope();
+                return await this.storage.revokeScope(this.scopeVersion);
+            }
+            finally {
+                const access = await this.storage.scopeAccess();
+                this.channel?.postMessage({ type: "scope-revoked", version: access.version });
+            }
+        })();
+    }
     async revoke(thread) {
         this.denyView(thread);
         const queue = this.writes.get(thread);
@@ -471,25 +585,36 @@ export class MessageClient {
             this.release(queue);
         }
         try {
-            await this.storage.resetThread(thread, true);
+            await this.storage.resetThread(thread, true, this.scopeVersion);
             await this.reload(thread);
         }
         finally {
-            this.channel?.postMessage({ type: "revoked", thread, version: this.watches.get(thread)?.snapshot.resetVersion });
+            this.channel?.postMessage({ type: "revoked", thread, version: this.watches.get(thread)?.snapshot.resetVersion, scopeVersion: this.scopeVersion });
         }
     }
-    async close() {
-        // Flush accepted event batches before closing; new requests are rejected afterwards.
+    async close(beforeDispose) {
+        if (this.closed)
+            return;
         this.closing = true;
-        this.syncTasks.close();
-        this.writeTasks.close();
-        await Promise.all([...this.writes.keys()].map(thread => this.flushWrites(thread)));
-        await Promise.all([...this.activeWrites]);
-        this.closed = true;
-        this.abort.abort();
-        this.channel?.close();
-        this.watches.clear();
-        this.allListeners.clear();
-        this.storage.close();
+        try {
+            await Promise.all([...this.enqueuing]);
+            this.syncTasks.close();
+            this.writeTasks.close();
+            const flushes = [...this.writes.keys()].map(thread => this.flushWrites(thread));
+            const results = await Promise.allSettled([...flushes, ...this.activeWrites, ...(this.revokingScope ? [this.revokingScope] : [])]);
+            const failed = results.find((result) => result.status === "rejected");
+            if (failed)
+                throw failed.reason;
+            await beforeDispose;
+        }
+        finally {
+            this.closed = true;
+            this.abort.abort();
+            this.channel?.close();
+            this.watches.clear();
+            this.allListeners.clear();
+            this.accessListeners.clear();
+            this.storage.close();
+        }
     }
 }

package/lib/runtime/messageReaders.d.ts

@@ -1,3 +1,4 @@
+import { type ResponseCacheAccess } from "./responseCache.js";
 import { type MessageScope } from "./messageStore.js";
 export type MessageReadersPage = {
     appId: string;
@@ -23,6 +24,7 @@ export type MessageReadersOptions = {
     hubHttpUrl: string;
     fetch?: typeof fetch;
     scope?: MessageScope;
+    access?: ResponseCacheAccess;
     onError?: (error: unknown) => void;
 };
 export declare class MessageReadersError extends Error {
@@ -42,5 +44,7 @@ export declare class MessageReadersClient {
     getReaders(query: MessageReadersQuery, signal?: AbortSignal): Promise<MessageReadersPage>;
     private cachedRequest;
     private request;
+    withdraw(): void;
+    retireScope(version: number): Promise<void>;
     close(): Promise<void>;
 }

package/lib/runtime/messageReaders.js

@@ -1,4 +1,4 @@
-import { IndexedDbResponseCache } from "./responseCache.js";
+import { IndexedDbResponseCache, isResponseCacheAuthorityError, assertResponseCacheAccess } from "./responseCache.js";
 import { messageScopeKey } from "./messageStore.js";
 export class MessageReadersError extends Error {
     status;
@@ -22,7 +22,7 @@ export class MessageReadersClient {
         if (options.scope) {
             if (options.scope.appId !== options.appId || options.scope.profileId !== options.profileId)
                 throw new Error("MESSAGE_READERS_SCOPE_MISMATCH");
-            this.cache = new IndexedDbResponseCache(messageScopeKey(options.scope));
+            this.cache = new IndexedDbResponseCache(messageScopeKey(options.scope), { access: options.access });
         }
     }
     getReaders(query, signal) {
@@ -56,7 +56,8 @@ export class MessageReadersClient {
         const cache = input.limit === 50 ? this.cache : undefined;
         if (!cache)
             return this.request(input);
-        const stored = await cache.read(key).catch(error => { this.options.onError?.(error); return undefined; });
+        const stored = await cache.read(key).catch(error => { if (isResponseCacheAuthorityError(error))
+            throw error; this.options.onError?.(error); return undefined; });
         if (this.lifetime.signal.aborted)
             throw new Error("MESSAGE_READERS_CLOSED");
         const generation = this.generation;
@@ -84,13 +85,16 @@ export class MessageReadersClient {
         if (value.resetRequired)
             await cache?.invalidate().catch(error => this.options.onError?.(error));
         else if (stored)
-            await cache?.write(key, value, stored.epoch).catch(error => { if (String(error).includes("RESPONSE_CACHE_INVALIDATED"))
+            await cache?.write(key, value, stored.epoch).catch(error => { if (isResponseCacheAuthorityError(error))
                 throw error; this.options.onError?.(error); });
         if (this.lifetime.signal.aborted)
             throw new Error("MESSAGE_READERS_CLOSED");
         return value;
     }
     async request(input) {
+        const scopeVersion = this.options.access ? await assertResponseCacheAccess(this.options.access) : undefined;
+        if (this.lifetime.signal.aborted)
+            throw new Error("MESSAGE_READERS_CLOSED");
         const { token, fetch: fetcher, hubHttpUrl, appId, profileId } = this.options;
         const controller = new AbortController();
         const cancel = () => controller.abort(this.lifetime.signal.reason);
@@ -113,6 +117,8 @@ export class MessageReadersClient {
                 throw new Error("INVALID_MESSAGE_READERS_RESPONSE");
             if (this.lifetime.signal.aborted)
                 throw new Error("MESSAGE_READERS_CLOSED");
+            if (this.options.access)
+                await assertResponseCacheAccess(this.options.access, scopeVersion);
             return data;
         }
         finally {
@@ -120,5 +126,7 @@ export class MessageReadersClient {
             this.lifetime.signal.removeEventListener("abort", cancel);
         }
     }
+    withdraw() { this.lifetime.abort(); this.pending.clear(); }
+    retireScope(version) { return this.cache?.retire(version) ?? Promise.resolve(); }
     close() { this.lifetime.abort(); this.pending.clear(); return this.cache?.close().catch(error => this.options.onError?.(error)) ?? Promise.resolve(); }
 }

package/lib/runtime/messageStore.d.ts

@@ -18,6 +18,12 @@ export type MessageCoverage = {
     syncedAt?: number;
     resetVersion?: number;
     revoked?: boolean;
+    scopeVersion?: number;
+};
+export type MessageScopeAccess = {
+    scope: string;
+    version: number;
+    revoked: boolean;
 };
 type CoverageRow = MessageCoverage & {
     scope: string;
@@ -32,6 +38,7 @@ export declare class IndexedDbMessageStore<T extends StoredMessage> {
     private rows;
     private legacy;
     private coverage;
+    private accessRows;
     private key;
     constructor(scope: MessageScope, merge: (previous: T | undefined, incoming: T) => T, options?: {
         indexedDB?: IDBFactory;
@@ -44,7 +51,7 @@ export declare class IndexedDbMessageStore<T extends StoredMessage> {
     }): Promise<{
         messages: T[];
         hasEarlier: boolean;
-        coverage: CoverageRow | undefined;
+        coverage: MessageCoverage | undefined;
     }>;
     /** Migration records never claim coverage or overwrite authoritative rows. */
     importLegacy(thread: string, messages: T[]): Promise<number>;
@@ -55,15 +62,21 @@ export declare class IndexedDbMessageStore<T extends StoredMessage> {
     }): Promise<{
         messages: T[];
         hasEarlier: boolean;
-        coverage: CoverageRow | undefined;
+        coverage: MessageCoverage | undefined;
     }>;
     commit(thread: string, messages: T[], coverage?: MessageCoverage, guard?: {
         version: number;
         authoritative?: boolean;
+        scopeVersion?: number;
     }): Promise<number>;
     windows(): Promise<CoverageRow[]>;
+    scopeAccess(): Promise<MessageScopeAccess>;
+    private scopedCoverage;
+    private clearScopeRows;
+    /** Persist the denial first; failed cleanup must never make cached rows readable. */
+    revokeScope(expectedVersion?: number): Promise<number>;
     /** A durable epoch prevents another tab's pre-reset request from restoring rows. */
-    resetThread(thread: string, revoked?: boolean): Promise<number>;
+    resetThread(thread: string, revoked?: boolean, scopeVersion?: number): Promise<number>;
     removeThread(thread: string): Promise<void>;
     clear(): Promise<void>;
     close(): void;