@pmate/chat-sdk 0.12.0-next.20 → 0.12.0-next.22

package/README.md

@@ -158,9 +158,17 @@ await chat.observeMessages(threadId, [voiceId], "played")
 await chat.sendMessage(threadId, { to, body, recipients })
 const readers = await chat.getReaders(threadId, messageId)
 off(); offSummary()
+// Ordinary navigation/shutdown preserves offline data.
 await chat.close()
 ```
 
+```ts
+// When team access is withdrawn, use this instead of ordinary close(). It hides
+// snapshots immediately, retires durable caches/outbox and closes this session.
+// Other teams' reading operations remain intact. Create a new session to recover.
+await chat.revokeAccess()
+```
+
 The facade owns all clients below. Message reads transparently restore IndexedDB
 windows and fetch missing ranges through the authenticated Hub. Its normalized
 messages retain the protocol body; product rendering remains with the host.

package/lib/runtime/batchedReadIndex.d.ts

@@ -1,6 +1,6 @@
-import { type ReadIndexPersistence, type ReadIndexState } from "./readIndex.js";
+import { type ReadIndexPersistence, type ReadIndexState, type ReadIndexTransform } from "./readIndex.js";
 type Change = {
-    transform: (state: ReadIndexState) => ReadIndexState;
+    transform: ReadIndexTransform;
     resolve: (state: ReadIndexState) => void;
     reject: (error: unknown) => void;
 };
@@ -15,6 +15,15 @@ export declare class BatchedReadIndex implements ReadIndexPersistence {
     private closed;
     constructor(storage: ReadIndexPersistence, windowMs?: number, batchSize?: number, queueLimit?: number);
     load(appId: string, profileId: string): Promise<ReadIndexState | undefined>;
+    loadVersioned(appId: string, profileId: string): Promise<{
+        state: ReadIndexState | undefined;
+        versions: import("./readIndex.js").ReadIndexVersions;
+    } | {
+        state: ReadIndexState | undefined;
+        versions: {};
+    }>;
+    loadVersions(appId: string, profileId: string): Promise<{}>;
+    invalidateTeam(appId: string, profileId: string, teamId: string, version: number, knownThreadIds?: readonly string[]): Promise<ReadIndexState>;
     update(appId: string, profileId: string, transform: Change["transform"]): Promise<ReadIndexState>;
     private drain;
     flush(appId: string, profileId: string): Promise<void>;

package/lib/runtime/batchedReadIndex.js

@@ -22,6 +22,26 @@ export class BatchedReadIndex {
             throw new Error("READ_STORAGE_CLOSED");
         return this.storage.load(appId, profileId);
     }
+    async loadVersioned(appId, profileId) {
+        await this.flush(appId, profileId);
+        if (this.closed)
+            throw new Error("READ_STORAGE_CLOSED");
+        return this.storage.loadVersioned ? this.storage.loadVersioned(appId, profileId) : { state: await this.storage.load(appId, profileId), versions: {} };
+    }
+    async loadVersions(appId, profileId) {
+        if (this.closed)
+            throw new Error("READ_STORAGE_CLOSED");
+        return this.storage.loadVersions ? this.storage.loadVersions(appId, profileId) : {};
+    }
+    async invalidateTeam(appId, profileId, teamId, version, knownThreadIds) {
+        if (this.closed)
+            throw new Error("READ_STORAGE_CLOSED");
+        if (!this.storage.invalidateTeam)
+            throw new Error("READ_SCOPE_INVALIDATION_UNAVAILABLE");
+        // Do not flush a blocked old HTTP transform first. The durable epoch is the
+        // barrier; any queued transform sees it inside its eventual transaction.
+        return this.storage.invalidateTeam(appId, profileId, teamId, version, knownThreadIds);
+    }
     update(appId, profileId, transform) {
         if (this.closed)
             return Promise.reject(new Error("READ_STORAGE_CLOSED"));
@@ -48,7 +68,7 @@ export class BatchedReadIndex {
             return;
         const run = (async () => {
             try {
-                const next = await this.storage.update(queue.appId, queue.profileId, state => batch.reduce((current, change) => change.transform(current), state));
+                const next = await this.storage.update(queue.appId, queue.profileId, (state, versions) => batch.reduce((current, change) => change.transform(current, versions), state));
                 batch.forEach(change => change.resolve(next));
             }
             catch (error) {

package/lib/runtime/chatSession.d.ts

@@ -59,9 +59,14 @@ export declare class ChatSession<T extends StoredMessage> {
     private off;
     private globalListeners;
     private globalSnapshot?;
+    private closedThread;
+    private closedSummary;
     private connectionState;
     private catchUp;
     private readingStarted;
+    private readingStarting?;
+    private withdrawn;
+    private revoking?;
     private closed;
     private starting?;
     private initializing?;
@@ -71,6 +76,7 @@ export declare class ChatSession<T extends StoredMessage> {
     /** Initializes local state and background reading sync without opening a
      * second transport when the host already owns calls/presence. */
     initialize(): Promise<void>;
+    private startReading;
     /** One-time migration only: never establishes trusted history coverage. */
     importLegacyMessages(threadId: string, messages: T[]): Promise<void>;
     getReadingSnapshot(): import("./readIndex.js").ReadIndexState | undefined;
@@ -117,5 +123,9 @@ export declare class ChatSession<T extends StoredMessage> {
     private buildGlobal;
     private publishGlobal;
     private publish;
+    /** Permanently retire this identity/team session. UI withdrawal is immediate;
+     * completion means all durable stores have crossed the same authority epoch. */
+    revokeAccess(): Promise<void>;
     close(): Promise<void>;
+    private dispose;
 }

package/lib/runtime/chatSession.js

@@ -27,9 +27,14 @@ export class ChatSession {
     off = [];
     globalListeners = new Set();
     globalSnapshot;
+    closedThread = { messages: [], outgoing: [], hasEarlier: false, resetVersion: 0, complete: false, unread: undefined };
+    closedSummary = { threads: [], unreadMessageCount: undefined, badgeCount: undefined, connection: "closed" };
     connectionState = "closed";
     catchUp;
     readingStarted = false;
+    readingStarting;
+    withdrawn = false;
+    revoking;
     closed = false;
     starting;
     initializing;
@@ -54,8 +59,8 @@ export class ChatSession {
                 throw new Error("REACH_HANDLER_UNAVAILABLE");
             } });
         this.reading = new ReadingClient({ ...options.reading, storageScope: JSON.stringify([scope.accountId]), migrateLegacy: true });
-        this.readers = new MessageReadersClient({ appId: scope.appId, profileId: scope.profileId, token: options.reading.sessionToken, scope, onError: options.onError, hubHttpUrl: options.reading.hubHttpUrl, fetch: options.reading.fetch });
-        this.sender = new DurableChatSender(this.connection, scope, options.onError);
+        this.readers = new MessageReadersClient({ appId: scope.appId, profileId: scope.profileId, token: options.reading.sessionToken, scope, access: () => this.messages.scopeAccess(), onError: options.onError, hubHttpUrl: options.reading.hubHttpUrl, fetch: options.reading.fetch });
+        this.sender = new DurableChatSender(this.connection, scope, options.onError, { access: () => this.messages.scopeAccess() });
         this.catchUp = new WindowedTasks(1000, error => { if (!this.closed)
             options.onError(error); });
         this.countTasks = new WindowedTasks(50, error => { if (!this.closed)
@@ -66,6 +71,8 @@ export class ChatSession {
             window.addEventListener("focus", wake);
             this.off.push(() => { window.removeEventListener("online", wake); window.removeEventListener("focus", wake); });
         }
+        this.off.push(this.messages.subscribeAccessRevoked(() => { if (!this.withdrawn && !this.closed)
+            void this.revokeAccess().catch(error => options.onError(error)); }));
         this.off.push(this.messages.subscribeAll(thread => this.publish(thread)));
         this.off.push(this.sender.subscribe(() => this.publishAll()), this.reading.subscribe(() => this.publishAll()));
         this.off.push(this.connection.watchMessages(message => {
@@ -112,21 +119,37 @@ export class ChatSession {
         return this.initializing ??= (async () => {
             await this.sender.initialize();
             this.assertOpen();
-            this.readingStarted = true;
-            await this.reading.start();
+            await this.startReading();
             this.assertOpen();
         })().catch(error => { this.initializing = undefined; throw error; });
     }
+    startReading() {
+        if (this.readingStarted)
+            return Promise.resolve();
+        return this.readingStarting ??= (async () => {
+            const access = await this.messages.scopeAccess();
+            if (!access.allowed)
+                return;
+            this.assertOpen();
+            await this.reading.prepareTeam(this.options.messages.scope.teamId, access.version);
+            await this.reading.start();
+            this.assertOpen();
+            this.readingStarted = true;
+        })().finally(() => { this.readingStarting = undefined; });
+    }
     /** One-time migration only: never establishes trusted history coverage. */
     importLegacyMessages(threadId, messages) { this.assertOpen(); return this.messages.importLegacy(threadId, messages); }
-    getReadingSnapshot() { return this.reading.getSnapshot(); }
+    getReadingSnapshot() { return this.closed || this.withdrawn ? undefined : this.reading.getSnapshot(); }
     subscribeReading(listener) { this.assertOpen(); return this.reading.subscribe(listener); }
     refreshReading() { this.assertOpen(); this.reading.refresh(); }
     synchronizeReading(cursor, profileId) { this.assertOpen(); return this.reading.synchronize(cursor, profileId); }
     /** Explicit text-history acknowledgement; unheard audio stays unread. */
-    markRead(threadId, messages = []) { this.assertOpen(); return this.reading.markRead(threadId, messages); }
-    updateReading(transform) { this.assertOpen(); return this.reading.update(transform); }
-    assertOpen() { if (this.closed)
+    markRead(threadId, messages = []) { this.assertOpen(); return this.reading.markRead(threadId, messages).then(next => { if (this.withdrawn)
+        throw new Error("CHAT_ACCESS_REVOKED"); return next; }); }
+    updateReading(transform) { this.assertOpen(); return this.reading.update(transform).then(next => { if (this.withdrawn)
+        throw new Error("CHAT_ACCESS_REVOKED"); return next; }); }
+    assertOpen() { if (this.withdrawn)
+        throw new Error("CHAT_ACCESS_REVOKED"); if (this.closed)
         throw new Error("CHAT_SESSION_CLOSED"); }
     async getMessages(threadId, options = {}) {
         this.assertOpen();
@@ -145,7 +168,11 @@ export class ChatSession {
             return this.readAll(threadId);
         }
         const page = await (options.before ? this.messages.earlier(threadId, options.before, options.limit) : this.messages.read(threadId, options.limit));
+        this.assertOpen();
         await this.sender.confirm(page.messages.map(message => message.id));
+        if (this.initializing && !this.readingStarted && page.complete)
+            await this.startReading();
+        this.assertOpen();
         const edge = this.historyEdges.get(threadId);
         if (!options.before && page.complete && (!edge || edge.version !== page.resetVersion))
             this.rememberHistoryEdge(threadId, page);
@@ -206,6 +233,7 @@ export class ChatSession {
                 return { messages: pages.reverse().flat(), hasEarlier: false, complete: true, resetVersion: version };
             }
             catch (error) {
+                this.assertOpen();
                 if ([401, 403].includes(error?.status ?? 0))
                     throw error;
                 if (String(error).includes("MESSAGE_PROJECTION_CHANGED"))
@@ -219,7 +247,8 @@ export class ChatSession {
     }
     sendMessage(threadId, input) {
         this.assertOpen();
-        return this.sender.enqueue(threadId, input);
+        return this.sender.enqueue(threadId, input).then(next => { if (this.withdrawn)
+            throw new Error("CHAT_ACCESS_REVOKED"); return next; });
     }
     async getReaders(threadId, messageId, page = {}, signal) {
         this.assertOpen();
@@ -245,7 +274,7 @@ export class ChatSession {
         }
         if (!threadId)
             throw new Error("INVALID_READING_THREAD");
-        return event === "played" ? this.reading.recordExplicit(threadId, ids) : this.reading.recordVisible(threadId, ids);
+        return (event === "played" ? this.reading.recordExplicit(threadId, ids) : this.reading.recordVisible(threadId, ids)).then(next => { this.assertOpen(); return next; });
     }
     /** Bridge transports can delegate social events without maintaining clients. */
     async handleReach(event) {
@@ -285,6 +314,8 @@ export class ChatSession {
         this.listeners.get(thread)?.forEach(listener => listener());
     }
     publishCounts(value) {
+        if (this.closed || this.withdrawn)
+            return;
         const previous = this.countSnapshots.get(value.threadId);
         if ((previous && previous.revision > value.revision) || JSON.stringify(previous) === JSON.stringify(value))
             return;
@@ -311,13 +342,13 @@ export class ChatSession {
                 this.countClosings.add(closing);
             }
             const scope = this.options.messages.scope;
-            const client = new ReadCountsClient({ appId: scope.appId, profileId: scope.profileId, scope, token: this.options.reading.sessionToken, clientInstanceId: receiver, hubHttpUrl: this.options.reading.hubHttpUrl, fetch: this.options.reading.fetch,
+            const client = new ReadCountsClient({ appId: scope.appId, profileId: scope.profileId, scope, access: () => this.messages.scopeAccess(), token: this.options.reading.sessionToken, clientInstanceId: receiver, hubHttpUrl: this.options.reading.hubHttpUrl, fetch: this.options.reading.fetch,
                 onChange: value => { if (!this.closed && this.counts === client)
                     this.publishCounts(value); },
                 onError: error => {
                     if (this.closed || this.counts !== client)
                         return;
-                    if (/READ_COUNTS_HTTP_(401|403)/.test(String(error))) {
+                    if (/READ_COUNTS_HTTP_(401|403)|RESPONSE_CACHE_(ACCESS_REVOKED|SCOPE_CHANGED|INVALIDATED)/.test(String(error))) {
                         const threads = [...this.countSnapshots.keys()];
                         this.countSnapshots.clear();
                         threads.forEach(thread => this.publishCountSnapshot(thread));
@@ -331,6 +362,11 @@ export class ChatSession {
         this.counts.watch(threadId, ids);
     }
     getSnapshot(threadId) {
+        if (this.closed || this.withdrawn) {
+            if (threadId === undefined)
+                return this.closedSummary;
+            return this.closedThread;
+        }
         if (threadId === undefined) {
             if (!this.globalSnapshot)
                 this.globalSnapshot = this.buildGlobal();
@@ -377,6 +413,8 @@ export class ChatSession {
         };
     }
     publishAll() {
+        if (this.closed || this.withdrawn)
+            return;
         for (const threadId of [...this.snapshots.keys()])
             this.publish(threadId, false);
         this.publishGlobal();
@@ -397,6 +435,8 @@ export class ChatSession {
         return { threads, unreadMessageCount: known ? threads.reduce((sum, t) => sum + (t.unread?.unreadMessageCount ?? 0), 0) : undefined, badgeCount: known ? threads.reduce((sum, t) => sum + (t.unread?.badgeCount ?? 0), 0) : undefined, connection: this.connectionState };
     }
     publishGlobal() {
+        if (this.closed || this.withdrawn)
+            return;
         const next = this.buildGlobal();
         if (JSON.stringify(next) === JSON.stringify(this.globalSnapshot))
             return;
@@ -415,7 +455,67 @@ export class ChatSession {
         if (notifyGlobal)
             this.publishGlobal();
     }
-    close() {
+    /** Permanently retire this identity/team session. UI withdrawal is immediate;
+     * completion means all durable stores have crossed the same authority epoch. */
+    revokeAccess() {
+        if (this.revoking)
+            return this.revoking;
+        if (this.closed)
+            return Promise.reject(new Error("CHAT_SESSION_CLOSED"));
+        this.withdrawn = true;
+        const knownThreads = [...new Set([...this.snapshots.keys(), ...this.historyEdges.keys()])];
+        this.catchUp.close();
+        this.countTasks.close();
+        this.off.splice(0).forEach(off => off());
+        this.sender.withdraw();
+        this.reading.withdraw();
+        this.readers.withdraw();
+        this.counts?.watch(undefined, []);
+        this.countSnapshots.clear();
+        this.snapshots.clear();
+        this.historyEdges.clear();
+        this.earlierReads.clear();
+        this.globalSnapshot = undefined;
+        this.listeners.forEach(listeners => listeners.forEach(listener => listener()));
+        this.globalListeners.forEach(listener => listener());
+        if (!this.options.sharedConnection)
+            this.connection.close();
+        return this.revoking = Promise.resolve().then(async () => {
+            const failures = [];
+            let version;
+            try {
+                version = await this.messages.revokeScope();
+            }
+            catch (error) {
+                failures.push(error);
+                version = 1;
+                try {
+                    version = Math.max(1, (await this.messages.scopeAccess()).version);
+                }
+                catch (failure) {
+                    failures.push(failure);
+                }
+            }
+            const results = await Promise.allSettled([
+                this.sender.revoke(version),
+                this.reading.revokeTeam(this.options.messages.scope.teamId, version, knownThreads),
+                this.readers.retireScope(version), this.counts?.retireScope(version),
+            ]);
+            for (const result of results)
+                if (result.status === "rejected")
+                    failures.push(result.reason);
+            try {
+                await this.dispose();
+            }
+            catch (error) {
+                failures.push(error);
+            }
+            if (failures.length)
+                throw new AggregateError(failures, "CHAT_ACCESS_CLEANUP_FAILED");
+        });
+    }
+    close() { return this.revoking ?? this.dispose(); }
+    dispose() {
         return this.closing ??= (async () => {
             this.closed = true;
             this.catchUp.close();
@@ -423,14 +523,22 @@ export class ChatSession {
             this.off.splice(0).forEach(off => off());
             if (!this.options.sharedConnection)
                 this.connection.close();
-            await Promise.all([this.counts?.close(), ...this.countClosings, this.readers.close(), this.sender.close(), this.reading.close(), this.messages.close()]);
-            this.listeners.clear();
-            this.globalListeners.clear();
-            this.snapshots.clear();
-            this.countSnapshots.clear();
-            this.historyEdges.clear();
-            this.earlierReads.clear();
-            this.globalSnapshot = undefined;
+            const senderClosing = this.sender.close();
+            try {
+                const results = await Promise.allSettled([this.counts?.close(), ...this.countClosings, this.readers.close(), senderClosing, this.reading.close(), this.messages.close(senderClosing)]);
+                const failed = results.find((result) => result.status === "rejected");
+                if (failed)
+                    throw failed.reason;
+            }
+            finally {
+                this.listeners.clear();
+                this.globalListeners.clear();
+                this.snapshots.clear();
+                this.countSnapshots.clear();
+                this.historyEdges.clear();
+                this.earlierReads.clear();
+                this.globalSnapshot = undefined;
+            }
         })();
     }
 }

package/lib/runtime/durableSender.d.ts

@@ -8,13 +8,30 @@ export type OutgoingMessage = {
     message: ChatRuntimeMessage;
     status: "sending" | "failed" | "sent";
     confirmed?: boolean;
+    accessVersion?: number;
+};
+export type SenderScopeAccess = {
+    version: number;
+    allowed: boolean;
+};
+export type DurableSenderOptions = {
+    indexedDB?: IDBFactory;
+    name?: string;
+    access?: () => Promise<SenderScopeAccess>;
 };
 /** Persists the exact wire message before sending; retries preserve its hash. */
 export declare class DurableChatSender {
     private client;
     private onError;
+    private options;
     private db;
     private outbox;
+    private epochs;
+    private version;
+    private withdrawn;
+    private revoking?;
+    private channel?;
+    private accepted;
     private scope;
     private identity;
     private values;
@@ -22,12 +39,19 @@ export declare class DurableChatSender {
     private listeners;
     private running;
     private closed;
+    private closing;
+    private empty;
     private offConnection;
     private ready;
-    constructor(client: ChatClient, scope: MessageScope, onError: (error: unknown) => void, options?: {
-        indexedDB?: IDBFactory;
-        name?: string;
-    });
+    constructor(client: ChatClient, scope: MessageScope, onError: (error: unknown) => void, options?: DurableSenderOptions);
+    private readAccess;
+    private restore;
+    private checkAccess;
+    private withEpoch;
+    private deleteRows;
+    /** Stop disclosure immediately; durable invalidation is coordinated separately. */
+    withdraw(): void;
+    revoke(targetVersion?: number): Promise<void>;
     initialize(): Promise<void>;
     subscribe(listener: () => void): () => void;
     snapshot(threadId?: string): readonly OutgoingMessage[];