@pmate/chat-sdk 0.12.0-next.4 → 0.12.0-next.40

package/lib/runtime/messageClient.js

@@ -1,3 +1,4 @@
+import { isOffline, isOfflineNetworkFailure } from "./connectivity.js";
 import { WindowedTasks } from "./coalescer.js";
 import { IndexedDbMessageStore, messageScopeKey, mergeStoredMessage } from "./messageStore.js";
 /** Local-first message facade; hosts never select a cache or network source. */
@@ -5,6 +6,9 @@ export class MessageClient {
     options;
     storage;
     watches = new Map();
+    windowEdges = new Map();
+    accessListeners = new Set();
+    allListeners = new Set();
     reads = new Map();
     syncing = new Map();
     paging = new Map();
@@ -22,6 +26,16 @@ export class MessageClient {
     queueBytes;
     pendingBytes = 0;
     pendingRecords = 0;
+    legacyImports = 0;
+    revokingScope;
+    scopeReady;
+    scopeVersion = 0;
+    scopeAllowed = true;
+    scopeDenied = false;
+    enqueuing = new Set();
+    ensureScope() {
+        return this.scopeReady ??= this.storage.scopeAccess().then(access => { this.scopeVersion = access.version; this.scopeAllowed = !access.revoked && !this.scopeDenied; });
+    }
     constructor(options) {
         this.options = options;
         this.storage = options.storage ?? new IndexedDbMessageStore(options.scope, options.merge ?? mergeStoredMessage);
@@ -32,40 +46,154 @@ export class MessageClient {
             throw new Error("INVALID_MESSAGE_BYTE_LIMIT");
         if (!Number.isSafeInteger(this.batchSize) || this.batchSize < 1 || this.batchSize > 1000)
             throw new Error("INVALID_MESSAGE_BATCH_SIZE");
-        this.writeTasks = new WindowedTasks(options.writeWindowMs ?? 16, (error, thread) => options.onError?.(error, thread));
-        this.syncTasks = new WindowedTasks(options.syncWindowMs ?? 1000, (error, thread) => options.onError?.(error, thread));
+        this.writeTasks = new WindowedTasks(options.writeWindowMs ?? 16, (error, thread) => { if (String(error).includes("MESSAGE_PROJECTION_CHANGED"))
+            this.invalidate(thread);
+        else
+            options.onError?.(error, thread); });
+        this.syncTasks = new WindowedTasks(options.syncWindowMs ?? 1000, (error, thread) => { if (!isOfflineNetworkFailure(error))
+            options.onError?.(error, thread); });
         if (typeof BroadcastChannel !== "undefined") {
-            this.channel = new BroadcastChannel(`pmate-chat:${messageScopeKey(options.scope)}`);
-            this.channel.onmessage = event => { if (typeof event.data === "string" && this.watches.has(event.data))
-                void this.reload(event.data).catch(error => options.onError?.(error, event.data)); };
+            this.channel = new BroadcastChannel(`pmate-chat:${messageScopeKey(options.scope)}${this.storage.namespace === "pmate-chat-messages" ? "" : `:${this.storage.namespace}`}`);
+            this.channel.onmessage = event => {
+                if (this.closed)
+                    return;
+                if (event.data?.type === "scope-revoked" && Number.isSafeInteger(event.data.version)) {
+                    const version = event.data.version;
+                    void this.ensureScope().then(async () => {
+                        const current = await this.storage.scopeAccess();
+                        if (!this.closed && (this.scopeVersion < version || current.revoked)) {
+                            this.denyScope();
+                            options.onError?.(accessRevoked(), "");
+                        }
+                    }).catch(error => options.onError?.(error, ""));
+                }
+                else if (event.data?.type === "revoked" && typeof event.data.thread === "string" && Number.isSafeInteger(event.data.version)) {
+                    const denied = event.data;
+                    void (async () => {
+                        const current = await this.storage.read(denied.thread, 1).then(page => page.coverage).catch(() => undefined);
+                        if ((current?.scopeVersion ?? 0) !== (denied.scopeVersion ?? 0))
+                            return;
+                        if (this.closed || (current && !current.revoked && (current.resetVersion ?? 0) >= denied.version))
+                            return;
+                        this.denyView(denied.thread, denied.version);
+                        options.onError?.(accessRevoked(), denied.thread);
+                    })();
+                }
+                else if (event.data?.type === "legacy" && typeof event.data.thread === "string" && this.watches.has(event.data.thread)) {
+                    const thread = event.data.thread;
+                    void this.storage.read(thread, 1).then(page => this.reload(thread, !page.coverage?.complete)).catch(error => { if (!this.closed)
+                        options.onError?.(error, thread); });
+                }
+                else if (typeof event.data === "string" && this.watches.has(event.data))
+                    void this.reload(event.data).catch(error => { if (!this.closed)
+                        options.onError?.(error, event.data); });
+            };
         }
     }
+    /** Shared guard for sibling caches; it never authorizes a denied old instance. */
+    subscribeAccessRevoked(listener) { this.accessListeners.add(listener); return () => { this.accessListeners.delete(listener); }; }
+    async scopeAccess() {
+        await this.ensureScope();
+        if (this.closed)
+            return { version: this.scopeVersion, allowed: false };
+        const current = await this.storage.scopeAccess();
+        return { version: current.version, allowed: !this.scopeDenied && !current.revoked && current.version === this.scopeVersion };
+    }
     getSnapshot(thread) { return this.watches.get(thread)?.snapshot; }
     subscribe(thread, listener) {
         let watch = this.watches.get(thread);
         if (!watch) {
-            watch = { snapshot: { messages: [], hasEarlier: false }, listeners: new Set() };
+            watch = { snapshot: { messages: [], hasEarlier: false, resetVersion: 0, complete: false }, listeners: new Set() };
             this.watches.set(thread, watch);
         }
         watch.listeners.add(listener);
         return () => { watch.listeners.delete(listener); };
     }
-    read(thread, limit = 100) {
-        if (this.closed || this.closing || this.revoked.has(thread))
+    subscribeAll(listener) { this.allListeners.add(listener); return () => { this.allListeners.delete(listener); }; }
+    /** Close the connection gap for saved windows with four bounded background lanes. */
+    async restore(since, threadId) {
+        if (this.closed || this.closing || this.scopeDenied || isOffline())
+            return;
+        const queue = (await this.storage.windows()).filter(window => (window.syncedAt ?? 0) < since && !window.revoked && (threadId === undefined || window.thread === threadId));
+        await Promise.all(Array.from({ length: Math.min(4, queue.length) }, async () => {
+            while (queue.length && !this.closed && !this.closing && !this.scopeDenied && !isOffline()) {
+                const window = queue.shift();
+                try {
+                    await this.synchronize(window.thread);
+                }
+                catch (error) {
+                    if (!this.closed && !this.closing && !isOfflineNetworkFailure(error))
+                        this.options.onError?.(error, window.thread);
+                }
+            }
+        }));
+    }
+    read(thread, limit = 100, refresh = false) {
+        if (this.closed || this.closing)
             return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
         if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000)
             return Promise.reject(new Error("INVALID_MESSAGE_LIMIT"));
-        const key = JSON.stringify([thread, limit]), running = this.reads.get(key);
+        const key = JSON.stringify([thread, limit, refresh]), running = this.reads.get(key);
         if (running)
             return running;
         const task = (async () => {
+            await this.ensureScope();
+            if (this.scopeDenied)
+                throw accessRevoked();
             const local = await this.storage.read(thread, limit);
-            if (!local.coverage?.complete)
-                await this.synchronize(thread);
+            if ((local.coverage?.scopeVersion ?? 0) !== this.scopeVersion) {
+                this.denyScope();
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            }
+            if (refresh || !local.coverage?.complete || local.coverage.revoked || this.revoked.has(thread)) {
+                if (typeof navigator !== "undefined" && navigator.onLine === false) {
+                    if (!refresh && !local.coverage?.revoked) {
+                        const fallback = await this.fallback(thread, limit);
+                        if (fallback.messages.length)
+                            return fallback;
+                    }
+                    throw new Error("MESSAGE_OFFLINE_UNAVAILABLE");
+                }
+                this.revoked.delete(thread);
+                try {
+                    await this.synchronize(thread);
+                }
+                catch (error) {
+                    if (String(error).includes("MESSAGE_SCOPE_CHANGED")) {
+                        this.denyScope();
+                        throw error;
+                    }
+                    if (refresh || [401, 403].includes(error?.status ?? 0))
+                        throw error;
+                    const fallback = await this.fallback(thread, limit);
+                    if (!fallback.messages.length)
+                        throw error;
+                    this.options.onError?.(error, thread);
+                    return fallback;
+                }
+            }
             if (this.closed)
                 throw new Error("MESSAGE_CLIENT_CLOSED");
-            const result = await this.fillWindow(thread, limit);
+            let result;
+            try {
+                result = await this.fillWindow(thread, limit);
+            }
+            catch (error) {
+                if (String(error).includes("MESSAGE_SCOPE_CHANGED")) {
+                    this.denyScope();
+                    throw error;
+                }
+                if ([401, 403].includes(error?.status ?? 0))
+                    throw error;
+                const cached = await this.fallback(thread, limit);
+                if (!cached.messages.length)
+                    throw error;
+                this.options.onError?.(error, thread);
+                return cached;
+            }
             const snapshot = await this.reload(thread);
+            if (this.scopeDenied || this.revoked.has(thread))
+                throw accessRevoked();
             if (local.coverage?.complete && Date.now() - (local.coverage.syncedAt ?? 0) > (this.options.freshnessMs ?? 30_000)
                 && (typeof navigator === "undefined" || navigator.onLine !== false))
                 this.invalidate(thread);
@@ -77,14 +205,89 @@ export class MessageClient {
     }
     /** Application connection/wake events invalidate, rather than fetching directly. */
     invalidate(thread) {
-        if (!this.closed && !this.closing && !this.revoked.has(thread))
-            this.syncTasks.schedule(thread, () => this.synchronize(thread));
+        if (!this.closed && !this.closing && !this.scopeDenied && !isOffline() && !this.revoked.has(thread))
+            this.syncTasks.schedule(thread, async () => {
+                if (!isOffline())
+                    await this.synchronize(thread);
+            });
+    }
+    async fallback(thread, limit, before) {
+        await this.ensureScope();
+        if (this.scopeDenied || this.revoked.has(thread))
+            throw accessRevoked();
+        const page = await this.storage.readFallback(thread, limit, before);
+        if ((page.coverage?.scopeVersion ?? 0) !== this.scopeVersion) {
+            this.denyScope();
+            throw new Error("MESSAGE_SCOPE_CHANGED");
+        }
+        if (!before && page.messages.length)
+            await this.reload(thread, true);
+        return { messages: page.messages, hasEarlier: true, complete: false, resetVersion: page.coverage?.resetVersion ?? 0 };
     }
-    async reload(thread) {
+    /** Migration batches remain separate from authoritative message coverage. */
+    importLegacy(thread, messages) {
+        if (this.closed || this.closing)
+            return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
+        if (messages.length > 128)
+            return Promise.reject(new Error("MESSAGE_BATCH_TOO_LARGE"));
+        if (this.legacyImports >= 4)
+            return Promise.reject(new Error("MESSAGE_STORAGE_BACKPRESSURE"));
+        let records;
+        try {
+            let bytes = 0;
+            for (const message of messages) {
+                bytes += this.messageBytes(message);
+                if (bytes > Math.min(this.transactionBytes, 1_048_576))
+                    throw new Error("MESSAGE_BATCH_TOO_LARGE");
+            }
+            records = structuredClone(messages);
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        this.legacyImports++;
+        const task = this.storage.importLegacy(thread, records).then(async () => {
+            const page = await this.storage.read(thread, 1);
+            await this.reload(thread, !page.coverage?.complete);
+            this.channel?.postMessage({ type: "legacy", thread });
+        }).finally(() => { this.legacyImports--; this.activeWrites.delete(task); });
+        this.activeWrites.add(task);
+        return task;
+    }
+    async reload(thread, fallback = false) {
+        await this.ensureScope();
         const limit = 100;
-        const page = await this.storage.read(thread, limit);
+        let page = await (fallback ? this.storage.readFallback(thread, limit) : this.storage.read(thread, limit));
+        const edge = this.windowEdges.get(thread);
+        if (edge && edge.version !== (page.coverage?.resetVersion ?? 0))
+            this.windowEdges.delete(thread);
+        if (edge && edge.version === (page.coverage?.resetVersion ?? 0)) {
+            const pages = [page.messages];
+            const beforeEdge = (message) => message.timestamp < edge.timestamp || message.timestamp === edge.timestamp && message.id < edge.id;
+            let oldest = page.messages[0];
+            while (oldest && !beforeEdge(oldest) && (oldest.timestamp !== edge.timestamp || oldest.id !== edge.id) && page.hasEarlier) {
+                const next = await (fallback ? this.storage.readFallback(thread, limit, { timestamp: oldest.timestamp, id: oldest.id }) : this.storage.read(thread, limit, { timestamp: oldest.timestamp, id: oldest.id }));
+                if ((next.coverage?.resetVersion ?? 0) !== edge.version || (next.coverage?.scopeVersion ?? 0) !== (page.coverage?.scopeVersion ?? 0)) {
+                    this.windowEdges.delete(thread);
+                    return this.reload(thread, fallback);
+                }
+                pages.push(next.messages);
+                page = next;
+                oldest = next.messages[0];
+            }
+            const messages = pages.reverse().flat();
+            page = { ...page, messages: messages.filter(message => !beforeEdge(message)), hasEarlier: page.hasEarlier || messages.some(beforeEdge) };
+        }
         if (this.closed)
             throw new Error("MESSAGE_CLIENT_CLOSED");
+        if ((page.coverage?.scopeVersion ?? 0) !== this.scopeVersion) {
+            this.denyScope();
+            throw new Error("MESSAGE_SCOPE_CHANGED");
+        }
+        if (this.scopeDenied || this.revoked.has(thread)) {
+            page.messages = [];
+            page.hasEarlier = false;
+        }
         let watch = this.watches.get(thread);
         const oldById = new Map(watch?.snapshot.messages.map(message => [message.id, message]));
         const messages = page.messages.map(message => {
@@ -92,22 +295,26 @@ export class MessageClient {
             return old && JSON.stringify(old) === JSON.stringify(message) ? old : message;
         });
         const old = watch?.snapshot;
-        if (old && old.hasEarlier === (page.hasEarlier || Boolean(page.coverage?.nextBefore)) && old.messages.length === messages.length && old.messages.every((message, index) => message === messages[index]))
+        const resetVersion = Math.max(page.coverage?.resetVersion ?? 0, this.revoked.has(thread) ? watch?.snapshot.resetVersion ?? 0 : 0), complete = !fallback && !this.scopeDenied && !this.revoked.has(thread) && (page.coverage?.complete ?? false);
+        const hasEarlier = !this.revoked.has(thread) && (page.hasEarlier || Boolean(page.coverage?.nextBefore));
+        if (old && old.resetVersion === resetVersion && old.complete === complete && old.hasEarlier === hasEarlier && old.messages.length === messages.length && old.messages.every((message, index) => message === messages[index]))
             return old;
-        const snapshot = { messages, hasEarlier: page.hasEarlier || Boolean(page.coverage?.nextBefore) };
+        const snapshot = { messages, resetVersion, complete, hasEarlier };
         if (!watch) {
             watch = { snapshot, listeners: new Set() };
             this.watches.set(thread, watch);
         }
         watch.snapshot = snapshot;
         watch.listeners.forEach(listener => listener());
+        this.allListeners.forEach(listener => listener(thread));
         return snapshot;
     }
     /** Events are visible only after their atomic batch commits. */
     receive(thread, messages) {
-        if (this.closed || this.closing || this.revoked.has(thread))
+        if (this.closed || this.closing)
             return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
-        const queue = this.writes.get(thread) ?? [];
+        if (this.revoked.has(thread))
+            return Promise.reject(accessRevoked());
         if (messages.length > 1000 || this.pendingRecords + messages.length > 4096)
             return Promise.reject(new Error("MESSAGE_STORAGE_BACKPRESSURE"));
         let bytes = 0;
@@ -124,12 +331,25 @@ export class MessageClient {
         }
         this.pendingBytes += bytes;
         this.pendingRecords += messages.length;
-        const promise = new Promise((resolve, reject) => queue.push({ messages, bytes, resolve, reject }));
-        this.writes.set(thread, queue);
-        this.writeTasks.schedule(thread, () => this.flushWrites(thread));
-        return promise;
+        let resolve, reject;
+        const committed = new Promise((yes, no) => { resolve = yes; reject = no; });
+        const enqueue = this.ensureScope().then(() => {
+            if (this.closed || this.scopeDenied)
+                throw accessRevoked();
+            if (!this.scopeAllowed)
+                throw new Error("MESSAGE_SCOPE_NOT_READY");
+            const queue = this.writes.get(thread) ?? [];
+            queue.push({ messages, bytes, version: this.watches.get(thread)?.snapshot.resetVersion ?? 0, scopeVersion: this.scopeVersion, resolve, reject });
+            this.writes.set(thread, queue);
+            this.writeTasks.schedule(thread, () => this.flushWrites(thread));
+        }).catch(error => { this.pendingBytes -= bytes; this.pendingRecords -= messages.length; reject(error); }).finally(() => this.enqueuing.delete(enqueue));
+        this.enqueuing.add(enqueue);
+        return committed;
     }
-    async persist(thread, messages, checkpoint, complete, nextBefore, syncedAt) {
+    async persist(thread, messages, checkpoint, complete, nextBefore, syncedAt, expectedVersion, expectedScopeVersion) {
+        const initial = (await this.storage.read(thread, 1)).coverage;
+        const version = expectedVersion ?? initial?.resetVersion ?? 0;
+        const guard = { version, scopeVersion: expectedScopeVersion ?? this.scopeVersion, authoritative: complete === true };
         let changed = 0;
         let navigationChanged = false;
         // Coverage advances only after all bounded batches have durably committed.
@@ -137,9 +357,9 @@ export class MessageClient {
         const commit = async () => {
             if (!batch.length)
                 return;
-            if (this.closed || this.revoked.has(thread))
+            if (this.closed || this.scopeDenied || this.revoked.has(thread))
                 throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
-            changed += await this.storage.commit(thread, batch);
+            changed += await this.storage.commit(thread, batch, undefined, guard);
             batch = [];
             bytes = 0;
         };
@@ -153,11 +373,13 @@ export class MessageClient {
         await commit();
         if (complete !== undefined || checkpoint !== undefined) {
             const old = (await this.storage.read(thread, 1)).coverage;
-            if (this.closed || this.revoked.has(thread))
+            if (this.closed || this.scopeDenied || this.revoked.has(thread))
                 throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
-            navigationChanged = nextBefore !== undefined && nextBefore !== old?.nextBefore;
-            await this.storage.commit(thread, [], { syncedAt: syncedAt ?? old?.syncedAt, complete: complete ?? old?.complete ?? false, checkpoint: checkpoint ?? old?.checkpoint, nextBefore: nextBefore === undefined ? old?.nextBefore : nextBefore });
+            navigationChanged = (nextBefore !== undefined && nextBefore !== old?.nextBefore) || (complete !== undefined && complete !== old?.complete);
+            await this.storage.commit(thread, [], { resetVersion: version, revoked: complete === true ? false : old?.revoked, syncedAt: syncedAt ?? old?.syncedAt, complete: complete ?? old?.complete ?? false, checkpoint: checkpoint ?? old?.checkpoint, nextBefore: nextBefore === undefined ? old?.nextBefore : nextBefore }, guard);
         }
+        if (complete === true)
+            this.scopeAllowed = true;
         if (changed || navigationChanged) {
             await this.reload(thread);
             this.channel?.postMessage(thread);
@@ -186,42 +408,63 @@ export class MessageClient {
             return;
         this.writes.delete(thread);
         try {
-            await this.persist(thread, queue.flatMap(write => write.messages));
-            queue.forEach(write => write.resolve());
-        }
-        catch (error) {
-            queue.forEach(write => write.reject(error));
-            throw error;
+            const groups = new Map();
+            for (const write of queue) {
+                const key = `${write.version}:${write.scopeVersion}`, group = groups.get(key) ?? [];
+                group.push(write);
+                groups.set(key, group);
+            }
+            let failed = false, failure;
+            for (const writes of groups.values()) {
+                try {
+                    await this.persist(thread, writes.flatMap(write => write.messages), undefined, undefined, undefined, undefined, writes[0].version, writes[0].scopeVersion);
+                    writes.forEach(write => write.resolve());
+                }
+                catch (error) {
+                    failed = true;
+                    failure = error;
+                    writes.forEach(write => write.reject(error));
+                }
+            }
+            if (failed)
+                throw failure;
         }
         finally {
             this.release(queue);
         }
     }
     synchronize(thread) {
-        if (this.closed || this.closing || this.revoked.has(thread))
+        if (this.closed || this.closing || this.scopeDenied || this.revoked.has(thread))
             return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
         const running = this.syncing.get(thread);
         if (running)
             return running;
         const task = (async () => {
+            await this.ensureScope();
             const coverage = (await this.storage.read(thread, 1)).coverage;
+            const scopeVersion = coverage?.scopeVersion ?? 0;
+            if (scopeVersion !== this.scopeVersion) {
+                this.denyScope();
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            }
+            let version = coverage?.resetVersion ?? 0;
             let after = coverage?.complete ? coverage.checkpoint : undefined;
             let page = after && this.options.transport.changes
                 ? await this.options.transport.changes(thread, after, this.abort.signal)
                 : await this.options.transport.load(thread, this.abort.signal);
             if (page.resetRequired) {
-                if (this.closed || this.revoked.has(thread))
+                if (this.closed || this.scopeDenied || this.revoked.has(thread))
                     throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
-                await this.storage.removeThread(thread);
+                version = await this.storage.resetThread(thread, false, scopeVersion);
                 after = undefined;
                 page = await this.options.transport.load(thread, this.abort.signal);
             }
             for (;;) {
-                if (this.closed || this.revoked.has(thread))
-                    throw new Error("MESSAGE_ACCESS_REVOKED");
+                if (this.closed || this.scopeDenied || this.revoked.has(thread))
+                    throw accessRevoked();
                 if (page.resetRequired)
                     throw new Error("MESSAGE_SYNC_RESET_REQUIRED");
-                await this.persist(thread, page.messages, page.checkpoint, true, after ? undefined : page.nextBefore, Date.now());
+                await this.persist(thread, page.messages, page.checkpoint, true, after ? undefined : page.nextBefore, Date.now(), version, scopeVersion);
                 if (!page.hasMoreChanges)
                     break;
                 if (!page.checkpoint || page.checkpoint === after || !this.options.transport.changes)
@@ -229,22 +472,71 @@ export class MessageClient {
                 after = page.checkpoint;
                 page = await this.options.transport.changes(thread, after, this.abort.signal);
             }
-        })().finally(() => { if (this.syncing.get(thread) === task)
+        })().catch(async (error) => {
+            if (String(error).includes("MESSAGE_SCOPE_CHANGED"))
+                this.denyScope();
+            if (!this.closed && !this.closing && error?.status === 403) {
+                try {
+                    await this.revoke(thread);
+                }
+                catch (cacheError) {
+                    Object.assign(error, { cacheError });
+                }
+            }
+            throw error;
+        }).finally(() => { if (this.syncing.get(thread) === task)
             this.syncing.delete(thread); });
         this.syncing.set(thread, task);
         return task;
     }
-    async earlier(thread, before, limit = 100) {
+    /** Keep an explicitly requested history range in the shared subscribed view. */
+    async expandWindow(thread, page) {
+        const first = page.messages[0];
+        if (!first || !page.complete)
+            return;
+        const old = this.windowEdges.get(thread);
+        if (!old || old.version !== page.resetVersion || first.timestamp < old.timestamp || first.timestamp === old.timestamp && first.id < old.id)
+            this.windowEdges.set(thread, { timestamp: first.timestamp, id: first.id, version: page.resetVersion });
+        const snapshot = await this.reload(thread);
+        if (snapshot.resetVersion !== page.resetVersion)
+            throw new Error("MESSAGE_PROJECTION_CHANGED");
+    }
+    async earlier(thread, before, limit = 100, expand = false) {
+        await this.ensureScope();
+        if (this.scopeDenied)
+            throw accessRevoked();
         if (this.closed)
             throw new Error("MESSAGE_CLIENT_CLOSED");
         if (this.revoked.has(thread))
-            throw new Error("MESSAGE_ACCESS_REVOKED");
-        if (!(await this.storage.read(thread, 1)).coverage?.complete)
-            await this.synchronize(thread);
-        return this.fillWindow(thread, limit, before);
+            throw accessRevoked();
+        try {
+            if (!(await this.storage.read(thread, 1)).coverage?.complete) {
+                if (typeof navigator !== "undefined" && navigator.onLine === false)
+                    throw new Error("MESSAGE_OFFLINE_UNAVAILABLE");
+                await this.synchronize(thread);
+            }
+            const page = await this.fillWindow(thread, limit, before);
+            if (expand)
+                await this.expandWindow(thread, page);
+            return page;
+        }
+        catch (error) {
+            if (String(error).includes("MESSAGE_SCOPE_CHANGED")) {
+                this.denyScope();
+                throw error;
+            }
+            if ([401, 403].includes(error?.status ?? 0))
+                throw error;
+            const fallback = await this.fallback(thread, limit, before);
+            if (!fallback.messages.length)
+                throw error;
+            this.options.onError?.(error, thread);
+            return fallback;
+        }
     }
     async fillWindow(thread, limit, before) {
         let page = await this.storage.read(thread, limit, before);
+        let resets = 0;
         while (page.messages.length < limit && page.coverage?.nextBefore && this.options.transport.older) {
             const pending = this.paging.get(thread);
             if (pending) {
@@ -252,49 +544,129 @@ export class MessageClient {
                 page = await this.storage.read(thread, limit, before);
                 continue;
             }
-            const token = page.coverage.nextBefore;
+            const token = page.coverage.nextBefore, version = page.coverage.resetVersion ?? 0, scopeVersion = page.coverage.scopeVersion ?? 0;
             const task = (async () => {
                 const remote = await this.options.transport.older(thread, token, this.abort.signal);
-                if (this.closed || this.revoked.has(thread))
+                if (this.closed || this.scopeDenied || this.revoked.has(thread))
                     throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
                 if (remote.resetRequired) {
-                    await this.storage.removeThread(thread);
-                    throw new Error("MESSAGE_SYNC_RESET_REQUIRED");
+                    if (++resets > 2)
+                        throw new Error("MESSAGE_SYNC_RESET_REQUIRED");
+                    await this.storage.resetThread(thread, false, scopeVersion);
+                    await this.synchronize(thread);
+                    return;
                 }
                 if (remote.nextBefore === token)
                     throw new Error("MESSAGE_SYNC_NO_PROGRESS");
-                await this.persist(thread, remote.messages, undefined, true, remote.nextBefore ?? null);
-            })().finally(() => { if (this.paging.get(thread) === task)
+                await this.persist(thread, remote.messages, undefined, true, remote.nextBefore ?? null, undefined, version, scopeVersion);
+            })().catch(async (error) => {
+                if (!this.closed && !this.closing && error?.status === 403) {
+                    try {
+                        await this.revoke(thread);
+                    }
+                    catch (cacheError) {
+                        Object.assign(error, { cacheError });
+                    }
+                }
+                throw error;
+            }).finally(() => { if (this.paging.get(thread) === task)
                 this.paging.delete(thread); });
             this.paging.set(thread, task);
             await task;
             page = await this.storage.read(thread, limit, before);
         }
-        return { messages: page.messages, hasEarlier: page.hasEarlier || Boolean(page.coverage?.nextBefore) };
+        if (this.scopeDenied || this.revoked.has(thread))
+            throw accessRevoked();
+        return { messages: page.messages, hasEarlier: page.hasEarlier || Boolean(page.coverage?.nextBefore), resetVersion: page.coverage?.resetVersion ?? 0, complete: page.coverage?.complete ?? false };
     }
-    async revoke(thread) {
+    denyView(thread, version) {
+        this.windowEdges.delete(thread);
         this.revoked.add(thread);
+        const watch = this.watches.get(thread);
+        const snapshot = { messages: [], hasEarlier: false, complete: false, resetVersion: Math.max(watch?.snapshot.resetVersion ?? 0, version ?? (watch?.snapshot.resetVersion ?? 0) + 1) };
+        if (watch && !watch.snapshot.messages.length && !watch.snapshot.complete && !watch.snapshot.hasEarlier && watch.snapshot.resetVersion === snapshot.resetVersion)
+            return;
+        if (watch) {
+            watch.snapshot = snapshot;
+            watch.listeners.forEach(listener => listener());
+        }
+        else
+            this.watches.set(thread, { snapshot, listeners: new Set() });
+        this.allListeners.forEach(listener => listener(thread));
+    }
+    denyScope() {
+        const notify = !this.scopeDenied;
+        this.scopeDenied = true;
+        this.scopeAllowed = false;
+        this.abort.abort();
+        this.syncTasks.close();
+        this.writeTasks.close();
+        for (const thread of this.watches.keys())
+            this.denyView(thread);
+        for (const queue of this.writes.values()) {
+            queue.forEach(write => write.reject(accessRevoked()));
+            this.release(queue);
+        }
+        this.writes.clear();
+        if (notify)
+            this.accessListeners.forEach(listener => listener());
+    }
+    revokeScope() {
+        if (this.closed || this.closing)
+            return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
+        return this.revokingScope ??= (async () => {
+            this.denyScope();
+            try {
+                await this.ensureScope();
+                return await this.storage.revokeScope(this.scopeVersion);
+            }
+            finally {
+                const access = await this.storage.scopeAccess();
+                this.channel?.postMessage({ type: "scope-revoked", version: access.version });
+            }
+        })();
+    }
+    async revoke(thread) {
+        this.denyView(thread);
         const queue = this.writes.get(thread);
         this.writes.delete(thread);
         if (queue) {
-            queue.forEach(write => write.reject(new Error("MESSAGE_ACCESS_REVOKED")));
+            queue.forEach(write => write.reject(accessRevoked()));
             this.release(queue);
         }
-        await this.storage.removeThread(thread);
-        await this.reload(thread);
-        this.channel?.postMessage(thread);
+        try {
+            await this.storage.resetThread(thread, true, this.scopeVersion);
+            await this.reload(thread);
+        }
+        finally {
+            this.channel?.postMessage({ type: "revoked", thread, version: this.watches.get(thread)?.snapshot.resetVersion, scopeVersion: this.scopeVersion });
+        }
     }
-    async close() {
-        // Flush accepted event batches before closing; new requests are rejected afterwards.
+    async close(beforeDispose) {
+        if (this.closed)
+            return;
         this.closing = true;
-        this.syncTasks.close();
-        this.writeTasks.close();
-        await Promise.all([...this.writes.keys()].map(thread => this.flushWrites(thread)));
-        await Promise.all([...this.activeWrites]);
-        this.closed = true;
-        this.abort.abort();
-        this.channel?.close();
-        this.watches.clear();
-        this.storage.close();
+        try {
+            await Promise.all([...this.enqueuing]);
+            this.syncTasks.close();
+            this.writeTasks.close();
+            const flushes = [...this.writes.keys()].map(thread => this.flushWrites(thread));
+            const results = await Promise.allSettled([...flushes, ...this.activeWrites, ...(this.revokingScope ? [this.revokingScope] : [])]);
+            const failed = results.find((result) => result.status === "rejected");
+            if (failed)
+                throw failed.reason;
+            await beforeDispose;
+        }
+        finally {
+            this.closed = true;
+            this.abort.abort();
+            this.channel?.close();
+            this.watches.clear();
+            this.windowEdges.clear();
+            this.allListeners.clear();
+            this.accessListeners.clear();
+            this.storage.close();
+        }
     }
 }
+function accessRevoked() { return Object.assign(new Error("MESSAGE_ACCESS_REVOKED"), { status: 403 }); }