@pmate/chat-sdk 0.12.0-next.4 → 0.12.0-next.40

package/lib/runtime/messageControls.d.ts

@@ -0,0 +1,19 @@
+import type { StoredMessage, MessageScope } from "./messageStore.js";
+export type MessageControl = {
+    scope: string;
+    thread: string;
+    target: string;
+    kind: "recall" | "reaction";
+    actor: string;
+    emoji: string;
+    id: string;
+    timestamp: number;
+    revision: number;
+    active: boolean;
+};
+export type ControlKey = [string, string, string, string, string, string];
+export declare const controlKey: (event: MessageControl) => ControlKey;
+export declare function newerControl(old: MessageControl | undefined, next: MessageControl): MessageControl;
+/** Body-free proofs retained independently of the visible history window. */
+export declare function messageControls(message: StoredMessage, scope: MessageScope, key: string): MessageControl[];
+export declare function applyMessageControls<T extends StoredMessage>(messages: T[], controls: readonly MessageControl[]): T[];

package/lib/runtime/messageControls.js

@@ -0,0 +1,44 @@
+export const controlKey = (event) => [event.scope, event.thread, event.target, event.kind, event.actor, event.emoji];
+export function newerControl(old, next) {
+    return !old || next.revision > old.revision || next.revision === old.revision && (next.timestamp > old.timestamp || next.timestamp === old.timestamp && next.id > old.id) ? next : old;
+}
+const identifier = (value) => typeof value === "string" && value.length > 0 && value.length <= 256;
+/** Body-free proofs retained independently of the visible history window. */
+export function messageControls(message, scope, key) {
+    const row = message;
+    if (row.appId !== undefined && row.appId !== scope.appId || row.teamId !== undefined && row.teamId !== scope.teamId || !identifier(row.from))
+        return [];
+    const apps = row.body;
+    const app = apps?.content?.appId ?? apps?.payload?.appId;
+    if (app !== undefined && app !== scope.appId)
+        return [];
+    if (row.recalled || row.legacyDisplay?.recalled)
+        return [{ scope: key, thread: message.threadId, target: message.id, kind: "recall", actor: row.from, emoji: "", id: message.id, timestamp: message.timestamp, revision: 0, active: true }];
+    const body = row.body;
+    const content = body?.kind === "message" && body.content?.appId === scope.appId ? body.content : undefined;
+    const target = body?.kind === "recall" && row.appId === scope.appId ? body.targetMessageId : content?.recall?.messageId;
+    const base = { scope: key, thread: message.threadId, actor: row.from, id: message.id, timestamp: message.timestamp };
+    if (identifier(target))
+        return [{ ...base, target, kind: "recall", emoji: "", revision: 0, active: true }];
+    const reaction = content?.reaction;
+    if (body?.contentKind === "text" && reaction?.version === 1 && identifier(reaction.messageId) && identifier(reaction.emojiId) && Number.isSafeInteger(reaction.revision) && (reaction.revision ?? 0) >= 1 && typeof reaction.active === "boolean")
+        return [{ ...base, target: reaction.messageId, kind: "reaction", emoji: reaction.emojiId, revision: reaction.revision, active: reaction.active }];
+    return [];
+}
+export function applyMessageControls(messages, controls) {
+    const grouped = new Map();
+    for (const event of controls) {
+        const list = grouped.get(event.target) ?? [];
+        list.push(event);
+        grouped.set(event.target, list);
+    }
+    return messages.map(message => {
+        const facts = grouped.get(message.id);
+        if (!facts?.length)
+            return message;
+        const row = message;
+        const recalled = message.recalled || facts.some(event => event.kind === "recall" && event.actor === row.from);
+        const reactionEvents = facts.filter(event => event.kind === "reaction").map(event => ({ id: event.id, messageId: event.target, threadId: event.thread, from: event.actor, emojiId: event.emoji, active: event.active, revision: event.revision, timestamp: event.timestamp }));
+        return { ...message, ...(recalled ? { recalled: true } : {}), ...(reactionEvents.length ? { reactionEvents: [...(row.reactionEvents ?? []), ...reactionEvents] } : {}) };
+    });
+}

package/lib/runtime/messageReaders.d.ts

@@ -1,3 +1,5 @@
+import { type ResponseCacheAccess } from "./responseCache.js";
+import { type MessageScope } from "./messageStore.js";
 export type MessageReadersPage = {
     appId: string;
     threadId: string;
@@ -21,6 +23,9 @@ export type MessageReadersOptions = {
     token: string;
     hubHttpUrl: string;
     fetch?: typeof fetch;
+    scope?: MessageScope;
+    access?: ResponseCacheAccess;
+    onError?: (error: unknown) => void;
 };
 export declare class MessageReadersError extends Error {
     readonly status: number;
@@ -32,8 +37,14 @@ export declare class MessageReadersClient {
     private options;
     private pending;
     private lifetime;
+    private cache?;
+    private revoked;
+    private generation;
     constructor(options: MessageReadersOptions);
     getReaders(query: MessageReadersQuery, signal?: AbortSignal): Promise<MessageReadersPage>;
+    private cachedRequest;
     private request;
-    close(): void;
+    withdraw(): void;
+    retireScope(version: number): Promise<void>;
+    close(): Promise<void>;
 }

package/lib/runtime/messageReaders.js

@@ -1,3 +1,6 @@
+import { isOffline } from "./connectivity.js";
+import { IndexedDbResponseCache, isResponseCacheAuthorityError, assertResponseCacheAccess } from "./responseCache.js";
+import { messageScopeKey } from "./messageStore.js";
 export class MessageReadersError extends Error {
     status;
     forbidden;
@@ -12,7 +15,17 @@ export class MessageReadersClient {
     options;
     pending = new Map();
     lifetime = new AbortController();
-    constructor(options) { this.options = { ...options }; }
+    cache;
+    revoked = false;
+    generation = 0;
+    constructor(options) {
+        this.options = { ...options };
+        if (options.scope) {
+            if (options.scope.appId !== options.appId || options.scope.profileId !== options.profileId)
+                throw new Error("MESSAGE_READERS_SCOPE_MISMATCH");
+            this.cache = new IndexedDbResponseCache(messageScopeKey(options.scope), { access: options.access });
+        }
+    }
     getReaders(query, signal) {
         if (this.lifetime.signal.aborted)
             return Promise.reject(new Error("MESSAGE_READERS_CLOSED"));
@@ -24,7 +37,7 @@ export class MessageReadersClient {
         const key = JSON.stringify([input.threadId, input.messageId, input.afterProfileId, input.revision, input.limit]);
         let task = this.pending.get(key);
         if (!task) {
-            task = this.request(input).finally(() => { if (this.pending.get(key) === task)
+            task = this.cachedRequest(input, key).finally(() => { if (this.pending.get(key) === task)
                 this.pending.delete(key); });
             this.pending.set(key, task);
         }
@@ -37,7 +50,54 @@ export class MessageReadersClient {
             task.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
         });
     }
+    async cachedRequest(input, key) {
+        // Keep only the standard SDK window. Arbitrary page sizes must not multiply
+        // durable cache entries. Revision is part of the key, so changed counts do
+        // not reuse a page from a previous membership/read projection.
+        const cache = input.limit === 50 ? this.cache : undefined;
+        if (!cache)
+            return this.request(input);
+        const stored = await cache.read(key).catch(error => { if (isResponseCacheAuthorityError(error))
+            throw error; this.options.onError?.(error); return undefined; });
+        if (this.lifetime.signal.aborted)
+            throw new Error("MESSAGE_READERS_CLOSED");
+        const generation = this.generation;
+        const cached = this.revoked ? undefined : stored?.cached;
+        if (cached && (Date.now() - cached.time < 5000 || (typeof navigator !== "undefined" && navigator.onLine === false)))
+            return structuredClone(cached.value);
+        let value;
+        try {
+            value = await this.request(input);
+        }
+        catch (error) {
+            if (error instanceof MessageReadersError && error.forbidden) {
+                this.revoked = true;
+                this.generation++;
+                await this.cache?.invalidate().catch(failure => this.options.onError?.(failure));
+                throw error;
+            }
+            if (cached && !this.revoked && generation === this.generation && !this.lifetime.signal.aborted && (error instanceof TypeError || (error instanceof MessageReadersError && error.status >= 500)))
+                return structuredClone(cached.value);
+            throw error;
+        }
+        if (generation !== this.generation)
+            throw new Error("MESSAGE_READERS_INVALIDATED");
+        this.revoked = false;
+        if (value.resetRequired)
+            await cache?.invalidate().catch(error => this.options.onError?.(error));
+        else if (stored)
+            await cache?.write(key, value, stored.epoch).catch(error => { if (isResponseCacheAuthorityError(error))
+                throw error; this.options.onError?.(error); });
+        if (this.lifetime.signal.aborted)
+            throw new Error("MESSAGE_READERS_CLOSED");
+        return value;
+    }
     async request(input) {
+        const scopeVersion = this.options.access ? await assertResponseCacheAccess(this.options.access) : undefined;
+        if (this.lifetime.signal.aborted)
+            throw new Error("MESSAGE_READERS_CLOSED");
+        if (isOffline())
+            throw new MessageReadersError(0, "MESSAGE_READERS_OFFLINE_UNAVAILABLE");
         const { token, fetch: fetcher, hubHttpUrl, appId, profileId } = this.options;
         const controller = new AbortController();
         const cancel = () => controller.abort(this.lifetime.signal.reason);
@@ -60,6 +120,8 @@ export class MessageReadersClient {
                 throw new Error("INVALID_MESSAGE_READERS_RESPONSE");
             if (this.lifetime.signal.aborted)
                 throw new Error("MESSAGE_READERS_CLOSED");
+            if (this.options.access)
+                await assertResponseCacheAccess(this.options.access, scopeVersion);
             return data;
         }
         finally {
@@ -67,5 +129,7 @@ export class MessageReadersClient {
             this.lifetime.signal.removeEventListener("abort", cancel);
         }
     }
-    close() { this.lifetime.abort(); this.pending.clear(); }
+    withdraw() { this.lifetime.abort(); this.pending.clear(); }
+    retireScope(version) { return this.cache?.retire(version) ?? Promise.resolve(); }
+    close() { this.lifetime.abort(); this.pending.clear(); return this.cache?.close().catch(error => this.options.onError?.(error)) ?? Promise.resolve(); }
 }

package/lib/runtime/messageStore.d.ts

@@ -16,6 +16,14 @@ export type MessageCoverage = {
     complete: boolean;
     nextBefore?: string | null;
     syncedAt?: number;
+    resetVersion?: number;
+    revoked?: boolean;
+    scopeVersion?: number;
+};
+export type MessageScopeAccess = {
+    scope: string;
+    version: number;
+    revoked: boolean;
 };
 type CoverageRow = MessageCoverage & {
     scope: string;
@@ -25,24 +33,55 @@ export declare const messageScopeKey: (scope: MessageScope) => string;
 /** Normalized browser cache. Data and coverage advance together in each commit.
  * Merge runs inside the write transaction against the latest cross-tab state. */
 export declare class IndexedDbMessageStore<T extends StoredMessage> {
+    private scope;
     private merge;
     private db;
     private rows;
+    private legacy;
     private coverage;
+    private accessRows;
+    private controls;
     private key;
     constructor(scope: MessageScope, merge: (previous: T | undefined, incoming: T) => T, options?: {
         indexedDB?: IDBFactory;
         name?: string;
     });
+    get namespace(): string;
     read(thread: string, limit?: number, before?: {
         timestamp: number;
         id: string;
     }): Promise<{
         messages: T[];
         hasEarlier: boolean;
-        coverage: CoverageRow | undefined;
+        coverage: MessageCoverage | undefined;
+    }>;
+    /** Migration records never claim coverage or overwrite authoritative rows. */
+    importLegacy(thread: string, messages: T[]): Promise<number>;
+    /** Bounded fallback only; callers must report an incomplete window. */
+    readFallback(thread: string, limit?: number, before?: {
+        timestamp: number;
+        id: string;
+    }): Promise<{
+        messages: T[];
+        hasEarlier: boolean;
+        coverage: MessageCoverage | undefined;
     }>;
-    commit(thread: string, messages: T[], coverage?: MessageCoverage): Promise<number>;
+    commit(thread: string, messages: T[], coverage?: MessageCoverage, guard?: {
+        version: number;
+        authoritative?: boolean;
+        scopeVersion?: number;
+    }): Promise<number>;
+    private rememberControls;
+    private controlPage;
+    private finishPage;
+    windows(): Promise<CoverageRow[]>;
+    scopeAccess(): Promise<MessageScopeAccess>;
+    private scopedCoverage;
+    private clearScopeRows;
+    /** Persist the denial first; failed cleanup must never make cached rows readable. */
+    revokeScope(expectedVersion?: number): Promise<number>;
+    /** A durable epoch prevents another tab's pre-reset request from restoring rows. */
+    resetThread(thread: string, revoked?: boolean, scopeVersion?: number): Promise<number>;
     removeThread(thread: string): Promise<void>;
     clear(): Promise<void>;
     close(): void;

package/lib/runtime/messageStore.js

@@ -1,68 +1,270 @@
 import { Dexie } from "dexie";
+import { messageControls, controlKey, newerControl, applyMessageControls } from "./messageControls.js";
 export const messageScopeKey = (scope) => JSON.stringify([scope.appId, scope.accountId, scope.profileId, scope.teamId]);
 /** Normalized browser cache. Data and coverage advance together in each commit.
  * Merge runs inside the write transaction against the latest cross-tab state. */
 export class IndexedDbMessageStore {
+    scope;
     merge;
     db;
     rows;
+    legacy;
     coverage;
+    accessRows;
+    controls;
     key;
     constructor(scope, merge, options = {}) {
+        this.scope = scope;
         this.merge = merge;
         this.key = messageScopeKey(scope);
         this.db = new Dexie(options.name ?? "pmate-chat-messages", { indexedDB: options.indexedDB ?? globalThis.indexedDB, IDBKeyRange: globalThis.IDBKeyRange });
         this.db.version(1).stores({ messages: "[scope+thread+id],[scope+thread+time+id],[scope+thread],scope", coverage: "[scope+thread],scope" });
+        this.db.version(2).stores({ legacyMessages: "[scope+thread+id],[scope+thread+time+id],[scope+thread],scope" });
+        this.db.version(3).stores({ scopeAccess: "scope" });
+        this.db.version(4).stores({ messageControls: "[scope+thread+target+kind+actor+emoji],[scope+thread+target],[scope+thread],scope" });
+        this.controls = this.db.table("messageControls");
+        this.accessRows = this.db.table("scopeAccess");
+        this.legacy = this.db.table("legacyMessages");
         this.rows = this.db.table("messages");
         this.coverage = this.db.table("coverage");
         this.db.on("versionchange", () => { this.db.close({ disableAutoOpen: false }); return false; });
     }
+    get namespace() { return this.db.name; }
     async read(thread, limit = 100, before) {
         if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000)
             throw new Error("INVALID_MESSAGE_LIMIT");
-        return this.db.transaction("r", this.rows, this.coverage, async () => {
+        const page = await this.db.transaction("r", this.rows, this.coverage, this.accessRows, this.controls, async () => {
+            const access = await this.scopeAccess();
+            if (access.revoked)
+                return { messages: [], hasEarlier: false, coverage: { complete: false, revoked: true, resetVersion: 0, scopeVersion: access.version } };
             const range = this.rows.where("[scope+thread+time+id]").between([this.key, thread, Dexie.minKey, Dexie.minKey], [this.key, thread, before?.timestamp ?? Dexie.maxKey, before?.id ?? Dexie.maxKey], true, !before);
             const records = await range.reverse().limit(limit + 1).toArray();
-            return { messages: records.slice(0, limit).reverse().map(row => row.value), hasEarlier: records.length > limit, coverage: await this.coverage.get([this.key, thread]) };
+            return this.controlPage({ messages: records.slice(0, limit).reverse().map(row => row.value), hasEarlier: records.length > limit, coverage: this.scopedCoverage(await this.coverage.get([this.key, thread]), access) });
         });
+        return this.finishPage(thread, page);
     }
-    async commit(thread, messages, coverage) {
+    /** Migration records never claim coverage or overwrite authoritative rows. */
+    async importLegacy(thread, messages) {
+        if (messages.length > 128)
+            throw new Error("MESSAGE_BATCH_TOO_LARGE");
+        let bytes = 0;
+        for (const message of messages) {
+            if (message.threadId !== thread || !message.id || !Number.isFinite(message.timestamp))
+                throw new Error("MESSAGE_SCOPE_MISMATCH");
+            bytes += new TextEncoder().encode(JSON.stringify(message)).byteLength;
+            if (bytes > 1_048_576)
+                throw new Error("MESSAGE_BATCH_TOO_LARGE");
+        }
+        return this.db.transaction("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            const access = await this.scopeAccess();
+            const coverage = await this.coverage.get([this.key, thread]);
+            if (access.revoked || coverage?.revoked)
+                throw new Error("MESSAGE_ACCESS_REVOKED");
+            if (access.version > 0)
+                throw new Error("MESSAGE_PROJECTION_CHANGED");
+            const proofs = messages.map(message => messageControls(message, this.scope, this.key));
+            const controlsOnly = messages.length > 0 && proofs.every((events, index) => events.length > 0 && !messages[index].recalled && !messages[index].legacyDisplay?.recalled);
+            if (controlsOnly) {
+                await this.rememberControls(proofs.flat());
+                return 0;
+            }
+            if ((coverage?.resetVersion ?? 0) > 0)
+                throw new Error("MESSAGE_PROJECTION_CHANGED");
+            const ids = [...new Set(messages.map(message => message.id))], keys = ids.map(id => [this.key, thread, id]);
+            const authoritative = await this.rows.bulkGet(keys), previous = await this.legacy.bulkGet(keys);
+            const known = new Set(authoritative.flatMap(row => row ? [row.id] : []));
+            const latest = new Map(previous.flatMap(row => row ? [[row.id, row.value]] : [])), changed = new Map();
+            for (const message of messages) {
+                if (known.has(message.id))
+                    continue;
+                const old = latest.get(message.id), value = this.merge(old, message);
+                if (value.id !== message.id || value.threadId !== thread || !Number.isFinite(value.timestamp))
+                    throw new Error("MESSAGE_SCOPE_MISMATCH");
+                latest.set(message.id, value);
+                if (JSON.stringify(old) !== JSON.stringify(value))
+                    changed.set(message.id, { scope: this.key, thread, id: value.id, time: value.timestamp, value });
+            }
+            await this.rememberControls([...changed.values()].flatMap(row => messageControls(row.value, this.scope, this.key)));
+            if (changed.size)
+                await this.legacy.bulkPut([...changed.values()]);
+            return changed.size;
+        });
+    }
+    /** Bounded fallback only; callers must report an incomplete window. */
+    async readFallback(thread, limit = 100, before) {
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000)
+            throw new Error("INVALID_MESSAGE_LIMIT");
+        const page = await this.db.transaction("r", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            const access = await this.scopeAccess();
+            const coverage = access.revoked ? { complete: false, revoked: true, resetVersion: 0, scopeVersion: access.version } : this.scopedCoverage(await this.coverage.get([this.key, thread]), access);
+            if (coverage?.revoked)
+                return { messages: [], hasEarlier: false, coverage };
+            const read = (table) => table.where("[scope+thread+time+id]").between([this.key, thread, Dexie.minKey, Dexie.minKey], [this.key, thread, before?.timestamp ?? Dexie.maxKey, before?.id ?? Dexie.maxKey], true, !before).reverse().limit(limit + 1).toArray();
+            const [canonical, legacy] = await Promise.all([read(this.rows), read(this.legacy)]);
+            const rows = [...new Map([...legacy, ...canonical].map(row => [row.id, row])).values()].sort((a, b) => a.time - b.time || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+            return this.controlPage({ messages: rows.slice(-limit).map(row => row.value), hasEarlier: rows.length > limit, coverage });
+        });
+        return this.finishPage(thread, page);
+    }
+    async commit(thread, messages, coverage, guard) {
         for (const message of messages)
             if (message.threadId !== thread || !message.id || !Number.isFinite(message.timestamp))
                 throw new Error("MESSAGE_SCOPE_MISMATCH");
         if (messages.length > 1000)
             throw new Error("MESSAGE_BATCH_TOO_LARGE");
-        return this.db.transaction("rw", this.rows, this.coverage, async () => {
+        return this.db.transaction("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            const access = await this.scopeAccess();
+            if ((guard?.scopeVersion ?? 0) !== access.version)
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            if (access.revoked) {
+                if (!guard?.authoritative)
+                    throw new Error("MESSAGE_ACCESS_REVOKED");
+                await this.clearScopeRows();
+                await this.accessRows.put({ ...access, revoked: false });
+            }
+            const current = await this.coverage.get([this.key, thread]);
+            if (guard && (current?.resetVersion ?? 0) !== guard.version)
+                throw new Error("MESSAGE_PROJECTION_CHANGED");
+            if (guard && current?.revoked && !guard.authoritative)
+                throw new Error("MESSAGE_ACCESS_REVOKED");
             const ids = [...new Set(messages.map(message => message.id))];
-            const previous = await this.rows.bulkGet(ids.map(id => [this.key, thread, id]));
-            const latest = new Map(previous.flatMap(row => row ? [[row.id, row.value]] : []));
+            const keys = ids.map(id => [this.key, thread, id]);
+            const previous = await this.rows.bulkGet(keys), legacy = await this.legacy.bulkGet(keys);
+            const canonicalIds = new Set(previous.flatMap(row => row ? [row.id] : []));
+            const latest = new Map([...legacy, ...previous].flatMap(row => row ? [[row.id, row.value]] : []));
             const changed = new Map();
             for (const message of messages) {
                 const old = latest.get(message.id), value = this.merge(old, message);
                 if (value.id !== message.id || value.threadId !== thread || !Number.isFinite(value.timestamp))
                     throw new Error("MESSAGE_SCOPE_MISMATCH");
                 latest.set(message.id, value);
-                if (JSON.stringify(old) !== JSON.stringify(value))
+                if (!canonicalIds.has(message.id) || JSON.stringify(old) !== JSON.stringify(value))
                     changed.set(message.id, { scope: this.key, thread, id: value.id, time: value.timestamp, value });
             }
+            await this.rememberControls(messages.flatMap(message => messageControls(message, this.scope, this.key)));
             if (changed.size)
                 await this.rows.bulkPut([...changed.values()]);
+            const replaced = legacy.flatMap(row => row ? [[this.key, thread, row.id]] : []);
+            if (replaced.length)
+                await this.legacy.bulkDelete(replaced);
             if (coverage) {
-                const old = await this.coverage.get([this.key, thread]), next = { ...coverage, scope: this.key, thread };
+                const old = await this.coverage.get([this.key, thread]), next = { ...old, ...coverage, scope: this.key, thread };
                 if (JSON.stringify(old) !== JSON.stringify(next))
                     await this.coverage.put(next);
             }
             return changed.size;
         });
     }
+    async rememberControls(events) {
+        const latest = new Map();
+        for (const event of events) {
+            const key = JSON.stringify(controlKey(event));
+            latest.set(key, newerControl(latest.get(key), event));
+        }
+        const values = [...latest.values()];
+        for (let offset = 0; offset < values.length; offset += 128) {
+            const batch = values.slice(offset, offset + 128), previous = await this.controls.bulkGet(batch.map(controlKey));
+            const changed = batch.filter((event, index) => newerControl(previous[index], event) !== previous[index]);
+            if (changed.length)
+                await this.controls.bulkPut(changed);
+        }
+    }
+    async controlPage(page) {
+        const events = page.messages.flatMap(message => messageControls(message, this.scope, this.key));
+        const old = events.length ? await this.controls.bulkGet(events.map(controlKey)) : [];
+        const pendingControls = events.filter((event, index) => newerControl(old[index], event) !== old[index]);
+        const facts = await this.controls.where("[scope+thread+target]").anyOf(page.messages.map(message => [this.key, message.threadId, message.id])).toArray();
+        const latest = new Map();
+        for (const event of [...facts, ...events]) {
+            const key = JSON.stringify(controlKey(event));
+            latest.set(key, newerControl(latest.get(key), event));
+        }
+        return { ...page, messages: applyMessageControls(page.messages, [...latest.values()]), pendingControls };
+    }
+    async finishPage(thread, page) {
+        const { pendingControls, ...result } = page;
+        // v3 caches migrate only source proofs from already-read pages, with no body
+        // rewrite. Steady reads remain a single read-only IndexedDB transaction.
+        if (pendingControls?.length)
+            await this.db.transaction("rw", this.controls, this.coverage, this.accessRows, async () => {
+                const access = await this.scopeAccess(), current = await this.coverage.get([this.key, thread]);
+                if (access.revoked || access.version !== (page.coverage?.scopeVersion ?? 0))
+                    throw new Error("MESSAGE_SCOPE_CHANGED");
+                if ((current?.resetVersion ?? 0) !== (page.coverage?.resetVersion ?? 0))
+                    throw new Error("MESSAGE_PROJECTION_CHANGED");
+                await this.rememberControls(pendingControls);
+            });
+        return result;
+    }
+    async windows() {
+        return this.db.transaction("r", this.coverage, this.accessRows, async () => {
+            if ((await this.scopeAccess()).revoked)
+                return [];
+            return this.coverage.where("scope").equals(this.key).toArray();
+        });
+    }
+    async scopeAccess() {
+        const access = (await this.accessRows.get(this.key)) ?? { scope: this.key, version: 0, revoked: false };
+        if (!Number.isSafeInteger(access.version) || access.version < 0 || typeof access.revoked !== "boolean")
+            throw new Error("INVALID_MESSAGE_SCOPE_ACCESS");
+        return access;
+    }
+    scopedCoverage(coverage, access) {
+        return access.version ? { ...coverage, complete: coverage?.complete ?? false, scopeVersion: access.version } : coverage;
+    }
+    async clearScopeRows() {
+        await this.controls.where("scope").equals(this.key).delete();
+        await this.rows.where("[scope+thread+id]").between([this.key, Dexie.minKey, Dexie.minKey], [this.key, Dexie.maxKey, Dexie.maxKey], true, true).delete();
+        await this.legacy.where("[scope+thread+id]").between([this.key, Dexie.minKey, Dexie.minKey], [this.key, Dexie.maxKey, Dexie.maxKey], true, true).delete();
+        await this.coverage.where("[scope+thread]").between([this.key, Dexie.minKey], [this.key, Dexie.maxKey], true, true).delete();
+    }
+    /** Persist the denial first; failed cleanup must never make cached rows readable. */
+    async revokeScope(expectedVersion) {
+        const access = await this.db.transaction("rw", this.accessRows, async () => {
+            const old = await this.scopeAccess();
+            if (expectedVersion !== undefined && old.version !== expectedVersion)
+                return old;
+            const next = { scope: this.key, version: old.version + 1, revoked: true };
+            await this.accessRows.put(next);
+            return next;
+        });
+        await this.db.transaction("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            const current = await this.scopeAccess();
+            if (current.version === access.version && current.revoked)
+                await this.clearScopeRows();
+        });
+        return access.version;
+    }
+    /** A durable epoch prevents another tab's pre-reset request from restoring rows. */
+    async resetThread(thread, revoked = false, scopeVersion = 0) {
+        return this.db.transaction("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            const access = await this.scopeAccess();
+            if (access.version !== scopeVersion)
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            if (access.revoked)
+                throw new Error("MESSAGE_ACCESS_REVOKED");
+            const old = await this.coverage.get([this.key, thread]);
+            const resetVersion = (old?.resetVersion ?? 0) + 1;
+            if (revoked)
+                await this.controls.where("[scope+thread]").equals([this.key, thread]).delete();
+            await this.rows.where("[scope+thread]").equals([this.key, thread]).delete();
+            await this.legacy.where("[scope+thread]").equals([this.key, thread]).delete();
+            await this.coverage.put({ scope: this.key, thread, complete: false, resetVersion, revoked });
+            return resetVersion;
+        });
+    }
     async removeThread(thread) {
-        await this.db.transaction("rw", this.rows, this.coverage, async () => {
+        await this.db.transaction("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            await this.controls.where("[scope+thread]").equals([this.key, thread]).delete();
             await this.rows.where("[scope+thread]").equals([this.key, thread]).delete();
+            await this.legacy.where("[scope+thread]").equals([this.key, thread]).delete();
             await this.coverage.delete([this.key, thread]);
         });
     }
     async clear() {
-        await this.db.transaction("rw", this.rows, this.coverage, async () => {
+        await this.db.transaction("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            await this.controls.where("scope").equals(this.key).delete();
+            await this.legacy.where("scope").equals(this.key).delete();
             await this.rows.where("scope").equals(this.key).delete();
             await this.coverage.where("scope").equals(this.key).delete();
         });

package/lib/runtime/messageTimeline.d.ts

@@ -0,0 +1,50 @@
+import type { StoredMessage } from "./messageStore.js";
+import type { OutgoingMessage } from "./durableSender.js";
+import type { ChatRuntimeMessage } from "./protocol.js";
+import type { MessageReadingState, ReadingCandidate } from "./conversationReading.js";
+export type TimelineReactionEvent = Reaction & {
+    threadId: string;
+};
+export type TimelineReaction = {
+    emojiId: string;
+    userIds: string[];
+    mine: boolean;
+};
+export type TimelineItem<T> = {
+    id: string;
+    threadId: string;
+    timestamp: number;
+    from?: string;
+    mine: boolean;
+    status: "sending" | "sent" | "failed" | "read";
+    recalled: boolean;
+    unread?: boolean;
+    attentionEligible?: boolean;
+    message: T | undefined;
+    reading?: MessageReadingState;
+    reactions: readonly TimelineReaction[];
+    reactionEvents: readonly TimelineReactionEvent[];
+};
+type Reaction = {
+    id: string;
+    messageId: string;
+    from: string;
+    emojiId: string;
+    active: boolean;
+    revision: number;
+    timestamp: number;
+};
+/** Derives one display stream without copying bodies or creating another cache.
+ * Outgoing rows retain their wire identity; indexed rows take precedence. */
+export declare function projectMessageTimeline<T extends StoredMessage>(input: {
+    appId: string;
+    profileId: string;
+    threadId: string;
+    messages: readonly T[];
+    outgoing: readonly OutgoingMessage[];
+    decode: (message: ChatRuntimeMessage) => T | undefined;
+    reading: Readonly<Record<string, MessageReadingState>>;
+    candidates?: ReadonlyMap<string, ReadingCandidate>;
+    previous?: readonly TimelineItem<T>[];
+}): readonly TimelineItem<T>[];
+export {};