@pmate/chat-sdk 0.12.0-next.6 → 0.12.0-next.61

package/lib/runtime/messageClient.js

@@ -1,3 +1,4 @@
+import { isOffline, isOfflineNetworkFailure } from "./connectivity.js";
 import { WindowedTasks } from "./coalescer.js";
 import { IndexedDbMessageStore, messageScopeKey, mergeStoredMessage } from "./messageStore.js";
 /** Local-first message facade; hosts never select a cache or network source. */
@@ -5,9 +6,12 @@ export class MessageClient {
     options;
     storage;
     watches = new Map();
+    windowEdges = new Map();
+    accessListeners = new Set();
     allListeners = new Set();
     reads = new Map();
     syncing = new Map();
+    completedSyncs = new Map();
     paging = new Map();
     writes = new Map();
     activeWrites = new Set();
@@ -23,6 +27,16 @@ export class MessageClient {
     queueBytes;
     pendingBytes = 0;
     pendingRecords = 0;
+    legacyImports = 0;
+    revokingScope;
+    scopeReady;
+    scopeVersion = 0;
+    scopeAllowed = true;
+    scopeDenied = false;
+    enqueuing = new Set();
+    ensureScope() {
+        return this.scopeReady ??= this.storage.scopeAccess().then(access => { this.scopeVersion = access.version; this.scopeAllowed = !access.revoked && !this.scopeDenied; });
+    }
     constructor(options) {
         this.options = options;
         this.storage = options.storage ?? new IndexedDbMessageStore(options.scope, options.merge ?? mergeStoredMessage);
@@ -37,29 +51,66 @@ export class MessageClient {
             this.invalidate(thread);
         else
             options.onError?.(error, thread); });
-        this.syncTasks = new WindowedTasks(options.syncWindowMs ?? 1000, (error, thread) => options.onError?.(error, thread));
+        this.syncTasks = new WindowedTasks(options.syncWindowMs ?? 1000, (error, thread) => { if (!isOfflineNetworkFailure(error))
+            options.onError?.(error, thread); });
         if (typeof BroadcastChannel !== "undefined") {
             this.channel = new BroadcastChannel(`pmate-chat:${messageScopeKey(options.scope)}${this.storage.namespace === "pmate-chat-messages" ? "" : `:${this.storage.namespace}`}`);
             this.channel.onmessage = event => {
                 if (this.closed)
                     return;
-                if (event.data?.type === "revoked" && typeof event.data.thread === "string" && Number.isSafeInteger(event.data.version)) {
+                if (event.data?.type === "scope-revoked" && Number.isSafeInteger(event.data.version)) {
+                    const version = event.data.version;
+                    void this.ensureScope().then(async () => {
+                        const current = await this.storage.scopeAccess();
+                        if (!this.closed && (this.scopeVersion < version || current.revoked)) {
+                            this.denyScope();
+                            options.onError?.(accessRevoked(), "");
+                        }
+                    }).catch(error => options.onError?.(error, ""));
+                }
+                else if (event.data?.type === "revoked" && typeof event.data.thread === "string" && Number.isSafeInteger(event.data.version)) {
                     const denied = event.data;
                     void (async () => {
                         const current = await this.storage.read(denied.thread, 1).then(page => page.coverage).catch(() => undefined);
+                        if ((current?.scopeVersion ?? 0) !== (denied.scopeVersion ?? 0))
+                            return;
                         if (this.closed || (current && !current.revoked && (current.resetVersion ?? 0) >= denied.version))
                             return;
                         this.denyView(denied.thread, denied.version);
-                        options.onError?.(Object.assign(new Error("MESSAGE_ACCESS_REVOKED"), { status: 403 }), denied.thread);
+                        options.onError?.(accessRevoked(), denied.thread);
                     })();
                 }
+                else if (event.data?.type === "legacy" && typeof event.data.thread === "string" && this.watches.has(event.data.thread)) {
+                    const thread = event.data.thread;
+                    void this.storage.read(thread, 1).then(page => this.reload(thread, !page.coverage?.complete)).catch(error => { if (!this.closed)
+                        options.onError?.(error, thread); });
+                }
                 else if (typeof event.data === "string" && this.watches.has(event.data))
                     void this.reload(event.data).catch(error => { if (!this.closed)
                         options.onError?.(error, event.data); });
             };
         }
     }
+    /** Shared guard for sibling caches; it never authorizes a denied old instance. */
+    subscribeAccessRevoked(listener) { this.accessListeners.add(listener); return () => { this.accessListeners.delete(listener); }; }
+    async scopeAccess() {
+        await this.ensureScope();
+        if (this.closed)
+            return { version: this.scopeVersion, allowed: false };
+        const current = await this.storage.scopeAccess();
+        return { version: current.version, allowed: !this.scopeDenied && !current.revoked && current.version === this.scopeVersion };
+    }
     getSnapshot(thread) { return this.watches.get(thread)?.snapshot; }
+    /** Exact authoritative row only; migration-only rows never prove delivery. */
+    async cachedMessage(thread, id) {
+        await this.ensureScope();
+        if (this.closed || this.closing || this.scopeDenied || this.revoked.has(thread))
+            throw accessRevoked();
+        const page = await this.storage.readSelected(thread, [id]);
+        if (page.coverage?.revoked || (page.coverage?.scopeVersion ?? 0) !== this.scopeVersion)
+            throw accessRevoked();
+        return page.messages[0];
+    }
     subscribe(thread, listener) {
         let watch = this.watches.get(thread);
         if (!watch) {
@@ -71,16 +122,18 @@ export class MessageClient {
     }
     subscribeAll(listener) { this.allListeners.add(listener); return () => { this.allListeners.delete(listener); }; }
     /** Close the connection gap for saved windows with four bounded background lanes. */
-    async restore(since) {
-        const queue = (await this.storage.windows()).filter(window => (window.syncedAt ?? 0) < since && !window.revoked);
+    async restore(since, threadId) {
+        if (this.closed || this.closing || this.scopeDenied || isOffline())
+            return;
+        const queue = (await this.storage.windows()).filter(window => (window.syncedAt ?? 0) < since && !window.revoked && (threadId === undefined || window.thread === threadId));
         await Promise.all(Array.from({ length: Math.min(4, queue.length) }, async () => {
-            while (queue.length && !this.closed && !this.closing) {
+            while (queue.length && !this.closed && !this.closing && !this.scopeDenied && !isOffline()) {
                 const window = queue.shift();
                 try {
                     await this.synchronize(window.thread);
                 }
                 catch (error) {
-                    if (!this.closed && !this.closing)
+                    if (!this.closed && !this.closing && !isOfflineNetworkFailure(error))
                         this.options.onError?.(error, window.thread);
                 }
             }
@@ -95,11 +148,22 @@ export class MessageClient {
         if (running)
             return running;
         const task = (async () => {
+            const completedAtStart = this.completedSyncs.get(thread);
+            await this.ensureScope();
+            if (this.scopeDenied)
+                throw accessRevoked();
             const local = await this.storage.read(thread, limit);
+            if ((local.coverage?.scopeVersion ?? 0) !== this.scopeVersion) {
+                this.denyScope();
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            }
             if (refresh || !local.coverage?.complete || local.coverage.revoked || this.revoked.has(thread)) {
                 if (typeof navigator !== "undefined" && navigator.onLine === false) {
-                    if (!refresh && local.messages.length && !local.coverage?.revoked)
-                        return this.reload(thread);
+                    if (!refresh && !local.coverage?.revoked) {
+                        const fallback = await this.fallback(thread, limit);
+                        if (fallback.messages.length)
+                            return fallback;
+                    }
                     throw new Error("MESSAGE_OFFLINE_UNAVAILABLE");
                 }
                 this.revoked.delete(thread);
@@ -107,10 +171,18 @@ export class MessageClient {
                     await this.synchronize(thread);
                 }
                 catch (error) {
-                    if (refresh || !local.messages.length || [401, 403].includes(error?.status ?? 0))
+                    if (String(error).includes("MESSAGE_SCOPE_CHANGED")) {
+                        this.denyScope();
                         throw error;
-                    this.options.onError?.(error, thread);
-                    return this.reload(thread);
+                    }
+                    if (refresh || [401, 403].includes(error?.status ?? 0))
+                        throw error;
+                    const fallback = await this.fallback(thread, limit);
+                    if (!fallback.messages.length)
+                        throw error;
+                    if (!isOfflineNetworkFailure(error))
+                        this.options.onError?.(error, thread);
+                    return fallback;
                 }
             }
             if (this.closed)
@@ -120,17 +192,24 @@ export class MessageClient {
                 result = await this.fillWindow(thread, limit);
             }
             catch (error) {
+                if (String(error).includes("MESSAGE_SCOPE_CHANGED")) {
+                    this.denyScope();
+                    throw error;
+                }
                 if ([401, 403].includes(error?.status ?? 0))
                     throw error;
-                const cached = await this.storage.read(thread, limit);
+                const cached = await this.fallback(thread, limit);
                 if (!cached.messages.length)
                     throw error;
-                this.options.onError?.(error, thread);
-                await this.reload(thread);
-                return { messages: cached.messages, hasEarlier: true, complete: false, resetVersion: cached.coverage?.resetVersion ?? 0 };
+                if (!isOfflineNetworkFailure(error))
+                    this.options.onError?.(error, thread);
+                return cached;
             }
             const snapshot = await this.reload(thread);
+            if (this.scopeDenied || this.revoked.has(thread))
+                throw accessRevoked();
             if (local.coverage?.complete && Date.now() - (local.coverage.syncedAt ?? 0) > (this.options.freshnessMs ?? 30_000)
+                && !this.syncing.has(thread) && this.completedSyncs.get(thread) === completedAtStart
                 && (typeof navigator === "undefined" || navigator.onLine !== false))
                 this.invalidate(thread);
             return limit === 100 ? snapshot : result;
@@ -141,15 +220,86 @@ export class MessageClient {
     }
     /** Application connection/wake events invalidate, rather than fetching directly. */
     invalidate(thread) {
-        if (!this.closed && !this.closing && !this.revoked.has(thread))
-            this.syncTasks.schedule(thread, () => this.synchronize(thread));
+        if (!this.closed && !this.closing && !this.scopeDenied && !isOffline() && !this.revoked.has(thread))
+            this.syncTasks.schedule(thread, async () => {
+                if (!isOffline())
+                    await this.synchronize(thread);
+            });
     }
-    async reload(thread) {
+    async fallback(thread, limit, before) {
+        await this.ensureScope();
+        if (this.scopeDenied || this.revoked.has(thread))
+            throw accessRevoked();
+        const page = await this.storage.readFallback(thread, limit, before);
+        if ((page.coverage?.scopeVersion ?? 0) !== this.scopeVersion) {
+            this.denyScope();
+            throw new Error("MESSAGE_SCOPE_CHANGED");
+        }
+        if (!before && page.messages.length)
+            await this.reload(thread, true);
+        return { messages: page.messages, hasEarlier: true, complete: false, resetVersion: page.coverage?.resetVersion ?? 0 };
+    }
+    /** Migration batches remain separate from authoritative message coverage. */
+    importLegacy(thread, messages) {
+        if (this.closed || this.closing)
+            return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
+        if (messages.length > 128)
+            return Promise.reject(new Error("MESSAGE_BATCH_TOO_LARGE"));
+        if (this.legacyImports >= 4)
+            return Promise.reject(new Error("MESSAGE_STORAGE_BACKPRESSURE"));
+        let records;
+        try {
+            let bytes = 0;
+            for (const message of messages) {
+                bytes += this.messageBytes(message);
+                if (bytes > Math.min(this.transactionBytes, 1_048_576))
+                    throw new Error("MESSAGE_BATCH_TOO_LARGE");
+            }
+            records = structuredClone(messages);
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        this.legacyImports++;
+        const task = this.storage.importLegacy(thread, records).then(async () => {
+            const page = await this.storage.read(thread, 1);
+            await this.reload(thread, !page.coverage?.complete);
+            this.channel?.postMessage({ type: "legacy", thread });
+        }).finally(() => { this.legacyImports--; this.activeWrites.delete(task); });
+        this.activeWrites.add(task);
+        return task;
+    }
+    async reload(thread, fallback = false) {
+        await this.ensureScope();
         const limit = 100;
-        const page = await this.storage.read(thread, limit);
+        let page = await (fallback ? this.storage.readFallback(thread, limit) : this.storage.read(thread, limit));
+        const edge = this.windowEdges.get(thread);
+        if (edge && edge.version !== (page.coverage?.resetVersion ?? 0))
+            this.windowEdges.delete(thread);
+        if (edge && edge.version === (page.coverage?.resetVersion ?? 0)) {
+            const pages = [page.messages];
+            const beforeEdge = (message) => message.timestamp < edge.timestamp || message.timestamp === edge.timestamp && message.id < edge.id;
+            let oldest = page.messages[0];
+            while (oldest && !beforeEdge(oldest) && (oldest.timestamp !== edge.timestamp || oldest.id !== edge.id) && page.hasEarlier) {
+                const next = await (fallback ? this.storage.readFallback(thread, limit, { timestamp: oldest.timestamp, id: oldest.id }) : this.storage.read(thread, limit, { timestamp: oldest.timestamp, id: oldest.id }));
+                if ((next.coverage?.resetVersion ?? 0) !== edge.version || (next.coverage?.scopeVersion ?? 0) !== (page.coverage?.scopeVersion ?? 0)) {
+                    this.windowEdges.delete(thread);
+                    return this.reload(thread, fallback);
+                }
+                pages.push(next.messages);
+                page = next;
+                oldest = next.messages[0];
+            }
+            const messages = pages.reverse().flat();
+            page = { ...page, messages: messages.filter(message => !beforeEdge(message)), hasEarlier: page.hasEarlier || messages.some(beforeEdge) };
+        }
         if (this.closed)
             throw new Error("MESSAGE_CLIENT_CLOSED");
-        if (this.revoked.has(thread)) {
+        if ((page.coverage?.scopeVersion ?? 0) !== this.scopeVersion) {
+            this.denyScope();
+            throw new Error("MESSAGE_SCOPE_CHANGED");
+        }
+        if (this.scopeDenied || this.revoked.has(thread)) {
             page.messages = [];
             page.hasEarlier = false;
         }
@@ -160,7 +310,7 @@ export class MessageClient {
             return old && JSON.stringify(old) === JSON.stringify(message) ? old : message;
         });
         const old = watch?.snapshot;
-        const resetVersion = Math.max(page.coverage?.resetVersion ?? 0, this.revoked.has(thread) ? watch?.snapshot.resetVersion ?? 0 : 0), complete = !this.revoked.has(thread) && (page.coverage?.complete ?? false);
+        const resetVersion = Math.max(page.coverage?.resetVersion ?? 0, this.revoked.has(thread) ? watch?.snapshot.resetVersion ?? 0 : 0), complete = !fallback && !this.scopeDenied && !this.revoked.has(thread) && (page.coverage?.complete ?? false);
         const hasEarlier = !this.revoked.has(thread) && (page.hasEarlier || Boolean(page.coverage?.nextBefore));
         if (old && old.resetVersion === resetVersion && old.complete === complete && old.hasEarlier === hasEarlier && old.messages.length === messages.length && old.messages.every((message, index) => message === messages[index]))
             return old;
@@ -179,8 +329,7 @@ export class MessageClient {
         if (this.closed || this.closing)
             return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
         if (this.revoked.has(thread))
-            return Promise.reject(new Error("MESSAGE_ACCESS_REVOKED"));
-        const queue = this.writes.get(thread) ?? [];
+            return Promise.reject(accessRevoked());
         if (messages.length > 1000 || this.pendingRecords + messages.length > 4096)
             return Promise.reject(new Error("MESSAGE_STORAGE_BACKPRESSURE"));
         let bytes = 0;
@@ -197,15 +346,25 @@ export class MessageClient {
         }
         this.pendingBytes += bytes;
         this.pendingRecords += messages.length;
-        const promise = new Promise((resolve, reject) => queue.push({ messages, bytes, version: this.watches.get(thread)?.snapshot.resetVersion ?? 0, resolve, reject }));
-        this.writes.set(thread, queue);
-        this.writeTasks.schedule(thread, () => this.flushWrites(thread));
-        return promise;
+        let resolve, reject;
+        const committed = new Promise((yes, no) => { resolve = yes; reject = no; });
+        const enqueue = this.ensureScope().then(() => {
+            if (this.closed || this.scopeDenied)
+                throw accessRevoked();
+            if (!this.scopeAllowed)
+                throw new Error("MESSAGE_SCOPE_NOT_READY");
+            const queue = this.writes.get(thread) ?? [];
+            queue.push({ messages, bytes, version: this.watches.get(thread)?.snapshot.resetVersion ?? 0, scopeVersion: this.scopeVersion, resolve, reject });
+            this.writes.set(thread, queue);
+            this.writeTasks.schedule(thread, () => this.flushWrites(thread));
+        }).catch(error => { this.pendingBytes -= bytes; this.pendingRecords -= messages.length; reject(error); }).finally(() => this.enqueuing.delete(enqueue));
+        this.enqueuing.add(enqueue);
+        return committed;
     }
-    async persist(thread, messages, checkpoint, complete, nextBefore, syncedAt, expectedVersion) {
+    async persist(thread, messages, checkpoint, complete, nextBefore, syncedAt, expectedVersion, expectedScopeVersion) {
         const initial = (await this.storage.read(thread, 1)).coverage;
         const version = expectedVersion ?? initial?.resetVersion ?? 0;
-        const guard = { version, authoritative: complete === true };
+        const guard = { version, scopeVersion: expectedScopeVersion ?? this.scopeVersion, authoritative: complete === true };
         let changed = 0;
         let navigationChanged = false;
         // Coverage advances only after all bounded batches have durably committed.
@@ -213,7 +372,7 @@ export class MessageClient {
         const commit = async () => {
             if (!batch.length)
                 return;
-            if (this.closed || this.revoked.has(thread))
+            if (this.closed || this.scopeDenied || this.revoked.has(thread))
                 throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
             changed += await this.storage.commit(thread, batch, undefined, guard);
             batch = [];
@@ -229,11 +388,13 @@ export class MessageClient {
         await commit();
         if (complete !== undefined || checkpoint !== undefined) {
             const old = (await this.storage.read(thread, 1)).coverage;
-            if (this.closed || this.revoked.has(thread))
+            if (this.closed || this.scopeDenied || this.revoked.has(thread))
                 throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
             navigationChanged = (nextBefore !== undefined && nextBefore !== old?.nextBefore) || (complete !== undefined && complete !== old?.complete);
             await this.storage.commit(thread, [], { resetVersion: version, revoked: complete === true ? false : old?.revoked, syncedAt: syncedAt ?? old?.syncedAt, complete: complete ?? old?.complete ?? false, checkpoint: checkpoint ?? old?.checkpoint, nextBefore: nextBefore === undefined ? old?.nextBefore : nextBefore }, guard);
         }
+        if (complete === true)
+            this.scopeAllowed = true;
         if (changed || navigationChanged) {
             await this.reload(thread);
             this.channel?.postMessage(thread);
@@ -264,14 +425,14 @@ export class MessageClient {
         try {
             const groups = new Map();
             for (const write of queue) {
-                const group = groups.get(write.version) ?? [];
+                const key = `${write.version}:${write.scopeVersion}`, group = groups.get(key) ?? [];
                 group.push(write);
-                groups.set(write.version, group);
+                groups.set(key, group);
             }
             let failed = false, failure;
-            for (const [version, writes] of groups) {
+            for (const writes of groups.values()) {
                 try {
-                    await this.persist(thread, writes.flatMap(write => write.messages), undefined, undefined, undefined, undefined, version);
+                    await this.persist(thread, writes.flatMap(write => write.messages), undefined, undefined, undefined, undefined, writes[0].version, writes[0].scopeVersion);
                     writes.forEach(write => write.resolve());
                 }
                 catch (error) {
@@ -287,40 +448,58 @@ export class MessageClient {
             this.release(queue);
         }
     }
+    assertNetworkAvailable(thread) {
+        if (this.closed || this.closing || this.scopeDenied || this.revoked.has(thread))
+            throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
+        if (isOffline())
+            throw new TypeError("MESSAGE_OFFLINE_UNAVAILABLE");
+    }
     synchronize(thread) {
-        if (this.closed || this.closing || this.revoked.has(thread))
+        if (this.closed || this.closing || this.scopeDenied || this.revoked.has(thread))
             return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
         const running = this.syncing.get(thread);
         if (running)
             return running;
         const task = (async () => {
+            await this.ensureScope();
             const coverage = (await this.storage.read(thread, 1)).coverage;
+            const scopeVersion = coverage?.scopeVersion ?? 0;
+            if (scopeVersion !== this.scopeVersion) {
+                this.denyScope();
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            }
             let version = coverage?.resetVersion ?? 0;
             let after = coverage?.complete ? coverage.checkpoint : undefined;
+            this.assertNetworkAvailable(thread);
             let page = after && this.options.transport.changes
                 ? await this.options.transport.changes(thread, after, this.abort.signal)
                 : await this.options.transport.load(thread, this.abort.signal);
             if (page.resetRequired) {
-                if (this.closed || this.revoked.has(thread))
+                if (this.closed || this.scopeDenied || this.revoked.has(thread))
                     throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
-                version = await this.storage.resetThread(thread);
+                version = await this.storage.resetThread(thread, false, scopeVersion);
                 after = undefined;
+                this.assertNetworkAvailable(thread);
                 page = await this.options.transport.load(thread, this.abort.signal);
             }
             for (;;) {
-                if (this.closed || this.revoked.has(thread))
-                    throw new Error("MESSAGE_ACCESS_REVOKED");
+                if (this.closed || this.scopeDenied || this.revoked.has(thread))
+                    throw accessRevoked();
                 if (page.resetRequired)
                     throw new Error("MESSAGE_SYNC_RESET_REQUIRED");
-                await this.persist(thread, page.messages, page.checkpoint, true, after ? undefined : page.nextBefore, Date.now(), version);
+                await this.persist(thread, page.messages, page.checkpoint, true, after ? undefined : page.nextBefore, Date.now(), version, scopeVersion);
                 if (!page.hasMoreChanges)
                     break;
                 if (!page.checkpoint || page.checkpoint === after || !this.options.transport.changes)
                     throw new Error("MESSAGE_SYNC_NO_PROGRESS");
                 after = page.checkpoint;
+                this.assertNetworkAvailable(thread);
                 page = await this.options.transport.changes(thread, after, this.abort.signal);
             }
+            this.completedSyncs.set(thread, (this.completedSyncs.get(thread) ?? 0) + 1);
         })().catch(async (error) => {
+            if (String(error).includes("MESSAGE_SCOPE_CHANGED"))
+                this.denyScope();
             if (!this.closed && !this.closing && error?.status === 403) {
                 try {
                     await this.revoke(thread);
@@ -335,14 +514,51 @@ export class MessageClient {
         this.syncing.set(thread, task);
         return task;
     }
-    async earlier(thread, before, limit = 100) {
+    /** Keep an explicitly requested history range in the shared subscribed view. */
+    async expandWindow(thread, page) {
+        const first = page.messages[0];
+        if (!first || !page.complete)
+            return;
+        const old = this.windowEdges.get(thread);
+        if (!old || old.version !== page.resetVersion || first.timestamp < old.timestamp || first.timestamp === old.timestamp && first.id < old.id)
+            this.windowEdges.set(thread, { timestamp: first.timestamp, id: first.id, version: page.resetVersion });
+        const snapshot = await this.reload(thread);
+        if (snapshot.resetVersion !== page.resetVersion)
+            throw new Error("MESSAGE_PROJECTION_CHANGED");
+    }
+    async earlier(thread, before, limit = 100, expand = false) {
+        await this.ensureScope();
+        if (this.scopeDenied)
+            throw accessRevoked();
         if (this.closed)
             throw new Error("MESSAGE_CLIENT_CLOSED");
         if (this.revoked.has(thread))
-            throw new Error("MESSAGE_ACCESS_REVOKED");
-        if (!(await this.storage.read(thread, 1)).coverage?.complete)
-            await this.synchronize(thread);
-        return this.fillWindow(thread, limit, before);
+            throw accessRevoked();
+        try {
+            if (!(await this.storage.read(thread, 1)).coverage?.complete) {
+                if (typeof navigator !== "undefined" && navigator.onLine === false)
+                    throw new Error("MESSAGE_OFFLINE_UNAVAILABLE");
+                await this.synchronize(thread);
+            }
+            const page = await this.fillWindow(thread, limit, before);
+            if (expand)
+                await this.expandWindow(thread, page);
+            return page;
+        }
+        catch (error) {
+            if (String(error).includes("MESSAGE_SCOPE_CHANGED")) {
+                this.denyScope();
+                throw error;
+            }
+            if ([401, 403].includes(error?.status ?? 0))
+                throw error;
+            const fallback = await this.fallback(thread, limit, before);
+            if (!fallback.messages.length)
+                throw error;
+            if (!isOfflineNetworkFailure(error))
+                this.options.onError?.(error, thread);
+            return fallback;
+        }
     }
     async fillWindow(thread, limit, before) {
         let page = await this.storage.read(thread, limit, before);
@@ -354,21 +570,22 @@ export class MessageClient {
                 page = await this.storage.read(thread, limit, before);
                 continue;
             }
-            const token = page.coverage.nextBefore, version = page.coverage.resetVersion ?? 0;
+            const token = page.coverage.nextBefore, version = page.coverage.resetVersion ?? 0, scopeVersion = page.coverage.scopeVersion ?? 0;
             const task = (async () => {
+                this.assertNetworkAvailable(thread);
                 const remote = await this.options.transport.older(thread, token, this.abort.signal);
-                if (this.closed || this.revoked.has(thread))
+                if (this.closed || this.scopeDenied || this.revoked.has(thread))
                     throw new Error("MESSAGE_CLIENT_UNAVAILABLE");
                 if (remote.resetRequired) {
                     if (++resets > 2)
                         throw new Error("MESSAGE_SYNC_RESET_REQUIRED");
-                    await this.storage.resetThread(thread);
+                    await this.storage.resetThread(thread, false, scopeVersion);
                     await this.synchronize(thread);
                     return;
                 }
                 if (remote.nextBefore === token)
                     throw new Error("MESSAGE_SYNC_NO_PROGRESS");
-                await this.persist(thread, remote.messages, undefined, true, remote.nextBefore ?? null, undefined, version);
+                await this.persist(thread, remote.messages, undefined, true, remote.nextBefore ?? null, undefined, version, scopeVersion);
             })().catch(async (error) => {
                 if (!this.closed && !this.closing && error?.status === 403) {
                     try {
@@ -385,9 +602,12 @@ export class MessageClient {
             await task;
             page = await this.storage.read(thread, limit, before);
         }
+        if (this.scopeDenied || this.revoked.has(thread))
+            throw accessRevoked();
         return { messages: page.messages, hasEarlier: page.hasEarlier || Boolean(page.coverage?.nextBefore), resetVersion: page.coverage?.resetVersion ?? 0, complete: page.coverage?.complete ?? false };
     }
     denyView(thread, version) {
+        this.windowEdges.delete(thread);
         this.revoked.add(thread);
         const watch = this.watches.get(thread);
         const snapshot = { messages: [], hasEarlier: false, complete: false, resetVersion: Math.max(watch?.snapshot.resetVersion ?? 0, version ?? (watch?.snapshot.resetVersion ?? 0) + 1) };
@@ -401,34 +621,80 @@ export class MessageClient {
             this.watches.set(thread, { snapshot, listeners: new Set() });
         this.allListeners.forEach(listener => listener(thread));
     }
+    denyScope() {
+        const notify = !this.scopeDenied;
+        this.scopeDenied = true;
+        this.scopeAllowed = false;
+        this.abort.abort();
+        this.syncTasks.close();
+        this.writeTasks.close();
+        for (const thread of this.watches.keys())
+            this.denyView(thread);
+        for (const queue of this.writes.values()) {
+            queue.forEach(write => write.reject(accessRevoked()));
+            this.release(queue);
+        }
+        this.writes.clear();
+        if (notify)
+            this.accessListeners.forEach(listener => listener());
+    }
+    revokeScope() {
+        if (this.closed || this.closing)
+            return Promise.reject(new Error("MESSAGE_CLIENT_UNAVAILABLE"));
+        return this.revokingScope ??= (async () => {
+            this.denyScope();
+            try {
+                await this.ensureScope();
+                return await this.storage.revokeScope(this.scopeVersion);
+            }
+            finally {
+                const access = await this.storage.scopeAccess();
+                this.channel?.postMessage({ type: "scope-revoked", version: access.version });
+            }
+        })();
+    }
     async revoke(thread) {
         this.denyView(thread);
         const queue = this.writes.get(thread);
         this.writes.delete(thread);
         if (queue) {
-            queue.forEach(write => write.reject(new Error("MESSAGE_ACCESS_REVOKED")));
+            queue.forEach(write => write.reject(accessRevoked()));
             this.release(queue);
         }
         try {
-            await this.storage.resetThread(thread, true);
+            await this.storage.resetThread(thread, true, this.scopeVersion);
             await this.reload(thread);
         }
         finally {
-            this.channel?.postMessage({ type: "revoked", thread, version: this.watches.get(thread)?.snapshot.resetVersion });
+            this.channel?.postMessage({ type: "revoked", thread, version: this.watches.get(thread)?.snapshot.resetVersion, scopeVersion: this.scopeVersion });
         }
     }
-    async close() {
-        // Flush accepted event batches before closing; new requests are rejected afterwards.
+    async close(beforeDispose) {
+        if (this.closed)
+            return;
         this.closing = true;
-        this.syncTasks.close();
-        this.writeTasks.close();
-        await Promise.all([...this.writes.keys()].map(thread => this.flushWrites(thread)));
-        await Promise.all([...this.activeWrites]);
-        this.closed = true;
-        this.abort.abort();
-        this.channel?.close();
-        this.watches.clear();
-        this.allListeners.clear();
-        this.storage.close();
+        try {
+            await Promise.all([...this.enqueuing]);
+            this.syncTasks.close();
+            this.writeTasks.close();
+            const flushes = [...this.writes.keys()].map(thread => this.flushWrites(thread));
+            const results = await Promise.allSettled([...flushes, ...this.activeWrites, ...(this.revokingScope ? [this.revokingScope] : [])]);
+            const failed = results.find((result) => result.status === "rejected");
+            if (failed)
+                throw failed.reason;
+            await beforeDispose;
+        }
+        finally {
+            this.closed = true;
+            this.abort.abort();
+            this.channel?.close();
+            this.watches.clear();
+            this.windowEdges.clear();
+            this.completedSyncs.clear();
+            this.allListeners.clear();
+            this.accessListeners.clear();
+            this.storage.close();
+        }
     }
 }
+function accessRevoked() { return Object.assign(new Error("MESSAGE_ACCESS_REVOKED"), { status: 403 }); }

package/lib/runtime/messageControls.d.ts

@@ -0,0 +1,19 @@
+import type { StoredMessage, MessageScope } from "./messageStore.js";
+export type MessageControl = {
+    scope: string;
+    thread: string;
+    target: string;
+    kind: "recall" | "reaction";
+    actor: string;
+    emoji: string;
+    id: string;
+    timestamp: number;
+    revision: number;
+    active: boolean;
+};
+export type ControlKey = [string, string, string, string, string, string];
+export declare const controlKey: (event: MessageControl) => ControlKey;
+export declare function newerControl(old: MessageControl | undefined, next: MessageControl): MessageControl;
+/** Body-free proofs retained independently of the visible history window. */
+export declare function messageControls(message: StoredMessage, scope: MessageScope, key: string): MessageControl[];
+export declare function applyMessageControls<T extends StoredMessage>(messages: T[], controls: readonly MessageControl[]): T[];