@pmate/chat-sdk 0.12.0-next.7 → 0.12.0-next.70

package/lib/runtime/durableSender.js

@@ -1,12 +1,47 @@
 import { Dexie } from "dexie";
+import { validMessageIdentifier } from "./outgoingContent.js";
+import { outboxDatabase, prepareOutboxSchema } from "./outboxSchema.js";
+import { blake3 } from "@noble/hashes/blake3.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
 import { withChatTeam } from "./teamScope.js";
 import { messageScopeKey } from "./messageStore.js";
 /** Persists the exact wire message before sending; retries preserve its hash. */
 export class DurableChatSender {
     client;
     onError;
+    options;
     db;
     outbox;
+    controlRevisions;
+    attachments;
+    schemaReady;
+    attachmentBytes = 0;
+    attachmentLeases = new Map();
+    epochs;
+    uploads = new Set();
+    reconciliations = new Set();
+    firstDelivery = new Set();
+    ioQueue = [];
+    ioTimer;
+    ioRunning;
+    ioCount = 0;
+    ioBytes = 0;
+    acceptanceQueue = [];
+    acceptanceTimer;
+    acceptanceRunning;
+    acceptanceCount = 0;
+    acceptanceBytes = 0;
+    uploadTail = Promise.resolve();
+    uploadWaiting = 0;
+    confirmationQueue = [];
+    confirmationTimer;
+    confirmationRunning;
+    confirmationSize = 0;
+    version = 0;
+    withdrawn = false;
+    revoking;
+    channel;
+    accepted = new Set();
     scope;
     identity;
     values = new Map();
@@ -14,30 +49,233 @@ export class DurableChatSender {
     listeners = new Set();
     running = new Map();
     closed = false;
+    closing = false;
+    empty = [];
     offConnection;
     ready;
     constructor(client, scope, onError, options = {}) {
         this.client = client;
         this.onError = onError;
+        this.options = options;
         this.scope = messageScopeKey(scope);
         this.identity = { ...scope };
-        this.db = new Dexie(options.name ?? "pmate-chat-outbox", { indexedDB: options.indexedDB ?? globalThis.indexedDB, IDBKeyRange: globalThis.IDBKeyRange });
-        this.db.version(1).stores({ outbox: "[scope+hash],scope,[scope+threadId]" });
-        this.outbox = this.db.table("outbox");
-        this.ready = this.outbox.where("scope").equals(this.scope).toArray().then(records => {
-            if (this.closed)
-                return;
-            records.filter(record => !record.confirmed).forEach(record => this.values.set(record.hash, record));
-            this.emit();
-        });
+        const factory = options.indexedDB ?? globalThis.indexedDB, name = options.name ?? "pmate-chat-outbox";
+        this.schemaReady = prepareOutboxSchema(factory, name);
+        this.db = outboxDatabase(factory, name);
+        this.outbox = this.db.table("outgoingMessages");
+        this.attachments = this.db.table("outgoingAttachments");
+        this.controlRevisions = this.db.table("outgoingControls");
+        this.epochs = this.db.table("scopeEpochs");
+        this.outbox.hook("creating", (_key, row) => { row.pendingState = row.confirmed ? 0 : 1; });
+        this.outbox.hook("updating", (changes, _key, row) => ({ pendingState: (Object.hasOwn(changes, "confirmed") ? changes.confirmed : row.confirmed) ? 0 : 1 }));
+        this.db.on("versionchange", () => { this.db.close({ disableAutoOpen: false }); return false; });
+        this.ready = this.restore();
+        void this.ready.catch(() => { });
+        if (typeof BroadcastChannel !== "undefined") {
+            this.channel = new BroadcastChannel(`pmate-chat-outbox:${this.scope}:${this.db.name}`);
+            this.channel.onmessage = event => { if (Number.isSafeInteger(event.data?.version) && event.data.version > this.version)
+                this.withdraw(); };
+        }
         this.offConnection = client.watchConnection(state => {
             if (state === "connected")
                 void this.resume().catch(onError);
         });
     }
+    /** Read only the selected durable rows, without restoring or delivering an outbox. */
+    static async readSelected(scope, threadId, ids, version, options = {}) {
+        if (ids.length > 100)
+            throw new Error("INVALID_OUTBOX_SELECTION");
+        const key = messageScopeKey(scope), factory = options.indexedDB ?? globalThis.indexedDB, name = options.name ?? "pmate-chat-outbox";
+        await prepareOutboxSchema(factory, name);
+        const db = outboxDatabase(factory, name);
+        try {
+            return await db.transaction("r", db.table("outgoingMessages"), db.table("scopeEpochs"), async () => {
+                if (((await db.table("scopeEpochs").get(key))?.version ?? 0) !== version)
+                    return [];
+                const rows = [];
+                for (const id of ids) {
+                    const row = await db.table("outgoingMessages").get([key, id]);
+                    rows.push(row ? splitAttachment(row).record : undefined);
+                }
+                return rows.flatMap(row => row && row.scope === key && row.threadId === threadId && !row.confirmed && (row.accessVersion ?? 0) === version ? [splitAttachment(row).record] : []);
+            });
+        }
+        finally {
+            db.close();
+        }
+    }
+    async readAccess() {
+        const access = await this.options.access?.();
+        if (access && (!Number.isSafeInteger(access.version) || access.version < 0 || typeof access.allowed !== "boolean"))
+            throw new Error("INVALID_OUTBOX_ACCESS");
+        return access;
+    }
+    async restore() {
+        await this.schemaReady;
+        const access = await this.readAccess();
+        const loaded = await this.db.transaction("rw", this.outbox, this.epochs, this.attachments, this.controlRevisions, async () => {
+            const current = (await this.epochs.get(this.scope))?.version ?? 0;
+            const version = access?.version ?? current;
+            if (version < current)
+                throw new Error("OUTBOX_SCOPE_CHANGED");
+            if (version > current) {
+                await this.epochs.put({ scope: this.scope, version });
+                await this.deleteRows();
+            }
+            const total = await this.outbox.where("scope").equals(this.scope).count();
+            const indexed = await this.outbox.where("[scope+pendingState+hash]").between([this.scope, 0, Dexie.minKey], [this.scope, 1, Dexie.maxKey], true, true).count();
+            return { version, advanced: version > current, legacy: total !== indexed };
+        });
+        this.version = loaded.version;
+        if (loaded.advanced)
+            this.channel?.postMessage({ version: this.version });
+        if (this.closed || this.withdrawn)
+            return;
+        const current = await this.readAccess();
+        if (current && (!current.allowed || current.version !== this.version))
+            return;
+        if (access?.allowed === false)
+            return;
+        let after;
+        const restored = new Map();
+        while (!this.closed && !this.withdrawn) {
+            const batch = await this.db.transaction("rw", this.outbox, this.epochs, this.attachments, this.controlRevisions, async () => {
+                if (((await this.epochs.get(this.scope))?.version ?? 0) !== this.version)
+                    throw new Error("OUTBOX_SCOPE_CHANGED");
+                const keys = await (loaded.legacy
+                    ? this.outbox.where("[scope+hash]").between([this.scope, after ?? Dexie.minKey], [this.scope, Dexie.maxKey], after === undefined, true)
+                    : this.outbox.where("[scope+pendingState+hash]").between([this.scope, 1, after ?? Dexie.minKey], [this.scope, 1, Dexie.maxKey], after === undefined, true)).limit(64).primaryKeys();
+                if (!keys.length)
+                    return { last: undefined, records: [] };
+                const last = keys.at(-1)[1];
+                // Key-only metadata covers confirmed history without reading wire bodies.
+                // Missing metadata identifies rows written by an older SDK after upgrade.
+                const confirmed = loaded.legacy ? await this.outbox.where("[scope+pendingState+hash]").between([this.scope, 0, keys[0][1]], [this.scope, 0, last], true, true).primaryKeys() : [];
+                const confirmedHashes = new Set(confirmed.map(key => key[1]));
+                const needed = keys.filter(key => !confirmedHashes.has(key[1]));
+                const records = [], writes = [], payloads = [];
+                let bytes = 0, processed = last;
+                for (const key of needed) {
+                    const row = await this.outbox.get(key);
+                    if (!row)
+                        continue;
+                    const size = row.voiceData?.bytes.byteLength ?? row.voiceBlob?.size ?? 0;
+                    if (records.length && bytes + 2 * size > 16 * 1024 * 1024) {
+                        processed = records.at(-1).hash;
+                        break;
+                    }
+                    if (!row.confirmed && (row.accessVersion ?? 0) === this.version) {
+                        const split = splitAttachment(row);
+                        records.push(split.record);
+                        bytes += 2 * size;
+                        if (split.attachment) {
+                            payloads.push(split.attachment);
+                            writes.push(split.record);
+                        }
+                        else if (row.pendingState !== (row.confirmed ? 0 : 1))
+                            writes.push({ ...row, pendingState: row.confirmed ? 0 : 1 });
+                    }
+                    else if (row.pendingState !== (row.confirmed ? 0 : 1))
+                        writes.push({ ...row, pendingState: row.confirmed ? 0 : 1 });
+                }
+                if (payloads.length)
+                    await this.attachments.bulkPut(payloads);
+                if (writes.length)
+                    await this.outbox.bulkPut(writes);
+                return { last: processed, records };
+            });
+            for (const row of batch.records)
+                restored.set(row.hash, row);
+            if (batch.last === undefined)
+                break;
+            after = batch.last;
+            // Leave the database transaction before yielding to input/rendering work.
+            await new Promise(resolve => setTimeout(resolve, 0));
+        }
+        if (this.closed || this.withdrawn)
+            return;
+        const latest = await this.readAccess();
+        if (latest && (!latest.allowed || latest.version !== this.version))
+            return;
+        this.values = restored;
+        this.emit();
+    }
+    async checkAccess() {
+        if (this.closed)
+            throw new Error("CHAT_SENDER_CLOSED");
+        if (this.withdrawn)
+            throw new Error("OUTBOX_ACCESS_REVOKED");
+        const access = await this.readAccess();
+        if (access && access.version !== this.version) {
+            this.withdraw();
+            throw new Error("OUTBOX_SCOPE_CHANGED");
+        }
+        if (access && !access.allowed)
+            throw new Error("OUTBOX_ACCESS_REVOKED");
+    }
+    async withEpoch(mode, operation) {
+        await this.checkAccess();
+        try {
+            return await this.db.transaction(mode, this.outbox, this.epochs, this.attachments, this.controlRevisions, async () => {
+                if (this.closed || this.withdrawn)
+                    throw new Error("OUTBOX_ACCESS_REVOKED");
+                if (((await this.epochs.get(this.scope))?.version ?? 0) !== this.version)
+                    throw new Error("OUTBOX_SCOPE_CHANGED");
+                return operation();
+            });
+        }
+        catch (error) {
+            if (String(error).includes("OUTBOX_SCOPE_CHANGED"))
+                this.withdraw();
+            throw error;
+        }
+    }
+    async deleteRows() {
+        await this.outbox.where("[scope+hash]").between([this.scope, Dexie.minKey], [this.scope, Dexie.maxKey], true, true).delete();
+        await this.attachments.where("scope").equals(this.scope).delete();
+        await this.controlRevisions.where("scope").equals(this.scope).delete();
+    }
+    /** Stop disclosure immediately; durable invalidation is coordinated separately. */
+    withdraw() {
+        this.withdrawn = true;
+        this.failIO(new Error("OUTBOX_ACCESS_REVOKED"));
+        this.failAcceptances(new Error("OUTBOX_ACCESS_REVOKED"));
+        this.failConfirmations(new Error("OUTBOX_ACCESS_REVOKED"));
+        this.uploads.forEach(controller => controller.abort());
+        this.reconciliations.forEach(controller => controller.abort());
+        this.firstDelivery.clear();
+        this.attachmentLeases.forEach(release => release());
+        this.values.clear();
+        this.emit();
+    }
+    revoke(targetVersion) {
+        if (this.closed || this.closing)
+            return Promise.reject(new Error("CHAT_SENDER_CLOSED"));
+        if (this.revoking)
+            return this.revoking;
+        this.withdraw();
+        return this.revoking = (async () => {
+            await this.ready.catch(error => { if (!String(error).includes("OUTBOX_SCOPE_CHANGED"))
+                throw error; });
+            const version = await this.db.transaction("rw", this.outbox, this.epochs, this.attachments, this.controlRevisions, async () => {
+                const current = (await this.epochs.get(this.scope))?.version ?? 0;
+                const target = targetVersion ?? this.version + 1;
+                if (!Number.isSafeInteger(target) || target < 0)
+                    throw new Error("INVALID_OUTBOX_EPOCH");
+                if (current >= target)
+                    return current;
+                await this.epochs.put({ scope: this.scope, version: target });
+                await this.deleteRows();
+                return target;
+            });
+            this.channel?.postMessage({ version });
+        })();
+    }
     initialize() { return this.ready; }
     subscribe(listener) { this.listeners.add(listener); return () => { this.listeners.delete(listener); }; }
     snapshot(threadId) {
+        if (this.closed || this.closing || this.withdrawn)
+            return this.empty;
         let snapshot = this.snapshots.get(threadId);
         if (!snapshot) {
             snapshot = [...this.values.values()].filter(record => threadId === undefined || record.threadId === threadId);
@@ -50,7 +288,8 @@ export class DurableChatSender {
     /** Resolves after the exact wire message is durable, independently of network delivery. */
     async enqueue(threadId, input) {
         const message = await this.persistOutgoing(threadId, input);
-        void this.retry(message.hash).catch(error => this.onError(error));
+        if (!this.closed && !this.closing && !this.withdrawn)
+            void this.retry(message.hash).catch(error => this.onError(error));
         return message;
     }
     /** Compatibility API: resolves only after transport delivery. */
@@ -58,23 +297,155 @@ export class DurableChatSender {
         const message = await this.persistOutgoing(threadId, input);
         return this.retry(message.hash);
     }
-    async persistOutgoing(threadId, input) {
-        await this.ready;
-        if (this.closed)
-            throw new Error("CHAT_SENDER_CLOSED");
-        const message = this.client.prepareChat(input.to, withChatTeam(input.body, this.identity.teamId), input.recipients);
-        if (message.from !== this.identity.profileId)
-            throw new Error("OUTGOING_MESSAGE_IDENTITY_MISMATCH");
-        const record = { scope: this.scope, threadId, hash: message.hash, message, status: "sending" };
-        await this.outbox.put(record);
-        if (this.closed)
-            throw new Error("CHAT_SENDER_CLOSED");
-        this.values.set(record.hash, record);
-        this.emit();
-        return message;
+    persistOutgoing(threadId, input) {
+        if (this.closed || this.closing || this.withdrawn)
+            return Promise.reject(new Error("OUTBOX_ACCESS_REVOKED"));
+        if (input.voiceBlob && (!(input.voiceBlob instanceof Blob) || input.voiceBlob.size === 0 || input.voiceBlob.size > 16 * 1024 * 1024))
+            return Promise.reject(new Error("INVALID_VOICE_ATTACHMENT"));
+        const reactionFloor = input.reactionRevisionFloor;
+        if (reactionFloor !== undefined && input.voiceBlob)
+            return Promise.reject(new Error("INVALID_MESSAGE_REACTION"));
+        if (reactionFloor !== undefined && (!Number.isSafeInteger(reactionFloor) || reactionFloor < 0 || reactionFloor >= Number.MAX_SAFE_INTEGER))
+            return Promise.reject(new Error("INVALID_REACTION_REVISION"));
+        let bytes;
+        try {
+            bytes = JSON.stringify([input.to, input.body, input.recipients, this.identity]).length * 3 + 1024 + (input.voiceBlob?.size ?? 0);
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        if (bytes > 20 * 1024 * 1024)
+            return Promise.reject(new Error("OUTBOX_RECORD_TOO_LARGE"));
+        if (this.acceptanceCount >= 4096 || this.acceptanceBytes + bytes > 64 * 1024 * 1024)
+            return Promise.reject(new Error("OUTBOX_ACCEPTANCE_BACKPRESSURE"));
+        this.acceptanceCount++;
+        this.acceptanceBytes += bytes;
+        const pending = (async () => {
+            await this.ready;
+            await this.checkAccess();
+            const message = this.client.prepareChat(input.to, withChatTeam(input.body, this.identity.teamId), input.recipients);
+            if (message.from !== this.identity.profileId)
+                throw new Error("OUTGOING_MESSAGE_IDENTITY_MISMATCH");
+            if (reactionFloor !== undefined) {
+                const body = message.body;
+                const reaction = body.kind === "message" ? body.content.reaction : undefined;
+                if (body.kind !== "message" || body.content.appId !== this.identity.appId || !reaction || reaction.version !== 1 || !validMessageIdentifier(reaction.messageId) || !validMessageIdentifier(reaction.emojiId) || typeof reaction.active !== "boolean")
+                    throw new Error("INVALID_MESSAGE_REACTION");
+            }
+            const command = statefulGroup(message);
+            if (command)
+                message.hash = commandId(this.scope, this.version, threadId, message);
+            if (input.voiceBlob) {
+                const body = message.body;
+                if (body.kind !== "message" || !validVoice(body.content.voice))
+                    throw new Error("INVALID_VOICE_ATTACHMENT");
+            }
+            const record = { ...(input.voiceBlob ? { voiceData: { bytes: await input.voiceBlob.arrayBuffer(), type: input.voiceBlob.type } } : {}), scope: this.scope, threadId, hash: message.hash, message, status: "sending", accessVersion: this.version };
+            const durable = await new Promise((resolve, reject) => {
+                this.acceptanceQueue.push({ record, reactionFloor, bytes, resolve, reject });
+                this.scheduleAcceptances();
+            });
+            return durable.message;
+        })().finally(() => { this.accepted.delete(pending); this.acceptanceCount--; this.acceptanceBytes -= bytes; });
+        this.accepted.add(pending);
+        return pending;
+    }
+    scheduleAcceptances() {
+        if (this.acceptanceTimer || this.acceptanceRunning || !this.acceptanceQueue.length)
+            return;
+        this.acceptanceTimer = setTimeout(() => { this.acceptanceTimer = undefined; void this.drainAcceptances(); }, 16);
+    }
+    failAcceptances(error) {
+        clearTimeout(this.acceptanceTimer);
+        this.acceptanceTimer = undefined;
+        for (const item of this.acceptanceQueue.splice(0))
+            item.reject(error);
+    }
+    drainAcceptances() {
+        const task = (async () => {
+            let bytes = 0, count = 0, operations = 0;
+            for (const item of this.acceptanceQueue) {
+                const size = item.bytes;
+                if (operations + (hasVoice(item.record) || item.reactionFloor !== undefined ? 2 : 1) > 128 || (count > 0 && bytes + size > 20 * 1024 * 1024))
+                    break;
+                bytes += size;
+                count++;
+                operations += hasVoice(item.record) || item.reactionFloor !== undefined ? 2 : 1;
+            }
+            const batch = this.acceptanceQueue.splice(0, count);
+            try {
+                const result = await this.withEpoch("rw", async () => {
+                    const commands = batch.filter(item => statefulGroup(item.record.message));
+                    const previous = await this.outbox.bulkGet(commands.map(item => [this.scope, item.record.hash]));
+                    const known = new Map(previous.filter((row) => Boolean(row && (row.accessVersion ?? 0) === this.version)).map(row => [row.hash, row]));
+                    const writes = [], records = [], revisions = new Map();
+                    for (const item of batch) {
+                        let record = item.record;
+                        if (item.reactionFloor !== undefined) {
+                            const body = record.message.body;
+                            const reaction = body.content.reaction;
+                            const key = [this.scope, record.threadId, reaction.messageId, reaction.emojiId], encoded = JSON.stringify(key);
+                            const previous = revisions.get(encoded) ?? await this.controlRevisions.get(key);
+                            const revision = Math.max(item.reactionFloor, previous?.version === this.version ? previous.value : 0) + 1;
+                            if (!Number.isSafeInteger(revision))
+                                throw new Error("INVALID_REACTION_REVISION");
+                            revisions.set(encoded, { scope: this.scope, threadId: record.threadId, target: reaction.messageId, emoji: reaction.emojiId, version: this.version, value: revision });
+                            record = { ...record, message: { ...record.message, body: { ...body, content: { ...body.content, reaction: { ...reaction, revision } } } } };
+                        }
+                        const command = statefulGroup(record.message), old = command ? known.get(record.hash) : undefined;
+                        if (old) {
+                            if (old.message.from !== this.identity.profileId || old.message.hash !== record.hash || commandId(this.scope, this.version, record.threadId, old.message) !== record.hash)
+                                throw new Error("OUTGOING_COMMAND_CONFLICT");
+                            records.push(old);
+                        }
+                        else {
+                            writes.push(record);
+                            records.push(record);
+                            if (command)
+                                known.set(record.hash, record);
+                        }
+                    }
+                    const split = writes.map(splitAttachment), payloads = split.flatMap(item => item.attachment ? [item.attachment] : []);
+                    if (payloads.length)
+                        await this.attachments.bulkPut(payloads);
+                    if (revisions.size)
+                        await this.controlRevisions.bulkPut([...revisions.values()]);
+                    if (split.length)
+                        await this.outbox.bulkPut(split.map(item => item.record));
+                    const metadata = new Map(split.map(item => [item.record.hash, item.record]));
+                    return { writes: split.map(item => item.record), records: records.map(record => metadata.get(record.hash) ?? record) };
+                });
+                await this.checkAccess();
+                for (const record of result.writes)
+                    if (statefulGroup(record.message))
+                        this.firstDelivery.add(record.hash);
+                let changed = false;
+                for (const record of result.records) {
+                    if (record.confirmed) {
+                        this.firstDelivery.delete(record.hash);
+                        changed = this.values.delete(record.hash) || changed;
+                    }
+                    else {
+                        const current = this.values.get(record.hash);
+                        if (!current || current.status !== record.status || current.accessVersion !== record.accessVersion) {
+                            this.values.set(record.hash, record);
+                            changed = true;
+                        }
+                    }
+                }
+                if (changed)
+                    this.emit();
+                batch.forEach((item, index) => item.resolve(result.records[index]));
+            }
+            catch (error) {
+                batch.forEach(item => item.reject(error));
+            }
+        })().finally(() => { this.acceptanceRunning = undefined; this.scheduleAcceptances(); });
+        this.acceptanceRunning = task;
+        return task;
     }
     retry(hash) {
-        if (this.closed)
+        if (this.closed || this.closing || this.withdrawn)
             return Promise.reject(new Error("CHAT_SENDER_CLOSED"));
         const running = this.running.get(hash);
         if (running)
@@ -85,88 +456,392 @@ export class DurableChatSender {
     }
     async transmit(hash) {
         await this.ready;
-        const record = await this.outbox.get([this.scope, hash]);
-        if (!record || this.closed)
+        let record = await this.queueIO(hash);
+        if (!record || this.closed || this.withdrawn)
             throw new Error("OUTGOING_MESSAGE_UNAVAILABLE");
-        if (record.status === "sent" || record.confirmed)
+        if (record.status === "sent" || record.confirmed) {
+            this.firstDelivery.delete(hash);
             return record.message;
+        }
         const sending = { ...record, status: "sending" };
         if (record.status !== "sending") {
             const latest = await this.save(sending);
             if (!latest || latest.confirmed || latest.status === "sent")
                 return latest?.message ?? record.message;
         }
+        await this.checkAccess();
         if (this.values.get(hash)?.status !== "sending") {
             this.values.set(hash, sending);
             this.emit();
         }
+        let transmitting = false;
         try {
+            if (statefulGroup(record.message) && !this.firstDelivery.delete(hash)) {
+                const confirmed = await this.reconcile(record);
+                if (confirmed) {
+                    await this.confirm([hash]);
+                    return record.message;
+                }
+            }
+            if (hasVoice(record)) {
+                record = await this.prepareVoice(record);
+                if (record.confirmed || record.status === "sent")
+                    return record.message;
+            }
+            await this.checkAccess();
+            if (this.closing)
+                throw new Error("CHAT_SENDER_CLOSED");
+            transmitting = true;
             const message = await this.client.sendPrepared(record.message);
             const sent = { ...record, message, status: "sent" };
-            const committed = await this.save(sent);
-            if (!this.closed) {
-                if (committed?.confirmed || !committed)
-                    this.values.delete(hash);
-                else
-                    this.values.set(hash, committed);
-                this.emit();
-            }
+            await this.save(sent);
             return message;
         }
         catch (error) {
-            if (!this.closed) {
+            // A failed delivery can already be durable remotely, including the first
+            // lost ACK. Proof recovery never sends a second wire in this attempt.
+            if (statefulGroup(record.message) && this.options.reconcile && transmitting && !this.closed && !this.closing && !this.withdrawn) {
+                try {
+                    if (await this.reconcile(record)) {
+                        await this.confirm([hash]);
+                        return record.message;
+                    }
+                }
+                catch (verificationError) {
+                    error = new AggregateError([error, verificationError], "OUTBOX_RECONCILIATION_FAILED");
+                }
+            }
+            if (!this.closed && !this.withdrawn && !(this.closing && statefulGroup(record.message))) {
                 const failed = { ...record, status: "failed" };
                 const committed = await this.save(failed);
-                if (committed?.confirmed || committed?.status === "sent") {
-                    this.values.delete(hash);
-                    this.emit();
+                if (committed?.confirmed || committed?.status === "sent")
                     return committed.message;
-                }
-                if (committed)
-                    this.values.set(hash, committed);
-                else
-                    this.values.delete(hash);
-                this.emit();
             }
             throw error;
         }
     }
-    async save(record) {
-        return this.db.transaction("rw", this.outbox, async () => {
-            const previous = await this.outbox.get([this.scope, record.hash]);
-            if (!previous || previous.confirmed || previous.status === "sent")
-                return previous;
-            await this.outbox.put(record);
-            return record;
-        });
+    async reconcile(record) {
+        await this.checkAccess();
+        if (this.closing || this.closed || this.withdrawn)
+            throw new Error("OUTBOX_RECONCILIATION_ABORTED");
+        if (!this.options.reconcile)
+            throw new Error("OUTBOX_RECONCILIATION_UNAVAILABLE");
+        const controller = new AbortController();
+        this.reconciliations.add(controller);
+        let abort;
+        const stopped = new Promise((_, reject) => { abort = () => reject(new Error("OUTBOX_RECONCILIATION_ABORTED")); controller.signal.addEventListener("abort", abort, { once: true }); });
+        const timer = setTimeout(() => controller.abort(), 10_000);
+        try {
+            const confirmed = await Promise.race([this.options.reconcile({ threadId: record.threadId, message: record.message }, controller.signal), stopped]);
+            await this.checkAccess();
+            if (this.closing || controller.signal.aborted)
+                throw new Error("OUTBOX_RECONCILIATION_ABORTED");
+            return confirmed;
+        }
+        finally {
+            clearTimeout(timer);
+            controller.signal.removeEventListener("abort", abort);
+            this.reconciliations.delete(controller);
+        }
+    }
+    /** Only explicit playback/transcription acquires a local payload, never snapshots. */
+    async acquireVoice(hash, threadId) {
+        await this.ready;
+        await this.checkAccess();
+        const record = await this.queueIO(hash);
+        if (!record || record.threadId !== threadId || !hasVoice(record))
+            return undefined;
+        const releaseBudget = this.reserveAttachment(record), key = Symbol(hash);
+        let url, released = false;
+        const release = () => { if (released)
+            return; released = true; if (url)
+            URL.revokeObjectURL(url); releaseBudget(); this.attachmentLeases.delete(key); };
+        this.attachmentLeases.set(key, release);
+        try {
+            const blob = await this.readVoice(record);
+            await this.checkAccess();
+            if (released || this.closing)
+                throw new Error("CHAT_SENDER_CLOSED");
+            url = URL.createObjectURL(blob);
+            return { url, release };
+        }
+        catch (error) {
+            release();
+            throw error;
+        }
+    }
+    reserveAttachment(record) {
+        const size = record.voiceAttachment?.size ?? record.voiceData?.bytes.byteLength ?? record.voiceBlob?.size ?? 0;
+        if (!Number.isSafeInteger(size) || size <= 0 || size > 16 * 1024 * 1024)
+            throw new Error("INVALID_VOICE_ATTACHMENT");
+        // Charge both the native read buffer and Blob construction, including active leases.
+        const bytes = 2 * size;
+        if (this.attachmentBytes + bytes > 64 * 1024 * 1024)
+            throw new Error("VOICE_ATTACHMENT_BACKPRESSURE");
+        this.attachmentBytes += bytes;
+        let released = false;
+        return () => { if (!released) {
+            released = true;
+            this.attachmentBytes -= bytes;
+        } };
+    }
+    async readVoice(record) {
+        const row = await this.withEpoch("r", () => this.attachments.get([this.scope, record.hash]));
+        await this.checkAccess();
+        if (!row || row.accessVersion !== this.version || row.size !== record.voiceAttachment?.size || row.type !== record.voiceAttachment.type || (row.bytes?.byteLength ?? row.blob?.size) !== row.size)
+            throw new Error("VOICE_ATTACHMENT_UNAVAILABLE");
+        return row.blob ?? new Blob([row.bytes], { type: row.type });
+    }
+    async prepareVoice(record) {
+        if (this.uploadWaiting >= 32)
+            throw new Error("VOICE_UPLOAD_BACKPRESSURE");
+        this.uploadWaiting++;
+        const previous = this.uploadTail;
+        let release;
+        this.uploadTail = new Promise(resolve => { release = resolve; });
+        try {
+            await previous;
+            await this.checkAccess();
+            if (this.closing)
+                throw new Error("CHAT_SENDER_CLOSED");
+            const latest = await this.queueIO(record.hash);
+            if (!latest)
+                throw new Error("OUTGOING_MESSAGE_UNAVAILABLE");
+            if (!hasVoice(latest) || latest.confirmed || latest.status === "sent")
+                return latest;
+            if (!this.options.uploadVoice)
+                throw new Error("VOICE_UPLOAD_UNAVAILABLE");
+            const release = this.reserveAttachment(latest);
+            const controller = new AbortController();
+            this.uploads.add(controller);
+            const timeout = setTimeout(() => controller.abort(), 30_000);
+            let url;
+            try {
+                const blob = await this.readVoice(latest);
+                if (controller.signal.aborted || this.closing)
+                    throw new Error("CHAT_SENDER_CLOSED");
+                url = await this.options.uploadVoice(blob, controller.signal);
+            }
+            finally {
+                release();
+                clearTimeout(timeout);
+                this.uploads.delete(controller);
+            }
+            const parsed = new URL(url);
+            if (!["https:", "http:"].includes(parsed.protocol) || parsed.username || parsed.password)
+                throw new Error("INVALID_VOICE_UPLOAD_URL");
+            await this.checkAccess();
+            if (this.closing)
+                throw new Error("CHAT_SENDER_CLOSED");
+            const { voiceBlob: _blob, voiceData: _data, voiceAttachment: _attachment, ...uploaded } = latest;
+            const committed = await this.queueIO(record.hash, { ...uploaded, message: withVoiceUrl(latest.message, url) }, true);
+            if (!committed)
+                throw new Error("OUTGOING_MESSAGE_UNAVAILABLE");
+            return committed;
+        }
+        finally {
+            this.uploadWaiting--;
+            release();
+        }
+    }
+    save(record) { return this.queueIO(record.hash, record); }
+    queueIO(hash, record, uploaded = false) {
+        if (this.closed || this.withdrawn)
+            return Promise.reject(new Error("OUTBOX_ACCESS_REVOKED"));
+        const value = record ?? this.values.get(hash);
+        const bytes = value ? JSON.stringify(value.message).length * 3 + (value.voiceData?.bytes.byteLength ?? value.voiceBlob?.size ?? 0) : 0;
+        if (bytes > 20 * 1024 * 1024)
+            return Promise.reject(new Error("OUTBOX_RECORD_TOO_LARGE"));
+        if (this.ioCount >= 4096 || this.ioBytes + bytes > 64 * 1024 * 1024)
+            return Promise.reject(new Error("OUTBOX_IO_BACKPRESSURE"));
+        this.ioCount++;
+        this.ioBytes += bytes;
+        return new Promise((resolve, reject) => {
+            this.ioQueue.push({ hash, record, uploaded, bytes, resolve, reject });
+            this.scheduleIO();
+        }).finally(() => { this.ioCount--; this.ioBytes -= bytes; });
+    }
+    scheduleIO() {
+        if (this.ioTimer || this.ioRunning || !this.ioQueue.length)
+            return;
+        this.ioTimer = setTimeout(() => { this.ioTimer = undefined; void this.drainIO(); }, 16);
+    }
+    failIO(error) {
+        clearTimeout(this.ioTimer);
+        this.ioTimer = undefined;
+        for (const item of this.ioQueue.splice(0))
+            item.reject(error);
+    }
+    drainIO() {
+        const task = (async () => {
+            let count = 0, bytes = 0, operations = 0;
+            for (const item of this.ioQueue) {
+                if (operations + (item.uploaded ? 2 : 1) > 128 || (count > 0 && bytes + item.bytes > 20 * 1024 * 1024))
+                    break;
+                count++;
+                bytes += item.bytes;
+                operations += item.uploaded ? 2 : 1;
+            }
+            const batch = this.ioQueue.splice(0, count);
+            try {
+                const records = await this.withEpoch(batch.some(item => item.record) ? "rw" : "r", async () => {
+                    const hashes = [...new Set(batch.map(item => item.hash))];
+                    const rows = await this.outbox.bulkGet(hashes.map(hash => [this.scope, hash]));
+                    const current = new Map(hashes.map((hash, index) => [hash, rows[index]]));
+                    const writes = new Map(), result = [];
+                    for (const item of batch) {
+                        const previous = current.get(item.hash);
+                        // Preserve another document's confirmation, sent status or uploaded URL.
+                        if (item.record && previous && !previous.confirmed && previous.status !== "sent" && !(hasVoice(item.record) && !hasVoice(previous)) && !(item.uploaded && !hasVoice(previous))) {
+                            current.set(item.hash, item.record);
+                            writes.set(item.hash, item.record);
+                        }
+                        result.push(current.get(item.hash));
+                    }
+                    if (writes.size) {
+                        await this.outbox.bulkPut([...writes.values()]);
+                        const released = [...writes.values()].filter(record => !hasVoice(record) && hasVoice(rows[hashes.indexOf(record.hash)]));
+                        if (released.length)
+                            await this.attachments.bulkDelete(released.map(record => [this.scope, record.hash]));
+                    }
+                    return result;
+                });
+                await this.checkAccess();
+                let changed = false;
+                batch.forEach((item, index) => {
+                    if (!item.record)
+                        return;
+                    const record = records[index], old = this.values.get(item.hash);
+                    if (!record || record.confirmed) {
+                        changed = this.values.delete(item.hash) || changed;
+                    }
+                    else if (!old || old.status !== record.status || old.accessVersion !== record.accessVersion || JSON.stringify(old.message) !== JSON.stringify(record.message) || hasVoice(old) !== hasVoice(record)) {
+                        this.values.set(item.hash, record);
+                        changed = true;
+                    }
+                });
+                if (changed)
+                    this.emit();
+                batch.forEach((item, index) => item.resolve(records[index]));
+            }
+            catch (error) {
+                batch.forEach(item => item.reject(error));
+            }
+        })().finally(() => { this.ioRunning = undefined; this.scheduleIO(); });
+        this.ioRunning = task;
+        return task;
     }
     /** Confirm only after the authoritative message has been durably merged.
      * A tombstone prevents another tab's late failure from recreating the outbox. */
-    async confirm(hashes) {
+    confirm(hashes) {
         hashes = [...new Set(hashes)];
         if (!hashes.length)
+            return Promise.resolve();
+        if (this.closed || this.closing || this.withdrawn)
+            return Promise.reject(new Error("OUTBOX_ACCESS_REVOKED"));
+        if (this.confirmationSize + hashes.length > 4096)
+            return Promise.reject(new Error("OUTBOX_CONFIRM_BACKPRESSURE"));
+        const pending = new Promise((resolve, reject) => this.confirmationQueue.push({ hashes, resolve, reject }));
+        this.confirmationSize += hashes.length;
+        this.scheduleConfirmations();
+        return pending;
+    }
+    scheduleConfirmations() {
+        if (this.confirmationTimer !== undefined || this.confirmationRunning || !this.confirmationQueue.length)
             return;
-        await this.ready;
-        await this.db.transaction("rw", this.outbox, async () => {
-            const previous = await this.outbox.bulkGet(hashes.map(hash => [this.scope, hash]));
-            const confirmed = previous.filter((record) => Boolean(record && !record.confirmed)).map(record => ({ ...record, status: "sent", confirmed: true }));
-            if (confirmed.length)
-                await this.outbox.bulkPut(confirmed);
+        this.confirmationTimer = setTimeout(() => { this.confirmationTimer = undefined; void this.drainConfirmations(); }, 16);
+    }
+    drainConfirmations() {
+        if (this.confirmationRunning)
+            return this.confirmationRunning;
+        const batch = this.confirmationQueue.splice(0);
+        if (!batch.length)
+            return Promise.resolve();
+        const size = batch.reduce((sum, item) => sum + item.hashes.length, 0);
+        return this.confirmationRunning = (async () => {
+            let failed = false, error;
+            try {
+                await this.confirmNow([...new Set(batch.flatMap(item => item.hashes))]);
+            }
+            catch (reason) {
+                failed = true;
+                error = reason;
+            }
+            this.confirmationSize -= size;
+            for (const item of batch)
+                if (failed)
+                    item.reject(error);
+                else
+                    item.resolve();
+        })().finally(() => {
+            this.confirmationRunning = undefined;
+            this.scheduleConfirmations();
         });
+    }
+    failConfirmations(error) {
+        clearTimeout(this.confirmationTimer);
+        this.confirmationTimer = undefined;
+        for (const item of this.confirmationQueue.splice(0)) {
+            this.confirmationSize -= item.hashes.length;
+            item.reject(error);
+        }
+    }
+    async flushConfirmations() {
+        while (this.confirmationRunning || this.confirmationQueue.length) {
+            clearTimeout(this.confirmationTimer);
+            this.confirmationTimer = undefined;
+            await (this.confirmationRunning ?? this.drainConfirmations());
+        }
+    }
+    async confirmNow(hashes) {
+        await this.ready;
         let changed = false;
-        for (const hash of hashes)
-            changed = this.values.delete(hash) || changed;
-        if (changed)
-            this.emit();
+        try {
+            for (let offset = 0; offset < hashes.length;) {
+                let end = offset, operations = 0;
+                while (end < hashes.length) {
+                    const known = this.values.get(hashes[end]), cost = known && !hasVoice(known) ? 1 : 2;
+                    if (operations + cost > 128)
+                        break;
+                    operations += cost;
+                    end++;
+                }
+                const batch = hashes.slice(offset, end);
+                await this.withEpoch("rw", async () => {
+                    const previous = await this.outbox.bulkGet(batch.map(hash => [this.scope, hash]));
+                    const confirmed = previous.filter((record) => Boolean(record && !record.confirmed)).map(record => ({ ...record, voiceBlob: undefined, voiceData: undefined, voiceAttachment: undefined, status: "sent", confirmed: true }));
+                    if (confirmed.length) {
+                        await this.outbox.bulkPut(confirmed);
+                        const voices = previous.filter((record) => Boolean(record && hasVoice(record)));
+                        if (voices.length)
+                            await this.attachments.bulkDelete(voices.map(record => [this.scope, record.hash]));
+                    }
+                });
+                // Retire only committed rows. A later failed transaction leaves the
+                // remaining sends retryable, including after a browser restart.
+                for (const hash of batch) {
+                    changed = this.values.delete(hash) || changed;
+                }
+                offset = end;
+                if (offset < hashes.length)
+                    await new Promise(resolve => setTimeout(resolve, 0));
+            }
+        }
+        finally {
+            // One confirmation operation publishes at most once, also on partial
+            // failure so consumers see exactly the progress that was committed.
+            if (changed)
+                this.emit();
+        }
     }
     async resume() {
         await this.ready;
-        if (this.closed)
+        if (this.closed || this.closing || this.withdrawn)
             return;
         // Only interrupted, unconfirmed sends resume automatically; failed sends require retry.
         for (const record of this.values.values())
             if (record.status === "sending") {
-                if (this.closed)
+                if (this.closed || this.withdrawn)
                     return;
                 try {
                     await this.retry(record.hash);
@@ -177,11 +852,51 @@ export class DurableChatSender {
             }
     }
     async close() {
-        this.closed = true;
+        this.closing = true;
+        this.attachmentLeases.forEach(release => release());
+        this.uploads.forEach(controller => controller.abort());
+        this.reconciliations.forEach(controller => controller.abort());
         this.offConnection();
         this.listeners.clear();
-        await this.ready;
-        await Promise.allSettled([...this.running.values()]);
-        this.db.close();
+        this.channel?.close();
+        this.channel = undefined;
+        try {
+            await this.ready;
+            await this.flushConfirmations();
+            await Promise.allSettled([...this.accepted, ...this.running.values(), ...(this.revoking ? [this.revoking] : [])]);
+        }
+        finally {
+            this.closed = true;
+            this.failConfirmations(new Error("CHAT_SENDER_CLOSED"));
+            this.firstDelivery.clear();
+            this.attachmentLeases.forEach(release => release());
+            this.values.clear();
+            this.snapshots.clear();
+            this.db.close();
+        }
     }
 }
+function statefulGroup(message) { const body = message.body; return body?.kind === "group" && (body.action === "groupCreate" || body.action === "groupUpdate"); }
+function commandId(scope, version, threadId, message) {
+    return bytesToHex(blake3(new TextEncoder().encode(JSON.stringify(["chat-command:v1", scope, version, threadId, message.to, ordered(message.body)]))));
+}
+function ordered(value) {
+    if (Array.isArray(value))
+        return value.map(ordered);
+    if (value && typeof value === "object")
+        return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => [key, ordered(item)]));
+    return value;
+}
+function validVoice(value) { const voice = value; return Boolean(voice && typeof voice.url === "string" && Number.isFinite(voice.durationMs) && voice.durationMs > 0); }
+function withVoiceUrl(message, url) {
+    const body = message.body;
+    return { ...message, body: { ...body, content: { ...body.content, voice: { ...body.content.voice, url } } } };
+}
+function hasVoice(record) { return Boolean(record && (record.voiceBlob || record.voiceData || record.voiceAttachment)); }
+function splitAttachment(record) {
+    const { voiceBlob, voiceData, ...metadata } = record;
+    if (!voiceBlob && !voiceData)
+        return { record: metadata };
+    const size = voiceData?.bytes.byteLength ?? voiceBlob.size, type = voiceData?.type ?? voiceBlob.type;
+    return { record: { ...metadata, pendingState: record.confirmed ? 0 : 1, voiceAttachment: { size, type } }, attachment: { scope: record.scope, hash: record.hash, accessVersion: record.accessVersion ?? 0, size, type, ...(voiceData ? { bytes: voiceData.bytes } : { blob: voiceBlob }) } };
+}