@pmate/chat-sdk 0.12.0-next.8 → 0.12.0-next.80

package/lib/runtime/messageStore.js

@@ -1,18 +1,35 @@
+import { recoverableTransactions } from "./indexedDbRecovery.js";
 import { Dexie } from "dexie";
+import { quotedMessageIds, redactMessageQuotes } from "./messageQuotes.js";
+import { messageControls, controlKey, newerControl, applyMessageControls } from "./messageControls.js";
 export const messageScopeKey = (scope) => JSON.stringify([scope.appId, scope.accountId, scope.profileId, scope.teamId]);
 /** Normalized browser cache. Data and coverage advance together in each commit.
  * Merge runs inside the write transaction against the latest cross-tab state. */
 export class IndexedDbMessageStore {
+    scope;
     merge;
+    transact;
     db;
     rows;
+    legacy;
     coverage;
+    accessRows;
+    controls;
+    closed = false;
     key;
     constructor(scope, merge, options = {}) {
+        this.scope = scope;
         this.merge = merge;
         this.key = messageScopeKey(scope);
         this.db = new Dexie(options.name ?? "pmate-chat-messages", { indexedDB: options.indexedDB ?? globalThis.indexedDB, IDBKeyRange: globalThis.IDBKeyRange });
+        this.transact = recoverableTransactions(this.db, () => this.closed);
         this.db.version(1).stores({ messages: "[scope+thread+id],[scope+thread+time+id],[scope+thread],scope", coverage: "[scope+thread],scope" });
+        this.db.version(2).stores({ legacyMessages: "[scope+thread+id],[scope+thread+time+id],[scope+thread],scope" });
+        this.db.version(3).stores({ scopeAccess: "scope" });
+        this.db.version(4).stores({ messageControls: "[scope+thread+target+kind+actor+emoji],[scope+thread+target],[scope+thread],scope" });
+        this.controls = this.db.table("messageControls");
+        this.accessRows = this.db.table("scopeAccess");
+        this.legacy = this.db.table("legacyMessages");
         this.rows = this.db.table("messages");
         this.coverage = this.db.table("coverage");
         this.db.on("versionchange", () => { this.db.close({ disableAutoOpen: false }); return false; });
@@ -21,11 +38,104 @@ export class IndexedDbMessageStore {
     async read(thread, limit = 100, before) {
         if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000)
             throw new Error("INVALID_MESSAGE_LIMIT");
-        return this.db.transaction("r", this.rows, this.coverage, async () => {
-            const range = this.rows.where("[scope+thread+time+id]").between([this.key, thread, Dexie.minKey, Dexie.minKey], [this.key, thread, before?.timestamp ?? Dexie.maxKey, before?.id ?? Dexie.maxKey], true, !before);
-            const records = await range.reverse().limit(limit + 1).toArray();
-            return { messages: records.slice(0, limit).reverse().map(row => row.value), hasEarlier: records.length > limit, coverage: await this.coverage.get([this.key, thread]) };
+        const page = await this.transact("r", this.rows, this.coverage, this.accessRows, this.controls, async () => {
+            const access = await this.scopeAccess();
+            if (access.revoked)
+                return { messages: [], hasEarlier: false, coverage: { complete: false, revoked: true, resetVersion: 0, scopeVersion: access.version } };
+            const records = await this.readRows(this.rows, thread, limit, before);
+            return this.controlPage({ messages: records.slice(0, limit).reverse().map(row => row.value), hasEarlier: records.length > limit, coverage: this.scopedCoverage(await this.coverage.get([this.key, thread]), access) });
         });
+        return this.finishPage(thread, page);
+    }
+    readRows(table, thread, limit, before) {
+        const lower = [this.key, thread, Dexie.minKey, Dexie.minKey], upper = [this.key, thread, before?.timestamp ?? Dexie.maxKey, before?.id ?? Dexie.maxKey];
+        const index = Dexie.currentTransaction.idbtrans.objectStore(table.name).index("[scope+thread+time+id]");
+        // Bounded batches avoid a browser round trip per history row. Older engines
+        // retain the same indexed cursor path and pagination boundaries.
+        if (typeof index.getAllRecords === "function")
+            return new Dexie.Promise((resolve, reject) => {
+                const request = index.getAllRecords({ query: IDBKeyRange.bound(lower, upper, false, Boolean(before)), count: limit + 1, direction: "prev" });
+                request.onsuccess = () => resolve(request.result.map(record => record.value));
+                request.onerror = () => reject(request.error);
+            });
+        return table.where("[scope+thread+time+id]").between(lower, upper, true, !before).reverse().limit(limit + 1).toArray();
+    }
+    /** Bounded identifier reads for SDK-owned view handoffs; no transport fallback. */
+    async readSelected(thread, ids) {
+        if (ids.length > 100 || ids.some(id => !id || id.length > 256))
+            throw new Error("INVALID_MESSAGE_SELECTION");
+        const page = await this.transact("r", this.rows, this.coverage, this.accessRows, this.controls, async () => {
+            const access = await this.scopeAccess();
+            const coverage = this.scopedCoverage(await this.coverage.get([this.key, thread]), access);
+            if (access.revoked || coverage?.revoked || (coverage?.scopeVersion ?? 0) !== access.version)
+                return { messages: [], hasEarlier: false, coverage: { ...coverage, complete: false, revoked: true, scopeVersion: access.version } };
+            const records = await this.rows.bulkGet([...new Set(ids)].map(id => [this.key, thread, id]));
+            return this.controlPage({ messages: records.flatMap(row => row ? [row.value] : []), hasEarlier: false, coverage });
+        });
+        return this.finishPage(thread, page);
+    }
+    /** Migration records never claim coverage or overwrite authoritative rows. */
+    async importLegacy(thread, messages) {
+        if (messages.length > 128)
+            throw new Error("MESSAGE_BATCH_TOO_LARGE");
+        let bytes = 0;
+        for (const message of messages) {
+            if (message.threadId !== thread || !message.id || !Number.isFinite(message.timestamp))
+                throw new Error("MESSAGE_SCOPE_MISMATCH");
+            bytes += new TextEncoder().encode(JSON.stringify(message)).byteLength;
+            if (bytes > 1_048_576)
+                throw new Error("MESSAGE_BATCH_TOO_LARGE");
+        }
+        return this.transact("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            const access = await this.scopeAccess();
+            const coverage = await this.coverage.get([this.key, thread]);
+            if (access.revoked || coverage?.revoked)
+                throw new Error("MESSAGE_ACCESS_REVOKED");
+            if (access.version > 0)
+                throw new Error("MESSAGE_PROJECTION_CHANGED");
+            const proofs = messages.map(message => messageControls(message, this.scope, this.key));
+            const controlsOnly = messages.length > 0 && proofs.every((events, index) => events.length > 0 && !messages[index].recalled && !messages[index].legacyDisplay?.recalled);
+            if (controlsOnly) {
+                await this.rememberControls(proofs.flat());
+                return 0;
+            }
+            if ((coverage?.resetVersion ?? 0) > 0)
+                throw new Error("MESSAGE_PROJECTION_CHANGED");
+            const ids = [...new Set(messages.map(message => message.id))], keys = ids.map(id => [this.key, thread, id]);
+            const authoritative = await this.rows.bulkGet(keys), previous = await this.legacy.bulkGet(keys);
+            const known = new Set(authoritative.flatMap(row => row ? [row.id] : []));
+            const latest = new Map(previous.flatMap(row => row ? [[row.id, row.value]] : [])), changed = new Map();
+            for (const message of messages) {
+                if (known.has(message.id))
+                    continue;
+                const old = latest.get(message.id), value = this.merge(old, message);
+                if (value.id !== message.id || value.threadId !== thread || !Number.isFinite(value.timestamp))
+                    throw new Error("MESSAGE_SCOPE_MISMATCH");
+                latest.set(message.id, value);
+                if (JSON.stringify(old) !== JSON.stringify(value))
+                    changed.set(message.id, { scope: this.key, thread, id: value.id, time: value.timestamp, value });
+            }
+            await this.rememberControls([...changed.values()].flatMap(row => messageControls(row.value, this.scope, this.key)));
+            if (changed.size)
+                await this.legacy.bulkPut([...changed.values()]);
+            return changed.size;
+        });
+    }
+    /** Bounded fallback only; callers must report an incomplete window. */
+    async readFallback(thread, limit = 100, before) {
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1000)
+            throw new Error("INVALID_MESSAGE_LIMIT");
+        const page = await this.transact("r", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            const access = await this.scopeAccess();
+            const coverage = access.revoked ? { complete: false, revoked: true, resetVersion: 0, scopeVersion: access.version } : this.scopedCoverage(await this.coverage.get([this.key, thread]), access);
+            if (coverage?.revoked)
+                return { messages: [], hasEarlier: false, coverage };
+            const read = (table) => this.readRows(table, thread, limit, before);
+            const [canonical, legacy] = await Promise.all([read(this.rows), read(this.legacy)]);
+            const rows = [...new Map([...legacy, ...canonical].map(row => [row.id, row])).values()].sort((a, b) => a.time - b.time || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+            return this.controlPage({ messages: rows.slice(-limit).map(row => row.value), hasEarlier: rows.length > limit, coverage });
+        });
+        return this.finishPage(thread, page);
     }
     async commit(thread, messages, coverage, guard) {
         for (const message of messages)
@@ -33,26 +143,41 @@ export class IndexedDbMessageStore {
                 throw new Error("MESSAGE_SCOPE_MISMATCH");
         if (messages.length > 1000)
             throw new Error("MESSAGE_BATCH_TOO_LARGE");
-        return this.db.transaction("rw", this.rows, this.coverage, async () => {
+        return this.transact("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            const access = await this.scopeAccess();
+            if ((guard?.scopeVersion ?? 0) !== access.version)
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            if (access.revoked) {
+                if (!guard?.authoritative)
+                    throw new Error("MESSAGE_ACCESS_REVOKED");
+                await this.clearScopeRows();
+                await this.accessRows.put({ ...access, revoked: false });
+            }
             const current = await this.coverage.get([this.key, thread]);
             if (guard && (current?.resetVersion ?? 0) !== guard.version)
                 throw new Error("MESSAGE_PROJECTION_CHANGED");
             if (guard && current?.revoked && !guard.authoritative)
                 throw new Error("MESSAGE_ACCESS_REVOKED");
             const ids = [...new Set(messages.map(message => message.id))];
-            const previous = await this.rows.bulkGet(ids.map(id => [this.key, thread, id]));
-            const latest = new Map(previous.flatMap(row => row ? [[row.id, row.value]] : []));
+            const keys = ids.map(id => [this.key, thread, id]);
+            const previous = await this.rows.bulkGet(keys), legacy = await this.legacy.bulkGet(keys);
+            const canonicalIds = new Set(previous.flatMap(row => row ? [row.id] : []));
+            const latest = new Map([...legacy, ...previous].flatMap(row => row ? [[row.id, row.value]] : []));
             const changed = new Map();
             for (const message of messages) {
                 const old = latest.get(message.id), value = this.merge(old, message);
                 if (value.id !== message.id || value.threadId !== thread || !Number.isFinite(value.timestamp))
                     throw new Error("MESSAGE_SCOPE_MISMATCH");
                 latest.set(message.id, value);
-                if (JSON.stringify(old) !== JSON.stringify(value))
+                if (!canonicalIds.has(message.id) || JSON.stringify(old) !== JSON.stringify(value))
                     changed.set(message.id, { scope: this.key, thread, id: value.id, time: value.timestamp, value });
             }
+            await this.rememberControls(messages.flatMap(message => messageControls(message, this.scope, this.key)));
             if (changed.size)
                 await this.rows.bulkPut([...changed.values()]);
+            const replaced = legacy.flatMap(row => row ? [[this.key, thread, row.id]] : []);
+            if (replaced.length)
+                await this.legacy.bulkDelete(replaced);
             if (coverage) {
                 const old = await this.coverage.get([this.key, thread]), next = { ...old, ...coverage, scope: this.key, thread };
                 if (JSON.stringify(old) !== JSON.stringify(next))
@@ -61,32 +186,141 @@ export class IndexedDbMessageStore {
             return changed.size;
         });
     }
+    async rememberControls(events) {
+        const latest = new Map();
+        for (const event of events) {
+            const key = JSON.stringify(controlKey(event));
+            latest.set(key, newerControl(latest.get(key), event));
+        }
+        const values = [...latest.values()];
+        for (let offset = 0; offset < values.length; offset += 128) {
+            const batch = values.slice(offset, offset + 128), previous = await this.controls.bulkGet(batch.map(controlKey));
+            const changed = batch.filter((event, index) => newerControl(previous[index], event) !== previous[index]);
+            if (changed.length)
+                await this.controls.bulkPut(changed);
+        }
+    }
+    async controlPage(page) {
+        const events = page.messages.flatMap(message => messageControls(message, this.scope, this.key));
+        const old = events.length ? await this.controls.bulkGet(events.map(controlKey)) : [];
+        const pendingControls = events.filter((event, index) => newerControl(old[index], event) !== old[index]);
+        const ids = new Set(page.messages.map(message => message.id));
+        const references = [...new Set(page.messages.flatMap(quotedMessageIds))].filter(id => !ids.has(id));
+        const thread = page.messages[0]?.threadId;
+        const targets = thread && references.length ? (await this.rows.bulkGet(references.map(id => [this.key, thread, id]))).flatMap(row => row ? [row.value] : []) : [];
+        const selected = [...page.messages, ...targets];
+        // Exact bounded index reads avoid serial cursor seeks across a message page.
+        const facts = (await Promise.all(selected.map(message => this.controls.where("[scope+thread+target]").equals([this.key, message.threadId, message.id]).toArray()))).flat();
+        const latest = new Map();
+        for (const event of [...facts, ...events]) {
+            const key = JSON.stringify(controlKey(event));
+            latest.set(key, newerControl(latest.get(key), event));
+        }
+        const controlled = applyMessageControls(selected, [...latest.values()]);
+        return { ...page, messages: redactMessageQuotes(controlled.slice(0, page.messages.length), controlled), pendingControls };
+    }
+    async finishPage(thread, page) {
+        const { pendingControls, ...result } = page;
+        // v3 caches migrate only source proofs from already-read pages, with no body
+        // rewrite. Steady reads remain a single read-only IndexedDB transaction.
+        if (pendingControls?.length)
+            await this.transact("rw", this.controls, this.coverage, this.accessRows, async () => {
+                const access = await this.scopeAccess(), current = await this.coverage.get([this.key, thread]);
+                if (access.revoked || access.version !== (page.coverage?.scopeVersion ?? 0))
+                    throw new Error("MESSAGE_SCOPE_CHANGED");
+                if ((current?.resetVersion ?? 0) !== (page.coverage?.resetVersion ?? 0))
+                    throw new Error("MESSAGE_PROJECTION_CHANGED");
+                await this.rememberControls(pendingControls);
+            });
+        return result;
+    }
     async windows() {
-        return this.coverage.where("scope").equals(this.key).toArray();
+        return this.transact("r", this.coverage, this.accessRows, async () => {
+            if ((await this.scopeAccess()).revoked)
+                return [];
+            return this.coverage.where("scope").equals(this.key).toArray();
+        });
+    }
+    async scopeAccess() {
+        const read = () => this.accessRows.get(this.key);
+        const access = (await (Dexie.currentTransaction?.db === this.db ? read() : this.transact("r", this.accessRows, read))) ?? { scope: this.key, version: 0, revoked: false };
+        if (!Number.isSafeInteger(access.version) || access.version < 0 || typeof access.revoked !== "boolean")
+            throw new Error("INVALID_MESSAGE_SCOPE_ACCESS");
+        return access;
+    }
+    /** Only fresh, server-confirmed authorization may lift this durable tombstone. */
+    async authorizeScope(expectedVersion) {
+        await this.transact("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            const access = await this.scopeAccess();
+            if (access.version !== expectedVersion)
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            if (!access.revoked)
+                return;
+            await this.clearScopeRows();
+            await this.accessRows.put({ ...access, revoked: false });
+        });
+    }
+    scopedCoverage(coverage, access) {
+        return access.version ? { ...coverage, complete: coverage?.complete ?? false, scopeVersion: access.version } : coverage;
+    }
+    async clearScopeRows() {
+        await this.controls.where("scope").equals(this.key).delete();
+        await this.rows.where("[scope+thread+id]").between([this.key, Dexie.minKey, Dexie.minKey], [this.key, Dexie.maxKey, Dexie.maxKey], true, true).delete();
+        await this.legacy.where("[scope+thread+id]").between([this.key, Dexie.minKey, Dexie.minKey], [this.key, Dexie.maxKey, Dexie.maxKey], true, true).delete();
+        await this.coverage.where("[scope+thread]").between([this.key, Dexie.minKey], [this.key, Dexie.maxKey], true, true).delete();
+    }
+    /** Persist the denial first; failed cleanup must never make cached rows readable. */
+    async revokeScope(expectedVersion) {
+        const access = await this.transact("rw", this.accessRows, async () => {
+            const old = await this.scopeAccess();
+            if (expectedVersion !== undefined && old.version !== expectedVersion)
+                return old;
+            const next = { scope: this.key, version: old.version + 1, revoked: true };
+            await this.accessRows.put(next);
+            return next;
+        });
+        await this.transact("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            const current = await this.scopeAccess();
+            if (current.version === access.version && current.revoked)
+                await this.clearScopeRows();
+        });
+        return access.version;
     }
     /** A durable epoch prevents another tab's pre-reset request from restoring rows. */
-    async resetThread(thread, revoked = false) {
-        return this.db.transaction("rw", this.rows, this.coverage, async () => {
+    async resetThread(thread, revoked = false, scopeVersion = 0) {
+        return this.transact("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            const access = await this.scopeAccess();
+            if (access.version !== scopeVersion)
+                throw new Error("MESSAGE_SCOPE_CHANGED");
+            if (access.revoked)
+                throw new Error("MESSAGE_ACCESS_REVOKED");
             const old = await this.coverage.get([this.key, thread]);
             const resetVersion = (old?.resetVersion ?? 0) + 1;
+            if (revoked)
+                await this.controls.where("[scope+thread]").equals([this.key, thread]).delete();
             await this.rows.where("[scope+thread]").equals([this.key, thread]).delete();
+            await this.legacy.where("[scope+thread]").equals([this.key, thread]).delete();
             await this.coverage.put({ scope: this.key, thread, complete: false, resetVersion, revoked });
             return resetVersion;
         });
     }
     async removeThread(thread) {
-        await this.db.transaction("rw", this.rows, this.coverage, async () => {
+        await this.transact("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            await this.controls.where("[scope+thread]").equals([this.key, thread]).delete();
             await this.rows.where("[scope+thread]").equals([this.key, thread]).delete();
+            await this.legacy.where("[scope+thread]").equals([this.key, thread]).delete();
             await this.coverage.delete([this.key, thread]);
         });
     }
     async clear() {
-        await this.db.transaction("rw", this.rows, this.coverage, async () => {
+        await this.transact("rw", [this.rows, this.legacy, this.coverage, this.accessRows, this.controls], async () => {
+            await this.controls.where("scope").equals(this.key).delete();
+            await this.legacy.where("scope").equals(this.key).delete();
             await this.rows.where("scope").equals(this.key).delete();
             await this.coverage.where("scope").equals(this.key).delete();
         });
     }
-    close() { this.db.close(); }
+    close() { this.closed = true; this.db.close(); }
 }
 /** Keep tombstones monotonic; applications can supply stricter domain reducers. */
 export function mergeStoredMessage(previous, incoming) {

package/lib/runtime/messageTimeline.d.ts

@@ -0,0 +1,50 @@
+import type { StoredMessage } from "./messageStore.js";
+import type { OutgoingMessage } from "./durableSender.js";
+import type { ChatRuntimeMessage } from "./protocol.js";
+import type { MessageReadingState, ReadingCandidate } from "./conversationReading.js";
+export type TimelineReactionEvent = Reaction & {
+    threadId: string;
+};
+export type TimelineReaction = {
+    emojiId: string;
+    userIds: string[];
+    mine: boolean;
+};
+export type TimelineItem<T> = {
+    id: string;
+    threadId: string;
+    timestamp: number;
+    from?: string;
+    mine: boolean;
+    status: "sending" | "sent" | "failed" | "read";
+    recalled: boolean;
+    unread?: boolean;
+    attentionEligible?: boolean;
+    message: T | undefined;
+    reading?: MessageReadingState;
+    reactions: readonly TimelineReaction[];
+    reactionEvents: readonly TimelineReactionEvent[];
+};
+type Reaction = {
+    id: string;
+    messageId: string;
+    from: string;
+    emojiId: string;
+    active: boolean;
+    revision: number;
+    timestamp: number;
+};
+/** Derives one display stream without copying bodies or creating another cache.
+ * Outgoing rows retain their wire identity; indexed rows take precedence. */
+export declare function projectMessageTimeline<T extends StoredMessage>(input: {
+    appId: string;
+    profileId: string;
+    threadId: string;
+    messages: readonly T[];
+    outgoing: readonly OutgoingMessage[];
+    decode: (message: ChatRuntimeMessage) => T | undefined;
+    reading: Readonly<Record<string, MessageReadingState>>;
+    candidates?: ReadonlyMap<string, ReadingCandidate>;
+    previous?: readonly TimelineItem<T>[];
+}): readonly TimelineItem<T>[];
+export {};

package/lib/runtime/messageTimeline.js

@@ -0,0 +1,120 @@
+import { isReadingControl } from "./readingContent.js";
+function content(message, appId) {
+    const body = message.body;
+    return body?.kind === "message" && body.content?.appId === appId ? body : undefined;
+}
+function nativeRecall(message, appId) {
+    const body = message.body;
+    return message.appId === appId && body?.kind === "recall" && typeof body.targetMessageId === "string" && body.targetMessageId.length > 0 && body.targetMessageId.length <= 256 ? body.targetMessageId : undefined;
+}
+function isControl(message, appId) { return isReadingControl(message.body, appId) || nativeRecall(message, appId) !== undefined; }
+function validReaction(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const event = value;
+    return [event.id, event.messageId, event.from, event.emojiId].every(field => typeof field === "string" && field.length > 0 && field.length <= 256) && typeof event.active === "boolean" && Number.isSafeInteger(event.revision) && event.revision >= 0 && Number.isFinite(event.timestamp);
+}
+/** Derives one display stream without copying bodies or creating another cache.
+ * Outgoing rows retain their wire identity; indexed rows take precedence. */
+export function projectMessageTimeline(input) {
+    const scoped = (message) => {
+        const value = message, body = value.body;
+        const app = body?.content?.appId ?? body?.payload?.appId;
+        return message.threadId === input.threadId && (value.appId === undefined || value.appId === input.appId) && (app === undefined || app === input.appId);
+    };
+    const tombstones = new Set(input.messages.filter(message => scoped(message) && (message.recalled || message.legacyDisplay?.recalled)).map(message => message.id));
+    const records = new Map();
+    for (const pending of input.outgoing) {
+        if (pending.threadId !== input.threadId || pending.confirmed)
+            continue;
+        const message = input.decode(pending.message);
+        if (message && scoped(message))
+            records.set(message.id, { message, status: pending.status });
+    }
+    for (const message of input.messages)
+        if (scoped(message)) {
+            const legacy = message.legacyDisplay;
+            if (legacy && records.has(message.id))
+                continue;
+            const legacyStatus = legacy?.status;
+            const status = legacyStatus === "failed" || legacyStatus === "sending" || legacyStatus === "read" ? legacyStatus : "sent";
+            records.set(message.id, { message, status });
+        }
+    const recalled = new Map(), reactions = new Map();
+    const addReaction = (event) => {
+        const key = JSON.stringify([event.messageId, event.from, event.emojiId]), old = reactions.get(key);
+        if (!old || event.revision > old.revision || event.revision === old.revision && (event.timestamp > old.timestamp || event.timestamp === old.timestamp && event.id > old.id))
+            reactions.set(key, event);
+    };
+    for (const { message, status } of records.values()) {
+        if (status === "failed" && isControl(message, input.appId))
+            continue;
+        const envelope = message, body = content(envelope, input.appId), target = nativeRecall(envelope, input.appId) ?? body?.content?.recall?.messageId;
+        if (typeof target === "string" && target.length > 0 && target.length <= 256 && envelope.from) {
+            if (!recalled.has(target))
+                recalled.set(target, new Set());
+            recalled.get(target).add(envelope.from);
+        }
+        const reaction = body?.content?.reaction;
+        if (body?.contentKind === "text" && reaction?.version === 1 && typeof reaction.messageId === "string" && typeof reaction.emojiId === "string" && typeof reaction.active === "boolean" && typeof reaction.revision === "number" && reaction.revision >= 1 && envelope.from) {
+            const event = { id: message.id, messageId: reaction.messageId, from: envelope.from, emojiId: reaction.emojiId, active: reaction.active, revision: reaction.revision, timestamp: message.timestamp };
+            if (validReaction(event))
+                addReaction(event);
+        }
+        const events = envelope.reactionEvents ?? envelope.legacyDisplay?.reactionEvents;
+        if (Array.isArray(events))
+            for (const event of events)
+                if (validReaction(event) && event.messageId === message.id && (event.threadId === undefined || event.threadId === input.threadId))
+                    addReaction(event);
+        // Old display-only imports may have aggregates but no event IDs. Treat them
+        // as revision-zero baselines; any durable control supersedes them.
+        const baseline = envelope.legacyDisplay?.reactions;
+        if (Array.isArray(baseline))
+            for (const value of baseline) {
+                if (typeof value?.emojiId !== "string" || !Array.isArray(value.userIds))
+                    continue;
+                for (const from of value.userIds) {
+                    const event = { id: `legacy:${message.id}`, messageId: message.id, from, emojiId: value.emojiId, active: true, revision: 0, timestamp: 0 };
+                    if (validReaction(event))
+                        addReaction(event);
+                }
+            }
+    }
+    const groupedEvents = new Map();
+    for (const event of reactions.values()) {
+        const values = groupedEvents.get(event.messageId) ?? [];
+        values.push({ ...event, threadId: input.threadId });
+        groupedEvents.set(event.messageId, values);
+    }
+    for (const values of groupedEvents.values())
+        values.sort((a, b) => a.from < b.from ? -1 : a.from > b.from ? 1 : a.emojiId < b.emojiId ? -1 : a.emojiId > b.emojiId ? 1 : 0);
+    const grouped = new Map();
+    for (const event of reactions.values())
+        if (event.active) {
+            if (!grouped.has(event.messageId))
+                grouped.set(event.messageId, new Map());
+            const emojis = grouped.get(event.messageId);
+            if (!emojis.has(event.emojiId))
+                emojis.set(event.emojiId, new Set());
+            emojis.get(event.emojiId).add(event.from);
+        }
+    const previous = new Map(input.previous?.map(item => [item.id, item]) ?? []);
+    const result = [];
+    for (const { message, status } of records.values()) {
+        const envelope = message;
+        if (isControl(envelope, input.appId))
+            continue;
+        const mine = envelope.from === input.profileId, reading = input.reading[message.id];
+        const withdrawn = Boolean(tombstones.has(message.id) || message.recalled || envelope.legacyDisplay?.recalled || envelope.from && recalled.get(message.id)?.has(envelope.from));
+        const candidate = input.candidates?.get(message.id);
+        const item = { id: message.id, threadId: message.threadId, timestamp: message.timestamp, from: envelope.from, mine, status: !mine && reading ? (reading.read ? "read" : status === "read" ? "sent" : status) : status, recalled: withdrawn, ...(candidate ? { unread: !mine && !withdrawn && (reading ? !reading.read : candidate.unread), attentionEligible: candidate.attentionEligible } : {}),
+            message: withdrawn ? undefined : message, reading, reactionEvents: withdrawn ? [] : groupedEvents.get(message.id) ?? [], reactions: withdrawn ? [] : [...(grouped.get(message.id) ?? [])].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([emojiId, users]) => { const userIds = [...users].sort(); return { emojiId, userIds, mine: userIds.includes(input.profileId) }; }) };
+        const old = previous.get(item.id);
+        const sameReading = old?.reading === item.reading || old?.reading?.seq === item.reading?.seq && old?.reading?.read === item.reading?.read && old?.reading?.readPolicy === item.reading?.readPolicy;
+        const sameReactions = old?.reactions.length === item.reactions.length && old.reactions.every((reaction, index) => { const next = item.reactions[index]; return reaction.emojiId === next.emojiId && reaction.mine === next.mine && reaction.userIds.length === next.userIds.length && reaction.userIds.every((user, i) => user === next.userIds[i]); });
+        const sameEvents = old?.reactionEvents.length === item.reactionEvents.length && old.reactionEvents.every((event, index) => { const next = item.reactionEvents[index]; return event.id === next.id && event.from === next.from && event.emojiId === next.emojiId && event.active === next.active && event.revision === next.revision && event.timestamp === next.timestamp && event.threadId === next.threadId && event.messageId === next.messageId; });
+        result.push(old && sameEvents && old.message === item.message && old.timestamp === item.timestamp && old.from === item.from && old.mine === item.mine && old.status === item.status && old.recalled === item.recalled && old.unread === item.unread && old.attentionEligible === item.attentionEligible && sameReading && sameReactions ? old : item);
+    }
+    result.sort((a, b) => a.timestamp - b.timestamp || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    return input.previous?.length === result.length && result.every((item, index) => item === input.previous[index]) ? input.previous : result;
+}

package/lib/runtime/outboxSchema.d.ts

@@ -0,0 +1,5 @@
+import { Dexie } from "dexie";
+/** Rename canonical rows without copying attachments in a versionchange transaction.
+ * An old sender must fail closed, rather than send a metadata-only voice wire. */
+export declare function prepareOutboxSchema(factory: IDBFactory, name: string): Promise<void>;
+export declare function outboxDatabase(factory: IDBFactory, name: string): Dexie;

package/lib/runtime/outboxSchema.js

@@ -0,0 +1,59 @@
+import { Dexie } from "dexie";
+const messageSchema = "[scope+hash],scope,[scope+threadId],[scope+pendingState+hash]";
+/** Rename canonical rows without copying attachments in a versionchange transaction.
+ * An old sender must fail closed, rather than send a metadata-only voice wire. */
+export async function prepareOutboxSchema(factory, name) {
+    const existing = await new Promise((resolve, reject) => {
+        const request = factory.open(name);
+        let fresh = false;
+        request.onupgradeneeded = event => { if (event.oldVersion === 0) {
+            fresh = true;
+            request.transaction.abort();
+        } };
+        request.onerror = event => { event.preventDefault(); if (fresh)
+            resolve(undefined);
+        else
+            reject(request.error); };
+        request.onsuccess = () => resolve(request.result);
+    });
+    if (!existing)
+        return;
+    const version = existing.version, prepared = existing.objectStoreNames.contains("outgoingMessages") && existing.objectStoreNames.contains("outgoingAttachments");
+    existing.close();
+    if (version >= 40 && prepared)
+        return;
+    await new Promise((resolve, reject) => {
+        const request = factory.open(name, Math.max(40, version + 1));
+        request.onerror = () => reject(request.error);
+        request.onupgradeneeded = () => {
+            const db = request.result, tx = request.transaction;
+            if (db.objectStoreNames.contains("outbox")) {
+                if (db.objectStoreNames.contains("outgoingMessages")) {
+                    tx.abort();
+                    return;
+                }
+                tx.objectStore("outbox").name = "outgoingMessages";
+            }
+            db.createObjectStore("outbox", { keyPath: "unsupportedOutboxFormat" });
+            const define = (name, keyPath, indexes) => {
+                const store = db.objectStoreNames.contains(name) ? tx.objectStore(name) : db.createObjectStore(name, { keyPath });
+                for (const [index, path] of Object.entries(indexes))
+                    if (!store.indexNames.contains(index))
+                        store.createIndex(index, path);
+            };
+            define("outgoingMessages", ["scope", "hash"], { scope: "scope", "[scope+threadId]": ["scope", "threadId"], "[scope+pendingState+hash]": ["scope", "pendingState", "hash"] });
+            define("outgoingAttachments", ["scope", "hash"], { scope: "scope" });
+            define("scopeEpochs", "scope", {});
+        };
+        request.onsuccess = () => { request.result.close(); resolve(); };
+    });
+}
+export function outboxDatabase(factory, name) {
+    const db = new Dexie(name, { indexedDB: factory, IDBKeyRange: globalThis.IDBKeyRange });
+    db.version(1).stores({ outbox: "[scope+hash],scope,[scope+threadId]" });
+    db.version(2).stores({ scopeEpochs: "scope" });
+    db.version(3).stores({ outbox: messageSchema });
+    db.version(4).stores({ outbox: "unsupportedOutboxFormat", outgoingMessages: messageSchema, outgoingAttachments: "[scope+hash],scope" });
+    db.version(5).stores({ outgoingControls: "[scope+threadId+target+emoji],scope" });
+    return db;
+}