@ttt-productions/chat-react 0.12.9 → 0.12.11

package/dist/index.d.ts

@@ -13,7 +13,7 @@ export type { RealtimeChatClient, RealtimeTransportConfig, ChannelClientState, C
 export type { ChatShellProps } from "./ui/ChatShell.js";
 export { ChatShell } from "./ui/ChatShell.js";
 export { MessageList } from "./ui/MessageList.js";
-export type { ComposerProps } from "./ui/Composer.js";
+export type { ComposerProps, ComposerHandle } from "./ui/Composer.js";
 export { Composer } from "./ui/Composer.js";
 export type { MessageItemDefaultProps } from "./ui/MessageItemDefault.js";
 export { MessageItemDefault } from "./ui/MessageItemDefault.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAM/C,YAAY,EACV,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AAGjD,YAAY,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAE9C,YAAY,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAKjE,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,6BAA6B,EAC7B,aAAa,EACb,eAAe,EACf,cAAc,EACd,cAAc,EACd,aAAa,EACb,cAAc,EACd,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAU7B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EACL,mBAAmB,EACnB,KAAK,wBAAwB,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,wCAAwC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,YAAY,EACV,cAAc,EACd,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAM/C,YAAY,EACV,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AAGjD,YAAY,EAAE,6BAA6B,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAE9C,YAAY,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAKjE,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,6BAA6B,EAC7B,aAAa,EACb,eAAe,EACf,cAAc,EACd,cAAc,EACd,aAAa,EACb,cAAc,EACd,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAU7B,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EACL,mBAAmB,EACnB,KAAK,wBAAwB,GAC9B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,wCAAwC,CAAC"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AA2Bb,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAU/C,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AAIjD,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,+EAA+E;AAC/E,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAC;AA+B7B,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAyB,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EACL,mBAAmB,GAEpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,GAKvB,MAAM,wCAAwC,CAAC","sourcesContent":["\"use client\";\n\n// @ttt-productions/chat-react — chat React UI, hooks, the Firebase-client\n// adapter config types, and React render types. Depends on the pure\n// @ttt-productions/chat-core for contracts, parser, and grouping.\n//\n// Apps import chat CSS via \"@ttt-productions/chat-react/styles\".\n\n// React-coupled config + render types (previously on chat-core root).\nexport type {\n  ChatCoreConfig,\n  ChatTransportMode,\n  ChatRealtimeTransportConfig,\n  ChatAttachmentConfig,\n  ChatUploadAdapter,\n  ChatMentionConfig,\n  MessageRenderer,\n  MessageRendererRegistry,\n  RenderableMentionProvider,\n  MentionResultRenderer,\n} from \"./types.js\";\n\n// Attachment-URL resolver context (render-time URL building from mediaAssetId).\nexport type {\n  ChatAttachmentUrlResolver,\n  ChatAttachmentUrlProviderProps,\n} from \"./context/ChatAttachmentUrlContext.js\";\nexport {\n  ChatAttachmentUrlProvider,\n  useChatAttachmentUrlResolver,\n} from \"./context/ChatAttachmentUrlContext.js\";\n\n// Attachment media-component injection (optional) — the app hands chat its own\n// display-path wrapper (recovery adapter, diagnostics, telemetry) so chat\n// media rides the same pipeline as every other surface; default stays the\n// package MediaViewer.\nexport type {\n  ChatAttachmentMediaComponent,\n  ChatAttachmentMediaProviderProps,\n} from \"./context/ChatAttachmentMediaContext.js\";\nexport {\n  ChatAttachmentMediaProvider,\n  useChatAttachmentMediaComponent,\n} from \"./context/ChatAttachmentMediaContext.js\";\n\n// Name-resolver context.\nexport type { ChatNameResolverProviderProps } from \"./context/ChatNameResolverContext.js\";\nexport {\n  ChatNameResolverProvider,\n  useChatNameResolver,\n  useOptionalChatNameResolver,\n  useResolvedSenderName,\n} from \"./context/ChatNameResolverContext.js\";\n\nexport type { UseChatMessagesResult } from \"./hooks/useChatMessages.js\";\nexport { useChatMessages } from \"./hooks/useChatMessages.js\";\nexport { canAccessThread } from \"./hooks/useChatThreadAccess.js\";\n\n// Realtime (Cloudflare Durable Object) transport — the client half of the chat\n// worker wire protocol. Opt-in via `ChatCoreConfig.transport === 'realtime'`; the\n// firestore transport stays the unchanged default. See docs/packages/chat-react.md.\nexport {\n  createRealtimeChatClient,\n  createInboxClient,\n  ChannelClient,\n  InboxClient,\n  useRealtimeChatMessages,\n  browserSocketFactory,\n  ChatAccessDeniedError,\n  isChatAccessDeniedError,\n  CHAT_SUBPROTOCOL,\n  CHAT_CLOSE_CODES,\n  CLIENT_FRAME,\n  SERVER_FRAME,\n  buildFrame,\n  parseFrame,\n} from \"./realtime/index.js\";\nexport type {\n  RealtimeChatClient,\n  RealtimeTransportConfig,\n  ChannelClientState,\n  ChannelClientConfig,\n  InboxClientState,\n  InboxClientConfig,\n  UseRealtimeChatMessagesResult,\n  GrantProvider,\n  TransportTimers,\n  RealtimeStatus,\n  RealtimeSocket,\n  SocketFactory,\n  SocketHandlers,\n  ChannelRefTuple,\n  WireMessageRow,\n  WireInboxSnapshot,\n  WireRegistryEntry,\n  ServerFrame,\n} from \"./realtime/index.js\";\n\n// TODO (re-export when a consumer needs them): the moderation-overlay helpers\n// `RevisionKind`, `ModerationOverlay`, `applyModerationOverlay`, `overlayFromRow`,\n// and `MODERATION_REDACTED_TEXT` live in `./realtime` but are intentionally NOT\n// re-exported from this package root yet — the consuming app's renderer reads moderation\n// state off `message.meta` (the realtime client applies the overlay internally), so\n// nothing imports them from here today. Add them to the block above when a consumer\n// genuinely needs to apply the overlay directly. (Comment-only; rides the next publish.)\n\nexport type { ChatShellProps } from \"./ui/ChatShell.js\";\nexport { ChatShell } from \"./ui/ChatShell.js\";\nexport { MessageList } from \"./ui/MessageList.js\";\nexport type { ComposerProps } from \"./ui/Composer.js\";\nexport { Composer } from \"./ui/Composer.js\";\nexport type { MessageItemDefaultProps } from \"./ui/MessageItemDefault.js\";\nexport { MessageItemDefault } from \"./ui/MessageItemDefault.js\";\nexport { MessageActions, ThreadActions } from \"./ui/menus.js\";\nexport { MessageText, type MessageTextProps } from \"./mentions/MessageText.js\";\nexport {\n  MentionAutocomplete,\n  type MentionAutocompleteProps,\n} from \"./mentions/MentionAutocomplete.js\";\nexport {\n  useMentionAutocomplete,\n  type UseMentionAutocompleteArgs,\n  type UseMentionAutocompleteResult,\n  type AutocompleteState,\n  type AutocompleteResultGroup,\n} from \"./mentions/use-mention-autocomplete.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AA2Bb,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAU/C,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,yCAAyC,CAAC;AAIjD,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,+EAA+E;AAC/E,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,UAAU,GACX,MAAM,qBAAqB,CAAC;AA+B7B,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAyB,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EACL,mBAAmB,GAEpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,GAKvB,MAAM,wCAAwC,CAAC","sourcesContent":["\"use client\";\n\n// @ttt-productions/chat-react — chat React UI, hooks, the Firebase-client\n// adapter config types, and React render types. Depends on the pure\n// @ttt-productions/chat-core for contracts, parser, and grouping.\n//\n// Apps import chat CSS via \"@ttt-productions/chat-react/styles\".\n\n// React-coupled config + render types (previously on chat-core root).\nexport type {\n  ChatCoreConfig,\n  ChatTransportMode,\n  ChatRealtimeTransportConfig,\n  ChatAttachmentConfig,\n  ChatUploadAdapter,\n  ChatMentionConfig,\n  MessageRenderer,\n  MessageRendererRegistry,\n  RenderableMentionProvider,\n  MentionResultRenderer,\n} from \"./types.js\";\n\n// Attachment-URL resolver context (render-time URL building from mediaAssetId).\nexport type {\n  ChatAttachmentUrlResolver,\n  ChatAttachmentUrlProviderProps,\n} from \"./context/ChatAttachmentUrlContext.js\";\nexport {\n  ChatAttachmentUrlProvider,\n  useChatAttachmentUrlResolver,\n} from \"./context/ChatAttachmentUrlContext.js\";\n\n// Attachment media-component injection (optional) — the app hands chat its own\n// display-path wrapper (recovery adapter, diagnostics, telemetry) so chat\n// media rides the same pipeline as every other surface; default stays the\n// package MediaViewer.\nexport type {\n  ChatAttachmentMediaComponent,\n  ChatAttachmentMediaProviderProps,\n} from \"./context/ChatAttachmentMediaContext.js\";\nexport {\n  ChatAttachmentMediaProvider,\n  useChatAttachmentMediaComponent,\n} from \"./context/ChatAttachmentMediaContext.js\";\n\n// Name-resolver context.\nexport type { ChatNameResolverProviderProps } from \"./context/ChatNameResolverContext.js\";\nexport {\n  ChatNameResolverProvider,\n  useChatNameResolver,\n  useOptionalChatNameResolver,\n  useResolvedSenderName,\n} from \"./context/ChatNameResolverContext.js\";\n\nexport type { UseChatMessagesResult } from \"./hooks/useChatMessages.js\";\nexport { useChatMessages } from \"./hooks/useChatMessages.js\";\nexport { canAccessThread } from \"./hooks/useChatThreadAccess.js\";\n\n// Realtime (Cloudflare Durable Object) transport — the client half of the chat\n// worker wire protocol. Opt-in via `ChatCoreConfig.transport === 'realtime'`; the\n// firestore transport stays the unchanged default. See docs/packages/chat-react.md.\nexport {\n  createRealtimeChatClient,\n  createInboxClient,\n  ChannelClient,\n  InboxClient,\n  useRealtimeChatMessages,\n  browserSocketFactory,\n  ChatAccessDeniedError,\n  isChatAccessDeniedError,\n  CHAT_SUBPROTOCOL,\n  CHAT_CLOSE_CODES,\n  CLIENT_FRAME,\n  SERVER_FRAME,\n  buildFrame,\n  parseFrame,\n} from \"./realtime/index.js\";\nexport type {\n  RealtimeChatClient,\n  RealtimeTransportConfig,\n  ChannelClientState,\n  ChannelClientConfig,\n  InboxClientState,\n  InboxClientConfig,\n  UseRealtimeChatMessagesResult,\n  GrantProvider,\n  TransportTimers,\n  RealtimeStatus,\n  RealtimeSocket,\n  SocketFactory,\n  SocketHandlers,\n  ChannelRefTuple,\n  WireMessageRow,\n  WireInboxSnapshot,\n  WireRegistryEntry,\n  ServerFrame,\n} from \"./realtime/index.js\";\n\n// TODO (re-export when a consumer needs them): the moderation-overlay helpers\n// `RevisionKind`, `ModerationOverlay`, `applyModerationOverlay`, `overlayFromRow`,\n// and `MODERATION_REDACTED_TEXT` live in `./realtime` but are intentionally NOT\n// re-exported from this package root yet — the consuming app's renderer reads moderation\n// state off `message.meta` (the realtime client applies the overlay internally), so\n// nothing imports them from here today. Add them to the block above when a consumer\n// genuinely needs to apply the overlay directly. (Comment-only; rides the next publish.)\n\nexport type { ChatShellProps } from \"./ui/ChatShell.js\";\nexport { ChatShell } from \"./ui/ChatShell.js\";\nexport { MessageList } from \"./ui/MessageList.js\";\nexport type { ComposerProps, ComposerHandle } from \"./ui/Composer.js\";\nexport { Composer } from \"./ui/Composer.js\";\nexport type { MessageItemDefaultProps } from \"./ui/MessageItemDefault.js\";\nexport { MessageItemDefault } from \"./ui/MessageItemDefault.js\";\nexport { MessageActions, ThreadActions } from \"./ui/menus.js\";\nexport { MessageText, type MessageTextProps } from \"./mentions/MessageText.js\";\nexport {\n  MentionAutocomplete,\n  type MentionAutocompleteProps,\n} from \"./mentions/MentionAutocomplete.js\";\nexport {\n  useMentionAutocomplete,\n  type UseMentionAutocompleteArgs,\n  type UseMentionAutocompleteResult,\n  type AutocompleteState,\n  type AutocompleteResultGroup,\n} from \"./mentions/use-mention-autocomplete.js\";\n"]}

package/dist/realtime/channel-client.d.ts

@@ -107,13 +107,51 @@ export declare class ChannelClient {
     /**
      * Flip an un-acked optimistic row to a visible failed state. The pending entry is
      * RETAINED (marked `failed`) so retrySend() can re-queue it with the SAME
-     * clientMessageId; the row is marked `meta.sendFailed` so the default renderer
-     * shows a failure with a retry affordance rather than an indistinguishable
-     * "sent" bubble. A late ack/echo still reconciles + clears it.
+     * clientMessageId; the row is marked `meta.sendFailed` (plus the correlated
+     * `sendFailureCode`/`sendRetryable` when a `send-rejected` frame supplied them) so
+     * the default renderer shows the right reason + retry affordance rather than an
+     * indistinguishable "sent" bubble. A late ack/echo still reconciles + clears it.
+     *
+     * `code`/`retryable` are present for a correlated rejection (terminal) or a
+     * budget-exhausted server-retryable send; absent for a blind reconnect give-up
+     * (which keeps the neutral `send-failed` code).
      */
     private failPendingSend;
+    /** Clear a pending send's per-send retry timer (idempotent). */
+    private clearSendRetryTimer;
+    /**
+     * Stop tracking a send (acked / reconciled by an echo / history row): cancel its
+     * per-send retry timer first so a late reconcile never leaves a stray timer that
+     * would resend after the send already landed, then drop it from the map.
+     */
+    private clearPendingSend;
     /** One timer for the membership-pending re-send window; a newer frame resets it. */
     private scheduleMembershipPendingRetry;
+    /**
+     * Handle a CORRELATED `send-rejected` frame (the target protocol): parse the
+     * untrusted payload with the shared schema, correlate to EXACTLY ONE pending send
+     * by clientMessageId, and either fail just that bubble (terminal) or schedule a
+     * single per-send resend (retryable).
+     *
+     * A frame that fails validation is NOT simply dropped when it still names one of
+     * OUR pending sends: unlike an unknown frame type, an id-correlated rejection is
+     * the server explicitly telling us this send did not land — swallowing it would
+     * strand the bubble on "Sending…" forever (no further frame, no reconnect, no
+     * budget check ever runs). A future/unknown rejection code (version skew during a
+     * rollout) therefore fails that send CLOSED with the neutral copy + Retry. A
+     * malformed frame with no recognizable pending id is dropped (forward-compat
+     * noise), never surfaced as an error.
+     */
+    private applySendRejected;
+    /**
+     * Schedule EXACTLY ONE per-send resend of a correlated retryable rejection (never
+     * stacks — a newer rejection clears the prior timer first). When it fires it
+     * re-sends the SAME clientMessageId (the DO dedups) unless the wall-clock budget
+     * has elapsed, in which case the send fails with its recorded reason.
+     */
+    private scheduleSendRetry;
+    /** Clamp a server `retryAfterMs` hint into a sane resend delay (defaulting when absent). */
+    private clampRetryDelay;
     /**
      * Flip EVERY un-acked pending send to the visible failed state. Called on the
      * terminal close paths (4403 REVOKED, reconnect give-up) — without this, a send

package/dist/realtime/channel-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channel-client.d.ts","sourceRoot":"","sources":["../../src/realtime/channel-client.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAWhE,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AASjE,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA0BlF,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,cAAc,CAAC;IACvB,mFAAmF;IACnF,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6DAA6D;IAC7D,eAAe,EAAE,OAAO,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,EAAE,OAAO,CAAC;IAClB,kGAAkG;IAClG,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;;;;OASG;IACH,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,iGAAiG;IACjG,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,aAAa,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,6DAA6D;IAC7D,SAAS,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE,CAAC;CAC/G;AAwBD,qBAAa,aAAa;IA6CZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IA5CnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8C;IAExE,wFAAwF;IACxF,OAAO,CAAC,SAAS,CAAK;IACtB;2CACuC;IACvC,OAAO,CAAC,WAAW,CAAsD;IACzE,iGAAiG;IACjG,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAA0D;IAChF,OAAO,CAAC,YAAY,CAAgE;IACpF,OAAO,CAAC,gBAAgB,CAA4B;IACpD,OAAO,CAAC,cAAc,CAA0D;IAChF,iFAAiF;IACjF,OAAO,CAAC,oBAAoB,CAA0D;IACtF,OAAO,CAAC,UAAU,CAAS;IAC3B;;;;;;qCAMiC;IACjC,OAAO,CAAC,QAAQ,CAAwC;IACxD;;;sFAGkF;IAClF,OAAO,CAAC,YAAY,CAAoC;IACxD;;;;;;;wDAOoD;IACpD,OAAO,CAAC,YAAY,CAAkC;gBAEzB,MAAM,EAAE,mBAAmB;IAOxD,QAAQ,IAAI,kBAAkB;IAI9B,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,IAAI,GAAG,MAAM,IAAI;IAK1D,OAAO,CAAC,QAAQ;IAOV,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAchB,UAAU;IA4BxB,OAAO,CAAC,MAAM;IAqBd;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAsB1B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAYvB,oFAAoF;IACpF,OAAO,CAAC,8BAA8B;IAStC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAM3B;;;;;;;;OAQG;IACH,SAAS,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAoB3C,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,OAAO;IA4Bf,OAAO,CAAC,iBAAiB;IAiBzB;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,SAAS;IAsCjB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAoB1B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB,kFAAkF;IAClF,OAAO,CAAC,SAAS;IAOjB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,oBAAoB;IAmC5B,OAAO,CAAC,YAAY;IAOpB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,QAAQ;IAsBhB,OAAO,CAAC,gBAAgB;IAmCxB,OAAO,CAAC,WAAW;IAgBnB,OAAO,CAAC,SAAS;IAMjB;;;OAGG;IACH,IAAI,CAAC,IAAI,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO;IAsCxH;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO;IAKnD,yEAAyE;IACzE,MAAM,IAAI,IAAI;IAOd,iBAAiB,IAAI,IAAI;IAKzB,mBAAmB,IAAI,IAAI;IAM3B,2FAA2F;IAC3F,UAAU,IAAI,IAAI;IAQlB,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,aAAa;IASrB,8EAA8E;IAC9E,KAAK,IAAI,IAAI;CAuBd"}
+{"version":3,"file":"channel-client.d.ts","sourceRoot":"","sources":["../../src/realtime/channel-client.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAahE,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AASjE,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA6ClF,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,cAAc,CAAC;IACvB,mFAAmF;IACnF,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6DAA6D;IAC7D,eAAe,EAAE,OAAO,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,EAAE,OAAO,CAAC;IAClB,kGAAkG;IAClG,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;;;;OASG;IACH,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,iGAAiG;IACjG,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,aAAa,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,6DAA6D;IAC7D,SAAS,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE,CAAC;CAC/G;AAwBD,qBAAa,aAAa;IA6CZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IA5CnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8C;IAExE,wFAAwF;IACxF,OAAO,CAAC,SAAS,CAAK;IACtB;2CACuC;IACvC,OAAO,CAAC,WAAW,CAAsD;IACzE,iGAAiG;IACjG,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAA0D;IAChF,OAAO,CAAC,YAAY,CAAgE;IACpF,OAAO,CAAC,gBAAgB,CAA4B;IACpD,OAAO,CAAC,cAAc,CAA0D;IAChF,iFAAiF;IACjF,OAAO,CAAC,oBAAoB,CAA0D;IACtF,OAAO,CAAC,UAAU,CAAS;IAC3B;;;;;;qCAMiC;IACjC,OAAO,CAAC,QAAQ,CAAwC;IACxD;;;sFAGkF;IAClF,OAAO,CAAC,YAAY,CAAoC;IACxD;;;;;;;wDAOoD;IACpD,OAAO,CAAC,YAAY,CAAkC;gBAEzB,MAAM,EAAE,mBAAmB;IAOxD,QAAQ,IAAI,kBAAkB;IAI9B,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,IAAI,GAAG,MAAM,IAAI;IAK1D,OAAO,CAAC,QAAQ;IAOV,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAchB,UAAU;IA4BxB,OAAO,CAAC,MAAM;IAqBd;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAuC1B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,eAAe;IA0BvB,gEAAgE;IAChE,OAAO,CAAC,mBAAmB;IAO3B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAMxB,oFAAoF;IACpF,OAAO,CAAC,8BAA8B;IAStC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,iBAAiB;IAyCzB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAuCzB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAQvB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAM3B;;;;;;;;OAQG;IACH,SAAS,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO;IAiC3C,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,OAAO;IA4Bf,OAAO,CAAC,iBAAiB;IAiBzB;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,SAAS;IAgDjB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAoB1B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAOxB,kFAAkF;IAClF,OAAO,CAAC,SAAS;IAOjB;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,oBAAoB;IAmC5B,OAAO,CAAC,YAAY;IAOpB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,QAAQ;IA6BhB,OAAO,CAAC,gBAAgB;IAmCxB,OAAO,CAAC,WAAW;IAgBnB,OAAO,CAAC,SAAS;IAMjB;;;OAGG;IACH,IAAI,CAAC,IAAI,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO;IAwCxH;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO;IAKnD,yEAAyE;IACzE,MAAM,IAAI,IAAI;IAOd,iBAAiB,IAAI,IAAI;IAKzB,mBAAmB,IAAI,IAAI;IAM3B,2FAA2F;IAC3F,UAAU,IAAI,IAAI;IAQlB,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,aAAa;IASrB,8EAA8E;IAC9E,KAAK,IAAI,IAAI;CAyBd"}

package/dist/realtime/channel-client.js

@@ -15,9 +15,9 @@
 //
 // Timers are injected (setTimeout/clearTimeout/now) so tests run deterministically.
 import { createReconnectController } from '@ttt-productions/realtime-core';
-import { CLIENT_FRAME, CHAT_CLOSE_CODES, buildFrame, parseFrame, isInboxSnapshot, } from './wire.js';
+import { CLIENT_FRAME, CHAT_CLOSE_CODES, buildFrame, parseFrame, isInboxSnapshot, ChatSendRejectedPayloadSchema, } from './wire.js';
 import { wireRowToMessage, optimisticMessage, seqToMessageId, applyModerationOverlay, overlayFromRow, } from './map.js';
-import { defaultTimers, isChatAccessDeniedError, HEARTBEAT_MS, TYPING_COALESCE_MS, HISTORY_PAGE_MAX, MAX_PENDING_SEND_ATTEMPTS, PENDING_SEND_MAX_AGE_MS, } from './shared.js';
+import { defaultTimers, isChatAccessDeniedError, HEARTBEAT_MS, TYPING_COALESCE_MS, HISTORY_PAGE_MAX, MAX_PENDING_SEND_ATTEMPTS, PENDING_SEND_MAX_AGE_MS, SERVER_RETRYABLE_MAX_AGE_MS, SEND_RETRY_MIN_DELAY_MS, SEND_RETRY_MAX_DELAY_MS, } from './shared.js';
 const INITIAL = {
     status: 'idle',
     messages: [],
@@ -182,11 +182,29 @@ export class ChannelClient {
             // re-queues it; the automatic reconnect resend leaves it alone.
             if (pending.failed)
                 continue;
-            const tooOld = now - pending.sentAt >= PENDING_SEND_MAX_AGE_MS;
-            const tooManyAttempts = pending.attempts >= MAX_PENDING_SEND_ATTEMPTS;
-            if (tooOld || tooManyAttempts) {
-                this.failPendingSend(pending.clientMessageId);
-                continue;
+            if (pending.serverRetryable) {
+                // The Worker declared this send retryable — give-up is the wall-clock budget
+                // ONLY (the 5-attempt cap must not fail a server-declared transient after
+                // ~10 s while the backend projection window is up to 60+ s).
+                if (now - pending.sentAt >= SERVER_RETRYABLE_MAX_AGE_MS) {
+                    this.failPendingSend(pending.clientMessageId, pending.lastRejectionCode, true);
+                    continue;
+                }
+                // This reconnect resend supersedes any per-send timer scheduled before the
+                // socket dropped — clear it so the send doesn't go out twice (the DO would
+                // dedup, but the duplicate frame is pure waste). A fresh rejection frame
+                // re-schedules as usual.
+                this.clearSendRetryTimer(pending);
+            }
+            else {
+                // A blind reconnect resend of a send the server has said nothing about: the
+                // generic attempt/age caps still protect against a permanent ghost.
+                const tooOld = now - pending.sentAt >= PENDING_SEND_MAX_AGE_MS;
+                const tooManyAttempts = pending.attempts >= MAX_PENDING_SEND_ATTEMPTS;
+                if (tooOld || tooManyAttempts) {
+                    this.failPendingSend(pending.clientMessageId);
+                    continue;
+                }
             }
             const sent = this.sendFrame(CLIENT_FRAME.SEND, {
                 clientMessageId: pending.clientMessageId,
@@ -200,19 +218,52 @@ export class ChannelClient {
     /**
      * Flip an un-acked optimistic row to a visible failed state. The pending entry is
      * RETAINED (marked `failed`) so retrySend() can re-queue it with the SAME
-     * clientMessageId; the row is marked `meta.sendFailed` so the default renderer
-     * shows a failure with a retry affordance rather than an indistinguishable
-     * "sent" bubble. A late ack/echo still reconciles + clears it.
+     * clientMessageId; the row is marked `meta.sendFailed` (plus the correlated
+     * `sendFailureCode`/`sendRetryable` when a `send-rejected` frame supplied them) so
+     * the default renderer shows the right reason + retry affordance rather than an
+     * indistinguishable "sent" bubble. A late ack/echo still reconciles + clears it.
+     *
+     * `code`/`retryable` are present for a correlated rejection (terminal) or a
+     * budget-exhausted server-retryable send; absent for a blind reconnect give-up
+     * (which keeps the neutral `send-failed` code).
      */
-    failPendingSend(clientMessageId) {
+    failPendingSend(clientMessageId, code, retryable) {
         const pending = this.pendingSends.get(clientMessageId);
         if (!pending || pending.failed)
             return;
         pending.failed = true;
+        // A terminal/exhausted send never retries on a timer — cancel any scheduled one.
+        this.clearSendRetryTimer(pending);
         const next = this.state.messages.map((m) => m.meta?.optimistic && m.meta?.clientMessageId === clientMessageId
-            ? { ...m, meta: { ...m.meta, sendFailed: true } }
+            ? {
+                ...m,
+                meta: {
+                    ...m.meta,
+                    sendFailed: true,
+                    ...(code ? { sendFailureCode: code } : {}),
+                    ...(retryable != null ? { sendRetryable: retryable } : {}),
+                },
+            }
             : m);
-        this.setState({ messages: next, lastErrorCode: 'send-failed' });
+        this.setState({ messages: next, lastErrorCode: code ?? 'send-failed' });
+    }
+    /** Clear a pending send's per-send retry timer (idempotent). */
+    clearSendRetryTimer(pending) {
+        if (pending.retryTimer != null) {
+            this.timers.clearTimeout(pending.retryTimer);
+            pending.retryTimer = null;
+        }
+    }
+    /**
+     * Stop tracking a send (acked / reconciled by an echo / history row): cancel its
+     * per-send retry timer first so a late reconcile never leaves a stray timer that
+     * would resend after the send already landed, then drop it from the map.
+     */
+    clearPendingSend(clientMessageId) {
+        const pending = this.pendingSends.get(clientMessageId);
+        if (pending)
+            this.clearSendRetryTimer(pending);
+        this.pendingSends.delete(clientMessageId);
     }
     /** One timer for the membership-pending re-send window; a newer frame resets it. */
     scheduleMembershipPendingRetry(delayMs) {
@@ -225,6 +276,116 @@ export class ChannelClient {
             this.resendPendingSends();
         }, delayMs);
     }
+    /**
+     * Handle a CORRELATED `send-rejected` frame (the target protocol): parse the
+     * untrusted payload with the shared schema, correlate to EXACTLY ONE pending send
+     * by clientMessageId, and either fail just that bubble (terminal) or schedule a
+     * single per-send resend (retryable).
+     *
+     * A frame that fails validation is NOT simply dropped when it still names one of
+     * OUR pending sends: unlike an unknown frame type, an id-correlated rejection is
+     * the server explicitly telling us this send did not land — swallowing it would
+     * strand the bubble on "Sending…" forever (no further frame, no reconnect, no
+     * budget check ever runs). A future/unknown rejection code (version skew during a
+     * rollout) therefore fails that send CLOSED with the neutral copy + Retry. A
+     * malformed frame with no recognizable pending id is dropped (forward-compat
+     * noise), never surfaced as an error.
+     */
+    applySendRejected(payload) {
+        const parsed = ChatSendRejectedPayloadSchema.safeParse(payload);
+        if (!parsed.success) {
+            // Defensive fail-closed: if the unparseable rejection still carries a string
+            // id matching one of our un-failed pending sends, that send was rejected by a
+            // server speaking a newer/buggy dialect — fail it visibly (neutral code-less
+            // "Couldn't send" + Retry) instead of stranding it.
+            const rawId = payload.clientMessageId;
+            if (typeof rawId === 'string' && rawId.length > 0 && rawId.length <= 200) {
+                const orphaned = this.pendingSends.get(rawId);
+                if (orphaned && !orphaned.failed)
+                    this.failPendingSend(rawId);
+            }
+            return;
+        }
+        const { clientMessageId, code, retryable, retryAfterMs } = parsed.data;
+        const pending = this.pendingSends.get(clientMessageId);
+        // No matching pending send — already acked/reconciled, or never ours. A late
+        // ack/echo (which may have already landed) always wins; nothing to correlate.
+        if (!pending || pending.failed)
+            return;
+        if (!retryable) {
+            // Terminal: an unchanged resend cannot succeed (blocked-word / archived /
+            // deleted). Fail ONLY this bubble, recording the reason + terminal class.
+            this.failPendingSend(clientMessageId, code, false);
+            return;
+        }
+        // Retryable: server-declared, so switch this send onto the wall-clock budget
+        // (the 5-attempt cap no longer applies) and record the reason for a possible
+        // budget-exhausted failure.
+        pending.serverRetryable = true;
+        pending.lastRejectionCode = code;
+        // If the budget already elapsed (a long stream of retryable rejections), fail
+        // now rather than scheduling yet another doomed resend.
+        if (this.timers.now() - pending.sentAt >= SERVER_RETRYABLE_MAX_AGE_MS) {
+            this.failPendingSend(clientMessageId, code, true);
+            return;
+        }
+        this.scheduleSendRetry(clientMessageId, this.clampRetryDelay(retryAfterMs));
+    }
+    /**
+     * Schedule EXACTLY ONE per-send resend of a correlated retryable rejection (never
+     * stacks — a newer rejection clears the prior timer first). When it fires it
+     * re-sends the SAME clientMessageId (the DO dedups) unless the wall-clock budget
+     * has elapsed, in which case the send fails with its recorded reason.
+     */
+    scheduleSendRetry(clientMessageId, delayMs) {
+        const pending = this.pendingSends.get(clientMessageId);
+        if (!pending)
+            return;
+        this.clearSendRetryTimer(pending);
+        pending.retryTimer = this.timers.setTimeout(() => {
+            pending.retryTimer = null;
+            if (this.closedByUs)
+                return;
+            const current = this.pendingSends.get(clientMessageId);
+            if (!current || current.failed)
+                return;
+            if (this.timers.now() - current.sentAt >= SERVER_RETRYABLE_MAX_AGE_MS) {
+                this.failPendingSend(clientMessageId, current.lastRejectionCode, true);
+                return;
+            }
+            // A server-retryable resend does NOT count toward the attempt cap (that cap is
+            // for blind reconnect resends only) — leave `attempts` untouched.
+            this.sendFrame(CLIENT_FRAME.SEND, {
+                clientMessageId: current.clientMessageId,
+                text: current.text,
+                replyTo: current.replyTo,
+            });
+            // Budget backstop: the contract says every send gets an ack or a rejection,
+            // and either one replaces/clears this timer. If the server goes silent (a
+            // contract violation), NOTHING else would ever re-check the budget on a
+            // stable socket — so arm a deadline check that fails the send at budget end.
+            // This makes SERVER_RETRYABLE_MAX_AGE_MS a hard ceiling, not a best effort.
+            const remainingMs = SERVER_RETRYABLE_MAX_AGE_MS - (this.timers.now() - current.sentAt) + SEND_RETRY_MIN_DELAY_MS;
+            current.retryTimer = this.timers.setTimeout(() => {
+                current.retryTimer = null;
+                if (this.closedByUs)
+                    return;
+                const atDeadline = this.pendingSends.get(clientMessageId);
+                if (!atDeadline || atDeadline.failed)
+                    return;
+                if (this.timers.now() - atDeadline.sentAt >= SERVER_RETRYABLE_MAX_AGE_MS) {
+                    this.failPendingSend(clientMessageId, atDeadline.lastRejectionCode, true);
+                }
+            }, remainingMs);
+        }, delayMs);
+    }
+    /** Clamp a server `retryAfterMs` hint into a sane resend delay (defaulting when absent). */
+    clampRetryDelay(retryAfterMs) {
+        const raw = typeof retryAfterMs === 'number' && retryAfterMs > 0
+            ? retryAfterMs
+            : MEMBERSHIP_PENDING_DEFAULT_RETRY_MS;
+        return Math.min(Math.max(raw, SEND_RETRY_MIN_DELAY_MS), SEND_RETRY_MAX_DELAY_MS);
+    }
     /**
      * Flip EVERY un-acked pending send to the visible failed state. Called on the
      * terminal close paths (4403 REVOKED, reconnect give-up) — without this, a send
@@ -248,7 +409,12 @@ export class ChannelClient {
         const pending = this.pendingSends.get(clientMessageId);
         if (!pending)
             return false;
+        // A manual retry supersedes any scheduled server-retryable resend and starts a
+        // fresh budget from now; the server re-declares retryability if it rejects again.
+        this.clearSendRetryTimer(pending);
         pending.failed = false;
+        pending.serverRetryable = false;
+        pending.lastRejectionCode = undefined;
         pending.sentAt = this.timers.now();
         const sent = this.sendFrame(CLIENT_FRAME.SEND, {
             clientMessageId: pending.clientMessageId,
@@ -256,9 +422,14 @@ export class ChannelClient {
             replyTo: pending.replyTo,
         });
         pending.attempts = sent ? 1 : 0;
-        const next = this.state.messages.map((m) => m.meta?.optimistic && m.meta?.clientMessageId === clientMessageId && m.meta?.sendFailed
-            ? { ...m, meta: { ...m.meta, sendFailed: false } }
-            : m);
+        const next = this.state.messages.map((m) => {
+            if (!(m.meta?.optimistic && m.meta?.clientMessageId === clientMessageId && m.meta?.sendFailed)) {
+                return m;
+            }
+            // Back to the normal pending look — drop every failure marker.
+            const { sendFailed: _sendFailed, sendFailureCode: _sendFailureCode, sendRetryable: _sendRetryable, ...restMeta } = m.meta;
+            return { ...m, meta: { ...restMeta } };
+        });
         this.setState({ messages: next, lastErrorCode: null });
         return true;
     }
@@ -343,16 +514,26 @@ export class ChannelClient {
                 return this.applyTyping(payload.uid);
             case 'snapshot':
                 return this.applyChannelSnapshot(payload);
+            case 'send-rejected':
+                return this.applySendRejected(payload);
             case 'error': {
                 const code = String(payload.code ?? 'error');
-                // Retryable: membership row not yet synced to the DO. Keep the send pending
-                // (no visible error — the optimistic bubble stays "Sending…") and re-send
-                // after the server-suggested delay via the normal resend machinery, whose
-                // attempt/age caps flip it to the visible failed state if the window never
-                // closes. Everything else surfaces as before.
+                // ROLLOUT COMPATIBILITY ONLY (not the target protocol): a Worker that predates
+                // the correlated `send-rejected` frame emits an UNCORRELATED
+                // error{code:'membership-pending'} with no clientMessageId, so we cannot target
+                // one send. Keep the send(s) pending (no visible error — the bubble stays
+                // "Sending…"), mark every in-flight send server-retryable so the wall-clock
+                // budget (NOT the 5-attempt cap) governs give-up, and re-send all after the
+                // server-suggested delay. The correlated path below is the target protocol.
                 if (code === MEMBERSHIP_PENDING_CODE) {
                     const raw = payload.retryAfterMs;
-                    const delay = typeof raw === 'number' && raw > 0 ? raw : MEMBERSHIP_PENDING_DEFAULT_RETRY_MS;
+                    const delay = this.clampRetryDelay(typeof raw === 'number' ? raw : undefined);
+                    for (const pending of this.pendingSends.values()) {
+                        if (!pending.failed) {
+                            pending.serverRetryable = true;
+                            pending.lastRejectionCode = MEMBERSHIP_PENDING_CODE;
+                        }
+                    }
                     return this.scheduleMembershipPendingRetry(delay);
                 }
                 return this.setState({ lastErrorCode: code });
@@ -482,9 +663,9 @@ export class ChannelClient {
     mergeMessage(mapped, row) {
         // If this canonical row carries a clientMessageId we still have pending (the
         // sender's own broadcast, or a resume delta that included our send), the send
-        // landed — stop tracking it for reconnect resend.
+        // landed — stop tracking it for reconnect resend (and cancel any retry timer).
         if (row.clientMessageId)
-            this.pendingSends.delete(row.clientMessageId);
+            this.clearPendingSend(row.clientMessageId);
         const next = this.state.messages.filter((m) => m.messageId !== mapped.messageId &&
             // drop the optimistic placeholder this server row reconciles
             (m.meta?.clientMessageId !== row.clientMessageId || !m.meta?.optimistic));
@@ -501,14 +682,16 @@ export class ChannelClient {
         // ack guarantees the seq even if the broadcast is dropped/reordered.
         const seq = payload.seq;
         const cmid = payload.clientMessageId;
-        // The send is acked — stop tracking it for reconnect resend.
-        this.pendingSends.delete(cmid);
+        // The send is acked — stop tracking it for reconnect resend (and cancel any
+        // per-send retry timer so a scheduled resend never fires after it landed).
+        this.clearPendingSend(cmid);
         const next = this.state.messages.map((m) => {
             if (!m.meta?.optimistic || m.meta?.clientMessageId !== cmid)
                 return m;
-            // Strip any failed marker — a late ack (e.g. a retry raced the cap) means the
-            // send actually landed, so the row must render as delivered, not failed.
-            const { sendFailed: _sendFailed, ...restMeta } = m.meta;
+            // Strip any failed markers — a late ack (e.g. a retry raced the cap, or a
+            // correlated rejection was superseded) means the send actually landed, so the
+            // row must render as delivered, not failed.
+            const { sendFailed: _sendFailed, sendFailureCode: _sendFailureCode, sendRetryable: _sendRetryable, ...restMeta } = m.meta;
             return { ...m, messageId: seqToMessageId(seq), meta: { ...restMeta, optimistic: false, seq } };
         });
         next.sort(sortBySeq);
@@ -527,7 +710,7 @@ export class ChannelClient {
         for (const r of rows) {
             if (r.clientMessageId) {
                 incomingCmids.add(r.clientMessageId);
-                this.pendingSends.delete(r.clientMessageId);
+                this.clearPendingSend(r.clientMessageId);
             }
         }
         const bySeq = new Map();
@@ -601,6 +784,8 @@ export class ChannelClient {
             sentAt: now,
             attempts: 1,
             failed: false,
+            serverRetryable: false,
+            retryTimer: null,
         });
         const echo = optimisticMessage({
             clientMessageId: args.clientMessageId,
@@ -681,6 +866,9 @@ export class ChannelClient {
         this.typingTimers.clear();
         this.overlays.clear();
         this.originalRows.clear();
+        // Cancel every per-send retry timer before dropping the tracking map.
+        for (const pending of this.pendingSends.values())
+            this.clearSendRetryTimer(pending);
         this.pendingSends.clear();
         if (this.reconnectTimer != null) {
             this.timers.clearTimeout(this.reconnectTimer);