stream-chat 9.50.3 → 9.52.0

package/dist/types/search/MessageSearchSource.d.ts

@@ -1,4 +1,4 @@
-import { BaseSearchSource } from './BaseSearchSource';
+import { BaseSearchSource, type SearchQueryOptions } from './BaseSearchSource';
 import type { ChannelFilters, ChannelOptions, ChannelSort, MessageFilters, MessageResponse, SearchMessageSort } from '../types';
 import type { StreamChat } from '../client';
 import type { SearchSourceOptions } from './types';
@@ -26,6 +26,17 @@ export type MessageSearchSourceFilterBuilderOptions<TContexts extends MessageSea
     messageSearch: FilterBuilderOptions<MessageFilters, MergeContext<BuiltInContexts['messageSearch'], TContexts['messageSearchContext']>>;
     channelQuery: FilterBuilderOptions<ChannelFilters, MergeContext<BuiltInContexts['channelQuery'], TContexts['channelQueryContext']>>;
 }>;
+export type MessageSearchSourceOptions = SearchSourceOptions & {
+    /** Static base filters for the channel scope of the message search. */
+    messageSearchChannelFilters?: ChannelFilters;
+    /** Static base filters for the message search itself. */
+    messageSearchFilters?: MessageFilters;
+    messageSearchSort?: SearchMessageSort;
+    /** Static base filters for the follow-up query that hydrates unknown channels. */
+    channelQueryFilters?: ChannelFilters;
+    channelQuerySort?: ChannelSort;
+    channelQueryOptions?: Omit<ChannelOptions, 'limit' | 'offset'>;
+};
 export declare class MessageSearchSource<TContexts extends MessageSearchSourceContexts = {}> extends BaseSearchSource<MessageResponse> {
     readonly type = "messages";
     private client;
@@ -38,8 +49,8 @@ export declare class MessageSearchSource<TContexts extends MessageSearchSourceCo
     messageSearchChannelFilterBuilder: FilterBuilder<ChannelFilters, MergeContext<BuiltInContexts['messageSearchChannel'], TContexts['messageSearchChannelContext']>>;
     messageSearchFilterBuilder: FilterBuilder<MessageFilters, MergeContext<BuiltInContexts['messageSearch'], TContexts['messageSearchContext']>>;
     channelQueryFilterBuilder: FilterBuilder<ChannelFilters, MergeContext<BuiltInContexts['channelQuery'], TContexts['channelQueryContext']>>;
-    constructor(client: StreamChat, options?: SearchSourceOptions, filterBuilderOptions?: MessageSearchSourceFilterBuilderOptions<TContexts>);
-    protected query(searchQuery: string): Promise<{
+    constructor(client: StreamChat, options?: MessageSearchSourceOptions, filterBuilderOptions?: MessageSearchSourceFilterBuilderOptions<TContexts>);
+    protected query(searchQuery: string, queryOptions?: SearchQueryOptions): Promise<{
         items: never[];
         next?: undefined;
     } | {

package/dist/types/search/UserSearchSource.d.ts

@@ -1,4 +1,4 @@
-import { BaseSearchSource } from './BaseSearchSource';
+import { BaseSearchSource, type SearchQueryOptions } from './BaseSearchSource';
 import { FilterBuilder, type FilterBuilderOptions } from '../pagination';
 import type { StreamChat } from '../client';
 import type { UserFilters, UserOptions, UserResponse, UserSort } from '../types';
@@ -7,6 +7,12 @@ type CustomContext = Record<string, unknown>;
 export type UserSearchSourceFilterBuilderContext<C extends CustomContext = CustomContext> = {
     searchQuery?: string;
 } & C;
+export type UserSearchSourceOptions = SearchSourceOptions & {
+    /** Static base filters merged under the dynamically generated ones. */
+    filters?: UserFilters;
+    sort?: UserSort;
+    searchOptions?: Omit<UserOptions, 'limit' | 'offset'>;
+};
 export declare class UserSearchSource<TFilterContext extends CustomContext = CustomContext> extends BaseSearchSource<UserResponse> {
     readonly type = "users";
     client: StreamChat;
@@ -14,8 +20,8 @@ export declare class UserSearchSource<TFilterContext extends CustomContext = Cus
     sort: UserSort | undefined;
     searchOptions: Omit<UserOptions, 'limit' | 'offset'> | undefined;
     filterBuilder: FilterBuilder<UserFilters, UserSearchSourceFilterBuilderContext<TFilterContext>>;
-    constructor(client: StreamChat, options?: SearchSourceOptions, filterBuilderOptions?: FilterBuilderOptions<UserFilters, UserSearchSourceFilterBuilderContext<TFilterContext>>);
-    protected query(searchQuery: string): Promise<{
+    constructor(client: StreamChat, options?: UserSearchSourceOptions, filterBuilderOptions?: FilterBuilderOptions<UserFilters, UserSearchSourceFilterBuilderContext<TFilterContext>>);
+    protected query(searchQuery: string, queryOptions?: SearchQueryOptions): Promise<{
         items: UserResponse[];
     }>;
     protected filterQueryResults(items: UserResponse[]): UserResponse[];

package/dist/types/search/types.d.ts

@@ -9,8 +9,21 @@ export type SearchSourceState<T = any> = {
     offset?: number;
 };
 export type SearchSourceOptions = {
-    /** The number of milliseconds to debounce the search query. The default interval is 300ms. */
+    /**
+     * Legacy single debounce interval. When set, it applies to both short and long queries,
+     * unless overridden by `shortQueryDebounceMs` / `longQueryDebounceMs`.
+     */
     debounceMs?: number;
+    /**
+     * Debounce interval for queries no longer than `shortQueryMaxLength`. Such queries have
+     * low selectivity and are expensive server-side, so they are debounced harder.
+     * Defaults to 500ms.
+     */
+    shortQueryDebounceMs?: number;
+    /** Debounce interval for queries longer than `shortQueryMaxLength`. Defaults to 300ms. */
+    longQueryDebounceMs?: number;
+    /** Query length (inclusive) that still counts as short. Defaults to 2. */
+    shortQueryMaxLength?: number;
     pageSize?: number;
     /** When true, the source can execute queries with an empty search string. Defaults to false. */
     allowEmptySearchString?: boolean;

package/dist/types/types.d.ts

@@ -1008,7 +1008,13 @@ export type ChannelQueryOptions = {
     watch?: boolean;
     watchers?: PaginationOptions;
 };
-export type ChannelStateOptions = {
+/**
+ * Composed with RequestOptions because `queryChannels` carries the abort signal in this
+ * bag; neither the state flags nor the signal are serialized into the request. Declaring
+ * the composition keeps passing a RequestOptions here intentional rather than incidental
+ * structural compatibility.
+ */
+export type ChannelStateOptions = RequestOptions & {
     offlineMode?: boolean;
     skipInitialization?: string[];
     skipHydration?: boolean;
@@ -1353,6 +1359,11 @@ export type SearchOptions = {
     offset?: number;
     sort?: SearchMessageSort;
 };
+/** Per-request options that are never part of the serialized request payload. */
+export type RequestOptions = {
+    /** Aborts the request. See AbortController. */
+    signal?: AbortSignal;
+};
 export type StreamChatOptions = AxiosRequestConfig & {
     /**
      * Used to disable warnings that are triggered by using connectUser or connectAnonymousUser server-side.

package/dist/types/uploadManager.d.ts

@@ -1,8 +1,38 @@
 import type { StreamChat } from './client';
 import { StateStore } from './store';
 import type { AttachmentManager } from '.';
+/**
+ * Whether an upload ended because it was aborted rather than because it failed.
+ *
+ * {@link UploadManager.deleteUploadRecord} and {@link UploadManager.cancelAllUploads} abort the
+ * request through its `AbortController`, which is what happens when an attachment is removed
+ * from the composer mid-upload or the client disconnects. Axios reports that as a
+ * `CanceledError` (`axios.isCancel`); a custom `doUploadRequest` on another transport
+ * conventionally throws a `DOMException` named `AbortError`.
+ *
+ * Callers use this to keep a deliberate cancellation from being reported as an error.
+ */
+export declare const isUploadCancellation: (error: unknown) => boolean;
 export type UploadRecord = {
     id: string;
+    /**
+     * `true` once every byte has been handed to the transport but the server has not responded
+     * yet.
+     *
+     * Upload progress measures bytes *written to the connection*, not bytes the server
+     * acknowledged, so it reaches 100% the moment the request body is flushed — then the
+     * connection sits idle while the CDN ingests the file and the response travels back. On a
+     * large file over a slow link that window is long, and a UI that renders 100% as "done"
+     * claims the upload is confirmed while it is not.
+     *
+     * Nothing measurable happens during that window, so it is the point at which a determinate
+     * progress bar should hand over to an indeterminate one. Confirmation is the record being
+     * removed, not progress reaching 100.
+     *
+     * Requires `AttachmentManagerConfig.trackUploadProgress`; without progress reporting there is
+     * no way to tell when the flush happened, and this stays `false`.
+     */
+    uploadConfirmationPending?: boolean;
     uploadProgress?: number;
 };
 export type UploadManagerState = {

package/dist/types/utils.d.ts

@@ -1,5 +1,5 @@
 import FormData from 'form-data';
-import type { AscDesc, ChannelFilters, ChannelQueryOptions, ChannelSort, ChannelSortBase, LocalMessage, LocalMessageBase, Logger, Message, MessagePaginationOptions, MessageResponse, MessageResponseBase, MessageSet, OwnUserResponse, PromoteChannelParams, ReactionGroupResponse, UpdatedMessage, UserResponse } from './types';
+import type { AscDesc, Attachment, ChannelFilters, ChannelQueryOptions, ChannelSort, ChannelSortBase, LocalMessage, LocalMessageBase, Logger, Message, MessagePaginationOptions, MessageResponse, MessageResponseBase, MessageSet, OwnUserResponse, PromoteChannelParams, ReactionGroupResponse, UpdatedMessage, UserResponse } from './types';
 import type { StreamChat } from './client';
 import type { Channel } from './channel';
 import type { AxiosRequestConfig } from 'axios';
@@ -74,6 +74,25 @@ export declare function formatMessage(message: MessageResponse | MessageResponse
  * @param {MessageResponse} message `MessageResponse` object
  */
 export declare function unformatMessage(message: LocalMessage): MessageResponse;
+/**
+ * Strips composer-internal state from a message's attachments, and drops any whose upload never
+ * resolved.
+ *
+ * `localMetadata` is how `AttachmentManager` tracks an upload (its id, the `File`, the local
+ * preview); it must never reach the API. An attachment that still carries it and has no remote
+ * URL was never settled — which is what happens when
+ * `createSendWithPendingUploadsAttachmentsMiddleware` is installed by a UI SDK that does not
+ * implement the rest of the flow (awaiting those uploads before sending). Sending it would store
+ * an attachment pointing at nothing, so it is dropped and logged instead.
+ *
+ * Returns the same message object when there was nothing to change.
+ */
+export declare const sanitizeOutgoingAttachments: <T extends {
+    attachments?: Attachment[];
+}>({ client, message, }: {
+    client: StreamChat;
+    message: T;
+}) => T;
 export declare const localMessageToNewMessagePayload: (localMessage: LocalMessage) => Message;
 export declare const toUpdatedMessagePayload: (message: LocalMessage | Partial<MessageResponse>) => UpdatedMessage;
 export declare const toDeletedMessage: ({ message, deletedAt, hardDelete, }: {
@@ -227,7 +246,7 @@ export interface DebouncedFunc<T extends (...args: any[]) => any> {
      */
     flush(): ReturnType<T> | undefined;
 }
-export declare const debounce: <T extends (...args: any[]) => any>(fn: T, timeout?: number, { leading, trailing }?: {
+export declare const debounce: <T extends (...args: any[]) => any>(fn: T, timeout?: number | ((...args: Parameters<T>) => number), { leading, trailing }?: {
     leading?: boolean;
     trailing?: boolean;
 }) => DebouncedFunc<T>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stream-chat",
-  "version": "9.50.3",
+  "version": "9.52.0",
   "description": "JS SDK for the Stream Chat API",
   "homepage": "https://getstream.io/chat/",
   "author": {
@@ -52,9 +52,9 @@
   "dependencies": {
     "@types/jsonwebtoken": "^9.0.8",
     "@types/ws": "^8.18.1",
-    "axios": "^1.16.1",
+    "axios": "^1.19.0",
     "base64-js": "^1.5.1",
-    "form-data": "^4.0.5",
+    "form-data": "^4.0.6",
     "isomorphic-ws": "^5.0.0",
     "jsonwebtoken": "^9.0.3",
     "linkifyjs": "^4.3.3",
@@ -68,22 +68,22 @@
     "@semantic-release/git": "^10.0.1",
     "@types/node": "^22.19.19",
     "@types/sinon": "^10.0.6",
-    "@vitest/coverage-v8": "^4.1.7",
+    "@vitest/coverage-v8": "^4.1.10",
     "concurrently": "^9.2.1",
     "conventional-changelog-conventionalcommits": "^9.3.1",
     "dotenv": "^17.4.2",
-    "esbuild": "^0.28.0",
+    "esbuild": "^0.28.2",
     "eslint": "^9.39.4",
     "eslint-plugin-import": "^2.32.0",
     "globals": "^17.6.0",
     "husky": "^9.1.7",
     "lint-staged": "^17.0.5",
     "prettier": "^3.8.3",
-    "semantic-release": "^25.0.3",
+    "semantic-release": "^25.0.9",
     "sinon": "^12.0.1",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.59.4",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.10"
   },
   "scripts": {
     "build": "rm -rf dist && concurrently 'tsc' './scripts/bundle.mjs'",

package/src/channel.ts

@@ -9,6 +9,7 @@ import {
   logChatPromiseExecution,
   messageSetPagination,
   normalizeQuerySort,
+  sanitizeOutgoingAttachments,
 } from './utils';
 import type { StreamChat } from './client';
 import { DEFAULT_QUERY_CHANNEL_MESSAGE_LIST_PAGE_SIZE } from './constants';
@@ -62,6 +63,7 @@ import type {
   QueryMembersOptions,
   Reaction,
   ReactionAPIResponse,
+  RequestOptions,
   SearchAPIResponse,
   SearchMessageSortBase,
   SearchOptions,
@@ -211,14 +213,17 @@ export class Channel {
    *
    * @return {Promise<SendMessageAPIResponse>} The Server Response
    */
-  async _sendMessage(message: Message, options?: SendMessageOptions) {
-    return await this.getClient().post<SendMessageAPIResponse>(
-      this._channelURL() + '/message',
-      {
-        message,
-        ...options,
-      },
-    );
+  async _sendMessage(rawMessage: Message, options?: SendMessageOptions) {
+    const client = this.getClient();
+    const message = sanitizeOutgoingAttachments({
+      client,
+      message: rawMessage,
+    });
+
+    return await client.post<SendMessageAPIResponse>(this._channelURL() + '/message', {
+      message,
+      ...options,
+    });
   }
 
   async sendMessage(message: Message, options?: SendMessageOptions) {
@@ -377,6 +382,7 @@ export class Channel {
    * @param {MemberSort} [sort] Sort options, for instance [{created_at: -1}].
    * When using multiple fields, make sure you use array of objects to guarantee field order, for instance [{name: -1}, {created_at: 1}]
    * @param {{ limit?: number; offset?: number }} [options] Option object, {limit: 10, offset:10}
+   * @param {RequestOptions} [requestOptions] Carries an abort signal. Not sent in the request.
    *
    * @return {Promise<ChannelMemberAPIResponse>} Query Members response
    */
@@ -384,6 +390,7 @@ export class Channel {
     filterConditions: MemberFilters,
     sort: MemberSort = [],
     options: QueryMembersOptions = {},
+    requestOptions: RequestOptions = {},
   ) {
     let id: string | undefined;
     const type = this.type;
@@ -406,6 +413,7 @@ export class Channel {
           ...options,
         },
       },
+      requestOptions,
     );
   }
 
@@ -2003,6 +2011,10 @@ export class Channel {
       // delivery-report network sync below is skipped for it.
       case 'message.read_locally':
       case 'message.read':
+        // Thread read events are handled indiscriminately within the reactive `thread` object, we can
+        // skip them here in order to ensure the channel does not get read incidentally when it should
+        // not.
+        if (event.thread) break;
         if (event.user?.id && event.created_at) {
           const previousReadState = channelState.read[event.user.id];
           channelState.read[event.user.id] = {

package/src/client.ts

@@ -36,6 +36,7 @@ import {
   normalizeQuerySort,
   randomId,
   retryInterval,
+  sanitizeOutgoingAttachments,
   sleep,
   toUpdatedMessagePayload,
 } from './utils';
@@ -219,6 +220,7 @@ import type {
   ReminderAPIResponse,
   RemoveUserGroupMembersOptions,
   RemoveUserGroupMembersResponse,
+  RequestOptions,
   ReviewFlagReportOptions,
   ReviewFlagReportResponse,
   SdkIdentifier,
@@ -1312,6 +1314,9 @@ export class StreamChat {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
     } catch (e: any /**TODO: generalize error types  */) {
       e.client_request_id = requestConfig.headers?.['x-client-request-id'];
+      // An aborted request is a deliberate cancellation, not a failure - logging it
+      // and counting it towards the token-refresh backoff would be misleading.
+      if (axios.isCancel(e)) throw e;
       this._logApiError(type, url, e);
       this.consecutiveFailures += 1;
       if (e.response) {
@@ -1333,16 +1338,22 @@ export class StreamChat {
     }
   };
 
-  get<T>(url: string, params?: AxiosRequestConfig['params']) {
-    return this.doAxiosRequest<T>('get', url, null, { params });
+  get<T>(
+    url: string,
+    params?: AxiosRequestConfig['params'],
+    // `params` is omitted deliberately: _enrichAxiosOptions spreads `config` after the
+    // enriched params, so a `config.params` would drop api_key/user_id/connection_id.
+    config?: Omit<AxiosRequestConfig, 'params'>,
+  ) {
+    return this.doAxiosRequest<T>('get', url, null, { params, config });
   }
 
   put<T>(url: string, data?: unknown) {
     return this.doAxiosRequest<T>('put', url, data);
   }
 
-  post<T>(url: string, data?: unknown) {
-    return this.doAxiosRequest<T>('post', url, data);
+  post<T>(url: string, data?: unknown, config?: Omit<AxiosRequestConfig, 'params'>) {
+    return this.doAxiosRequest<T>('post', url, data, { config });
   }
 
   patch<T>(url: string, data?: unknown) {
@@ -1837,6 +1848,7 @@ export class StreamChat {
    * @param {UserSort} sort Sort options, for instance [{last_active: -1}].
    * When using multiple fields, make sure you use array of objects to guarantee field order, for instance [{last_active: -1}, {created_at: 1}]
    * @param {UserOptions} options Option object, {presence: true}
+   * @param {RequestOptions} [requestOptions] Carries an abort signal. Not sent in the request.
    *
    * @return {Promise<{ users: Array<UserResponse> }>} User Query Response
    */
@@ -1844,6 +1856,7 @@ export class StreamChat {
     filterConditions: UserFilters,
     sort: UserSort = [],
     options: UserOptions = {},
+    requestOptions: RequestOptions = {},
   ) {
     const defaultOptions = {
       presence: false,
@@ -1867,6 +1880,7 @@ export class StreamChat {
           ...options,
         },
       },
+      requestOptions,
     );
 
     this.state.updateUsers(data.users);
@@ -1918,13 +1932,17 @@ export class StreamChat {
    * searchUserGroups - Search user groups by prefix for autocomplete
    *
    * @param {SearchUserGroupsOptions} options The search options
-   *
+   * @param {RequestOptions} [requestOptions] Carries an abort signal. Not sent in the request.
    * @return {Promise<SearchUserGroupsResponse>} User Group Search Response
    */
-  async searchUserGroups(options: SearchUserGroupsOptions) {
+  async searchUserGroups(
+    options: SearchUserGroupsOptions,
+    requestOptions: RequestOptions = {},
+  ) {
     return await this.get<SearchUserGroupsResponse>(
       this.baseURL + '/usergroups/search',
       options,
+      requestOptions,
     );
   }
 
@@ -2061,6 +2079,7 @@ export class StreamChat {
    * @param {ChannelSort} [sort] Sort options, for instance {created_at: -1}.
    * When using multiple fields, make sure you use array of objects to guarantee field order, for instance [{last_updated: -1}, {created_at: 1}]
    * @param {ChannelOptions} [options] Options object. Can include predefined_filter, filter_values, and sort_values for using predefined filters.
+   * @param {RequestOptions} [requestOptions] Carries an abort signal. Not sent in the request.
    *
    * @return {Promise<QueryChannelsAPIResponse>} full search channels response
    */
@@ -2068,6 +2087,7 @@ export class StreamChat {
     filterConditions: ChannelFilters,
     sort: ChannelSort = [],
     options: ChannelOptions = {},
+    requestOptions: RequestOptions = {},
   ): Promise<QueryChannelsAPIResponse> {
     const defaultOptions: ChannelOptions = {
       state: true,
@@ -2101,7 +2121,11 @@ export class StreamChat {
           ...restOptions,
         };
 
-    return await this.post<QueryChannelsAPIResponse>(this.baseURL + '/channels', payload);
+    return await this.post<QueryChannelsAPIResponse>(
+      this.baseURL + '/channels',
+      payload,
+      requestOptions,
+    );
   }
 
   /**
@@ -2147,6 +2171,7 @@ export class StreamChat {
    * - stateOptions.skipInitialization - Skips the initialization of the state for the channels matching the ids in the list.
    * - stateOptions.skipHydration - Skips returning the channels as instances of the Channel class and rather returns the raw query response.
    * - stateOptions.withResponse - Returns the full query response with hydrated channels. This is a compatibility bridge for internal callers that need response-level metadata while the default return value remains `Channel[]`.
+   * - stateOptions.signal - Aborts the request. See AbortController.
    *
    * @return {Promise<Array<Channel>>} search channels response
    */
@@ -2172,6 +2197,8 @@ export class StreamChat {
       filterConditions,
       sort,
       options,
+      // stateOptions is never serialized, so it carries the abort signal
+      { signal: stateOptions.signal },
     );
     const channels = queryChannelsResponse.channels;
 
@@ -2317,6 +2344,7 @@ export class StreamChat {
    * @param {ChannelFilters} filterConditions MongoDB style filter conditions
    * @param {MessageFilters | string} query search query or object MongoDB style filters
    * @param {SearchOptions} [options] Option object, {user_id: 'tommaso'}
+   * @param {RequestOptions} [requestOptions] Carries an abort signal. Not sent in the request.
    *
    * @return {Promise<SearchAPIResponse>} search messages response
    */
@@ -2324,6 +2352,7 @@ export class StreamChat {
     filterConditions: ChannelFilters,
     query: string | MessageFilters,
     options: SearchOptions = {},
+    requestOptions: RequestOptions = {},
   ) {
     if (options.offset && options.next) {
       throw Error(`Cannot specify offset with next`);
@@ -2346,7 +2375,11 @@ export class StreamChat {
     // Make sure we wait for the connect promise if there is a pending one
     await this.wsPromise;
 
-    return await this.get<SearchAPIResponse>(this.baseURL + '/search', { payload });
+    return await this.get<SearchAPIResponse>(
+      this.baseURL + '/search',
+      { payload },
+      requestOptions,
+    );
   }
 
   /**
@@ -3019,6 +3052,11 @@ export class StreamChat {
 
   /**
    * unflagMessage - unflag a message
+   *
+   * @deprecated The `/moderation/unflag` endpoint is deprecated and is a no-op on
+   * the backend - calling this resolves successfully but does not remove the flag.
+   * Use `client.moderation.submitAction()` against the review queue item instead.
+   *
    * @param {string} targetMessageID
    * @param {string} [options.user_id] currentUserID, only used with serverside auth
    * @returns {Promise<APIResponse>}
@@ -3032,6 +3070,11 @@ export class StreamChat {
 
   /**
    * unflagUser - unflag a user
+   *
+   * @deprecated The `/moderation/unflag` endpoint is deprecated and is a no-op on
+   * the backend - calling this resolves successfully but does not remove the flag.
+   * Use `client.moderation.submitAction()` against the review queue item instead.
+   *
    * @param {string} targetID
    * @param {string} [options.user_id] currentUserID, only used with serverside auth
    * @returns {Promise<APIResponse>}
@@ -3388,7 +3431,12 @@ export class StreamChat {
     }
 
     // should not include user object
-    const payload = toUpdatedMessagePayload(message);
+    // Sanitized at the point of sending, which is the only place every path converges: the
+    // offline replay of a queued `update-message` task calls this method directly.
+    const payload = sanitizeOutgoingAttachments({
+      client: this,
+      message: toUpdatedMessagePayload(message),
+    });
 
     // add user_id (if exists)
     if (typeof partialUserOrUserId === 'string') {
@@ -3806,6 +3854,12 @@ export class StreamChat {
       ...axiosRequestConfigRest
     } = this.options.axiosRequestConfig || {};
 
+    // Most specific wins, and it is spread last so that a config carrying an explicit
+    // `signal: undefined` cannot clobber a client-wide one or an armed
+    // nextRequestAbortController.
+    const resolvedSignal =
+      options.config?.signal ?? axiosRequestConfigRest.signal ?? signal;
+
     return {
       params: {
         user_id: this.userID,
@@ -3821,9 +3875,9 @@ export class StreamChat {
         ...options.headers,
         ...(axiosRequestConfigHeaders || {}),
       },
-      ...(signal ? { signal } : {}),
       ...options.config,
-      ...(axiosRequestConfigRest || {}),
+      ...axiosRequestConfigRest,
+      ...(resolvedSignal ? { signal: resolvedSignal } : {}),
     };
   }
 
@@ -3993,8 +4047,12 @@ export class StreamChat {
    *
    * @returns {Promise<APIResponse>}
    */
-  searchRoles(options: SearchRolesOptions) {
-    return this.get<SearchRolesAPIResponse>(`${this.baseURL}/roles/search`, options);
+  searchRoles(options: SearchRolesOptions, requestOptions: RequestOptions = {}) {
+    return this.get<SearchRolesAPIResponse>(
+      `${this.baseURL}/roles/search`,
+      options,
+      requestOptions,
+    );
   }
 
   /** deleteRole - deletes a custom role

package/src/index.ts

@@ -62,3 +62,15 @@ export {
   promoteChannel,
 } from './utils';
 export { FixedSizeQueueCache } from './utils/FixedSizeQueueCache';
+/**
+ * Tag-keyed async runners. Exported so the UI SDKs (and integrators) serialize their own
+ * actions with the same primitive the SDK uses internally instead of hand-rolling promise
+ * chains. Tags share one process-wide map, so namespace yours (`my-app/thing/${id}`) to avoid
+ * colliding with another caller's.
+ */
+export {
+  hasPending,
+  settled,
+  withCancellation,
+  withoutConcurrency,
+} from './utils/concurrency';

package/src/messageComposer/attachmentIdentity.ts

@@ -1,5 +1,6 @@
 import type { Attachment, SharedLocationResponse } from '../types';
 import type {
+  AttachmentLoadingState,
   AudioAttachment,
   FileAttachment,
   GiphyAttachment,
@@ -27,6 +28,32 @@ export const isLocalUploadAttachment = (
 ): attachment is LocalUploadAttachment =>
   !!(attachment as LocalAttachment)?.localMetadata?.uploadState;
 
+/**
+ * Upload states meaning "the bytes are not on the CDN yet, but they are on their way".
+ * `blocked` and `failed` are excluded - those never resolve on their own.
+ *
+ * Typed against {@link AttachmentLoadingState} rather than `string`, so renaming a state fails
+ * the build instead of silently making this list match nothing - it decides what gets sent.
+ */
+const PENDING_UPLOAD_STATES: ReadonlyArray<AttachmentLoadingState> = [
+  'pending',
+  'uploading',
+];
+
+/** Whether an upload for this attachment is still expected to resolve. */
+export const isPendingUpload = (
+  attachment: unknown,
+): attachment is LocalUploadAttachment =>
+  isLocalUploadAttachment(attachment) &&
+  PENDING_UPLOAD_STATES.includes(attachment.localMetadata.uploadState);
+
+/** Whether this attachment's upload already resolved to a URL. */
+export const isFinishedUpload = (
+  attachment: unknown,
+): attachment is LocalUploadAttachment =>
+  isLocalUploadAttachment(attachment) &&
+  attachment.localMetadata.uploadState === 'finished';
+
 export const isFileAttachment = (
   attachment: Attachment | LocalAttachment,
   supportedVideoFormat: string[] = [],