<?php
// api/chat/poll.php — read back the caller's own thread. The thread comes from the
// token, never from a query parameter: no id to guess, no IDOR, no listing.
// Contract: _docs/chat-contract.md
require_once __DIR__ . '/lib.php';
// Note: poll is deliberately NOT rate limited. A 30 s poller is 120 GETs/hour;
// sharing the write window would make the client throttle itself into silence.

$token  = chat_token();
$thread = chat_thread($token);
$since  = isset($_GET['since']) ? (int)$_GET['since'] : 0;   // epoch seconds, numeric

$all = chat_read($thread);
$messages = $since > 0
    ? array_values(array_filter($all, fn($m) => (int)($m['epoch'] ?? 0) > $since))
    : $all;
$lastAll = $all ? end($all) : null;

json_response([
    'success'  => true,
    'thread'   => $thread,
    'messages' => array_slice($messages, -50),
    // `awaiting` replaces `unread`: the server keeps no read state, so an unread
    // counter could never clear. Who spoke last is knowable.
    'awaiting' => (bool)($lastAll && ($lastAll['author'] ?? '') !== 'hermes'),
    'cursor'   => $lastAll ? (int)($lastAll['epoch'] ?? 0) : 0,
]);