chat implemented

need testing

apps/admin/package-lock.json

@@ -45,6 +45,7 @@
         "react-hook-form": "^7.66.0",
         "recharts": "^3.3.0",
         "resend": "^6.9.3",
+        "socket.io-client": "^4.8.1",
         "sonner": "^2.0.7",
         "sqlite": "^5.1.1",
         "sqlite3": "^5.1.7",
@@ -3506,6 +3507,12 @@
         "@sinonjs/commons": "^3.0.1"
       }
     },
+    "node_modules/@socket.io/component-emitter": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@socket.io/component-emitter/-/component-emitter-3.1.2.tgz",
+      "integrity": "sha512-9BCxFwvbGg/RsZK9tjXd8s4UcwR0MWeFQ1XEKIQVVvAGJyINdrqKMcTRyLoK8Rse1GjzLV9cwjWV1olXRWEXVA==",
+      "license": "MIT"
+    },
     "node_modules/@stablelib/base64": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@stablelib/base64/-/base64-1.0.1.tgz",
@@ -6691,6 +6698,28 @@
         "once": "^1.4.0"
       }
     },
+    "node_modules/engine.io-client": {
+      "version": "6.6.4",
+      "resolved": "https://registry.npmjs.org/engine.io-client/-/engine.io-client-6.6.4.tgz",
+      "integrity": "sha512-+kjUJnZGwzewFDw951CDWcwj35vMNf2fcj7xQWOctq1F2i1jkDdVvdFG9kM/BEChymCH36KgjnW0NsL58JYRxw==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1",
+        "engine.io-parser": "~5.2.1",
+        "ws": "~8.18.3",
+        "xmlhttprequest-ssl": "~2.1.1"
+      }
+    },
+    "node_modules/engine.io-parser": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/engine.io-parser/-/engine.io-parser-5.2.3.tgz",
+      "integrity": "sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/entities": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
@@ -13241,6 +13270,34 @@
         "npm": ">= 3.0.0"
       }
     },
+    "node_modules/socket.io-client": {
+      "version": "4.8.3",
+      "resolved": "https://registry.npmjs.org/socket.io-client/-/socket.io-client-4.8.3.tgz",
+      "integrity": "sha512-uP0bpjWrjQmUt5DTHq9RuoCBdFJF10cdX9X+a368j/Ft0wmaVgxlrjvK3kjvgCODOMMOz9lcaRzxmso0bTWZ/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1",
+        "engine.io-client": "~6.6.1",
+        "socket.io-parser": "~4.2.4"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/socket.io-parser": {
+      "version": "4.2.6",
+      "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.6.tgz",
+      "integrity": "sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/socks": {
       "version": "2.8.7",
       "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.7.tgz",
@@ -15132,7 +15189,6 @@
       "version": "8.18.3",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.3.tgz",
       "integrity": "sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -15167,6 +15223,14 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/xmlhttprequest-ssl": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-2.1.2.tgz",
+      "integrity": "sha512-TEU+nJVUUnA4CYJFLvK5X9AOeH4KvDvhIfm0vV1GaQRtchnG0hgK5p8hw/xjv8cunWYCsiPCSDzObPyhEwq3KQ==",
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
     "node_modules/y18n": {
       "version": "5.0.8",
       "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",

apps/admin/package.json

@@ -49,6 +49,7 @@
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "react-hook-form": "^7.66.0",
+    "socket.io-client": "^4.8.1",
     "recharts": "^3.3.0",
     "resend": "^6.9.3",
     "sonner": "^2.0.7",

apps/admin/src/app/api/chat/__tests__/route-authz.test.ts

@@ -0,0 +1,108 @@
+/**
+ * @jest-environment node
+ */
+
+import { NextRequest } from "next/server";
+import { GET as GET_THREADS } from "../threads/route";
+import { POST as START_DM } from "../dm/start/route";
+import { GET as GET_MY_DM } from "../dm/my-thread/route";
+
+jest.mock("@clerk/nextjs/server", () => ({
+  auth: jest.fn(),
+}));
+
+jest.mock("@/lib/database", () => ({
+  getDatabase: jest.fn(),
+}));
+
+jest.mock("@/lib/sync-user", () => ({
+  ensureUserSynced: jest.fn(),
+}));
+
+jest.mock("@/lib/chat", () => ({
+  getOrCreateGymRoomThread: jest.fn(),
+  listThreadsForUser: jest.fn(),
+  getOrCreateDmThread: jest.fn(),
+  isChatError: jest.fn(() => false),
+}));
+
+jest.mock("@/lib/logger", () => ({
+  info: jest.fn(),
+  warn: jest.fn(),
+  error: jest.fn(),
+  debug: jest.fn(),
+}));
+
+describe("/api/chat authz", () => {
+  const mockAuth = require("@clerk/nextjs/server").auth as jest.Mock;
+  const mockGetDatabase = require("@/lib/database").getDatabase as jest.Mock;
+  const mockEnsureUserSynced = require("@/lib/sync-user")
+    .ensureUserSynced as jest.Mock;
+  const mockListThreadsForUser = require("@/lib/chat")
+    .listThreadsForUser as jest.Mock;
+  const mockGetOrCreateDmThread = require("@/lib/chat")
+    .getOrCreateDmThread as jest.Mock;
+
+  const mockDb = {
+    getClientTrainerAssignment: jest.fn(),
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetDatabase.mockResolvedValue(mockDb);
+    mockListThreadsForUser.mockResolvedValue([]);
+  });
+
+  it("returns 401 for unauthenticated threads list", async () => {
+    mockAuth.mockResolvedValue({ userId: null });
+
+    const req = new NextRequest("http://localhost/api/chat/threads");
+    const res = await GET_THREADS(req);
+
+    expect(res.status).toBe(401);
+  });
+
+  it("returns 403 when non participant/non staff starts DM", async () => {
+    mockAuth.mockResolvedValue({ userId: "user_1" });
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "user_1",
+      role: "trainer",
+      gymId: "gym_1",
+    });
+
+    const req = new NextRequest("http://localhost/api/chat/dm/start", {
+      method: "POST",
+      body: JSON.stringify({ trainerId: "trainer_2", clientId: "client_2" }),
+    });
+
+    const res = await START_DM(req);
+
+    expect(res.status).toBe(403);
+    expect(mockGetOrCreateDmThread).not.toHaveBeenCalled();
+  });
+
+  it("returns 403 when non-client requests my-thread endpoint", async () => {
+    mockAuth.mockResolvedValue({ userId: "trainer_1" });
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "trainer_1",
+      role: "trainer",
+      gymId: "gym_1",
+    });
+
+    const res = await GET_MY_DM();
+    expect(res.status).toBe(403);
+  });
+
+  it("returns 404 when client has no active assignment", async () => {
+    mockAuth.mockResolvedValue({ userId: "client_1" });
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "client_1",
+      role: "client",
+      gymId: "gym_1",
+    });
+    mockDb.getClientTrainerAssignment.mockResolvedValue(null);
+
+    const res = await GET_MY_DM();
+    expect(res.status).toBe(404);
+  });
+});

apps/admin/src/app/api/chat/dm/my-thread/route.ts

@@ -0,0 +1,61 @@
+import { NextResponse } from "next/server";
+import { auth } from "@clerk/nextjs/server";
+import { ensureUserSynced } from "@/lib/sync-user";
+import { getDatabase } from "@/lib/database";
+import { getOrCreateDmThread, isChatError } from "@/lib/chat";
+import log from "@/lib/logger";
+
+export async function GET() {
+  try {
+    const { userId } = await auth();
+    if (!userId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const db = await getDatabase();
+    const currentUser = await ensureUserSynced(userId, db);
+    if (!currentUser) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    if (currentUser.role !== "client") {
+      return NextResponse.json(
+        { error: "Only clients can use this endpoint" },
+        { status: 403 },
+      );
+    }
+
+    const assignment = await db.getClientTrainerAssignment(currentUser.id);
+    if (!assignment || !assignment.isActive) {
+      return NextResponse.json(
+        { error: "No active trainer assignment found" },
+        { status: 404 },
+      );
+    }
+
+    const thread = await getOrCreateDmThread({
+      trainerId: assignment.trainerId,
+      clientId: assignment.clientId,
+      createdBy: {
+        id: currentUser.id,
+        role: currentUser.role,
+        gymId: currentUser.gymId,
+      },
+    });
+
+    return NextResponse.json({ thread });
+  } catch (error) {
+    if (isChatError(error)) {
+      return NextResponse.json(
+        { error: error.message },
+        { status: error.status },
+      );
+    }
+
+    log.error("Failed to get client DM thread", error);
+    return NextResponse.json(
+      { error: "Internal server error" },
+      { status: 500 },
+    );
+  }
+}

apps/admin/src/app/api/chat/dm/start/route.ts

@@ -0,0 +1,70 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@clerk/nextjs/server";
+import { ensureUserSynced } from "@/lib/sync-user";
+import { getDatabase } from "@/lib/database";
+import { getOrCreateDmThread, isChatError } from "@/lib/chat";
+import log from "@/lib/logger";
+
+export async function POST(request: NextRequest) {
+  try {
+    const { userId } = await auth();
+    if (!userId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const body = await request.json().catch(() => null);
+    if (!body || typeof body !== "object") {
+      return NextResponse.json({ error: "Invalid body" }, { status: 400 });
+    }
+
+    const trainerId = String(body.trainerId ?? "").trim();
+    const clientId = String(body.clientId ?? "").trim();
+
+    if (!trainerId || !clientId) {
+      return NextResponse.json(
+        { error: "trainerId and clientId are required" },
+        { status: 400 },
+      );
+    }
+
+    const db = await getDatabase();
+    const currentUser = await ensureUserSynced(userId, db);
+    if (!currentUser) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const isStaff =
+      currentUser.role === "superAdmin" || currentUser.role === "admin";
+    const isParticipant =
+      currentUser.id === trainerId || currentUser.id === clientId;
+
+    if (!isStaff && !isParticipant) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const thread = await getOrCreateDmThread({
+      trainerId,
+      clientId,
+      createdBy: {
+        id: currentUser.id,
+        role: currentUser.role,
+        gymId: currentUser.gymId,
+      },
+    });
+
+    return NextResponse.json({ thread }, { status: 201 });
+  } catch (error) {
+    if (isChatError(error)) {
+      return NextResponse.json(
+        { error: error.message },
+        { status: error.status },
+      );
+    }
+
+    log.error("Failed to start direct message thread", error);
+    return NextResponse.json(
+      { error: "Internal server error" },
+      { status: 500 },
+    );
+  }
+}

apps/admin/src/app/api/chat/gym-room/route.ts

@@ -0,0 +1,42 @@
+import { NextResponse } from "next/server";
+import { auth } from "@clerk/nextjs/server";
+import { ensureUserSynced } from "@/lib/sync-user";
+import { getDatabase } from "@/lib/database";
+import { getOrCreateGymRoomThread, isChatError } from "@/lib/chat";
+import log from "@/lib/logger";
+
+export async function GET() {
+  try {
+    const { userId } = await auth();
+    if (!userId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const db = await getDatabase();
+    const currentUser = await ensureUserSynced(userId, db);
+    if (!currentUser) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const thread = await getOrCreateGymRoomThread({
+      id: currentUser.id,
+      role: currentUser.role,
+      gymId: currentUser.gymId,
+    });
+
+    return NextResponse.json({ thread });
+  } catch (error) {
+    if (isChatError(error)) {
+      return NextResponse.json(
+        { error: error.message },
+        { status: error.status },
+      );
+    }
+
+    log.error("Failed to get gym room thread", error);
+    return NextResponse.json(
+      { error: "Internal server error" },
+      { status: 500 },
+    );
+  }
+}

apps/admin/src/app/api/chat/threads/[id]/messages/__tests__/route-authz.test.ts

@@ -0,0 +1,181 @@
+/**
+ * @jest-environment node
+ */
+
+import { NextRequest } from "next/server";
+import { GET, POST } from "../route";
+
+jest.mock("@clerk/nextjs/server", () => ({
+  auth: jest.fn(),
+}));
+
+jest.mock("@/lib/database", () => ({
+  getDatabase: jest.fn(),
+}));
+
+jest.mock("@/lib/sync-user", () => ({
+  ensureUserSynced: jest.fn(),
+}));
+
+jest.mock("@/lib/chat", () => ({
+  getThreadMessages: jest.fn(),
+  createThreadMessage: jest.fn(),
+  isChatError: jest.fn((error: unknown) =>
+    Boolean(
+      error && typeof error === "object" && "status" in (error as object),
+    ),
+  ),
+}));
+
+jest.mock("@/lib/logger", () => ({
+  info: jest.fn(),
+  warn: jest.fn(),
+  error: jest.fn(),
+  debug: jest.fn(),
+}));
+
+describe("/api/chat/threads/[id]/messages authz", () => {
+  const mockAuth = require("@clerk/nextjs/server").auth as jest.Mock;
+  const mockGetDatabase = require("@/lib/database").getDatabase as jest.Mock;
+  const mockEnsureUserSynced = require("@/lib/sync-user")
+    .ensureUserSynced as jest.Mock;
+  const mockGetThreadMessages = require("@/lib/chat")
+    .getThreadMessages as jest.Mock;
+  const mockCreateThreadMessage = require("@/lib/chat")
+    .createThreadMessage as jest.Mock;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetDatabase.mockResolvedValue({});
+  });
+
+  it("returns 401 for unauthenticated GET", async () => {
+    mockAuth.mockResolvedValue({ userId: null });
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/messages",
+    );
+    const response = await GET(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(401);
+  });
+
+  it("returns 403 when synced user is missing on GET", async () => {
+    mockAuth.mockResolvedValue({ userId: "user_1" });
+    mockEnsureUserSynced.mockResolvedValue(null);
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/messages",
+    );
+    const response = await GET(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(403);
+    expect(mockGetThreadMessages).not.toHaveBeenCalled();
+  });
+
+  it("maps ChatError to status code on GET", async () => {
+    mockAuth.mockResolvedValue({ userId: "user_1" });
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "user_1",
+      role: "client",
+      gymId: "gym_1",
+    });
+    mockGetThreadMessages.mockRejectedValue({
+      status: 403,
+      message: "Forbidden",
+    });
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/messages",
+    );
+    const response = await GET(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(403);
+  });
+
+  it("returns 401 for unauthenticated POST", async () => {
+    mockAuth.mockResolvedValue({ userId: null });
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/messages",
+      {
+        method: "POST",
+        body: JSON.stringify({ body: "Hello" }),
+      },
+    );
+    const response = await POST(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(401);
+  });
+
+  it("returns 400 when POST body is invalid", async () => {
+    mockAuth.mockResolvedValue({ userId: "user_1" });
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/messages",
+      {
+        method: "POST",
+        body: "not json",
+        headers: { "Content-Type": "application/json" },
+      },
+    );
+    const response = await POST(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(400);
+  });
+
+  it("returns 403 when synced user is missing on POST", async () => {
+    mockAuth.mockResolvedValue({ userId: "user_1" });
+    mockEnsureUserSynced.mockResolvedValue(null);
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/messages",
+      {
+        method: "POST",
+        body: JSON.stringify({ body: "Hi" }),
+      },
+    );
+    const response = await POST(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(403);
+    expect(mockCreateThreadMessage).not.toHaveBeenCalled();
+  });
+
+  it("maps ChatError to status code on POST", async () => {
+    mockAuth.mockResolvedValue({ userId: "user_1" });
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "user_1",
+      role: "client",
+      gymId: "gym_1",
+    });
+    mockCreateThreadMessage.mockRejectedValue({
+      status: 403,
+      message: "Forbidden",
+    });
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/messages",
+      {
+        method: "POST",
+        body: JSON.stringify({ body: "Hello" }),
+      },
+    );
+    const response = await POST(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(403);
+  });
+});

apps/admin/src/app/api/chat/threads/[id]/messages/__tests__/route-params.test.ts

@@ -0,0 +1,133 @@
+/**
+ * @jest-environment node
+ */
+
+import { NextRequest } from "next/server";
+import { GET, POST } from "../route";
+
+jest.mock("@clerk/nextjs/server", () => ({
+  auth: jest.fn(),
+}));
+
+jest.mock("@/lib/database", () => ({
+  getDatabase: jest.fn(),
+}));
+
+jest.mock("@/lib/sync-user", () => ({
+  ensureUserSynced: jest.fn(),
+}));
+
+jest.mock("@/lib/chat", () => ({
+  getThreadMessages: jest.fn(),
+  createThreadMessage: jest.fn(),
+  isChatError: jest.fn(() => false),
+}));
+
+jest.mock("@/lib/logger", () => ({
+  info: jest.fn(),
+  warn: jest.fn(),
+  error: jest.fn(),
+  debug: jest.fn(),
+}));
+
+describe("/api/chat/threads/[id]/messages params", () => {
+  const mockAuth = require("@clerk/nextjs/server").auth as jest.Mock;
+  const mockGetDatabase = require("@/lib/database").getDatabase as jest.Mock;
+  const mockEnsureUserSynced = require("@/lib/sync-user")
+    .ensureUserSynced as jest.Mock;
+  const mockGetThreadMessages = require("@/lib/chat")
+    .getThreadMessages as jest.Mock;
+  const mockCreateThreadMessage = require("@/lib/chat")
+    .createThreadMessage as jest.Mock;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockAuth.mockResolvedValue({ userId: "user_1" });
+    mockGetDatabase.mockResolvedValue({});
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "user_1",
+      role: "client",
+      gymId: "gym_1",
+    });
+  });
+
+  it("parses numeric cursor and limit", async () => {
+    mockGetThreadMessages.mockResolvedValue({ messages: [], nextCursor: null });
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/messages?cursor=12345&limit=20",
+    );
+
+    const response = await GET(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(mockGetThreadMessages).toHaveBeenCalledWith(
+      expect.objectContaining({
+        threadId: "thread_1",
+        cursor: 12345,
+        limit: 20,
+      }),
+    );
+  });
+
+  it("ignores invalid cursor and limit query values", async () => {
+    mockGetThreadMessages.mockResolvedValue({ messages: [], nextCursor: null });
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/messages?cursor=abc&limit=xyz",
+    );
+
+    const response = await GET(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(mockGetThreadMessages).toHaveBeenCalledWith(
+      expect.objectContaining({
+        threadId: "thread_1",
+        cursor: undefined,
+        limit: undefined,
+      }),
+    );
+  });
+
+  it("filters malformed attachments before create", async () => {
+    mockCreateThreadMessage.mockResolvedValue({ id: "msg_1" });
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/messages",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          body: "Hello",
+          attachments: [
+            { url: "https://example.com/file.png", type: "image/png" },
+            { url: 123, type: "image/png" },
+            { foo: "bar" },
+          ],
+        }),
+      },
+    );
+
+    const response = await POST(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(201);
+    expect(mockCreateThreadMessage).toHaveBeenCalledWith(
+      expect.objectContaining({
+        threadId: "thread_1",
+        body: "Hello",
+        attachments: [
+          {
+            url: "https://example.com/file.png",
+            type: "image/png",
+            name: undefined,
+          },
+        ],
+      }),
+    );
+  });
+});

apps/admin/src/app/api/chat/threads/[id]/messages/route.ts

@@ -0,0 +1,148 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@clerk/nextjs/server";
+import { ensureUserSynced } from "@/lib/sync-user";
+import { getDatabase } from "@/lib/database";
+import {
+  createThreadMessage,
+  getThreadMessages,
+  isChatError,
+} from "@/lib/chat";
+import log from "@/lib/logger";
+
+interface Params {
+  params: Promise<{ id: string }>;
+}
+
+export async function GET(request: NextRequest, { params }: Params) {
+  try {
+    const { userId } = await auth();
+    if (!userId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const { id: threadId } = await params;
+    const db = await getDatabase();
+    const currentUser = await ensureUserSynced(userId, db);
+    if (!currentUser) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const cursorParam = request.nextUrl.searchParams.get("cursor");
+    const limitParam = request.nextUrl.searchParams.get("limit");
+
+    const cursor =
+      cursorParam && Number.isFinite(Number(cursorParam))
+        ? Number(cursorParam)
+        : undefined;
+    const limit =
+      limitParam && Number.isFinite(Number(limitParam))
+        ? Number(limitParam)
+        : undefined;
+
+    const result = await getThreadMessages({
+      currentUser: {
+        id: currentUser.id,
+        role: currentUser.role,
+        gymId: currentUser.gymId,
+      },
+      threadId,
+      cursor,
+      limit,
+    });
+
+    return NextResponse.json(result);
+  } catch (error) {
+    if (isChatError(error)) {
+      return NextResponse.json(
+        { error: error.message },
+        { status: error.status },
+      );
+    }
+
+    log.error("Failed to fetch chat messages", error);
+    return NextResponse.json(
+      { error: "Internal server error" },
+      { status: 500 },
+    );
+  }
+}
+
+export async function POST(request: NextRequest, { params }: Params) {
+  try {
+    const { userId } = await auth();
+    if (!userId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const { id: threadId } = await params;
+    const body = await request.json().catch(() => null);
+    if (!body || typeof body !== "object") {
+      return NextResponse.json({ error: "Invalid body" }, { status: 400 });
+    }
+
+    const messageBody = String(body.body ?? "").trim();
+    if (!messageBody) {
+      return NextResponse.json(
+        { error: "Message body is required" },
+        { status: 400 },
+      );
+    }
+
+    const clientMessageIdRaw = body.clientMessageId;
+    const clientMessageId =
+      typeof clientMessageIdRaw === "string" &&
+      clientMessageIdRaw.trim().length > 0
+        ? clientMessageIdRaw.trim()
+        : undefined;
+
+    const attachmentsRaw = body.attachments;
+    const attachments = Array.isArray(attachmentsRaw)
+      ? attachmentsRaw
+          .filter(
+            (item): item is { url: string; type: string; name?: string } =>
+              !!item &&
+              typeof item === "object" &&
+              typeof item.url === "string" &&
+              typeof item.type === "string",
+          )
+          .map((item) => ({
+            url: item.url,
+            type: item.type,
+            name: typeof item.name === "string" ? item.name : undefined,
+          }))
+      : undefined;
+
+    const db = await getDatabase();
+    const currentUser = await ensureUserSynced(userId, db);
+    if (!currentUser) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const message = await createThreadMessage({
+      currentUser: {
+        id: currentUser.id,
+        role: currentUser.role,
+        gymId: currentUser.gymId,
+      },
+      threadId,
+      body: messageBody,
+      clientMessageId,
+      attachments,
+    });
+
+    return NextResponse.json({ message }, { status: 201 });
+  } catch (error) {
+    if (isChatError(error)) {
+      return NextResponse.json(
+        { error: error.message },
+        { status: error.status },
+      );
+    }
+
+    log.error("Failed to create chat message", error);
+    return NextResponse.json(
+      { error: "Internal server error" },
+      { status: 500 },
+    );
+  }
+}

apps/admin/src/app/api/chat/threads/[id]/read/__tests__/route-authz.test.ts

@@ -0,0 +1,134 @@
+/**
+ * @jest-environment node
+ */
+
+import { NextRequest } from "next/server";
+import { POST } from "../route";
+
+jest.mock("@clerk/nextjs/server", () => ({
+  auth: jest.fn(),
+}));
+
+jest.mock("@/lib/database", () => ({
+  getDatabase: jest.fn(),
+}));
+
+jest.mock("@/lib/sync-user", () => ({
+  ensureUserSynced: jest.fn(),
+}));
+
+jest.mock("@/lib/chat", () => ({
+  markThreadAsRead: jest.fn(),
+  isChatError: jest.fn((error: unknown) =>
+    Boolean(
+      error && typeof error === "object" && "status" in (error as object),
+    ),
+  ),
+}));
+
+jest.mock("@/lib/logger", () => ({
+  info: jest.fn(),
+  warn: jest.fn(),
+  error: jest.fn(),
+  debug: jest.fn(),
+}));
+
+describe("/api/chat/threads/[id]/read authz", () => {
+  const mockAuth = require("@clerk/nextjs/server").auth as jest.Mock;
+  const mockGetDatabase = require("@/lib/database").getDatabase as jest.Mock;
+  const mockEnsureUserSynced = require("@/lib/sync-user")
+    .ensureUserSynced as jest.Mock;
+  const mockMarkThreadAsRead = require("@/lib/chat")
+    .markThreadAsRead as jest.Mock;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockGetDatabase.mockResolvedValue({});
+  });
+
+  it("returns 401 for unauthenticated request", async () => {
+    mockAuth.mockResolvedValue({ userId: null });
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/read",
+      {
+        method: "POST",
+        body: JSON.stringify({ lastReadMessageId: "msg_1" }),
+      },
+    );
+    const response = await POST(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(401);
+  });
+
+  it("returns 403 when synced user is missing", async () => {
+    mockAuth.mockResolvedValue({ userId: "user_1" });
+    mockEnsureUserSynced.mockResolvedValue(null);
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/read",
+      {
+        method: "POST",
+        body: JSON.stringify({ lastReadMessageId: "msg_1" }),
+      },
+    );
+    const response = await POST(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(403);
+    expect(mockMarkThreadAsRead).not.toHaveBeenCalled();
+  });
+
+  it("maps ChatError to status code", async () => {
+    mockAuth.mockResolvedValue({ userId: "user_1" });
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "user_1",
+      role: "client",
+      gymId: "gym_1",
+    });
+    mockMarkThreadAsRead.mockRejectedValue({
+      status: 403,
+      message: "Forbidden",
+    });
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/read",
+      {
+        method: "POST",
+        body: JSON.stringify({ lastReadMessageId: "msg_1" }),
+      },
+    );
+    const response = await POST(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(403);
+  });
+
+  it("returns success for authorized user", async () => {
+    mockAuth.mockResolvedValue({ userId: "user_1" });
+    mockEnsureUserSynced.mockResolvedValue({
+      id: "user_1",
+      role: "client",
+      gymId: "gym_1",
+    });
+    mockMarkThreadAsRead.mockResolvedValue(undefined);
+
+    const request = new NextRequest(
+      "http://localhost/api/chat/threads/thread_1/read",
+      {
+        method: "POST",
+        body: JSON.stringify({ lastReadMessageId: "msg_1" }),
+      },
+    );
+    const response = await POST(request, {
+      params: Promise.resolve({ id: "thread_1" }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(mockMarkThreadAsRead).toHaveBeenCalled();
+  });
+});

apps/admin/src/app/api/chat/threads/[id]/read/route.ts

@@ -0,0 +1,60 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@clerk/nextjs/server";
+import { ensureUserSynced } from "@/lib/sync-user";
+import { getDatabase } from "@/lib/database";
+import { isChatError, markThreadAsRead } from "@/lib/chat";
+import log from "@/lib/logger";
+
+interface Params {
+  params: Promise<{ id: string }>;
+}
+
+export async function POST(request: NextRequest, { params }: Params) {
+  try {
+    const { userId } = await auth();
+    if (!userId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const { id: threadId } = await params;
+    const body = await request.json().catch(() => ({}));
+
+    const lastReadMessageId =
+      body &&
+      typeof body === "object" &&
+      typeof body.lastReadMessageId === "string"
+        ? body.lastReadMessageId
+        : undefined;
+
+    const db = await getDatabase();
+    const currentUser = await ensureUserSynced(userId, db);
+    if (!currentUser) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    await markThreadAsRead({
+      currentUser: {
+        id: currentUser.id,
+        role: currentUser.role,
+        gymId: currentUser.gymId,
+      },
+      threadId,
+      lastReadMessageId,
+    });
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    if (isChatError(error)) {
+      return NextResponse.json(
+        { error: error.message },
+        { status: error.status },
+      );
+    }
+
+    log.error("Failed to mark chat thread as read", error);
+    return NextResponse.json(
+      { error: "Internal server error" },
+      { status: 500 },
+    );
+  }
+}

apps/admin/src/app/api/chat/threads/[id]/route.ts

@@ -0,0 +1,52 @@
+import { NextResponse } from "next/server";
+import { auth } from "@clerk/nextjs/server";
+import { ensureUserSynced } from "@/lib/sync-user";
+import { getDatabase } from "@/lib/database";
+import { isChatError, listThreadsForUser } from "@/lib/chat";
+import log from "@/lib/logger";
+
+interface Params {
+  params: Promise<{ id: string }>;
+}
+
+export async function GET(_request: Request, { params }: Params) {
+  try {
+    const { userId } = await auth();
+    if (!userId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const { id: threadId } = await params;
+    const db = await getDatabase();
+    const currentUser = await ensureUserSynced(userId, db);
+    if (!currentUser) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const threads = await listThreadsForUser({
+      id: currentUser.id,
+      role: currentUser.role,
+      gymId: currentUser.gymId,
+    });
+
+    const thread = threads.find((item) => item.id === threadId);
+    if (!thread) {
+      return NextResponse.json({ error: "Thread not found" }, { status: 404 });
+    }
+
+    return NextResponse.json({ thread });
+  } catch (error) {
+    if (isChatError(error)) {
+      return NextResponse.json(
+        { error: error.message },
+        { status: error.status },
+      );
+    }
+
+    log.error("Failed to fetch chat thread", error);
+    return NextResponse.json(
+      { error: "Internal server error" },
+      { status: 500 },
+    );
+  }
+}

apps/admin/src/app/api/chat/threads/route.ts

@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from "next/server";
+import { auth } from "@clerk/nextjs/server";
+import { ensureUserSynced } from "@/lib/sync-user";
+import { getDatabase } from "@/lib/database";
+import {
+  getOrCreateGymRoomThread,
+  isChatError,
+  listThreadsForUser,
+} from "@/lib/chat";
+import log from "@/lib/logger";
+
+export async function GET(request: NextRequest) {
+  try {
+    const { userId } = await auth();
+    if (!userId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const db = await getDatabase();
+    const currentUser = await ensureUserSynced(userId, db);
+    if (!currentUser) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const includeGymRoom =
+      request.nextUrl.searchParams.get("includeGymRoom") !== "false";
+
+    if (includeGymRoom && currentUser.gymId) {
+      await getOrCreateGymRoomThread({
+        id: currentUser.id,
+        role: currentUser.role,
+        gymId: currentUser.gymId,
+      });
+    }
+
+    const threads = await listThreadsForUser({
+      id: currentUser.id,
+      role: currentUser.role,
+      gymId: currentUser.gymId,
+    });
+
+    return NextResponse.json({ threads });
+  } catch (error) {
+    if (isChatError(error)) {
+      return NextResponse.json(
+        { error: error.message },
+        { status: error.status },
+      );
+    }
+
+    log.error("Failed to fetch chat threads", error);
+    return NextResponse.json(
+      { error: "Internal server error" },
+      { status: 500 },
+    );
+  }
+}

apps/admin/src/app/chat/page.tsx

@@ -0,0 +1,575 @@
+"use client";
+
+import { useAuth } from "@clerk/nextjs";
+import { useEffect, useMemo, useRef, useState } from "react";
+import { io, type Socket } from "socket.io-client";
+import axios from "axios";
+import { PageHeader } from "@/components/ui/PageHeader";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Input } from "@/components/ui/input";
+
+interface ChatThread {
+  id: string;
+  type: "gym" | "dm";
+  unreadCount: number;
+  lastMessageBody: string | null;
+  lastMessageAt: string | null;
+}
+
+interface ChatMessage {
+  id: string;
+  threadId: string;
+  senderUserId: string;
+  body: string;
+  createdAt: string;
+  clientMessageId: string | null;
+  kind?: "text" | "system";
+  attachments?: Array<{ url: string; type: string; name?: string }>;
+  editedAt?: string | null;
+  deletedAt?: string | null;
+}
+
+interface ReadEvent {
+  threadId?: string;
+  userId?: string;
+  lastReadMessageId?: string | null;
+}
+
+export default function AdminChatPage() {
+  const { getToken, userId } = useAuth();
+
+  const [threads, setThreads] = useState<ChatThread[]>([]);
+  const [activeThreadId, setActiveThreadId] = useState<string | null>(null);
+  const [messagesByThreadId, setMessagesByThreadId] = useState<
+    Record<string, ChatMessage[]>
+  >({});
+  const [draft, setDraft] = useState("");
+  const [loadingThreads, setLoadingThreads] = useState(false);
+  const [loadingMessages, setLoadingMessages] = useState(false);
+  const [socketConnected, setSocketConnected] = useState(false);
+  const [typingByThreadId, setTypingByThreadId] = useState<
+    Record<string, string[]>
+  >({});
+  const [readByThreadId, setReadByThreadId] = useState<
+    Record<string, Record<string, string>>
+  >({});
+
+  const typingTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const socketRef = useRef<Socket | null>(null);
+
+  const activeMessages = useMemo(
+    () => (activeThreadId ? (messagesByThreadId[activeThreadId] ?? []) : []),
+    [activeThreadId, messagesByThreadId],
+  );
+
+  const typingUsers = useMemo(
+    () => (activeThreadId ? (typingByThreadId[activeThreadId] ?? []) : []),
+    [activeThreadId, typingByThreadId],
+  );
+
+  useEffect(() => {
+    const loadThreads = async () => {
+      const token = await getToken();
+      if (!token) {
+        return;
+      }
+
+      try {
+        setLoadingThreads(true);
+        const response = await axios.get<{ threads: ChatThread[] }>(
+          "/api/chat/threads",
+          {
+            headers: { Authorization: `Bearer ${token}` },
+          },
+        );
+
+        setThreads(response.data.threads);
+        setActiveThreadId(
+          (prev) => prev ?? response.data.threads[0]?.id ?? null,
+        );
+        setReadByThreadId({});
+      } finally {
+        setLoadingThreads(false);
+      }
+    };
+
+    void loadThreads();
+  }, [getToken]);
+
+  useEffect(() => {
+    if (!activeThreadId) {
+      return;
+    }
+
+    const loadMessages = async () => {
+      const token = await getToken();
+      if (!token) {
+        return;
+      }
+
+      try {
+        setLoadingMessages(true);
+        const response = await axios.get<{ messages: ChatMessage[] }>(
+          `/api/chat/threads/${activeThreadId}/messages`,
+          {
+            headers: { Authorization: `Bearer ${token}` },
+          },
+        );
+
+        setMessagesByThreadId((prev) => ({
+          ...prev,
+          [activeThreadId]: response.data.messages,
+        }));
+      } finally {
+        setLoadingMessages(false);
+      }
+    };
+
+    void loadMessages();
+  }, [activeThreadId, getToken]);
+
+  useEffect(() => {
+    let mounted = true;
+
+    const setupSocket = async () => {
+      const token = await getToken();
+      if (!token || !mounted) {
+        return;
+      }
+
+      const realtimeBase =
+        process.env.NEXT_PUBLIC_REALTIME_URL ?? window.location.origin;
+
+      const socket = io(realtimeBase, {
+        path: process.env.NEXT_PUBLIC_REALTIME_PATH ?? "/socket.io",
+        transports: ["websocket"],
+        auth: { token },
+      });
+
+      socketRef.current = socket;
+
+      socket.on("connect", () => {
+        setSocketConnected(true);
+        if (activeThreadId) {
+          socket.emit("chat:subscribe", { threadId: activeThreadId });
+        }
+      });
+
+      socket.on("disconnect", () => {
+        setSocketConnected(false);
+        setTypingByThreadId({});
+      });
+
+      socket.on(
+        "chat:message:new",
+        (event: { threadId: string; message: ChatMessage }) => {
+          setMessagesByThreadId((prev) => {
+            const current = prev[event.threadId] ?? [];
+            if (current.some((message) => message.id === event.message.id)) {
+              return prev;
+            }
+
+            return {
+              ...prev,
+              [event.threadId]: [...current, event.message],
+            };
+          });
+
+          setThreads((prev) =>
+            prev
+              .map((thread) =>
+                thread.id === event.threadId
+                  ? {
+                      ...thread,
+                      lastMessageAt: event.message.createdAt,
+                      lastMessageBody: event.message.body,
+                      unreadCount:
+                        event.threadId === activeThreadId ||
+                        event.message.senderUserId === userId
+                          ? thread.unreadCount
+                          : thread.unreadCount + 1,
+                    }
+                  : thread,
+              )
+              .sort((a, b) => {
+                const aTime = a.lastMessageAt ?? "1970-01-01T00:00:00.000Z";
+                const bTime = b.lastMessageAt ?? "1970-01-01T00:00:00.000Z";
+                return new Date(bTime).getTime() - new Date(aTime).getTime();
+              }),
+          );
+        },
+      );
+
+      socket.on(
+        "chat:message:ack",
+        (event: {
+          threadId: string;
+          message: ChatMessage;
+          clientMessageId?: string | null;
+        }) => {
+          setMessagesByThreadId((prev) => ({
+            ...prev,
+            [event.threadId]: (prev[event.threadId] ?? []).map((message) =>
+              event.clientMessageId
+                ? message.clientMessageId === event.clientMessageId
+                  ? event.message
+                  : message
+                : message.id === event.message.id
+                  ? event.message
+                  : message,
+            ),
+          }));
+        },
+      );
+
+      socket.on(
+        "chat:typing",
+        (event: { threadId?: string; userId?: string; isTyping?: boolean }) => {
+          if (!event.threadId || !event.userId || event.userId === userId) {
+            return;
+          }
+
+          setTypingByThreadId((prev) => {
+            const current = prev[event.threadId!] ?? [];
+            if (event.isTyping) {
+              if (current.includes(event.userId!)) {
+                return prev;
+              }
+
+              return {
+                ...prev,
+                [event.threadId!]: [...current, event.userId!],
+              };
+            }
+
+            return {
+              ...prev,
+              [event.threadId!]: current.filter((id) => id !== event.userId),
+            };
+          });
+        },
+      );
+
+      socket.on("chat:read:update", (event: ReadEvent) => {
+        if (!event.threadId || !event.userId || !event.lastReadMessageId) {
+          return;
+        }
+
+        setReadByThreadId((prev) => ({
+          ...prev,
+          [event.threadId!]: {
+            ...(prev[event.threadId!] ?? {}),
+            [event.userId!]: event.lastReadMessageId!,
+          },
+        }));
+      });
+
+      socket.on("chat:error", (event: { code?: string; message?: string }) => {
+        if (event.code === "rate_limited") {
+          console.warn(event.message ?? "Chat action rate-limited");
+        }
+      });
+    };
+
+    void setupSocket();
+
+    return () => {
+      mounted = false;
+      if (typingTimeoutRef.current) {
+        clearTimeout(typingTimeoutRef.current);
+      }
+      if (socketRef.current) {
+        socketRef.current.disconnect();
+        socketRef.current = null;
+      }
+    };
+  }, [activeThreadId, getToken, userId]);
+
+  useEffect(() => {
+    if (!activeThreadId || !socketRef.current || !socketConnected) {
+      return;
+    }
+
+    socketRef.current.emit("chat:subscribe", { threadId: activeThreadId });
+    setThreads((prev) =>
+      prev.map((thread) =>
+        thread.id === activeThreadId ? { ...thread, unreadCount: 0 } : thread,
+      ),
+    );
+
+    return () => {
+      if (socketRef.current) {
+        socketRef.current.emit("chat:unsubscribe", {
+          threadId: activeThreadId,
+        });
+      }
+    };
+  }, [activeThreadId, socketConnected]);
+
+  useEffect(() => {
+    if (!activeThreadId) {
+      return;
+    }
+
+    const messages = messagesByThreadId[activeThreadId] ?? [];
+    const lastMessage = messages[messages.length - 1];
+    if (!lastMessage || lastMessage.senderUserId === userId) {
+      return;
+    }
+
+    const markRead = async () => {
+      const token = await getToken();
+      if (!token) {
+        return;
+      }
+
+      await axios.post(
+        `/api/chat/threads/${activeThreadId}/read`,
+        { lastReadMessageId: lastMessage.id },
+        {
+          headers: { Authorization: `Bearer ${token}` },
+        },
+      );
+
+      if (socketRef.current && socketConnected) {
+        socketRef.current.emit("chat:read", {
+          threadId: activeThreadId,
+          lastReadMessageId: lastMessage.id,
+        });
+      }
+
+      if (userId) {
+        setReadByThreadId((prev) => ({
+          ...prev,
+          [activeThreadId]: {
+            ...(prev[activeThreadId] ?? {}),
+            [userId]: lastMessage.id,
+          },
+        }));
+      }
+    };
+
+    void markRead();
+  }, [activeThreadId, getToken, messagesByThreadId, socketConnected, userId]);
+
+  const onChangeDraft = (value: string) => {
+    setDraft(value);
+
+    if (!activeThreadId || !socketRef.current || !socketConnected) {
+      return;
+    }
+
+    const isTyping = value.trim().length > 0;
+    socketRef.current.emit("chat:typing", {
+      threadId: activeThreadId,
+      isTyping,
+    });
+
+    if (typingTimeoutRef.current) {
+      clearTimeout(typingTimeoutRef.current);
+    }
+
+    typingTimeoutRef.current = setTimeout(() => {
+      if (activeThreadId && socketRef.current) {
+        socketRef.current.emit("chat:typing", {
+          threadId: activeThreadId,
+          isTyping: false,
+        });
+      }
+    }, 1200);
+  };
+
+  const onSend = async () => {
+    if (!activeThreadId) {
+      return;
+    }
+
+    const body = draft.trim();
+    if (!body) {
+      return;
+    }
+
+    const clientMessageId = `admin_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+    const optimistic: ChatMessage = {
+      id: clientMessageId,
+      threadId: activeThreadId,
+      senderUserId: userId ?? "",
+      body,
+      createdAt: new Date().toISOString(),
+      clientMessageId,
+      kind: "text",
+      attachments: [],
+      editedAt: null,
+      deletedAt: null,
+    };
+
+    setMessagesByThreadId((prev) => ({
+      ...prev,
+      [activeThreadId]: [...(prev[activeThreadId] ?? []), optimistic],
+    }));
+    setDraft("");
+
+    if (socketRef.current && socketConnected) {
+      socketRef.current.emit("chat:send", {
+        threadId: activeThreadId,
+        body,
+        clientMessageId,
+      });
+      return;
+    }
+
+    const token = await getToken();
+    if (!token) {
+      return;
+    }
+
+    try {
+      const response = await axios.post<{ message: ChatMessage }>(
+        `/api/chat/threads/${activeThreadId}/messages`,
+        { body, clientMessageId },
+        {
+          headers: { Authorization: `Bearer ${token}` },
+        },
+      );
+
+      setMessagesByThreadId((prev) => ({
+        ...prev,
+        [activeThreadId]: (prev[activeThreadId] ?? []).map((message) =>
+          message.id === clientMessageId ? response.data.message : message,
+        ),
+      }));
+    } catch {
+      setMessagesByThreadId((prev) => ({
+        ...prev,
+        [activeThreadId]: (prev[activeThreadId] ?? []).filter(
+          (message) => message.id !== clientMessageId,
+        ),
+      }));
+    }
+  };
+
+  return (
+    <div className="space-y-6">
+      <PageHeader
+        title="Chat"
+        description="Gym room and private trainer-client messaging"
+        breadcrumbs={[{ label: "Chat" }]}
+      />
+
+      <div className="text-sm text-slate-500">
+        {socketConnected ? "Realtime connected" : "Realtime disconnected"}
+      </div>
+
+      <div className="grid grid-cols-1 gap-6 lg:grid-cols-[320px_1fr]">
+        <Card>
+          <CardHeader>
+            <CardTitle>Threads</CardTitle>
+          </CardHeader>
+          <CardContent className="space-y-2">
+            {loadingThreads ? (
+              <div className="text-sm text-slate-500">Loading threads...</div>
+            ) : (
+              threads.map((thread) => (
+                <button
+                  key={thread.id}
+                  type="button"
+                  onClick={() => setActiveThreadId(thread.id)}
+                  className={`w-full rounded-lg border p-3 text-left transition ${
+                    thread.id === activeThreadId
+                      ? "border-blue-500 bg-blue-50"
+                      : "border-slate-200 hover:bg-slate-50"
+                  }`}
+                >
+                  <div className="flex items-center justify-between">
+                    <p className="font-medium text-slate-900">
+                      {thread.type === "gym" ? "Gym Room" : "Trainer DM"}
+                    </p>
+                    {thread.unreadCount > 0 && (
+                      <span className="rounded-full bg-red-500 px-2 py-0.5 text-xs font-semibold text-white">
+                        {thread.unreadCount > 99 ? "99+" : thread.unreadCount}
+                      </span>
+                    )}
+                  </div>
+                  <p className="mt-1 truncate text-sm text-slate-500">
+                    {thread.lastMessageBody ?? "No messages yet"}
+                  </p>
+                </button>
+              ))
+            )}
+          </CardContent>
+        </Card>
+
+        <Card>
+          <CardHeader>
+            <CardTitle>Messages</CardTitle>
+          </CardHeader>
+          <CardContent>
+            {!activeThreadId ? (
+              <p className="text-sm text-slate-500">
+                Select a thread to start chatting.
+              </p>
+            ) : (
+              <div className="space-y-3">
+                <div className="max-h-[460px] space-y-2 overflow-y-auto rounded-md border border-slate-200 p-3">
+                  {loadingMessages ? (
+                    <p className="text-sm text-slate-500">
+                      Loading messages...
+                    </p>
+                  ) : (
+                    activeMessages.map((message) => {
+                      const own = message.senderUserId === userId;
+                      const threadReads = activeThreadId
+                        ? (readByThreadId[activeThreadId] ?? {})
+                        : {};
+                      const seen = Object.entries(threadReads).some(
+                        ([readerUserId, readMessageId]) =>
+                          readerUserId !== userId &&
+                          readMessageId === message.id,
+                      );
+
+                      return (
+                        <div
+                          key={message.id}
+                          className={`max-w-[80%] rounded-lg px-3 py-2 text-sm ${
+                            own
+                              ? "ml-auto bg-blue-600 text-white"
+                              : "bg-slate-100 text-slate-900"
+                          }`}
+                        >
+                          <div>{message.body}</div>
+                          {own && seen && (
+                            <div className="mt-1 text-[10px] text-blue-100">
+                              Seen
+                            </div>
+                          )}
+                        </div>
+                      );
+                    })
+                  )}
+                </div>
+
+                {typingUsers.length > 0 && (
+                  <p className="text-xs text-slate-500">
+                    {typingUsers.length === 1
+                      ? "Someone is typing..."
+                      : `${typingUsers.length} people are typing...`}
+                  </p>
+                )}
+
+                <div className="flex items-center gap-2">
+                  <Input
+                    value={draft}
+                    onChange={(event) => onChangeDraft(event.target.value)}
+                    placeholder="Type a message"
+                  />
+                  <Button onClick={onSend}>Send</Button>
+                </div>
+              </div>
+            )}
+          </CardContent>
+        </Card>
+      </div>
+    </div>
+  );
+}

apps/admin/src/components/ui/Sidebar.tsx

@@ -12,6 +12,7 @@ import {
   Brain,
   ChevronLeft,
   Activity,
+  MessageCircle,
 } from "lucide-react";
 import { UserButton, useUser } from "@clerk/nextjs";
 import { usePendingRecommendationsCount } from "@/hooks/use-api";
@@ -52,6 +53,7 @@ export function Sidebar() {
       href: "/recommendations",
       badge: pendingCount > 0 ? pendingCount : undefined,
     },
+    { icon: MessageCircle, label: "Chat", href: "/chat" },
     { icon: CalendarCheck, label: "Attendance", href: "/attendance" },
     { icon: CreditCard, label: "Payments", href: "/payments" },
     { icon: Settings, label: "Settings", href: "/settings" },

apps/admin/src/lib/chat.ts

@@ -0,0 +1,824 @@
+import { db, sql } from "@fitai/database";
+import type { UserRole } from "@fitai/shared";
+import log from "@/lib/logger";
+
+export interface ChatUserContext {
+  id: string;
+  role: UserRole;
+  gymId?: string | null;
+}
+
+export interface ChatThreadSummary {
+  id: string;
+  type: "gym" | "dm";
+  gymId: string | null;
+  trainerId: string | null;
+  clientId: string | null;
+  createdBy: string;
+  lastMessageAt: Date | null;
+  createdAt: Date;
+  updatedAt: Date;
+  archivedAt: Date | null;
+  unreadCount: number;
+  lastMessageBody: string | null;
+}
+
+export interface ChatMessageRecord {
+  id: string;
+  threadId: string;
+  senderUserId: string;
+  body: string;
+  kind: "text" | "system";
+  attachments: Array<{ url: string; type: string; name?: string }>;
+  clientMessageId: string | null;
+  createdAt: Date;
+  editedAt: Date | null;
+  deletedAt: Date | null;
+}
+
+class ChatError extends Error {
+  status: number;
+
+  constructor(message: string, status: number) {
+    super(message);
+    this.status = status;
+  }
+}
+
+let tablesEnsured = false;
+
+export async function ensureChatTables(): Promise<void> {
+  if (tablesEnsured) {
+    return;
+  }
+
+  await db.run(sql`
+    CREATE TABLE IF NOT EXISTS chat_threads (
+      id TEXT PRIMARY KEY,
+      type TEXT NOT NULL CHECK (type IN ('gym', 'dm')),
+      gym_id TEXT,
+      trainer_id TEXT,
+      client_id TEXT,
+      created_by TEXT NOT NULL,
+      last_message_at INTEGER,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      archived_at INTEGER,
+      FOREIGN KEY (gym_id) REFERENCES gyms(id) ON DELETE CASCADE,
+      FOREIGN KEY (trainer_id) REFERENCES users(id) ON DELETE CASCADE,
+      FOREIGN KEY (client_id) REFERENCES users(id) ON DELETE CASCADE,
+      FOREIGN KEY (created_by) REFERENCES users(id) ON DELETE CASCADE
+    )
+  `);
+
+  await db.run(sql`
+    CREATE TABLE IF NOT EXISTS chat_thread_members (
+      id TEXT PRIMARY KEY,
+      thread_id TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      role_in_thread TEXT NOT NULL CHECK (role_in_thread IN ('superAdmin', 'admin', 'trainer', 'client')),
+      joined_at INTEGER NOT NULL,
+      left_at INTEGER,
+      muted INTEGER NOT NULL DEFAULT 0,
+      last_read_message_id TEXT,
+      last_read_at INTEGER,
+      FOREIGN KEY (thread_id) REFERENCES chat_threads(id) ON DELETE CASCADE,
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+      UNIQUE(thread_id, user_id)
+    )
+  `);
+
+  await db.run(sql`
+    CREATE TABLE IF NOT EXISTS chat_messages (
+      id TEXT PRIMARY KEY,
+      thread_id TEXT NOT NULL,
+      sender_user_id TEXT NOT NULL,
+      body TEXT NOT NULL,
+      kind TEXT NOT NULL CHECK (kind IN ('text', 'system')) DEFAULT 'text',
+      attachments_json TEXT,
+      client_message_id TEXT,
+      created_at INTEGER NOT NULL,
+      edited_at INTEGER,
+      deleted_at INTEGER,
+      FOREIGN KEY (thread_id) REFERENCES chat_threads(id) ON DELETE CASCADE,
+      FOREIGN KEY (sender_user_id) REFERENCES users(id) ON DELETE CASCADE,
+      UNIQUE(sender_user_id, client_message_id)
+    )
+  `);
+
+  await db.run(sql`
+    CREATE TABLE IF NOT EXISTS chat_message_reads (
+      id TEXT PRIMARY KEY,
+      message_id TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      read_at INTEGER NOT NULL,
+      FOREIGN KEY (message_id) REFERENCES chat_messages(id) ON DELETE CASCADE,
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+      UNIQUE(message_id, user_id)
+    )
+  `);
+
+  await db.run(
+    sql`CREATE INDEX IF NOT EXISTS chat_threads_gym_type_last_msg_idx ON chat_threads(gym_id, type, last_message_at)`,
+  );
+  await db.run(
+    sql`CREATE INDEX IF NOT EXISTS chat_threads_type_idx ON chat_threads(type)`,
+  );
+  await db.run(
+    sql`CREATE UNIQUE INDEX IF NOT EXISTS chat_threads_trainer_client_type_idx ON chat_threads(trainer_id, client_id, type)`,
+  );
+  await db.run(
+    sql`CREATE INDEX IF NOT EXISTS chat_thread_members_user_thread_idx ON chat_thread_members(user_id, thread_id)`,
+  );
+  await db.run(
+    sql`CREATE INDEX IF NOT EXISTS chat_messages_thread_created_at_idx ON chat_messages(thread_id, created_at)`,
+  );
+  await db.run(
+    sql`CREATE INDEX IF NOT EXISTS chat_message_reads_user_read_at_idx ON chat_message_reads(user_id, read_at)`,
+  );
+
+  tablesEnsured = true;
+}
+
+export async function getOrCreateGymRoomThread(
+  currentUser: ChatUserContext,
+): Promise<ChatThreadSummary> {
+  await ensureChatTables();
+
+  if (!currentUser.gymId) {
+    throw new ChatError("No gym assigned", 400);
+  }
+
+  const rows = await db.all(sql`
+    SELECT
+      id,
+      type,
+      gym_id as gymId,
+      trainer_id as trainerId,
+      client_id as clientId
+    FROM chat_threads
+    WHERE type = 'gym'
+      AND gym_id = ${currentUser.gymId}
+      AND archived_at IS NULL
+    LIMIT 1
+  `);
+
+  let thread = rows?.[0] as ThreadRow | undefined;
+
+  if (!thread) {
+    const now = nowEpochSeconds();
+    const newThreadId = generateId("thread");
+
+    await db.run(sql`
+      INSERT INTO chat_threads (
+        id,
+        type,
+        gym_id,
+        created_by,
+        created_at,
+        updated_at
+      ) VALUES (
+        ${newThreadId},
+        ${"gym"},
+        ${currentUser.gymId},
+        ${currentUser.id},
+        ${now},
+        ${now}
+      )
+    `);
+
+    const createdRows = await db.all(sql`
+      SELECT
+        id,
+        type,
+        gym_id as gymId,
+        trainer_id as trainerId,
+        client_id as clientId
+      FROM chat_threads
+      WHERE id = ${newThreadId}
+      LIMIT 1
+    `);
+    thread = createdRows?.[0] as ThreadRow | undefined;
+  }
+
+  if (!thread) {
+    throw new ChatError("Failed to initialize gym room", 500);
+  }
+
+  await ensureThreadMember(thread.id, currentUser.id, currentUser.role);
+  return await getThreadSummaryForUser(currentUser.id, thread.id);
+}
+
+export async function getOrCreateDmThread(params: {
+  trainerId: string;
+  clientId: string;
+  createdBy: ChatUserContext;
+}): Promise<ChatThreadSummary> {
+  await ensureChatTables();
+
+  const trainerRows = await db.all(sql`
+    SELECT id, role, gym_id as gymId
+    FROM users
+    WHERE id = ${params.trainerId}
+    LIMIT 1
+  `);
+  const clientRows = await db.all(sql`
+    SELECT id, role, gym_id as gymId
+    FROM users
+    WHERE id = ${params.clientId}
+    LIMIT 1
+  `);
+
+  const trainer = trainerRows?.[0] as
+    | { id: string; role: UserRole; gymId: string | null }
+    | undefined;
+  const client = clientRows?.[0] as
+    | { id: string; role: UserRole; gymId: string | null }
+    | undefined;
+
+  if (!trainer || !client) {
+    throw new ChatError("Trainer or client not found", 404);
+  }
+
+  if (client.role !== "client") {
+    throw new ChatError("Direct message target must be a client", 400);
+  }
+
+  if (trainer.role !== "trainer" && trainer.role !== "admin") {
+    throw new ChatError("Direct message trainer is invalid", 400);
+  }
+
+  if (!trainer.gymId || trainer.gymId !== client.gymId) {
+    throw new ChatError("Trainer and client must belong to same gym", 400);
+  }
+
+  const assignmentRows = await db.all(sql`
+    SELECT id
+    FROM trainer_client_assignments
+    WHERE trainer_id = ${params.trainerId}
+      AND client_id = ${params.clientId}
+      AND is_active = 1
+    LIMIT 1
+  `);
+
+  if (!assignmentRows?.[0]) {
+    throw new ChatError("Trainer is not assigned to this client", 403);
+  }
+
+  const rows = await db.all(sql`
+    SELECT
+      id,
+      type,
+      gym_id as gymId,
+      trainer_id as trainerId,
+      client_id as clientId
+    FROM chat_threads
+    WHERE type = 'dm'
+      AND trainer_id = ${params.trainerId}
+      AND client_id = ${params.clientId}
+      AND archived_at IS NULL
+    LIMIT 1
+  `);
+
+  let thread = rows?.[0] as ThreadRow | undefined;
+
+  if (!thread) {
+    const now = nowEpochSeconds();
+    const threadId = generateId("thread");
+
+    await db.run(sql`
+      INSERT INTO chat_threads (
+        id,
+        type,
+        gym_id,
+        trainer_id,
+        client_id,
+        created_by,
+        created_at,
+        updated_at
+      ) VALUES (
+        ${threadId},
+        ${"dm"},
+        ${trainer.gymId},
+        ${params.trainerId},
+        ${params.clientId},
+        ${params.createdBy.id},
+        ${now},
+        ${now}
+      )
+    `);
+
+    await ensureThreadMember(threadId, params.trainerId, trainer.role);
+    await ensureThreadMember(threadId, params.clientId, client.role);
+
+    const createdRows = await db.all(sql`
+      SELECT
+        id,
+        type,
+        gym_id as gymId,
+        trainer_id as trainerId,
+        client_id as clientId
+      FROM chat_threads
+      WHERE id = ${threadId}
+      LIMIT 1
+    `);
+    thread = createdRows?.[0] as ThreadRow | undefined;
+  }
+
+  if (!thread) {
+    throw new ChatError("Failed to initialize direct message", 500);
+  }
+
+  await ensureThreadMember(
+    thread.id,
+    params.createdBy.id,
+    params.createdBy.role,
+  );
+  return await getThreadSummaryForUser(params.createdBy.id, thread.id);
+}
+
+export async function listThreadsForUser(
+  currentUser: ChatUserContext,
+): Promise<ChatThreadSummary[]> {
+  await ensureChatTables();
+
+  const rows = await db.all(sql`
+    SELECT
+      t.id,
+      t.type,
+      t.gym_id as gymId,
+      t.trainer_id as trainerId,
+      t.client_id as clientId,
+      t.created_by as createdBy,
+      t.last_message_at as lastMessageAt,
+      t.created_at as createdAt,
+      t.updated_at as updatedAt,
+      t.archived_at as archivedAt,
+      (
+        SELECT m.body
+        FROM chat_messages m
+        WHERE m.thread_id = t.id
+          AND m.deleted_at IS NULL
+        ORDER BY m.created_at DESC
+        LIMIT 1
+      ) as lastMessageBody,
+      (
+        SELECT COUNT(*)
+        FROM chat_messages m
+        WHERE m.thread_id = t.id
+          AND m.deleted_at IS NULL
+          AND m.sender_user_id != ${currentUser.id}
+          AND m.created_at > COALESCE(mem.last_read_at, 0)
+      ) as unreadCount
+    FROM chat_threads t
+    JOIN chat_thread_members mem
+      ON mem.thread_id = t.id
+    WHERE mem.user_id = ${currentUser.id}
+      AND mem.left_at IS NULL
+      AND t.archived_at IS NULL
+    ORDER BY COALESCE(t.last_message_at, t.created_at) DESC
+  `);
+
+  return (rows as ThreadSummaryRow[]).map(mapThreadSummaryRow);
+}
+
+export async function getThreadMessages(params: {
+  currentUser: ChatUserContext;
+  threadId: string;
+  cursor?: number;
+  limit?: number;
+}): Promise<{ messages: ChatMessageRecord[]; nextCursor: number | null }> {
+  await ensureChatTables();
+  await assertThreadAccess(params.currentUser, params.threadId);
+
+  const pageSize = Math.max(1, Math.min(100, params.limit ?? 30));
+  const cursor = params.cursor;
+
+  const rows = await db.all(sql`
+    SELECT
+      id,
+      thread_id as threadId,
+      sender_user_id as senderUserId,
+      body,
+      kind,
+      attachments_json as attachmentsJson,
+      client_message_id as clientMessageId,
+      created_at as createdAt,
+      edited_at as editedAt,
+      deleted_at as deletedAt
+    FROM chat_messages
+    WHERE thread_id = ${params.threadId}
+      AND deleted_at IS NULL
+      ${cursor ? sql`AND created_at < ${cursor}` : sql``}
+    ORDER BY created_at DESC
+    LIMIT ${pageSize + 1}
+  `);
+
+  const data = rows as MessageRow[];
+  const hasNextPage = data.length > pageSize;
+  const pageRows = hasNextPage ? data.slice(0, pageSize) : data;
+  const messages = pageRows.map(mapMessageRow).reverse();
+
+  const nextCursor =
+    hasNextPage && pageRows.length > 0
+      ? Number(pageRows[pageRows.length - 1].createdAt)
+      : null;
+
+  return { messages, nextCursor };
+}
+
+export async function createThreadMessage(params: {
+  currentUser: ChatUserContext;
+  threadId: string;
+  body: string;
+  clientMessageId?: string;
+  attachments?: Array<{ url: string; type: string; name?: string }>;
+}): Promise<ChatMessageRecord> {
+  await ensureChatTables();
+  await assertThreadAccess(params.currentUser, params.threadId);
+
+  const body = params.body.trim();
+  if (!body) {
+    throw new ChatError("Message body is required", 400);
+  }
+
+  if (body.length > 2000) {
+    throw new ChatError("Message is too long", 400);
+  }
+
+  if (params.clientMessageId) {
+    const existingRows = await db.all(sql`
+      SELECT
+        id,
+        thread_id as threadId,
+        sender_user_id as senderUserId,
+        body,
+        kind,
+        attachments_json as attachmentsJson,
+        client_message_id as clientMessageId,
+        created_at as createdAt,
+        edited_at as editedAt,
+        deleted_at as deletedAt
+      FROM chat_messages
+      WHERE sender_user_id = ${params.currentUser.id}
+        AND client_message_id = ${params.clientMessageId}
+      LIMIT 1
+    `);
+
+    if (existingRows?.[0]) {
+      return mapMessageRow(existingRows[0] as MessageRow);
+    }
+  }
+
+  const messageId = generateId("msg");
+  const now = nowEpochSeconds();
+
+  await db.run(sql`
+    INSERT INTO chat_messages (
+      id,
+      thread_id,
+      sender_user_id,
+      body,
+      kind,
+      attachments_json,
+      client_message_id,
+      created_at
+    ) VALUES (
+      ${messageId},
+      ${params.threadId},
+      ${params.currentUser.id},
+      ${body},
+      ${"text"},
+      ${params.attachments?.length ? JSON.stringify(params.attachments) : null},
+      ${params.clientMessageId ?? null},
+      ${now}
+    )
+  `);
+
+  await db.run(sql`
+    UPDATE chat_threads
+    SET
+      last_message_at = ${now},
+      updated_at = ${now}
+    WHERE id = ${params.threadId}
+  `);
+
+  const messageRows = await db.all(sql`
+    SELECT
+      id,
+      thread_id as threadId,
+      sender_user_id as senderUserId,
+      body,
+      kind,
+      attachments_json as attachmentsJson,
+      client_message_id as clientMessageId,
+      created_at as createdAt,
+      edited_at as editedAt,
+      deleted_at as deletedAt
+    FROM chat_messages
+    WHERE id = ${messageId}
+    LIMIT 1
+  `);
+
+  const message = messageRows?.[0] as MessageRow | undefined;
+  if (!message) {
+    throw new ChatError("Failed to send message", 500);
+  }
+
+  return mapMessageRow(message);
+}
+
+export async function markThreadAsRead(params: {
+  currentUser: ChatUserContext;
+  threadId: string;
+  lastReadMessageId?: string;
+}): Promise<void> {
+  await ensureChatTables();
+  await assertThreadAccess(params.currentUser, params.threadId);
+
+  let targetMessageId = params.lastReadMessageId ?? null;
+
+  if (!targetMessageId) {
+    const latestRows = await db.all(sql`
+      SELECT id
+      FROM chat_messages
+      WHERE thread_id = ${params.threadId}
+        AND deleted_at IS NULL
+      ORDER BY created_at DESC
+      LIMIT 1
+    `);
+    const latest = latestRows?.[0] as { id?: string } | undefined;
+    targetMessageId = latest?.id ?? null;
+  }
+
+  const now = nowEpochSeconds();
+  await db.run(sql`
+    UPDATE chat_thread_members
+    SET
+      last_read_message_id = ${targetMessageId},
+      last_read_at = ${now}
+    WHERE thread_id = ${params.threadId}
+      AND user_id = ${params.currentUser.id}
+  `);
+}
+
+export function isChatError(error: unknown): error is ChatError {
+  return error instanceof ChatError;
+}
+
+async function assertThreadAccess(
+  currentUser: ChatUserContext,
+  threadId: string,
+): Promise<ThreadRow> {
+  const rows = await db.all(sql`
+    SELECT
+      id,
+      type,
+      gym_id as gymId,
+      trainer_id as trainerId,
+      client_id as clientId
+    FROM chat_threads
+    WHERE id = ${threadId}
+      AND archived_at IS NULL
+    LIMIT 1
+  `);
+  const thread = rows?.[0] as ThreadRow | undefined;
+
+  if (!thread) {
+    throw new ChatError("Thread not found", 404);
+  }
+
+  if (currentUser.role === "superAdmin") {
+    return thread;
+  }
+
+  if (thread.type === "gym") {
+    if (!currentUser.gymId || currentUser.gymId !== thread.gymId) {
+      throw new ChatError("Forbidden", 403);
+    }
+
+    await ensureThreadMember(thread.id, currentUser.id, currentUser.role);
+    return thread;
+  }
+
+  const isParticipant =
+    thread.trainerId === currentUser.id || thread.clientId === currentUser.id;
+
+  if (!isParticipant) {
+    throw new ChatError("Forbidden", 403);
+  }
+
+  if (thread.trainerId && thread.clientId) {
+    const assignmentRows = await db.all(sql`
+      SELECT id
+      FROM trainer_client_assignments
+      WHERE trainer_id = ${thread.trainerId}
+        AND client_id = ${thread.clientId}
+        AND is_active = 1
+      LIMIT 1
+    `);
+
+    if (!assignmentRows?.[0]) {
+      throw new ChatError("Trainer-client assignment is not active", 403);
+    }
+  }
+
+  await ensureThreadMember(thread.id, currentUser.id, currentUser.role);
+  return thread;
+}
+
+async function getThreadSummaryForUser(
+  userId: string,
+  threadId: string,
+): Promise<ChatThreadSummary> {
+  const rows = await db.all(sql`
+    SELECT
+      t.id,
+      t.type,
+      t.gym_id as gymId,
+      t.trainer_id as trainerId,
+      t.client_id as clientId,
+      t.created_by as createdBy,
+      t.last_message_at as lastMessageAt,
+      t.created_at as createdAt,
+      t.updated_at as updatedAt,
+      t.archived_at as archivedAt,
+      (
+        SELECT m.body
+        FROM chat_messages m
+        WHERE m.thread_id = t.id
+          AND m.deleted_at IS NULL
+        ORDER BY m.created_at DESC
+        LIMIT 1
+      ) as lastMessageBody,
+      (
+        SELECT COUNT(*)
+        FROM chat_messages m
+        WHERE m.thread_id = t.id
+          AND m.deleted_at IS NULL
+          AND m.sender_user_id != ${userId}
+          AND m.created_at > COALESCE(mem.last_read_at, 0)
+      ) as unreadCount
+    FROM chat_threads t
+    JOIN chat_thread_members mem
+      ON mem.thread_id = t.id
+      AND mem.user_id = ${userId}
+      AND mem.left_at IS NULL
+    WHERE t.id = ${threadId}
+    LIMIT 1
+  `);
+
+  const row = rows?.[0] as ThreadSummaryRow | undefined;
+  if (!row) {
+    throw new ChatError("Thread not found", 404);
+  }
+
+  return mapThreadSummaryRow(row);
+}
+
+async function ensureThreadMember(
+  threadId: string,
+  userId: string,
+  role: UserRole,
+): Promise<void> {
+  const now = nowEpochSeconds();
+  await db.run(sql`
+    INSERT OR IGNORE INTO chat_thread_members (
+      id,
+      thread_id,
+      user_id,
+      role_in_thread,
+      joined_at,
+      muted
+    ) VALUES (
+      ${generateId("member")},
+      ${threadId},
+      ${userId},
+      ${role},
+      ${now},
+      ${0}
+    )
+  `);
+
+  await db.run(sql`
+    UPDATE chat_thread_members
+    SET left_at = NULL
+    WHERE thread_id = ${threadId}
+      AND user_id = ${userId}
+  `);
+}
+
+function mapThreadSummaryRow(row: ThreadSummaryRow): ChatThreadSummary {
+  return {
+    id: row.id,
+    type: row.type,
+    gymId: row.gymId ?? null,
+    trainerId: row.trainerId ?? null,
+    clientId: row.clientId ?? null,
+    createdBy: row.createdBy,
+    lastMessageAt: toDate(row.lastMessageAt),
+    createdAt: toDate(row.createdAt) ?? new Date(),
+    updatedAt: toDate(row.updatedAt) ?? new Date(),
+    archivedAt: toDate(row.archivedAt),
+    unreadCount: Number(row.unreadCount ?? 0),
+    lastMessageBody: row.lastMessageBody ?? null,
+  };
+}
+
+function mapMessageRow(row: MessageRow): ChatMessageRecord {
+  return {
+    id: row.id,
+    threadId: row.threadId,
+    senderUserId: row.senderUserId,
+    body: row.body,
+    kind: row.kind,
+    attachments: parseAttachments(row.attachmentsJson),
+    clientMessageId: row.clientMessageId ?? null,
+    createdAt: toDate(row.createdAt) ?? new Date(),
+    editedAt: toDate(row.editedAt),
+    deletedAt: toDate(row.deletedAt),
+  };
+}
+
+function parseAttachments(
+  value: string | null,
+): Array<{ url: string; type: string; name?: string }> {
+  if (!value) {
+    return [];
+  }
+
+  try {
+    const parsed = JSON.parse(value);
+    if (!Array.isArray(parsed)) {
+      return [];
+    }
+
+    return parsed.filter(
+      (item): item is { url: string; type: string; name?: string } =>
+        item &&
+        typeof item === "object" &&
+        typeof item.url === "string" &&
+        typeof item.type === "string",
+    );
+  } catch (error) {
+    log.warn("Failed to parse chat attachments JSON", { value, error });
+    return [];
+  }
+}
+
+function toDate(value: number | string | null | undefined): Date | null {
+  if (value === null || value === undefined) {
+    return null;
+  }
+
+  const numberValue = Number(value);
+  if (!Number.isFinite(numberValue)) {
+    return null;
+  }
+
+  return new Date(numberValue * 1000);
+}
+
+function generateId(prefix: string): string {
+  return `${prefix}_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+}
+
+function nowEpochSeconds(): number {
+  return Math.floor(Date.now() / 1000);
+}
+
+interface ThreadRow {
+  id: string;
+  type: "gym" | "dm";
+  gymId: string | null;
+  trainerId: string | null;
+  clientId: string | null;
+}
+
+interface ThreadSummaryRow {
+  id: string;
+  type: "gym" | "dm";
+  gymId: string | null;
+  trainerId: string | null;
+  clientId: string | null;
+  createdBy: string;
+  lastMessageAt: number | null;
+  createdAt: number;
+  updatedAt: number;
+  archivedAt: number | null;
+  unreadCount: number;
+  lastMessageBody: string | null;
+}
+
+interface MessageRow {
+  id: string;
+  threadId: string;
+  senderUserId: string;
+  body: string;
+  kind: "text" | "system";
+  attachmentsJson: string | null;
+  clientMessageId: string | null;
+  createdAt: number;
+  editedAt: number | null;
+  deletedAt: number | null;
+}

apps/mobile/.env.example

@@ -34,6 +34,11 @@ EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_your_publishable_key_here
 #
 EXPO_PUBLIC_API_URL=http://localhost:3000
 
+# Optional realtime override (defaults to EXPO_PUBLIC_API_URL host)
+# Set this when your Socket.IO service runs on a different origin/port.
+EXPO_PUBLIC_REALTIME_URL=http://localhost:3001
+EXPO_PUBLIC_REALTIME_PATH=/socket.io
+
 # =============================================================================
 # App Configuration (Optional)
 # =============================================================================

apps/mobile/package-lock.json

@@ -46,6 +46,7 @@
         "react-native-screens": "~4.16.0",
         "react-native-svg": "^15.15.3",
         "react-native-web": "^0.21.2",
+        "socket.io-client": "^4.8.1",
         "zod": "^3.22.0"
       },
       "devDependencies": {
@@ -4602,6 +4603,12 @@
         "@sinonjs/commons": "^3.0.0"
       }
     },
+    "node_modules/@socket.io/component-emitter": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@socket.io/component-emitter/-/component-emitter-3.1.2.tgz",
+      "integrity": "sha512-9BCxFwvbGg/RsZK9tjXd8s4UcwR0MWeFQ1XEKIQVVvAGJyINdrqKMcTRyLoK8Rse1GjzLV9cwjWV1olXRWEXVA==",
+      "license": "MIT"
+    },
     "node_modules/@stripe/stripe-js": {
       "version": "5.6.0",
       "resolved": "https://registry.npmjs.org/@stripe/stripe-js/-/stripe-js-5.6.0.tgz",
@@ -6806,6 +6813,49 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/engine.io-client": {
+      "version": "6.6.4",
+      "resolved": "https://registry.npmjs.org/engine.io-client/-/engine.io-client-6.6.4.tgz",
+      "integrity": "sha512-+kjUJnZGwzewFDw951CDWcwj35vMNf2fcj7xQWOctq1F2i1jkDdVvdFG9kM/BEChymCH36KgjnW0NsL58JYRxw==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1",
+        "engine.io-parser": "~5.2.1",
+        "ws": "~8.18.3",
+        "xmlhttprequest-ssl": "~2.1.1"
+      }
+    },
+    "node_modules/engine.io-client/node_modules/ws": {
+      "version": "8.18.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.18.3.tgz",
+      "integrity": "sha512-PEIGCY5tSlUt50cqyMXfCzX+oOPqN0vuGqWzbcJ2xvnkzkq46oOpz7dQaTDBdfICb4N14+GARUDw2XV2N4tvzg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/engine.io-parser": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/engine.io-parser/-/engine.io-parser-5.2.3.tgz",
+      "integrity": "sha512-HqD3yTBfnBxIrbnM1DoD6Pcq8NECnh8d4As1Qgh0z5Gg3jRRIqijury0CL3ghu/edArpUYiYqQiDUQBIs4np3Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/entities": {
       "version": "4.5.0",
       "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
@@ -12740,6 +12790,34 @@
         "node": ">=8.0.0"
       }
     },
+    "node_modules/socket.io-client": {
+      "version": "4.8.3",
+      "resolved": "https://registry.npmjs.org/socket.io-client/-/socket.io-client-4.8.3.tgz",
+      "integrity": "sha512-uP0bpjWrjQmUt5DTHq9RuoCBdFJF10cdX9X+a368j/Ft0wmaVgxlrjvK3kjvgCODOMMOz9lcaRzxmso0bTWZ/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1",
+        "engine.io-client": "~6.6.1",
+        "socket.io-parser": "~4.2.4"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/socket.io-parser": {
+      "version": "4.2.6",
+      "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.6.tgz",
+      "integrity": "sha512-asJqbVBDsBCJx0pTqw3WfesSY0iRX+2xzWEWzrpcH7L6fLzrhyF8WPI8UaeM4YCuDfpwA/cgsdugMsmtz8EJeg==",
+      "license": "MIT",
+      "dependencies": {
+        "@socket.io/component-emitter": "~3.1.0",
+        "debug": "~4.4.1"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
     "node_modules/source-map": {
       "version": "0.5.7",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
@@ -14037,6 +14115,14 @@
         "node": ">=8.0"
       }
     },
+    "node_modules/xmlhttprequest-ssl": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-2.1.2.tgz",
+      "integrity": "sha512-TEU+nJVUUnA4CYJFLvK5X9AOeH4KvDvhIfm0vV1GaQRtchnG0hgK5p8hw/xjv8cunWYCsiPCSDzObPyhEwq3KQ==",
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
     "node_modules/y18n": {
       "version": "5.0.8",
       "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",

apps/mobile/package.json

@@ -52,6 +52,7 @@
     "react-native-screens": "~4.16.0",
     "react-native-svg": "^15.15.3",
     "react-native-web": "^0.21.2",
+    "socket.io-client": "^4.8.1",
     "zod": "^3.22.0"
   },
   "devDependencies": {

apps/mobile/src/api/chat.ts

@@ -0,0 +1,118 @@
+import { io, type Socket } from "socket.io-client";
+import { API_BASE_URL, API_ENDPOINTS } from "../config/api";
+import { apiClient, withAuth } from "./client";
+
+export interface ChatThread {
+  id: string;
+  type: "gym" | "dm";
+  gymId: string | null;
+  trainerId: string | null;
+  clientId: string | null;
+  createdBy: string;
+  lastMessageAt: string | null;
+  createdAt: string;
+  updatedAt: string;
+  archivedAt: string | null;
+  unreadCount: number;
+  lastMessageBody: string | null;
+}
+
+export interface ChatMessage {
+  id: string;
+  threadId: string;
+  senderUserId: string;
+  body: string;
+  kind: "text" | "system";
+  attachments: Array<{ url: string; type: string; name?: string }>;
+  clientMessageId: string | null;
+  createdAt: string;
+  editedAt: string | null;
+  deletedAt: string | null;
+}
+
+export interface ThreadMessagesResponse {
+  messages: ChatMessage[];
+  nextCursor: number | null;
+}
+
+export const chatApi = {
+  getThreads: async (token: string): Promise<ChatThread[]> => {
+    const response = await apiClient.get<{ threads: ChatThread[] }>(
+      API_ENDPOINTS.CHAT.THREADS,
+      withAuth(token),
+    );
+    return response.data.threads;
+  },
+
+  getGymRoomThread: async (token: string): Promise<ChatThread> => {
+    const response = await apiClient.get<{ thread: ChatThread }>(
+      API_ENDPOINTS.CHAT.GYM_ROOM,
+      withAuth(token),
+    );
+    return response.data.thread;
+  },
+
+  getMyDmThread: async (token: string): Promise<ChatThread> => {
+    const response = await apiClient.get<{ thread: ChatThread }>(
+      API_ENDPOINTS.CHAT.MY_DM_THREAD,
+      withAuth(token),
+    );
+    return response.data.thread;
+  },
+
+  getThreadMessages: async (
+    threadId: string,
+    token: string,
+    cursor?: number,
+  ): Promise<ThreadMessagesResponse> => {
+    const endpoint =
+      cursor === undefined
+        ? API_ENDPOINTS.CHAT.THREAD_MESSAGES(threadId)
+        : `${API_ENDPOINTS.CHAT.THREAD_MESSAGES(threadId)}?cursor=${cursor}`;
+
+    const response = await apiClient.get<ThreadMessagesResponse>(
+      endpoint,
+      withAuth(token),
+    );
+    return response.data;
+  },
+
+  sendMessage: async (
+    threadId: string,
+    body: string,
+    token: string,
+    clientMessageId?: string,
+  ): Promise<ChatMessage> => {
+    const response = await apiClient.post<{ message: ChatMessage }>(
+      API_ENDPOINTS.CHAT.THREAD_MESSAGES(threadId),
+      { body, clientMessageId },
+      withAuth(token),
+    );
+    return response.data.message;
+  },
+
+  markThreadRead: async (
+    threadId: string,
+    token: string,
+    lastReadMessageId?: string,
+  ): Promise<void> => {
+    await apiClient.post(
+      API_ENDPOINTS.CHAT.THREAD_READ(threadId),
+      { lastReadMessageId },
+      withAuth(token),
+    );
+  },
+};
+
+export function createChatSocket(token: string): Socket {
+  const baseUrl = new URL(API_BASE_URL);
+  const realtimeBase =
+    process.env.EXPO_PUBLIC_REALTIME_URL ??
+    `${baseUrl.protocol}//${baseUrl.host}`;
+
+  return io(realtimeBase, {
+    path: process.env.EXPO_PUBLIC_REALTIME_PATH ?? "/socket.io",
+    transports: ["websocket"],
+    auth: { token },
+  });
+}

apps/mobile/src/api/index.ts

@@ -17,3 +17,4 @@ export * from "./helpers";
 export * from "./membership";
 export * from "./food";
 export * from "./gyms";
+export * from "./chat";

apps/mobile/src/app/(tabs)/_layout.tsx

@@ -83,6 +83,12 @@ export default function TabLayout() {
           title: "Plans",
         }}
       />
+      <Tabs.Screen
+        name="chat"
+        options={{
+          title: "Chat",
+        }}
+      />
       <Tabs.Screen
         name="profile"
         options={{

apps/mobile/src/app/(tabs)/chat.tsx

@@ -0,0 +1,385 @@
+import React, { useEffect, useMemo, useRef, useState } from "react";
+import {
+  ActivityIndicator,
+  FlatList,
+  RefreshControl,
+  Pressable,
+  StyleSheet,
+  Text,
+  TextInput,
+  View,
+} from "react-native";
+import { useAuth } from "@clerk/clerk-expo";
+import { useChat } from "../../contexts/ChatContext";
+import { useTheme } from "../../contexts/ThemeContext";
+
+export default function ChatScreen() {
+  const { userId } = useAuth();
+  const { colors } = useTheme();
+  const {
+    threads,
+    activeThreadId,
+    messagesByThreadId,
+    readByThreadId,
+    loadingThreads,
+    loadingMessages,
+    socketConnected,
+    totalUnreadCount,
+    typingByThreadId,
+    setActiveThread,
+    refreshMessages,
+    refreshThreads,
+    sendMessage,
+    setTyping,
+    loadOlderMessages,
+    hasMoreMessages,
+    isLoadingOlderMessages,
+  } = useChat();
+
+  const [draft, setDraft] = useState("");
+  const typingTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const activeMessages = useMemo(
+    () => (activeThreadId ? (messagesByThreadId[activeThreadId] ?? []) : []),
+    [activeThreadId, messagesByThreadId],
+  );
+  const typingUsers = useMemo(
+    () => (activeThreadId ? (typingByThreadId[activeThreadId] ?? []) : []),
+    [activeThreadId, typingByThreadId],
+  );
+
+  const handleSend = async () => {
+    if (!activeThreadId) {
+      return;
+    }
+
+    const body = draft.trim();
+    if (!body) {
+      return;
+    }
+
+    setDraft("");
+    try {
+      await sendMessage(activeThreadId, body);
+      setTyping(activeThreadId, false);
+    } catch {
+      setDraft(body);
+    }
+  };
+
+  const handleDraftChange = (value: string) => {
+    setDraft(value);
+
+    if (!activeThreadId) {
+      return;
+    }
+
+    const isTyping = value.trim().length > 0;
+    setTyping(activeThreadId, isTyping);
+
+    if (typingTimeoutRef.current) {
+      clearTimeout(typingTimeoutRef.current);
+    }
+
+    typingTimeoutRef.current = setTimeout(() => {
+      if (activeThreadId) {
+        setTyping(activeThreadId, false);
+      }
+    }, 1200);
+  };
+
+  const handleLoadOlder = () => {
+    if (!activeThreadId) {
+      return;
+    }
+
+    void loadOlderMessages(activeThreadId);
+  };
+
+  useEffect(() => {
+    return () => {
+      if (typingTimeoutRef.current) {
+        clearTimeout(typingTimeoutRef.current);
+      }
+
+      if (activeThreadId) {
+        setTyping(activeThreadId, false);
+      }
+    };
+  }, [activeThreadId, setTyping]);
+
+  return (
+    <View style={[styles.container, { backgroundColor: colors.background }]}>
+      <View style={[styles.connection, { borderColor: colors.border }]}>
+        <Text style={{ color: colors.textSecondary }}>
+          {socketConnected ? "Realtime connected" : "Realtime disconnected"}
+        </Text>
+        <Text style={{ color: colors.textTertiary, marginTop: 2 }}>
+          {totalUnreadCount} unread total
+        </Text>
+      </View>
+
+      <View style={styles.layout}>
+        <View style={[styles.sidebar, { borderColor: colors.border }]}>
+          {loadingThreads ? (
+            <ActivityIndicator />
+          ) : (
+            <FlatList
+              data={threads}
+              keyExtractor={(item) => item.id}
+              renderItem={({ item }) => {
+                const selected = item.id === activeThreadId;
+                return (
+                  <Pressable
+                    onPress={() => setActiveThread(item.id)}
+                    style={[
+                      styles.threadItem,
+                      {
+                        backgroundColor: selected
+                          ? colors.surface
+                          : "transparent",
+                        borderColor: colors.border,
+                      },
+                    ]}
+                  >
+                    <Text
+                      style={{ color: colors.textPrimary, fontWeight: "600" }}
+                    >
+                      {item.type === "gym" ? "Gym Room" : "Trainer Chat"}
+                    </Text>
+                    <Text
+                      numberOfLines={1}
+                      style={{ color: colors.textSecondary, marginTop: 2 }}
+                    >
+                      {item.lastMessageBody ?? "No messages yet"}
+                    </Text>
+                    {item.unreadCount > 0 && (
+                      <Text style={{ color: colors.primary, marginTop: 4 }}>
+                        {item.unreadCount} unread
+                      </Text>
+                    )}
+                  </Pressable>
+                );
+              }}
+            />
+          )}
+        </View>
+
+        <View style={[styles.chatPane, { borderColor: colors.border }]}>
+          {!activeThreadId ? (
+            <View style={styles.emptyState}>
+              <Text style={{ color: colors.textSecondary }}>
+                Select a thread to start chatting
+              </Text>
+            </View>
+          ) : (
+            <>
+              {loadingMessages ? (
+                <ActivityIndicator style={{ marginTop: 16 }} />
+              ) : (
+                <FlatList
+                  data={activeMessages}
+                  keyExtractor={(item) => item.id}
+                  contentContainerStyle={styles.messagesList}
+                  refreshControl={
+                    <RefreshControl
+                      refreshing={loadingMessages}
+                      onRefresh={() =>
+                        activeThreadId
+                          ? void refreshMessages(activeThreadId)
+                          : void refreshThreads()
+                      }
+                      tintColor={colors.primary}
+                    />
+                  }
+                  ListHeaderComponent={
+                    activeThreadId && hasMoreMessages(activeThreadId) ? (
+                      <Pressable
+                        onPress={handleLoadOlder}
+                        style={[
+                          styles.loadOlder,
+                          {
+                            borderColor: colors.border,
+                            backgroundColor: colors.surface,
+                          },
+                        ]}
+                        disabled={isLoadingOlderMessages(activeThreadId)}
+                      >
+                        {isLoadingOlderMessages(activeThreadId) ? (
+                          <ActivityIndicator size="small" />
+                        ) : (
+                          <Text style={{ color: colors.textSecondary }}>
+                            Load older messages
+                          </Text>
+                        )}
+                      </Pressable>
+                    ) : null
+                  }
+                  renderItem={({ item }) => {
+                    const own = item.senderUserId === userId;
+                    const threadReads = activeThreadId
+                      ? (readByThreadId[activeThreadId] ?? {})
+                      : {};
+                    const readers = Object.entries(threadReads)
+                      .filter(
+                        ([readerUserId, messageId]) =>
+                          readerUserId !== userId && messageId === item.id,
+                      )
+                      .map(([readerUserId]) => readerUserId);
+
+                    return (
+                      <View
+                        style={[
+                          styles.messageBubble,
+                          {
+                            alignSelf: own ? "flex-end" : "flex-start",
+                            backgroundColor: own
+                              ? colors.primary
+                              : colors.surface,
+                            borderColor: colors.border,
+                          },
+                        ]}
+                      >
+                        <Text
+                          style={{ color: own ? "white" : colors.textPrimary }}
+                        >
+                          {item.body}
+                        </Text>
+                        {own && readers.length > 0 && (
+                          <Text
+                            style={{
+                              color: own
+                                ? "rgba(255,255,255,0.85)"
+                                : colors.textSecondary,
+                              marginTop: 4,
+                              fontSize: 10,
+                            }}
+                          >
+                            Seen
+                          </Text>
+                        )}
+                      </View>
+                    );
+                  }}
+                />
+              )}
+
+              {typingUsers.length > 0 && (
+                <View style={styles.typingRow}>
+                  <Text style={{ color: colors.textSecondary, fontSize: 12 }}>
+                    {typingUsers.length === 1
+                      ? "Someone is typing..."
+                      : `${typingUsers.length} people are typing...`}
+                  </Text>
+                </View>
+              )}
+
+              <View style={[styles.composer, { borderColor: colors.border }]}>
+                <TextInput
+                  value={draft}
+                  onChangeText={handleDraftChange}
+                  placeholder="Type a message"
+                  placeholderTextColor={colors.textTertiary}
+                  style={[
+                    styles.input,
+                    {
+                      color: colors.textPrimary,
+                      borderColor: colors.border,
+                    },
+                  ]}
+                />
+                <Pressable
+                  onPress={handleSend}
+                  style={[
+                    styles.sendButton,
+                    { backgroundColor: colors.primary },
+                  ]}
+                >
+                  <Text style={{ color: "white", fontWeight: "700" }}>
+                    Send
+                  </Text>
+                </Pressable>
+              </View>
+            </>
+          )}
+        </View>
+      </View>
+    </View>
+  );
+}
+
+const styles = StyleSheet.create({
+  container: {
+    flex: 1,
+  },
+  connection: {
+    borderBottomWidth: 1,
+    paddingHorizontal: 16,
+    paddingVertical: 8,
+  },
+  layout: {
+    flex: 1,
+    flexDirection: "row",
+  },
+  sidebar: {
+    width: 160,
+    borderRightWidth: 1,
+    padding: 8,
+  },
+  threadItem: {
+    borderWidth: 1,
+    borderRadius: 12,
+    padding: 10,
+    marginBottom: 8,
+  },
+  chatPane: {
+    flex: 1,
+    borderLeftWidth: 0,
+  },
+  emptyState: {
+    flex: 1,
+    alignItems: "center",
+    justifyContent: "center",
+  },
+  messagesList: {
+    padding: 12,
+    gap: 8,
+  },
+  loadOlder: {
+    borderWidth: 1,
+    borderRadius: 10,
+    paddingHorizontal: 10,
+    paddingVertical: 8,
+    alignSelf: "center",
+    marginBottom: 10,
+  },
+  messageBubble: {
+    borderRadius: 12,
+    borderWidth: 1,
+    paddingHorizontal: 10,
+    paddingVertical: 8,
+    maxWidth: "80%",
+  },
+  composer: {
+    borderTopWidth: 1,
+    padding: 10,
+    flexDirection: "row",
+    gap: 8,
+    alignItems: "center",
+  },
+  typingRow: {
+    paddingHorizontal: 14,
+    paddingBottom: 6,
+  },
+  input: {
+    flex: 1,
+    borderWidth: 1,
+    borderRadius: 10,
+    paddingHorizontal: 10,
+    paddingVertical: 8,
+  },
+  sendButton: {
+    borderRadius: 10,
+    paddingHorizontal: 14,
+    paddingVertical: 10,
+  },
+});

apps/mobile/src/app/_layout.tsx

@@ -12,6 +12,7 @@ import { FitnessGoalsProvider } from "../contexts/FitnessGoalsContext";
 import { RecommendationsProvider } from "../contexts/RecommendationsContext";
 import { NotificationsProvider } from "../contexts/NotificationsContext";
 import { MembershipProvider } from "../contexts/MembershipContext";
+import { ChatProvider } from "../contexts/ChatContext";
 import { queryClient } from "../lib/query-client";
 import { useAutoWorkoutGeofence } from "../hooks/useAutoWorkoutGeofence";
 import log from "../utils/logger";
@@ -184,11 +185,13 @@ export default function RootLayout() {
               <NotificationsProvider>
                 <StatisticsProvider>
                   <MembershipProvider>
-                    <FitnessGoalsProvider>
+                    <ChatProvider>
-                      <RecommendationsProvider>
+                      <FitnessGoalsProvider>
-                        <AppContent />
+                        <RecommendationsProvider>
-                      </RecommendationsProvider>
+                          <AppContent />
-                    </FitnessGoalsProvider>
+                        </RecommendationsProvider>
+                      </FitnessGoalsProvider>
+                    </ChatProvider>
                   </MembershipProvider>
                 </StatisticsProvider>
               </NotificationsProvider>

apps/mobile/src/components/CustomTabBar.tsx

@@ -4,6 +4,7 @@ import { BottomTabBarProps } from "@react-navigation/bottom-tabs";
 import { Ionicons } from "@expo/vector-icons";
 import { useSafeAreaInsets } from "react-native-safe-area-context";
 import { useTheme } from "../contexts/ThemeContext";
+import { useChat } from "../contexts/ChatContext";
 
 export function CustomTabBar({
   state,
@@ -12,6 +13,7 @@ export function CustomTabBar({
 }: BottomTabBarProps) {
   const { colors } = useTheme();
   const insets = useSafeAreaInsets();
+  const { totalUnreadCount } = useChat();
 
   return (
     <View
@@ -53,6 +55,8 @@ export function CustomTabBar({
               return focused ? "sparkles" : "sparkles-outline";
             case "profile":
               return focused ? "person" : "person-outline";
+            case "chat":
+              return focused ? "chatbubbles" : "chatbubbles-outline";
             default:
               return "ellipse-outline";
           }
@@ -68,6 +72,8 @@ export function CustomTabBar({
               return "Plans";
             case "profile":
               return "Profile";
+            case "chat":
+              return "Chat";
             default:
               return "";
           }
@@ -90,6 +96,15 @@ export function CustomTabBar({
                 size={26}
                 color={isFocused ? colors.primary : colors.textTertiary}
               />
+              {route.name === "chat" && totalUnreadCount > 0 && (
+                <View
+                  style={[styles.badge, { backgroundColor: colors.danger }]}
+                >
+                  <Text style={styles.badgeText}>
+                    {totalUnreadCount > 99 ? "99+" : totalUnreadCount}
+                  </Text>
+                </View>
+              )}
               {isFocused && (
                 <View
                   style={[
@@ -144,4 +159,20 @@ const styles = StyleSheet.create({
     fontSize: 11,
     marginTop: 4,
   },
+  badge: {
+    position: "absolute",
+    top: -6,
+    right: -12,
+    minWidth: 16,
+    height: 16,
+    borderRadius: 8,
+    alignItems: "center",
+    justifyContent: "center",
+    paddingHorizontal: 4,
+  },
+  badgeText: {
+    color: "white",
+    fontSize: 10,
+    fontWeight: "700",
+  },
 });

apps/mobile/src/config/api.ts

@@ -63,6 +63,16 @@ export const API_ENDPOINTS = {
     GET_RANGE: (startDate: string, endDate: string) =>
       `/api/hydration?startDate=${startDate}&endDate=${endDate}`,
   },
+  CHAT: {
+    THREADS: "/api/chat/threads",
+    GYM_ROOM: "/api/chat/gym-room",
+    START_DM: "/api/chat/dm/start",
+    MY_DM_THREAD: "/api/chat/dm/my-thread",
+    THREAD: (threadId: string) => `/api/chat/threads/${threadId}`,
+    THREAD_MESSAGES: (threadId: string) =>
+      `/api/chat/threads/${threadId}/messages`,
+    THREAD_READ: (threadId: string) => `/api/chat/threads/${threadId}/read`,
+  },
   FITNESS_GOALS: {
     LIST: "/api/fitness-goals",
     CREATE: "/api/fitness-goals",

apps/mobile/src/contexts/ChatContext.tsx

@@ -0,0 +1,723 @@
+import React, {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+} from "react";
+import { useAuth, useUser } from "@clerk/clerk-expo";
+import type { Socket } from "socket.io-client";
+import {
+  chatApi,
+  createChatSocket,
+  type ChatMessage,
+  type ChatThread,
+} from "../api/chat";
+import log from "../utils/logger";
+
+interface ChatContextValue {
+  threads: ChatThread[];
+  totalUnreadCount: number;
+  activeThreadId: string | null;
+  messagesByThreadId: Record<string, ChatMessage[]>;
+  readByThreadId: Record<string, Record<string, string>>;
+  loadingThreads: boolean;
+  loadingMessages: boolean;
+  socketConnected: boolean;
+  typingByThreadId: Record<string, string[]>;
+  setActiveThread: (threadId: string | null) => void;
+  refreshThreads: () => Promise<void>;
+  refreshMessages: (threadId: string) => Promise<void>;
+  loadOlderMessages: (threadId: string) => Promise<void>;
+  hasMoreMessages: (threadId: string) => boolean;
+  isLoadingOlderMessages: (threadId: string) => boolean;
+  sendMessage: (threadId: string, body: string) => Promise<void>;
+  setTyping: (threadId: string, isTyping: boolean) => void;
+  markThreadRead: (
+    threadId: string,
+    lastReadMessageId?: string,
+  ) => Promise<void>;
+}
+
+const ChatContext = createContext<ChatContextValue | undefined>(undefined);
+
+export function ChatProvider({ children }: { children: React.ReactNode }) {
+  const { isSignedIn, getToken } = useAuth();
+  const { user } = useUser();
+  const userRole =
+    typeof user?.publicMetadata?.role === "string"
+      ? user.publicMetadata.role
+      : undefined;
+  const isClientUser = userRole === "client";
+
+  const [threads, setThreads] = useState<ChatThread[]>([]);
+  const [activeThreadId, setActiveThreadId] = useState<string | null>(null);
+  const [messagesByThreadId, setMessagesByThreadId] = useState<
+    Record<string, ChatMessage[]>
+  >({});
+  const [readByThreadId, setReadByThreadId] = useState<
+    Record<string, Record<string, string>>
+  >({});
+  const [loadingThreads, setLoadingThreads] = useState(false);
+  const [loadingMessages, setLoadingMessages] = useState(false);
+  const [socketConnected, setSocketConnected] = useState(false);
+  const [typingByThreadId, setTypingByThreadId] = useState<
+    Record<string, string[]>
+  >({});
+  const [nextCursorByThreadId, setNextCursorByThreadId] = useState<
+    Record<string, number | null | undefined>
+  >({});
+  const [loadingOlderByThreadId, setLoadingOlderByThreadId] = useState<
+    Record<string, boolean>
+  >({});
+
+  const socketRef = useRef<Socket | null>(null);
+  const lastMarkedReadByThreadRef = useRef<Record<string, string>>({});
+  const activeThreadIdRef = useRef<string | null>(null);
+  const currentUserIdRef = useRef<string | undefined>(undefined);
+  const refreshThreadsRef = useRef<() => Promise<void>>(async () => {});
+  const markThreadReadRef = useRef<
+    (threadId: string, lastReadMessageId?: string) => Promise<void>
+  >(async () => {});
+
+  const clearAll = useCallback(() => {
+    setThreads([]);
+    setActiveThreadId(null);
+    setMessagesByThreadId({});
+    setReadByThreadId({});
+    setNextCursorByThreadId({});
+    setLoadingOlderByThreadId({});
+    setLoadingThreads(false);
+    setLoadingMessages(false);
+    setSocketConnected(false);
+    setTypingByThreadId({});
+    lastMarkedReadByThreadRef.current = {};
+
+    if (socketRef.current) {
+      socketRef.current.disconnect();
+      socketRef.current = null;
+    }
+  }, []);
+
+  const refreshThreads = useCallback(async () => {
+    if (!isSignedIn) {
+      return;
+    }
+
+    const token = await getToken();
+    if (!token) {
+      return;
+    }
+
+    try {
+      setLoadingThreads(true);
+      if (isClientUser) {
+        try {
+          await chatApi.getMyDmThread(token);
+        } catch {
+          // ignore bootstrap errors for now
+        }
+      }
+
+      const data = await chatApi.getThreads(token);
+      setThreads(data);
+
+      setActiveThreadId((prev) => {
+        if (prev && data.some((thread) => thread.id === prev)) {
+          return prev;
+        }
+
+        return data.length > 0 ? data[0].id : null;
+      });
+    } catch (error) {
+      log.warn("Failed to refresh chat threads", { error });
+    } finally {
+      setLoadingThreads(false);
+    }
+  }, [getToken, isSignedIn, isClientUser]);
+
+  const refreshMessages = useCallback(
+    async (threadId: string) => {
+      if (!isSignedIn) {
+        return;
+      }
+
+      const token = await getToken();
+      if (!token) {
+        return;
+      }
+
+      try {
+        setLoadingMessages(true);
+        const response = await chatApi.getThreadMessages(threadId, token);
+        setMessagesByThreadId((prev) => ({
+          ...prev,
+          [threadId]: response.messages,
+        }));
+        setNextCursorByThreadId((prev) => ({
+          ...prev,
+          [threadId]: response.nextCursor,
+        }));
+
+        setThreads((prev) =>
+          prev.map((thread) =>
+            thread.id === threadId ? { ...thread, unreadCount: 0 } : thread,
+          ),
+        );
+      } catch (error) {
+        log.warn("Failed to refresh chat messages", { threadId, error });
+      } finally {
+        setLoadingMessages(false);
+      }
+    },
+    [getToken, isSignedIn],
+  );
+
+  const loadOlderMessages = useCallback(
+    async (threadId: string) => {
+      if (!isSignedIn) {
+        return;
+      }
+
+      const nextCursor = nextCursorByThreadId[threadId];
+      if (nextCursor === null || nextCursor === undefined) {
+        return;
+      }
+
+      if (loadingOlderByThreadId[threadId]) {
+        return;
+      }
+
+      const token = await getToken();
+      if (!token) {
+        return;
+      }
+
+      try {
+        setLoadingOlderByThreadId((prev) => ({ ...prev, [threadId]: true }));
+
+        const response = await chatApi.getThreadMessages(
+          threadId,
+          token,
+          nextCursor,
+        );
+
+        setMessagesByThreadId((prev) => {
+          const existing = prev[threadId] ?? [];
+          const merged = [...response.messages, ...existing];
+          const dedupedById = new Map<string, ChatMessage>();
+          merged.forEach((message) => {
+            dedupedById.set(message.id, message);
+          });
+
+          return {
+            ...prev,
+            [threadId]: Array.from(dedupedById.values()).sort(
+              (a, b) =>
+                new Date(a.createdAt).getTime() -
+                new Date(b.createdAt).getTime(),
+            ),
+          };
+        });
+
+        setNextCursorByThreadId((prev) => ({
+          ...prev,
+          [threadId]: response.nextCursor,
+        }));
+      } catch (error) {
+        log.warn("Failed to load older chat messages", { threadId, error });
+      } finally {
+        setLoadingOlderByThreadId((prev) => ({ ...prev, [threadId]: false }));
+      }
+    },
+    [getToken, isSignedIn, loadingOlderByThreadId, nextCursorByThreadId],
+  );
+
+  const markThreadRead = useCallback(
+    async (threadId: string, lastReadMessageId?: string) => {
+      if (!isSignedIn) {
+        return;
+      }
+
+      const token = await getToken();
+      if (!token) {
+        return;
+      }
+
+      try {
+        await chatApi.markThreadRead(threadId, token, lastReadMessageId);
+        if (socketRef.current?.connected) {
+          socketRef.current.emit("chat:read", {
+            threadId,
+            lastReadMessageId,
+          });
+        }
+
+        if (lastReadMessageId && user?.id) {
+          setReadByThreadId((prev) => ({
+            ...prev,
+            [threadId]: {
+              ...(prev[threadId] ?? {}),
+              [user.id]: lastReadMessageId,
+            },
+          }));
+        }
+      } catch (error) {
+        log.warn("Failed to mark thread read", { threadId, error });
+      }
+    },
+    [getToken, isSignedIn, user?.id],
+  );
+
+  useEffect(() => {
+    activeThreadIdRef.current = activeThreadId;
+  }, [activeThreadId]);
+
+  useEffect(() => {
+    currentUserIdRef.current = user?.id;
+  }, [user?.id]);
+
+  useEffect(() => {
+    refreshThreadsRef.current = refreshThreads;
+  }, [refreshThreads]);
+
+  useEffect(() => {
+    markThreadReadRef.current = markThreadRead;
+  }, [markThreadRead]);
+
+  const sendMessage = useCallback(
+    async (threadId: string, body: string) => {
+      const text = body.trim();
+      if (!text || !isSignedIn) {
+        return;
+      }
+
+      const token = await getToken();
+      if (!token) {
+        return;
+      }
+
+      const clientMessageId = `mobile_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+
+      const optimistic: ChatMessage = {
+        id: clientMessageId,
+        threadId,
+        senderUserId: user?.id ?? "",
+        body: text,
+        kind: "text",
+        attachments: [],
+        clientMessageId,
+        createdAt: new Date().toISOString(),
+        editedAt: null,
+        deletedAt: null,
+      };
+
+      setMessagesByThreadId((prev) => ({
+        ...prev,
+        [threadId]: [...(prev[threadId] ?? []), optimistic],
+      }));
+
+      try {
+        if (socketRef.current && socketConnected) {
+          socketRef.current.emit("chat:send", {
+            threadId,
+            body: text,
+            clientMessageId,
+          });
+        } else {
+          const persisted = await chatApi.sendMessage(
+            threadId,
+            text,
+            token,
+            clientMessageId,
+          );
+
+          setMessagesByThreadId((prev) => ({
+            ...prev,
+            [threadId]: (prev[threadId] ?? []).map((msg) =>
+              msg.id === clientMessageId ? persisted : msg,
+            ),
+          }));
+        }
+      } catch (error) {
+        setMessagesByThreadId((prev) => ({
+          ...prev,
+          [threadId]: (prev[threadId] ?? []).filter(
+            (msg) => msg.id !== clientMessageId,
+          ),
+        }));
+
+        log.warn("Failed to send chat message", { threadId, error });
+        throw error;
+      }
+    },
+    [getToken, isSignedIn, socketConnected, user?.id],
+  );
+
+  useEffect(() => {
+    if (!isSignedIn) {
+      clearAll();
+      return;
+    }
+
+    let mounted = true;
+
+    const setupSocket = async () => {
+      const token = await getToken();
+      if (!token || !mounted) {
+        return;
+      }
+
+      const socket = createChatSocket(token);
+      socketRef.current = socket;
+
+      socket.on("connect", () => {
+        setSocketConnected(true);
+        void refreshThreadsRef.current();
+
+        if (activeThreadIdRef.current) {
+          socket.emit("chat:subscribe", {
+            threadId: activeThreadIdRef.current,
+          });
+        }
+      });
+
+      socket.on("disconnect", () => {
+        setSocketConnected(false);
+        setTypingByThreadId({});
+      });
+
+      socket.on(
+        "chat:message:new",
+        (event: { threadId: string; message: ChatMessage }) => {
+          setMessagesByThreadId((prev) => {
+            const current = prev[event.threadId] ?? [];
+            if (current.some((msg) => msg.id === event.message.id)) {
+              return prev;
+            }
+
+            const deduped = current.filter(
+              (msg) =>
+                !(
+                  msg.clientMessageId &&
+                  event.message.clientMessageId &&
+                  msg.clientMessageId === event.message.clientMessageId
+                ),
+            );
+
+            return {
+              ...prev,
+              [event.threadId]: [...deduped, event.message],
+            };
+          });
+
+          setThreads((prev) =>
+            prev
+              .map((thread) => {
+                if (thread.id !== event.threadId) {
+                  return thread;
+                }
+
+                const isIncoming =
+                  event.message.senderUserId !== currentUserIdRef.current;
+                const incrementUnread =
+                  isIncoming && event.threadId !== activeThreadIdRef.current;
+
+                return {
+                  ...thread,
+                  lastMessageAt: event.message.createdAt,
+                  lastMessageBody: event.message.body,
+                  unreadCount: incrementUnread
+                    ? thread.unreadCount + 1
+                    : thread.unreadCount,
+                };
+              })
+              .sort((a, b) => {
+                const aTime = a.lastMessageAt ?? a.createdAt;
+                const bTime = b.lastMessageAt ?? b.createdAt;
+                return new Date(bTime).getTime() - new Date(aTime).getTime();
+              }),
+          );
+
+          if (
+            event.threadId === activeThreadIdRef.current &&
+            event.message.senderUserId !== currentUserIdRef.current
+          ) {
+            void markThreadReadRef.current(event.threadId, event.message.id);
+            setThreads((prev) =>
+              prev.map((thread) =>
+                thread.id === event.threadId
+                  ? { ...thread, unreadCount: 0 }
+                  : thread,
+              ),
+            );
+          }
+        },
+      );
+
+      socket.on(
+        "chat:message:ack",
+        (event: {
+          threadId: string;
+          message: ChatMessage;
+          clientMessageId?: string | null;
+        }) => {
+          setMessagesByThreadId((prev) => ({
+            ...prev,
+            [event.threadId]: (prev[event.threadId] ?? []).map((msg) =>
+              event.clientMessageId
+                ? msg.clientMessageId === event.clientMessageId
+                  ? event.message
+                  : msg
+                : msg.id === event.message.id
+                  ? event.message
+                  : msg,
+            ),
+          }));
+
+          setThreads((prev) =>
+            prev
+              .map((thread) =>
+                thread.id === event.threadId
+                  ? {
+                      ...thread,
+                      lastMessageAt: event.message.createdAt,
+                      lastMessageBody: event.message.body,
+                    }
+                  : thread,
+              )
+              .sort((a, b) => {
+                const aTime = a.lastMessageAt ?? a.createdAt;
+                const bTime = b.lastMessageAt ?? b.createdAt;
+                return new Date(bTime).getTime() - new Date(aTime).getTime();
+              }),
+          );
+        },
+      );
+
+      socket.on(
+        "chat:read:update",
+        (event: {
+          threadId?: string;
+          userId?: string;
+          lastReadMessageId?: string | null;
+        }) => {
+          if (!event.threadId || !event.userId || !event.lastReadMessageId) {
+            return;
+          }
+
+          setReadByThreadId((prev) => ({
+            ...prev,
+            [event.threadId!]: {
+              ...(prev[event.threadId!] ?? {}),
+              [event.userId!]: event.lastReadMessageId!,
+            },
+          }));
+
+          void refreshThreadsRef.current();
+        },
+      );
+
+      socket.on(
+        "chat:typing",
+        (event: { threadId?: string; userId?: string; isTyping?: boolean }) => {
+          const threadId = event?.threadId;
+          const typingUserId = event?.userId;
+          if (
+            !threadId ||
+            !typingUserId ||
+            typingUserId === currentUserIdRef.current
+          ) {
+            return;
+          }
+
+          setTypingByThreadId((prev) => {
+            const current = prev[threadId] ?? [];
+            if (event.isTyping) {
+              if (current.includes(typingUserId)) {
+                return prev;
+              }
+
+              return {
+                ...prev,
+                [threadId]: [...current, typingUserId],
+              };
+            }
+
+            return {
+              ...prev,
+              [threadId]: current.filter((id) => id !== typingUserId),
+            };
+          });
+        },
+      );
+
+      socket.on("chat:error", (event) => {
+        log.warn("Chat socket error event", { event });
+      });
+    };
+
+    void setupSocket();
+
+    return () => {
+      mounted = false;
+      if (socketRef.current) {
+        socketRef.current.disconnect();
+        socketRef.current = null;
+      }
+    };
+  }, [clearAll, getToken, isSignedIn]);
+
+  useEffect(() => {
+    if (!isSignedIn) {
+      return;
+    }
+
+    void refreshThreadsRef.current();
+  }, [isSignedIn, userRole]);
+
+  useEffect(() => {
+    if (!activeThreadId) {
+      return;
+    }
+
+    if (socketRef.current && socketConnected) {
+      socketRef.current.emit("chat:subscribe", { threadId: activeThreadId });
+    }
+
+    void refreshMessages(activeThreadId);
+
+    setThreads((prev) =>
+      prev.map((thread) =>
+        thread.id === activeThreadId ? { ...thread, unreadCount: 0 } : thread,
+      ),
+    );
+
+    return () => {
+      if (socketRef.current) {
+        socketRef.current.emit("chat:unsubscribe", {
+          threadId: activeThreadId,
+        });
+      }
+    };
+  }, [activeThreadId, refreshMessages, socketConnected]);
+
+  useEffect(() => {
+    if (!activeThreadId) {
+      return;
+    }
+
+    const messages = messagesByThreadId[activeThreadId] ?? [];
+    if (messages.length === 0) {
+      return;
+    }
+
+    const lastMessage = messages[messages.length - 1];
+    if (!lastMessage || lastMessage.senderUserId === user?.id) {
+      return;
+    }
+
+    if (lastMarkedReadByThreadRef.current[activeThreadId] === lastMessage.id) {
+      return;
+    }
+
+    lastMarkedReadByThreadRef.current[activeThreadId] = lastMessage.id;
+    void markThreadRead(activeThreadId, lastMessage.id);
+  }, [activeThreadId, markThreadRead, messagesByThreadId, user?.id]);
+
+  const setActiveThread = useCallback((threadId: string | null) => {
+    setActiveThreadId(threadId);
+    if (!threadId) {
+      return;
+    }
+
+    setThreads((prev) =>
+      prev.map((thread) =>
+        thread.id === threadId ? { ...thread, unreadCount: 0 } : thread,
+      ),
+    );
+  }, []);
+
+  const setTyping = useCallback(
+    (threadId: string, isTyping: boolean) => {
+      if (!socketRef.current || !socketConnected) {
+        return;
+      }
+
+      socketRef.current.emit("chat:typing", { threadId, isTyping });
+    },
+    [socketConnected],
+  );
+
+  const hasMoreMessages = useCallback(
+    (threadId: string) =>
+      nextCursorByThreadId[threadId] !== null &&
+      nextCursorByThreadId[threadId] !== undefined,
+    [nextCursorByThreadId],
+  );
+
+  const isLoadingOlderMessages = useCallback(
+    (threadId: string) => Boolean(loadingOlderByThreadId[threadId]),
+    [loadingOlderByThreadId],
+  );
+
+  const totalUnreadCount = useMemo(
+    () => threads.reduce((sum, thread) => sum + thread.unreadCount, 0),
+    [threads],
+  );
+
+  const value = useMemo<ChatContextValue>(
+    () => ({
+      threads,
+      totalUnreadCount,
+      activeThreadId,
+      messagesByThreadId,
+      readByThreadId,
+      loadingThreads,
+      loadingMessages,
+      socketConnected,
+      typingByThreadId,
+      setActiveThread,
+      refreshThreads,
+      refreshMessages,
+      loadOlderMessages,
+      hasMoreMessages,
+      isLoadingOlderMessages,
+      sendMessage,
+      setTyping,
+      markThreadRead,
+    }),
+    [
+      threads,
+      totalUnreadCount,
+      activeThreadId,
+      messagesByThreadId,
+      readByThreadId,
+      loadingThreads,
+      loadingMessages,
+      socketConnected,
+      typingByThreadId,
+      setActiveThread,
+      refreshThreads,
+      refreshMessages,
+      loadOlderMessages,
+      hasMoreMessages,
+      isLoadingOlderMessages,
+      sendMessage,
+      setTyping,
+      markThreadRead,
+    ],
+  );
+
+  return <ChatContext.Provider value={value}>{children}</ChatContext.Provider>;
+}
+
+export function useChat(): ChatContextValue {
+  const context = useContext(ChatContext);
+  if (!context) {
+    throw new Error("useChat must be used within ChatProvider");
+  }
+  return context;
+}

apps/realtime/.env.example

@@ -0,0 +1,19 @@
+# Realtime service port
+REALTIME_PORT=3001
+
+# Comma-separated allowed origins for Socket.IO CORS
+# Example: http://localhost:3000,http://localhost:8081
+REALTIME_CORS_ORIGIN=http://localhost:3000,http://localhost:8081
+
+# Socket.IO path (must match clients)
+REALTIME_SOCKET_PATH=/socket.io
+
+# Clerk secret key (required for token verification)
+CLERK_SECRET_KEY=sk_test_your_secret_key_here
+
+# Redis URL (optional but recommended for multi-instance scaling + distributed rate limits)
+REDIS_URL=redis://localhost:6379
+
+# Optional database path override (shared with @fitai/database)
+# FITAI_DATABASE_PATH=../../apps/admin/data/fitai.db
+# DATABASE_PATH=../../apps/admin/data/fitai.db

apps/realtime/README.md

@@ -0,0 +1,44 @@
+# FitAI Realtime Service
+
+Socket.IO service for gym room and trainer-client chat.
+
+## Setup
+
+1. Copy env template:
+
+```bash
+cp .env.example .env
+```
+
+2. Fill required values in `.env` (`CLERK_SECRET_KEY` at minimum).
+
+3. Build dependencies from monorepo root (if needed) and run:
+
+```bash
+npm --prefix packages/database run build
+npm --prefix apps/realtime run dev
+```
+
+For production:
+
+```bash
+npm --prefix apps/realtime run build
+npm --prefix apps/realtime run start
+```
+
+## Required environment variables
+
+- `CLERK_SECRET_KEY`: verifies client session token in socket handshake.
+- `REALTIME_CORS_ORIGIN`: comma-separated client origins.
+
+## Recommended environment variables
+
+- `REDIS_URL`: enables Socket.IO Redis adapter and distributed rate limiting.
+- `FITAI_DATABASE_PATH` or `DATABASE_PATH`: explicit DB path.
+- `REALTIME_PORT`: server port (default `3001`).
+- `REALTIME_SOCKET_PATH`: Socket.IO path (default `/socket.io`).
+
+## Notes
+
+- If `REDIS_URL` is missing, service still works with single-instance in-memory rate limits.
+- Database path resolution falls back to shared `apps/admin/data/fitai.db` when available.

apps/realtime/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@fitai/realtime",
+  "version": "1.0.0",
+  "private": true,
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/index.js",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@clerk/backend": "^2.5.4",
+    "@fitai/database": "file:../../packages/database",
+    "@fitai/shared": "file:../../packages/shared",
+    "@socket.io/redis-adapter": "^8.3.0",
+    "dotenv": "^17.2.3",
+    "express": "^4.21.2",
+    "redis": "^4.7.0",
+    "socket.io": "^4.8.1"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.23",
+    "@types/node": "^24.10.0",
+    "tsx": "^4.20.6",
+    "typescript": "^5.9.3"
+  }
+}

apps/realtime/src/index.ts

@@ -0,0 +1,692 @@
+import "dotenv/config";
+import http from "node:http";
+import express, { type Request, type Response } from "express";
+import { Server as SocketIOServer } from "socket.io";
+import { createClient } from "redis";
+import { createAdapter } from "@socket.io/redis-adapter";
+import { verifyToken } from "@clerk/backend";
+import { db, sql } from "@fitai/database";
+
+interface ThreadAccess {
+  id: string;
+  type: "gym" | "dm";
+  gymId: string | null;
+  trainerId: string | null;
+  clientId: string | null;
+}
+
+interface IncomingChatMessagePayload {
+  threadId?: string;
+  body?: string;
+  clientMessageId?: string;
+  attachments?: unknown;
+}
+
+interface AuthenticatedSocketData {
+  user: {
+    id: string;
+    role: "superAdmin" | "admin" | "trainer" | "client";
+    gymId: string | null;
+  };
+}
+
+const app = express();
+const server = http.createServer(app);
+const sendRateWindowByUser = new Map<string, number[]>();
+const typingRateWindowByKey = new Map<string, number[]>();
+const readRateWindowByKey = new Map<string, number[]>();
+const SEND_LIMIT_PER_MINUTE = 30;
+const TYPING_LIMIT_PER_10_SECONDS = 20;
+const READ_LIMIT_PER_10_SECONDS = 30;
+let redisRateClient: ReturnType<typeof createClient> | null = null;
+
+const io = new SocketIOServer<
+  Record<string, never>,
+  Record<string, never>,
+  Record<string, never>,
+  AuthenticatedSocketData
+>(server, {
+  cors: {
+    origin: process.env.REALTIME_CORS_ORIGIN?.split(",") ?? "*",
+    credentials: true,
+  },
+  path: process.env.REALTIME_SOCKET_PATH ?? "/socket.io",
+});
+
+app.get("/healthz", (_req: Request, res: Response) => {
+  res.json({ ok: true, service: "realtime" });
+});
+
+async function attachRedisAdapter(): Promise<void> {
+  const redisUrl = process.env.REDIS_URL;
+  if (!redisUrl) {
+    return;
+  }
+
+  const pubClient = createClient({ url: redisUrl });
+  const subClient = pubClient.duplicate();
+  await pubClient.connect();
+  await subClient.connect();
+
+  redisRateClient = pubClient;
+  io.adapter(createAdapter(pubClient, subClient));
+}
+
+io.use(async (socket: any, next: (err?: Error) => void) => {
+  try {
+    const token =
+      typeof socket.handshake.auth?.token === "string"
+        ? socket.handshake.auth.token
+        : null;
+
+    const userId = await verifyAndExtractUserId(token);
+    if (!userId) {
+      return next(new Error("Unauthorized"));
+    }
+
+    const rows = await db.all(sql`
+      SELECT
+        id,
+        role,
+        gym_id as gymId
+      FROM users
+      WHERE id = ${userId}
+      LIMIT 1
+    `);
+
+    const user = rows?.[0] as
+      | {
+          id: string;
+          role: "superAdmin" | "admin" | "trainer" | "client";
+          gymId: string | null;
+        }
+      | undefined;
+
+    if (!user) {
+      return next(new Error("Unauthorized"));
+    }
+
+    socket.data.user = user;
+    return next();
+  } catch {
+    return next(new Error("Unauthorized"));
+  }
+});
+
+io.on("connection", (socket: any) => {
+  socket.on("chat:subscribe", async (payload: { threadId?: string }) => {
+    const threadId = payload?.threadId;
+    if (!threadId) {
+      socket.emit("chat:error", { code: "invalid_payload" });
+      return;
+    }
+
+    const allowed = await canAccessThread(socket.data.user, threadId);
+    if (!allowed) {
+      socket.emit("chat:error", { code: "forbidden" });
+      return;
+    }
+
+    await socket.join(`thread:${threadId}`);
+    socket.emit("chat:subscribed", { threadId });
+  });
+
+  socket.on("chat:unsubscribe", async (payload: { threadId?: string }) => {
+    const threadId = payload?.threadId;
+    if (!threadId) {
+      return;
+    }
+
+    await socket.leave(`thread:${threadId}`);
+  });
+
+  socket.on(
+    "chat:typing",
+    async (payload: { threadId?: string; isTyping?: boolean }) => {
+      const threadId = payload?.threadId;
+      if (!threadId) {
+        return;
+      }
+
+      const typingAllowed = await checkRateLimit(
+        typingRateWindowByKey,
+        `typing:${socket.data.user.id}:${threadId}`,
+        TYPING_LIMIT_PER_10_SECONDS,
+        10,
+      );
+      if (!typingAllowed) {
+        return;
+      }
+
+      const allowed = await canAccessThread(socket.data.user, threadId);
+      if (!allowed) {
+        return;
+      }
+
+      socket.to(`thread:${threadId}`).emit("chat:typing", {
+        threadId,
+        userId: socket.data.user.id,
+        isTyping: Boolean(payload?.isTyping),
+      });
+    },
+  );
+
+  socket.on("chat:send", async (payload: IncomingChatMessagePayload) => {
+    try {
+      const threadId =
+        typeof payload?.threadId === "string" ? payload.threadId : null;
+      const body = typeof payload?.body === "string" ? payload.body.trim() : "";
+
+      if (!threadId || !body) {
+        socket.emit("chat:error", {
+          code: "invalid_payload",
+          message: "threadId and body are required",
+        });
+        return;
+      }
+
+      const sendAllowed = await checkRateLimit(
+        sendRateWindowByUser,
+        `send:${socket.data.user.id}`,
+        SEND_LIMIT_PER_MINUTE,
+        60,
+      );
+      if (!sendAllowed) {
+        socket.emit("chat:error", {
+          code: "rate_limited",
+          message: "Too many messages. Please slow down.",
+        });
+        return;
+      }
+
+      if (body.length > 2000) {
+        socket.emit("chat:error", {
+          code: "message_too_long",
+          message: "Message is too long",
+        });
+        return;
+      }
+
+      const access = await getThreadAccess(socket.data.user, threadId);
+      if (!access) {
+        socket.emit("chat:error", { code: "forbidden", message: "Forbidden" });
+        return;
+      }
+
+      await ensureThreadMembership(
+        threadId,
+        socket.data.user.id,
+        socket.data.user.role,
+      );
+
+      const clientMessageId =
+        typeof payload.clientMessageId === "string" &&
+        payload.clientMessageId.trim().length > 0
+          ? payload.clientMessageId.trim()
+          : null;
+
+      if (clientMessageId) {
+        const existingRows = await db.all(sql`
+          SELECT
+            id,
+            thread_id as threadId,
+            sender_user_id as senderUserId,
+            body,
+            kind,
+            attachments_json as attachmentsJson,
+            client_message_id as clientMessageId,
+            created_at as createdAt,
+            edited_at as editedAt,
+            deleted_at as deletedAt
+          FROM chat_messages
+          WHERE sender_user_id = ${socket.data.user.id}
+            AND client_message_id = ${clientMessageId}
+          LIMIT 1
+        `);
+
+        if (existingRows?.[0]) {
+          const message = mapMessageRow(existingRows[0] as MessageRow);
+          socket.emit("chat:message:ack", {
+            threadId,
+            clientMessageId,
+            message,
+            duplicate: true,
+          });
+          return;
+        }
+      }
+
+      const attachments = normalizeAttachments(payload.attachments);
+      const now = nowEpochSeconds();
+      const messageId = generateId("msg");
+
+      await db.run(sql`
+        INSERT INTO chat_messages (
+          id,
+          thread_id,
+          sender_user_id,
+          body,
+          kind,
+          attachments_json,
+          client_message_id,
+          created_at
+        ) VALUES (
+          ${messageId},
+          ${threadId},
+          ${socket.data.user.id},
+          ${body},
+          ${"text"},
+          ${attachments.length > 0 ? JSON.stringify(attachments) : null},
+          ${clientMessageId},
+          ${now}
+        )
+      `);
+
+      await db.run(sql`
+        UPDATE chat_threads
+        SET
+          last_message_at = ${now},
+          updated_at = ${now}
+        WHERE id = ${threadId}
+      `);
+
+      const createdRows = await db.all(sql`
+        SELECT
+          id,
+          thread_id as threadId,
+          sender_user_id as senderUserId,
+          body,
+          kind,
+          attachments_json as attachmentsJson,
+          client_message_id as clientMessageId,
+          created_at as createdAt,
+          edited_at as editedAt,
+          deleted_at as deletedAt
+        FROM chat_messages
+        WHERE id = ${messageId}
+        LIMIT 1
+      `);
+
+      const createdRow = createdRows?.[0] as MessageRow | undefined;
+      if (!createdRow) {
+        socket.emit("chat:error", {
+          code: "send_failed",
+          message: "Failed to persist message",
+        });
+        return;
+      }
+
+      const message = mapMessageRow(createdRow);
+
+      await socket.join(`thread:${threadId}`);
+
+      io.to(`thread:${threadId}`).emit("chat:message:new", {
+        threadId,
+        message,
+      });
+
+      io.to(`thread:${threadId}`).emit("chat:read:update", {
+        threadId,
+        userId: socket.data.user.id,
+        lastReadMessageId: message.id,
+      });
+
+      socket.emit("chat:message:ack", {
+        threadId,
+        clientMessageId,
+        message,
+      });
+    } catch (error) {
+      socket.emit("chat:error", {
+        code: "internal_error",
+        message: error instanceof Error ? error.message : "Failed to send",
+      });
+    }
+  });
+
+  socket.on(
+    "chat:read",
+    async (payload: { threadId?: string; lastReadMessageId?: string }) => {
+      const threadId = payload?.threadId;
+      if (!threadId) {
+        return;
+      }
+
+      const readAllowed = await checkRateLimit(
+        readRateWindowByKey,
+        `read:${socket.data.user.id}:${threadId}`,
+        READ_LIMIT_PER_10_SECONDS,
+        10,
+      );
+      if (!readAllowed) {
+        return;
+      }
+
+      const allowed = await canAccessThread(socket.data.user, threadId);
+      if (!allowed) {
+        return;
+      }
+
+      await ensureThreadMembership(
+        threadId,
+        socket.data.user.id,
+        socket.data.user.role,
+      );
+
+      const now = Math.floor(Date.now() / 1000);
+      await db.run(sql`
+        UPDATE chat_thread_members
+        SET
+          last_read_message_id = ${payload?.lastReadMessageId ?? null},
+          last_read_at = ${now}
+        WHERE thread_id = ${threadId}
+          AND user_id = ${socket.data.user.id}
+      `);
+
+      io.to(`thread:${threadId}`).emit("chat:read:update", {
+        threadId,
+        userId: socket.data.user.id,
+        lastReadMessageId: payload?.lastReadMessageId ?? null,
+      });
+    },
+  );
+});
+
+async function canAccessThread(
+  user: AuthenticatedSocketData["user"],
+  threadId: string,
+): Promise<boolean> {
+  const access = await getThreadAccess(user, threadId);
+  return Boolean(access);
+}
+
+async function getThreadAccess(
+  user: AuthenticatedSocketData["user"],
+  threadId: string,
+): Promise<ThreadAccess | null> {
+  const rows = await db.all(sql`
+    SELECT
+      id,
+      type,
+      gym_id as gymId,
+      trainer_id as trainerId,
+      client_id as clientId,
+      archived_at as archivedAt
+    FROM chat_threads
+    WHERE id = ${threadId}
+    LIMIT 1
+  `);
+
+  const thread = rows?.[0] as
+    | {
+        id: string;
+        type: "gym" | "dm";
+        gymId: string | null;
+        trainerId: string | null;
+        clientId: string | null;
+        archivedAt: number | null;
+      }
+    | undefined;
+
+  if (!thread || thread.archivedAt) {
+    return null;
+  }
+
+  if (user.role === "superAdmin") {
+    return {
+      id: thread.id,
+      type: thread.type,
+      gymId: thread.gymId,
+      trainerId: thread.trainerId,
+      clientId: thread.clientId,
+    };
+  }
+
+  if (thread.type === "gym") {
+    if (!user.gymId || user.gymId !== thread.gymId) {
+      return null;
+    }
+
+    return {
+      id: thread.id,
+      type: thread.type,
+      gymId: thread.gymId,
+      trainerId: thread.trainerId,
+      clientId: thread.clientId,
+    };
+  }
+
+  const isParticipant =
+    user.id === thread.trainerId || user.id === thread.clientId;
+  if (!isParticipant) {
+    return null;
+  }
+
+  if (thread.trainerId && thread.clientId) {
+    const assignmentRows = await db.all(sql`
+      SELECT id
+      FROM trainer_client_assignments
+      WHERE trainer_id = ${thread.trainerId}
+        AND client_id = ${thread.clientId}
+        AND is_active = 1
+      LIMIT 1
+    `);
+
+    if (!assignmentRows?.[0]) {
+      return null;
+    }
+  }
+
+  return {
+    id: thread.id,
+    type: thread.type,
+    gymId: thread.gymId,
+    trainerId: thread.trainerId,
+    clientId: thread.clientId,
+  };
+}
+
+async function verifyAndExtractUserId(
+  token: string | null,
+): Promise<string | null> {
+  if (!token) {
+    return null;
+  }
+
+  const secretKey = process.env.CLERK_SECRET_KEY;
+  if (!secretKey) {
+    return null;
+  }
+
+  try {
+    const verified = await verifyToken(token, {
+      secretKey,
+      clockSkewInMs: 5000,
+    });
+    if (typeof verified.sub === "string" && verified.sub.trim().length > 0) {
+      return verified.sub;
+    }
+
+    const fallback =
+      typeof verified.sid === "string" && verified.sid.trim().length > 0
+        ? verified.sid
+        : null;
+    if (fallback) {
+      const rows = await db.all(sql`
+        SELECT id
+        FROM users
+        WHERE id = ${fallback}
+        LIMIT 1
+      `);
+      if (rows?.[0]) {
+        return fallback;
+      }
+    }
+
+    const payload = JSON.parse(
+      Buffer.from(token.split(".")[1], "base64url").toString(),
+    );
+    if (typeof payload.sub === "string" && payload.sub.trim().length > 0) {
+      return payload.sub;
+    }
+
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+async function main() {
+  await attachRedisAdapter();
+  const port = Number(process.env.REALTIME_PORT ?? 3001);
+  server.listen(port, () => {
+    console.log(`[realtime] listening on :${port}`);
+  });
+}
+
+async function ensureThreadMembership(
+  threadId: string,
+  userId: string,
+  role: AuthenticatedSocketData["user"]["role"],
+): Promise<void> {
+  const now = nowEpochSeconds();
+  await db.run(sql`
+    INSERT OR IGNORE INTO chat_thread_members (
+      id,
+      thread_id,
+      user_id,
+      role_in_thread,
+      joined_at,
+      muted
+    ) VALUES (
+      ${generateId("member")},
+      ${threadId},
+      ${userId},
+      ${role},
+      ${now},
+      ${0}
+    )
+  `);
+
+  await db.run(sql`
+    UPDATE chat_thread_members
+    SET left_at = NULL
+    WHERE thread_id = ${threadId}
+      AND user_id = ${userId}
+  `);
+}
+
+function normalizeAttachments(
+  raw: unknown,
+): Array<{ url: string; type: string; name?: string }> {
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+
+  return raw
+    .filter(
+      (item): item is { url: string; type: string; name?: string } =>
+        item !== null &&
+        typeof item === "object" &&
+        typeof (item as { url?: unknown }).url === "string" &&
+        typeof (item as { type?: unknown }).type === "string",
+    )
+    .map((item) => ({
+      url: item.url,
+      type: item.type,
+      name: typeof item.name === "string" ? item.name : undefined,
+    }));
+}
+
+function parseAttachments(
+  value: string | null,
+): Array<{ url: string; type: string; name?: string }> {
+  if (!value) {
+    return [];
+  }
+
+  try {
+    return normalizeAttachments(JSON.parse(value));
+  } catch {
+    return [];
+  }
+}
+
+function mapMessageRow(row: MessageRow) {
+  return {
+    id: row.id,
+    threadId: row.threadId,
+    senderUserId: row.senderUserId,
+    body: row.body,
+    kind: row.kind,
+    attachments: parseAttachments(row.attachmentsJson),
+    clientMessageId: row.clientMessageId,
+    createdAt: new Date(Number(row.createdAt) * 1000).toISOString(),
+    editedAt: row.editedAt
+      ? new Date(Number(row.editedAt) * 1000).toISOString()
+      : null,
+    deletedAt: row.deletedAt
+      ? new Date(Number(row.deletedAt) * 1000).toISOString()
+      : null,
+  };
+}
+
+function generateId(prefix: string): string {
+  return `${prefix}_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+}
+
+function nowEpochSeconds(): number {
+  return Math.floor(Date.now() / 1000);
+}
+
+export async function checkRateLimit(
+  windows: Map<string, number[]>,
+  key: string,
+  limit: number,
+  windowSeconds: number,
+): Promise<boolean> {
+  if (redisRateClient) {
+    try {
+      const redisKey = `fitai:chat:rl:${key}`;
+      const count = await redisRateClient.incr(redisKey);
+      if (count === 1) {
+        await redisRateClient.expire(redisKey, windowSeconds);
+      }
+
+      return count <= limit;
+    } catch {
+      // Continue with in-memory fallback below.
+    }
+  }
+
+  const now = Date.now();
+  const current = windows.get(key) ?? [];
+  const windowMs = windowSeconds * 1000;
+  const withinWindow = current.filter(
+    (timestamp) => now - timestamp < windowMs,
+  );
+
+  if (withinWindow.length >= limit) {
+    windows.set(key, withinWindow);
+    return false;
+  }
+
+  withinWindow.push(now);
+  windows.set(key, withinWindow);
+  return true;
+}
+
+interface MessageRow {
+  id: string;
+  threadId: string;
+  senderUserId: string;
+  body: string;
+  kind: "text" | "system";
+  attachmentsJson: string | null;
+  clientMessageId: string | null;
+  createdAt: number;
+  editedAt: number | null;
+  deletedAt: number | null;
+}
+
+void main();

apps/realtime/src/types.d.ts

@@ -0,0 +1,11 @@
+declare module "@fitai/database" {
+  export const db: {
+    all: (query: unknown) => Promise<unknown[]>;
+    run: (query: unknown) => Promise<unknown>;
+  };
+
+  export function sql(
+    strings: TemplateStringsArray,
+    ...values: unknown[]
+  ): unknown;
+}

apps/realtime/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "CommonJS",
+    "moduleResolution": "Node",
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "types": ["node"]
+  },
+  "include": ["src/**/*.ts"]
+}

package.json

@@ -5,10 +5,13 @@
   "private": true,
   "scripts": {
     "dev": "concurrently \"npm run dev:admin\" \"npm run dev:mobile\"",
+    "dev:chat-stack": "concurrently \"npm run dev:admin\" \"npm run dev:realtime\" \"npm run dev:mobile\"",
     "dev:admin": "cd apps/admin && npx next dev",
+    "dev:realtime": "npm --prefix apps/realtime run dev",
     "dev:mobile": "cd apps/mobile && npx expo start",
     "build": "npm run build:admin && npm run build:mobile",
     "build:admin": "cd apps/admin && npx next build",
+    "build:realtime": "npm --prefix apps/realtime run build",
     "build:mobile": "cd apps/mobile && npx expo build",
     "test": "npm run test:admin && npm run test:mobile",
     "test:admin": "cd apps/admin && npx jest",
@@ -16,9 +19,10 @@
     "lint": "npm run lint:admin && npm run lint:mobile",
     "lint:admin": "cd apps/admin && npx eslint . --ext .js,.jsx,.ts,.tsx",
     "lint:mobile": "cd apps/mobile && npx eslint . --ext .js,.jsx,.ts,.tsx",
-    "typecheck": "npm run typecheck:admin && npm run typecheck:mobile",
+    "typecheck": "npm run typecheck:admin && npm run typecheck:mobile && npm run typecheck:realtime",
     "typecheck:admin": "cd apps/admin && npx tsc --noEmit",
-    "typecheck:mobile": "cd apps/mobile && npx tsc --noEmit"
+    "typecheck:mobile": "cd apps/mobile && npx tsc --noEmit",
+    "typecheck:realtime": "npm --prefix apps/realtime run typecheck"
   },
   "devDependencies": {
     "@typescript-eslint/eslint-plugin": "^8.46.3",

packages/database/src/index.ts

@@ -1,9 +1,16 @@
 import Database from "better-sqlite3";
 import { drizzle } from "drizzle-orm/better-sqlite3";
+import { existsSync, mkdirSync } from "node:fs";
+import path from "node:path";
 import * as schema from "./schema";
 
-// Configurable database path with intelligent defaults
+// Configurable database path with intelligent defaults.
-const dbPath = "./data/fitai.db";
+// Priority:
+// 1) FITAI_DATABASE_PATH / DATABASE_PATH
+// 2) ./data/fitai.db from current working directory
+// 3) monorepo shared admin database path
+const dbPath = resolveDatabasePath();
+mkdirSync(path.dirname(dbPath), { recursive: true });
 
 const sqlite = new Database(dbPath);
 export const db = drizzle(sqlite, { schema });
@@ -21,3 +28,29 @@ export {
   lte,
   like,
 } from "drizzle-orm";
+
+function resolveDatabasePath(): string {
+  const envPath = process.env.FITAI_DATABASE_PATH ?? process.env.DATABASE_PATH;
+  if (envPath && envPath.trim().length > 0) {
+    return path.resolve(envPath);
+  }
+
+  const cwdDefault = path.resolve(process.cwd(), "data", "fitai.db");
+  if (existsSync(cwdDefault)) {
+    return cwdDefault;
+  }
+
+  const repoRoot = path.resolve(__dirname, "..", "..", "..");
+  const sharedAdminDb = path.join(
+    repoRoot,
+    "apps",
+    "admin",
+    "data",
+    "fitai.db",
+  );
+  if (existsSync(sharedAdminDb)) {
+    return sharedAdminDb;
+  }
+
+  return cwdDefault;
+}

packages/database/src/schema.ts

@@ -8,6 +8,9 @@ import {
   uniqueIndex,
 } from "drizzle-orm/sqlite-core";
 
+const chatThreadTypeValues = ["gym", "dm"] as const;
+const chatMessageKindValues = ["text", "system"] as const;
+
 export const users = sqliteTable(
   "users",
   {
@@ -574,6 +577,135 @@ export const trainerClientAssignments = sqliteTable(
   }),
 );
 
+export const chatThreads = sqliteTable(
+  "chat_threads",
+  {
+    id: text("id").primaryKey(),
+    type: text("type", { enum: chatThreadTypeValues }).notNull(),
+    gymId: text("gym_id").references(() => gyms.id, { onDelete: "cascade" }),
+    trainerId: text("trainer_id").references(() => users.id, {
+      onDelete: "cascade",
+    }),
+    clientId: text("client_id").references(() => users.id, {
+      onDelete: "cascade",
+    }),
+    createdBy: text("created_by")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    lastMessageAt: integer("last_message_at", { mode: "timestamp" }),
+    createdAt: integer("created_at", { mode: "timestamp" })
+      .notNull()
+      .$defaultFn(() => new Date()),
+    updatedAt: integer("updated_at", { mode: "timestamp" })
+      .notNull()
+      .$defaultFn(() => new Date()),
+    archivedAt: integer("archived_at", { mode: "timestamp" }),
+  },
+  (table) => ({
+    typeIdx: index("chat_threads_type_idx").on(table.type),
+    gymTypeLastMessageIdx: index("chat_threads_gym_type_last_msg_idx").on(
+      table.gymId,
+      table.type,
+      table.lastMessageAt,
+    ),
+    trainerClientTypeIdx: uniqueIndex(
+      "chat_threads_trainer_client_type_idx",
+    ).on(table.trainerId, table.clientId, table.type),
+  }),
+);
+
+export const chatThreadMembers = sqliteTable(
+  "chat_thread_members",
+  {
+    id: text("id").primaryKey(),
+    threadId: text("thread_id")
+      .notNull()
+      .references(() => chatThreads.id, { onDelete: "cascade" }),
+    userId: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    roleInThread: text("role_in_thread", {
+      enum: ["superAdmin", "admin", "trainer", "client"],
+    }).notNull(),
+    joinedAt: integer("joined_at", { mode: "timestamp" })
+      .notNull()
+      .$defaultFn(() => new Date()),
+    leftAt: integer("left_at", { mode: "timestamp" }),
+    muted: integer("muted", { mode: "boolean" }).notNull().default(false),
+    lastReadMessageId: text("last_read_message_id"),
+    lastReadAt: integer("last_read_at", { mode: "timestamp" }),
+  },
+  (table) => ({
+    threadUserUniqueIdx: uniqueIndex("chat_thread_members_thread_user_idx").on(
+      table.threadId,
+      table.userId,
+    ),
+    userThreadIdx: index("chat_thread_members_user_thread_idx").on(
+      table.userId,
+      table.threadId,
+    ),
+  }),
+);
+
+export const chatMessages = sqliteTable(
+  "chat_messages",
+  {
+    id: text("id").primaryKey(),
+    threadId: text("thread_id")
+      .notNull()
+      .references(() => chatThreads.id, { onDelete: "cascade" }),
+    senderUserId: text("sender_user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    body: text("body").notNull(),
+    kind: text("kind", { enum: chatMessageKindValues })
+      .notNull()
+      .default("text"),
+    attachmentsJson: text("attachments_json"),
+    clientMessageId: text("client_message_id"),
+    createdAt: integer("created_at", { mode: "timestamp" })
+      .notNull()
+      .$defaultFn(() => new Date()),
+    editedAt: integer("edited_at", { mode: "timestamp" }),
+    deletedAt: integer("deleted_at", { mode: "timestamp" }),
+  },
+  (table) => ({
+    threadCreatedAtIdx: index("chat_messages_thread_created_at_idx").on(
+      table.threadId,
+      table.createdAt,
+    ),
+    senderClientMessageUniqueIdx: uniqueIndex(
+      "chat_messages_sender_client_msg_idx",
+    ).on(table.senderUserId, table.clientMessageId),
+  }),
+);
+
+export const chatMessageReads = sqliteTable(
+  "chat_message_reads",
+  {
+    id: text("id").primaryKey(),
+    messageId: text("message_id")
+      .notNull()
+      .references(() => chatMessages.id, { onDelete: "cascade" }),
+    userId: text("user_id")
+      .notNull()
+      .references(() => users.id, { onDelete: "cascade" }),
+    readAt: integer("read_at", { mode: "timestamp" })
+      .notNull()
+      .$defaultFn(() => new Date()),
+  },
+  (table) => ({
+    messageUserUniqueIdx: uniqueIndex("chat_message_reads_message_user_idx").on(
+      table.messageId,
+      table.userId,
+    ),
+    userReadAtIdx: index("chat_message_reads_user_read_at_idx").on(
+      table.userId,
+      table.readAt,
+    ),
+  }),
+);
+
 export type User = typeof users.$inferSelect;
 export type NewUser = typeof users.$inferInsert;
 export type Client = typeof clients.$inferSelect;
@@ -603,3 +735,11 @@ export type TrainerClientAssignment =
   typeof trainerClientAssignments.$inferSelect;
 export type NewTrainerClientAssignment =
   typeof trainerClientAssignments.$inferInsert;
+export type ChatThread = typeof chatThreads.$inferSelect;
+export type NewChatThread = typeof chatThreads.$inferInsert;
+export type ChatThreadMember = typeof chatThreadMembers.$inferSelect;
+export type NewChatThreadMember = typeof chatThreadMembers.$inferInsert;
+export type ChatMessage = typeof chatMessages.$inferSelect;
+export type NewChatMessage = typeof chatMessages.$inferInsert;
+export type ChatMessageRead = typeof chatMessageReads.$inferSelect;
+export type NewChatMessageRead = typeof chatMessageReads.$inferInsert;

packages/shared/src/constants/index.ts

@@ -128,6 +128,13 @@ export const RECOMMENDATION_STATUSES = [
 ] as const;
 export type RecommendationStatus = (typeof RECOMMENDATION_STATUSES)[number];
 
+// Chat constants
+export const CHAT_THREAD_TYPES = ["gym", "dm"] as const;
+export type ChatThreadType = (typeof CHAT_THREAD_TYPES)[number];
+
+export const CHAT_MESSAGE_KINDS = ["text", "system"] as const;
+export type ChatMessageKind = (typeof CHAT_MESSAGE_KINDS)[number];
+
 // Helper functions to check enum values
 export function isValidUserRole(role: string): role is UserRole {
   return USER_ROLES.includes(role as UserRole);

packages/shared/src/types/index.ts

@@ -13,6 +13,8 @@ import type {
   NotificationType,
   GymStatus,
   RecommendationStatus,
+  ChatThreadType,
+  ChatMessageKind,
 } from "../constants";
 
 export interface User {
@@ -239,6 +241,55 @@ export interface TrainerClientAssignment {
   updatedAt: Date;
 }
 
+export interface ChatThread {
+  id: string;
+  type: ChatThreadType;
+  gymId?: string;
+  trainerId?: string;
+  clientId?: string;
+  createdBy: string;
+  lastMessageAt?: Date;
+  createdAt: Date;
+  updatedAt: Date;
+  archivedAt?: Date;
+}
+
+export interface ChatThreadMember {
+  id: string;
+  threadId: string;
+  userId: string;
+  roleInThread: UserRole;
+  joinedAt: Date;
+  leftAt?: Date;
+  muted: boolean;
+  lastReadMessageId?: string;
+  lastReadAt?: Date;
+}
+
+export interface ChatMessage {
+  id: string;
+  threadId: string;
+  senderUserId: string;
+  body: string;
+  kind: ChatMessageKind;
+  attachments?: Array<{
+    url: string;
+    type: string;
+    name?: string;
+  }>;
+  clientMessageId?: string;
+  createdAt: Date;
+  editedAt?: Date;
+  deletedAt?: Date;
+}
+
+export interface ChatMessageRead {
+  id: string;
+  messageId: string;
+  userId: string;
+  readAt: Date;
+}
+
 // User Report Types
 export interface WeeklyCheckInStats {
   weekStart: string; // ISO 8601 date (YYYY-MM-DD)