Adds the initial preview of the Azure Web PubSub Chat service client, including authentication, synchronous/asynchronous APIs, documentation, samples, and live-test infrastructure.

Changes:

• Adds generated Chat service clients, models, paging operations, and custom token authentication.
• Adds packaging metadata, API snapshots, documentation, and samples.
• Adds unit/live tests, test resources, and CI registration.

Files not reviewed (1)

• sdk/webpubsub/azure-messaging-webpubsubchatservice/package-lock.json: Generated file

• Files reviewed: 86/88 changed files
• Comments generated: 5
• Review effort level: Balanced

Files not reviewed (1)

• sdk/webpubsub/azure-messaging-webpubsubchatservice/package-lock.json: Generated file

• Files reviewed: 86/88 changed files
• Comments generated: 6
• Review effort level: Balanced

Files not reviewed (1)

• sdk/webpubsub/azure-messaging-webpubsubchatservice/package-lock.json: Generated file

Suppressed comments (2)

sdk/webpubsub/azure-messaging-webpubsubchatservice/tests/test_live_async.py:304

• Safe-secret runs disable local authentication, but the Entra-backed token request remains valid and should still be exercised. The early skip currently removes the only live coverage for that path; create and assert the key client only when local auth is enabled.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/tsp-location.yaml:2
• The pinned source commit predates the linked correction PR, but this generated surface already includes corrections from that PR (for example, ChatPermission, which #44881 adds to models.tsp). Regenerating from this file will therefore produce a different API and discard those corrections. Please update the pin to the merged correction commit and regenerate before merging this SDK.

• Files reviewed: 89/91 changed files
• Comments generated: 1
• Review effort level: Balanced

Files not reviewed (1)

• sdk/webpubsub/azure-messaging-webpubsubchatservice/package-lock.json: Generated file

Suppressed comments (3)

Previously missed (2) — in code that hasn't changed since the last review.

sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubservice/chat/_patch.py:116

• This slices the endpoint as though it is always HTTP(S), so values such as example.com or ftp://... produce malformed WebSocket URLs instead of rejecting the documented-invalid endpoint. minutes_to_expire is also validated only in the key-credential branch; token credentials send non-positive values to the service. Validate both inputs before branching so both authentication modes behave consistently.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubservice/chat/aio/_patch.py:113
• This async path has the same input inconsistency as the sync client: slicing assumes an HTTP(S) endpoint and silently creates a malformed WebSocket URL for any other scheme, while non-positive expiration is rejected only for key credentials. Validate both values before selecting the authentication path.

sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubservice/chat/_shared.py:62

• on_request passes request.http_request.url here, which is a string, not an AzureKeyCredential. The incorrect annotation misdocuments the helper and causes static type checkers to flag the call.

    def _encode(self, url: AzureKeyCredential) -> str:

• Files reviewed: 89/91 changed files
• Comments generated: 0 new
• Review effort level: Balanced

Files not reviewed (1)

• sdk/webpubsub/azure-messaging-webpubsubchatservice/package-lock.json: Generated file

Suppressed comments (3)

Previously missed (2) — in code that hasn't changed since the last review.

sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubservice/chat/_patch.py:118

• endpoint[4:] assumes an HTTP(S) prefix. Inputs such as myservice.webpubsub.azure.com or another scheme therefore return a malformed WebSocket URL instead of the validation error provided by the existing Web PubSub client. Reject unsupported schemes before slicing the endpoint.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubservice/chat/aio/_patch.py:115
• The async path has the same unchecked endpoint[4:] assumption as the sync client, so a non-HTTP(S) endpoint produces an invalid access URL. Validate the scheme before deriving the WebSocket URL.

sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubservice/chat/_shared.py:62

• _encode receives request.http_request.url and uses it as the JWT audience, so this parameter is a string rather than an AzureKeyCredential. The current annotation gives static analysis and maintainers an incorrect contract.

    def _encode(self, url: AzureKeyCredential) -> str:

• Files reviewed: 90/92 changed files
• Comments generated: 1
• Review effort level: Balanced

Files not reviewed (1)

• sdk/webpubsub/azure-messaging-webpubsubchatservice/package-lock.json: Generated file

Suppressed comments (1)

sdk/webpubsub/azure-messaging-webpubsubservice/azure/messaging/webpubsubservice/init.py:12

• This namespace fix does not make the new package compatible with the already-published azure-messaging-webpubsubservice 1.3.0: that version's regular azure.messaging.webpubsubservice package does not extend its path, so it hides the sibling chat directory and import azure.messaging.webpubsubservice.chat fails. The PR also leaves that distribution at version 1.3.0, so this fix cannot be published as-is. Please either move Chat out of another distribution's concrete package or version/release this parent-package change and require that new version from the Chat package.

• Files reviewed: 90/92 changed files
• Comments generated: 2
• Review effort level: Balanced (auto)

Files not reviewed (1)

• sdk/webpubsub/azure-messaging-webpubsubchatservice/package-lock.json: Generated file

• Files reviewed: 88/90 changed files
• Comments generated: 1
• Review effort level: Balanced (auto)

Files not reviewed (1)

• sdk/webpubsub/azure-messaging-webpubsubchatservice/package-lock.json: Generated file

Suppressed comments (9)

Previously missed (5) — in code that hasn't changed since the last review.

sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/_patch.py:121

• Validate the documented lower bound before branching on credential type. get_token_by_key currently raises for values below 1, but token-credential clients skip that helper and send the invalid value to the service, so the same public method has credential-dependent validation and exception behavior.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/aio/_patch.py:118
• Validate the expiration before selecting the authentication path. As written, key credentials reject values below 1 locally while async token-credential clients issue a request with the invalid value, producing inconsistent behavior from this public method.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:33
• ChatMessage is accepted as a request-body dictionary, but this type requires the server-generated id (and also createdAt/etag). Type checkers therefore reject valid create/update payloads that contain only writable fields. Regenerate a request shape that requires only writable properties.

This issue also appears in the following locations of the same file:

• line 58
• line 80
• line 101
• line 124
  sdk/webpubsub/azure-messaging-webpubsubchatservice/samples/sample_client_access.py:19

• This prints a bearer access token to stdout, where CI logs, terminals, or redirected output can retain it. It also contradicts the README warning not to log the returned URL. Remove the print, pass the URL directly to the intended client, and regenerate the README snippet from this sample.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/samples/sample_client_access_async.py:23
• Avoid printing the connection URL because it embeds a bearer token and can be retained in terminal or CI logs. Pass it directly to the intended client instead, consistent with the package's README security guidance.

sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:58

• This request dictionary requires the role name, even though the name is supplied separately as the operation's path parameter; it also requires the response-only ETag below. This makes the dictionary overload reject the valid permissions-only request body. Generate a role request shape containing only writable body fields.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:80
• The room ID is supplied as a path parameter and returned by the service, but this request-body dictionary marks it required; defaultConversation and etag are likewise response-only. This causes type checkers to reject the valid title-only room body. Generate a request type containing only writable fields.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:101
• The member's user ID is already supplied in the request path, but this body dictionary requires it and also requires the response ETag. The valid role-name-only request body is therefore rejected by type checkers. Generate a request type containing only writable body fields.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:124
• The user ID is supplied as the operation's path parameter, but this body dictionary requires it and the response-only ETag. As a result, type checkers reject the same valid request shape accepted by HumanChatUser(...). Generate a request type that excludes server-owned fields.

• Files reviewed: 88/90 changed files
• Comments generated: 0 new
• Review effort level: Balanced (auto)

Files not reviewed (1)

• sdk/webpubsub/azure-messaging-webpubsubchatservice/package-lock.json: Generated file

Suppressed comments (5)

Previously missed (1) — in code that hasn't changed since the last review.

sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:33

• ChatMessage is accepted by the update_message dictionary overload, but this Required marks the server-generated message ID as mandatory (and createdAt/etag below are likewise mandatory). Type checkers will therefore reject the supported payload shown in generated_samples/update_message.py, which supplies only createdBy and content. Model these response-only properties as optional in the input shape, or introduce a separate input type, then regenerate.

This issue also appears in the following locations of the same file:

• line 58
• line 80
• line 101
• line 124

sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:58

• The dictionary overload for create_or_replace_role accepts ChatRole, but this makes the role name mandatory in the body even though it is supplied as the role_name path parameter; etag is also response-only. Consequently the generated {"permissions": ...} sample is rejected by static type checking. Separate the request shape from the response shape (or correct property visibility) and regenerate.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:80
• create_or_replace_room documents and generates a title-only dictionary request, but this ChatRoom TypedDict requires the server-populated id, defaultConversation, and etag fields. This makes the generated sample invalid under mypy/pyright. Keep only title required for the request shape and regenerate the public types/API snapshot.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:101
• The create_or_replace_room_member dictionary overload receives room_id and user_id as path parameters, yet this input TypedDict requires userId in the body and also requires the response-only etag. The generated sample correctly sends only roleName, so static type checking rejects a valid request. Define a request shape with only roleName required and regenerate.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:124
• HumanChatUser is used as the dictionary request shape for create_or_replace_user, but it requires the path-supplied id and response-only etag. The generated create-user sample omits both, so consumers following it fail static type checking. Keep kind, nickname, and roleName required for input while making output-only properties non-required, then regenerate.

• Files reviewed: 88/90 changed files
• Comments generated: 0 new
• Review effort level: Balanced (auto)

Files not reviewed (1)

• sdk/webpubsub/azure-messaging-webpubsubchatservice/package-lock.json: Generated file

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/_patch.py:64

• A trailing slash on either endpoint breaks reverse-proxy routing. PipelineClient normalizes the request URL to https://host/api/..., so an origin_endpoint stored as https://host/ no longer matches in ApiManagementProxy; a trailing slash on the proxy can also introduce //api/.... Normalize both endpoints before constructing the policies.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/aio/_patch.py:61
• The async client has the same trailing-slash failure as the sync client: the normalized request URL may not match the stored origin, causing reverse_proxy_endpoint to be bypassed, or the replacement may create a double-slash path. Normalize both endpoint values before building the policies.

• Files reviewed: 88/90 changed files
• Comments generated: 0 new
• Review effort level: Balanced (auto)

Files not reviewed (1)

• sdk/webpubsub/azure-messaging-webpubsubchatservice/package-lock.json: Generated file

Suppressed comments (3)

sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:80

• id is supplied in the operation path and is read-only on ChatRoom, but this dict type requires callers to include it. This contradicts the generated create_or_replace_room sample, whose valid input contains only title; regenerate a writable input shape without response-only fields.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:101
• userId is supplied in the operation path and is read-only on the response model, so requiring it here makes the dict overload reject the generated sample's valid { "roleName": ... } body. Generate a request-specific shape containing only writable fields.
  sdk/webpubsub/azure-messaging-webpubsubchatservice/azure/messaging/webpubsubchatservice/types.py:124
• id is read-only on the user response model (models/_models.py:239) but is Required in the dict accepted by create_or_replace_user. Callers already pass the ID separately as user_id, so the dict overload cannot type-check a normal request; generate a writable user input shape instead.

• Files reviewed: 88/90 changed files
• Comments generated: 2
• Review effort level: Balanced (auto)