@glyphteck/veyl 0.59.0 → 0.60.0

package/dist/account.js

@@ -6263,8 +6263,9 @@ var LOCAL_CHAT_MESSAGE_CACHE_MAX_VISIBLE = 1000;
 var LOCAL_AVATAR_CACHE_MAX_BYTES = 128 * MIB_BYTES;
 var LOCAL_AVATAR_CACHE_MAX_AGE_MS = 30 * DAY_MS;
 var AVATAR_IMAGE_MAX_BYTES = 256 * KIB_BYTES;
-var CHAT_AVATAR_IMAGE_MAX_BYTES = 16 * KIB_BYTES;
-var CHAT_AVATAR_REF_MAX_CHARS = 24 * KIB_BYTES;
+var AVATAR_IMAGE_QUALITY_ATTEMPTS = Object.freeze([0.92, 0.84, 0.76, 0.68]);
+var CHAT_AVATAR_IMAGE_MAX_BYTES = AVATAR_IMAGE_MAX_BYTES;
+var CHAT_AVATAR_REF_MAX_CHARS = 256;
 var CHAT_MESSAGE_FILE_CACHE_MAX_BYTES = 64 * MIB_BYTES;
 var IDLE_CALLBACK_MIN_TIMEOUT_MS = 50;
 var ATTACHMENT_CACHE_IDLE_TIMEOUT_MS = 2500;
@@ -6323,6 +6324,7 @@ var CHAT_RECEIPT_MAX_MEMBERS = 32;
 var CHAT_ORDINARY_DELIVERY_MAX_MEMBERS = 128;
 var CHAT_MAX_MEMBERS = 256;
 var CHAT_MAX_TEXT_CHARS = 2048;
+var CHAT_TITLE_MAX_CHARS = 32;
 var CHAT_MAX_REACTIONS = CHAT_MAX_MEMBERS;
 var SEARCH_DEBOUNCE_MS = 300;
 var RECENT_PEER_REFRESH_LIMIT = 50;
@@ -8730,1849 +8732,1886 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
   };
 }
 
-// ../../core/chat/state.js
-function makeCid() {
-  return `${Date.now().toString(36)}${toHex(randomBytes3(3))}`;
-}
-function getMessageKey(message) {
-  return message?.cid || message?.id || null;
-}
-function getCidMs(cid) {
-  if (typeof cid !== "string" || cid.length <= 6) {
-    return null;
-  }
-  const base = cid.slice(0, -6);
-  const ms = Number.parseInt(base, 36);
-  return Number.isFinite(ms) ? ms : null;
+// ../../core/crypto/file.js
+"use client";
+var FILE_SCOPE = "file-body";
+var FILE_IV_BYTES = 12;
+var FILE_TAG_BYTES = 16;
+function createFileKey() {
+  return randomBytes3(32);
 }
-function getMessageOrderMs(message) {
-  return getCidMs(message?.cid) ?? timestampMs(message?.ts, Infinity);
+function encodeFileKey(key) {
+  return toHex(toBytes32(key, "file key"));
 }
-function sortMessages(messages) {
-  return [...messages].sort((a, b) => {
-    const aMs = getMessageOrderMs(a);
-    const bMs = getMessageOrderMs(b);
-    if (aMs !== bMs) {
-      return aMs - bMs;
-    }
-    return String(a?.id || "").localeCompare(String(b?.id || ""));
-  });
+function decodeFileKey(key) {
+  return toBytes32(key, "file key");
 }
-function mergeMessages(...groups) {
-  const merged = new Map;
-  for (const group of groups) {
-    for (const message of group || []) {
-      const key = getMessageKey(message);
-      if (!key) {
-        continue;
-      }
-      merged.set(key, message);
-    }
+function getFileAadForPath(scope) {
+  if (!scope) {
+    throw new Error("file scope required");
   }
-  return sortMessages([...merged.values()]);
+  return encodeScope(FILE_SCOPE, [scope]);
 }
-
-// ../../core/chat/ids.js
-function isChatMessageForParticipants(message, chatPK, peerChatPK, memberChatPKs = null) {
-  const members = Array.isArray(memberChatPKs) ? new Set(memberChatPKs.filter(Boolean)) : null;
-  if (!chatPK && !peerChatPK && !members?.size) {
-    return true;
+function getSubtleCrypto() {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new Error("WebCrypto AES-GCM unavailable");
   }
-  const sender = typeof message?.s === "string" && message.s ? message.s : typeof message?.from === "string" ? message.from : "";
-  const epochMembers = Array.isArray(message?.epochMemberChatPKs) ? new Set(message.epochMemberChatPKs.filter(Boolean)) : null;
-  return !sender || epochMembers?.has(sender) || members?.has(sender) || sender === chatPK || sender === peerChatPK;
+  return subtle;
 }
-function filterChatMessages(messages, chatPK, peerChatPK, memberChatPKs = null) {
-  return chatPK || peerChatPK || memberChatPKs?.length ? (messages || []).filter((message) => isChatMessageForParticipants(message, chatPK, peerChatPK, memberChatPKs)) : messages || [];
+async function importAesKey(key, usages) {
+  return getSubtleCrypto().importKey("raw", toBytes32(key, "file key"), { name: "AES-GCM" }, false, usages);
 }
-function getChatPeerPK(chatItem) {
-  return chatItem?.lineage === "direct" && chatItem?.memberCount === 2 ? chatItem?.peerChatPK || null : null;
+async function sealFile(key, bytes, scope) {
+  const fileKey = new Uint8Array(toBytes32(key, "file key"));
+  try {
+    const cryptoKey = await importAesKey(fileKey, ["encrypt"]);
+    const iv = randomBytes3(FILE_IV_BYTES);
+    const ct = await getSubtleCrypto().encrypt({
+      name: "AES-GCM",
+      iv,
+      tagLength: FILE_TAG_BYTES * 8,
+      additionalData: getFileAadForPath(scope)
+    }, cryptoKey, toBytes(bytes, "plaintext"));
+    return packBodyData(iv, new Uint8Array(ct));
+  } finally {
+    cleanBytes(fileKey);
+  }
 }
-function getChatPreviewKey(chatItem) {
-  const preview = chatItem?.preview;
-  if (!preview || preview.pending || preview.failed || String(preview?.id || "").startsWith("local:")) {
-    return null;
+async function openFileForPath(key, body, scope) {
+  const fileKey = new Uint8Array(toBytes32(key, "file key"));
+  try {
+    const cryptoKey = await importAesKey(fileKey, ["decrypt"]);
+    const { nonce, ct } = unpackBodyData(body, FILE_IV_BYTES);
+    const pt = await getSubtleCrypto().decrypt({
+      name: "AES-GCM",
+      iv: nonce,
+      tagLength: FILE_TAG_BYTES * 8,
+      additionalData: getFileAadForPath(scope)
+    }, cryptoKey, ct);
+    return new Uint8Array(pt);
+  } finally {
+    cleanBytes(fileKey);
   }
-  return getMessageKey(preview);
 }
 
-// ../../core/chat/protocol.js
-"use client";
-var CHAT_PROTOCOL_VERSION = 3;
-var CHAT_MANIFEST_VERSION = 2;
-var CHAT_TRANSITION_VERSION = 2;
-var CHAT_MESSAGE_ENVELOPE_VERSION = 3;
-var CHAT_SETTINGS_VERSION = 1;
-
-// ../../core/chat/epochs/manifest.js
+// ../../core/chat/filepayload.js
 "use client";
-var CHAT_LINEAGES = Object.freeze({
-  SELF: "self",
-  DIRECT: "direct",
-  GROUP: "group"
-});
-var LINEAGES = new Set(Object.values(CHAT_LINEAGES));
-var HEX_32_RE2 = /^[0-9a-f]{64}$/u;
-function cleanChatHex(value, label = "chat value") {
-  const text = cleanText(value).toLowerCase();
-  if (!HEX_32_RE2.test(text)) {
-    throw new Error(`${label} required`);
+var CHAT_MEDIA_ROOT = "chatEpochs";
+var SHARED_MEDIA_ROOT = "shared";
+var CHAT_MEDIA_TTL_MS2 = CHAT_MEDIA_TTL_MS;
+var MAX_CHAT_UPLOAD_BYTES = CHAT_UPLOAD_MAX_BYTES;
+var CHAT_VIDEO_TRANSCODE_VIDEO_BITRATE_BPS2 = CHAT_VIDEO_TRANSCODE_VIDEO_BITRATE_BPS;
+var CHAT_VIDEO_TRANSCODE_AUDIO_BITRATE_BPS2 = CHAT_VIDEO_TRANSCODE_AUDIO_BITRATE_BPS;
+var CHAT_VIDEO_TRANSCODE_TOTAL_BITRATE_BPS = CHAT_VIDEO_TRANSCODE_VIDEO_BITRATE_BPS2 + CHAT_VIDEO_TRANSCODE_AUDIO_BITRATE_BPS2;
+var CHAT_ID_PATTERN = "[0-9a-fA-F]{64}";
+var SHARED_MEDIA_ID_PATTERN = "[0-9a-fA-F]{32}";
+var MEDIA_ID_PATTERN = "[0-9a-fA-F]{32}";
+var CHAT_MEDIA_FILE_PATTERN = new RegExp(`^${CHAT_MEDIA_ROOT}/(${CHAT_ID_PATTERN})/(${MEDIA_ID_PATTERN})$`);
+var SHARED_MEDIA_FILE_PATTERN = new RegExp(`^${SHARED_MEDIA_ROOT}/(${SHARED_MEDIA_ID_PATTERN})$`);
+function cleanMediaEpochId(value) {
+  const epochId = String(value || "").trim();
+  if (!new RegExp(`^${CHAT_ID_PATTERN}$`).test(epochId)) {
+    throw new Error("invalid media epoch id");
   }
-  return text;
+  return epochId.toLowerCase();
 }
-function cleanUid(value) {
-  const uid = cleanText(value);
-  if (!uid || uid.length > 128) {
-    throw new Error("chat member uid required");
+function cleanMediaId(value) {
+  const mediaId = String(value || "").trim();
+  if (!new RegExp(`^${MEDIA_ID_PATTERN}$`).test(mediaId)) {
+    throw new Error("invalid media id");
   }
-  return uid;
+  return mediaId.toLowerCase();
 }
-function cleanCreatedAt(value) {
-  if (!Number.isSafeInteger(value) || value <= 0) {
-    throw new Error("chat epoch createdAt required");
+function cleanSharedMediaId(value) {
+  const sharedId = String(value || "").trim();
+  if (!new RegExp(`^${SHARED_MEDIA_ID_PATTERN}$`).test(sharedId)) {
+    throw new Error("invalid shared media id");
   }
-  return value;
+  return sharedId.toLowerCase();
 }
-function cleanEpochVersion(value) {
-  if (!Number.isSafeInteger(value) || value <= 0) {
-    throw new Error("chat epoch version required");
-  }
-  return value;
+function makeChatMediaId() {
+  return toHex(randomBytes3(16));
 }
-function cleanMember(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("invalid chat member");
-  }
-  return {
-    uid: cleanUid(value.uid),
-    chatPK: cleanChatHex(value.chatPK, "member chat key"),
-    chatSigningPK: cleanChatHex(value.chatSigningPK, "member signing key"),
-    notificationPK: cleanChatHex(value.notificationPK, "member notification key"),
-    mlsLeafId: cleanChatHex(value.mlsLeafId, "member mls leaf id")
-  };
+function mediaFilePath(epochId, mediaId) {
+  const nextEpochId = cleanMediaEpochId(epochId);
+  const nextMediaId = cleanMediaId(mediaId);
+  return `${CHAT_MEDIA_ROOT}/${nextEpochId}/${nextMediaId}`;
 }
-function assertUniqueMembers(members) {
-  const uids = new Set;
-  const chatKeys = new Set;
-  const signingKeys = new Set;
-  const mlsLeafIds = new Set;
-  for (const member of members) {
-    if (uids.has(member.uid) || chatKeys.has(member.chatPK) || signingKeys.has(member.chatSigningPK) || mlsLeafIds.has(member.mlsLeafId)) {
-      throw new Error("duplicate chat member");
-    }
-    uids.add(member.uid);
-    chatKeys.add(member.chatPK);
-    signingKeys.add(member.chatSigningPK);
-    mlsLeafIds.add(member.mlsLeafId);
-  }
+function sharedMediaFilePath(sharedId) {
+  const nextSharedId = cleanSharedMediaId(sharedId);
+  return `${SHARED_MEDIA_ROOT}/${nextSharedId}`;
 }
-function assertLineage(manifest, parent) {
-  const memberCount = manifest.members.length;
-  if (memberCount > 2 && manifest.lineage !== CHAT_LINEAGES.GROUP) {
-    throw new Error("group lineage required");
-  }
-  if (!parent) {
-    return;
+function makeSharedMediaId() {
+  return toHex(randomBytes3(16));
+}
+function getMediaFileRef(path) {
+  const value = String(path || "").trim();
+  const chatMatch = value.match(CHAT_MEDIA_FILE_PATTERN);
+  if (chatMatch?.[1] && chatMatch?.[2]) {
+    return {
+      type: "chat",
+      epochId: chatMatch[1].toLowerCase(),
+      mediaId: chatMatch[2].toLowerCase()
+    };
   }
-  if (manifest.chatId !== parent.chatId || manifest.parentEpochId !== parent.epochId || manifest.epochVersion !== parent.epochVersion + 1) {
-    throw new Error("invalid chat epoch successor");
+  const sharedMatch = value.match(SHARED_MEDIA_FILE_PATTERN);
+  if (sharedMatch?.[1]) {
+    return {
+      type: "shared",
+      sharedId: sharedMatch[1].toLowerCase()
+    };
   }
-  if (parent.lineage === CHAT_LINEAGES.GROUP && manifest.lineage !== CHAT_LINEAGES.GROUP) {
-    throw new Error("chat group lineage is permanent");
+  throw new Error("invalid media file path");
+}
+function getChatMediaFileRef(path) {
+  const ref = getMediaFileRef(path);
+  if (ref?.type !== "chat") {
+    throw new Error("invalid media file path");
   }
+  return ref;
 }
-function normalizeEpochManifest(value, options = {}) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("chat manifest required");
+function getSharedMediaFileRef(path) {
+  const ref = getMediaFileRef(path);
+  if (ref?.type !== "shared") {
+    throw new Error("invalid shared media file path");
   }
-  if (value.v !== CHAT_MANIFEST_VERSION || value.protocol !== CHAT_PROTOCOL_VERSION) {
-    throw new Error("unsupported chat manifest");
+  return ref;
+}
+function uploadByteLength(value) {
+  if (Number.isFinite(value?.byteLength)) {
+    return value.byteLength;
   }
-  if (!Array.isArray(value.members) || value.members.length < 1 || value.members.length > CHAT_MAX_MEMBERS) {
-    throw new Error("invalid chat member count");
+  if (Number.isFinite(value?.size)) {
+    return value.size;
   }
-  const lineage = cleanText(value.lineage);
-  if (!LINEAGES.has(lineage)) {
-    throw new Error("invalid chat lineage");
-  }
-  const members = value.members.map(cleanMember).sort((a, b) => a.chatPK.localeCompare(b.chatPK));
-  assertUniqueMembers(members);
-  const manifest = {
-    v: CHAT_MANIFEST_VERSION,
-    protocol: CHAT_PROTOCOL_VERSION,
-    chatId: cleanChatHex(value.chatId, "chat id"),
-    epochId: cleanChatHex(value.epochId, "chat epoch id"),
-    epochVersion: cleanEpochVersion(value.epochVersion),
-    parentEpochId: value.parentEpochId == null ? null : cleanChatHex(value.parentEpochId, "parent epoch id"),
-    createdAt: cleanCreatedAt(value.createdAt),
-    lineage,
-    members
-  };
-  if (manifest.epochVersion === 1 !== (manifest.parentEpochId === null)) {
-    throw new Error("invalid parent epoch");
-  }
-  const bytes = canonicalBytes(manifest, "chat manifest");
-  if (bytes.length > CHAT_MANIFEST_MAX_BYTES) {
-    throw new Error("chat manifest too large");
+  if (Number.isFinite(value)) {
+    return value;
   }
-  assertLineage(manifest, options.parent || null);
-  return manifest;
-}
-function epochManifestDigest(manifest) {
-  return toHex(sha256(canonicalBytes(normalizeEpochManifest(manifest), "chat manifest digest")));
-}
-function manifestMember(manifest, chatPK) {
-  const key = cleanChatHex(chatPK, "member chat key");
-  return normalizeEpochManifest(manifest).members.find((member) => member.chatPK === key) || null;
-}
-function manifestSigningKeys(manifest) {
-  return Object.fromEntries(normalizeEpochManifest(manifest).members.map((member) => [member.chatPK, member.chatSigningPK]));
+  return null;
 }
-
-// ../../core/chat/direct.js
-"use client";
-function orderedChatKeys(first, second) {
-  return [
-    cleanChatHex(first, "chat public key"),
-    cleanChatHex(second, "peer chat public key")
-  ].sort();
+function makeChatUploadTooLargeError(bytes, maxBytes = MAX_CHAT_UPLOAD_BYTES) {
+  const error = new Error("upload too large");
+  error.code = "upload-too-large";
+  error.maxBytes = maxBytes;
+  if (Number.isFinite(bytes)) {
+    error.bytes = bytes;
+  }
+  return error;
 }
-function findDirectChat(chats, peerChatPK) {
-  const peer = cleanChatHex(peerChatPK, "peer chat public key");
-  return (chats || []).find((chat) => chat?.lineage === "direct" && chat?.peerChatPK === peer) || null;
+function assertChatUploadByteSize(bytes, maxBytes = MAX_CHAT_UPLOAD_BYTES) {
+  const length = uploadByteLength(bytes);
+  if (!Number.isFinite(length)) {
+    throw new Error("upload bytes required");
+  }
+  if (length <= 0 || length > maxBytes) {
+    throw makeChatUploadTooLargeError(length, maxBytes);
+  }
+  return length;
 }
-function deriveDirectRouteId(chatPrivateKey, chatPK, peerChatPK) {
-  const ownChatPK = cleanChatHex(chatPK, "chat public key");
-  const otherChatPK = cleanChatHex(peerChatPK, "peer chat public key");
-  if (ownChatPK === otherChatPK) {
-    throw new Error("direct peer chat key required");
+async function toUploadBytes(data) {
+  if (typeof Blob !== "undefined" && data instanceof Blob) {
+    if (typeof data.arrayBuffer === "function") {
+      return new Uint8Array(await data.arrayBuffer());
+    }
+    if (typeof FileReader !== "undefined") {
+      return new Promise((resolve, reject) => {
+        const reader = new FileReader;
+        reader.onload = () => resolve(new Uint8Array(reader.result));
+        reader.onerror = () => reject(reader.error || new Error("blob read failed"));
+        reader.readAsArrayBuffer(data);
+      });
+    }
+    if (typeof Response !== "undefined") {
+      return new Uint8Array(await new Response(data).arrayBuffer());
+    }
   }
-  let peerKey = null;
-  let shared = null;
-  let routeId = null;
+  if (typeof data?.arrayBuffer === "function") {
+    return new Uint8Array(await data.arrayBuffer());
+  }
+  return toBytes(data, "upload bytes");
+}
+async function makeChatFileUploadPayload(epochId, cid, data, { cacheControl = "private, max-age=0, no-transform" } = {}) {
+  const nextEpochId = cleanMediaEpochId(epochId);
+  const mediaId = makeChatMediaId();
+  const path = mediaFilePath(nextEpochId, mediaId);
+  const expiresAt = Date.now() + CHAT_MEDIA_TTL_MS2;
+  const key = createFileKey();
   try {
-    peerKey = fromHex(otherChatPK, "peer chat public key");
-    shared = x25519.getSharedSecret(toBytes32(chatPrivateKey, "chat private key"), peerKey);
-    routeId = deriveKey(shared, "direct-route-id-v3", orderedChatKeys(ownChatPK, otherChatPK));
-    return toHex(routeId);
+    const uploadBytes = await toUploadBytes(data);
+    assertChatUploadByteSize(uploadBytes);
+    const body = await sealFile(key, uploadBytes, path);
+    assertChatUploadByteSize(body);
+    return {
+      epochId: nextEpochId,
+      mediaId,
+      path,
+      body,
+      metadata: {
+        contentType: "application/octet-stream",
+        cacheControl
+      },
+      file: {
+        p: path,
+        k: encodeFileKey(key),
+        x: expiresAt
+      }
+    };
+  } catch (error) {
+    if (error && typeof error === "object") {
+      error.path = error?.path || path;
+      error.cid = error?.cid || cid;
+    }
+    throw error;
   } finally {
-    cleanBytes(peerKey, shared, routeId);
+    cleanBytes(key);
   }
 }
-function deriveSelfChatId(chatPrivateKey, chatPK) {
-  const ownChatPK = cleanChatHex(chatPK, "chat public key");
-  let chatId = null;
+async function makeSharedFileUploadPayload(data, { contentType = "application/octet-stream", cacheControl = "private, max-age=0, no-transform" } = {}) {
+  const sharedId = makeSharedMediaId();
+  const path = sharedMediaFilePath(sharedId);
+  const expiresAt = Date.now() + CHAT_MEDIA_TTL_MS2;
+  const key = createFileKey();
   try {
-    chatId = deriveKey(toBytes32(chatPrivateKey, "chat private key"), "self-chat-id-v3", [ownChatPK]);
-    return toHex(chatId);
+    const uploadBytes = await toUploadBytes(data);
+    assertChatUploadByteSize(uploadBytes);
+    const body = await sealFile(key, uploadBytes, path);
+    assertChatUploadByteSize(body);
+    return {
+      sharedId,
+      path,
+      body,
+      metadata: {
+        contentType,
+        cacheControl
+      },
+      file: {
+        p: path,
+        k: encodeFileKey(key),
+        x: expiresAt
+      }
+    };
+  } catch (error) {
+    if (error && typeof error === "object") {
+      error.path = error?.path || path;
+      error.sharedId = error?.sharedId || sharedId;
+    }
+    throw error;
   } finally {
-    cleanBytes(chatId);
+    cleanBytes(key);
   }
 }
 
-// ../../core/chat/errors.js
-function makeChatUnavailableError() {
-  const error = new Error("chat unavailable");
-  error.code = "permission-denied";
-  return error;
-}
-function makeMessageSaveUnavailableError() {
-  const error = new Error("this message can't be saved anymore");
-  error.code = "message-unavailable";
-  return error;
-}
-function isMessageSaveUnavailableError(error) {
-  return String(error?.code || "").toLowerCase() === "message-unavailable";
+// ../../core/files.js
+"use client";
+function makeFileId(size = 8) {
+  return toHex(randomBytes3(size));
 }
-function normalizeMessageSaveError(error) {
-  if (isMessageSaveUnavailableError(error)) {
+function setErrorStage(error, stage, extra = {}) {
+  if (!error || typeof error !== "object") {
     return error;
   }
-  const code = String(error?.code || "").toLowerCase();
-  if (code === "7" || code === "not-found" || code.endsWith("/not-found") || code === "permission-denied" || code.endsWith("/permission-denied")) {
-    return makeMessageSaveUnavailableError();
-  }
+  error.stage = error?.stage || stage;
+  Object.assign(error, extra);
   return error;
 }
-
-// ../../core/chat/epochs/state.js
-"use client";
-var CAPABILITY_WITNESS_SCOPE = "veyl-chat-state-witness-v3:";
-var CAPABILITY_COMMITMENT_SCOPE = "veyl-chat-state-commitment-v3:";
-function randomChatId() {
-  return toHex(randomBytes3(32));
-}
-function hashText(value) {
-  return toHex(sha256(encoder.encode(value)));
-}
-function stateCapabilityWitness(value) {
-  return hashText(`${CAPABILITY_WITNESS_SCOPE}${toHex(toBytes32(value, "state capability"))}`);
-}
-function stateCapabilityCommitment(value) {
-  return hashText(`${CAPABILITY_COMMITMENT_SCOPE}${stateCapabilityWitness(value)}`);
-}
-function deriveEpochKeys(epochSecret, manifestValue) {
-  const manifest = normalizeEpochManifest(manifestValue);
-  const root = deriveKey(toBytes32(epochSecret, "epoch secret"), "chat-epoch-root-v3", [
-    manifest.chatId,
-    manifest.epochId,
-    manifest.epochVersion
-  ]);
-  let settingsIdBytes = null;
-  let messageLaneBytes = null;
-  let stateLaneBytes = null;
+async function makeChatFileUpload(epochId, cid, data, { cacheControl = "private, max-age=0, no-transform" } = {}) {
   try {
-    settingsIdBytes = deriveKey(root, "chat-epoch-settings-id-v3");
-    messageLaneBytes = deriveKey(root, "chat-epoch-message-lane-v3");
-    stateLaneBytes = deriveKey(root, "chat-epoch-member-state-lane-v3");
-    return {
-      root,
-      bodyKey: deriveKey(root, "chat-epoch-body-v3"),
-      settingsKey: deriveKey(root, "chat-epoch-settings-v3"),
-      settingsId: toHex(settingsIdBytes),
-      messageLane: toHex(messageLaneBytes),
-      stateLane: toHex(stateLaneBytes),
-      stateKey: deriveKey(root, "chat-epoch-member-state-v3")
-    };
+    return await makeChatFileUploadPayload(epochId, cid, data, {
+      cacheControl
+    });
   } catch (error) {
-    cleanBytes(root);
-    throw error;
-  } finally {
-    cleanBytes(settingsIdBytes, messageLaneBytes, stateLaneBytes);
+    throw setErrorStage(error, "encrypt", {
+      ...error?.path ? { path: error.path } : {},
+      cid
+    });
   }
 }
-function closeEpochKeys(keys) {
-  cleanBytes(keys?.root, keys?.bodyKey, keys?.settingsKey, keys?.stateKey);
-}
-function ownerEpochEntryId(chatPrivateKey, chatId, epochId) {
-  const value = deriveKey(toBytes32(chatPrivateKey, "chat private key"), "user-chat-epoch-entry-id-v3", [
-    cleanChatHex(chatId, "chat id"),
-    cleanChatHex(epochId, "chat epoch id")
-  ], 16);
+async function putChatFile(epochId, cid, data, options) {
+  const upload = await makeChatFileUpload(epochId, cid, data, options);
   try {
-    return toHex(value);
-  } finally {
-    cleanBytes(value);
+    if (typeof options?.uploadChatMedia !== "function") {
+      throw new Error("chat media upload required");
+    }
+    await options.uploadChatMedia(upload);
+    return upload.file;
+  } catch (error) {
+    throw setErrorStage(error, "upload", { path: upload.path, cid });
   }
 }
-function secretHex(value, label) {
-  return typeof value === "string" ? cleanChatHex(value, label) : toHex(toBytes32(value, label));
-}
-function secretBytes(value, label) {
-  return fromHex(cleanChatHex(value, label), label);
-}
-
-// ../../core/crypto/base64.js
-"use client";
-var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-var VALUE_BY_CHAR = new Map([...ALPHABET].map((char, index) => [char, index]));
-function bytesBase64Url(value, label = "base64url bytes") {
-  const bytes = toBytes(value, label);
-  let output = "";
-  for (let index = 0;index < bytes.length; index += 3) {
-    const a = bytes[index];
-    const hasB = index + 1 < bytes.length;
-    const hasC = index + 2 < bytes.length;
-    const b = hasB ? bytes[index + 1] : 0;
-    const c = hasC ? bytes[index + 2] : 0;
-    output += ALPHABET[a >>> 2];
-    output += ALPHABET[(a & 3) << 4 | b >>> 4];
-    if (hasB)
-      output += ALPHABET[(b & 15) << 2 | c >>> 6];
-    if (hasC)
-      output += ALPHABET[c & 63];
+async function makeSharedFileUpload(data, { contentType = "application/octet-stream", cacheControl = "private, max-age=0, no-transform" } = {}) {
+  try {
+    return await makeSharedFileUploadPayload(data, {
+      contentType,
+      cacheControl
+    });
+  } catch (error) {
+    throw setErrorStage(error, "encrypt", {
+      ...error?.path ? { path: error.path } : {}
+    });
   }
-  return output;
 }
-function base64UrlBytes(value, label = "base64url") {
-  const text = typeof value === "string" ? value.trim() : "";
-  if (!text || text.length % 4 === 1 || !/^[A-Za-z0-9_-]+$/u.test(text)) {
-    throw new Error(`invalid ${label}`);
+async function putSharedFile(data, options = {}) {
+  const upload = await makeSharedFileUpload(data, options);
+  try {
+    if (typeof options?.uploadSharedMedia !== "function") {
+      throw new Error("shared media upload required");
+    }
+    await options.uploadSharedMedia(upload);
+    return upload.file;
+  } catch (error) {
+    throw setErrorStage(error, "upload", { path: upload.path });
   }
-  const output = new Uint8Array(Math.floor(text.length * 6 / 8));
-  let bits = 0;
-  let bitCount = 0;
-  let offset = 0;
-  for (const char of text) {
-    const next = VALUE_BY_CHAR.get(char);
-    if (next == null)
-      throw new Error(`invalid ${label}`);
-    bits = bits << 6 | next;
-    bitCount += 6;
-    if (bitCount >= 8) {
-      bitCount -= 8;
-      output[offset++] = bits >>> bitCount & 255;
-      bits &= bitCount ? (1 << bitCount) - 1 : 0;
+}
+async function readChatFile(readChatMedia, file) {
+  let body;
+  try {
+    if (typeof readChatMedia !== "function") {
+      throw new Error("chat media read required");
     }
+    body = await readChatMedia(file?.p);
+  } catch (error) {
+    error.path = error?.path || file?.p || null;
+    error.stage = error?.stage || "download";
+    throw error;
+  }
+  try {
+    getMediaFileRef(file?.p);
+    const bytes = await openFileForPath(decodeFileKey(file?.k), body, file?.p);
+    return bytes;
+  } catch (error) {
+    error.path = file?.p || null;
+    error.stage = "decrypt";
+    throw error;
   }
-  return output;
 }
 
-// ../../core/chat/messages/actions.js
+// ../../core/chat/avatar.js
 "use client";
-var CHAT_ACTION_VERSION = 3;
-var CHAT_ACTION_OPS = Object.freeze({
-  CREATE: "create",
-  EDIT: "edit",
-  PAY_CONFIRM: "pay_confirm",
-  REACTION: "rxn",
-  DELETE: "del",
-  SYSTEM: "sys",
-  EPOCH: "epoch"
-});
-var CHAT_ACTION_OP_SET = new Set(Object.values(CHAT_ACTION_OPS));
-var CONTROL_OP_BY_TYPE = Object.freeze({
-  rxn: CHAT_ACTION_OPS.REACTION,
-  del: CHAT_ACTION_OPS.DELETE,
-  sys: CHAT_ACTION_OPS.SYSTEM,
-  epoch: CHAT_ACTION_OPS.EPOCH
-});
-function isChatActionOp(value) {
-  return CHAT_ACTION_OP_SET.has(value);
+var CHAT_AVATAR_REF_PREFIX = "v1:";
+var FILE_KEY_RE = /^[0-9a-f]{64}$/u;
+function chatAvatarFile(value) {
+  const ref = typeof value === "string" ? value.trim() : "";
+  if (!ref.startsWith(CHAT_AVATAR_REF_PREFIX) || ref.length > CHAT_AVATAR_REF_MAX_CHARS)
+    return null;
+  const parts = ref.split(":");
+  const key = parts[2]?.toLowerCase();
+  if (parts.length !== 3 || parts[0] !== "v1" || !FILE_KEY_RE.test(key))
+    return null;
+  let parsed;
+  try {
+    parsed = getChatMediaFileRef(parts[1]);
+  } catch {
+    return null;
+  }
+  return Object.freeze({
+    t: "img",
+    m: "image/webp",
+    p: mediaFilePath(parsed.epochId, parsed.mediaId),
+    k: key
+  });
 }
-function cleanChatActionOp(value) {
-  const op = cleanText(value);
-  if (!isChatActionOp(op)) {
-    throw new Error("unsupported chat action op");
+function makeChatAvatarRef(file) {
+  let parsed;
+  const path = cleanText(file?.p);
+  const key = cleanText(file?.k).toLowerCase();
+  try {
+    parsed = getChatMediaFileRef(path);
+  } catch {
+    throw new Error("invalid chat avatar");
   }
-  return op;
+  if (!FILE_KEY_RE.test(key))
+    throw new Error("invalid chat avatar");
+  const ref = `${CHAT_AVATAR_REF_PREFIX}${mediaFilePath(parsed.epochId, parsed.mediaId)}:${key}`;
+  if (ref.length > CHAT_AVATAR_REF_MAX_CHARS)
+    throw new Error("invalid chat avatar");
+  return ref;
 }
-function actionOpForPayload(payload, fallback = CHAT_ACTION_OPS.CREATE) {
-  return CONTROL_OP_BY_TYPE[cleanText(payload?.t)] || fallback;
+function cleanChatAvatarRef(value) {
+  if (value == null)
+    return null;
+  const file = chatAvatarFile(value);
+  if (!file)
+    throw new Error("invalid chat avatar");
+  return makeChatAvatarRef(file);
 }
-
-// ../../core/crypto/chat.js
-"use client";
-var MSG_BODY_VERSION = CHAT_MESSAGE_ENVELOPE_VERSION;
-var MSG_BODY_SUITE_XCHACHA_ED25519 = 1;
-var MSG_SIGN_SCOPE_BYTES = encoder.encode("veyl-chat-msg-v3-sign");
-var MSG_BODY_FLAGS_NONE = 0;
-var ED25519_SIGNATURE_BYTES = 64;
-var MSG_BODY_HEADER_BYTES = 1 + 1 + 1 + BOX_NONCE_BYTES + ED25519_SIGNATURE_BYTES;
-function hasMsgHead(data) {
-  return typeof data?.head?.cid === "string" && !!data.head.cid;
+function assertChatAvatarBytes(value) {
+  const bytes = Number(value?.byteLength ?? value?.size);
+  if (!Number.isSafeInteger(bytes) || bytes <= 0 || bytes > CHAT_AVATAR_IMAGE_MAX_BYTES) {
+    throw new Error("invalid chat avatar");
+  }
+  return bytes;
 }
-function hasMsgBody(data) {
-  return data?.body != null;
+
+// ../../core/chat/state.js
+function makeCid() {
+  return `${Date.now().toString(36)}${toHex(randomBytes3(3))}`;
 }
-function hasMsgData(data) {
-  return hasMsgHead(data) && hasMsgBody(data);
+function getMessageKey(message) {
+  return message?.cid || message?.id || null;
 }
-function cleanSigningKey(value) {
-  const secret = value?.secret;
-  const publicKey = cleanChatHex(value?.publicKey, "chat signing public key");
-  if (!secret) {
-    throw new Error("chat signing secret required");
+function getCidMs(cid) {
+  if (typeof cid !== "string" || cid.length <= 6) {
+    return null;
   }
-  return { secret, publicKey };
+  const base = cid.slice(0, -6);
+  const ms = Number.parseInt(base, 36);
+  return Number.isFinite(ms) ? ms : null;
 }
-function openChatEpoch({ manifest: manifestValue, epochSecret, actor = null } = {}) {
-  const manifest = normalizeEpochManifest(manifestValue);
-  const keys = deriveEpochKeys(epochSecret, manifest);
-  let normalizedActor = null;
-  try {
-    if (actor) {
-      const chatPK = cleanChatHex(actor.chatPK, "chat actor key");
-      const signingKey = cleanSigningKey(actor.signingKey);
-      const member = manifestMember(manifest, chatPK);
-      if (!member || member.chatSigningPK !== signingKey.publicKey) {
-        throw new Error("chat actor is not an epoch member");
+function getMessageOrderMs(message) {
+  return getCidMs(message?.cid) ?? timestampMs(message?.ts, Infinity);
+}
+function sortMessages(messages) {
+  return [...messages].sort((a, b) => {
+    const aMs = getMessageOrderMs(a);
+    const bMs = getMessageOrderMs(b);
+    if (aMs !== bMs) {
+      return aMs - bMs;
+    }
+    return String(a?.id || "").localeCompare(String(b?.id || ""));
+  });
+}
+function mergeMessages(...groups) {
+  const merged = new Map;
+  for (const group of groups) {
+    for (const message of group || []) {
+      const key = getMessageKey(message);
+      if (!key) {
+        continue;
       }
-      normalizedActor = { chatPK, signingKey };
+      merged.set(key, message);
     }
-    return {
-      protocol: CHAT_PROTOCOL_VERSION,
-      chatId: manifest.chatId,
-      epochId: manifest.epochId,
-      epochVersion: manifest.epochVersion,
-      manifest,
-      actor: normalizedActor,
-      ...keys
-    };
-  } catch (error) {
-    closeEpochKeys(keys);
-    throw error;
   }
+  return sortMessages([...merged.values()]);
 }
-function closeChatEpoch(epoch) {
-  closeEpochKeys(epoch);
-}
-function getHead(message) {
-  const cid = cleanText(message?.cid);
-  if (!cid || cid.length > 256) {
-    throw new Error("message cid required");
+
+// ../../core/chat/ids.js
+function isChatMessageForParticipants(message, chatPK, peerChatPK, memberChatPKs = null) {
+  const members = Array.isArray(memberChatPKs) ? new Set(memberChatPKs.filter(Boolean)) : null;
+  if (!chatPK && !peerChatPK && !members?.size) {
+    return true;
   }
-  return { cid };
+  const sender = typeof message?.s === "string" && message.s ? message.s : typeof message?.from === "string" ? message.from : "";
+  const epochMembers = Array.isArray(message?.epochMemberChatPKs) ? new Set(message.epochMemberChatPKs.filter(Boolean)) : null;
+  return !sender || epochMembers?.has(sender) || members?.has(sender) || sender === chatPK || sender === peerChatPK;
 }
-function getPayload(message) {
-  const payload = { ...message || {} };
-  delete payload.cid;
-  delete payload.from;
-  delete payload.s;
-  return payload;
+function filterChatMessages(messages, chatPK, peerChatPK, memberChatPKs = null) {
+  return chatPK || peerChatPK || memberChatPKs?.length ? (messages || []).filter((message) => isChatMessageForParticipants(message, chatPK, peerChatPK, memberChatPKs)) : messages || [];
 }
-function getMsgAad(epoch, head, suite = MSG_BODY_SUITE_XCHACHA_ED25519, flags = MSG_BODY_FLAGS_NONE) {
-  return canonicalBytes({
-    v: MSG_BODY_VERSION,
-    protocol: CHAT_PROTOCOL_VERSION,
-    chatId: epoch.chatId,
-    epochId: epoch.epochId,
-    epochVersion: epoch.epochVersion,
-    cid: head.cid,
-    suite,
-    flags
-  }, "chat message aad");
+function getChatPeerPK(chatItem) {
+  return chatItem?.lineage === "direct" && chatItem?.memberCount === 2 ? chatItem?.peerChatPK || null : null;
 }
-function getSignatureInput(aad, nonce, ct) {
-  return concatBytes4(MSG_SIGN_SCOPE_BYTES, aad, nonce, ct);
+function getChatPreviewKey(chatItem) {
+  const preview = chatItem?.preview;
+  if (!preview || preview.pending || preview.failed || String(preview?.id || "").startsWith("local:")) {
+    return null;
+  }
+  return getMessageKey(preview);
 }
-function batchRecordId(record) {
-  return cleanText(record?.id) || cleanText(record?.recordId) || cleanText(record?.head?.cid);
+
+// ../../core/chat/protocol.js
+"use client";
+var CHAT_PROTOCOL_VERSION = 3;
+var CHAT_MANIFEST_VERSION = 2;
+var CHAT_TRANSITION_VERSION = 2;
+var CHAT_MESSAGE_ENVELOPE_VERSION = 3;
+var CHAT_SETTINGS_VERSION = 1;
+
+// ../../core/chat/epochs/manifest.js
+"use client";
+var CHAT_LINEAGES = Object.freeze({
+  SELF: "self",
+  DIRECT: "direct",
+  GROUP: "group"
+});
+var LINEAGES = new Set(Object.values(CHAT_LINEAGES));
+var HEX_32_RE2 = /^[0-9a-f]{64}$/u;
+function cleanChatHex(value, label = "chat value") {
+  const text = cleanText(value).toLowerCase();
+  if (!HEX_32_RE2.test(text)) {
+    throw new Error(`${label} required`);
+  }
+  return text;
 }
-function makeBatchOpenRequest(epoch, records) {
-  return {
-    records: (records || []).map((record) => ({
-      id: batchRecordId(record),
-      head: record?.head,
-      body: record?.body
-    })),
-    protocol: CHAT_PROTOCOL_VERSION,
-    chatId: epoch.chatId,
-    epochId: epoch.epochId,
-    epochVersion: epoch.epochVersion,
-    bodyKey: epoch.bodyKey,
-    manifest: epoch.manifest,
-    signingKeysByChatKey: manifestSigningKeys(epoch.manifest)
-  };
+function cleanUid(value) {
+  const uid = cleanText(value);
+  if (!uid || uid.length > 128) {
+    throw new Error("chat member uid required");
+  }
+  return uid;
 }
-function cleanActionTimestamp(value) {
-  if (typeof value !== "number" || !Number.isFinite(value)) {
-    throw new Error("chat action ts required");
+function cleanCreatedAt(value) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error("chat epoch createdAt required");
   }
-  return Object.is(value, -0) ? 0 : value;
+  return value;
 }
-function normalizePlainPayload(payload) {
-  if (payload == null)
-    return {};
-  if (typeof payload !== "object" || Array.isArray(payload)) {
-    throw new Error("invalid chat action payload");
+function cleanEpochVersion(value) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error("chat epoch version required");
   }
-  return payload;
+  return value;
 }
-function makeMsgAction(epoch, head, message, options = {}) {
-  if (!epoch?.actor?.chatPK || !epoch?.actor?.signingKey) {
-    throw new Error("chat epoch actor required");
+function cleanMember(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("invalid chat member");
   }
-  const target = cleanText(options.target);
   return {
-    v: CHAT_ACTION_VERSION,
-    op: cleanChatActionOp(cleanText(options.op) || actionOpForPayload(message)),
-    id: cleanText(options.id) || head.cid,
-    ...target ? { target } : {},
-    actor: epoch.actor.chatPK,
-    ts: Number.isFinite(options.ts) ? options.ts : Date.now(),
-    p: getPayload(message)
+    uid: cleanUid(value.uid),
+    chatPK: cleanChatHex(value.chatPK, "member chat key"),
+    chatSigningPK: cleanChatHex(value.chatSigningPK, "member signing key"),
+    notificationPK: cleanChatHex(value.notificationPK, "member notification key"),
+    mlsLeafId: cleanChatHex(value.mlsLeafId, "member mls leaf id")
   };
 }
-function packMsgBody({ suite = MSG_BODY_SUITE_XCHACHA_ED25519, flags = MSG_BODY_FLAGS_NONE, nonce, sig, ct }) {
-  const nonceBytes = toBytes(nonce, "chat message nonce");
-  const sigBytes = typeof sig === "string" ? fromHexBytes(sig, "chat message signature") : toBytes(sig, "chat message signature");
-  const ctBytes = toBytes(ct, "chat message ciphertext");
-  if (suite !== MSG_BODY_SUITE_XCHACHA_ED25519 || flags !== MSG_BODY_FLAGS_NONE) {
-    throw new Error("unsupported chat message suite");
-  }
-  if (nonceBytes.length !== BOX_NONCE_BYTES || sigBytes.length !== ED25519_SIGNATURE_BYTES) {
-    throw new Error("invalid chat message signature envelope");
+function assertUniqueMembers(members) {
+  const uids = new Set;
+  const chatKeys = new Set;
+  const signingKeys = new Set;
+  const mlsLeafIds = new Set;
+  for (const member of members) {
+    if (uids.has(member.uid) || chatKeys.has(member.chatPK) || signingKeys.has(member.chatSigningPK) || mlsLeafIds.has(member.mlsLeafId)) {
+      throw new Error("duplicate chat member");
+    }
+    uids.add(member.uid);
+    chatKeys.add(member.chatPK);
+    signingKeys.add(member.chatSigningPK);
+    mlsLeafIds.add(member.mlsLeafId);
   }
-  const out = new Uint8Array(MSG_BODY_HEADER_BYTES + ctBytes.length);
-  out[0] = MSG_BODY_VERSION;
-  out[1] = suite;
-  out[2] = flags;
-  out.set(nonceBytes, 3);
-  out.set(sigBytes, 3 + BOX_NONCE_BYTES);
-  out.set(ctBytes, MSG_BODY_HEADER_BYTES);
-  return out;
 }
-function unpackMsgBody(body) {
-  const bytes = toBytes(body, "chat message body");
-  if (bytes.length <= MSG_BODY_HEADER_BYTES || bytes[0] !== MSG_BODY_VERSION) {
-    throw new Error("unsupported chat message body");
+function assertLineage(manifest, parent) {
+  const memberCount = manifest.members.length;
+  if (memberCount > 2 && manifest.lineage !== CHAT_LINEAGES.GROUP) {
+    throw new Error("group lineage required");
   }
-  if (bytes[1] !== MSG_BODY_SUITE_XCHACHA_ED25519 || bytes[2] !== MSG_BODY_FLAGS_NONE) {
-    throw new Error("unsupported chat message suite");
+  if (!parent) {
+    return;
+  }
+  if (manifest.chatId !== parent.chatId || manifest.parentEpochId !== parent.epochId || manifest.epochVersion !== parent.epochVersion + 1) {
+    throw new Error("invalid chat epoch successor");
+  }
+  if (parent.lineage === CHAT_LINEAGES.GROUP && manifest.lineage !== CHAT_LINEAGES.GROUP) {
+    throw new Error("chat group lineage is permanent");
   }
-  return {
-    suite: bytes[1],
-    flags: bytes[2],
-    nonce: bytes.subarray(3, 3 + BOX_NONCE_BYTES),
-    sig: bytes.subarray(3 + BOX_NONCE_BYTES, MSG_BODY_HEADER_BYTES),
-    ct: bytes.subarray(MSG_BODY_HEADER_BYTES)
-  };
 }
-function normalizeOpenedAction(epoch, head, action) {
-  if (!action || typeof action !== "object" || Array.isArray(action) || action.v !== CHAT_ACTION_VERSION) {
-    throw new Error("unsupported chat action");
+function normalizeEpochManifest(value, options = {}) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("chat manifest required");
   }
-  const id = cleanText(action.id);
-  if (!id || id !== head.cid) {
-    throw new Error("chat action id mismatch");
+  if (value.v !== CHAT_MANIFEST_VERSION || value.protocol !== CHAT_PROTOCOL_VERSION) {
+    throw new Error("unsupported chat manifest");
   }
-  const sender = cleanChatHex(action.actor, "chat action actor");
-  const member = manifestMember(epoch.manifest, sender);
-  if (!member) {
-    throw new Error("chat action actor is not an epoch member");
+  if (!Array.isArray(value.members) || value.members.length < 1 || value.members.length > CHAT_MAX_MEMBERS) {
+    throw new Error("invalid chat member count");
   }
-  return {
-    op: cleanChatActionOp(action.op),
-    id,
-    target: cleanText(action.target),
-    sender,
-    signingPublicKey: member.chatSigningPK,
-    ts: cleanActionTimestamp(action.ts),
-    payload: normalizePlainPayload(action.p)
+  const lineage = cleanText(value.lineage);
+  if (!LINEAGES.has(lineage)) {
+    throw new Error("invalid chat lineage");
+  }
+  const members = value.members.map(cleanMember).sort((a, b) => a.chatPK.localeCompare(b.chatPK));
+  assertUniqueMembers(members);
+  const manifest = {
+    v: CHAT_MANIFEST_VERSION,
+    protocol: CHAT_PROTOCOL_VERSION,
+    chatId: cleanChatHex(value.chatId, "chat id"),
+    epochId: cleanChatHex(value.epochId, "chat epoch id"),
+    epochVersion: cleanEpochVersion(value.epochVersion),
+    parentEpochId: value.parentEpochId == null ? null : cleanChatHex(value.parentEpochId, "parent epoch id"),
+    createdAt: cleanCreatedAt(value.createdAt),
+    lineage,
+    members
   };
-}
-async function openMsgPlaintext(epoch, nonce, ct, aad, options) {
-  const crypto = options?.crypto;
-  if (typeof crypto?.openBox === "function" && (typeof crypto.isAvailable !== "function" || crypto.isAvailable())) {
-    return crypto.openBox(epoch.bodyKey, nonce, ct, aad);
+  if (manifest.epochVersion === 1 !== (manifest.parentEpochId === null)) {
+    throw new Error("invalid parent epoch");
   }
-  return openBox(epoch.bodyKey, nonce, ct, aad);
-}
-async function verifyMsgSignature(publicKey, sig, bytes, options) {
-  const crypto = options?.crypto;
-  if (typeof crypto?.verifyChatBytes === "function" && (typeof crypto.isAvailable !== "function" || crypto.isAvailable())) {
-    return crypto.verifyChatBytes(publicKey, sig, bytes);
+  const bytes = canonicalBytes(manifest, "chat manifest");
+  if (bytes.length > CHAT_MANIFEST_MAX_BYTES) {
+    throw new Error("chat manifest too large");
   }
-  return verifyChatBytes(publicKey, toHex(sig), bytes);
+  assertLineage(manifest, options.parent || null);
+  return manifest;
 }
-async function preverifySigner(epoch, sig, bytes, options) {
-  if (!options?.crypto?.preverifyBeforeOpen)
-    return "";
-  for (const member of epoch.manifest.members) {
-    if (await verifyMsgSignature(member.chatSigningPK, sig, bytes, options)) {
-      return member.chatSigningPK;
-    }
-  }
-  return null;
+function epochManifestDigest(manifest) {
+  return toHex(sha256(canonicalBytes(normalizeEpochManifest(manifest), "chat manifest digest")));
 }
-async function sealMsg(epoch, message, options = {}) {
-  if (!epoch?.bodyKey || !epoch?.actor?.signingKey) {
-    throw new Error("chat epoch sender required");
-  }
-  const head = getHead(message);
-  const action = makeMsgAction(epoch, head, message, options);
-  const aad = getMsgAad(epoch, head);
-  const plaintext = encoder.encode(JSON.stringify(action));
-  try {
-    const { nonce, ct } = await sealBox(epoch.bodyKey, plaintext, aad);
-    const sig = signChatBytes(epoch.actor.signingKey, getSignatureInput(aad, nonce, ct));
-    return { head, body: packMsgBody({ nonce, sig, ct }) };
-  } finally {
-    cleanBytes(plaintext);
-  }
+function manifestMember(manifest, chatPK) {
+  const key = cleanChatHex(chatPK, "member chat key");
+  return normalizeEpochManifest(manifest).members.find((member) => member.chatPK === key) || null;
 }
-async function openMsg(epoch, data, options = {}) {
-  if (!hasMsgData(data) || !epoch?.bodyKey || !epoch?.manifest) {
-    throw new Error("invalid chat message");
-  }
-  const head = data.head;
-  const { suite, flags, nonce, sig, ct } = unpackMsgBody(data.body);
-  const aad = getMsgAad(epoch, head, suite, flags);
-  const signedBytes = getSignatureInput(aad, nonce, ct);
-  const preverified = await preverifySigner(epoch, sig, signedBytes, options);
-  if (preverified == null) {
-    throw new Error("invalid chat action signature");
-  }
-  const plaintext = await openMsgPlaintext(epoch, nonce, ct, aad, options);
+function manifestSigningKeys(manifest) {
+  return Object.fromEntries(normalizeEpochManifest(manifest).members.map((member) => [member.chatPK, member.chatSigningPK]));
+}
+
+// ../../core/chat/direct.js
+"use client";
+function orderedChatKeys(first, second) {
+  return [
+    cleanChatHex(first, "chat public key"),
+    cleanChatHex(second, "peer chat public key")
+  ].sort();
+}
+function findDirectChat(chats, peerChatPK) {
+  const peer = cleanChatHex(peerChatPK, "peer chat public key");
+  return (chats || []).find((chat) => chat?.lineage === "direct" && chat?.peerChatPK === peer) || null;
+}
+function deriveDirectRouteId(chatPrivateKey, chatPK, peerChatPK) {
+  const ownChatPK = cleanChatHex(chatPK, "chat public key");
+  const otherChatPK = cleanChatHex(peerChatPK, "peer chat public key");
+  if (ownChatPK === otherChatPK) {
+    throw new Error("direct peer chat key required");
+  }
+  let peerKey = null;
+  let shared = null;
+  let routeId = null;
   try {
-    const normalized = normalizeOpenedAction(epoch, head, JSON.parse(decoder.decode(plaintext)));
-    const valid = preverified ? normalized.signingPublicKey === preverified : await verifyMsgSignature(normalized.signingPublicKey, sig, signedBytes, options);
-    if (!valid) {
-      throw new Error("invalid chat action signature");
-    }
-    return {
-      ...normalized.payload,
-      id: normalized.target && normalized.op !== CHAT_ACTION_OPS.CREATE ? normalized.target : undefined,
-      cid: normalized.id,
-      actionId: normalized.id,
-      actionOp: normalized.op,
-      actionTarget: normalized.target,
-      signingPublicKey: normalized.signingPublicKey,
-      from: normalized.sender,
-      s: normalized.sender
-    };
+    peerKey = fromHex(otherChatPK, "peer chat public key");
+    shared = x25519.getSharedSecret(toBytes32(chatPrivateKey, "chat private key"), peerKey);
+    routeId = deriveKey(shared, "direct-route-id-v3", orderedChatKeys(ownChatPK, otherChatPK));
+    return toHex(routeId);
   } finally {
-    cleanBytes(plaintext);
-  }
-}
-async function openMessageBatchV3Default(epoch, records, options) {
-  const opened = [];
-  for (const record of records || []) {
-    try {
-      const message = await openMsg(epoch, record, options);
-      opened.push({ recordId: batchRecordId(record), message });
-    } catch {
-      opened.push(null);
-    }
+    cleanBytes(peerKey, shared, routeId);
   }
-  return opened;
 }
-async function openMessageBatchV3(epoch, records, options = {}) {
-  const source = Array.isArray(records) ? records : [];
-  if (!source.length)
-    return [];
-  if (!epoch?.chatId || !epoch?.epochId || !epoch?.bodyKey || !epoch?.manifest) {
-    throw new Error("chat batch epoch required");
-  }
-  const crypto = options.crypto;
-  if (typeof crypto?.openMessageBatchV3 === "function" && (typeof crypto.isAvailable !== "function" || crypto.isAvailable())) {
-    const opened = await crypto.openMessageBatchV3(makeBatchOpenRequest(epoch, source));
-    if (!Array.isArray(opened) || opened.length !== source.length) {
-      throw new Error("invalid chat message batch result");
-    }
-    return opened;
+function deriveSelfChatId(chatPrivateKey, chatPK) {
+  const ownChatPK = cleanChatHex(chatPK, "chat public key");
+  let chatId = null;
+  try {
+    chatId = deriveKey(toBytes32(chatPrivateKey, "chat private key"), "self-chat-id-v3", [ownChatPK]);
+    return toHex(chatId);
+  } finally {
+    cleanBytes(chatId);
   }
-  return openMessageBatchV3Default(epoch, source, options);
 }
 
-// ../../core/chat/avatar.js
-"use client";
-var CHAT_AVATAR_PREFIX = "data:image/webp;base64,";
-var BASE64_RE = /^[A-Za-z0-9+/]+={0,2}$/u;
-function cleanChatAvatarRef(value) {
-  if (value == null)
-    return null;
-  const ref = cleanText(value);
-  if (!ref || ref.length > CHAT_AVATAR_REF_MAX_CHARS) {
-    throw new Error("invalid chat avatar");
-  }
-  return ref;
+// ../../core/chat/errors.js
+function makeChatUnavailableError() {
+  const error = new Error("chat unavailable");
+  error.code = "permission-denied";
+  return error;
 }
-function chatAvatarDataUrl(value) {
-  const ref = typeof value === "string" ? value.trim() : "";
-  if (!ref.startsWith(CHAT_AVATAR_PREFIX) || ref.length > CHAT_AVATAR_REF_MAX_CHARS)
-    return "";
-  const body = ref.slice(CHAT_AVATAR_PREFIX.length);
-  if (!body || body.length % 4 !== 0 || !BASE64_RE.test(body))
-    return "";
-  const padding2 = body.endsWith("==") ? 2 : body.endsWith("=") ? 1 : 0;
-  const bytes = body.length / 4 * 3 - padding2;
-  return bytes > 0 && bytes <= CHAT_AVATAR_IMAGE_MAX_BYTES ? ref : "";
+function isChatEpochConflict(error) {
+  const code = String(error?.code || "").trim().toLowerCase();
+  const message = String(error?.message || "").trim().toLowerCase();
+  return code === "permission-denied" || code.endsWith("/permission-denied") || code === "aborted" || code.endsWith("/aborted") || code === "failed-precondition" || code.endsWith("/failed-precondition") || message.includes("insufficient permissions") || message === "chat owner epoch changed";
 }
-
-// ../../core/chat/epochs/transition.js
-"use client";
-var TRANSITION_SIGN_SCOPE = encoder.encode("veyl-chat-transition-v3");
-var TRANSITION_MEMBER_SCOPE = encoder.encode("veyl-chat-transition-member-v3");
-function cleanTime(value) {
-  if (!Number.isSafeInteger(value) || value <= 0) {
-    throw new Error("chat transition time required");
-  }
-  return value;
+function makeMessageSaveUnavailableError() {
+  const error = new Error("this message can't be saved anymore");
+  error.code = "message-unavailable";
+  return error;
 }
-function normalizeTransitionCore(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("chat transition required");
-  }
-  if (value.v !== CHAT_TRANSITION_VERSION || value.protocol !== CHAT_PROTOCOL_VERSION) {
-    throw new Error("unsupported chat transition");
+function isMessageSaveUnavailableError(error) {
+  return String(error?.code || "").toLowerCase() === "message-unavailable";
+}
+function normalizeMessageSaveError(error) {
+  if (isMessageSaveUnavailableError(error)) {
+    return error;
   }
-  const parentEpochVersion = value.parentEpochVersion;
-  const nextEpochVersion = value.nextEpochVersion;
-  if (!Number.isSafeInteger(parentEpochVersion) || parentEpochVersion <= 0 || nextEpochVersion !== parentEpochVersion + 1) {
-    throw new Error("invalid chat transition version");
+  const code = String(error?.code || "").toLowerCase();
+  if (code === "7" || code === "not-found" || code.endsWith("/not-found") || code === "permission-denied" || code.endsWith("/permission-denied")) {
+    return makeMessageSaveUnavailableError();
   }
-  return {
-    v: CHAT_TRANSITION_VERSION,
-    protocol: CHAT_PROTOCOL_VERSION,
-    chatId: cleanChatHex(value.chatId, "chat id"),
-    parentEpochId: cleanChatHex(value.parentEpochId, "parent epoch id"),
-    parentEpochVersion,
-    nextEpochId: cleanChatHex(value.nextEpochId, "next epoch id"),
-    nextEpochVersion,
-    nextManifestDigest: cleanChatHex(value.nextManifestDigest, "manifest digest"),
-    nextStateCapabilityCommitment: cleanChatHex(value.nextStateCapabilityCommitment, "state capability commitment"),
-    proposalId: cleanChatHex(value.proposalId, "transition proposal id"),
-    createdAt: cleanTime(value.createdAt)
-  };
+  return error;
 }
-function transitionCommitment(value) {
-  return toHex(sha256(canonicalBytes(normalizeTransitionCore(value), "chat transition commitment")));
+
+// ../../core/chat/epochs/state.js
+"use client";
+var CAPABILITY_WITNESS_SCOPE = "veyl-chat-state-witness-v3:";
+var CAPABILITY_COMMITMENT_SCOPE = "veyl-chat-state-commitment-v3:";
+function randomChatId() {
+  return toHex(randomBytes3(32));
 }
-function signatureInput(core) {
-  return concatBytes4(TRANSITION_SIGN_SCOPE, canonicalBytes(core, "chat transition signature"));
+function hashText(value) {
+  return toHex(sha256(encoder.encode(value)));
 }
-function createTransitionCertificate(parentValue, nextValue, nextStateCapability, actor, options = {}) {
-  const parent = normalizeEpochManifest(parentValue);
-  const next = normalizeEpochManifest(nextValue, { parent });
-  const actorChatPK = cleanChatHex(actor?.chatPK, "transition actor");
-  const parentMember = manifestMember(parent, actorChatPK);
-  if (!parentMember || parentMember.chatSigningPK !== cleanText(actor?.signingKey?.publicKey).toLowerCase()) {
-    throw new Error("transition actor is not a parent member");
-  }
-  const core = normalizeTransitionCore({
-    v: CHAT_TRANSITION_VERSION,
-    protocol: CHAT_PROTOCOL_VERSION,
-    chatId: parent.chatId,
-    parentEpochId: parent.epochId,
-    parentEpochVersion: parent.epochVersion,
-    nextEpochId: next.epochId,
-    nextEpochVersion: next.epochVersion,
-    nextManifestDigest: epochManifestDigest(next),
-    nextStateCapabilityCommitment: stateCapabilityCommitment(nextStateCapability),
-    proposalId: options.proposalId || toHex(randomBytes3(32)),
-    createdAt: options.createdAt || Date.now()
-  });
-  return {
-    ...core,
-    actor: actorChatPK,
-    signature: signChatBytes(actor.signingKey, signatureInput(core))
-  };
+function stateCapabilityWitness(value) {
+  return hashText(`${CAPABILITY_WITNESS_SCOPE}${toHex(toBytes32(value, "state capability"))}`);
 }
-function verifyTransitionCertificate(parentValue, nextValue, certificate) {
-  const parent = normalizeEpochManifest(parentValue);
-  const next = normalizeEpochManifest(nextValue, { parent });
-  const core = normalizeTransitionCore(certificate);
-  const actor = cleanChatHex(certificate?.actor, "transition actor");
-  const member = manifestMember(parent, actor);
-  if (!member || core.chatId !== parent.chatId || core.parentEpochId !== parent.epochId || core.parentEpochVersion !== parent.epochVersion || core.nextEpochId !== next.epochId || core.nextEpochVersion !== next.epochVersion || core.nextManifestDigest !== epochManifestDigest(next)) {
-    return false;
-  }
-  return verifyTransitionSignature(certificate, member.chatSigningPK);
+function stateCapabilityCommitment(value) {
+  return hashText(`${CAPABILITY_COMMITMENT_SCOPE}${stateCapabilityWitness(value)}`);
 }
-function verifyTransitionSuccessor(nextValue, certificate) {
+function deriveEpochKeys(epochSecret, manifestValue) {
+  const manifest = normalizeEpochManifest(manifestValue);
+  const root = deriveKey(toBytes32(epochSecret, "epoch secret"), "chat-epoch-root-v3", [
+    manifest.chatId,
+    manifest.epochId,
+    manifest.epochVersion
+  ]);
+  let settingsIdBytes = null;
+  let messageLaneBytes = null;
+  let stateLaneBytes = null;
   try {
-    const next = normalizeEpochManifest(nextValue);
-    const core = normalizeTransitionCore(certificate);
-    return core.chatId === next.chatId && core.nextEpochId === next.epochId && core.nextEpochVersion === next.epochVersion && core.nextManifestDigest === epochManifestDigest(next);
-  } catch {
-    return false;
+    settingsIdBytes = deriveKey(root, "chat-epoch-settings-id-v3");
+    messageLaneBytes = deriveKey(root, "chat-epoch-message-lane-v3");
+    stateLaneBytes = deriveKey(root, "chat-epoch-member-state-lane-v3");
+    return {
+      root,
+      bodyKey: deriveKey(root, "chat-epoch-body-v3"),
+      settingsKey: deriveKey(root, "chat-epoch-settings-v3"),
+      settingsId: toHex(settingsIdBytes),
+      messageLane: toHex(messageLaneBytes),
+      stateLane: toHex(stateLaneBytes),
+      stateKey: deriveKey(root, "chat-epoch-member-state-v3")
+    };
+  } catch (error) {
+    cleanBytes(root);
+    throw error;
+  } finally {
+    cleanBytes(settingsIdBytes, messageLaneBytes, stateLaneBytes);
   }
 }
-function verifyTransitionSignature(certificate, signingPublicKey) {
+function closeEpochKeys(keys) {
+  cleanBytes(keys?.root, keys?.bodyKey, keys?.settingsKey, keys?.stateKey);
+}
+function ownerEpochEntryId(chatPrivateKey, chatId, epochId) {
+  const value = deriveKey(toBytes32(chatPrivateKey, "chat private key"), "user-chat-epoch-entry-id-v3", [
+    cleanChatHex(chatId, "chat id"),
+    cleanChatHex(epochId, "chat epoch id")
+  ], 16);
   try {
-    const core = normalizeTransitionCore(certificate);
-    const signature = cleanText(certificate?.signature).toLowerCase();
-    return verifyChatBytes(cleanChatHex(signingPublicKey, "transition signing key"), signature, signatureInput(core));
-  } catch {
-    return false;
+    return toHex(value);
+  } finally {
+    cleanBytes(value);
   }
 }
-function transitionCore(certificate) {
-  return normalizeTransitionCore(certificate);
+function secretHex(value, label) {
+  return typeof value === "string" ? cleanChatHex(value, label) : toHex(toBytes32(value, label));
+}
+function secretBytes(value, label) {
+  return fromHex(cleanChatHex(value, label), label);
 }
 
-// ../../core/chat/ttl.js
+// ../../core/crypto/base64.js
 "use client";
-var CHAT_RETENTION_SEEN = "seen";
-var CHAT_RETENTION_24H = "24h";
-var CHAT_RETENTION_FOREVER = "forever";
-var DEFAULT_CHAT_RETENTION = CHAT_RETENTION_SEEN;
-var CHAT_RETENTION_VALUES = Object.freeze([CHAT_RETENTION_SEEN, CHAT_RETENTION_24H]);
-var CHAT_PROTOCOL_RETENTION_VALUES = new Set([...CHAT_RETENTION_VALUES, CHAT_RETENTION_FOREVER]);
-var CHAT_RETENTION_LABELS = Object.freeze({
-  [CHAT_RETENTION_SEEN]: "delete after seen",
-  [CHAT_RETENTION_24H]: "keep for 24h"
-});
-var MESSAGE_STORAGE_TTL_MS = CHAT_UNSAVED_TTL_MS;
-var AFTER_SEEN_MS = CHAT_AFTER_SEEN_MS;
-function hasChatRetention(value) {
-  const retention = cleanText(value);
-  return CHAT_PROTOCOL_RETENTION_VALUES.has(retention);
-}
-function cleanChatRetention(value) {
-  const retention = cleanText(value);
-  return hasChatRetention(retention) ? retention : DEFAULT_CHAT_RETENTION;
-}
-function normalizeChatSettings(settings) {
-  const retention = cleanChatRetention(settings?.retention);
-  return { retention };
-}
-function getMessageRetention(message, fallback = DEFAULT_CHAT_RETENTION) {
-  if (hasChatRetention(message?.retention)) {
-    return cleanChatRetention(message.retention);
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var VALUE_BY_CHAR = new Map([...ALPHABET].map((char, index) => [char, index]));
+function bytesBase64Url(value, label = "base64url bytes") {
+  const bytes = toBytes(value, label);
+  let output = "";
+  for (let index = 0;index < bytes.length; index += 3) {
+    const a = bytes[index];
+    const hasB = index + 1 < bytes.length;
+    const hasC = index + 2 < bytes.length;
+    const b = hasB ? bytes[index + 1] : 0;
+    const c = hasC ? bytes[index + 2] : 0;
+    output += ALPHABET[a >>> 2];
+    output += ALPHABET[(a & 3) << 4 | b >>> 4];
+    if (hasB)
+      output += ALPHABET[(b & 15) << 2 | c >>> 6];
+    if (hasC)
+      output += ALPHABET[c & 63];
   }
-  return cleanChatRetention(fallback);
-}
-function retentionPatch(message) {
-  return hasChatRetention(message?.retention) ? { retention: cleanChatRetention(message.retention) } : {};
+  return output;
 }
-function withMessageRetention(message, retention = DEFAULT_CHAT_RETENTION) {
-  if (!message || typeof message !== "object" || Array.isArray(message)) {
-    return message;
+function base64UrlBytes(value, label = "base64url") {
+  const text = typeof value === "string" ? value.trim() : "";
+  if (!text || text.length % 4 === 1 || !/^[A-Za-z0-9_-]+$/u.test(text)) {
+    throw new Error(`invalid ${label}`);
   }
-  const nextRetention = getMessageRetention(message, retention);
-  return message.retention === nextRetention ? message : { ...message, retention: nextRetention };
-}
-function ttlMillis(value) {
-  return timestampMs(value, null, { positive: true });
-}
-function isTtlExpired(value, now = Date.now()) {
-  const ms = ttlMillis(value);
-  return ms != null && ms <= now;
+  const output = new Uint8Array(Math.floor(text.length * 6 / 8));
+  let bits = 0;
+  let bitCount = 0;
+  let offset = 0;
+  for (const char of text) {
+    const next = VALUE_BY_CHAR.get(char);
+    if (next == null)
+      throw new Error(`invalid ${label}`);
+    bits = bits << 6 | next;
+    bitCount += 6;
+    if (bitCount >= 8) {
+      bitCount -= 8;
+      output[offset++] = bits >>> bitCount & 255;
+      bits &= bitCount ? (1 << bitCount) - 1 : 0;
+    }
+  }
+  return output;
 }
-function newMessageStorageTtlMs(now = Date.now()) {
-  return now + MESSAGE_STORAGE_TTL_MS;
+
+// ../../core/chat/messages/actions.js
+"use client";
+var CHAT_ACTION_VERSION = 3;
+var CHAT_ACTION_OPS = Object.freeze({
+  CREATE: "create",
+  EDIT: "edit",
+  PAY_CONFIRM: "pay_confirm",
+  REACTION: "rxn",
+  DELETE: "del",
+  SYSTEM: "sys",
+  EPOCH: "epoch"
+});
+var CHAT_ACTION_OP_SET = new Set(Object.values(CHAT_ACTION_OPS));
+var CONTROL_OP_BY_TYPE = Object.freeze({
+  rxn: CHAT_ACTION_OPS.REACTION,
+  del: CHAT_ACTION_OPS.DELETE,
+  sys: CHAT_ACTION_OPS.SYSTEM,
+  epoch: CHAT_ACTION_OPS.EPOCH
+});
+function isChatActionOp(value) {
+  return CHAT_ACTION_OP_SET.has(value);
 }
-function messageExpiryMs(retention, seenAt) {
-  if (cleanChatRetention(retention) === CHAT_RETENTION_FOREVER) {
-    return null;
-  }
-  if (!Number.isFinite(seenAt)) {
-    return null;
+function cleanChatActionOp(value) {
+  const op = cleanText(value);
+  if (!isChatActionOp(op)) {
+    throw new Error("unsupported chat action op");
   }
-  return cleanChatRetention(retention) === CHAT_RETENTION_24H ? seenAt + AFTER_SEEN_MS : seenAt;
+  return op;
+}
+function actionOpForPayload(payload, fallback = CHAT_ACTION_OPS.CREATE) {
+  return CONTROL_OP_BY_TYPE[cleanText(payload?.t)] || fallback;
 }
 
-// ../../core/chat/settings.js
+// ../../core/crypto/chat.js
 "use client";
-var SETTINGS_SIGN_SCOPE = encoder.encode("veyl-chat-settings-v3-sign");
-var SIGNATURE_RE = /^[0-9a-f]{128}$/u;
-function cleanRevision(value) {
-  if (!Number.isSafeInteger(value) || value <= 0) {
-    throw new Error("chat settings revision required");
-  }
-  return value;
+var MSG_BODY_VERSION = CHAT_MESSAGE_ENVELOPE_VERSION;
+var MSG_BODY_SUITE_XCHACHA_ED25519 = 1;
+var MSG_SIGN_SCOPE_BYTES = encoder.encode("veyl-chat-msg-v3-sign");
+var MSG_BODY_FLAGS_NONE = 0;
+var ED25519_SIGNATURE_BYTES = 64;
+var MSG_BODY_HEADER_BYTES = 1 + 1 + 1 + BOX_NONCE_BYTES + ED25519_SIGNATURE_BYTES;
+function hasMsgHead(data) {
+  return typeof data?.head?.cid === "string" && !!data.head.cid;
 }
-function cleanPreviousDigest(value) {
-  return value == null ? null : cleanChatHex(value, "previous chat settings digest");
+function hasMsgBody(data) {
+  return data?.body != null;
 }
-function cleanEventId(value) {
-  const eventId = value == null ? null : cleanText(value);
-  if (eventId != null && (!eventId || eventId.length > 128 || eventId.includes("/"))) {
-    throw new Error("invalid chat settings event");
-  }
-  return eventId;
+function hasMsgData(data) {
+  return hasMsgHead(data) && hasMsgBody(data);
 }
-function normalizeTransitionAuthorization(value, epoch, actor) {
-  if (value == null)
-    return null;
-  if (!value || typeof value !== "object" || Array.isArray(value) || value.kind !== "transition") {
-    throw new Error("invalid chat settings authorization");
+function cleanSigningKey(value) {
+  const secret = value?.secret;
+  const publicKey = cleanChatHex(value?.publicKey, "chat signing public key");
+  if (!secret) {
+    throw new Error("chat signing secret required");
   }
-  const signingPK = cleanChatHex(value.signingPK, "chat settings transition signing key");
-  const certificateCore = transitionCore(value.certificate);
-  const certificate = {
-    ...certificateCore,
-    actor: cleanChatHex(value.certificate?.actor, "transition actor"),
-    signature: cleanText(value.certificate?.signature).toLowerCase()
-  };
-  if (certificate.actor !== actor || !SIGNATURE_RE.test(certificate.signature) || transitionCommitment(certificate) !== cleanChatHex(epoch?.transitionCommitment, "transition commitment") || !verifyTransitionSuccessor(epoch.manifest, certificate) || !verifyTransitionSignature(certificate, signingPK)) {
-    throw new Error("invalid chat settings transition authorization");
+  return { secret, publicKey };
+}
+function openChatEpoch({ manifest: manifestValue, epochSecret, actor = null } = {}) {
+  const manifest = normalizeEpochManifest(manifestValue);
+  const keys = deriveEpochKeys(epochSecret, manifest);
+  let normalizedActor = null;
+  try {
+    if (actor) {
+      const chatPK = cleanChatHex(actor.chatPK, "chat actor key");
+      const signingKey = cleanSigningKey(actor.signingKey);
+      const member = manifestMember(manifest, chatPK);
+      if (!member || member.chatSigningPK !== signingKey.publicKey) {
+        throw new Error("chat actor is not an epoch member");
+      }
+      normalizedActor = { chatPK, signingKey };
+    }
+    return {
+      protocol: CHAT_PROTOCOL_VERSION,
+      chatId: manifest.chatId,
+      epochId: manifest.epochId,
+      epochVersion: manifest.epochVersion,
+      manifest,
+      actor: normalizedActor,
+      ...keys
+    };
+  } catch (error) {
+    closeEpochKeys(keys);
+    throw error;
   }
-  return { kind: "transition", signingPK, certificate };
 }
-function withAuthorization(core, authorization) {
-  return authorization ? { ...core, authorization } : core;
+function closeChatEpoch(epoch) {
+  closeEpochKeys(epoch);
 }
-function normalizeChatStateSettings(value = {}) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("chat settings required");
-  }
-  const title = value.title == null ? null : cleanText(value.title);
-  if (title != null && (!title || title.length > 128)) {
-    throw new Error("invalid chat title");
+function getHead(message) {
+  const cid = cleanText(message?.cid);
+  if (!cid || cid.length > 256) {
+    throw new Error("message cid required");
   }
-  return {
-    title,
-    avatarRef: cleanChatAvatarRef(value.avatarRef),
-    retention: cleanChatRetention(value.retention)
-  };
+  return { cid };
 }
-function settingsCore(epoch, settings, options = {}) {
-  const actor = cleanChatHex(epoch?.actor?.chatPK, "chat settings actor");
-  const authorization = normalizeTransitionAuthorization(options.authorization, epoch, actor);
-  if (!epoch?.settingsKey || !epoch?.settingsId || !epoch?.actor?.signingKey || !manifestMember(epoch.manifest, actor) && !authorization) {
-    throw new Error("chat settings epoch actor required");
-  }
-  return withAuthorization({
-    v: CHAT_SETTINGS_VERSION,
+function getPayload(message) {
+  const payload = { ...message || {} };
+  delete payload.cid;
+  delete payload.from;
+  delete payload.s;
+  return payload;
+}
+function getMsgAad(epoch, head, suite = MSG_BODY_SUITE_XCHACHA_ED25519, flags = MSG_BODY_FLAGS_NONE) {
+  return canonicalBytes({
+    v: MSG_BODY_VERSION,
     protocol: CHAT_PROTOCOL_VERSION,
-    chatId: cleanChatHex(epoch.chatId, "chat id"),
-    epochId: cleanChatHex(epoch.epochId, "chat epoch id"),
-    revision: cleanRevision(options.revision),
-    previousDigest: cleanPreviousDigest(options.previousDigest),
-    eventId: cleanEventId(options.eventId),
-    actor,
-    settings: normalizeChatStateSettings(settings)
-  }, authorization);
+    chatId: epoch.chatId,
+    epochId: epoch.epochId,
+    epochVersion: epoch.epochVersion,
+    cid: head.cid,
+    suite,
+    flags
+  }, "chat message aad");
 }
-function normalizeSettingsCore(value, epoch) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("invalid chat settings state");
-  }
-  const actor = cleanChatHex(value.actor, "chat settings actor");
-  const authorization = normalizeTransitionAuthorization(value.authorization, epoch, actor);
-  const core = withAuthorization({
-    v: value.v,
-    protocol: value.protocol,
-    chatId: cleanChatHex(value.chatId, "chat id"),
-    epochId: cleanChatHex(value.epochId, "chat epoch id"),
-    revision: cleanRevision(value.revision),
-    previousDigest: cleanPreviousDigest(value.previousDigest),
-    eventId: cleanEventId(value.eventId),
-    actor,
-    settings: normalizeChatStateSettings(value.settings)
-  }, authorization);
-  if (core.v !== CHAT_SETTINGS_VERSION || core.protocol !== CHAT_PROTOCOL_VERSION || core.chatId !== epoch.chatId || core.epochId !== epoch.epochId || !manifestMember(epoch.manifest, core.actor) && !authorization) {
-    throw new Error("chat settings binding mismatch");
-  }
-  return core;
+function getSignatureInput(aad, nonce, ct) {
+  return concatBytes4(MSG_SIGN_SCOPE_BYTES, aad, nonce, ct);
 }
-function coreDigest(core) {
-  return toHex(sha256(canonicalBytes(core, "chat settings digest")));
+function batchRecordId(record) {
+  return cleanText(record?.id) || cleanText(record?.recordId) || cleanText(record?.head?.cid);
 }
-function settingsHead(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("chat settings record required");
-  }
+function makeBatchOpenRequest(epoch, records) {
   return {
-    v: value.v,
-    protocol: value.protocol,
-    chatId: cleanChatHex(value.chatId, "chat id"),
-    epochId: cleanChatHex(value.epochId, "chat epoch id"),
-    revision: cleanRevision(value.revision),
-    previousDigest: cleanPreviousDigest(value.previousDigest),
-    eventId: cleanEventId(value.eventId),
-    digest: cleanChatHex(value.digest, "chat settings digest")
+    records: (records || []).map((record) => ({
+      id: batchRecordId(record),
+      head: record?.head,
+      body: record?.body
+    })),
+    protocol: CHAT_PROTOCOL_VERSION,
+    chatId: epoch.chatId,
+    epochId: epoch.epochId,
+    epochVersion: epoch.epochVersion,
+    bodyKey: epoch.bodyKey,
+    manifest: epoch.manifest,
+    signingKeysByChatKey: manifestSigningKeys(epoch.manifest)
   };
 }
-function signatureInput2(core) {
-  return concatBytes4(SETTINGS_SIGN_SCOPE, canonicalBytes(core, "chat settings signature"));
+function cleanActionTimestamp(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    throw new Error("chat action ts required");
+  }
+  return Object.is(value, -0) ? 0 : value;
 }
-function settingsAad(head) {
-  return canonicalBytes({
-    v: head.v,
-    protocol: head.protocol,
-    chatId: head.chatId,
-    epochId: head.epochId,
-    revision: head.revision,
-    previousDigest: head.previousDigest,
-    eventId: head.eventId,
-    digest: head.digest
-  }, "chat settings aad");
+function normalizePlainPayload(payload) {
+  if (payload == null)
+    return {};
+  if (typeof payload !== "object" || Array.isArray(payload)) {
+    throw new Error("invalid chat action payload");
+  }
+  return payload;
 }
-async function sealChatSettings(epoch, settings, options = {}) {
-  const core = settingsCore(epoch, settings, options);
-  const digest = coreDigest(core);
-  const head = settingsHead({ ...core, digest });
-  const plaintext = encoder.encode(JSON.stringify({
-    core,
-    signature: signChatBytes(epoch.actor.signingKey, signatureInput2(core))
-  }));
-  try {
-    const { nonce, ct } = await sealBox(epoch.settingsKey, plaintext, settingsAad(head));
-    const body = concatBytes4(nonce, ct);
-    if (body.length > CHAT_SETTINGS_BODY_MAX_BYTES) {
-      throw new Error("chat settings too large");
-    }
-    return { id: epoch.settingsId, head, body, actor: core.actor, settings: core.settings };
-  } finally {
-    cleanBytes(plaintext);
+function makeMsgAction(epoch, head, message, options = {}) {
+  if (!epoch?.actor?.chatPK || !epoch?.actor?.signingKey) {
+    throw new Error("chat epoch actor required");
   }
+  const target = cleanText(options.target);
+  return {
+    v: CHAT_ACTION_VERSION,
+    op: cleanChatActionOp(cleanText(options.op) || actionOpForPayload(message)),
+    id: cleanText(options.id) || head.cid,
+    ...target ? { target } : {},
+    actor: epoch.actor.chatPK,
+    ts: Number.isFinite(options.ts) ? options.ts : Date.now(),
+    p: getPayload(message)
+  };
 }
-async function openChatSettings(epoch, record) {
-  if (!epoch?.settingsKey || !epoch?.settingsId || record?.id !== epoch.settingsId) {
-    throw new Error("chat settings address mismatch");
+function packMsgBody({ suite = MSG_BODY_SUITE_XCHACHA_ED25519, flags = MSG_BODY_FLAGS_NONE, nonce, sig, ct }) {
+  const nonceBytes = toBytes(nonce, "chat message nonce");
+  const sigBytes = typeof sig === "string" ? fromHexBytes(sig, "chat message signature") : toBytes(sig, "chat message signature");
+  const ctBytes = toBytes(ct, "chat message ciphertext");
+  if (suite !== MSG_BODY_SUITE_XCHACHA_ED25519 || flags !== MSG_BODY_FLAGS_NONE) {
+    throw new Error("unsupported chat message suite");
   }
-  const head = settingsHead(record.head);
-  if (head.v !== CHAT_SETTINGS_VERSION || head.protocol !== CHAT_PROTOCOL_VERSION || head.chatId !== epoch.chatId || head.epochId !== epoch.epochId) {
-    throw new Error("chat settings binding mismatch");
+  if (nonceBytes.length !== BOX_NONCE_BYTES || sigBytes.length !== ED25519_SIGNATURE_BYTES) {
+    throw new Error("invalid chat message signature envelope");
   }
-  const body = toBytes(record.body, "chat settings body");
-  if (body.length <= 24 || body.length > CHAT_SETTINGS_BODY_MAX_BYTES) {
-    throw new Error("invalid chat settings body");
+  const out = new Uint8Array(MSG_BODY_HEADER_BYTES + ctBytes.length);
+  out[0] = MSG_BODY_VERSION;
+  out[1] = suite;
+  out[2] = flags;
+  out.set(nonceBytes, 3);
+  out.set(sigBytes, 3 + BOX_NONCE_BYTES);
+  out.set(ctBytes, MSG_BODY_HEADER_BYTES);
+  return out;
+}
+function unpackMsgBody(body) {
+  const bytes = toBytes(body, "chat message body");
+  if (bytes.length <= MSG_BODY_HEADER_BYTES || bytes[0] !== MSG_BODY_VERSION) {
+    throw new Error("unsupported chat message body");
   }
-  let plaintext = null;
-  try {
-    plaintext = await openBox(epoch.settingsKey, body.subarray(0, 24), body.subarray(24), settingsAad(head));
-    const opened = JSON.parse(decoder.decode(plaintext));
-    const core = normalizeSettingsCore(opened?.core, epoch);
-    const signature = cleanText(opened?.signature).toLowerCase();
-    const member = manifestMember(epoch.manifest, core.actor);
-    const signingPK = member?.chatSigningPK || core.authorization?.signingPK;
-    if (core.revision !== head.revision || core.previousDigest !== head.previousDigest || core.eventId !== head.eventId || coreDigest(core) !== head.digest || !SIGNATURE_RE.test(signature) || !signingPK || !verifyChatBytes(signingPK, signature, signatureInput2(core))) {
-      throw new Error("invalid chat settings signature");
-    }
-    return { id: epoch.settingsId, head, actor: core.actor, settings: core.settings };
-  } finally {
-    cleanBytes(plaintext);
+  if (bytes[1] !== MSG_BODY_SUITE_XCHACHA_ED25519 || bytes[2] !== MSG_BODY_FLAGS_NONE) {
+    throw new Error("unsupported chat message suite");
   }
+  return {
+    suite: bytes[1],
+    flags: bytes[2],
+    nonce: bytes.subarray(3, 3 + BOX_NONCE_BYTES),
+    sig: bytes.subarray(3 + BOX_NONCE_BYTES, MSG_BODY_HEADER_BYTES),
+    ct: bytes.subarray(MSG_BODY_HEADER_BYTES)
+  };
 }
-function chatSettingsProjection(snapshot) {
-  return normalizeChatSettingsProjection({
-    revision: cleanRevision(snapshot?.head?.revision),
-    digest: cleanChatHex(snapshot?.head?.digest, "chat settings digest"),
-    values: normalizeChatStateSettings(snapshot?.settings)
-  });
-}
-function normalizeChatSettingsProjection(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("chat settings projection required");
+function normalizeOpenedAction(epoch, head, action) {
+  if (!action || typeof action !== "object" || Array.isArray(action) || action.v !== CHAT_ACTION_VERSION) {
+    throw new Error("unsupported chat action");
+  }
+  const id = cleanText(action.id);
+  if (!id || id !== head.cid) {
+    throw new Error("chat action id mismatch");
+  }
+  const sender = cleanChatHex(action.actor, "chat action actor");
+  const member = manifestMember(epoch.manifest, sender);
+  if (!member) {
+    throw new Error("chat action actor is not an epoch member");
   }
   return {
-    revision: cleanRevision(value.revision),
-    digest: cleanChatHex(value.digest, "chat settings digest"),
-    values: normalizeChatStateSettings(value.values)
+    op: cleanChatActionOp(action.op),
+    id,
+    target: cleanText(action.target),
+    sender,
+    signingPublicKey: member.chatSigningPK,
+    ts: cleanActionTimestamp(action.ts),
+    payload: normalizePlainPayload(action.p)
   };
 }
-async function createEpochChatSettings(epochState, identity, values, options = {}) {
-  const epoch = openChatEpoch({
-    manifest: epochState?.manifest,
-    epochSecret: epochState?.epochSecret,
-    actor: {
-      chatPK: identity?.chatPK,
-      signingKey: {
-        publicKey: identity?.chatSigningPK,
-        secret: identity?.chatSigningSecret
-      }
-    }
-  });
-  try {
-    const sealed = await sealChatSettings(epoch, values, options);
-    return { sealed, projection: chatSettingsProjection(sealed) };
-  } finally {
-    closeChatEpoch(epoch);
+async function openMsgPlaintext(epoch, nonce, ct, aad, options) {
+  const crypto = options?.crypto;
+  if (typeof crypto?.openBox === "function" && (typeof crypto.isAvailable !== "function" || crypto.isAvailable())) {
+    return crypto.openBox(epoch.bodyKey, nonce, ct, aad);
   }
+  return openBox(epoch.bodyKey, nonce, ct, aad);
 }
-async function createTransitionEpochChatSettings(epochState, identity, certificate, values, options = {}) {
-  const epoch = openChatEpoch({
-    manifest: epochState?.manifest,
-    epochSecret: epochState?.epochSecret
-  });
-  epoch.actor = {
-    chatPK: cleanChatHex(identity?.chatPK, "chat settings actor"),
-    signingKey: {
-      publicKey: cleanChatHex(identity?.chatSigningPK, "chat settings signing key"),
-      secret: identity?.chatSigningSecret
-    }
-  };
-  epoch.transitionCommitment = transitionCommitment(certificate);
-  try {
-    const sealed = await sealChatSettings(epoch, values, {
-      ...options,
-      authorization: {
-        kind: "transition",
-        signingPK: identity?.chatSigningPK,
-        certificate
-      }
-    });
-    return { sealed, projection: chatSettingsProjection(sealed) };
-  } finally {
-    closeChatEpoch(epoch);
+async function verifyMsgSignature(publicKey, sig, bytes, options) {
+  const crypto = options?.crypto;
+  if (typeof crypto?.verifyChatBytes === "function" && (typeof crypto.isAvailable !== "function" || crypto.isAvailable())) {
+    return crypto.verifyChatBytes(publicKey, sig, bytes);
   }
+  return verifyChatBytes(publicKey, toHex(sig), bytes);
 }
-async function readEpochChatSettings(cloud, epochState) {
-  const epoch = openChatEpoch({
-    manifest: epochState?.manifest,
-    epochSecret: epochState?.epochSecret
-  });
-  epoch.transitionCommitment = cleanChatHex(epochState?.transitionCommitment, "transition commitment");
-  try {
-    const record = await cloud?.chat?.settings?.read?.(epoch.settingsId);
-    if (!record)
-      throw new Error("chat settings unavailable");
-    return chatSettingsProjection(await openChatSettings(epoch, record));
-  } finally {
-    closeChatEpoch(epoch);
+async function preverifySigner(epoch, sig, bytes, options) {
+  if (!options?.crypto?.preverifyBeforeOpen)
+    return "";
+  for (const member of epoch.manifest.members) {
+    if (await verifyMsgSignature(member.chatSigningPK, sig, bytes, options)) {
+      return member.chatSigningPK;
+    }
   }
+  return null;
 }
-function epochChatSettingsId(epochState) {
-  const epoch = openChatEpoch({
-    manifest: epochState?.manifest,
-    epochSecret: epochState?.epochSecret
-  });
+async function sealMsg(epoch, message, options = {}) {
+  if (!epoch?.bodyKey || !epoch?.actor?.signingKey) {
+    throw new Error("chat epoch sender required");
+  }
+  const head = getHead(message);
+  const action = makeMsgAction(epoch, head, message, options);
+  const aad = getMsgAad(epoch, head);
+  const plaintext = encoder.encode(JSON.stringify(action));
   try {
-    return epoch.settingsId;
+    const { nonce, ct } = await sealBox(epoch.bodyKey, plaintext, aad);
+    const sig = signChatBytes(epoch.actor.signingKey, getSignatureInput(aad, nonce, ct));
+    return { head, body: packMsgBody({ nonce, sig, ct }) };
   } finally {
-    closeChatEpoch(epoch);
+    cleanBytes(plaintext);
   }
 }
-
-// ../../core/chat/entry.js
-"use client";
-var CHAT_ENTRY_VERSION = 4;
-var CHAT_OWNER_EPOCH_ENTRY_VERSION = 2;
-function ownChatEntryId(chatPrivateKey, chatId) {
-  const key = deriveKey(toBytes32(chatPrivateKey, "chat private key"), "user-chat-entry-id-v4", [cleanChatHex(chatId, "chat id")], 16);
+async function openMsg(epoch, data, options = {}) {
+  if (!hasMsgData(data) || !epoch?.bodyKey || !epoch?.manifest) {
+    throw new Error("invalid chat message");
+  }
+  const head = data.head;
+  const { suite, flags, nonce, sig, ct } = unpackMsgBody(data.body);
+  const aad = getMsgAad(epoch, head, suite, flags);
+  const signedBytes = getSignatureInput(aad, nonce, ct);
+  const preverified = await preverifySigner(epoch, sig, signedBytes, options);
+  if (preverified == null) {
+    throw new Error("invalid chat action signature");
+  }
+  const plaintext = await openMsgPlaintext(epoch, nonce, ct, aad, options);
   try {
-    return toHex(key);
+    const normalized = normalizeOpenedAction(epoch, head, JSON.parse(decoder.decode(plaintext)));
+    const valid = preverified ? normalized.signingPublicKey === preverified : await verifyMsgSignature(normalized.signingPublicKey, sig, signedBytes, options);
+    if (!valid) {
+      throw new Error("invalid chat action signature");
+    }
+    return {
+      ...normalized.payload,
+      id: normalized.target && normalized.op !== CHAT_ACTION_OPS.CREATE ? normalized.target : undefined,
+      cid: normalized.id,
+      actionId: normalized.id,
+      actionOp: normalized.op,
+      actionTarget: normalized.target,
+      signingPublicKey: normalized.signingPublicKey,
+      from: normalized.sender,
+      s: normalized.sender
+    };
   } finally {
-    cleanBytes(key);
+    cleanBytes(plaintext);
   }
 }
-function entryKey(chatPrivateKey, entryId) {
-  return deriveKey(toBytes32(chatPrivateKey, "chat private key"), "user-chat-entry-v4", [cleanText(entryId)]);
-}
-function entryAad(entryId) {
-  return canonicalBytes({ v: CHAT_ENTRY_VERSION, protocol: CHAT_PROTOCOL_VERSION, entryId }, "chat entry aad");
-}
-function ownerEpochKey(chatPrivateKey, entryId, epochEntryId) {
-  return deriveKey(toBytes32(chatPrivateKey, "chat private key"), "user-chat-epoch-entry-v3", [entryId, epochEntryId]);
-}
-function ownerEpochAad(entryId, epochEntryId) {
-  return canonicalBytes({
-    v: CHAT_OWNER_EPOCH_ENTRY_VERSION,
-    protocol: CHAT_PROTOCOL_VERSION,
-    entryId,
-    epochEntryId
-  }, "chat owner epoch aad");
-}
-function cleanTransitionCommitment(value) {
-  return cleanChatHex(value, "transition commitment");
-}
-function cleanTransitionMessageId(value) {
-  const messageId = cleanText(value);
-  if (!messageId || messageId.length > 128 || messageId.includes("/")) {
-    throw new Error("invalid transition message id");
+async function openMessageBatchV3Default(epoch, records, options) {
+  const opened = [];
+  for (const record of records || []) {
+    try {
+      const message = await openMsg(epoch, record, options);
+      opened.push({ recordId: batchRecordId(record), message });
+    } catch {
+      opened.push(null);
+    }
   }
-  return messageId;
+  return opened;
 }
-function normalizeRoutes(value) {
-  if (value == null)
-    return {};
-  if (typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("invalid chat routes");
+async function openMessageBatchV3(epoch, records, options = {}) {
+  const source = Array.isArray(records) ? records : [];
+  if (!source.length)
+    return [];
+  if (!epoch?.chatId || !epoch?.epochId || !epoch?.bodyKey || !epoch?.manifest) {
+    throw new Error("chat batch epoch required");
   }
-  const routes = {};
-  for (const [rawChatPK, route] of Object.entries(value)) {
-    const chatPK = cleanChatHex(rawChatPK, "chat route member");
-    if (!route || typeof route !== "object" || Array.isArray(route)) {
-      throw new Error("invalid chat route");
-    }
-    const uid = cleanText(route.uid);
-    const deliveryCapability = route.deliveryCapability == null ? null : cleanChatHex(route.deliveryCapability, "delivery capability");
-    const notificationPK = route.notificationPK == null ? null : cleanChatHex(route.notificationPK, "notification key");
-    const generation = Number.isSafeInteger(route.generation) && route.generation > 0 ? route.generation : 1;
-    if (!uid || uid.length > 128) {
-      throw new Error("chat route uid required");
+  const crypto = options.crypto;
+  if (typeof crypto?.openMessageBatchV3 === "function" && (typeof crypto.isAvailable !== "function" || crypto.isAvailable())) {
+    const opened = await crypto.openMessageBatchV3(makeBatchOpenRequest(epoch, source));
+    if (!Array.isArray(opened) || opened.length !== source.length) {
+      throw new Error("invalid chat message batch result");
     }
-    routes[chatPK] = { uid, deliveryCapability, notificationPK, generation };
+    return opened;
   }
-  return routes;
+  return openMessageBatchV3Default(epoch, source, options);
 }
-function normalizeCurrentEpoch(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("current chat epoch required");
+
+// ../../core/chat/epochs/transition.js
+"use client";
+var TRANSITION_SIGN_SCOPE = encoder.encode("veyl-chat-transition-v3");
+var TRANSITION_MEMBER_SCOPE = encoder.encode("veyl-chat-transition-member-v3");
+function cleanTime(value) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error("chat transition time required");
   }
-  const manifest = normalizeEpochManifest(value.manifest);
-  return {
-    manifest,
-    epochSecret: cleanChatHex(value.epochSecret, "epoch secret"),
-    stateCapability: cleanChatHex(value.stateCapability, "state capability"),
-    transitionCommitment: cleanTransitionCommitment(value.transitionCommitment),
-    mlsPackageId: cleanChatHex(value.mlsPackageId, "mls epoch package id"),
-    mlsPackageDigest: cleanChatHex(value.mlsPackageDigest, "mls epoch package digest"),
-    settings: normalizeChatSettingsProjection(value.settings)
-  };
+  return value;
 }
-function normalizeOwnerEntry(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || value.v !== CHAT_ENTRY_VERSION || value.protocol !== CHAT_PROTOCOL_VERSION) {
-    throw new Error("invalid chat entry");
+function normalizeTransitionCore(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("chat transition required");
   }
-  const current = normalizeCurrentEpoch(value.current);
-  if (current.manifest.chatId !== cleanChatHex(value.chatId, "chat id")) {
-    throw new Error("chat entry id mismatch");
+  if (value.v !== CHAT_TRANSITION_VERSION || value.protocol !== CHAT_PROTOCOL_VERSION) {
+    throw new Error("unsupported chat transition");
+  }
+  const parentEpochVersion = value.parentEpochVersion;
+  const nextEpochVersion = value.nextEpochVersion;
+  if (!Number.isSafeInteger(parentEpochVersion) || parentEpochVersion <= 0 || nextEpochVersion !== parentEpochVersion + 1) {
+    throw new Error("invalid chat transition version");
   }
   return {
-    v: CHAT_ENTRY_VERSION,
+    v: CHAT_TRANSITION_VERSION,
     protocol: CHAT_PROTOCOL_VERSION,
-    ownerRevision: Number.isSafeInteger(value.ownerRevision) && value.ownerRevision > 0 ? value.ownerRevision : (() => {
-      throw new Error("chat owner revision required");
-    })(),
-    chatId: current.manifest.chatId,
-    current,
-    routes: normalizeRoutes(value.routes),
-    saved: value.saved || null,
-    startMs: Number.isFinite(value.startMs) ? value.startMs : null,
-    deliveryRegistered: value.deliveryRegistered === true,
-    notificationTag: cleanText(value.notificationTag) || null
+    chatId: cleanChatHex(value.chatId, "chat id"),
+    parentEpochId: cleanChatHex(value.parentEpochId, "parent epoch id"),
+    parentEpochVersion,
+    nextEpochId: cleanChatHex(value.nextEpochId, "next epoch id"),
+    nextEpochVersion,
+    nextManifestDigest: cleanChatHex(value.nextManifestDigest, "manifest digest"),
+    nextStateCapabilityCommitment: cleanChatHex(value.nextStateCapabilityCommitment, "state capability commitment"),
+    proposalId: cleanChatHex(value.proposalId, "transition proposal id"),
+    createdAt: cleanTime(value.createdAt)
   };
 }
-async function sealOwnChatEntry(chatPrivateKey, entryId, entry) {
-  const key = entryKey(chatPrivateKey, entryId);
-  try {
-    const { nonce, ct } = await sealJson(key, normalizeOwnerEntry(entry), entryAad(entryId));
-    return packBodyData(nonce, ct);
-  } finally {
-    cleanBytes(key);
-  }
-}
-async function openOwnChatEntry(chatPrivateKey, entryId, body) {
-  const key = entryKey(chatPrivateKey, entryId);
-  try {
-    const { nonce, ct } = unpackBodyData(body);
-    return normalizeOwnerEntry(await openJson(key, nonce, ct, entryAad(entryId)));
-  } finally {
-    cleanBytes(key);
-  }
+function transitionCommitment(value) {
+  return toHex(sha256(canonicalBytes(normalizeTransitionCore(value), "chat transition commitment")));
 }
-function makeOwnChatEntry(epoch, fields = {}) {
-  const manifest = normalizeEpochManifest(epoch?.manifest);
-  return normalizeOwnerEntry({
-    v: CHAT_ENTRY_VERSION,
-    protocol: CHAT_PROTOCOL_VERSION,
-    ownerRevision: Number.isSafeInteger(fields.ownerRevision) && fields.ownerRevision > 0 ? fields.ownerRevision : 1,
-    chatId: manifest.chatId,
-    current: {
-      manifest,
-      epochSecret: secretHex(epoch.epochSecret, "epoch secret"),
-      stateCapability: secretHex(epoch.stateCapability, "state capability"),
-      transitionCommitment: cleanTransitionCommitment(epoch.transitionCommitment),
-      mlsPackageId: cleanChatHex(epoch.mlsPackageId, "mls epoch package id"),
-      mlsPackageDigest: cleanChatHex(epoch.mlsPackageDigest, "mls epoch package digest"),
-      settings: normalizeChatSettingsProjection(epoch.settings)
-    },
-    routes: fields.routes || {},
-    saved: fields.saved || null,
-    startMs: Number.isFinite(fields.startMs) ? fields.startMs : null,
-    deliveryRegistered: fields.deliveryRegistered === true,
-    notificationTag: cleanText(fields.notificationTag) || null
-  });
+function signatureInput(core) {
+  return concatBytes4(TRANSITION_SIGN_SCOPE, canonicalBytes(core, "chat transition signature"));
 }
-function normalizeOwnerEpochRecord(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || value.v !== CHAT_OWNER_EPOCH_ENTRY_VERSION || value.protocol !== CHAT_PROTOCOL_VERSION) {
-    throw new Error("invalid owner epoch entry");
+function createTransitionCertificate(parentValue, nextValue, nextStateCapability, actor, options = {}) {
+  const parent = normalizeEpochManifest(parentValue);
+  const next = normalizeEpochManifest(nextValue, { parent });
+  const actorChatPK = cleanChatHex(actor?.chatPK, "transition actor");
+  const parentMember = manifestMember(parent, actorChatPK);
+  if (!parentMember || parentMember.chatSigningPK !== cleanText(actor?.signingKey?.publicKey).toLowerCase()) {
+    throw new Error("transition actor is not a parent member");
   }
-  const manifest = normalizeEpochManifest(value.manifest);
-  return {
-    v: CHAT_OWNER_EPOCH_ENTRY_VERSION,
-    protocol: CHAT_PROTOCOL_VERSION,
-    chatId: manifest.chatId,
-    epochId: manifest.epochId,
-    epochVersion: manifest.epochVersion,
-    manifest,
-    epochSecret: cleanChatHex(value.epochSecret, "epoch secret"),
-    cutoffMs: Number.isFinite(value.cutoffMs) ? value.cutoffMs : null,
-    successorTransitionCommitment: cleanTransitionCommitment(value.successorTransitionCommitment),
-    successorTransitionMessageId: cleanTransitionMessageId(value.successorTransitionMessageId)
-  };
-}
-function makeOwnerEpochRecord(manifest, epochSecret, fields = {}) {
-  return normalizeOwnerEpochRecord({
-    v: CHAT_OWNER_EPOCH_ENTRY_VERSION,
+  const core = normalizeTransitionCore({
+    v: CHAT_TRANSITION_VERSION,
     protocol: CHAT_PROTOCOL_VERSION,
-    manifest,
-    epochSecret: secretHex(epochSecret, "epoch secret"),
-    cutoffMs: Number.isFinite(fields.cutoffMs) ? fields.cutoffMs : null,
-    successorTransitionCommitment: fields.successorTransitionCommitment,
-    successorTransitionMessageId: fields.successorTransitionMessageId
+    chatId: parent.chatId,
+    parentEpochId: parent.epochId,
+    parentEpochVersion: parent.epochVersion,
+    nextEpochId: next.epochId,
+    nextEpochVersion: next.epochVersion,
+    nextManifestDigest: epochManifestDigest(next),
+    nextStateCapabilityCommitment: stateCapabilityCommitment(nextStateCapability),
+    proposalId: options.proposalId || toHex(randomBytes3(32)),
+    createdAt: options.createdAt || Date.now()
   });
+  return {
+    ...core,
+    actor: actorChatPK,
+    signature: signChatBytes(actor.signingKey, signatureInput(core))
+  };
 }
-async function sealOwnerEpochRecord(chatPrivateKey, entryId, epochEntryId, record) {
-  const key = ownerEpochKey(chatPrivateKey, entryId, epochEntryId);
+function verifyTransitionCertificate(parentValue, nextValue, certificate) {
+  const parent = normalizeEpochManifest(parentValue);
+  const next = normalizeEpochManifest(nextValue, { parent });
+  const core = normalizeTransitionCore(certificate);
+  const actor = cleanChatHex(certificate?.actor, "transition actor");
+  const member = manifestMember(parent, actor);
+  if (!member || core.chatId !== parent.chatId || core.parentEpochId !== parent.epochId || core.parentEpochVersion !== parent.epochVersion || core.nextEpochId !== next.epochId || core.nextEpochVersion !== next.epochVersion || core.nextManifestDigest !== epochManifestDigest(next)) {
+    return false;
+  }
+  return verifyTransitionSignature(certificate, member.chatSigningPK);
+}
+function verifyTransitionSuccessor(nextValue, certificate) {
   try {
-    const { nonce, ct } = await sealJson(key, normalizeOwnerEpochRecord(record), ownerEpochAad(entryId, epochEntryId));
-    return packBodyData(nonce, ct);
-  } finally {
-    cleanBytes(key);
+    const next = normalizeEpochManifest(nextValue);
+    const core = normalizeTransitionCore(certificate);
+    return core.chatId === next.chatId && core.nextEpochId === next.epochId && core.nextEpochVersion === next.epochVersion && core.nextManifestDigest === epochManifestDigest(next);
+  } catch {
+    return false;
   }
 }
-async function openOwnerEpochRecord(chatPrivateKey, entryId, epochEntryId, body) {
-  const key = ownerEpochKey(chatPrivateKey, entryId, epochEntryId);
+function verifyTransitionSignature(certificate, signingPublicKey) {
   try {
-    const { nonce, ct } = unpackBodyData(body);
-    return normalizeOwnerEpochRecord(await openJson(key, nonce, ct, ownerEpochAad(entryId, epochEntryId)));
-  } finally {
-    cleanBytes(key);
+    const core = normalizeTransitionCore(certificate);
+    const signature = cleanText(certificate?.signature).toLowerCase();
+    return verifyChatBytes(cleanChatHex(signingPublicKey, "transition signing key"), signature, signatureInput(core));
+  } catch {
+    return false;
   }
 }
-function ownEpochEntryId(chatPrivateKey, chatId, epochId) {
-  return ownerEpochEntryId(chatPrivateKey, chatId, epochId);
+function transitionCore(certificate) {
+  return normalizeTransitionCore(certificate);
 }
 
-// ../../core/chat/epochs/bootstrap.js
+// ../../core/chat/ttl.js
 "use client";
-var CHAT_INITIAL_EPOCH_CREATED_AT = 1;
-function initialEpochCommitment(manifestValue, stateCapability) {
-  const manifest = normalizeEpochManifest(manifestValue);
-  return toHex(sha256(canonicalBytes({
-    v: 2,
-    protocol: CHAT_PROTOCOL_VERSION,
-    chatId: manifest.chatId,
-    epochId: manifest.epochId,
-    epochVersion: manifest.epochVersion,
-    manifestDigest: epochManifestDigest(manifest),
-    stateCapabilityCommitment: stateCapabilityCommitment(stateCapability)
-  }, "initial chat epoch commitment")));
+var CHAT_RETENTION_SEEN = "seen";
+var CHAT_RETENTION_24H = "24h";
+var CHAT_RETENTION_FOREVER = "forever";
+var DEFAULT_CHAT_RETENTION = CHAT_RETENTION_SEEN;
+var CHAT_RETENTION_VALUES = Object.freeze([CHAT_RETENTION_SEEN, CHAT_RETENTION_24H]);
+var CHAT_PROTOCOL_RETENTION_VALUES = new Set([...CHAT_RETENTION_VALUES, CHAT_RETENTION_FOREVER]);
+var CHAT_RETENTION_LABELS = Object.freeze({
+  [CHAT_RETENTION_SEEN]: "delete after seen",
+  [CHAT_RETENTION_24H]: "keep for 24h"
+});
+var MESSAGE_STORAGE_TTL_MS = CHAT_UNSAVED_TTL_MS;
+var AFTER_SEEN_MS = CHAT_AFTER_SEEN_MS;
+function hasChatRetention(value) {
+  const retention = cleanText(value);
+  return CHAT_PROTOCOL_RETENTION_VALUES.has(retention);
 }
-function makeInitialEpochManifest({ chatId, epochId, members, lineage }, options = {}) {
-  return normalizeEpochManifest({
-    v: CHAT_MANIFEST_VERSION,
-    protocol: CHAT_PROTOCOL_VERSION,
-    chatId,
-    epochId,
-    epochVersion: 1,
-    parentEpochId: null,
-    createdAt: CHAT_INITIAL_EPOCH_CREATED_AT,
-    lineage,
-    members
-  }, options);
+function cleanChatRetention(value) {
+  const retention = cleanText(value);
+  return hasChatRetention(retention) ? retention : DEFAULT_CHAT_RETENTION;
 }
-
-// ../../core/chat/criticaldelivery.js
-"use client";
-var RETRY_DELAYS_MS = Object.freeze([150, 600]);
-function retryableDeliveryError(error) {
-  const code = cleanText(error?.code).toLowerCase();
-  const message = cleanText(error?.message).toLowerCase();
-  const retryableCodes = [
-    "aborted",
-    "deadline-exceeded",
-    "internal",
-    "network-request-failed",
-    "resource-exhausted",
-    "unavailable",
-    "unknown"
-  ];
-  return retryableCodes.some((value) => code === value || code.endsWith(`/${value}`)) || /\b(network|offline|timed? out|temporar(?:y|ily)|connection)\b/u.test(message);
+function normalizeChatSettings(settings) {
+  const retention = cleanChatRetention(settings?.retention);
+  return { retention };
 }
-function wait(ms) {
-  return ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
+function getMessageRetention(message, fallback = DEFAULT_CHAT_RETENTION) {
+  if (hasChatRetention(message?.retention)) {
+    return cleanChatRetention(message.retention);
+  }
+  return cleanChatRetention(fallback);
 }
-async function pushCriticalInbox(cloud, recipientUid, ping, options = {}, retry = {}) {
-  const deliveryId = cleanText(options.deliveryId).toLowerCase() || toHex(randomBytes3(32));
-  const delays = Array.isArray(retry.delaysMs) ? retry.delaysMs : RETRY_DELAYS_MS;
-  let lastError = null;
-  for (let attempt = 0;attempt <= delays.length; attempt += 1) {
-    try {
-      await cloud.inbox.push(recipientUid, ping, { ...options, deliveryId });
-      return { deliveryId, attempts: attempt + 1 };
-    } catch (error) {
-      lastError = error;
-      if (attempt >= delays.length || !retryableDeliveryError(error))
-        break;
-      await wait(delays[attempt]);
-    }
+function retentionPatch(message) {
+  return hasChatRetention(message?.retention) ? { retention: cleanChatRetention(message.retention) } : {};
+}
+function withMessageRetention(message, retention = DEFAULT_CHAT_RETENTION) {
+  if (!message || typeof message !== "object" || Array.isArray(message)) {
+    return message;
   }
-  throw lastError || new Error("critical inbox delivery failed");
+  const nextRetention = getMessageRetention(message, retention);
+  return message.retention === nextRetention ? message : { ...message, retention: nextRetention };
+}
+function ttlMillis(value) {
+  return timestampMs(value, null, { positive: true });
+}
+function isTtlExpired(value, now = Date.now()) {
+  const ms = ttlMillis(value);
+  return ms != null && ms <= now;
+}
+function newMessageStorageTtlMs(now = Date.now()) {
+  return now + MESSAGE_STORAGE_TTL_MS;
+}
+function messageExpiryMs(retention, seenAt) {
+  if (cleanChatRetention(retention) === CHAT_RETENTION_FOREVER) {
+    return null;
+  }
+  if (!Number.isFinite(seenAt)) {
+    return null;
+  }
+  return cleanChatRetention(retention) === CHAT_RETENTION_24H ? seenAt + AFTER_SEEN_MS : seenAt;
 }
-var criticalDeliveryInternals = Object.freeze({ retryableDeliveryError });
 
-// ../../core/chat/owner.js
+// ../../core/chat/settings.js
 "use client";
-async function prepareMutation(identity, entryId, current, update) {
-  const prepared = await update(current);
-  if (!prepared?.entry) {
-    return { unchanged: true, result: prepared?.result ?? null };
+var SETTINGS_SIGN_SCOPE = encoder.encode("veyl-chat-settings-v3-sign");
+var SIGNATURE_RE = /^[0-9a-f]{128}$/u;
+function cleanRevision(value) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error("chat settings revision required");
   }
-  const entry = {
-    ...prepared.entry,
-    ownerRevision: (current?.ownerRevision || 0) + 1
+  return value;
+}
+function cleanPreviousDigest(value) {
+  return value == null ? null : cleanChatHex(value, "previous chat settings digest");
+}
+function cleanEventId(value) {
+  const eventId = value == null ? null : cleanText(value);
+  if (eventId != null && (!eventId || eventId.length > 128 || eventId.includes("/"))) {
+    throw new Error("invalid chat settings event");
+  }
+  return eventId;
+}
+function normalizeTransitionAuthorization(value, epoch, actor) {
+  if (value == null)
+    return null;
+  if (!value || typeof value !== "object" || Array.isArray(value) || value.kind !== "transition") {
+    throw new Error("invalid chat settings authorization");
+  }
+  const signingPK = cleanChatHex(value.signingPK, "chat settings transition signing key");
+  const certificateCore = transitionCore(value.certificate);
+  const certificate = {
+    ...certificateCore,
+    actor: cleanChatHex(value.certificate?.actor, "transition actor"),
+    signature: cleanText(value.certificate?.signature).toLowerCase()
   };
+  if (certificate.actor !== actor || !SIGNATURE_RE.test(certificate.signature) || transitionCommitment(certificate) !== cleanChatHex(epoch?.transitionCommitment, "transition commitment") || !verifyTransitionSuccessor(epoch.manifest, certificate) || !verifyTransitionSignature(certificate, signingPK)) {
+    throw new Error("invalid chat settings transition authorization");
+  }
+  return { kind: "transition", signingPK, certificate };
+}
+function withAuthorization(core, authorization) {
+  return authorization ? { ...core, authorization } : core;
+}
+function normalizeChatStateSettings(value = {}) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("chat settings required");
+  }
+  const title = value.title == null ? null : cleanText(value.title);
+  if (title != null && (!title || title.length > CHAT_TITLE_MAX_CHARS)) {
+    throw new Error("invalid chat title");
+  }
   return {
-    uid: identity.uid,
-    entryId,
-    record: {
-      body: await sealOwnChatEntry(identity.chatPrivateKey, entryId, entry),
-      revision: entry.ownerRevision,
-      ...Number.isFinite(prepared.tsMs) ? { tsMs: prepared.tsMs } : {},
-      ...prepared.touchTs === true ? { touchTs: true } : {}
-    },
-    epochs: prepared.epochs || [],
-    mlsWrites: prepared.mlsWrites || [],
-    mlsDeletes: prepared.mlsDeletes || [],
-    result: prepared.result === prepared.entry || prepared.result == null ? entry : prepared.result
+    title,
+    avatarRef: cleanChatAvatarRef(value.avatarRef),
+    retention: cleanChatRetention(value.retention)
   };
 }
-async function prepareOwnChatMutation(identity, entryId, current, update) {
-  if (!identity?.uid || !identity?.chatPrivateKey || !entryId || typeof update !== "function") {
-    throw new Error("chat owner mutation required");
+function settingsCore(epoch, settings, options = {}) {
+  const actor = cleanChatHex(epoch?.actor?.chatPK, "chat settings actor");
+  const authorization = normalizeTransitionAuthorization(options.authorization, epoch, actor);
+  if (!epoch?.settingsKey || !epoch?.settingsId || !epoch?.actor?.signingKey || !manifestMember(epoch.manifest, actor) && !authorization) {
+    throw new Error("chat settings epoch actor required");
+  }
+  return withAuthorization({
+    v: CHAT_SETTINGS_VERSION,
+    protocol: CHAT_PROTOCOL_VERSION,
+    chatId: cleanChatHex(epoch.chatId, "chat id"),
+    epochId: cleanChatHex(epoch.epochId, "chat epoch id"),
+    revision: cleanRevision(options.revision),
+    previousDigest: cleanPreviousDigest(options.previousDigest),
+    eventId: cleanEventId(options.eventId),
+    actor,
+    settings: normalizeChatStateSettings(settings)
+  }, authorization);
+}
+function normalizeSettingsCore(value, epoch) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("invalid chat settings state");
+  }
+  const actor = cleanChatHex(value.actor, "chat settings actor");
+  const authorization = normalizeTransitionAuthorization(value.authorization, epoch, actor);
+  const core = withAuthorization({
+    v: value.v,
+    protocol: value.protocol,
+    chatId: cleanChatHex(value.chatId, "chat id"),
+    epochId: cleanChatHex(value.epochId, "chat epoch id"),
+    revision: cleanRevision(value.revision),
+    previousDigest: cleanPreviousDigest(value.previousDigest),
+    eventId: cleanEventId(value.eventId),
+    actor,
+    settings: normalizeChatStateSettings(value.settings)
+  }, authorization);
+  if (core.v !== CHAT_SETTINGS_VERSION || core.protocol !== CHAT_PROTOCOL_VERSION || core.chatId !== epoch.chatId || core.epochId !== epoch.epochId || !manifestMember(epoch.manifest, core.actor) && !authorization) {
+    throw new Error("chat settings binding mismatch");
+  }
+  return core;
+}
+function coreDigest(core) {
+  return toHex(sha256(canonicalBytes(core, "chat settings digest")));
+}
+function settingsHead(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("chat settings record required");
   }
-  const initial = await prepareMutation(identity, entryId, current, update);
   return {
-    ...initial,
-    open: (record) => openOwnChatMutationEntry(identity, entryId, record),
-    prepare: async (record) => {
-      if (!record) {
-        return prepareMutation(identity, entryId, null, update);
-      }
-      if (!record?.body || !Number.isSafeInteger(record.revision) || record.revision < 1) {
-        throw new Error("current chat owner record required");
-      }
-      const opened = await openOwnChatEntry(identity.chatPrivateKey, entryId, record.body);
-      if (opened.ownerRevision !== record.revision) {
-        throw new Error("chat owner revision mismatch");
-      }
-      return prepareMutation(identity, entryId, opened, update);
-    }
+    v: value.v,
+    protocol: value.protocol,
+    chatId: cleanChatHex(value.chatId, "chat id"),
+    epochId: cleanChatHex(value.epochId, "chat epoch id"),
+    revision: cleanRevision(value.revision),
+    previousDigest: cleanPreviousDigest(value.previousDigest),
+    eventId: cleanEventId(value.eventId),
+    digest: cleanChatHex(value.digest, "chat settings digest")
   };
 }
-async function mutateOwnChatEntry(cloud, identity, entryId, current, update) {
-  if (!cloud?.user?.chats?.mutate) {
-    throw new Error("chat owner mutation required");
-  }
-  const mutation = await prepareOwnChatMutation(identity, entryId, current, update);
-  if (mutation.unchanged)
-    return mutation.result;
-  const committed = await cloud.user.chats.mutate(identity.uid, entryId, mutation);
-  return committed?.result ?? mutation.result ?? null;
+function signatureInput2(core) {
+  return concatBytes4(SETTINGS_SIGN_SCOPE, canonicalBytes(core, "chat settings signature"));
 }
-async function openOwnChatMutationEntry(identity, entryId, record) {
-  if (!record)
-    return null;
-  if (!record?.body || !Number.isSafeInteger(record.revision) || record.revision < 1)
-    throw new Error("current chat owner record required");
-  const current = await openOwnChatEntry(identity.chatPrivateKey, entryId, record.body);
-  if (current.ownerRevision !== record.revision) {
-    throw new Error("chat owner revision mismatch");
-  }
-  return current;
+function settingsAad(head) {
+  return canonicalBytes({
+    v: head.v,
+    protocol: head.protocol,
+    chatId: head.chatId,
+    epochId: head.epochId,
+    revision: head.revision,
+    previousDigest: head.previousDigest,
+    eventId: head.eventId,
+    digest: head.digest
+  }, "chat settings aad");
 }
-
-// ../../core/crypto/file.js
-"use client";
-var FILE_SCOPE = "file-body";
-var FILE_IV_BYTES = 12;
-var FILE_TAG_BYTES = 16;
-function createFileKey() {
-  return randomBytes3(32);
+async function sealChatSettings(epoch, settings, options = {}) {
+  const core = settingsCore(epoch, settings, options);
+  const digest = coreDigest(core);
+  const head = settingsHead({ ...core, digest });
+  const plaintext = encoder.encode(JSON.stringify({
+    core,
+    signature: signChatBytes(epoch.actor.signingKey, signatureInput2(core))
+  }));
+  try {
+    const { nonce, ct } = await sealBox(epoch.settingsKey, plaintext, settingsAad(head));
+    const body = concatBytes4(nonce, ct);
+    if (body.length > CHAT_SETTINGS_BODY_MAX_BYTES) {
+      throw new Error("chat settings too large");
+    }
+    return { id: epoch.settingsId, head, body, actor: core.actor, settings: core.settings };
+  } finally {
+    cleanBytes(plaintext);
+  }
 }
-function encodeFileKey(key) {
-  return toHex(toBytes32(key, "file key"));
+async function openChatSettings(epoch, record) {
+  if (!epoch?.settingsKey || !epoch?.settingsId || record?.id !== epoch.settingsId) {
+    throw new Error("chat settings address mismatch");
+  }
+  const head = settingsHead(record.head);
+  if (head.v !== CHAT_SETTINGS_VERSION || head.protocol !== CHAT_PROTOCOL_VERSION || head.chatId !== epoch.chatId || head.epochId !== epoch.epochId) {
+    throw new Error("chat settings binding mismatch");
+  }
+  const body = toBytes(record.body, "chat settings body");
+  if (body.length <= 24 || body.length > CHAT_SETTINGS_BODY_MAX_BYTES) {
+    throw new Error("invalid chat settings body");
+  }
+  let plaintext = null;
+  try {
+    plaintext = await openBox(epoch.settingsKey, body.subarray(0, 24), body.subarray(24), settingsAad(head));
+    const opened = JSON.parse(decoder.decode(plaintext));
+    const core = normalizeSettingsCore(opened?.core, epoch);
+    const signature = cleanText(opened?.signature).toLowerCase();
+    const member = manifestMember(epoch.manifest, core.actor);
+    const signingPK = member?.chatSigningPK || core.authorization?.signingPK;
+    if (core.revision !== head.revision || core.previousDigest !== head.previousDigest || core.eventId !== head.eventId || coreDigest(core) !== head.digest || !SIGNATURE_RE.test(signature) || !signingPK || !verifyChatBytes(signingPK, signature, signatureInput2(core))) {
+      throw new Error("invalid chat settings signature");
+    }
+    return { id: epoch.settingsId, head, actor: core.actor, settings: core.settings };
+  } finally {
+    cleanBytes(plaintext);
+  }
 }
-function decodeFileKey(key) {
-  return toBytes32(key, "file key");
+function chatSettingsProjection(snapshot) {
+  return normalizeChatSettingsProjection({
+    revision: cleanRevision(snapshot?.head?.revision),
+    digest: cleanChatHex(snapshot?.head?.digest, "chat settings digest"),
+    values: normalizeChatStateSettings(snapshot?.settings)
+  });
 }
-function getFileAadForPath(scope) {
-  if (!scope) {
-    throw new Error("file scope required");
+function normalizeChatSettingsProjection(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("chat settings projection required");
   }
-  return encodeScope(FILE_SCOPE, [scope]);
+  return {
+    revision: cleanRevision(value.revision),
+    digest: cleanChatHex(value.digest, "chat settings digest"),
+    values: normalizeChatStateSettings(value.values)
+  };
 }
-function getSubtleCrypto() {
-  const subtle = globalThis.crypto?.subtle;
-  if (!subtle) {
-    throw new Error("WebCrypto AES-GCM unavailable");
+async function createEpochChatSettings(epochState, identity, values, options = {}) {
+  const epoch = openChatEpoch({
+    manifest: epochState?.manifest,
+    epochSecret: epochState?.epochSecret,
+    actor: {
+      chatPK: identity?.chatPK,
+      signingKey: {
+        publicKey: identity?.chatSigningPK,
+        secret: identity?.chatSigningSecret
+      }
+    }
+  });
+  try {
+    const sealed = await sealChatSettings(epoch, values, options);
+    return { sealed, projection: chatSettingsProjection(sealed) };
+  } finally {
+    closeChatEpoch(epoch);
   }
-  return subtle;
 }
-async function importAesKey(key, usages) {
-  return getSubtleCrypto().importKey("raw", toBytes32(key, "file key"), { name: "AES-GCM" }, false, usages);
-}
-async function sealFile(key, bytes, scope) {
-  const fileKey = new Uint8Array(toBytes32(key, "file key"));
+async function createTransitionEpochChatSettings(epochState, identity, certificate, values, options = {}) {
+  const epoch = openChatEpoch({
+    manifest: epochState?.manifest,
+    epochSecret: epochState?.epochSecret
+  });
+  epoch.actor = {
+    chatPK: cleanChatHex(identity?.chatPK, "chat settings actor"),
+    signingKey: {
+      publicKey: cleanChatHex(identity?.chatSigningPK, "chat settings signing key"),
+      secret: identity?.chatSigningSecret
+    }
+  };
+  epoch.transitionCommitment = transitionCommitment(certificate);
   try {
-    const cryptoKey = await importAesKey(fileKey, ["encrypt"]);
-    const iv = randomBytes3(FILE_IV_BYTES);
-    const ct = await getSubtleCrypto().encrypt({
-      name: "AES-GCM",
-      iv,
-      tagLength: FILE_TAG_BYTES * 8,
-      additionalData: getFileAadForPath(scope)
-    }, cryptoKey, toBytes(bytes, "plaintext"));
-    return packBodyData(iv, new Uint8Array(ct));
+    const sealed = await sealChatSettings(epoch, values, {
+      ...options,
+      authorization: {
+        kind: "transition",
+        signingPK: identity?.chatSigningPK,
+        certificate
+      }
+    });
+    return { sealed, projection: chatSettingsProjection(sealed) };
   } finally {
-    cleanBytes(fileKey);
+    closeChatEpoch(epoch);
   }
 }
-async function openFileForPath(key, body, scope) {
-  const fileKey = new Uint8Array(toBytes32(key, "file key"));
+async function readEpochChatSettings(cloud, epochState) {
+  const epoch = openChatEpoch({
+    manifest: epochState?.manifest,
+    epochSecret: epochState?.epochSecret
+  });
+  epoch.transitionCommitment = cleanChatHex(epochState?.transitionCommitment, "transition commitment");
   try {
-    const cryptoKey = await importAesKey(fileKey, ["decrypt"]);
-    const { nonce, ct } = unpackBodyData(body, FILE_IV_BYTES);
-    const pt = await getSubtleCrypto().decrypt({
-      name: "AES-GCM",
-      iv: nonce,
-      tagLength: FILE_TAG_BYTES * 8,
-      additionalData: getFileAadForPath(scope)
-    }, cryptoKey, ct);
-    return new Uint8Array(pt);
+    const record = await cloud?.chat?.settings?.read?.(epoch.settingsId);
+    if (!record)
+      throw new Error("chat settings unavailable");
+    return chatSettingsProjection(await openChatSettings(epoch, record));
   } finally {
-    cleanBytes(fileKey);
+    closeChatEpoch(epoch);
   }
 }
-
-// ../../core/chat/filepayload.js
-"use client";
-var CHAT_MEDIA_ROOT = "chatEpochs";
-var SHARED_MEDIA_ROOT = "shared";
-var CHAT_MEDIA_TTL_MS2 = CHAT_MEDIA_TTL_MS;
-var MAX_CHAT_UPLOAD_BYTES = CHAT_UPLOAD_MAX_BYTES;
-var CHAT_VIDEO_TRANSCODE_VIDEO_BITRATE_BPS2 = CHAT_VIDEO_TRANSCODE_VIDEO_BITRATE_BPS;
-var CHAT_VIDEO_TRANSCODE_AUDIO_BITRATE_BPS2 = CHAT_VIDEO_TRANSCODE_AUDIO_BITRATE_BPS;
-var CHAT_VIDEO_TRANSCODE_TOTAL_BITRATE_BPS = CHAT_VIDEO_TRANSCODE_VIDEO_BITRATE_BPS2 + CHAT_VIDEO_TRANSCODE_AUDIO_BITRATE_BPS2;
-var CHAT_ID_PATTERN = "[0-9a-fA-F]{64}";
-var SHARED_MEDIA_ID_PATTERN = "[0-9a-fA-F]{32}";
-var MEDIA_ID_PATTERN = "[0-9a-fA-F]{32}";
-var CHAT_MEDIA_FILE_PATTERN = new RegExp(`^${CHAT_MEDIA_ROOT}/(${CHAT_ID_PATTERN})/(${MEDIA_ID_PATTERN})$`);
-var SHARED_MEDIA_FILE_PATTERN = new RegExp(`^${SHARED_MEDIA_ROOT}/(${SHARED_MEDIA_ID_PATTERN})$`);
-function cleanMediaEpochId(value) {
-  const epochId = String(value || "").trim();
-  if (!new RegExp(`^${CHAT_ID_PATTERN}$`).test(epochId)) {
-    throw new Error("invalid media epoch id");
+function epochChatSettingsId(epochState) {
+  const epoch = openChatEpoch({
+    manifest: epochState?.manifest,
+    epochSecret: epochState?.epochSecret
+  });
+  try {
+    return epoch.settingsId;
+  } finally {
+    closeChatEpoch(epoch);
   }
-  return epochId.toLowerCase();
 }
-function cleanMediaId(value) {
-  const mediaId = String(value || "").trim();
-  if (!new RegExp(`^${MEDIA_ID_PATTERN}$`).test(mediaId)) {
-    throw new Error("invalid media id");
+
+// ../../core/chat/entry.js
+"use client";
+var CHAT_ENTRY_VERSION = 4;
+var CHAT_OWNER_EPOCH_ENTRY_VERSION = 2;
+function ownChatEntryId(chatPrivateKey, chatId) {
+  const key = deriveKey(toBytes32(chatPrivateKey, "chat private key"), "user-chat-entry-id-v4", [cleanChatHex(chatId, "chat id")], 16);
+  try {
+    return toHex(key);
+  } finally {
+    cleanBytes(key);
   }
-  return mediaId.toLowerCase();
 }
-function cleanSharedMediaId(value) {
-  const sharedId = String(value || "").trim();
-  if (!new RegExp(`^${SHARED_MEDIA_ID_PATTERN}$`).test(sharedId)) {
-    throw new Error("invalid shared media id");
-  }
-  return sharedId.toLowerCase();
+function entryKey(chatPrivateKey, entryId) {
+  return deriveKey(toBytes32(chatPrivateKey, "chat private key"), "user-chat-entry-v4", [cleanText(entryId)]);
 }
-function makeChatMediaId() {
-  return toHex(randomBytes3(16));
+function entryAad(entryId) {
+  return canonicalBytes({ v: CHAT_ENTRY_VERSION, protocol: CHAT_PROTOCOL_VERSION, entryId }, "chat entry aad");
 }
-function mediaFilePath(epochId, mediaId) {
-  const nextEpochId = cleanMediaEpochId(epochId);
-  const nextMediaId = cleanMediaId(mediaId);
-  return `${CHAT_MEDIA_ROOT}/${nextEpochId}/${nextMediaId}`;
+function ownerEpochKey(chatPrivateKey, entryId, epochEntryId) {
+  return deriveKey(toBytes32(chatPrivateKey, "chat private key"), "user-chat-epoch-entry-v3", [entryId, epochEntryId]);
 }
-function sharedMediaFilePath(sharedId) {
-  const nextSharedId = cleanSharedMediaId(sharedId);
-  return `${SHARED_MEDIA_ROOT}/${nextSharedId}`;
+function ownerEpochAad(entryId, epochEntryId) {
+  return canonicalBytes({
+    v: CHAT_OWNER_EPOCH_ENTRY_VERSION,
+    protocol: CHAT_PROTOCOL_VERSION,
+    entryId,
+    epochEntryId
+  }, "chat owner epoch aad");
 }
-function makeSharedMediaId() {
-  return toHex(randomBytes3(16));
+function cleanTransitionCommitment(value) {
+  return cleanChatHex(value, "transition commitment");
 }
-function getMediaFileRef(path) {
-  const value = String(path || "").trim();
-  const chatMatch = value.match(CHAT_MEDIA_FILE_PATTERN);
-  if (chatMatch?.[1] && chatMatch?.[2]) {
-    return {
-      type: "chat",
-      epochId: chatMatch[1].toLowerCase(),
-      mediaId: chatMatch[2].toLowerCase()
-    };
-  }
-  const sharedMatch = value.match(SHARED_MEDIA_FILE_PATTERN);
-  if (sharedMatch?.[1]) {
-    return {
-      type: "shared",
-      sharedId: sharedMatch[1].toLowerCase()
-    };
+function cleanTransitionMessageId(value) {
+  const messageId = cleanText(value);
+  if (!messageId || messageId.length > 128 || messageId.includes("/")) {
+    throw new Error("invalid transition message id");
   }
-  throw new Error("invalid media file path");
+  return messageId;
 }
-function getChatMediaFileRef(path) {
-  const ref = getMediaFileRef(path);
-  if (ref?.type !== "chat") {
-    throw new Error("invalid media file path");
+function normalizeRoutes(value) {
+  if (value == null)
+    return {};
+  if (typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("invalid chat routes");
   }
-  return ref;
-}
-function getSharedMediaFileRef(path) {
-  const ref = getMediaFileRef(path);
-  if (ref?.type !== "shared") {
-    throw new Error("invalid shared media file path");
+  const routes = {};
+  for (const [rawChatPK, route] of Object.entries(value)) {
+    const chatPK = cleanChatHex(rawChatPK, "chat route member");
+    if (!route || typeof route !== "object" || Array.isArray(route)) {
+      throw new Error("invalid chat route");
+    }
+    const uid = cleanText(route.uid);
+    const deliveryCapability = route.deliveryCapability == null ? null : cleanChatHex(route.deliveryCapability, "delivery capability");
+    const notificationPK = route.notificationPK == null ? null : cleanChatHex(route.notificationPK, "notification key");
+    const generation = Number.isSafeInteger(route.generation) && route.generation > 0 ? route.generation : 1;
+    if (!uid || uid.length > 128) {
+      throw new Error("chat route uid required");
+    }
+    routes[chatPK] = { uid, deliveryCapability, notificationPK, generation };
   }
-  return ref;
+  return routes;
 }
-function uploadByteLength(value) {
-  if (Number.isFinite(value?.byteLength)) {
-    return value.byteLength;
+function normalizeCurrentEpoch(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("current chat epoch required");
   }
-  if (Number.isFinite(value?.size)) {
-    return value.size;
+  const manifest = normalizeEpochManifest(value.manifest);
+  return {
+    manifest,
+    epochSecret: cleanChatHex(value.epochSecret, "epoch secret"),
+    stateCapability: cleanChatHex(value.stateCapability, "state capability"),
+    transitionCommitment: cleanTransitionCommitment(value.transitionCommitment),
+    mlsPackageId: cleanChatHex(value.mlsPackageId, "mls epoch package id"),
+    mlsPackageDigest: cleanChatHex(value.mlsPackageDigest, "mls epoch package digest"),
+    settings: normalizeChatSettingsProjection(value.settings)
+  };
+}
+function normalizeOwnerEntry(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || value.v !== CHAT_ENTRY_VERSION || value.protocol !== CHAT_PROTOCOL_VERSION) {
+    throw new Error("invalid chat entry");
   }
-  if (Number.isFinite(value)) {
-    return value;
+  const current = normalizeCurrentEpoch(value.current);
+  if (current.manifest.chatId !== cleanChatHex(value.chatId, "chat id")) {
+    throw new Error("chat entry id mismatch");
   }
-  return null;
+  return {
+    v: CHAT_ENTRY_VERSION,
+    protocol: CHAT_PROTOCOL_VERSION,
+    ownerRevision: Number.isSafeInteger(value.ownerRevision) && value.ownerRevision > 0 ? value.ownerRevision : (() => {
+      throw new Error("chat owner revision required");
+    })(),
+    chatId: current.manifest.chatId,
+    current,
+    routes: normalizeRoutes(value.routes),
+    saved: value.saved || null,
+    startMs: Number.isFinite(value.startMs) ? value.startMs : null,
+    deliveryRegistered: value.deliveryRegistered === true,
+    notificationTag: cleanText(value.notificationTag) || null
+  };
 }
-function makeChatUploadTooLargeError(bytes, maxBytes = MAX_CHAT_UPLOAD_BYTES) {
-  const error = new Error("upload too large");
-  error.code = "upload-too-large";
-  error.maxBytes = maxBytes;
-  if (Number.isFinite(bytes)) {
-    error.bytes = bytes;
+async function sealOwnChatEntry(chatPrivateKey, entryId, entry) {
+  const key = entryKey(chatPrivateKey, entryId);
+  try {
+    const { nonce, ct } = await sealJson(key, normalizeOwnerEntry(entry), entryAad(entryId));
+    return packBodyData(nonce, ct);
+  } finally {
+    cleanBytes(key);
   }
-  return error;
 }
-function assertChatUploadByteSize(bytes, maxBytes = MAX_CHAT_UPLOAD_BYTES) {
-  const length = uploadByteLength(bytes);
-  if (!Number.isFinite(length)) {
-    throw new Error("upload bytes required");
-  }
-  if (length <= 0 || length > maxBytes) {
-    throw makeChatUploadTooLargeError(length, maxBytes);
+async function openOwnChatEntry(chatPrivateKey, entryId, body) {
+  const key = entryKey(chatPrivateKey, entryId);
+  try {
+    const { nonce, ct } = unpackBodyData(body);
+    return normalizeOwnerEntry(await openJson(key, nonce, ct, entryAad(entryId)));
+  } finally {
+    cleanBytes(key);
   }
-  return length;
 }
-async function toUploadBytes(data) {
-  if (typeof Blob !== "undefined" && data instanceof Blob) {
-    if (typeof data.arrayBuffer === "function") {
-      return new Uint8Array(await data.arrayBuffer());
-    }
-    if (typeof FileReader !== "undefined") {
-      return new Promise((resolve, reject) => {
-        const reader = new FileReader;
-        reader.onload = () => resolve(new Uint8Array(reader.result));
-        reader.onerror = () => reject(reader.error || new Error("blob read failed"));
-        reader.readAsArrayBuffer(data);
-      });
-    }
-    if (typeof Response !== "undefined") {
-      return new Uint8Array(await new Response(data).arrayBuffer());
-    }
-  }
-  if (typeof data?.arrayBuffer === "function") {
-    return new Uint8Array(await data.arrayBuffer());
+function makeOwnChatEntry(epoch, fields = {}) {
+  const manifest = normalizeEpochManifest(epoch?.manifest);
+  return normalizeOwnerEntry({
+    v: CHAT_ENTRY_VERSION,
+    protocol: CHAT_PROTOCOL_VERSION,
+    ownerRevision: Number.isSafeInteger(fields.ownerRevision) && fields.ownerRevision > 0 ? fields.ownerRevision : 1,
+    chatId: manifest.chatId,
+    current: {
+      manifest,
+      epochSecret: secretHex(epoch.epochSecret, "epoch secret"),
+      stateCapability: secretHex(epoch.stateCapability, "state capability"),
+      transitionCommitment: cleanTransitionCommitment(epoch.transitionCommitment),
+      mlsPackageId: cleanChatHex(epoch.mlsPackageId, "mls epoch package id"),
+      mlsPackageDigest: cleanChatHex(epoch.mlsPackageDigest, "mls epoch package digest"),
+      settings: normalizeChatSettingsProjection(epoch.settings)
+    },
+    routes: fields.routes || {},
+    saved: fields.saved || null,
+    startMs: Number.isFinite(fields.startMs) ? fields.startMs : null,
+    deliveryRegistered: fields.deliveryRegistered === true,
+    notificationTag: cleanText(fields.notificationTag) || null
+  });
+}
+function normalizeOwnerEpochRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || value.v !== CHAT_OWNER_EPOCH_ENTRY_VERSION || value.protocol !== CHAT_PROTOCOL_VERSION) {
+    throw new Error("invalid owner epoch entry");
   }
-  return toBytes(data, "upload bytes");
+  const manifest = normalizeEpochManifest(value.manifest);
+  return {
+    v: CHAT_OWNER_EPOCH_ENTRY_VERSION,
+    protocol: CHAT_PROTOCOL_VERSION,
+    chatId: manifest.chatId,
+    epochId: manifest.epochId,
+    epochVersion: manifest.epochVersion,
+    manifest,
+    epochSecret: cleanChatHex(value.epochSecret, "epoch secret"),
+    cutoffMs: Number.isFinite(value.cutoffMs) ? value.cutoffMs : null,
+    successorTransitionCommitment: cleanTransitionCommitment(value.successorTransitionCommitment),
+    successorTransitionMessageId: cleanTransitionMessageId(value.successorTransitionMessageId)
+  };
 }
-async function makeChatFileUploadPayload(epochId, cid, data, { cacheControl = "private, max-age=0, no-transform" } = {}) {
-  const nextEpochId = cleanMediaEpochId(epochId);
-  const mediaId = makeChatMediaId();
-  const path = mediaFilePath(nextEpochId, mediaId);
-  const expiresAt = Date.now() + CHAT_MEDIA_TTL_MS2;
-  const key = createFileKey();
+function makeOwnerEpochRecord(manifest, epochSecret, fields = {}) {
+  return normalizeOwnerEpochRecord({
+    v: CHAT_OWNER_EPOCH_ENTRY_VERSION,
+    protocol: CHAT_PROTOCOL_VERSION,
+    manifest,
+    epochSecret: secretHex(epochSecret, "epoch secret"),
+    cutoffMs: Number.isFinite(fields.cutoffMs) ? fields.cutoffMs : null,
+    successorTransitionCommitment: fields.successorTransitionCommitment,
+    successorTransitionMessageId: fields.successorTransitionMessageId
+  });
+}
+async function sealOwnerEpochRecord(chatPrivateKey, entryId, epochEntryId, record) {
+  const key = ownerEpochKey(chatPrivateKey, entryId, epochEntryId);
   try {
-    const uploadBytes = await toUploadBytes(data);
-    assertChatUploadByteSize(uploadBytes);
-    const body = await sealFile(key, uploadBytes, path);
-    assertChatUploadByteSize(body);
-    return {
-      epochId: nextEpochId,
-      mediaId,
-      path,
-      body,
-      metadata: {
-        contentType: "application/octet-stream",
-        cacheControl
-      },
-      file: {
-        p: path,
-        k: encodeFileKey(key),
-        x: expiresAt
-      }
-    };
-  } catch (error) {
-    if (error && typeof error === "object") {
-      error.path = error?.path || path;
-      error.cid = error?.cid || cid;
-    }
-    throw error;
+    const { nonce, ct } = await sealJson(key, normalizeOwnerEpochRecord(record), ownerEpochAad(entryId, epochEntryId));
+    return packBodyData(nonce, ct);
   } finally {
     cleanBytes(key);
   }
 }
-async function makeSharedFileUploadPayload(data, { contentType = "application/octet-stream", cacheControl = "private, max-age=0, no-transform" } = {}) {
-  const sharedId = makeSharedMediaId();
-  const path = sharedMediaFilePath(sharedId);
-  const expiresAt = Date.now() + CHAT_MEDIA_TTL_MS2;
-  const key = createFileKey();
+async function openOwnerEpochRecord(chatPrivateKey, entryId, epochEntryId, body) {
+  const key = ownerEpochKey(chatPrivateKey, entryId, epochEntryId);
   try {
-    const uploadBytes = await toUploadBytes(data);
-    assertChatUploadByteSize(uploadBytes);
-    const body = await sealFile(key, uploadBytes, path);
-    assertChatUploadByteSize(body);
-    return {
-      sharedId,
-      path,
-      body,
-      metadata: {
-        contentType,
-        cacheControl
-      },
-      file: {
-        p: path,
-        k: encodeFileKey(key),
-        x: expiresAt
-      }
-    };
-  } catch (error) {
-    if (error && typeof error === "object") {
-      error.path = error?.path || path;
-      error.sharedId = error?.sharedId || sharedId;
-    }
-    throw error;
+    const { nonce, ct } = unpackBodyData(body);
+    return normalizeOwnerEpochRecord(await openJson(key, nonce, ct, ownerEpochAad(entryId, epochEntryId)));
   } finally {
     cleanBytes(key);
   }
 }
+function ownEpochEntryId(chatPrivateKey, chatId, epochId) {
+  return ownerEpochEntryId(chatPrivateKey, chatId, epochId);
+}
 
-// ../../core/files.js
+// ../../core/chat/epochs/bootstrap.js
 "use client";
-function makeFileId(size = 8) {
-  return toHex(randomBytes3(size));
+var CHAT_INITIAL_EPOCH_CREATED_AT = 1;
+function initialEpochCommitment(manifestValue, stateCapability) {
+  const manifest = normalizeEpochManifest(manifestValue);
+  return toHex(sha256(canonicalBytes({
+    v: 2,
+    protocol: CHAT_PROTOCOL_VERSION,
+    chatId: manifest.chatId,
+    epochId: manifest.epochId,
+    epochVersion: manifest.epochVersion,
+    manifestDigest: epochManifestDigest(manifest),
+    stateCapabilityCommitment: stateCapabilityCommitment(stateCapability)
+  }, "initial chat epoch commitment")));
 }
-function setErrorStage(error, stage, extra = {}) {
-  if (!error || typeof error !== "object") {
-    return error;
-  }
-  error.stage = error?.stage || stage;
-  Object.assign(error, extra);
-  return error;
+function makeInitialEpochManifest({ chatId, epochId, members, lineage }, options = {}) {
+  return normalizeEpochManifest({
+    v: CHAT_MANIFEST_VERSION,
+    protocol: CHAT_PROTOCOL_VERSION,
+    chatId,
+    epochId,
+    epochVersion: 1,
+    parentEpochId: null,
+    createdAt: CHAT_INITIAL_EPOCH_CREATED_AT,
+    lineage,
+    members
+  }, options);
 }
-async function makeChatFileUpload(epochId, cid, data, { cacheControl = "private, max-age=0, no-transform" } = {}) {
-  try {
-    return await makeChatFileUploadPayload(epochId, cid, data, {
-      cacheControl
-    });
-  } catch (error) {
-    throw setErrorStage(error, "encrypt", {
-      ...error?.path ? { path: error.path } : {},
-      cid
-    });
-  }
+
+// ../../core/chat/criticaldelivery.js
+"use client";
+var RETRY_DELAYS_MS = Object.freeze([150, 600]);
+function retryableDeliveryError(error) {
+  const code = cleanText(error?.code).toLowerCase();
+  const message = cleanText(error?.message).toLowerCase();
+  const retryableCodes = [
+    "aborted",
+    "deadline-exceeded",
+    "internal",
+    "network-request-failed",
+    "resource-exhausted",
+    "unavailable",
+    "unknown"
+  ];
+  return retryableCodes.some((value) => code === value || code.endsWith(`/${value}`)) || /\b(network|offline|timed? out|temporar(?:y|ily)|connection)\b/u.test(message);
 }
-async function putChatFile(epochId, cid, data, options) {
-  const upload = await makeChatFileUpload(epochId, cid, data, options);
-  try {
-    if (typeof options?.uploadChatMedia !== "function") {
-      throw new Error("chat media upload required");
+function wait(ms) {
+  return ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
+}
+async function pushCriticalInbox(cloud, recipientUid, ping, options = {}, retry = {}) {
+  const deliveryId = cleanText(options.deliveryId).toLowerCase() || toHex(randomBytes3(32));
+  const delays = Array.isArray(retry.delaysMs) ? retry.delaysMs : RETRY_DELAYS_MS;
+  let lastError = null;
+  for (let attempt = 0;attempt <= delays.length; attempt += 1) {
+    try {
+      await cloud.inbox.push(recipientUid, ping, { ...options, deliveryId });
+      return { deliveryId, attempts: attempt + 1 };
+    } catch (error) {
+      lastError = error;
+      if (attempt >= delays.length || !retryableDeliveryError(error))
+        break;
+      await wait(delays[attempt]);
     }
-    await options.uploadChatMedia(upload);
-    return upload.file;
-  } catch (error) {
-    throw setErrorStage(error, "upload", { path: upload.path, cid });
   }
+  throw lastError || new Error("critical inbox delivery failed");
 }
-async function makeSharedFileUpload(data, { contentType = "application/octet-stream", cacheControl = "private, max-age=0, no-transform" } = {}) {
-  try {
-    return await makeSharedFileUploadPayload(data, {
-      contentType,
-      cacheControl
-    });
-  } catch (error) {
-    throw setErrorStage(error, "encrypt", {
-      ...error?.path ? { path: error.path } : {}
-    });
+var criticalDeliveryInternals = Object.freeze({ retryableDeliveryError });
+
+// ../../core/chat/owner.js
+"use client";
+async function prepareMutation(identity, entryId, current, update) {
+  const prepared = await update(current);
+  if (!prepared?.entry) {
+    return { unchanged: true, result: prepared?.result ?? null };
   }
+  const entry = {
+    ...prepared.entry,
+    ownerRevision: (current?.ownerRevision || 0) + 1
+  };
+  return {
+    uid: identity.uid,
+    entryId,
+    record: {
+      body: await sealOwnChatEntry(identity.chatPrivateKey, entryId, entry),
+      revision: entry.ownerRevision,
+      ...Number.isFinite(prepared.tsMs) ? { tsMs: prepared.tsMs } : {},
+      ...prepared.touchTs === true ? { touchTs: true } : {}
+    },
+    epochs: prepared.epochs || [],
+    mlsWrites: prepared.mlsWrites || [],
+    mlsDeletes: prepared.mlsDeletes || [],
+    result: prepared.result === prepared.entry || prepared.result == null ? entry : prepared.result
+  };
 }
-async function putSharedFile(data, options = {}) {
-  const upload = await makeSharedFileUpload(data, options);
-  try {
-    if (typeof options?.uploadSharedMedia !== "function") {
-      throw new Error("shared media upload required");
-    }
-    await options.uploadSharedMedia(upload);
-    return upload.file;
-  } catch (error) {
-    throw setErrorStage(error, "upload", { path: upload.path });
+async function prepareOwnChatMutation(identity, entryId, current, update) {
+  if (!identity?.uid || !identity?.chatPrivateKey || !entryId || typeof update !== "function") {
+    throw new Error("chat owner mutation required");
   }
-}
-async function readChatFile(readChatMedia, file) {
-  let body;
-  try {
-    if (typeof readChatMedia !== "function") {
-      throw new Error("chat media read required");
+  const initial = await prepareMutation(identity, entryId, current, update);
+  return {
+    ...initial,
+    open: (record) => openOwnChatMutationEntry(identity, entryId, record),
+    prepare: async (record) => {
+      if (!record) {
+        return prepareMutation(identity, entryId, null, update);
+      }
+      if (!record?.body || !Number.isSafeInteger(record.revision) || record.revision < 1) {
+        throw new Error("current chat owner record required");
+      }
+      const opened = await openOwnChatEntry(identity.chatPrivateKey, entryId, record.body);
+      if (opened.ownerRevision !== record.revision) {
+        throw new Error("chat owner revision mismatch");
+      }
+      return prepareMutation(identity, entryId, opened, update);
     }
-    body = await readChatMedia(file?.p);
-  } catch (error) {
-    error.path = error?.path || file?.p || null;
-    error.stage = error?.stage || "download";
-    throw error;
+  };
+}
+async function mutateOwnChatEntry(cloud, identity, entryId, current, update) {
+  if (!cloud?.user?.chats?.mutate) {
+    throw new Error("chat owner mutation required");
   }
-  try {
-    getMediaFileRef(file?.p);
-    const bytes = await openFileForPath(decodeFileKey(file?.k), body, file?.p);
-    return bytes;
-  } catch (error) {
-    error.path = file?.p || null;
-    error.stage = "decrypt";
-    throw error;
+  const mutation = await prepareOwnChatMutation(identity, entryId, current, update);
+  if (mutation.unchanged)
+    return mutation.result;
+  const committed = await cloud.user.chats.mutate(identity.uid, entryId, mutation);
+  return committed?.result ?? mutation.result ?? null;
+}
+async function openOwnChatMutationEntry(identity, entryId, record) {
+  if (!record)
+    return null;
+  if (!record?.body || !Number.isSafeInteger(record.revision) || record.revision < 1)
+    throw new Error("current chat owner record required");
+  const current = await openOwnChatEntry(identity.chatPrivateKey, entryId, record.body);
+  if (current.ownerRevision !== record.revision) {
+    throw new Error("chat owner revision mismatch");
   }
+  return current;
 }
 
 // ../../core/chat/messages/types.js
@@ -11484,7 +11523,7 @@ function cleanChatSettingsEventTitle(value) {
   if (value == null)
     return null;
   const title = cleanText(value);
-  if (!title || title.length > 128)
+  if (!title || title.length > CHAT_TITLE_MAX_CHARS)
     throw new Error("invalid chat settings event title");
   return title;
 }
@@ -11499,10 +11538,7 @@ function makeChatSettingsMsg(revision, digest, changes = [], values = {}) {
   const titleChanged = cleanChanges.includes("title");
   const avatarChanged = cleanChanges.includes("avatarRef");
   const title = titleChanged ? cleanChatSettingsEventTitle(values?.title) : undefined;
-  const avatarRef = avatarChanged ? values?.avatarRef == null ? null : chatAvatarDataUrl(values.avatarRef) : undefined;
-  if (avatarChanged && values?.avatarRef != null && !avatarRef) {
-    throw new Error("invalid chat settings event avatar");
-  }
+  const avatarRef = avatarChanged ? values?.avatarRef == null ? null : cleanChatAvatarRef(values.avatarRef) : undefined;
   return {
     t: SYSTEM_MSG_TYPE,
     sys: SYSTEM_SETTINGS_KIND,
@@ -11525,7 +11561,7 @@ function isChatSettingsMsg(msg) {
       return false;
     }
   }
-  return !changes.includes("avatarRef") || msg?.avatarRef == null || !!chatAvatarDataUrl(msg.avatarRef);
+  return !changes.includes("avatarRef") || msg?.avatarRef == null || !!chatAvatarFile(msg.avatarRef);
 }
 function isPendingChatSettingsMsg(msg) {
   return msg?.t === SYSTEM_MSG_TYPE && msg?.sys === SYSTEM_SETTINGS_KIND && msg?.pending === true && String(msg?.id || "").startsWith("local:") && chatSettingsEventChanges(msg).length === 1 && chatSettingsEventChanges(msg)[0] === "retention";
@@ -11533,7 +11569,7 @@ function isPendingChatSettingsMsg(msg) {
 function getChatSettingsEventAvatar(msg) {
   if (!isChatSettingsMsg(msg) || !chatSettingsEventChanges(msg).includes("avatarRef"))
     return "";
-  return chatAvatarDataUrl(msg?.avatarRef);
+  return chatAvatarFile(msg?.avatarRef) ? msg.avatarRef : "";
 }
 function isSystemMsg(msg) {
   return !!getSystemMsgText(msg) && (msg?.t === SYSTEM_MSG_TYPE || isMembershipEventMsg(msg));
@@ -12242,13 +12278,12 @@ function withChatPreviewExpired(preview, expiredAt) {
     sourceTs: getChatPreviewSourceTs(preview)
   }));
 }
-function chatPreviewWantsAttention(preview, chatPK) {
+function chatPreviewCountsAsUnseen(preview, chatPK) {
   if (!preview || fromSelf(preview, chatPK)) {
     return false;
   }
   if (isReactionMsg(preview)) {
-    const targetFrom = cleanText(preview?.targetFrom);
-    return !!cleanText(preview?.emoji) && (!targetFrom || targetFrom === chatPK);
+    return !!cleanText(preview?.emoji);
   }
   return canRenderPreviewContent(preview);
 }
@@ -14656,7 +14691,7 @@ function getPeersFromChats(chats) {
 }
 function isChatUnseenForUser(chatData, userChatPK) {
   const last = chatData?.preview;
-  if (!last?.ts || !chatPreviewWantsAttention(last, userChatPK))
+  if (!last?.ts || !chatPreviewCountsAsUnseen(last, userChatPK))
     return false;
   const readMs = timestampMs(chatData?.readMs, null);
   const lastMs = timestampMs(last.ts, null);
@@ -16180,11 +16215,13 @@ function createChatDelete({
   listActionsRef,
   closeMessageBatchRef,
   mutationGate,
+  reconcileEpoch,
   diag
 }) {
   const pendingDeleteIdsRef = { current: new Set };
   const locallyDeletedChatIdsRef = { current: new Set };
   const deletedChatIdsRef = { current: new Set };
+  const removedChatVersionsRef = { current: new Map };
   const keepSelectedDeletedChatIdsRef = { current: new Set };
   const isChatPendingDelete = (chatId) => !!chatId && pendingDeleteIdsRef.current.has(chatId);
   const clearDeletedChatState = (chatIds) => {
@@ -16294,20 +16331,46 @@ function createChatDelete({
     listActionsRef.current?.commitServerChats?.(nextServerChats, { warm: false });
     setSelectedChat((current) => current === chatId ? null : current);
   };
-  const dropRemovedChat = (chatId) => {
-    if (!chatId)
+  const dropRemovedChat = (chatId, epochVersion) => {
+    if (!chatId || !Number.isSafeInteger(epochVersion) || epochVersion < 1)
       return false;
-    deletedChatIdsRef.current.add(chatId);
-    locallyDeletedChatIdsRef.current.add(chatId);
+    const previousVersion = removedChatVersionsRef.current.get(chatId) || 0;
+    removedChatVersionsRef.current.set(chatId, Math.max(previousVersion, epochVersion));
     dropChat(chatId);
     return true;
   };
+  const commitRemovedRetirement = (chatId, epochVersion) => {
+    if (!chatId || !Number.isSafeInteger(epochVersion) || epochVersion < 1)
+      return false;
+    const previousVersion = removedChatVersionsRef.current.get(chatId) || 0;
+    removedChatVersionsRef.current.set(chatId, Math.max(previousVersion, epochVersion));
+    pendingDeleteIdsRef.current.delete(chatId);
+    locallyDeletedChatIdsRef.current.delete(chatId);
+    deletedChatIdsRef.current.delete(chatId);
+    keepSelectedDeletedChatIdsRef.current.delete(chatId);
+    confirmDeletedChats([chatId]);
+    return true;
+  };
+  const restoreRemovedChat = (chat) => {
+    const chatId = chat?.id;
+    const removedAtVersion = removedChatVersionsRef.current.get(chatId);
+    if (!chatId || removedAtVersion == null)
+      return false;
+    if (!Number.isSafeInteger(chat.epochVersion) || chat.epochVersion <= removedAtVersion || !Array.isArray(chat.memberChatPKs) || !chat.memberChatPKs.includes(chatPK))
+      return false;
+    removedChatVersionsRef.current.delete(chatId);
+    return true;
+  };
   const dropUnavailableChat = (chatId) => {
     if (!chatId)
       return Promise.resolve(false);
     return (async () => {
       const releaseMutation = await mutationGate?.acquireExclusive(chatId) || (() => {});
       try {
+        if (removedChatVersionsRef.current.has(chatId)) {
+          dropChat(chatId);
+          return true;
+        }
         const chat = lastServerChatsRef.current.find((item) => item?.id === chatId);
         if (chat?.deliveryRegistered && chat?.epochVersion && chatPK && chat?.epochState?.stateCapability) {
           await cloud.delivery.revoke(deriveChatDeliveryCapability(chat.epochState.stateCapability, {
@@ -16384,39 +16447,74 @@ function createChatDelete({
     }, target.members, target.expectedEpochId);
     return result.deliveredCount;
   };
+  const deleteCurrentChat = async (input, options = {}) => {
+    const chatId = cleanText(typeof input === "string" ? input : input?.chatId || input?.id);
+    const attemptedEpochs = new Set;
+    while (chatId) {
+      const target = getDeleteTargets(input)[0];
+      if (!target)
+        return null;
+      const peerChatPK = cleanText(typeof input === "object" ? input?.peerChatPK : "") || cleanText(lastServerChatsRef.current.find((item) => item?.id === chatId)?.peerChatPK);
+      const releaseMutation = await mutationGate?.acquireExclusive([chatId, peerChatPK].filter(Boolean)) || (() => {});
+      let released = false;
+      const release = () => {
+        if (released)
+          return;
+        released = true;
+        releaseMutation();
+      };
+      try {
+        const deletion = await cloud.chat.delete(target.chatId, {
+          entryId: target.entryId,
+          expectedEpochId: target.expectedEpochId,
+          stateCapability: target.stateCapability,
+          cleanup: options.cleanup !== false
+        });
+        if (deletion?.newlyDeleted !== false)
+          await wakeDeletedChat(target);
+        return target;
+      } catch (error) {
+        release();
+        const attemptKey = `${target.epochVersion || 0}:${target.expectedEpochId || ""}`;
+        if (!attemptKey || attemptedEpochs.has(attemptKey) || !isChatEpochConflict(error) || typeof reconcileEpoch !== "function")
+          throw error;
+        attemptedEpochs.add(attemptKey);
+        const reconciled = await reconcileEpoch(chatId);
+        const current = lastServerChatsRef.current.find((item) => item?.id === chatId) || null;
+        if (reconciled?.removed || !current)
+          return null;
+        if (!Number.isSafeInteger(current.epochVersion) || current.epochVersion <= target.epochVersion) {
+          throw error;
+        }
+      } finally {
+        release();
+      }
+    }
+    return null;
+  };
   const deleteChat = async (chat, options = {}) => {
-    const targets = getDeleteTargets(chat);
+    const inputs = Array.isArray(chat) ? chat : [chat];
+    const targets = getDeleteTargets(inputs);
     if (!targets.length)
       return false;
     const chatIds = targets.map((target) => target.chatId);
-    const peerChatPKs = chatIds.map((chatId) => {
-      const input = (Array.isArray(chat) ? chat : [chat]).find((item) => cleanText(typeof item === "string" ? item : item?.chatId || item?.id) === chatId);
-      return cleanText(typeof input === "object" ? input?.peerChatPK : "") || cleanText(lastServerChatsRef.current.find((item) => item?.id === chatId)?.peerChatPK);
-    }).filter(Boolean);
-    const releaseMutation = await mutationGate?.acquireExclusive([...chatIds, ...peerChatPKs]) || (() => {});
+    const deletedTargets = [];
+    hideDeletingChats(chatIds, options);
     try {
-      hideDeletingChats(chatIds, options);
-      try {
-        for (const target of targets) {
-          await cloud.chat.delete(target.chatId, {
-            entryId: target.entryId,
-            expectedEpochId: target.expectedEpochId,
-            stateCapability: target.stateCapability,
-            cleanup: options.cleanup !== false
-          });
-          await wakeDeletedChat(target);
-        }
-        await revokeTargetDeliveries(targets);
-        await options.onDeliveryRevoked?.();
-        confirmDeletedChats(chatIds);
-      } catch (error) {
-        restoreDeletedChats(chatIds);
-        throw error;
-      }
-      return Array.isArray(chat) ? targets.length : true;
-    } finally {
-      releaseMutation();
+      for (const target of targets) {
+        const input = inputs.find((item) => cleanText(typeof item === "string" ? item : item?.chatId || item?.id) === target.chatId) || target.chatId;
+        const deleted = await deleteCurrentChat(input, options);
+        if (deleted)
+          deletedTargets.push(deleted);
+      }
+      await revokeTargetDeliveries(deletedTargets);
+      await options.onDeliveryRevoked?.();
+      confirmDeletedChats(chatIds);
+    } catch (error) {
+      restoreDeletedChats(chatIds);
+      throw error;
     }
+    return Array.isArray(chat) ? targets.length : true;
   };
   const wasChatDeletedLocally = (chatId) => !!chatId && locallyDeletedChatIdsRef.current.has(chatId);
   const ackDeletedChat = (chatId) => {
@@ -16427,21 +16525,25 @@ function createChatDelete({
     pendingDeleteIdsRef.current = new Set;
     locallyDeletedChatIdsRef.current = new Set;
     deletedChatIdsRef.current = new Set;
+    removedChatVersionsRef.current = new Map;
     keepSelectedDeletedChatIdsRef.current = new Set;
   };
   return {
     pendingDeleteIdsRef,
     deletedChatIdsRef,
+    removedChatVersionsRef,
     keepSelectedDeletedChatIdsRef,
     resetDeleteState,
     clearDeletedChatState,
     beginRetirement,
     rollbackRetirement,
     commitRetirement,
+    commitRemovedRetirement,
     restoreDeletedChat,
     deleteChat,
     dropChat,
     dropRemovedChat,
+    restoreRemovedChat,
     dropUnavailableChat,
     wasChatDeletedLocally,
     ackDeletedChat,
@@ -17902,7 +18004,73 @@ function withoutChatIdentity(options = {}) {
 }
 function refreshQueuedSendOptions(sendOptionsForPeer, peerChatPK, sendOptionOverrides = null) {
   const chatId = cleanText(sendOptionOverrides?.chatId);
-  return mergeSendOptions(withoutChatIdentity(sendOptionOverrides), sendOptionsForPeer(peerChatPK, chatId));
+  const current = sendOptionsForPeer(peerChatPK, chatId);
+  if (chatId) {
+    return {
+      ...withoutChatIdentity(sendOptionOverrides),
+      ...current
+    };
+  }
+  return mergeSendOptions(withoutChatIdentity(sendOptionOverrides), current);
+}
+function currentEpoch(options) {
+  const manifest = options?.epochState?.manifest || options?.ownEntry?.current?.manifest || null;
+  const epochId = cleanText(manifest?.epochId);
+  const epochVersion = Number(manifest?.epochVersion);
+  return epochId && Number.isInteger(epochVersion) && epochVersion > 0 ? { epochId, epochVersion } : null;
+}
+async function runCurrentEpochWrite({
+  chatId,
+  mutationGate,
+  readOptions,
+  reconcileEpoch,
+  write,
+  onCommitted,
+  onEpochAdvance
+}) {
+  const attemptedEpochs = new Set;
+  while (true) {
+    const releaseMutation = await mutationGate?.acquireShared(chatId) || (() => {});
+    let released = false;
+    let committed = false;
+    const release = () => {
+      if (released)
+        return;
+      released = true;
+      releaseMutation();
+    };
+    let options;
+    let epoch;
+    try {
+      options = readOptions();
+      epoch = currentEpoch(options);
+      return await write(options, (...args) => {
+        committed = true;
+        release();
+        onCommitted?.(...args);
+      });
+    } catch (error) {
+      release();
+      const attemptKey = epoch ? `${epoch.epochVersion}:${epoch.epochId}` : "";
+      if (committed || options?.chatExists !== true || !attemptKey || attemptedEpochs.has(attemptKey) || !isChatEpochConflict(error) || typeof reconcileEpoch !== "function") {
+        throw error;
+      }
+      attemptedEpochs.add(attemptKey);
+      await reconcileEpoch(chatId);
+      const nextEpoch = currentEpoch(readOptions());
+      if (!nextEpoch || nextEpoch.epochVersion <= epoch.epochVersion || nextEpoch.epochId === epoch.epochId) {
+        throw error;
+      }
+      onEpochAdvance?.({
+        fromEpochId: epoch.epochId,
+        fromEpochVersion: epoch.epochVersion,
+        toEpochId: nextEpoch.epochId,
+        toEpochVersion: nextEpoch.epochVersion
+      });
+    } finally {
+      release();
+    }
+  }
 }
 function markSendPerf(diag, label, startedAt, data = {}, minMs = SEND_CHAT_REDUCER_WARN_MS) {
   const elapsedMs = Date.now() - startedAt;
@@ -18167,7 +18335,7 @@ async function makeSharedMediaAttachment(cloud, media, message, data) {
     ...source?.c ? { caption: source.c } : {}
   }));
 }
-function createChatSend({ cloud, media = {}, uid, chatBanned, chatPK, chatSigningPK, chatSigningSecret, chatPrivateKey, notificationPK, notificationPrivateKey, localCache, localByChatRef, setLocalByChat, setChats, setLastChat, sendOptionsForPeer, selectLocalChat, adoptLocalMessageMedia, readMessageFile, mutationGate, diag = null }) {
+function createChatSend({ cloud, media = {}, uid, chatBanned, chatPK, chatSigningPK, chatSigningSecret, chatPrivateKey, notificationPK, notificationPrivateKey, localCache, localByChatRef, setLocalByChat, setChats, setLastChat, sendOptionsForPeer, selectLocalChat, adoptLocalMessageMedia, readMessageFile, mutationGate, reconcileEpoch, diag = null }) {
   const adoptedLocalMediaRef = { current: new Set };
   const attachmentPrepareByCidRef = { current: new Map };
   const cachedLocalMediaRef = { current: new Set };
@@ -18527,78 +18695,80 @@ ${cid}` : "";
   };
   const queueSend = async (peerChatPK, message, run, { previewRequired = false, sendOptions: sendOptionOverrides = null } = {}) => {
     const startedAt = Date.now();
-    let sendOptions = refreshQueuedSendOptions(sendOptionsForPeer, peerChatPK, sendOptionOverrides);
-    let local = await showLocalMessage(peerChatPK, message, sendOptions);
+    const sendOptions = refreshQueuedSendOptions(sendOptionsForPeer, peerChatPK, sendOptionOverrides);
+    const local = await showLocalMessage(peerChatPK, message, sendOptions);
     const mutationTarget = local.chatId || cleanText(sendOptionOverrides?.chatId) || peerChatPK;
-    let releaseMutation;
-    try {
-      releaseMutation = await mutationGate?.acquireShared(mutationTarget) || (() => {});
-    } catch (error) {
-      markLocalStatus(local.chatId, local.cid, LOCAL_FAILED);
-      throw error;
-    }
-    try {
-      sendOptions = refreshQueuedSendOptions(sendOptionsForPeer, peerChatPK, {
-        ...sendOptionOverrides,
-        chatId: local.chatId
-      });
-      const requiredPreview = previewRequired || sendOptions.chatExists !== true;
-      let committed = false;
-      let sent = false;
-      const markSent = () => {
-        if (sent)
-          return;
-        sent = true;
-        sentChatIdsRef.current.add(local.chatId);
-        markLocalStatus(local.chatId, local.cid, LOCAL_SENT);
-      };
-      const markCommitted = () => {
-        if (committed)
-          return;
-        committed = true;
-        markSent();
-        markDone(diag, "chat.send.commit", startedAt, { type: local?.t || "txt", previewRequired: !!requiredPreview });
-      };
-      return await new Promise((resolve, reject) => {
-        const job = {
-          previewKey: local.chatId,
-          previewRequired: requiredPreview,
-          resolve,
-          reject,
-          onSuccess: markSent,
-          onError: (error) => {
-            markError(diag, "chat.send.job", startedAt, error, { type: local?.t || "txt", previewRequired: !!requiredPreview });
-            if (committed)
-              markSent();
-            else
-              markLocalStatus(local.chatId, local.cid, LOCAL_FAILED);
-          },
-          run: async (context) => {
-            const writeStartedAt = Date.now();
-            const onCommitted = () => {
-              markCommitted();
-              context?.releaseTargets?.();
-            };
-            markDiag(diag, "chat.send.write.start", { type: local?.t || "txt", previewRequired: !!requiredPreview, updatePreview: !!context?.updatePreview });
-            try {
-              const result = await run({ ...context, local, onCommitted, sendOptions });
-              markDone(diag, "chat.send.write", writeStartedAt, { type: local?.t || "txt", previewRequired: !!requiredPreview, updatePreview: !!context?.updatePreview });
-              return result;
-            } catch (error) {
-              markError(diag, "chat.send.write", writeStartedAt, error, {
-                type: local?.t || "txt",
-                previewRequired: !!requiredPreview,
-                updatePreview: !!context?.updatePreview
-              });
-              throw error;
-            }
+    const requiredPreview = previewRequired || sendOptions.chatExists !== true;
+    let committed = false;
+    let sent = false;
+    const markSent = () => {
+      if (sent)
+        return;
+      sent = true;
+      sentChatIdsRef.current.add(local.chatId);
+      markLocalStatus(local.chatId, local.cid, LOCAL_SENT);
+    };
+    const markCommitted = () => {
+      if (committed)
+        return;
+      committed = true;
+      markSent();
+      markDone(diag, "chat.send.commit", startedAt, { type: local?.t || "txt", previewRequired: !!requiredPreview });
+    };
+    return await new Promise((resolve, reject) => {
+      const job = {
+        previewKey: local.chatId,
+        previewRequired: requiredPreview,
+        resolve,
+        reject,
+        onSuccess: markSent,
+        onError: (error) => {
+          markError(diag, "chat.send.job", startedAt, error, { type: local?.t || "txt", previewRequired: !!requiredPreview });
+          if (committed)
+            markSent();
+          else
+            markLocalStatus(local.chatId, local.cid, LOCAL_FAILED);
+        },
+        run: async (context) => {
+          const writeStartedAt = Date.now();
+          markDiag(diag, "chat.send.write.start", { type: local?.t || "txt", previewRequired: !!requiredPreview, updatePreview: !!context?.updatePreview });
+          try {
+            const result = await runCurrentEpochWrite({
+              chatId: mutationTarget,
+              mutationGate,
+              readOptions: () => refreshQueuedSendOptions(sendOptionsForPeer, peerChatPK, {
+                ...sendOptionOverrides,
+                chatId: local.chatId
+              }),
+              reconcileEpoch,
+              write: (currentSendOptions, onCommitted) => run({
+                ...context,
+                local,
+                onCommitted,
+                sendOptions: currentSendOptions
+              }),
+              onCommitted: () => {
+                markCommitted();
+                context?.releaseTargets?.();
+              },
+              onEpochAdvance: ({ fromEpochVersion, toEpochVersion }) => {
+                markDiag(diag, "chat.send.epoch.advance", { fromEpochVersion, toEpochVersion });
+              }
+            });
+            markDone(diag, "chat.send.write", writeStartedAt, { type: local?.t || "txt", previewRequired: !!requiredPreview, updatePreview: !!context?.updatePreview });
+            return result;
+          } catch (error) {
+            markError(diag, "chat.send.write", writeStartedAt, error, {
+              type: local?.t || "txt",
+              previewRequired: !!requiredPreview,
+              updatePreview: !!context?.updatePreview
+            });
+            throw error;
           }
-        };
-        enqueueSendJob(peerChatPK, job, reject);
-      });
-    } finally {
-      releaseMutation?.();
-    }
+        }
+      };
+      enqueueSendJob(peerChatPK, job, reject);
+    });
   };
   const sendOptionsForQueuedWrite = (baseOptions, local, updatePreview, onCommitted) => {
     const chatId = local?.chatId;
@@ -22715,7 +22885,7 @@ async function unlinkBlockedChat(cloud, uid, identity, entry, options) {
   const entryId = ownChatEntryId(identity.chatPrivateKey, manifest.chatId);
   markDiag(options.diag, "chat.owner.unlink", { reason: "blocked" });
   await cloud.user.chats.unlink(uid, entryId);
-  options.onRemoved?.(manifest.chatId);
+  options.onRemoved?.(manifest.chatId, manifest.epochVersion);
   options.onPingDelete?.(manifest.chatId);
   return { removed: true, blocked: true, chatId: manifest.chatId };
 }
@@ -22734,6 +22904,25 @@ function isRetryableInboxError(error) {
   ];
   return retryableCodes.some((value) => code === value || code.endsWith(`/${value}`)) || /\b(network|offline|timed? out|temporar(?:y|ily)|connection)\b/.test(message);
 }
+async function retireConfirmedDeletedChat(cloud, uid, identity, entry, options = {}) {
+  const manifest = entry?.current?.manifest;
+  if (!manifest?.chatId || !identity?.chatPrivateKey || !identity?.chatPK) {
+    throw new Error("deleted chat owner entry required");
+  }
+  const entryId = ownChatEntryId(identity.chatPrivateKey, manifest.chatId);
+  await cloud.user.chats.unlinkDeleted(uid, entryId, manifest.chatId);
+  if (entry.deliveryRegistered) {
+    const capability = deriveChatDeliveryCapability(entry.current.stateCapability, {
+      chatId: manifest.chatId,
+      recipientChatPK: identity.chatPK,
+      generation: manifest.epochVersion
+    });
+    await cloud.delivery.revoke(capability).catch(() => false);
+  }
+  markDiag(options.diag, "chat.owner.unlink", { reason: "confirmed_deleted" });
+  options.onPingDelete?.(manifest.chatId);
+  return { removed: true, deleted: true, chatId: manifest.chatId };
+}
 function inboxErrorReason(error) {
   const message = cleanText(error?.message).toLowerCase();
   if (message === "ping sender identity mismatch")
@@ -23006,7 +23195,21 @@ async function processOpenedPing(cloud, uid, identity, ping, openedProfile, hint
     return "stale";
   }
   if (entry && payload.epochVersion > entry.current.manifest.epochVersion) {
-    const advanced = await advanceEntryToEpoch(cloud, uid, identity, entry, payload.epochVersion, options);
+    let advanced;
+    try {
+      advanced = await advanceEntryToEpoch(cloud, uid, identity, entry, payload.epochVersion, options);
+    } catch (error) {
+      if (payload.kind !== "chat_deleted")
+        throw error;
+      try {
+        await retireConfirmedDeletedChat(cloud, uid, identity, entry, options);
+        return "deleted";
+      } catch (confirmationError) {
+        if (isRetryableInboxError(confirmationError))
+          throw confirmationError;
+        throw error;
+      }
+    }
     if (advanced?.removed) {
       options.onPingDelete?.(payload.chatId);
       return "deleted";
@@ -23062,6 +23265,11 @@ async function processOpenedPing(cloud, uid, identity, ping, openedProfile, hint
         options.onPingDelete?.(payload.chatId);
         return "deleted";
       }
+      const latest = await advanceEntryToLatestEpoch(cloud, uid, identity, transitioned, options);
+      if (latest?.removed) {
+        options.onPingDelete?.(payload.chatId);
+        return "deleted";
+      }
       return "transition";
     }
   }
@@ -23170,8 +23378,15 @@ async function processPing(cloud, uid, identity, doc, options) {
 async function applyEpochTransitionAction(cloud, uid, identityValue, entry, action, options, confirmedValue = null) {
   const parent = entry.current.manifest;
   const sender = manifestMember(parent, action.s || action.certificate?.actor);
-  if (!sender)
+  const reject = (stage) => {
+    markDiag(options.diag, "chat.epoch.apply.reject", {
+      stage,
+      epochVersion: parent.epochVersion
+    });
     return null;
+  };
+  if (!sender)
+    return reject("sender");
   const engine = await options.mls?.open?.();
   if (!engine)
     throw new Error("mls engine required");
@@ -23179,25 +23394,25 @@ async function applyEpochTransitionAction(cloud, uid, identityValue, entry, acti
   const expectedCommitment = transitionCommitment(action.certificate);
   const confirmed = confirmedValue || await cloud.chat.state.transition(parent.chatId, parent.epochId, entry.current.stateCapability).catch(() => null);
   if (!confirmed || confirmed.parentEpochVersion !== parent.epochVersion || confirmed.nextEpochId !== action.certificate?.nextEpochId || confirmed.nextEpochVersion !== action.certificate?.nextEpochVersion || confirmed.transitionCommitment !== expectedCommitment || confirmed.transitionMessageId !== messageId || confirmed.mlsPackageId !== action.mls?.packageId || confirmed.mlsPackageDigest !== action.mls?.packageDigest)
-    return null;
+    return reject("certificate");
   let leaveProposalId = "";
   if (action.membership?.kind === "leave") {
     const leavingChatPK = cleanText(action.membership?.actor);
     const proposalId = cleanText(action.membership?.proposalId);
     const targetSet = new Set(Array.isArray(action.membership?.targets) ? action.membership.targets.map(cleanText) : []);
     if (!leavingChatPK || !proposalId || targetSet.size !== 1 || !targetSet.has(leavingChatPK))
-      return null;
+      return reject("leave-certificate");
     const proposalRecord = await cloud.chat.messages.read(parent.epochId, proposalId, {
       lane: messageLaneForEpoch(entry.current)
     }).catch(() => null);
     const proposal = proposalRecord ? await decryptMsg(proposalRecord, "", "", "", { chatId: parent.chatId, epochState: entry.current }).catch(() => null) : null;
     if (!isLeaveProposalMsg(proposal) || proposal.s !== leavingChatPK)
-      return null;
+      return reject("leave-proposal");
     leaveProposalId = proposalId;
   }
   const packageRecord = await cloud.chat.mls.packages.read(parent.chatId, confirmed.mlsPackageId);
   if (!packageRecord || packageRecord.digest !== confirmed.mlsPackageDigest || packageRecord.head.transitionCommitment !== confirmed.transitionCommitment || !verifyChatMlsEpochPackageSignature(packageRecord, sender.chatSigningPK))
-    return null;
+    return reject("mls-package");
   const identity = {
     ...identityValue,
     uid,
@@ -23208,8 +23423,11 @@ async function applyEpochTransitionAction(cloud, uid, identityValue, entry, acti
   let parentSnapshot = null;
   let nextSnapshot = null;
   let epochState = null;
+  let openStage = "owner-snapshot";
+  const openStartedAt = Date.now();
   try {
     parentSnapshot = await readOwnerChatMlsSnapshot(cloud, identity, entryId, entry.current);
+    openStage = "mls-commit";
     const processed = engine.processCommit(parentSnapshot, packageRecord.commit);
     nextSnapshot = processed.snapshot;
     if (processed.removed) {
@@ -23228,9 +23446,10 @@ async function applyEpochTransitionAction(cloud, uid, identityValue, entry, acti
       if (leaveProposalId) {
         options.leaveProposalObservedAt?.delete(`${parent.chatId}:${leaveProposalId}`);
       }
-      options.onRemoved?.(parent.chatId);
+      options.onRemoved?.(parent.chatId, confirmed.nextEpochVersion);
       return { removed: true, chatId: parent.chatId };
     }
+    openStage = "mls-package-open";
     const opened = await openChatMlsEpochPackage(processed, packageRecord, {
       chatId: parent.chatId,
       senderSigningPK: sender.chatSigningPK,
@@ -23245,8 +23464,13 @@ async function applyEpochTransitionAction(cloud, uid, identityValue, entry, acti
       mlsPackageId: opened.packageId,
       mlsPackageDigest: opened.packageDigest
     };
+    openStage = "settings";
     epochState.settings = await readEpochChatSettings(cloud, epochState);
-  } catch {
+  } catch (error) {
+    markError(options.diag, "chat.epoch.apply", openStartedAt, error, {
+      stage: openStage,
+      epochVersion: parent.epochVersion
+    });
     cleanBytes(parentSnapshot, nextSnapshot, epochState?.epochSecret, epochState?.stateCapability);
     return null;
   }
@@ -23333,6 +23557,42 @@ async function advanceEntryToEpoch(cloud, uid, identity, entry, targetEpochVersi
     }).catch(() => null);
     const action = record ? await decryptMsg(record, "", "", "", { chatId: parent.chatId, epochState: current.current }).catch(() => null) : null;
     if (!isEpochTransitionMsg(action)) {
+      markDiag(options.diag, "chat.epoch.advance.pending", {
+        stage: record ? "transition-open" : "transition-record",
+        epochVersion: parent.epochVersion
+      });
+      const error = new Error("chat epoch transition message is not available yet");
+      error.code = "chat/epoch-pending";
+      throw error;
+    }
+    const advanced = await applyEpochTransitionAction(cloud, uid, identity, current, action, options, confirmed);
+    if (advanced?.removed)
+      return advanced;
+    if (!advanced?.current?.manifest || advanced.current.manifest.epochVersion <= parent.epochVersion) {
+      const error = new Error("chat epoch transition could not be verified");
+      error.code = "chat/epoch-pending";
+      throw error;
+    }
+    current = advanced;
+  }
+  return current;
+}
+async function advanceEntryToLatestEpoch(cloud, uid, identity, entry, options = {}) {
+  let current = entry;
+  while (current?.current?.manifest) {
+    const parent = current.current.manifest;
+    const confirmed = await cloud.chat.state.transition(parent.chatId, parent.epochId, current.current.stateCapability);
+    if (!confirmed?.transitionMessageId)
+      return current;
+    const record = await cloud.chat.messages.read(parent.epochId, confirmed.transitionMessageId, {
+      lane: messageLaneForEpoch(current.current)
+    }).catch(() => null);
+    const action = record ? await decryptMsg(record, "", "", "", { chatId: parent.chatId, epochState: current.current }).catch(() => null) : null;
+    if (!isEpochTransitionMsg(action)) {
+      markDiag(options.diag, "chat.epoch.advance.pending", {
+        stage: record ? "transition-open" : "transition-record",
+        epochVersion: parent.epochVersion
+      });
       const error = new Error("chat epoch transition message is not available yet");
       error.code = "chat/epoch-pending";
       throw error;
@@ -23449,6 +23709,17 @@ async function processInbox(cloud, uid, userChatPK, userPrivKey, options = {}) {
 var CHAT_LIST_DECRYPT_YIELD_EVERY = 2;
 var CHAT_INBOX_RETRY_DELAYS_MS = Object.freeze([1000, 3000, 1e4, 30000]);
 var CHAT_EPOCH_PENDING_MAX_ATTEMPTS = CHAT_INBOX_RETRY_DELAYS_MS.length + 1;
+function chatOwnerRevision(chat) {
+  return Number.isSafeInteger(chat?.ownEntry?.ownerRevision) ? chat.ownEntry.ownerRevision : 0;
+}
+function serverChatCoversOverlay(chat, overlay) {
+  const serverEpoch = Number.isSafeInteger(chat?.epochVersion) ? chat.epochVersion : 0;
+  const overlayEpoch = Number.isSafeInteger(overlay?.epochVersion) ? overlay.epochVersion : 0;
+  if (serverEpoch !== overlayEpoch) {
+    return serverEpoch > overlayEpoch;
+  }
+  return chatOwnerRevision(chat) >= chatOwnerRevision(overlay);
+}
 function inboxRetryKey(doc) {
   const id = typeof doc?.id === "string" ? doc.id : "";
   const ts = timestampMs(doc?.ts, 0) || 0;
@@ -23521,13 +23792,17 @@ function listenToChats(cloud, uid, userChatPK, userPrivKey, onUpdate, onError, o
     nextAfterChat: null,
     hasMore: false
   };
-  const optimisticChats = new Map;
-  const mergedChats = (chats) => {
+  const optimisticChats = options.optimisticChats instanceof Map ? options.optimisticChats : new Map;
+  const mergedChats = (chats, mergeOptions = {}) => {
     const nextById = new Map;
     for (const chat of chats || []) {
       const optimistic = optimisticChats.get(chat?.id);
-      if (chat?.id)
+      if (chat?.id) {
         nextById.set(chat.id, mergeChatActivity(chat, optimistic, userChatPK));
+        if (mergeOptions.settle === true && optimistic && serverChatCoversOverlay(chat, optimistic)) {
+          optimisticChats.delete(chat.id);
+        }
+      }
     }
     for (const [id, chat] of optimisticChats.entries()) {
       if (!nextById.has(id)) {
@@ -23592,7 +23867,7 @@ function listenToChats(cloud, uid, userChatPK, userPrivKey, onUpdate, onError, o
       if (!closed && runId === run) {
         processedFirst = true;
         const chats = page.chats;
-        latestChats = mergedChats(chats);
+        latestChats = mergedChats(chats, { settle: true });
         latestMeta = {
           nextAfterChat: snapshot.nextAfterChat,
           hasMore: snapshot.hasMore
@@ -23961,6 +24236,7 @@ function createChatList({
   localByChatRef,
   pendingDeleteIdsRef,
   deletedChatIdsRef,
+  removedChatVersionsRef,
   keepSelectedDeletedChatIdsRef,
   readCacheRef,
   lastServerChatsRef,
@@ -23978,6 +24254,7 @@ function createChatList({
   onTransition,
   onRemoved,
   wasRemoved,
+  restoreRemovedChat,
   resetExternalChatState,
   mutationGate,
   onMlsKeyPackageConsumed
@@ -24006,6 +24283,8 @@ function createChatList({
   const cachedHistoryEndRef = { current: false };
   const cachedHistoryHeadRef = { current: [] };
   const previewTimerRef = { current: null };
+  const epochReconciliations = new Map;
+  const inboxOverlayChats = new Map;
   let listening = false;
   let unsubscribeChats = null;
   let snapshot = null;
@@ -24014,7 +24293,7 @@ function createChatList({
   let blockedUidSet = new Set(blockedUids);
   let schedulePreviewExpiry = () => {};
   let fillVisibleChatPage = () => {};
-  const isHiddenChatId = (chatId) => !!chatId && (pendingDeleteIdsRef.current.has(chatId) || deletedChatIdsRef.current.has(chatId));
+  const isHiddenChatId = (chatId) => !!chatId && (pendingDeleteIdsRef.current.has(chatId) || deletedChatIdsRef.current.has(chatId) || removedChatVersionsRef.current.has(chatId));
   const filterHiddenChats = (nextChats) => (nextChats || []).filter((chatItem) => chatItem?.id && !isHiddenChatId(chatItem.id));
   const nextValue = (current, next) => typeof next === "function" ? next(current) : next;
   const publish = () => {
@@ -24229,7 +24508,13 @@ function createChatList({
     return shownChats;
   };
   const applyInboxChat = (chat) => {
-    if (!chat?.id || isHiddenChatId(chat.id)) {
+    if (!chat?.id) {
+      return;
+    }
+    if (removedChatVersionsRef.current.has(chat.id)) {
+      restoreRemovedChat?.(chat);
+    }
+    if (isHiddenChatId(chat.id)) {
       return;
     }
     const updateStartedAt = Date.now();
@@ -24255,13 +24540,113 @@ function createChatList({
   const applyInboxDelete = (chatId) => {
     if (!chatId)
       return;
+    inboxOverlayChats.delete(chatId);
     pendingDeleteIdsRef.current.delete(chatId);
     commitServerChats(lastServerChatsRef.current.filter((chat) => chat?.id !== chatId), {
       warm: false
     });
     setSelectedChat((current) => current === chatId ? null : current);
   };
+  const reconcileChatEpoch = (chatId) => {
+    if (!chatId || !uid || !chatPK || !chatPrivateKey || !chatSigningPK || !chatSigningSecret || !notificationPK) {
+      return Promise.resolve({ advanced: false, chat: null, removed: false });
+    }
+    const active = epochReconciliations.get(chatId);
+    if (active)
+      return active;
+    let task;
+    task = (async () => {
+      const releaseMutation = await mutationGate?.acquireExclusive(chatId) || (() => {});
+      try {
+        const initial = getChatEntry(chatId);
+        if (!initial?.ownEntry)
+          return { advanced: false, chat: initial || null, removed: false };
+        const initialVersion = initial.epochVersion;
+        const identity = {
+          uid,
+          chatPK,
+          chatPrivateKey,
+          chatSigningPK,
+          chatSigningSecret,
+          notificationPK,
+          notificationPrivateKey
+        };
+        const advanceOptions = {
+          blockedUids: blockedUidSet,
+          mls,
+          diag,
+          onMlsKeyPackageConsumed,
+          onRemoved: (removedChatId, epochVersion) => {
+            onRemoved?.(removedChatId, epochVersion);
+            applyInboxDelete(removedChatId);
+          },
+          wasRemoved,
+          onTransition: (chat, message) => {
+            onTransition?.(chat, message);
+            applyInboxChat(chat);
+          }
+        };
+        let working = initial;
+        let result;
+        while (true) {
+          try {
+            result = await advanceEntryToLatestEpoch(cloud, uid, identity, working.ownEntry, advanceOptions);
+            break;
+          } catch (error) {
+            const code = String(error?.code || "").trim().toLowerCase();
+            if (code === "permission-denied" || code.endsWith("/permission-denied")) {
+              result = await retireConfirmedDeletedChat(cloud, uid, identity, working.ownEntry, {
+                diag,
+                onPingDelete: applyInboxDelete
+              });
+              break;
+            }
+            if (code !== "chat/epoch-pending")
+              throw error;
+            const canonical = await getChat(cloud, uid, chatId, chatPK, chatPrivateKey);
+            if (!canonical?.ownEntry || canonical.epochVersion <= working.epochVersion)
+              throw error;
+            markDiag(diag, "chat.epoch.reconcile.rebase", {
+              fromEpochVersion: working.epochVersion,
+              toEpochVersion: canonical.epochVersion
+            });
+            applyInboxChat(canonical);
+            working = canonical;
+          }
+        }
+        if (result?.removed) {
+          markDiag(diag, "chat.epoch.reconcile.done", {
+            fromEpochVersion: initialVersion,
+            removed: true
+          });
+          return { advanced: true, chat: null, removed: true };
+        }
+        const latest = getChatEntry(chatId);
+        const advanced = Number(latest?.epochVersion || 0) > Number(initialVersion || 0);
+        if (advanced) {
+          markDiag(diag, "chat.epoch.reconcile.done", {
+            fromEpochVersion: initialVersion,
+            toEpochVersion: latest.epochVersion,
+            removed: false
+          });
+        }
+        return {
+          advanced,
+          chat: latest || null,
+          removed: false
+        };
+      } finally {
+        releaseMutation();
+      }
+    })().finally(() => {
+      if (epochReconciliations.get(chatId) === task)
+        epochReconciliations.delete(chatId);
+    });
+    epochReconciliations.set(chatId, task);
+    return task;
+  };
   const resetChatList = (ready = false) => {
+    inboxOverlayChats.clear();
     chatSourceReady = ready;
     syncChatDataReady();
     setIsChatListLive(false);
@@ -24385,7 +24770,15 @@ function createChatList({
     };
     const unsubscribe = listenToChats(cloud, uid, chatPK, chatPrivateKey, (nextChats, _nextPeers, meta = {}) => {
       const updateStartedAt = Date.now();
-      const rawNextChats = filterHiddenChats(Array.isArray(nextChats) ? nextChats : []);
+      const incomingChats = Array.isArray(nextChats) ? nextChats : [];
+      if (meta?.source === "inbox") {
+        for (const chat of incomingChats) {
+          if (removedChatVersionsRef.current.has(chat?.id)) {
+            restoreRemovedChat?.(chat);
+          }
+        }
+      }
+      const rawNextChats = filterHiddenChats(incomingChats);
       hydrateReadCache(rawNextChats, readCacheRef.current);
       const readAppliedChats = applyReadCache(rawNextChats, chatPK, readCacheRef.current);
       const trimmedChats = trimExpiredChatPreviews(readAppliedChats, { skipChatId: selectedChatIdRef.current });
@@ -24490,6 +24883,7 @@ function createChatList({
       blockedUids: blockedUidSet,
       localCache,
       diag,
+      optimisticChats: inboxOverlayChats,
       getCurrentChat: (chatId) => lastServerChatsRef.current.find((chatItem) => chatItem?.id === chatId) || null,
       mutationGate,
       onMlsKeyPackageConsumed
@@ -24668,12 +25062,16 @@ function createChatList({
   };
   const hasChat = (chatId) => !!chatId && (serverChatIdsSet.has(chatId) || chatLoadsRef.current.has(chatId)) && !isHiddenChatId(chatId);
   const setSources = (nextSources) => {
+    const accountChanged = cloud !== nextSources.cloud || uid !== nextSources.uid || chatPK !== nextSources.chatPK || chatPrivateKey !== nextSources.chatPrivateKey;
     const nextBlocked = sortedUniqueValues(Array.isArray(nextSources.blocked) ? nextSources.blocked : []);
     const nextBlockedUidsKey = nextBlocked.join("|");
     const nextBlockedReady = nextSources.blockedReady === true;
     const blockedFilterChanged = blockedUidsKey !== nextBlockedUidsKey || blockedReady !== nextBlockedReady;
     const listenerChanged = cloud !== nextSources.cloud || uid !== nextSources.uid || chatPK !== nextSources.chatPK || chatSigningPK !== nextSources.chatSigningPK || chatSigningSecret !== nextSources.chatSigningSecret || chatPrivateKey !== nextSources.chatPrivateKey || notificationPK !== nextSources.notificationPK || notificationPrivateKey !== nextSources.notificationPrivateKey || mls !== nextSources.mls || chatBanned !== nextSources.chatBanned || localCache !== nextSources.localCache || isActive !== nextSources.isActive;
     const selectedChatChanged = selectedChatId !== nextSources.selectedChatId;
+    if (accountChanged) {
+      inboxOverlayChats.clear();
+    }
     ({
       cloud,
       uid,
@@ -24695,6 +25093,7 @@ function createChatList({
       localByChatRef,
       pendingDeleteIdsRef,
       deletedChatIdsRef,
+      removedChatVersionsRef,
       keepSelectedDeletedChatIdsRef,
       readCacheRef,
       lastServerChatsRef,
@@ -24712,6 +25111,7 @@ function createChatList({
       onTransition,
       onRemoved,
       wasRemoved,
+      restoreRemovedChat,
       resetExternalChatState,
       mutationGate,
       onMlsKeyPackageConsumed
@@ -24755,6 +25155,8 @@ function createChatList({
       previewTimerRef.current = null;
     }
     flushChatCacheWrite();
+    epochReconciliations.clear();
+    inboxOverlayChats.clear();
     subscribers.clear();
   };
   const subscribe = (subscriber) => {
@@ -24780,6 +25182,7 @@ function createChatList({
     getChatPreviewKey: getChatPreviewKey2,
     getChatRetention,
     getChatEntry,
+    reconcileChatEpoch,
     sendOptionsForPeer,
     hasChat
   };
@@ -24982,7 +25385,6 @@ function createChatSession({
   const closeMessageBatchRef = { current: null };
   const localMessageDiagRef = { current: "" };
   const epochHistoryRef = { current: new Map };
-  const epochRecoveryRef = { current: new Map };
   const settingsUpdateStatesRef = { current: new Map };
   const membershipUpdateStatesRef = { current: new Map };
   const directChatOpensRef = { current: new Map };
@@ -25021,6 +25423,7 @@ function createChatSession({
       kickChatMember,
       leaveChat,
       updateChatSettings: updateChatSettings2,
+      updateChatAvatar,
       dropChat,
       dropUnavailableChat,
       deleteChat,
@@ -25479,51 +25882,15 @@ function createChatSession({
     return true;
   };
   const handleBatchMessages = (chatId, messages) => {
-    const transition = [...messages || []].reverse().find(isEpochTransitionMsg);
-    const nextEpochId = transition?.certificate?.nextEpochId;
-    const chat = getChatEntry(chatId);
-    if (!nextEpochId || !chat?.ownEntry || chat.epochId === nextEpochId || epochRecoveryRef.current.has(nextEpochId))
+    if (![...messages || []].reverse().some(isEpochTransitionMsg))
       return;
-    const recover = (attempt = 0) => {
-      const timer = attempt > 0 ? setTimeout(run, [0, 250, 1000, 3000][attempt] || 3000) : null;
-      epochRecoveryRef.current.set(nextEpochId, timer || true);
-      if (!timer)
-        run();
-      async function run() {
-        let releaseMutation = () => {};
-        try {
-          releaseMutation = await mutationGate.acquireExclusive(chatId);
-          const current = getChatEntry(chatId);
-          if (!current?.ownEntry || current.epochId === nextEpochId)
-            return;
-          const advanced = await processEpochTransitionMessages(cloud, uid, {
-            chatPK,
-            chatPrivateKey,
-            notificationPK
-          }, current.ownEntry, messages, {
-            blockedUids: new Set(blocked),
-            notificationPrivateKey,
-            diag,
-            onRemoved: (removedChatId) => deleteActions.dropRemovedChat(removedChatId),
-            wasRemoved: (removedChatId) => deleteActions.deletedChatIdsRef.current.has(removedChatId),
-            onTransition: stageCommittedMembershipMessage
-          });
-          if (advanced)
-            epochHistoryRef.current.delete(chatId);
-          else if (attempt < 3)
-            return recover(attempt + 1);
-        } catch {
-          if (attempt < 3)
-            return recover(attempt + 1);
-        } finally {
-          releaseMutation();
-          if (epochRecoveryRef.current.get(nextEpochId) === (timer || true)) {
-            epochRecoveryRef.current.delete(nextEpochId);
-          }
-        }
-      }
-    };
-    recover();
+    const startedAt = Date.now();
+    chatListOwner.reconcileChatEpoch(chatId).then((result) => {
+      if (result.advanced)
+        epochHistoryRef.current.delete(chatId);
+    }).catch((error) => {
+      markError(diag, "chat.epoch.reconcile", startedAt, error);
+    });
   };
   const setChats = (...args) => chatListOwner.setChats(...args);
   const setLastChat = (...args) => chatListOwner.setLastChat(...args);
@@ -25541,11 +25908,6 @@ function createChatSession({
     liveActions?.close?.();
     liveActivityByChat = new Map;
     messageBatchOwner.clear();
-    for (const pending of epochRecoveryRef.current.values()) {
-      if (typeof pending === "number")
-        clearTimeout(pending);
-    }
-    epochRecoveryRef.current.clear();
     epochHistoryRef.current.clear();
     membershipUpdateStatesRef.current.clear();
     directChatOpensRef.current.clear();
@@ -25999,10 +26361,10 @@ function createChatSession({
         await discardOwnerChatMlsSnapshot(cloud, transitionIdentity(), chat.entryId, chat.epochState);
         await cloud.user.chats.unlink(uid, chat.entryId);
         if (retirementStarted) {
-          deleteActions.commitRetirement(chatId);
+          deleteActions.commitRemovedRetirement(chatId, chat.epochVersion + 1);
           retirementStarted = false;
         } else {
-          deleteActions.dropChat(chatId);
+          deleteActions.dropRemovedChat(chatId, chat.epochVersion + 1);
         }
         return { left: true, message: proposal.message };
       } catch (error) {
@@ -26064,35 +26426,55 @@ function createChatSession({
         clearLocalMembershipMessage(chatId, cid);
     };
     state.promise = (async () => {
-      const releaseMutation = await mutationGate.acquireExclusive(chatId);
       try {
-        const chat = requireTransitionChat(chatId);
-        const members = prepareMembers ? await prepareMembers(chat) : resolveMembers(chat);
-        if (!members) {
-          restoreAuthoritativeChat();
-          return { entry: chat.ownEntry, unchanged: true };
-        }
-        if (!members.length) {
-          restoreAuthoritativeChat();
-          await deleteActions.deleteChat(chat);
-          return { deleted: true };
-        }
-        const result = await transitionChatEpoch(cloud, transitionIdentity(), chat.ownEntry, { members, cid, mls });
-        if (result.entry) {
-          const projected = projectOwnChatEntry(result.entry, chat.entryId, chatPK, chat.ts);
-          chatListOwner.commitServerChats(sortedChats([projected], lastServerChatsRef.current));
-        } else {
-          chatListOwner.commitServerChats(lastServerChatsRef.current.filter((chatItem) => chatItem?.id !== chatId), { warm: false });
-          setSelectedChat((current) => current === chatId ? null : current);
-        }
-        if (optimisticRoster && result.message) {
-          stageCommittedMembershipMessage(chat, result.message);
-        } else if (optimisticRoster) {
-          clearLocalMembershipMessage(chatId, cid);
+        while (true) {
+          const releaseMutation = await mutationGate.acquireExclusive(chatId);
+          let attemptedEpochVersion = 0;
+          try {
+            const chat = requireTransitionChat(chatId);
+            attemptedEpochVersion = chat.epochVersion;
+            const members = prepareMembers ? await prepareMembers(chat) : resolveMembers(chat);
+            if (!members) {
+              restoreAuthoritativeChat();
+              return { entry: chat.ownEntry, unchanged: true };
+            }
+            if (!members.length) {
+              restoreAuthoritativeChat();
+              await deleteActions.deleteChat(chat);
+              return { deleted: true };
+            }
+            const result = await transitionChatEpoch(cloud, transitionIdentity(), chat.ownEntry, { members, cid, mls });
+            if (result.entry) {
+              const projected = projectOwnChatEntry(result.entry, chat.entryId, chatPK, chat.ts);
+              chatListOwner.commitServerChats(sortedChats([projected], lastServerChatsRef.current));
+            } else {
+              chatListOwner.commitServerChats(lastServerChatsRef.current.filter((chatItem) => chatItem?.id !== chatId), { warm: false });
+              setSelectedChat((current) => current === chatId ? null : current);
+            }
+            if (optimisticRoster && result.message) {
+              stageCommittedMembershipMessage(chat, result.message);
+            } else if (optimisticRoster) {
+              clearLocalMembershipMessage(chatId, cid);
+            }
+            if (optimisticRoster)
+              setPendingChatMembers(chatId, null);
+            return result;
+          } catch (error) {
+            releaseMutation();
+            if (!attemptedEpochVersion || !isChatEpochConflict(error))
+              throw error;
+            await chatListOwner.reconcileChatEpoch(chatId);
+            const currentEpochVersion = getChatEntry(chatId)?.epochVersion || 0;
+            if (currentEpochVersion <= attemptedEpochVersion)
+              throw error;
+            markDiag(diag, "chat.membership.epoch.advance", {
+              fromEpochVersion: attemptedEpochVersion,
+              toEpochVersion: currentEpochVersion
+            });
+          } finally {
+            releaseMutation();
+          }
         }
-        if (optimisticRoster)
-          setPendingChatMembers(chatId, null);
-        return result;
       } catch (error) {
         restoreAuthoritativeChat();
         throw error;
@@ -26100,7 +26482,6 @@ function createChatSession({
         if (membershipUpdateStatesRef.current.get(chatId) === state) {
           membershipUpdateStatesRef.current.delete(chatId);
         }
-        releaseMutation();
       }
     })();
     membershipUpdateStatesRef.current.set(chatId, state);
@@ -26223,6 +26604,26 @@ function createChatSession({
     }
     return state.promise;
   };
+  const updateChatAvatar = async (chatId, data) => {
+    assertChatAvatarBytes(data);
+    const chat = requireTransitionChat(chatId);
+    if (chat.lineage !== "group")
+      throw new Error("group chat required");
+    const epochId = chat?.epochState?.manifest?.epochId;
+    if (!epochId)
+      throw new Error("current chat epoch unavailable");
+    const uploadChatMedia = cloud?.chat?.media?.upload;
+    if (typeof uploadChatMedia !== "function")
+      throw new Error("chat media upload unavailable");
+    const cid = makeCid();
+    const file = typeof media?.uploadChatAvatar === "function" ? await media.uploadChatAvatar({ cid, data, epochId, uploadChatMedia }) : await putChatFile(epochId, cid, data, {
+      uploadChatMedia,
+      cacheControl: "private, max-age=31536000, immutable, no-transform"
+    });
+    const avatarRef = makeChatAvatarRef(file);
+    await updateChatSettings2(chatId, { avatarRef });
+    return avatarRef;
+  };
   const adoptCommittedSettingsMessage = ({ chatId, message }) => {
     if (!chatId || !message?.cid)
       return;
@@ -26345,7 +26746,13 @@ function createChatSession({
   const ackDeletedChat = (...args) => deleteActions.ackDeletedChat(...args);
   const markChatReadState = (...args) => seenActions.markChatReadState(...args);
   const markChatRead = (...args) => seenActions.markChatRead(...args);
-  const enterChatActivity = (...args) => liveActions.enterChatActivity(...args);
+  const enterChatActivity = (chatId) => {
+    const reconcileStartedAt = Date.now();
+    chatListOwner.reconcileChatEpoch(chatId).catch((error) => {
+      markError(diag, "chat.epoch.reconcile", reconcileStartedAt, error);
+    });
+    return liveActions.enterChatActivity(chatId);
+  };
   const leaveChatActivity = (chatId) => {
     const flush = seenActions.flushChatRead(chatId);
     liveActions.leaveChatActivity(chatId);
@@ -26592,6 +26999,7 @@ function createChatSession({
     listActionsRef: deleteListActionsRef,
     closeMessageBatchRef,
     mutationGate,
+    reconcileEpoch: (chatId) => chatListOwner?.reconcileChatEpoch(chatId),
     diag
   });
   const createActionOwners = () => {
@@ -26671,6 +27079,7 @@ function createChatSession({
       adoptLocalMessageMedia,
       readMessageFile,
       mutationGate,
+      reconcileEpoch: (chatId) => chatListOwner.reconcileChatEpoch(chatId),
       diag
     });
     reactionActions = createChatReaction({
@@ -26751,6 +27160,7 @@ function createChatSession({
     localByChatRef,
     pendingDeleteIdsRef: deleteActions.pendingDeleteIdsRef,
     deletedChatIdsRef: deleteActions.deletedChatIdsRef,
+    removedChatVersionsRef: deleteActions.removedChatVersionsRef,
     keepSelectedDeletedChatIdsRef: deleteActions.keepSelectedDeletedChatIdsRef,
     readCacheRef,
     lastServerChatsRef,
@@ -26766,8 +27176,9 @@ function createChatSession({
     reconcileMessageBatches: (...args) => messageBatchOwner.reconcileChats(...args),
     warmChats: (...args) => messageBatchOwner.warm(...args),
     onTransition: stageCommittedMembershipMessage,
-    onRemoved: (removedChatId) => deleteActions.dropRemovedChat(removedChatId),
-    wasRemoved: (removedChatId) => deleteActions.deletedChatIdsRef.current.has(removedChatId),
+    onRemoved: (removedChatId, epochVersion) => deleteActions.dropRemovedChat(removedChatId, epochVersion),
+    wasRemoved: (removedChatId) => deleteActions.removedChatVersionsRef.current.has(removedChatId),
+    restoreRemovedChat: (chat) => deleteActions.restoreRemovedChat(chat),
     resetExternalChatState,
     mutationGate,
     onMlsKeyPackageConsumed: markMlsKeyPackageConsumed