@ours.network/cowork 0.3.0 → 0.3.1

package/dist/daemon.js

@@ -4767,377 +4767,1007 @@ var init_config = __esm({
   }
 });
 
-// src/packets.ts
-import { randomBytes } from "node:crypto";
-import * as nodeFs2 from "node:fs";
-import { dirname as dirname3, join as join3 } from "node:path";
-function atomicWriteFileSync(target, bytes, ops = nodeFs2) {
-  const temp = `${target}.tmp-${process.pid}-${temporarySequence++}`;
-  let fileFd;
-  let directoryFd;
-  try {
-    fileFd = ops.openSync(temp, nodeFs2.constants.O_CREAT | nodeFs2.constants.O_TRUNC | nodeFs2.constants.O_WRONLY, 384);
-    ops.fchmodSync(fileFd, 384);
-    let offset = 0;
-    while (offset < bytes.byteLength) {
-      const written = ops.writeSync(fileFd, bytes, offset, bytes.byteLength - offset, null);
-      if (written <= 0) throw new Error(`short write while persisting ${target}`);
-      offset += written;
-    }
-    ops.fsyncSync(fileFd);
-    ops.closeSync(fileFd);
-    fileFd = void 0;
-    ops.renameSync(temp, target);
-    ops.chmodSync(target, 384);
-    directoryFd = ops.openSync(dirname3(target), nodeFs2.constants.O_RDONLY);
-    ops.fsyncSync(directoryFd);
-    ops.closeSync(directoryFd);
-    directoryFd = void 0;
-  } catch (error) {
-    if (fileFd !== void 0) {
-      try {
-        ops.closeSync(fileFd);
-      } catch {
-      }
+// src/contracts.ts
+import { createHash } from "node:crypto";
+function utf8Bounded(label, maximumBytes) {
+  return external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") >= 1, `${label} must be at least 1 UTF-8 byte`).refine(
+    (value) => Buffer.byteLength(value, "utf8") <= maximumBytes,
+    `${label} must be at most ${maximumBytes} UTF-8 bytes`
+  );
+}
+function isStrictRfc3339(value) {
+  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
+  if (!match) return false;
+  const [, yearText, monthText, dayText, hourText, minuteText, secondText, offsetHourText, offsetMinuteText] = match;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  const offsetHour = offsetHourText === void 0 ? 0 : Number(offsetHourText);
+  const offsetMinute = offsetMinuteText === void 0 ? 0 : Number(offsetMinuteText);
+  if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59) return false;
+  if (offsetHour > 23 || offsetMinute > 59) return false;
+  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const days = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return day >= 1 && day <= days[month - 1];
+}
+function refineRoomLineage(room, context) {
+  const pendingIdentityName = `cowork-room-${room.room_id}`;
+  const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && room.identity_name === pendingIdentityName && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
+  if (room.identity_cid === "" && !exactPacketPending) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["identity_cid"],
+      message: "empty identity_cid is reserved for the exact packet_pending provisioning sentinel"
+    });
+  }
+  if (room.identity_cid !== "" && room.status === "packet_pending") {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["status"],
+      message: "packet_pending status requires an empty identity_cid"
+    });
+  }
+  const pendingByRecovery = /* @__PURE__ */ new Map();
+  for (const [index, invite] of room.invites.entries()) {
+    if (invite.recovery_of === void 0) continue;
+    const recoveryOf = invite.recovery_of;
+    const source = room.invites.find((candidate) => candidate.invite_id === recoveryOf);
+    const validSourceState = invite.state === "receipt_pending" ? source?.state === "replacement_required" : invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required" ? source?.state === "revoked" : invite.state === "revoked" ? invite.recovery_confirmed === true ? source?.state === "revoked" : source?.state === "replacement_required" || source?.state === "revoked" : false;
+    if (!source || source.invite_id === invite.invite_id || !validSourceState) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["invites", index, "recovery_of"],
+        message: "recovery_of must point to a source invite in the state required by this recovery lineage"
+      });
+    } else if (invite.mode !== source.mode || invite.role !== source.role || invite.min_accepts !== source.min_accepts) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["invites", index],
+        message: "receipt_pending descriptor must copy source mode, role, and min_accepts"
+      });
     }
-    if (directoryFd !== void 0) {
-      try {
-        ops.closeSync(directoryFd);
-      } catch {
+    if (invite.state === "receipt_pending") {
+      const count = (pendingByRecovery.get(recoveryOf) ?? 0) + 1;
+      pendingByRecovery.set(recoveryOf, count);
+      if (count > 1) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["invites", index, "recovery_of"],
+          message: "only one receipt_pending invite may exist per recovery_of pointer"
+        });
       }
     }
-    try {
-      ops.rmSync(temp, { force: true });
-    } catch {
-    }
-    throw new PacketPersistenceError(`failed to durably persist ${target}`, { cause: error });
   }
 }
-function renderInbox(value) {
-  const output = [];
-  if (value.IsNil()) return output;
-  for (let index = 0; ; index += 1) {
-    const message = value.Reduce(index);
-    if (message.IsNil()) break;
-    output.push({
-      msg_id: Number(message.Reduce("msg_id").Visualize()),
-      sender_id: message.Reduce("sender_id").Visualize(),
-      sender_name: message.Reduce("sender_name").Visualize(),
-      text: message.Reduce("text").Visualize(),
-      date: adaptTimeToRfc3339(message.Reduce("date").Visualize()),
-      status: message.Reduce("status").Visualize(),
-      wire_id: message.Reduce("wire_id").Visualize()
+function migrateRoomV1(room, mintParticipantId) {
+  return RoomSchema.parse({
+    ...room,
+    version: 2,
+    mission: { ...room.mission, briefing_version: 1 },
+    role_briefings: {},
+    anonymous: false,
+    quiet_membership: false,
+    membership_epoch: 0,
+    seats: room.seats.map((seat) => ({
+      ...seat,
+      participant_id: LowerCrockfordUlidSchema.parse(mintParticipantId()),
+      state: "active"
+    }))
+  });
+}
+function refineRelaySubject(record, context) {
+  if (record.kind !== "relay_intent" && record.kind !== "relay_result") return;
+  if (record.message_id === void 0 === (record.file_id === void 0)) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["message_id"],
+      message: "relay records require exactly one of message_id or file_id"
     });
   }
-  return output;
 }
-function renderIntegerArray(value) {
-  const output = [];
-  if (value.IsNil()) return output;
-  for (let index = 0; ; index += 1) {
-    const item = value.Reduce(index);
-    if (item.IsNil()) break;
-    output.push(Number(item.Visualize()));
+function refineFileRecord(record, context) {
+  if (record.kind !== "file" || record.data_base64 === void 0) return;
+  const bytes = Buffer.from(record.data_base64, "base64");
+  if (bytes.toString("base64") !== record.data_base64) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["data_base64"], message: "file bytes must use canonical base64" });
   }
-  return output;
-}
-function dictionaryEntries(value) {
-  if (value.IsNil()) return [];
-  return value.GetKeys().map((key) => [key.Visualize(), value.Reduce(key)]);
-}
-function booleanValue(value) {
-  if (value.IsNil()) return false;
-  try {
-    return value.GetBoolean();
-  } catch {
-    return /true/i.test(value.Visualize());
+  if (bytes.length !== record.size) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["size"], message: "file size must match decoded bytes" });
   }
-}
-function strictBooleanValue(value, label) {
-  if (value.IsNil()) throw new Error(`${label} must be a boolean`);
-  let decoded;
-  try {
-    decoded = value.GetBoolean();
-  } catch (error) {
-    throw new Error(`${label} must be a boolean`, { cause: error });
+  const digest = createHash("sha256").update(bytes).digest("hex");
+  if (digest !== record.sha256) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["sha256"], message: "file sha256 must match decoded bytes" });
   }
-  if (typeof decoded !== "boolean") throw new Error(`${label} must be a boolean`);
-  return decoded;
 }
-function nilString(value) {
-  return value.IsNil() ? "" : value.Visualize();
-}
-function adaptTimeToRfc3339(value) {
-  const rfc3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,3}))?(?:Z|([+-])(\d{2}):(\d{2}))$/.exec(value);
-  if (rfc3339) {
-    const [, year2, month2, day2, hour2, minute2, second2, fraction2 = "", sign2, offsetHour2 = "0", offsetMinute = "0"] = rfc3339;
-    if (sign2 === "-" && offsetHour2 === "00" && offsetMinute === "00") return invalidAdaptTime(value);
-    return canonicalUtcTime(value, year2, month2, day2, hour2, minute2, second2, fraction2, sign2, offsetHour2, offsetMinute);
+function refineMessageCategory(message, context) {
+  const requires = (field, present) => {
+    if (present && message[field] === void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `${message.category} messages require ${field}`
+      });
+    }
+    if (!present && message[field] !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `${field} is forbidden on ${message.category} messages`
+      });
+    }
+  };
+  requires("briefing_role", message.category === "role_briefing");
+  requires("membership", message.category === "membership");
+  if (message.category === "role_briefing" && message.briefing_version === void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["briefing_version"],
+      message: "role_briefing messages require briefing_version"
+    });
   }
-  const native = /^(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))? \(UTC(?:([+-])(0|[1-9]|1\d|2[0-3]))?\)$/.exec(value);
-  if (!native) return invalidAdaptTime(value);
-  const [, year, month, day, hour, minute, second, fraction = "", sign, offsetHour = "0"] = native;
-  if (sign === "-" && offsetHour === "0") return invalidAdaptTime(value);
-  return canonicalUtcTime(value, year, month, day, hour, minute, second, fraction, sign, offsetHour, "0");
-}
-function canonicalUtcTime(source, yearText, monthText, dayText, hourText, minuteText, secondText, fraction, offsetSign, offsetHourText, offsetMinuteText) {
-  const year = Number(yearText);
-  const month = Number(monthText);
-  const day = Number(dayText);
-  const hour = Number(hourText);
-  const minute = Number(minuteText);
-  const second = Number(secondText);
-  const offsetHour = Number(offsetHourText);
-  const offsetMinute = Number(offsetMinuteText);
-  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
-  const monthDays = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-  if (month < 1 || month > 12 || day < 1 || day > monthDays[month - 1] || hour > 23 || minute > 59 || second > 59 || offsetHour > 23 || offsetMinute > 59) return invalidAdaptTime(source);
-  const milliseconds = Number(fraction.slice(0, 3).padEnd(3, "0"));
-  const local = /* @__PURE__ */ new Date(0);
-  local.setUTCFullYear(year, month - 1, day);
-  local.setUTCHours(hour, minute, second, milliseconds);
-  if (local.getUTCFullYear() !== year || local.getUTCMonth() !== month - 1 || local.getUTCDate() !== day || local.getUTCHours() !== hour || local.getUTCMinutes() !== minute || local.getUTCSeconds() !== second) {
-    return invalidAdaptTime(source);
+  if (message.category === "chat" || message.category === "membership") {
+    if (message.briefing_version !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["briefing_version"],
+        message: `briefing_version is forbidden on ${message.category} messages`
+      });
+    }
   }
-  const direction = offsetSign === "-" ? -1 : 1;
-  const offsetMilliseconds = direction * (offsetHour * 60 + offsetMinute) * 6e4;
-  const canonical = new Date(local.getTime() - offsetMilliseconds).toISOString();
-  if (!/^\d{4}-/.test(canonical)) return invalidAdaptTime(source);
-  return canonical;
-}
-function invalidAdaptTime(value) {
-  throw new Error(`unexpected ADAPT time visualization: ${value}`);
-}
-function inviteMode(value) {
-  const normalized = value.replace(/^\$/, "");
-  if (normalized === "one_time" || normalized === "public") return normalized;
-  throw new Error(`unexpected invite mode: ${value}`);
-}
-function exportSigningSecret(packet) {
-  return withScope((lifetime) => Buffer.from(packet.readonlyTx("::actor::export_signing_secret", lifetime).Serialize()).toString("hex"));
 }
-function validateRoomId(roomId) {
-  if (!/^[A-Za-z0-9_-]{1,128}$/.test(roomId)) throw new Error(`invalid room id: ${roomId}`);
-}
-var PacketPersistenceError, temporarySequence, PacketRegistry, HostedRoomPacket;
-var init_packets = __esm({
-  async "src/packets.ts"() {
+var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoleSchema, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
+var init_contracts = __esm({
+  "src/contracts.ts"() {
     "use strict";
-    await init_adapt();
-    PacketPersistenceError = class extends Error {
-      constructor(message, options) {
-        super(message, options);
-        this.name = "PacketPersistenceError";
+    init_zod();
+    MAX_TEXT_BYTES = 262144;
+    MAX_FILE_BYTES = 2 * 1024 * 1024;
+    MAX_HISTORY_PAGE_BYTES = 3 * 1024 * 1024;
+    MAX_MANAGEMENT_RESPONSE_BYTES = MAX_HISTORY_PAGE_BYTES + 1024 * 1024;
+    MAX_FILE_NAME_BYTES = 255;
+    MAX_MIME_BYTES = 255;
+    MAX_ROLE_BYTES = 256;
+    NonEmptyStringSchema = external_exports.string().min(1);
+    PositiveSafeIntegerSchema = external_exports.number().int().positive().safe();
+    LowerCrockfordUlidSchema = external_exports.string().regex(
+      /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
+      "must be a 26-character lowercase Crockford ULID"
+    );
+    Rfc3339Schema = external_exports.string().refine(isStrictRfc3339, "must be a valid RFC3339 timestamp");
+    RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
+    MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
+    MessageTextSchema = utf8Bounded("message text", MAX_TEXT_BYTES);
+    FileNameSchema = utf8Bounded("file name", MAX_FILE_NAME_BYTES).refine((value) => value !== "." && value !== "..", "file name must not be a relative path token").refine((value) => !/[\x00/\\]/.test(value), "file name must be a single path-free name");
+    FileMimeSchema = external_exports.string().refine(
+      (value) => Buffer.byteLength(value, "utf8") <= MAX_MIME_BYTES,
+      `file MIME metadata must be at most ${MAX_MIME_BYTES} UTF-8 bytes`
+    );
+    RoomStateSchema = external_exports.enum(["provisioning", "active", "closing", "closed"]);
+    SeatStateSchema = external_exports.enum(["active", "removed"]);
+    InviteModeSchema = external_exports.enum(["one_time", "public"]);
+    DEFAULT_ROLE = "Participant";
+    InviteStateSchema = external_exports.enum([
+      "live",
+      "consumed",
+      "revoked",
+      "replacement_required",
+      "receipt_pending"
+    ]);
+    RelayStatusSchema = external_exports.enum(["queued", "send_failed"]);
+    SeatV1Schema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema,
+      invite_id: NonEmptyStringSchema,
+      accepted_at: Rfc3339Schema
+    }).strict();
+    SeatSchema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema,
+      invite_id: NonEmptyStringSchema,
+      accepted_at: Rfc3339Schema,
+      participant_id: LowerCrockfordUlidSchema,
+      state: SeatStateSchema,
+      alias: NonEmptyStringSchema.optional(),
+      removed_at: Rfc3339Schema.optional(),
+      removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
+      replaces_seat: LowerCrockfordUlidSchema.optional(),
+      bounced_at: Rfc3339Schema.optional()
+    }).strict().superRefine((seat, context) => {
+      if (seat.state === "removed") {
+        if (seat.removed_at === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["removed_at"],
+            message: "removed seats require removed_at"
+          });
+        }
+        if (seat.removed_epoch === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["removed_epoch"],
+            message: "removed seats require removed_epoch"
+          });
+        }
+      } else {
+        for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
+          if (seat[field] !== void 0) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [field],
+              message: `${field} is reserved for removed seats`
+            });
+          }
+        }
       }
-    };
-    temporarySequence = 0;
-    PacketRegistry = class {
-      packets = /* @__PURE__ */ new Map();
-      host;
-      stateDir;
-      fs;
-      persistence;
-      log;
-      seed;
-      beforeExpose;
-      onNotify;
-      provisioningCheckpoint;
-      stagingName;
-      constructor(host, stateDir, options = {}) {
-        this.host = host;
-        this.stateDir = stateDir;
-        this.fs = options.fs ?? nodeFs2;
-        this.persistence = options.persistence ?? this.fs;
-        this.log = options.log ?? (() => {
+    });
+    RoomInviteSchema = external_exports.object({
+      invite_id: NonEmptyStringSchema,
+      mode: InviteModeSchema,
+      role: RoleSchema,
+      min_accepts: PositiveSafeIntegerSchema,
+      accepted_cids: external_exports.array(NonEmptyStringSchema),
+      state: InviteStateSchema,
+      recovery_of: NonEmptyStringSchema.optional(),
+      recovery_confirmed: external_exports.boolean().optional(),
+      created_at: Rfc3339Schema,
+      replaces_seat: LowerCrockfordUlidSchema.optional()
+    }).strict().superRefine((invite, context) => {
+      if (invite.mode === "one_time" && invite.min_accepts !== 1) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["min_accepts"],
+          message: "one_time invites require min_accepts === 1"
         });
-        this.seed = options.seed ?? (() => randomBytes(24).toString("hex"));
-        this.beforeExpose = options.beforeExpose ?? (() => {
+      }
+      if (invite.state === "receipt_pending" && invite.recovery_of === void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_of"],
+          message: "receipt_pending invites require recovery_of"
         });
-        this.onNotify = options.onNotify ?? (() => {
+      }
+      if (invite.recovery_of === void 0 && invite.recovery_confirmed !== void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "recovery_confirmed is forbidden without recovery_of"
         });
-        this.provisioningCheckpoint = options.provisioningCheckpoint ?? (() => {
+      }
+      if (invite.recovery_of !== void 0 && invite.recovery_confirmed === void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "recovery_confirmed is required with recovery_of"
         });
-        this.stagingName = options.stagingName ?? (() => `live.staging-${randomBytes(16).toString("hex")}`);
       }
-      get size() {
-        return this.packets.size;
+      if (invite.state === "receipt_pending" && invite.recovery_confirmed !== false) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "receipt_pending recovery lineage must be unconfirmed"
+        });
       }
-      get(roomId) {
-        return this.packets.get(roomId);
+      if (invite.recovery_of !== void 0 && (invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required") && invite.recovery_confirmed !== true) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "live, consumed, and replacement_required recovery lineage must be confirmed"
+        });
       }
-      async create(roomId, identityName = `cowork-room-${roomId}`, bio = `ours-cowork mission room ${roomId}`) {
-        validateRoomId(roomId);
-        if (this.packets.has(roomId)) throw new Error(`room packet "${roomId}" is already hosted`);
-        const liveDir = this.liveDir(roomId);
-        if (this.hasRestorableState(roomId)) {
-          try {
-            return await this.restore(roomId, void 0, identityName, bio);
-          } catch (error) {
-            this.log(`[${this.packetName(roomId)}] pending packet restore failed; reprovisioning:`, error);
+      if (invite.state === "receipt_pending" && invite.accepted_cids.length > 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["accepted_cids"],
+          message: "receipt_pending invites cannot have accepted CIDs"
+        });
+      }
+    });
+    MissionV1Schema = external_exports.object({
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema
+    }).strict();
+    MissionSchema = external_exports.object({
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema,
+      briefing_version: PositiveSafeIntegerSchema
+    }).strict();
+    RoleBriefingSchema = external_exports.object({
+      text: MissionTextSchema,
+      version: PositiveSafeIntegerSchema,
+      updated_at: Rfc3339Schema
+    }).strict();
+    RoomCommonShape = {
+      room_id: LowerCrockfordUlidSchema,
+      identity_name: NonEmptyStringSchema,
+      identity_cid: external_exports.string(),
+      state: RoomStateSchema,
+      status: NonEmptyStringSchema.optional(),
+      invites: external_exports.array(RoomInviteSchema),
+      created_at: Rfc3339Schema,
+      activated_at: Rfc3339Schema.optional(),
+      closed_at: Rfc3339Schema.optional()
+    };
+    RoomV1Schema = external_exports.object({
+      ...RoomCommonShape,
+      version: external_exports.literal(1),
+      mission: MissionV1Schema,
+      seats: external_exports.array(SeatV1Schema)
+    }).strict().superRefine(refineRoomLineage);
+    RoomSchema = external_exports.object({
+      ...RoomCommonShape,
+      version: external_exports.literal(2),
+      mission: MissionSchema,
+      role_briefings: external_exports.record(RoleSchema, RoleBriefingSchema),
+      anonymous: external_exports.boolean(),
+      quiet_membership: external_exports.boolean(),
+      membership_epoch: external_exports.number().int().nonnegative().safe(),
+      seats: external_exports.array(SeatSchema)
+    }).strict().superRefine((room, context) => {
+      refineRoomLineage(room, context);
+      const byParticipant = /* @__PURE__ */ new Map();
+      const activeAliases = /* @__PURE__ */ new Set();
+      for (const [index, seat] of room.seats.entries()) {
+        if (byParticipant.has(seat.participant_id)) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "participant_id"],
+            message: "participant_id must be unique within the room"
+          });
+        }
+        byParticipant.set(seat.participant_id, seat);
+        if (room.anonymous && seat.alias === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "anonymous rooms require an alias on every seat"
+          });
+        }
+        if (!room.anonymous && seat.alias !== void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "aliases are reserved for anonymous rooms"
+          });
+        }
+        if (seat.state === "active" && seat.alias !== void 0) {
+          if (activeAliases.has(seat.alias)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: ["seats", index, "alias"],
+              message: "active seats must hold distinct aliases"
+            });
           }
+          activeAliases.add(seat.alias);
         }
-        this.prepareProvisioningDirectory(roomId);
-        let native;
-        try {
-          native = await this.host.createPacket(this.packetName(roomId), this.seed());
-          let room;
-          room = new HostedRoomPacket(
-            native,
-            () => this.saveState(native, liveDir),
-            this.log,
-            (event) => this.onNotify(roomId, event),
-            () => {
-              if (this.packets.get(roomId) === room) this.packets.delete(roomId);
-            }
-          );
-          atomicWriteFileSync(this.identityPath(roomId), Buffer.from(exportSigningSecret(native), "utf8"), this.persistence);
-          this.provisioningCheckpoint("identity");
-          this.saveState(native, liveDir);
-          this.provisioningCheckpoint("state");
-          this.packets.set(roomId, room);
-          await room.setIdentity(identityName, bio);
-          this.provisioningCheckpoint("identity_applied");
-          return room;
-        } catch (error) {
-          if (native) {
-            try {
-              this.host.removePacket(native.cid);
-            } catch {
-            }
-          }
-          this.packets.delete(roomId);
-          throw error;
-        }
-      }
-      async restore(roomId, expectedCid, identityName, bio) {
-        validateRoomId(roomId);
-        if (this.packets.has(roomId)) throw new Error(`room packet "${roomId}" is already hosted`);
-        const liveDir = this.liveDir(roomId);
-        const secret = this.fs.readFileSync(this.identityPath(roomId), "utf8").trim();
-        if (!/^[0-9a-f]+$/i.test(secret) || secret.length % 2 !== 0) {
-          throw new Error(`invalid signing secret for room "${roomId}"`);
-        }
-        const stateBytes = this.fs.readFileSync(this.statePath(roomId));
-        if (stateBytes.length === 0) throw new Error(`empty packet state for room "${roomId}"`);
-        const native = await this.host.createPacket(
-          this.packetName(roomId),
-          this.seed(),
-          secret,
-          { deferredExposure: true }
-        );
-        if (expectedCid !== void 0 && native.cid !== expectedCid) {
-          try {
-            this.host.removePacket(native.cid);
-          } catch {
-          }
-          throw new Error(
-            `restored room packet CID mismatch for "${roomId}": expected "${expectedCid}", found "${native.cid}"`
-          );
-        }
-        let room;
-        room = new HostedRoomPacket(
-          native,
-          () => this.saveState(native, liveDir),
-          this.log,
-          (event) => this.onNotify(roomId, event),
-          () => {
-            if (this.packets.get(roomId) === room) this.packets.delete(roomId);
-          }
-        );
-        try {
-          await withScopeAsync(async (lifetime) => {
-            const state = native.pw.packet.ParseValue(new Uint8Array(stateBytes)).Attach(lifetime);
-            await native.mutatingTx("::actor::import_state", state, lifetime);
+        if (seat.removed_epoch !== void 0 && seat.removed_epoch > room.membership_epoch) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "removed_epoch"],
+            message: "removed_epoch cannot exceed the room membership_epoch"
           });
-          native.pw.refresh_identity_proof_document();
-          if (identityName !== void 0 && bio !== void 0) {
-            await room.setIdentity(identityName, bio);
-            this.provisioningCheckpoint("identity_applied");
-          }
-          atomicWriteFileSync(
-            this.ownershipPath(roomId),
-            Buffer.from(`${roomId}
-`, "utf8"),
-            this.persistence
-          );
-          await this.beforeExpose(room);
-          this.host.exposePacket(native.cid);
-          this.packets.set(roomId, room);
-          return room;
-        } catch (error) {
-          try {
-            this.host.removePacket(native.cid);
-          } catch {
-          }
-          throw error;
         }
       }
-      async destroy(roomId) {
-        validateRoomId(roomId);
-        const room = this.packets.get(roomId);
-        if (room) {
-          this.host.removePacket(room.cid);
-          this.packets.delete(roomId);
+      for (const [index, seat] of room.seats.entries()) {
+        if (seat.replaces_seat === void 0) continue;
+        const predecessor = byParticipant.get(seat.replaces_seat);
+        if (!predecessor || predecessor === seat || predecessor.state !== "removed") {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "replaces_seat"],
+            message: "replaces_seat must reference a removed seat in this room"
+          });
+          continue;
         }
-        const liveDir = this.liveDir(roomId);
-        let removalFailure;
-        try {
-          this.assertSafeRoomDirectory(roomId);
-          this.fs.rmSync(liveDir, { recursive: true, force: true });
-          this.fsyncDirectory(this.roomDir(roomId));
-        } catch (error) {
-          this.log(`[${room?.name ?? this.packetName(roomId)}] live-state removal failed:`, error);
-          removalFailure = error;
+        if (predecessor.role !== seat.role) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "role"],
+            message: "a replacement seat must inherit the predecessor role"
+          });
         }
-        const residue = this.residue(roomId);
-        if (removalFailure !== void 0 && residue.length === 0) {
-          throw new PacketPersistenceError(
-            `live-state removal durability is uncertain for room "${roomId}"`,
-            { cause: removalFailure }
-          );
+        if (room.anonymous && seat.alias !== predecessor.alias) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "an anonymous replacement seat must inherit the predecessor alias"
+          });
         }
-        return residue;
       }
-      /** Unhost runtime packets while retaining every byte required for restart. */
-      async unhostAll() {
-        const errors = [];
-        for (const [roomId, room] of [...this.packets]) {
-          try {
-            this.host.removePacket(room.cid, new Error("cowork daemon is shutting down"));
-            this.packets.delete(roomId);
-          } catch (error) {
-            errors.push(error);
+    });
+    CreateRoomInputSchema = external_exports.object({
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema,
+      anonymous: external_exports.boolean().optional(),
+      quiet_membership: external_exports.boolean().optional()
+    }).strict();
+    UpdateRoomInputSchema = external_exports.object({
+      goal: MissionTextSchema.optional(),
+      briefing: MissionTextSchema.optional(),
+      status: NonEmptyStringSchema.optional(),
+      quiet_membership: external_exports.boolean().optional()
+    }).strict().refine((input) => Object.keys(input).length > 0, "at least one setting is required");
+    RoleBriefingSetInputSchema = external_exports.object({
+      role: RoleSchema,
+      text: MissionTextSchema
+    }).strict();
+    RoleBriefingDeleteInputSchema = external_exports.object({
+      role: RoleSchema
+    }).strict();
+    PostMessageInputSchema = external_exports.object({
+      text: MessageTextSchema
+    }).strict();
+    AuthorSnapshotSchema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema
+    }).strict();
+    RecordCommonShape = {
+      version: external_exports.literal(1),
+      room_id: LowerCrockfordUlidSchema,
+      seq: PositiveSafeIntegerSchema,
+      record_id: NonEmptyStringSchema,
+      at: Rfc3339Schema
+    };
+    AppendCommonShape = {
+      version: external_exports.literal(1),
+      room_id: LowerCrockfordUlidSchema,
+      at: Rfc3339Schema
+    };
+    MembershipNoticeSchema = external_exports.object({
+      action: external_exports.enum(["remove"]),
+      alias: NonEmptyStringSchema.optional(),
+      role: RoleSchema.optional(),
+      epoch: external_exports.number().int().nonnegative().safe()
+    }).strict();
+    AuthorAliasSchema = external_exports.object({
+      participant_id: LowerCrockfordUlidSchema,
+      alias: NonEmptyStringSchema
+    }).strict();
+    MessageShape = {
+      kind: external_exports.literal("message"),
+      message_id: LowerCrockfordUlidSchema,
+      author: AuthorSnapshotSchema,
+      author_alias: AuthorAliasSchema.optional(),
+      category: external_exports.enum(["briefing", "role_briefing", "chat", "membership"]),
+      briefing_role: RoleSchema.optional(),
+      briefing_version: PositiveSafeIntegerSchema.optional(),
+      membership: MembershipNoticeSchema.optional(),
+      text: MessageTextSchema,
+      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
+        const seen = /* @__PURE__ */ new Set();
+        for (const [index, identity] of identities.entries()) {
+          if (seen.has(identity)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [index],
+              message: "recipient identities must be unique"
+            });
           }
+          seen.add(identity);
         }
-        if (errors.length > 0) throw new AggregateError(errors, "failed to unhost room packets");
-      }
-      saveState(packet, liveDir) {
-        try {
-          const bytes = withScope((lifetime) => Buffer.from(packet.readonlyTx("::actor::export_state", lifetime).Serialize()));
-          atomicWriteFileSync(join3(liveDir, "state_data.bin"), bytes, this.persistence);
-        } catch (error) {
-          if (error instanceof PacketPersistenceError) throw error;
-          throw new PacketPersistenceError(`failed to export state for packet "${packet.name}"`, { cause: error });
-        }
-      }
-      residue(roomId) {
-        const liveDir = this.liveDir(roomId);
-        try {
-          this.fs.lstatSync(liveDir);
-          return [liveDir];
-        } catch (error) {
-          if (error.code === "ENOENT") return [];
-          throw error;
+      }),
+      source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
+      source_wire_id: NonEmptyStringSchema.optional()
+    };
+    RelayIntentShape = {
+      kind: external_exports.literal("relay_intent"),
+      message_id: LowerCrockfordUlidSchema.optional(),
+      file_id: LowerCrockfordUlidSchema.optional(),
+      recipient_identity: NonEmptyStringSchema
+    };
+    RelayResultStatusSchema = external_exports.enum(["queued", "send_failed", "skipped_removed"]);
+    RelayResultShape = {
+      kind: external_exports.literal("relay_result"),
+      intent_record_id: NonEmptyStringSchema,
+      message_id: LowerCrockfordUlidSchema.optional(),
+      file_id: LowerCrockfordUlidSchema.optional(),
+      recipient_identity: NonEmptyStringSchema,
+      status: RelayResultStatusSchema,
+      wire_id: NonEmptyStringSchema.optional(),
+      metadata_wire_id: NonEmptyStringSchema.optional()
+    };
+    FileShape = {
+      kind: external_exports.literal("file"),
+      file_id: LowerCrockfordUlidSchema,
+      author: AuthorSnapshotSchema,
+      author_alias: AuthorAliasSchema.optional(),
+      filename: FileNameSchema,
+      mime: FileMimeSchema,
+      size: external_exports.number().int().nonnegative().max(MAX_FILE_BYTES),
+      sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+      data_base64: external_exports.string(),
+      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
+        const seen = /* @__PURE__ */ new Set();
+        for (const [index, identity] of identities.entries()) {
+          if (seen.has(identity)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [index],
+              message: "recipient identities must be unique"
+            });
+          }
+          seen.add(identity);
         }
+      }),
+      source_file_id: external_exports.number().int().nonnegative().safe(),
+      source_wire_id: NonEmptyStringSchema.optional()
+    };
+    MembershipIntentShape = {
+      kind: external_exports.literal("membership_intent"),
+      action: external_exports.enum(["remove"]),
+      participant_id: LowerCrockfordUlidSchema,
+      recipient_identity: NonEmptyStringSchema,
+      role: RoleSchema,
+      alias: NonEmptyStringSchema.optional(),
+      epoch: PositiveSafeIntegerSchema,
+      notify: external_exports.boolean()
+    };
+    MembershipResultShape = {
+      kind: external_exports.literal("membership_result"),
+      intent_record_id: NonEmptyStringSchema,
+      participant_id: LowerCrockfordUlidSchema,
+      status: RelayStatusSchema,
+      notified: external_exports.boolean(),
+      key_material_retained: external_exports.literal(true),
+      uncertain_after_restart: external_exports.literal(true).optional()
+    };
+    CloseNoticeIntentShape = {
+      kind: external_exports.literal("close_notice_intent"),
+      recipient_identity: NonEmptyStringSchema
+    };
+    CloseNoticeResultShape = {
+      kind: external_exports.literal("close_notice_result"),
+      intent_record_id: NonEmptyStringSchema,
+      recipient_identity: NonEmptyStringSchema,
+      status: RelayStatusSchema,
+      notified: external_exports.boolean(),
+      key_material_retained: external_exports.literal(true),
+      uncertain_after_restart: external_exports.literal(true).optional()
+    };
+    MessageRecordSchema = external_exports.object({ ...RecordCommonShape, ...MessageShape }).strict();
+    FileRecordSchema = external_exports.object({ ...RecordCommonShape, ...FileShape }).strict();
+    RelayIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayIntentShape }).strict();
+    RelayResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayResultShape }).strict();
+    MembershipIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipIntentShape }).strict();
+    MembershipResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipResultShape }).strict();
+    CloseNoticeIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeIntentShape }).strict();
+    CloseNoticeResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeResultShape }).strict();
+    RawCommunicationRecordSchema = external_exports.discriminatedUnion("kind", [
+      MessageRecordSchema,
+      FileRecordSchema,
+      RelayIntentRecordSchema,
+      RelayResultRecordSchema,
+      MembershipIntentRecordSchema,
+      MembershipResultRecordSchema,
+      CloseNoticeIntentRecordSchema,
+      CloseNoticeResultRecordSchema
+    ]);
+    CommunicationRecordSchema = RawCommunicationRecordSchema.superRefine((record, context) => {
+      if (record.record_id !== `${record.room_id}:${record.seq}`) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["record_id"],
+          message: 'record_id must equal room_id + ":" + seq'
+        });
       }
-      packetName(roomId) {
-        return `cowork-room-${roomId}`;
+      if (record.kind === "message") refineMessageCategory(record, context);
+      refineRelaySubject(record, context);
+      refineFileRecord(record, context);
+    });
+    AppendRecordSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ ...AppendCommonShape, ...MessageShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...FileShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...RelayIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...RelayResultShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...MembershipIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...MembershipResultShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...CloseNoticeIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...CloseNoticeResultShape }).strict()
+    ]).superRefine((record, context) => {
+      if (record.kind === "message") refineMessageCategory(record, context);
+      refineRelaySubject(record, context);
+      refineFileRecord(record, context);
+    });
+  }
+});
+
+// src/packets.ts
+import { randomBytes } from "node:crypto";
+import * as nodeFs2 from "node:fs";
+import { dirname as dirname3, join as join3 } from "node:path";
+function atomicWriteFileSync(target, bytes, ops = nodeFs2) {
+  const temp = `${target}.tmp-${process.pid}-${temporarySequence++}`;
+  let fileFd;
+  let directoryFd;
+  try {
+    fileFd = ops.openSync(temp, nodeFs2.constants.O_CREAT | nodeFs2.constants.O_TRUNC | nodeFs2.constants.O_WRONLY, 384);
+    ops.fchmodSync(fileFd, 384);
+    let offset = 0;
+    while (offset < bytes.byteLength) {
+      const written = ops.writeSync(fileFd, bytes, offset, bytes.byteLength - offset, null);
+      if (written <= 0) throw new Error(`short write while persisting ${target}`);
+      offset += written;
+    }
+    ops.fsyncSync(fileFd);
+    ops.closeSync(fileFd);
+    fileFd = void 0;
+    ops.renameSync(temp, target);
+    ops.chmodSync(target, 384);
+    directoryFd = ops.openSync(dirname3(target), nodeFs2.constants.O_RDONLY);
+    ops.fsyncSync(directoryFd);
+    ops.closeSync(directoryFd);
+    directoryFd = void 0;
+  } catch (error) {
+    if (fileFd !== void 0) {
+      try {
+        ops.closeSync(fileFd);
+      } catch {
       }
-      roomDir(roomId) {
-        return join3(this.stateDir, "rooms", roomId);
+    }
+    if (directoryFd !== void 0) {
+      try {
+        ops.closeSync(directoryFd);
+      } catch {
       }
-      liveDir(roomId) {
-        return join3(this.roomDir(roomId), "live");
+    }
+    try {
+      ops.rmSync(temp, { force: true });
+    } catch {
+    }
+    throw new PacketPersistenceError(`failed to durably persist ${target}`, { cause: error });
+  }
+}
+function renderInbox(value) {
+  const output = [];
+  if (value.IsNil()) return output;
+  for (let index = 0; ; index += 1) {
+    const message = value.Reduce(index);
+    if (message.IsNil()) break;
+    output.push({
+      msg_id: Number(message.Reduce("msg_id").Visualize()),
+      sender_id: message.Reduce("sender_id").Visualize(),
+      sender_name: message.Reduce("sender_name").Visualize(),
+      text: message.Reduce("text").Visualize(),
+      date: adaptTimeToRfc3339(message.Reduce("date").Visualize()),
+      status: message.Reduce("status").Visualize(),
+      wire_id: message.Reduce("wire_id").Visualize()
+    });
+  }
+  return output;
+}
+function renderFileInbox(value) {
+  const output = [];
+  if (value.IsNil()) return output;
+  for (let index = 0; ; index += 1) {
+    const file = value.Reduce(index);
+    if (file.IsNil()) break;
+    output.push({
+      file_id: Number(file.Reduce("file_id").Visualize()),
+      sender_id: file.Reduce("sender_id").Visualize(),
+      sender_name: file.Reduce("sender_name").Visualize(),
+      filename: file.Reduce("filename").Visualize(),
+      mime: file.Reduce("mime").Visualize(),
+      data: Buffer.from(file.Reduce("data").GetBinary()),
+      date: adaptTimeToRfc3339(file.Reduce("date").Visualize()),
+      status: file.Reduce("status").Visualize(),
+      wire_id: file.Reduce("wire_id").Visualize()
+    });
+  }
+  return output;
+}
+function renderIntegerArray(value) {
+  const output = [];
+  if (value.IsNil()) return output;
+  for (let index = 0; ; index += 1) {
+    const item = value.Reduce(index);
+    if (item.IsNil()) break;
+    output.push(Number(item.Visualize()));
+  }
+  return output;
+}
+function dictionaryEntries(value) {
+  if (value.IsNil()) return [];
+  return value.GetKeys().map((key) => [key.Visualize(), value.Reduce(key)]);
+}
+function booleanValue(value) {
+  if (value.IsNil()) return false;
+  try {
+    return value.GetBoolean();
+  } catch {
+    return /true/i.test(value.Visualize());
+  }
+}
+function strictBooleanValue(value, label) {
+  if (value.IsNil()) throw new Error(`${label} must be a boolean`);
+  let decoded;
+  try {
+    decoded = value.GetBoolean();
+  } catch (error) {
+    throw new Error(`${label} must be a boolean`, { cause: error });
+  }
+  if (typeof decoded !== "boolean") throw new Error(`${label} must be a boolean`);
+  return decoded;
+}
+function nilString(value) {
+  return value.IsNil() ? "" : value.Visualize();
+}
+function adaptTimeToRfc3339(value) {
+  const rfc3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,3}))?(?:Z|([+-])(\d{2}):(\d{2}))$/.exec(value);
+  if (rfc3339) {
+    const [, year2, month2, day2, hour2, minute2, second2, fraction2 = "", sign2, offsetHour2 = "0", offsetMinute = "0"] = rfc3339;
+    if (sign2 === "-" && offsetHour2 === "00" && offsetMinute === "00") return invalidAdaptTime(value);
+    return canonicalUtcTime(value, year2, month2, day2, hour2, minute2, second2, fraction2, sign2, offsetHour2, offsetMinute);
+  }
+  const native = /^(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))? \(UTC(?:([+-])(0|[1-9]|1\d|2[0-3]))?\)$/.exec(value);
+  if (!native) return invalidAdaptTime(value);
+  const [, year, month, day, hour, minute, second, fraction = "", sign, offsetHour = "0"] = native;
+  if (sign === "-" && offsetHour === "0") return invalidAdaptTime(value);
+  return canonicalUtcTime(value, year, month, day, hour, minute, second, fraction, sign, offsetHour, "0");
+}
+function canonicalUtcTime(source, yearText, monthText, dayText, hourText, minuteText, secondText, fraction, offsetSign, offsetHourText, offsetMinuteText) {
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  const offsetHour = Number(offsetHourText);
+  const offsetMinute = Number(offsetMinuteText);
+  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const monthDays = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  if (month < 1 || month > 12 || day < 1 || day > monthDays[month - 1] || hour > 23 || minute > 59 || second > 59 || offsetHour > 23 || offsetMinute > 59) return invalidAdaptTime(source);
+  const milliseconds = Number(fraction.slice(0, 3).padEnd(3, "0"));
+  const local = /* @__PURE__ */ new Date(0);
+  local.setUTCFullYear(year, month - 1, day);
+  local.setUTCHours(hour, minute, second, milliseconds);
+  if (local.getUTCFullYear() !== year || local.getUTCMonth() !== month - 1 || local.getUTCDate() !== day || local.getUTCHours() !== hour || local.getUTCMinutes() !== minute || local.getUTCSeconds() !== second) {
+    return invalidAdaptTime(source);
+  }
+  const direction = offsetSign === "-" ? -1 : 1;
+  const offsetMilliseconds = direction * (offsetHour * 60 + offsetMinute) * 6e4;
+  const canonical = new Date(local.getTime() - offsetMilliseconds).toISOString();
+  if (!/^\d{4}-/.test(canonical)) return invalidAdaptTime(source);
+  return canonical;
+}
+function invalidAdaptTime(value) {
+  throw new Error(`unexpected ADAPT time visualization: ${value}`);
+}
+function inviteMode(value) {
+  const normalized = value.replace(/^\$/, "");
+  if (normalized === "one_time" || normalized === "public") return normalized;
+  throw new Error(`unexpected invite mode: ${value}`);
+}
+function exportSigningSecret(packet) {
+  return withScope((lifetime) => Buffer.from(packet.readonlyTx("::actor::export_signing_secret", lifetime).Serialize()).toString("hex"));
+}
+function validateRoomId(roomId) {
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(roomId)) throw new Error(`invalid room id: ${roomId}`);
+}
+var PacketPersistenceError, temporarySequence, PacketRegistry, HostedRoomPacket;
+var init_packets = __esm({
+  async "src/packets.ts"() {
+    "use strict";
+    await init_adapt();
+    init_contracts();
+    PacketPersistenceError = class extends Error {
+      constructor(message, options) {
+        super(message, options);
+        this.name = "PacketPersistenceError";
+      }
+    };
+    temporarySequence = 0;
+    PacketRegistry = class {
+      packets = /* @__PURE__ */ new Map();
+      host;
+      stateDir;
+      fs;
+      persistence;
+      log;
+      seed;
+      beforeExpose;
+      onNotify;
+      provisioningCheckpoint;
+      stagingName;
+      constructor(host, stateDir, options = {}) {
+        this.host = host;
+        this.stateDir = stateDir;
+        this.fs = options.fs ?? nodeFs2;
+        this.persistence = options.persistence ?? this.fs;
+        this.log = options.log ?? (() => {
+        });
+        this.seed = options.seed ?? (() => randomBytes(24).toString("hex"));
+        this.beforeExpose = options.beforeExpose ?? (() => {
+        });
+        this.onNotify = options.onNotify ?? (() => {
+        });
+        this.provisioningCheckpoint = options.provisioningCheckpoint ?? (() => {
+        });
+        this.stagingName = options.stagingName ?? (() => `live.staging-${randomBytes(16).toString("hex")}`);
+      }
+      get size() {
+        return this.packets.size;
+      }
+      get(roomId) {
+        return this.packets.get(roomId);
+      }
+      async create(roomId, identityName = `cowork-room-${roomId}`, bio = `ours-cowork mission room ${roomId}`) {
+        validateRoomId(roomId);
+        if (this.packets.has(roomId)) throw new Error(`room packet "${roomId}" is already hosted`);
+        const liveDir = this.liveDir(roomId);
+        if (this.hasRestorableState(roomId)) {
+          try {
+            return await this.restore(roomId, void 0, identityName, bio);
+          } catch (error) {
+            this.log(`[${this.packetName(roomId)}] pending packet restore failed; reprovisioning:`, error);
+          }
+        }
+        this.prepareProvisioningDirectory(roomId);
+        let native;
+        try {
+          native = await this.host.createPacket(this.packetName(roomId), this.seed());
+          let room;
+          room = new HostedRoomPacket(
+            native,
+            () => this.saveState(native, liveDir),
+            this.log,
+            (event) => this.onNotify(roomId, event),
+            () => {
+              if (this.packets.get(roomId) === room) this.packets.delete(roomId);
+            }
+          );
+          atomicWriteFileSync(this.identityPath(roomId), Buffer.from(exportSigningSecret(native), "utf8"), this.persistence);
+          this.provisioningCheckpoint("identity");
+          this.saveState(native, liveDir);
+          this.provisioningCheckpoint("state");
+          this.packets.set(roomId, room);
+          await room.setIdentity(identityName, bio);
+          this.provisioningCheckpoint("identity_applied");
+          return room;
+        } catch (error) {
+          if (native) {
+            try {
+              this.host.removePacket(native.cid);
+            } catch {
+            }
+          }
+          this.packets.delete(roomId);
+          throw error;
+        }
+      }
+      async restore(roomId, expectedCid, identityName, bio) {
+        validateRoomId(roomId);
+        if (this.packets.has(roomId)) throw new Error(`room packet "${roomId}" is already hosted`);
+        const liveDir = this.liveDir(roomId);
+        const secret = this.fs.readFileSync(this.identityPath(roomId), "utf8").trim();
+        if (!/^[0-9a-f]+$/i.test(secret) || secret.length % 2 !== 0) {
+          throw new Error(`invalid signing secret for room "${roomId}"`);
+        }
+        const stateBytes = this.fs.readFileSync(this.statePath(roomId));
+        if (stateBytes.length === 0) throw new Error(`empty packet state for room "${roomId}"`);
+        const native = await this.host.createPacket(
+          this.packetName(roomId),
+          this.seed(),
+          secret,
+          { deferredExposure: true }
+        );
+        if (expectedCid !== void 0 && native.cid !== expectedCid) {
+          try {
+            this.host.removePacket(native.cid);
+          } catch {
+          }
+          throw new Error(
+            `restored room packet CID mismatch for "${roomId}": expected "${expectedCid}", found "${native.cid}"`
+          );
+        }
+        let room;
+        room = new HostedRoomPacket(
+          native,
+          () => this.saveState(native, liveDir),
+          this.log,
+          (event) => this.onNotify(roomId, event),
+          () => {
+            if (this.packets.get(roomId) === room) this.packets.delete(roomId);
+          }
+        );
+        try {
+          await withScopeAsync(async (lifetime) => {
+            const state = native.pw.packet.ParseValue(new Uint8Array(stateBytes)).Attach(lifetime);
+            await native.mutatingTx("::actor::import_state", state, lifetime);
+          });
+          native.pw.refresh_identity_proof_document();
+          if (identityName !== void 0 && bio !== void 0) {
+            await room.setIdentity(identityName, bio);
+            this.provisioningCheckpoint("identity_applied");
+          }
+          atomicWriteFileSync(
+            this.ownershipPath(roomId),
+            Buffer.from(`${roomId}
+`, "utf8"),
+            this.persistence
+          );
+          await this.beforeExpose(room);
+          this.host.exposePacket(native.cid);
+          this.packets.set(roomId, room);
+          return room;
+        } catch (error) {
+          try {
+            this.host.removePacket(native.cid);
+          } catch {
+          }
+          throw error;
+        }
+      }
+      async destroy(roomId) {
+        validateRoomId(roomId);
+        const room = this.packets.get(roomId);
+        if (room) {
+          this.host.removePacket(room.cid);
+          this.packets.delete(roomId);
+        }
+        const liveDir = this.liveDir(roomId);
+        let removalFailure;
+        try {
+          this.assertSafeRoomDirectory(roomId);
+          this.fs.rmSync(liveDir, { recursive: true, force: true });
+          this.fsyncDirectory(this.roomDir(roomId));
+        } catch (error) {
+          this.log(`[${room?.name ?? this.packetName(roomId)}] live-state removal failed:`, error);
+          removalFailure = error;
+        }
+        const residue = this.residue(roomId);
+        if (removalFailure !== void 0 && residue.length === 0) {
+          throw new PacketPersistenceError(
+            `live-state removal durability is uncertain for room "${roomId}"`,
+            { cause: removalFailure }
+          );
+        }
+        return residue;
+      }
+      /** Unhost runtime packets while retaining every byte required for restart. */
+      async unhostAll() {
+        const errors = [];
+        for (const [roomId, room] of [...this.packets]) {
+          try {
+            this.host.removePacket(room.cid, new Error("cowork daemon is shutting down"));
+            this.packets.delete(roomId);
+          } catch (error) {
+            errors.push(error);
+          }
+        }
+        if (errors.length > 0) throw new AggregateError(errors, "failed to unhost room packets");
+      }
+      saveState(packet, liveDir) {
+        try {
+          const bytes = withScope((lifetime) => Buffer.from(packet.readonlyTx("::actor::export_state", lifetime).Serialize()));
+          atomicWriteFileSync(join3(liveDir, "state_data.bin"), bytes, this.persistence);
+        } catch (error) {
+          if (error instanceof PacketPersistenceError) throw error;
+          throw new PacketPersistenceError(`failed to export state for packet "${packet.name}"`, { cause: error });
+        }
+      }
+      residue(roomId) {
+        const liveDir = this.liveDir(roomId);
+        try {
+          this.fs.lstatSync(liveDir);
+          return [liveDir];
+        } catch (error) {
+          if (error.code === "ENOENT") return [];
+          throw error;
+        }
+      }
+      packetName(roomId) {
+        return `cowork-room-${roomId}`;
+      }
+      roomDir(roomId) {
+        return join3(this.stateDir, "rooms", roomId);
+      }
+      liveDir(roomId) {
+        return join3(this.roomDir(roomId), "live");
       }
       identityPath(roomId) {
         return join3(this.liveDir(roomId), "identity.key");
@@ -5327,681 +5957,184 @@ var init_packets = __esm({
         }
       }
       assertSafeRoomDirectory(roomId) {
-        const roomDir = this.roomDir(roomId);
-        const stat = this.fs.lstatSync(roomDir);
-        if (stat.isSymbolicLink() || !stat.isDirectory()) {
-          throw new Error(`room directory for "${roomId}" is not a safe directory`);
-        }
-      }
-      fsyncDirectory(path) {
-        let fd;
-        try {
-          fd = this.fs.openSync(path, nodeFs2.constants.O_RDONLY | (nodeFs2.constants.O_NOFOLLOW ?? 0));
-          this.fs.fsyncSync(fd);
-        } finally {
-          if (fd !== void 0) this.fs.closeSync(fd);
-        }
-      }
-    };
-    HostedRoomPacket = class {
-      name;
-      cid;
-      packet;
-      constructor(packet, saveState, log, onNotify = () => {
-      }, onTerminal = () => {
-      }) {
-        this.packet = packet;
-        this.name = packet.name;
-        this.cid = packet.cid;
-        wireHandlers(packet, { onSaveState: saveState, onNotify: (event) => onNotify(event) }, log);
-        packet.onTerminalClose?.(onTerminal);
-      }
-      async setIdentity(identityName, bio) {
-        await withScopeAsync((lifetime) => this.packet.mutatingTx("::a2a_messaging::set_my_name", { name: identityName }, lifetime));
-        await withScopeAsync((lifetime) => this.packet.mutatingTx("::a2a_messaging::set_my_bio", { bio }, lifetime));
-      }
-      async mintInvite(mode) {
-        return withScopeAsync(async (lifetime) => {
-          const result = await this.packet.mutatingTx("::a2a_messaging::generate_invite", { mode }, lifetime);
-          return {
-            blob: packInvite(Buffer.from(result.Reduce("invite").GetBinary())),
-            invite_id: result.Reduce("invite_id").Visualize(),
-            reusable: booleanValue(result.Reduce("reusable"))
-          };
-        });
-      }
-      async revokeInvite(inviteId) {
-        return withScopeAsync(async (lifetime) => {
-          const result = await this.packet.mutatingTx("::a2a_messaging::revoke_invite", { invite_id: inviteId }, lifetime);
-          return { revoked: booleanValue(result.Reduce("revoked")) };
-        });
-      }
-      listInvites() {
-        return withScope((lifetime) => {
-          const value = this.packet.readonlyTx("::a2a_messaging::list_invites", lifetime);
-          return dictionaryEntries(value).map(([inviteId, invite]) => ({
-            invite_id: inviteId,
-            mode: inviteMode(invite.Reduce("mode").Visualize())
-          }));
-        });
-      }
-      listContacts() {
-        return withScope((lifetime) => {
-          const value = this.packet.readonlyTx("::a2a_messaging::list_contacts", lifetime);
-          return dictionaryEntries(value).map(([, contact]) => ({
-            name: contact.Reduce("name").Visualize(),
-            container_id: contact.Reduce("container_id").Visualize()
-          }));
-        });
-      }
-      listContactOrigins() {
-        return withScope((lifetime) => {
-          const value = this.packet.readonlyTx("::a2a_messaging::list_contact_origins", lifetime);
-          return Object.fromEntries(dictionaryEntries(value).map(([cid, origin]) => [cid, {
-            via: origin.Reduce("via").Visualize(),
-            invite_id: nilString(origin.Reduce("invite_id")),
-            at: adaptTimeToRfc3339(origin.Reduce("at").Visualize())
-          }]));
-        });
-      }
-      peekInbox() {
-        return withScope((lifetime) => renderInbox(this.packet.readonlyTx("::actor::list_incoming_messages", lifetime)).filter((message) => message.status === "unread").map(({ status: _status, ...message }) => message));
-      }
-      async consumeInbox(expectedIds) {
-        return withScopeAsync(async (lifetime) => {
-          const result = await this.packet.mutatingTx(
-            "::actor::consume_messages",
-            { expected_ids: expectedIds },
-            lifetime
-          );
-          return {
-            consumed: renderIntegerArray(result.Reduce("consumed")),
-            deferred: renderIntegerArray(result.Reduce("deferred"))
-          };
-        });
-      }
-      async send(contactCid, body) {
-        return withScopeAsync(async (lifetime) => {
-          const result = await this.packet.mutatingTx(
-            "::a2a_messaging::send_message",
-            { contact: contactCid, text: body },
-            lifetime
-          );
-          const refused = !result.Reduce("downgrade_refused").IsNil();
-          return refused ? { status: "send_failed" } : { status: "queued", wire_id: nilString(result.Reduce("wire_id")) || void 0 };
-        });
-      }
-      async removeContact(contactCid) {
-        return withScopeAsync(async (lifetime) => {
-          const result = await this.packet.mutatingTx(
-            "::a2a_messaging::remove_contact",
-            { contact: contactCid },
-            lifetime
-          );
-          const notified = strictBooleanValue(result.Reduce("notified"), "remove_contact notified");
-          const keyMaterialRetained = strictBooleanValue(
-            result.Reduce("key_material_retained"),
-            "remove_contact key_material_retained"
-          );
-          if (!keyMaterialRetained) {
-            throw new Error("remove_contact key_material_retained must be true");
-          }
-          return {
-            status: notified ? "queued" : "send_failed",
-            notified,
-            key_material_retained: true
-          };
-        });
-      }
-      async sign(canonicalJson2) {
-        return withScopeAsync(async (lifetime) => {
-          const result = await this.packet.mutatingTx(
-            "::actor::sign_app_envelope",
-            { canonical_json: canonicalJson2 },
-            lifetime
-          );
-          return Buffer.from(result.Reduce("signature").GetBinary()).toString("base64url");
-        });
-      }
-    };
-  }
-});
-
-// src/contracts.ts
-function utf8Bounded(label, maximumBytes) {
-  return external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") >= 1, `${label} must be at least 1 UTF-8 byte`).refine(
-    (value) => Buffer.byteLength(value, "utf8") <= maximumBytes,
-    `${label} must be at most ${maximumBytes} UTF-8 bytes`
-  );
-}
-function isStrictRfc3339(value) {
-  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
-  if (!match) return false;
-  const [, yearText, monthText, dayText, hourText, minuteText, secondText, offsetHourText, offsetMinuteText] = match;
-  const year = Number(yearText);
-  const month = Number(monthText);
-  const day = Number(dayText);
-  const hour = Number(hourText);
-  const minute = Number(minuteText);
-  const second = Number(secondText);
-  const offsetHour = offsetHourText === void 0 ? 0 : Number(offsetHourText);
-  const offsetMinute = offsetMinuteText === void 0 ? 0 : Number(offsetMinuteText);
-  if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59) return false;
-  if (offsetHour > 23 || offsetMinute > 59) return false;
-  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
-  const days = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-  return day >= 1 && day <= days[month - 1];
-}
-function refineRoomLineage(room, context) {
-  const pendingIdentityName = `cowork-room-${room.room_id}`;
-  const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && room.identity_name === pendingIdentityName && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
-  if (room.identity_cid === "" && !exactPacketPending) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["identity_cid"],
-      message: "empty identity_cid is reserved for the exact packet_pending provisioning sentinel"
-    });
-  }
-  if (room.identity_cid !== "" && room.status === "packet_pending") {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["status"],
-      message: "packet_pending status requires an empty identity_cid"
-    });
-  }
-  const pendingByRecovery = /* @__PURE__ */ new Map();
-  for (const [index, invite] of room.invites.entries()) {
-    if (invite.recovery_of === void 0) continue;
-    const recoveryOf = invite.recovery_of;
-    const source = room.invites.find((candidate) => candidate.invite_id === recoveryOf);
-    const validSourceState = invite.state === "receipt_pending" ? source?.state === "replacement_required" : invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required" ? source?.state === "revoked" : invite.state === "revoked" ? invite.recovery_confirmed === true ? source?.state === "revoked" : source?.state === "replacement_required" || source?.state === "revoked" : false;
-    if (!source || source.invite_id === invite.invite_id || !validSourceState) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["invites", index, "recovery_of"],
-        message: "recovery_of must point to a source invite in the state required by this recovery lineage"
-      });
-    } else if (invite.mode !== source.mode || invite.role !== source.role || invite.min_accepts !== source.min_accepts) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["invites", index],
-        message: "receipt_pending descriptor must copy source mode, role, and min_accepts"
-      });
-    }
-    if (invite.state === "receipt_pending") {
-      const count = (pendingByRecovery.get(recoveryOf) ?? 0) + 1;
-      pendingByRecovery.set(recoveryOf, count);
-      if (count > 1) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["invites", index, "recovery_of"],
-          message: "only one receipt_pending invite may exist per recovery_of pointer"
-        });
-      }
-    }
-  }
-}
-function migrateRoomV1(room, mintParticipantId) {
-  return RoomSchema.parse({
-    ...room,
-    version: 2,
-    mission: { ...room.mission, briefing_version: 1 },
-    role_briefings: {},
-    anonymous: false,
-    quiet_membership: false,
-    membership_epoch: 0,
-    seats: room.seats.map((seat) => ({
-      ...seat,
-      participant_id: LowerCrockfordUlidSchema.parse(mintParticipantId()),
-      state: "active"
-    }))
-  });
-}
-function refineMessageCategory(message, context) {
-  const requires = (field, present) => {
-    if (present && message[field] === void 0) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [field],
-        message: `${message.category} messages require ${field}`
-      });
-    }
-    if (!present && message[field] !== void 0) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [field],
-        message: `${field} is forbidden on ${message.category} messages`
-      });
-    }
-  };
-  requires("briefing_role", message.category === "role_briefing");
-  requires("membership", message.category === "membership");
-  if (message.category === "role_briefing" && message.briefing_version === void 0) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["briefing_version"],
-      message: "role_briefing messages require briefing_version"
-    });
-  }
-  if (message.category === "chat" || message.category === "membership") {
-    if (message.briefing_version !== void 0) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["briefing_version"],
-        message: `briefing_version is forbidden on ${message.category} messages`
-      });
-    }
-  }
-}
-var MAX_TEXT_BYTES, MAX_ROLE_BYTES, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoleSchema, MissionTextSchema, MessageTextSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
-var init_contracts = __esm({
-  "src/contracts.ts"() {
-    "use strict";
-    init_zod();
-    MAX_TEXT_BYTES = 262144;
-    MAX_ROLE_BYTES = 256;
-    NonEmptyStringSchema = external_exports.string().min(1);
-    PositiveSafeIntegerSchema = external_exports.number().int().positive().safe();
-    LowerCrockfordUlidSchema = external_exports.string().regex(
-      /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
-      "must be a 26-character lowercase Crockford ULID"
-    );
-    Rfc3339Schema = external_exports.string().refine(isStrictRfc3339, "must be a valid RFC3339 timestamp");
-    RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
-    MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
-    MessageTextSchema = utf8Bounded("message text", MAX_TEXT_BYTES);
-    RoomStateSchema = external_exports.enum(["provisioning", "active", "closing", "closed"]);
-    SeatStateSchema = external_exports.enum(["active", "removed"]);
-    InviteModeSchema = external_exports.enum(["one_time", "public"]);
-    DEFAULT_ROLE = "Participant";
-    InviteStateSchema = external_exports.enum([
-      "live",
-      "consumed",
-      "revoked",
-      "replacement_required",
-      "receipt_pending"
-    ]);
-    RelayStatusSchema = external_exports.enum(["queued", "send_failed"]);
-    SeatV1Schema = external_exports.object({
-      identity: NonEmptyStringSchema,
-      display_name: NonEmptyStringSchema,
-      role: RoleSchema,
-      invite_id: NonEmptyStringSchema,
-      accepted_at: Rfc3339Schema
-    }).strict();
-    SeatSchema = external_exports.object({
-      identity: NonEmptyStringSchema,
-      display_name: NonEmptyStringSchema,
-      role: RoleSchema,
-      invite_id: NonEmptyStringSchema,
-      accepted_at: Rfc3339Schema,
-      participant_id: LowerCrockfordUlidSchema,
-      state: SeatStateSchema,
-      alias: NonEmptyStringSchema.optional(),
-      removed_at: Rfc3339Schema.optional(),
-      removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
-      replaces_seat: LowerCrockfordUlidSchema.optional(),
-      bounced_at: Rfc3339Schema.optional()
-    }).strict().superRefine((seat, context) => {
-      if (seat.state === "removed") {
-        if (seat.removed_at === void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["removed_at"],
-            message: "removed seats require removed_at"
-          });
-        }
-        if (seat.removed_epoch === void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["removed_epoch"],
-            message: "removed seats require removed_epoch"
-          });
-        }
-      } else {
-        for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
-          if (seat[field] !== void 0) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [field],
-              message: `${field} is reserved for removed seats`
-            });
-          }
+        const roomDir = this.roomDir(roomId);
+        const stat = this.fs.lstatSync(roomDir);
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+          throw new Error(`room directory for "${roomId}" is not a safe directory`);
         }
       }
-    });
-    RoomInviteSchema = external_exports.object({
-      invite_id: NonEmptyStringSchema,
-      mode: InviteModeSchema,
-      role: RoleSchema,
-      min_accepts: PositiveSafeIntegerSchema,
-      accepted_cids: external_exports.array(NonEmptyStringSchema),
-      state: InviteStateSchema,
-      recovery_of: NonEmptyStringSchema.optional(),
-      recovery_confirmed: external_exports.boolean().optional(),
-      created_at: Rfc3339Schema,
-      replaces_seat: LowerCrockfordUlidSchema.optional()
-    }).strict().superRefine((invite, context) => {
-      if (invite.mode === "one_time" && invite.min_accepts !== 1) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["min_accepts"],
-          message: "one_time invites require min_accepts === 1"
+      fsyncDirectory(path) {
+        let fd;
+        try {
+          fd = this.fs.openSync(path, nodeFs2.constants.O_RDONLY | (nodeFs2.constants.O_NOFOLLOW ?? 0));
+          this.fs.fsyncSync(fd);
+        } finally {
+          if (fd !== void 0) this.fs.closeSync(fd);
+        }
+      }
+    };
+    HostedRoomPacket = class {
+      name;
+      cid;
+      packet;
+      constructor(packet, saveState, log, onNotify = () => {
+      }, onTerminal = () => {
+      }) {
+        this.packet = packet;
+        this.name = packet.name;
+        this.cid = packet.cid;
+        wireHandlers(packet, { onSaveState: saveState, onNotify: (event) => onNotify(event) }, log);
+        packet.onTerminalClose?.(onTerminal);
+      }
+      async setIdentity(identityName, bio) {
+        await withScopeAsync((lifetime) => this.packet.mutatingTx("::a2a_messaging::set_my_name", { name: identityName }, lifetime));
+        await withScopeAsync((lifetime) => this.packet.mutatingTx("::a2a_messaging::set_my_bio", { bio }, lifetime));
+      }
+      async mintInvite(mode) {
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx("::a2a_messaging::generate_invite", { mode }, lifetime);
+          return {
+            blob: packInvite(Buffer.from(result.Reduce("invite").GetBinary())),
+            invite_id: result.Reduce("invite_id").Visualize(),
+            reusable: booleanValue(result.Reduce("reusable"))
+          };
         });
       }
-      if (invite.state === "receipt_pending" && invite.recovery_of === void 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_of"],
-          message: "receipt_pending invites require recovery_of"
+      async revokeInvite(inviteId) {
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx("::a2a_messaging::revoke_invite", { invite_id: inviteId }, lifetime);
+          return { revoked: booleanValue(result.Reduce("revoked")) };
         });
       }
-      if (invite.recovery_of === void 0 && invite.recovery_confirmed !== void 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "recovery_confirmed is forbidden without recovery_of"
+      listInvites() {
+        return withScope((lifetime) => {
+          const value = this.packet.readonlyTx("::a2a_messaging::list_invites", lifetime);
+          return dictionaryEntries(value).map(([inviteId, invite]) => ({
+            invite_id: inviteId,
+            mode: inviteMode(invite.Reduce("mode").Visualize())
+          }));
         });
       }
-      if (invite.recovery_of !== void 0 && invite.recovery_confirmed === void 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "recovery_confirmed is required with recovery_of"
+      listContacts() {
+        return withScope((lifetime) => {
+          const value = this.packet.readonlyTx("::a2a_messaging::list_contacts", lifetime);
+          return dictionaryEntries(value).map(([, contact]) => ({
+            name: contact.Reduce("name").Visualize(),
+            container_id: contact.Reduce("container_id").Visualize()
+          }));
         });
       }
-      if (invite.state === "receipt_pending" && invite.recovery_confirmed !== false) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "receipt_pending recovery lineage must be unconfirmed"
+      listContactOrigins() {
+        return withScope((lifetime) => {
+          const value = this.packet.readonlyTx("::a2a_messaging::list_contact_origins", lifetime);
+          return Object.fromEntries(dictionaryEntries(value).map(([cid, origin]) => [cid, {
+            via: origin.Reduce("via").Visualize(),
+            invite_id: nilString(origin.Reduce("invite_id")),
+            at: adaptTimeToRfc3339(origin.Reduce("at").Visualize())
+          }]));
         });
       }
-      if (invite.recovery_of !== void 0 && (invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required") && invite.recovery_confirmed !== true) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "live, consumed, and replacement_required recovery lineage must be confirmed"
+      peekInbox() {
+        return withScope((lifetime) => renderInbox(this.packet.readonlyTx("::actor::list_incoming_messages", lifetime)).filter((message) => message.status === "unread").map(({ status: _status, ...message }) => message));
+      }
+      async consumeInbox(expectedIds) {
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::actor::consume_messages",
+            { expected_ids: expectedIds },
+            lifetime
+          );
+          return {
+            consumed: renderIntegerArray(result.Reduce("consumed")),
+            deferred: renderIntegerArray(result.Reduce("deferred"))
+          };
         });
       }
-      if (invite.state === "receipt_pending" && invite.accepted_cids.length > 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["accepted_cids"],
-          message: "receipt_pending invites cannot have accepted CIDs"
+      peekFileInbox() {
+        return withScope((lifetime) => renderFileInbox(
+          this.packet.readonlyTx("::actor::list_incoming_files", lifetime)
+        ).filter((file) => file.status === "unread").map(({ status: _status, ...file }) => file));
+      }
+      async consumeFileInbox(expectedIds) {
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::actor::consume_files",
+            { expected_ids: expectedIds },
+            lifetime
+          );
+          return {
+            consumed: renderIntegerArray(result.Reduce("consumed")),
+            deferred: renderIntegerArray(result.Reduce("deferred"))
+          };
         });
       }
-    });
-    MissionV1Schema = external_exports.object({
-      goal: MissionTextSchema,
-      briefing: MissionTextSchema
-    }).strict();
-    MissionSchema = external_exports.object({
-      goal: MissionTextSchema,
-      briefing: MissionTextSchema,
-      briefing_version: PositiveSafeIntegerSchema
-    }).strict();
-    RoleBriefingSchema = external_exports.object({
-      text: MissionTextSchema,
-      version: PositiveSafeIntegerSchema,
-      updated_at: Rfc3339Schema
-    }).strict();
-    RoomCommonShape = {
-      room_id: LowerCrockfordUlidSchema,
-      identity_name: NonEmptyStringSchema,
-      identity_cid: external_exports.string(),
-      state: RoomStateSchema,
-      status: NonEmptyStringSchema.optional(),
-      invites: external_exports.array(RoomInviteSchema),
-      created_at: Rfc3339Schema,
-      activated_at: Rfc3339Schema.optional(),
-      closed_at: Rfc3339Schema.optional()
-    };
-    RoomV1Schema = external_exports.object({
-      ...RoomCommonShape,
-      version: external_exports.literal(1),
-      mission: MissionV1Schema,
-      seats: external_exports.array(SeatV1Schema)
-    }).strict().superRefine(refineRoomLineage);
-    RoomSchema = external_exports.object({
-      ...RoomCommonShape,
-      version: external_exports.literal(2),
-      mission: MissionSchema,
-      role_briefings: external_exports.record(RoleSchema, RoleBriefingSchema),
-      anonymous: external_exports.boolean(),
-      quiet_membership: external_exports.boolean(),
-      membership_epoch: external_exports.number().int().nonnegative().safe(),
-      seats: external_exports.array(SeatSchema)
-    }).strict().superRefine((room, context) => {
-      refineRoomLineage(room, context);
-      const byParticipant = /* @__PURE__ */ new Map();
-      const activeAliases = /* @__PURE__ */ new Set();
-      for (const [index, seat] of room.seats.entries()) {
-        if (byParticipant.has(seat.participant_id)) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "participant_id"],
-            message: "participant_id must be unique within the room"
-          });
-        }
-        byParticipant.set(seat.participant_id, seat);
-        if (room.anonymous && seat.alias === void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "alias"],
-            message: "anonymous rooms require an alias on every seat"
-          });
-        }
-        if (!room.anonymous && seat.alias !== void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "alias"],
-            message: "aliases are reserved for anonymous rooms"
-          });
-        }
-        if (seat.state === "active" && seat.alias !== void 0) {
-          if (activeAliases.has(seat.alias)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: ["seats", index, "alias"],
-              message: "active seats must hold distinct aliases"
-            });
-          }
-          activeAliases.add(seat.alias);
-        }
-        if (seat.removed_epoch !== void 0 && seat.removed_epoch > room.membership_epoch) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "removed_epoch"],
-            message: "removed_epoch cannot exceed the room membership_epoch"
-          });
-        }
+      async send(contactCid, body) {
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::a2a_messaging::send_message",
+            { contact: contactCid, text: body },
+            lifetime
+          );
+          const refused = !result.Reduce("downgrade_refused").IsNil();
+          return refused ? { status: "send_failed" } : { status: "queued", wire_id: nilString(result.Reduce("wire_id")) || void 0 };
+        });
       }
-      for (const [index, seat] of room.seats.entries()) {
-        if (seat.replaces_seat === void 0) continue;
-        const predecessor = byParticipant.get(seat.replaces_seat);
-        if (!predecessor || predecessor === seat || predecessor.state !== "removed") {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "replaces_seat"],
-            message: "replaces_seat must reference a removed seat in this room"
-          });
-          continue;
-        }
-        if (predecessor.role !== seat.role) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "role"],
-            message: "a replacement seat must inherit the predecessor role"
-          });
-        }
-        if (room.anonymous && seat.alias !== predecessor.alias) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "alias"],
-            message: "an anonymous replacement seat must inherit the predecessor alias"
-          });
+      async sendFile(contactCid, filename, mime, data) {
+        const validName = FileNameSchema.parse(filename);
+        const validMime = FileMimeSchema.parse(mime);
+        if (data.length > MAX_FILE_BYTES) {
+          throw new RangeError(`room files must be at most ${MAX_FILE_BYTES} bytes (2 MiB)`);
         }
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::a2a_messaging::send_file",
+            {
+              contact: contactCid,
+              filename: validName,
+              mime: validMime,
+              // The core contract takes bytes. A filesystem path here would make
+              // recovery depend on staging ownership and is deliberately forbidden.
+              data: this.packet.newBinary(data, lifetime)
+            },
+            lifetime
+          );
+          const refused = !result.Reduce("downgrade_refused").IsNil() || !result.Reduce("migrating").IsNil();
+          return refused ? { status: "send_failed" } : { status: "queued", wire_id: nilString(result.Reduce("wire_id")) || void 0 };
+        });
       }
-    });
-    CreateRoomInputSchema = external_exports.object({
-      goal: MissionTextSchema,
-      briefing: MissionTextSchema,
-      anonymous: external_exports.boolean().optional(),
-      quiet_membership: external_exports.boolean().optional()
-    }).strict();
-    UpdateRoomInputSchema = external_exports.object({
-      goal: MissionTextSchema.optional(),
-      briefing: MissionTextSchema.optional(),
-      status: NonEmptyStringSchema.optional(),
-      quiet_membership: external_exports.boolean().optional()
-    }).strict().refine((input) => Object.keys(input).length > 0, "at least one setting is required");
-    RoleBriefingSetInputSchema = external_exports.object({
-      role: RoleSchema,
-      text: MissionTextSchema
-    }).strict();
-    RoleBriefingDeleteInputSchema = external_exports.object({
-      role: RoleSchema
-    }).strict();
-    PostMessageInputSchema = external_exports.object({
-      text: MessageTextSchema
-    }).strict();
-    AuthorSnapshotSchema = external_exports.object({
-      identity: NonEmptyStringSchema,
-      display_name: NonEmptyStringSchema,
-      role: RoleSchema
-    }).strict();
-    RecordCommonShape = {
-      version: external_exports.literal(1),
-      room_id: LowerCrockfordUlidSchema,
-      seq: PositiveSafeIntegerSchema,
-      record_id: NonEmptyStringSchema,
-      at: Rfc3339Schema
-    };
-    AppendCommonShape = {
-      version: external_exports.literal(1),
-      room_id: LowerCrockfordUlidSchema,
-      at: Rfc3339Schema
-    };
-    MembershipNoticeSchema = external_exports.object({
-      action: external_exports.enum(["remove"]),
-      alias: NonEmptyStringSchema.optional(),
-      role: RoleSchema.optional(),
-      epoch: external_exports.number().int().nonnegative().safe()
-    }).strict();
-    AuthorAliasSchema = external_exports.object({
-      participant_id: LowerCrockfordUlidSchema,
-      alias: NonEmptyStringSchema
-    }).strict();
-    MessageShape = {
-      kind: external_exports.literal("message"),
-      message_id: LowerCrockfordUlidSchema,
-      author: AuthorSnapshotSchema,
-      author_alias: AuthorAliasSchema.optional(),
-      category: external_exports.enum(["briefing", "role_briefing", "chat", "membership"]),
-      briefing_role: RoleSchema.optional(),
-      briefing_version: PositiveSafeIntegerSchema.optional(),
-      membership: MembershipNoticeSchema.optional(),
-      text: MessageTextSchema,
-      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
-        const seen = /* @__PURE__ */ new Set();
-        for (const [index, identity] of identities.entries()) {
-          if (seen.has(identity)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [index],
-              message: "recipient identities must be unique"
-            });
+      async removeContact(contactCid) {
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::a2a_messaging::remove_contact",
+            { contact: contactCid },
+            lifetime
+          );
+          const notified = strictBooleanValue(result.Reduce("notified"), "remove_contact notified");
+          const keyMaterialRetained = strictBooleanValue(
+            result.Reduce("key_material_retained"),
+            "remove_contact key_material_retained"
+          );
+          if (!keyMaterialRetained) {
+            throw new Error("remove_contact key_material_retained must be true");
           }
-          seen.add(identity);
-        }
-      }),
-      source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
-      source_wire_id: NonEmptyStringSchema.optional()
-    };
-    RelayIntentShape = {
-      kind: external_exports.literal("relay_intent"),
-      message_id: LowerCrockfordUlidSchema,
-      recipient_identity: NonEmptyStringSchema
-    };
-    RelayResultStatusSchema = external_exports.enum(["queued", "send_failed", "skipped_removed"]);
-    RelayResultShape = {
-      kind: external_exports.literal("relay_result"),
-      intent_record_id: NonEmptyStringSchema,
-      message_id: LowerCrockfordUlidSchema,
-      recipient_identity: NonEmptyStringSchema,
-      status: RelayResultStatusSchema,
-      wire_id: NonEmptyStringSchema.optional()
-    };
-    MembershipIntentShape = {
-      kind: external_exports.literal("membership_intent"),
-      action: external_exports.enum(["remove"]),
-      participant_id: LowerCrockfordUlidSchema,
-      recipient_identity: NonEmptyStringSchema,
-      role: RoleSchema,
-      alias: NonEmptyStringSchema.optional(),
-      epoch: PositiveSafeIntegerSchema,
-      notify: external_exports.boolean()
-    };
-    MembershipResultShape = {
-      kind: external_exports.literal("membership_result"),
-      intent_record_id: NonEmptyStringSchema,
-      participant_id: LowerCrockfordUlidSchema,
-      status: RelayStatusSchema,
-      notified: external_exports.boolean(),
-      key_material_retained: external_exports.literal(true),
-      uncertain_after_restart: external_exports.literal(true).optional()
-    };
-    CloseNoticeIntentShape = {
-      kind: external_exports.literal("close_notice_intent"),
-      recipient_identity: NonEmptyStringSchema
-    };
-    CloseNoticeResultShape = {
-      kind: external_exports.literal("close_notice_result"),
-      intent_record_id: NonEmptyStringSchema,
-      recipient_identity: NonEmptyStringSchema,
-      status: RelayStatusSchema,
-      notified: external_exports.boolean(),
-      key_material_retained: external_exports.literal(true),
-      uncertain_after_restart: external_exports.literal(true).optional()
-    };
-    MessageRecordSchema = external_exports.object({ ...RecordCommonShape, ...MessageShape }).strict();
-    RelayIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayIntentShape }).strict();
-    RelayResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayResultShape }).strict();
-    MembershipIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipIntentShape }).strict();
-    MembershipResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipResultShape }).strict();
-    CloseNoticeIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeIntentShape }).strict();
-    CloseNoticeResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeResultShape }).strict();
-    RawCommunicationRecordSchema = external_exports.discriminatedUnion("kind", [
-      MessageRecordSchema,
-      RelayIntentRecordSchema,
-      RelayResultRecordSchema,
-      MembershipIntentRecordSchema,
-      MembershipResultRecordSchema,
-      CloseNoticeIntentRecordSchema,
-      CloseNoticeResultRecordSchema
-    ]);
-    CommunicationRecordSchema = RawCommunicationRecordSchema.superRefine((record, context) => {
-      if (record.record_id !== `${record.room_id}:${record.seq}`) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["record_id"],
-          message: 'record_id must equal room_id + ":" + seq'
+          return {
+            status: notified ? "queued" : "send_failed",
+            notified,
+            key_material_retained: true
+          };
         });
       }
-      if (record.kind === "message") refineMessageCategory(record, context);
-    });
-    AppendRecordSchema = external_exports.discriminatedUnion("kind", [
-      external_exports.object({ ...AppendCommonShape, ...MessageShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...RelayIntentShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...RelayResultShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...MembershipIntentShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...MembershipResultShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...CloseNoticeIntentShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...CloseNoticeResultShape }).strict()
-    ]).superRefine((record, context) => {
-      if (record.kind === "message") refineMessageCategory(record, context);
-    });
+      async sign(canonicalJson2) {
+        return withScopeAsync(async (lifetime) => {
+          const result = await this.packet.mutatingTx(
+            "::actor::sign_app_envelope",
+            { canonical_json: canonicalJson2 },
+            lifetime
+          );
+          return Buffer.from(result.Reduce("signature").GetBinary()).toString("base64url");
+        });
+      }
+    };
   }
 });
 
@@ -6037,11 +6170,16 @@ var init_ulid = __esm({
 });
 
 // src/intake.ts
+import { createHash as createHash2 } from "node:crypto";
 function canonicalJson(value) {
   const encoded = JSON.stringify(canonicalValue(value));
   if (encoded === void 0) throw new TypeError("canonical JSON value is not serializable");
   return encoded;
 }
+async function sendSignedBody(packet, recipientIdentity, unsigned) {
+  const signature = await packet.sign(canonicalJson(unsigned));
+  return packet.send(recipientIdentity, canonicalJson({ ...unsigned, signature }));
+}
 function canonicalValue(value) {
   if (Array.isArray(value)) return value.map(canonicalValue);
   if (value !== null && typeof value === "object") {
@@ -6155,9 +6293,58 @@ var init_intake = __esm({
       async processAndRelayUnlocked(roomId, packet) {
         const snapshot = packet.peekInbox();
         for (const item of snapshot) await this.processInboxItem(roomId, packet, item);
+        const fileSnapshot = packet.peekFileInbox();
+        for (const item of fileSnapshot) await this.processFileInboxItem(roomId, packet, item);
         await this.completeSnapshotIntents(roomId);
         await this.relayPendingUnlocked(roomId, packet);
       }
+      async processFileInboxItem(roomId, packet, item) {
+        const parsedName = FileNameSchema.safeParse(item.filename);
+        const parsedMime = FileMimeSchema.safeParse(item.mime);
+        if (!parsedName.success || !parsedMime.success) {
+          await packet.consumeFileInbox([item.file_id]);
+          return;
+        }
+        if (item.data.length > MAX_FILE_BYTES) {
+          throw new RangeError(`room files must be at most ${MAX_FILE_BYTES} bytes (2 MiB)`);
+        }
+        const room = await this.store.load(roomId);
+        const seat = room.seats.find(
+          (candidate) => candidate.identity === item.sender_id && candidate.state === "active"
+        );
+        if (room.state !== "active" || !seat) {
+          if (room.state === "active") await this.bounceRemovedSender(roomId, room, packet, item);
+          await packet.consumeFileInbox([item.file_id]);
+          return;
+        }
+        const records = await this.store.read(roomId);
+        let file = this.findSourceFile(records, item);
+        if (!file) {
+          const recipientIdentities = unique(room.seats.filter((recipient) => recipient.state === "active").map((recipient) => recipient.identity).filter((identity) => identity !== seat.identity));
+          const bytes = Buffer.from(item.data);
+          const appended = await this.store.append(roomId, {
+            version: 1,
+            kind: "file",
+            room_id: roomId,
+            at: Rfc3339Schema.parse(item.date),
+            file_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
+            author: { identity: seat.identity, display_name: seat.display_name, role: seat.role },
+            ...room.anonymous && seat.alias !== void 0 ? { author_alias: { participant_id: seat.participant_id, alias: seat.alias } } : {},
+            filename: parsedName.data,
+            mime: parsedMime.data,
+            size: bytes.length,
+            sha256: createHash2("sha256").update(bytes).digest("hex"),
+            data_base64: bytes.toString("base64"),
+            recipient_identities: recipientIdentities,
+            source_file_id: item.file_id,
+            ...item.wire_id === "" ? {} : { source_wire_id: item.wire_id }
+          });
+          if (appended.kind !== "file") throw new Error("storage returned the wrong participant file kind");
+          file = appended;
+        }
+        await this.completeFileIntents(roomId, file);
+        await packet.consumeFileInbox([item.file_id]);
+      }
       async processInboxItem(roomId, packet, item) {
         const room = await this.store.load(roomId);
         const seat = room.seats.find(
@@ -6215,8 +6402,7 @@ var init_intake = __esm({
         await this.store.save(RoomSchema.parse({ ...room, seats }));
         try {
           const unsigned = { version: 1, kind: "room_not_member", room_id: roomId };
-          const signature = await packet.sign(canonicalJson(unsigned));
-          await packet.send(item.sender_id, canonicalJson({ ...unsigned, signature }));
+          await sendSignedBody(packet, item.sender_id, unsigned);
         } catch {
         }
       }
@@ -6225,6 +6411,25 @@ var init_intake = __esm({
         for (const message of records.filter(
           (record) => record.kind === "message"
         )) await this.completeMessageIntents(roomId, message);
+        for (const file of records.filter(
+          (record) => record.kind === "file"
+        )) await this.completeFileIntents(roomId, file);
+      }
+      async completeFileIntents(roomId, file) {
+        const records = await this.store.read(roomId);
+        const intended = new Set(records.filter((record) => record.kind === "relay_intent" && record.file_id === file.file_id).map((intent) => intent.recipient_identity));
+        for (const recipientIdentity of file.recipient_identities) {
+          if (intended.has(recipientIdentity)) continue;
+          await this.store.append(roomId, {
+            version: 1,
+            kind: "relay_intent",
+            room_id: roomId,
+            at: this.now(),
+            file_id: file.file_id,
+            recipient_identity: recipientIdentity
+          });
+          intended.add(recipientIdentity);
+        }
       }
       async completeMessageIntents(roomId, message) {
         const records = await this.store.read(roomId);
@@ -6248,14 +6453,17 @@ var init_intake = __esm({
         const activeCids = new Set(room.seats.filter((seat) => seat.state === "active").map((seat) => seat.identity));
         const removedCids = new Set(room.seats.filter((seat) => seat.state === "removed").map((seat) => seat.identity));
         const messages = new Map(records.filter((record) => record.kind === "message").map((message) => [message.message_id, message]));
+        const files = new Map(records.filter((record) => record.kind === "file").map((file) => [file.file_id, file]));
         const completed = new Set(records.filter((record) => record.kind === "relay_result").map((result) => result.kind === "relay_result" ? result.intent_record_id : ""));
         for (const intent of records.filter(
           (record) => record.kind === "relay_intent"
         )) {
           if (completed.has(intent.record_id)) continue;
-          const message = messages.get(intent.message_id);
-          if (!message) continue;
-          if (!message.recipient_identities.includes(intent.recipient_identity)) continue;
+          const message = intent.message_id === void 0 ? void 0 : messages.get(intent.message_id);
+          const file = intent.file_id === void 0 ? void 0 : files.get(intent.file_id);
+          if (message === void 0 === (file === void 0)) continue;
+          const recipients = message?.recipient_identities ?? file.recipient_identities;
+          if (!recipients.includes(intent.recipient_identity)) continue;
           if (!activeCids.has(intent.recipient_identity) && removedCids.has(intent.recipient_identity)) {
             const skipped = await this.store.append(roomId, {
               version: 1,
@@ -6263,7 +6471,8 @@ var init_intake = __esm({
               room_id: roomId,
               at: this.now(),
               intent_record_id: intent.record_id,
-              message_id: intent.message_id,
+              ...intent.message_id === void 0 ? {} : { message_id: intent.message_id },
+              ...intent.file_id === void 0 ? {} : { file_id: intent.file_id },
               recipient_identity: intent.recipient_identity,
               status: "skipped_removed"
             });
@@ -6271,6 +6480,61 @@ var init_intake = __esm({
             completed.add(intent.record_id);
             continue;
           }
+          if (file !== void 0) {
+            const author = file.author_alias === void 0 ? file.author : {
+              identity: file.author_alias.participant_id,
+              display_name: file.author_alias.alias,
+              role: file.author.role
+            };
+            const metadata = await sendSignedBody(packet, intent.recipient_identity, {
+              version: 1,
+              kind: "room_file",
+              room_id: roomId,
+              file_id: file.file_id,
+              author,
+              filename: file.filename,
+              mime: file.mime,
+              size: file.size,
+              sha256: file.sha256,
+              at: file.at
+            });
+            if (metadata.status === "send_failed") {
+              const failed = await this.store.append(roomId, {
+                version: 1,
+                kind: "relay_result",
+                room_id: roomId,
+                at: this.now(),
+                intent_record_id: intent.record_id,
+                file_id: file.file_id,
+                recipient_identity: intent.recipient_identity,
+                status: "send_failed"
+              });
+              if (failed.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
+              completed.add(intent.record_id);
+              continue;
+            }
+            const outcome2 = await packet.sendFile(
+              intent.recipient_identity,
+              file.filename,
+              file.mime,
+              Buffer.from(file.data_base64, "base64")
+            );
+            const appended2 = await this.store.append(roomId, {
+              version: 1,
+              kind: "relay_result",
+              room_id: roomId,
+              at: this.now(),
+              intent_record_id: intent.record_id,
+              file_id: file.file_id,
+              recipient_identity: intent.recipient_identity,
+              status: outcome2.status,
+              ...outcome2.wire_id === void 0 || outcome2.wire_id === "" ? {} : { wire_id: outcome2.wire_id },
+              ...metadata.wire_id === void 0 || metadata.wire_id === "" ? {} : { metadata_wire_id: metadata.wire_id }
+            });
+            if (appended2.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
+            completed.add(intent.record_id);
+            continue;
+          }
           const unsigned = {
             version: 1,
             kind: wireKind(message.category),
@@ -6288,9 +6552,7 @@ var init_intake = __esm({
             ...message.briefing_version === void 0 ? {} : { briefing_version: message.briefing_version },
             ...message.membership === void 0 ? {} : { membership: message.membership }
           };
-          const signature = await packet.sign(canonicalJson(unsigned));
-          const body = canonicalJson({ ...unsigned, signature });
-          const outcome = await packet.send(intent.recipient_identity, body);
+          const outcome = await sendSignedBody(packet, intent.recipient_identity, unsigned);
           const appended = await this.store.append(roomId, {
             version: 1,
             kind: "relay_result",
@@ -6315,6 +6577,16 @@ var init_intake = __esm({
         }
         return message;
       }
+      findSourceFile(records, item) {
+        const file = records.find((record) => record.kind === "file" && record.source_file_id === item.file_id);
+        if (!file) return void 0;
+        const observedWireId = item.wire_id === "" ? void 0 : item.wire_id;
+        const bytes = Buffer.from(item.data);
+        if (file.source_wire_id !== observedWireId || file.author.identity !== item.sender_id || file.filename !== item.filename || file.mime !== item.mime || file.at !== item.date || file.size !== bytes.length || file.data_base64 !== bytes.toString("base64")) {
+          throw new Error(`file inbox source ${item.file_id} does not match its durable room file`);
+        }
+        return file;
+      }
       lock(roomId, work) {
         return this.store.mutex(roomId).runExclusive(work);
       }
@@ -6331,6 +6603,23 @@ var init_intake = __esm({
 });
 
 // src/service.ts
+function byteBoundedHistoryPage(records) {
+  const page = [];
+  let bytes = 2;
+  for (const record of records) {
+    const encoded = JSON.stringify(record);
+    const nextBytes = Buffer.byteLength(encoded, "utf8") + (page.length === 0 ? 0 : 1);
+    if (bytes + nextBytes > MAX_HISTORY_PAGE_BYTES) {
+      if (page.length === 0) {
+        throw new RangeError(`one history record exceeds the ${MAX_HISTORY_PAGE_BYTES}-byte page contract`);
+      }
+      break;
+    }
+    page.push(record);
+    bytes += nextBytes;
+  }
+  return page;
+}
 function activeSeats(room) {
   return room.seats.filter((seat) => seat.state === "active");
 }
@@ -6982,9 +7271,9 @@ var init_service = __esm({
       async history(roomId, options = {}) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
         const { view, ...page } = HistoryOptionsSchema.parse(options);
-        const records = await this.store.read(id, page);
-        if (view !== "participant") return records;
-        return records.filter((record) => record.kind === "message").map((record) => {
+        const records = await this.store.read(id, view === "participant" ? { after: page.after } : page);
+        if (view !== "participant") return byteBoundedHistoryPage(records);
+        const projected = records.filter((record) => record.kind === "message").map((record) => {
           const {
             author_alias,
             recipient_identities: _recipients,
@@ -7001,6 +7290,7 @@ var init_service = __esm({
             }
           };
         });
+        return byteBoundedHistoryPage(projected.slice(0, page.limit ?? Number.MAX_SAFE_INTEGER));
       }
       /**
        * Forward-only close. Every external contact mutation is preceded by a
@@ -7304,7 +7594,7 @@ var init_service = __esm({
         const matching = records.filter((record) => record.kind === "message" && record.category === briefing.category && record.briefing_role === briefing.briefing_role && (record.briefing_version ?? 1) === briefing.briefing_version);
         const intentsByMessage = /* @__PURE__ */ new Map();
         for (const record of records) {
-          if (record.kind !== "relay_intent") continue;
+          if (record.kind !== "relay_intent" || record.message_id === void 0) continue;
           const intents = intentsByMessage.get(record.message_id) ?? /* @__PURE__ */ new Set();
           intents.add(record.recipient_identity);
           intentsByMessage.set(record.message_id, intents);
@@ -8915,6 +9205,7 @@ __export(daemon_runtime_exports, {
   DaemonShutdownError: () => DaemonShutdownError,
   acquireDaemonLock: () => acquireDaemonLock,
   createDaemonControlRoutes: () => createDaemonControlRoutes,
+  isIntakeNotification: () => isIntakeNotification,
   loadConfig: () => loadConfig,
   removeDaemonPid: () => removeDaemonPid,
   writeDaemonPid: () => writeDaemonPid
@@ -8922,6 +9213,9 @@ __export(daemon_runtime_exports, {
 import * as nodeFs6 from "node:fs";
 import { join as join7 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
+function isIntakeNotification(event) {
+  return event === "message_received" || event === "file_received" || event === "contact_accepted";
+}
 function createDaemonControlRoutes(control) {
   if (!/^[0-9a-f]{32}$/.test(control.session)) throw new TypeError("invalid daemon control session");
   const requireExact = (params, keys) => {
@@ -9204,7 +9498,7 @@ var init_daemon_runtime = __esm({
             {
               log: this.options.log,
               onNotify: (roomId, event) => {
-                if (event === "message_received" || event === "contact_accepted") {
+                if (isIntakeNotification(event)) {
                   this.handleNotification(roomId, event, serviceRef);
                 }
               }