@ours.network/cowork 1.0.1 → 1.0.3

package/dist/daemon.js

@@ -4116,1181 +4116,1149 @@ var init_zod = __esm({
   }
 });
 
-// src/contracts.ts
-import { createHash } from "node:crypto";
-function utf8Bounded(label, maximumBytes) {
-  return external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") >= 1, `${label} must be at least 1 UTF-8 byte`).refine(
-    (value) => Buffer.byteLength(value, "utf8") <= maximumBytes,
-    `${label} must be at most ${maximumBytes} UTF-8 bytes`
-  );
-}
-function isStrictRfc3339(value) {
-  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
-  if (!match) return false;
-  const [, yearText, monthText, dayText, hourText, minuteText, secondText, offsetHourText, offsetMinuteText] = match;
-  const year = Number(yearText);
-  const month = Number(monthText);
-  const day = Number(dayText);
-  const hour = Number(hourText);
-  const minute = Number(minuteText);
-  const second = Number(secondText);
-  const offsetHour = offsetHourText === void 0 ? 0 : Number(offsetHourText);
-  const offsetMinute = offsetMinuteText === void 0 ? 0 : Number(offsetMinuteText);
-  if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59) return false;
-  if (offsetHour > 23 || offsetMinute > 59) return false;
-  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
-  const days = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-  return day >= 1 && day <= days[month - 1];
+// src/config.ts
+import * as nodeFs from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, parse, resolve } from "node:path";
+function defaultConfig(home = homedir()) {
+  return {
+    version: 1,
+    stateDir: resolve(home, ".ours-cowork"),
+    rest: { enabled: true, port: 3052 }
+  };
 }
-function normalizeRoomName(value) {
-  return value.trim().normalize("NFC");
+function loadConfig(env = process.env, io = {}) {
+  rejectRemovedEnvironment(env);
+  const fs2 = io.fs ?? nodeFs;
+  const defaults = defaultConfig(io.home);
+  const configPath = resolve(env.OURS_COWORK_CONFIG ?? join(io.home ?? homedir(), ".ours-cowork", "config.json"));
+  let file = defaults;
+  const stat = lstatIfPresent(fs2, configPath);
+  if (stat) {
+    assertSecureFile(fs2, configPath, "config file");
+    let parsed;
+    try {
+      parsed = JSON.parse(readSecureFile(fs2, configPath, "config file").toString("utf8"));
+    } catch (error) {
+      throw new CoworkConfigError(`malformed cowork config at ${configPath}`, { cause: error });
+    }
+    rejectRemovedConfig(parsed, configPath);
+    try {
+      file = CoworkConfigSchema.parse(parsed);
+    } catch (error) {
+      throw new CoworkConfigError(`invalid cowork config at ${configPath}`, { cause: error });
+    }
+  } else if (env.OURS_COWORK_CONFIG !== void 0) {
+    throw new CoworkConfigError(`configured cowork config does not exist: ${configPath}`);
+  }
+  const restPort = env.OURS_COWORK_REST_PORT === void 0 ? void 0 : parsePort(env.OURS_COWORK_REST_PORT);
+  try {
+    return CoworkConfigSchema.parse({
+      version: 1,
+      stateDir: resolve(env.OURS_COWORK_STATE_DIR ?? file.stateDir),
+      rest: {
+        enabled: restPort === void 0 ? file.rest.enabled : true,
+        port: restPort ?? file.rest.port
+      }
+    });
+  } catch (error) {
+    throw new CoworkConfigError("invalid effective cowork config", { cause: error });
+  }
 }
-function roomIdentityName(roomId) {
-  return `${ROOM_IDENTITY_PREFIX}${LowerCrockfordUlidSchema.parse(roomId)}`;
+function rejectRemovedEnvironment(env) {
+  const removed = [
+    "OURS_COWORK_BROKER_URL",
+    "OURS_COWORK_DAEMON_MODE",
+    "OURS_COWORK_DAEMON_ENDPOINT",
+    "OURS_COWORK_DAEMON_STATE_DIR"
+  ].filter((name) => env[name] !== void 0);
+  if (removed.length === 0) return;
+  throw new CoworkConfigError(
+    `${removed.join(", ")} ${removed.length === 1 ? "was" : "were"} removed: ours-cowork now attaches only to the shared ours daemon. Configure that daemon with @ours.network/cli and select it through the standard OURS_CONFIG, OURS_PORT, and OURS_STATE_DIR inputs.`
+  );
 }
-function roomIdentitySlug(roomName) {
-  const normalized = RoomNameSchema.parse(roomName).normalize("NFKD").replace(new RegExp("\\p{M}+", "gu"), "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  const bounded = normalized.slice(0, MAX_FRIENDLY_IDENTITY_SLUG_CHARACTERS).replace(/-+$/g, "");
-  return bounded || "room";
+function rejectRemovedConfig(value, path) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+  const removed = ["brokerUrl", "daemon"].filter((key) => Object.hasOwn(value, key));
+  if (removed.length === 0) return;
+  throw new CoworkConfigError(
+    `cowork config at ${path} contains removed ${removed.join(" and ")} ${removed.length === 1 ? "key" : "keys"}: ours-cowork now attaches only to the shared ours daemon. Remove those keys and configure the daemon with @ours.network/cli.`
+  );
 }
-function friendlyRoomIdentityName(roomId, roomName) {
-  const id = LowerCrockfordUlidSchema.parse(roomId);
-  const name = `${ROOM_IDENTITY_PREFIX}${roomIdentitySlug(roomName)}-${id}`;
-  if (name.length > MAX_ROOM_IDENTITY_NAME_CHARACTERS || !SDK_IDENTITY_NAME_PATTERN.test(name)) {
-    throw new TypeError("generated room identity name violates the shared ours daemon contract");
+function ensureRuntimeState(config, io = {}) {
+  const parsed = CoworkConfigSchema.parse(config);
+  const fs2 = io.fs ?? nodeFs;
+  const stateDir = resolve(parsed.stateDir);
+  assertSecureAncestors(fs2, stateDir, "state directory");
+  const existing = lstatIfPresent(fs2, stateDir);
+  if (!existing) {
+    createSecureDirectoryTree(fs2, stateDir, "state directory");
   }
-  return name;
-}
-function configuredRoomIdentityName(roomId, roomName, mode) {
-  return mode === "friendly" ? friendlyRoomIdentityName(roomId, roomName) : roomIdentityName(roomId);
+  assertSecureDirectory(fs2, stateDir, "state directory");
+  const roomsPath = join(stateDir, "rooms");
+  const rooms = lstatIfPresent(fs2, roomsPath);
+  if (!rooms) {
+    fs2.mkdirSync(roomsPath, { mode: DIRECTORY_MODE });
+    secureOpenedDirectory(fs2, roomsPath, "rooms directory");
+    fsyncDirectory(fs2, stateDir);
+  }
+  assertSecureDirectory(fs2, roomsPath, "rooms directory");
+  return {
+    socketPath: join(stateDir, "management.sock"),
+    pidPath: join(stateDir, "daemon.pid"),
+    lockPath: join(stateDir, "daemon.lock")
+  };
 }
-function legacyRoomIdentityName(roomId) {
-  return `cowork-room-${LowerCrockfordUlidSchema.parse(roomId)}`;
+function parsePort(value) {
+  if (!/^[1-9][0-9]{0,4}$/.test(value)) {
+    throw new CoworkConfigError("OURS_COWORK_REST_PORT must be a decimal port from 1 to 65535");
+  }
+  const port = Number(value);
+  if (port > 65535) throw new CoworkConfigError("OURS_COWORK_REST_PORT must be from 1 to 65535");
+  return port;
 }
-function isPersistedRoomIdentityName(roomId, identityName) {
-  const id = LowerCrockfordUlidSchema.safeParse(roomId);
-  if (!id.success) return false;
-  if (identityName === roomIdentityName(id.data) || identityName === legacyRoomIdentityName(id.data)) return true;
-  const suffix = `-${id.data}`;
-  if (!identityName.startsWith(ROOM_IDENTITY_PREFIX) || !identityName.endsWith(suffix)) return false;
-  const slug = identityName.slice(ROOM_IDENTITY_PREFIX.length, -suffix.length);
-  return slug.length >= 1 && slug.length <= MAX_FRIENDLY_IDENTITY_SLUG_CHARACTERS && FRIENDLY_SLUG_PATTERN.test(slug) && identityName.length <= MAX_ROOM_IDENTITY_NAME_CHARACTERS && SDK_IDENTITY_NAME_PATTERN.test(identityName);
+function assertSecureAncestors(fs2, path, label) {
+  const absolute = isAbsolute(path) ? path : resolve(path);
+  const root = parse(absolute).root;
+  const rootOwner = fs2.lstatSync(root).uid;
+  let cursor = root;
+  const components = absolute.slice(root.length).split("/").filter(Boolean);
+  for (const [index, component] of components.entries()) {
+    cursor = join(cursor, component);
+    const stat = lstatIfPresent(fs2, cursor);
+    if (stat?.isSymbolicLink()) throw new CoworkConfigError(`${label} must not traverse a symbolic link (symlink): ${cursor}`);
+    if (!stat) break;
+    if (!stat.isDirectory()) {
+      if (index === components.length - 1) return;
+      throw new CoworkConfigError(`${label} ancestor is not a directory: ${cursor}`);
+    }
+    if (index < components.length - 1) assertTrustedAncestor(stat, rootOwner, cursor, label);
+  }
 }
-function isStandardRoomIdentityName(roomId, identityName) {
-  return isPersistedRoomIdentityName(roomId, identityName) && identityName !== legacyRoomIdentityName(roomId);
+function assertTrustedAncestor(stat, rootOwner, path, label) {
+  const uid = typeof process.getuid === "function" ? process.getuid() : stat.uid;
+  const trustedStickyDirectory = (stat.mode & 512) !== 0;
+  const writableByOthers = (stat.mode & 18) !== 0;
+  const trustedOwner = stat.uid === uid || stat.uid === 0 || stat.uid === rootOwner;
+  if (writableByOthers && (!trustedStickyDirectory || !trustedOwner)) {
+    throw new CoworkConfigError(`${label} has an unsafe writable ancestor: ${path}`);
+  }
 }
-function refineRoomLineage(room, context) {
-  const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && isPersistedRoomIdentityName(room.room_id, room.identity_name) && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
-  if (room.identity_cid === "" && !exactPacketPending) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["identity_cid"],
-      message: "empty identity_cid is reserved for the exact packet_pending provisioning sentinel"
-    });
+function createSecureDirectoryTree(fs2, path, label) {
+  const missing = [];
+  let cursor = path;
+  while (!lstatIfPresent(fs2, cursor)) {
+    missing.push(cursor);
+    const parent = dirname(cursor);
+    if (parent === cursor) throw new CoworkConfigError(`cannot locate an existing ancestor for ${label}`);
+    cursor = parent;
   }
-  if (room.identity_cid !== "" && room.status === "packet_pending") {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["status"],
-      message: "packet_pending status requires an empty identity_cid"
-    });
+  assertSecureAncestors(fs2, path, label);
+  for (const directory of missing.reverse()) {
+    fs2.mkdirSync(directory, { mode: DIRECTORY_MODE });
+    secureOpenedDirectory(fs2, directory, label);
+    fsyncDirectory(fs2, dirname(directory));
   }
-  const pendingByRecovery = /* @__PURE__ */ new Map();
-  for (const [index, invite] of room.invites.entries()) {
-    if (invite.recovery_of === void 0) continue;
-    const recoveryOf = invite.recovery_of;
-    const source = room.invites.find((candidate) => candidate.invite_id === recoveryOf);
-    const validSourceState = invite.state === "receipt_pending" ? source?.state === "replacement_required" : invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required" ? source?.state === "revoked" : invite.state === "revoked" ? invite.recovery_confirmed === true ? source?.state === "revoked" : source?.state === "replacement_required" || source?.state === "revoked" : false;
-    if (!source || source.invite_id === invite.invite_id || !validSourceState) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["invites", index, "recovery_of"],
-        message: "recovery_of must point to a source invite in the state required by this recovery lineage"
-      });
-    } else if (invite.mode !== source.mode || invite.role !== source.role || invite.min_accepts !== source.min_accepts) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["invites", index],
-        message: "receipt_pending descriptor must copy source mode, role, and min_accepts"
-      });
-    }
-    if (invite.state === "receipt_pending") {
-      const count = (pendingByRecovery.get(recoveryOf) ?? 0) + 1;
-      pendingByRecovery.set(recoveryOf, count);
-      if (count > 1) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["invites", index, "recovery_of"],
-          message: "only one receipt_pending invite may exist per recovery_of pointer"
-        });
-      }
+}
+function secureOpenedDirectory(fs2, path, label) {
+  let fd;
+  try {
+    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
+    const opened = fs2.fstatSync(fd);
+    const current = fs2.lstatSync(path);
+    if (!opened.isDirectory() || current.isSymbolicLink() || opened.dev !== current.dev || opened.ino !== current.ino) {
+      throw new CoworkConfigError(`${label} changed while opening`);
     }
+    fs2.fchmodSync(fd, DIRECTORY_MODE);
+    fs2.fsyncSync(fd);
+  } finally {
+    if (fd !== void 0) fs2.closeSync(fd);
   }
 }
-function defaultRoomName(roomId) {
-  return `Room ${LowerCrockfordUlidSchema.parse(roomId).slice(0, 8)}`;
-}
-function migrateRoomV1(room, mintParticipantId) {
-  return RoomSchema.parse({
-    ...room,
-    version: 2,
-    mission: { ...room.mission, briefing_version: 1 },
-    role_briefings: {},
-    rest_roles: [],
-    anonymous: false,
-    quiet_membership: false,
-    membership_epoch: 0,
-    seats: room.seats.map((seat) => ({
-      ...seat,
-      participant_id: LowerCrockfordUlidSchema.parse(mintParticipantId()),
-      state: "active"
-    }))
-  });
-}
-function refineRelaySubject(record, context) {
-  if (record.kind !== "relay_intent" && record.kind !== "relay_result") return;
-  if (record.message_id === void 0 === (record.file_id === void 0)) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["message_id"],
-      message: "relay records require exactly one of message_id or file_id"
-    });
+function assertSecureDirectory(fs2, path, label) {
+  const stat = fs2.lstatSync(path);
+  if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
+  if (!stat.isDirectory()) throw new CoworkConfigError(`${label} must be a directory`);
+  if ((stat.mode & 511) !== DIRECTORY_MODE) {
+    throw new CoworkConfigError(`${label} mode must be 0700`);
   }
+  assertOwner(stat, label);
 }
-function refineFileRecord(record, context) {
-  if (record.kind !== "file" || record.data_base64 === void 0) return;
-  const bytes = Buffer.from(record.data_base64, "base64");
-  if (bytes.toString("base64") !== record.data_base64) {
-    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["data_base64"], message: "file bytes must use canonical base64" });
-  }
-  if (bytes.length !== record.size) {
-    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["size"], message: "file size must match decoded bytes" });
-  }
-  const digest = createHash("sha256").update(bytes).digest("hex");
-  if (digest !== record.sha256) {
-    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["sha256"], message: "file sha256 must match decoded bytes" });
+function assertSecureFile(fs2, path, label) {
+  const stat = fs2.lstatSync(path);
+  if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
+  if (!stat.isFile() || stat.nlink !== 1) throw new CoworkConfigError(`${label} must be a single-link regular file`);
+  if ((stat.mode & 511) !== FILE_MODE) throw new CoworkConfigError(`${label} mode must be 0600`);
+  assertOwner(stat, label);
+}
+function assertOwner(stat, label) {
+  if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
+    throw new CoworkConfigError(`${label} must be owned by the current user`);
   }
 }
-function refineMessageCategory(message, context) {
-  const requires = (field, present) => {
-    if (present && message[field] === void 0) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [field],
-        message: `${message.category} messages require ${field}`
-      });
-    }
-    if (!present && message[field] !== void 0) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [field],
-        message: `${field} is forbidden on ${message.category} messages`
-      });
+function readSecureFile(fs2, path, label) {
+  let fd;
+  try {
+    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
+    const opened = fs2.fstatSync(fd);
+    const current = fs2.lstatSync(path);
+    if (!opened.isFile() || opened.nlink !== 1 || (opened.mode & 511) !== FILE_MODE || typeof process.getuid === "function" && opened.uid !== process.getuid() || current.isSymbolicLink() || current.dev !== opened.dev || current.ino !== opened.ino) {
+      throw new CoworkConfigError(`${label} changed while opening`);
     }
-  };
-  requires("briefing_role", message.category === "role_briefing");
-  requires("membership", message.category === "membership");
-  if (message.category === "role_briefing" && message.briefing_version === void 0) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["briefing_version"],
-      message: "role_briefing messages require briefing_version"
-    });
+    return fs2.readFileSync(fd);
+  } finally {
+    if (fd !== void 0) fs2.closeSync(fd);
   }
-  if (message.category === "chat" || message.category === "membership") {
-    if (message.briefing_version !== void 0) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["briefing_version"],
-        message: `briefing_version is forbidden on ${message.category} messages`
-      });
-    }
+}
+function fsyncDirectory(fs2, path) {
+  let fd;
+  try {
+    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
+    fs2.fsyncSync(fd);
+  } finally {
+    if (fd !== void 0) fs2.closeSync(fd);
   }
 }
-var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, MAX_ROOM_IDENTITY_NAME_CHARACTERS, MAX_FRIENDLY_IDENTITY_SLUG_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoomNameSchema, RoomIdentityNameModeSchema, ROOM_IDENTITY_PREFIX, SDK_IDENTITY_NAME_PATTERN, FRIENDLY_SLUG_PATTERN, RoleSchema, ROOM_ROLE, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, ContainerIdSchema, AcceptExternalInviteInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
-var init_contracts = __esm({
-  "src/contracts.ts"() {
+function lstatIfPresent(fs2, path) {
+  try {
+    return fs2.lstatSync(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+var DIRECTORY_MODE, FILE_MODE, NO_FOLLOW, CoworkConfigSchema, CoworkConfigError;
+var init_config = __esm({
+  "src/config.ts"() {
     "use strict";
     init_zod();
-    MAX_TEXT_BYTES = 262144;
-    MAX_FILE_BYTES = 2 * 1024 * 1024;
-    MAX_HISTORY_PAGE_BYTES = 3 * 1024 * 1024;
-    MAX_MANAGEMENT_RESPONSE_BYTES = MAX_HISTORY_PAGE_BYTES + 1024 * 1024;
-    MAX_EXTERNAL_INVITE_BYTES = 48 * 1024;
-    MAX_FILE_NAME_BYTES = 255;
-    MAX_MIME_BYTES = 255;
-    MAX_ROLE_BYTES = 256;
-    MAX_ROOM_NAME_CHARACTERS = 64;
-    MAX_ROOM_IDENTITY_NAME_CHARACTERS = 64;
-    MAX_FRIENDLY_IDENTITY_SLUG_CHARACTERS = 25;
-    NonEmptyStringSchema = external_exports.string().min(1);
-    PositiveSafeIntegerSchema = external_exports.number().int().positive().safe();
-    LowerCrockfordUlidSchema = external_exports.string().regex(
-      /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
-      "must be a 26-character lowercase Crockford ULID"
-    );
-    Rfc3339Schema = external_exports.string().refine(isStrictRfc3339, "must be a valid RFC3339 timestamp");
-    RoomNameSchema = external_exports.string().refine(
-      (value) => !/[\p{Cc}\p{Cf}]/u.test(value),
-      "room name must not contain Unicode control or format characters"
-    ).transform(normalizeRoomName).superRefine((value, context) => {
-      const length = Array.from(value).length;
-      if (length < 1 || length > MAX_ROOM_NAME_CHARACTERS) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          message: `room name must contain 1-${MAX_ROOM_NAME_CHARACTERS} Unicode characters after normalization`
-        });
-      }
-    });
-    RoomIdentityNameModeSchema = external_exports.enum(["stable_id", "friendly"]);
-    ROOM_IDENTITY_PREFIX = "ours-cowork-";
-    SDK_IDENTITY_NAME_PATTERN = /^[A-Za-z0-9 _.@-]{1,64}$/;
-    FRIENDLY_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-    RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
-    ROOM_ROLE = "room";
-    MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
-    MessageTextSchema = utf8Bounded("message text", MAX_TEXT_BYTES);
-    FileNameSchema = utf8Bounded("file name", MAX_FILE_NAME_BYTES).refine((value) => value !== "." && value !== "..", "file name must not be a relative path token").refine((value) => !/[\x00/\\]/.test(value), "file name must be a single path-free name");
-    FileMimeSchema = external_exports.string().refine(
-      (value) => Buffer.byteLength(value, "utf8") <= MAX_MIME_BYTES,
-      `file MIME metadata must be at most ${MAX_MIME_BYTES} UTF-8 bytes`
-    );
-    RoomStateSchema = external_exports.enum(["provisioning", "active", "closing", "closed"]);
-    SeatStateSchema = external_exports.enum(["pending", "active", "removed"]);
-    InviteModeSchema = external_exports.enum(["one_time", "public"]);
-    DEFAULT_ROLE = "Participant";
-    InviteStateSchema = external_exports.enum([
-      "live",
-      "consumed",
-      "revoked",
-      "replacement_required",
-      "receipt_pending"
-    ]);
-    RelayStatusSchema = external_exports.enum(["queued", "send_failed"]);
-    SeatV1Schema = external_exports.object({
-      identity: NonEmptyStringSchema,
-      display_name: NonEmptyStringSchema,
-      role: RoleSchema,
-      invite_id: NonEmptyStringSchema,
-      accepted_at: Rfc3339Schema
+    DIRECTORY_MODE = 448;
+    FILE_MODE = 384;
+    NO_FOLLOW = nodeFs.constants.O_NOFOLLOW ?? 0;
+    CoworkConfigSchema = external_exports.object({
+      version: external_exports.literal(1),
+      stateDir: external_exports.string().min(1),
+      rest: external_exports.object({
+        enabled: external_exports.boolean(),
+        port: external_exports.number().int().min(1).max(65535)
+      }).strict()
     }).strict();
-    SeatSchema = external_exports.object({
-      identity: NonEmptyStringSchema,
-      display_name: NonEmptyStringSchema,
-      role: RoleSchema,
-      invite_id: NonEmptyStringSchema,
-      accepted_at: Rfc3339Schema.optional(),
-      requested_at: Rfc3339Schema.optional(),
-      invite_sha256: external_exports.string().regex(/^[0-9a-f]{64}$/).optional(),
-      participant_id: LowerCrockfordUlidSchema,
-      state: SeatStateSchema,
-      alias: NonEmptyStringSchema.optional(),
-      removed_at: Rfc3339Schema.optional(),
-      removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
-      replaces_seat: LowerCrockfordUlidSchema.optional(),
-      bounced_at: Rfc3339Schema.optional()
-    }).strict().superRefine((seat, context) => {
-      if (seat.state === "pending") {
-        for (const field of ["requested_at", "invite_sha256"]) {
-          if (seat[field] === void 0) {
-            context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `pending seats require ${field}` });
-          }
-        }
-        for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at"]) {
-          if (seat[field] !== void 0) {
-            context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `${field} is forbidden on pending seats` });
-          }
-        }
-      } else if (seat.state === "removed") {
-        if (seat.accepted_at === void 0 && seat.requested_at === void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["accepted_at"],
-            message: "removed seats require accepted_at unless they are cancelled external admissions"
-          });
-        }
-        if (seat.removed_at === void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["removed_at"],
-            message: "removed seats require removed_at"
-          });
-        }
-        if (seat.removed_epoch === void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["removed_epoch"],
-            message: "removed seats require removed_epoch"
-          });
-        }
-      } else {
-        if (seat.accepted_at === void 0) {
-          context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["accepted_at"], message: "active seats require accepted_at" });
-        }
-        for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
-          if (seat[field] !== void 0) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [field],
-              message: `${field} is reserved for removed seats`
-            });
-          }
-        }
-      }
-      if (seat.requested_at === void 0 !== (seat.invite_sha256 === void 0)) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["invite_sha256"],
-          message: "external admission metadata requires both requested_at and invite_sha256"
-        });
-      }
-    });
-    RoomInviteSchema = external_exports.object({
-      invite_id: NonEmptyStringSchema,
-      mode: InviteModeSchema,
-      role: RoleSchema,
-      min_accepts: PositiveSafeIntegerSchema,
-      accepted_cids: external_exports.array(NonEmptyStringSchema),
-      state: InviteStateSchema,
-      recovery_of: NonEmptyStringSchema.optional(),
-      recovery_confirmed: external_exports.boolean().optional(),
-      created_at: Rfc3339Schema,
-      replaces_seat: LowerCrockfordUlidSchema.optional()
-    }).strict().superRefine((invite, context) => {
-      if (invite.mode === "one_time" && invite.min_accepts !== 1) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["min_accepts"],
-          message: "one_time invites require min_accepts === 1"
-        });
-      }
-      if (invite.state === "receipt_pending" && invite.recovery_of === void 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_of"],
-          message: "receipt_pending invites require recovery_of"
-        });
-      }
-      if (invite.recovery_of === void 0 && invite.recovery_confirmed !== void 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "recovery_confirmed is forbidden without recovery_of"
-        });
+    CoworkConfigError = class extends Error {
+      constructor(message, options) {
+        super(message, options);
+        this.name = "CoworkConfigError";
       }
-      if (invite.recovery_of !== void 0 && invite.recovery_confirmed === void 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "recovery_confirmed is required with recovery_of"
-        });
+    };
+  }
+});
+
+// src/ours-runtime.ts
+import { randomBytes } from "node:crypto";
+function createOursHost(_config, log = () => {
+}) {
+  return new SharedOursHost(log);
+}
+function sleep(ms, signal) {
+  return new Promise((resolveSleep) => {
+    const timer = setTimeout(finish, ms);
+    signal.addEventListener("abort", finish, { once: true });
+    function finish() {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", finish);
+      resolveSleep();
+    }
+  });
+}
+var WATCH_RETRY_MIN_MS, WATCH_RETRY_MAX_MS, STATE_RESYNC_INTERVAL_MS, attachSharedClient, SharedOursHost;
+var init_ours_runtime = __esm({
+  "src/ours-runtime.ts"() {
+    "use strict";
+    WATCH_RETRY_MIN_MS = 500;
+    WATCH_RETRY_MAX_MS = 3e4;
+    STATE_RESYNC_INTERVAL_MS = 2e3;
+    attachSharedClient = async (options) => {
+      const { attachOursClient } = await import("@ours.network/sdk");
+      return attachOursClient(options);
+    };
+    SharedOursHost = class {
+      log;
+      attach;
+      listeners = /* @__PURE__ */ new Set();
+      watchers = /* @__PURE__ */ new Map();
+      watchLeaseToken = `cowork-watch-${randomBytes(16).toString("hex")}`;
+      watchClient;
+      resyncTimer;
+      closed = false;
+      constructor(log = () => {
+      }, attach = attachSharedClient) {
+        this.log = log;
+        this.attach = attach;
       }
-      if (invite.state === "receipt_pending" && invite.recovery_confirmed !== false) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "receipt_pending recovery lineage must be unconfirmed"
-        });
+      async boot() {
+        if (this.watchClient) return;
+        if (this.closed) throw new Error("shared ours daemon host cannot restart in the same process");
+        this.watchClient = await this.attach({ leaseToken: this.watchLeaseToken });
       }
-      if (invite.recovery_of !== void 0 && (invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required") && invite.recovery_confirmed !== true) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["recovery_confirmed"],
-          message: "live, consumed, and replacement_required recovery lineage must be confirmed"
-        });
+      async createClient(leaseToken = `cowork-${randomBytes(16).toString("hex")}`) {
+        if (!this.watchClient) throw new Error("shared ours daemon host is not booted");
+        return this.attach({ leaseToken });
       }
-      if (invite.state === "receipt_pending" && invite.accepted_cids.length > 0) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["accepted_cids"],
-          message: "receipt_pending invites cannot have accepted CIDs"
-        });
+      async listIdentityNames(localNames) {
+        if (!this.watchClient) throw new Error("shared ours daemon host is not booted");
+        const rows = await this.watchClient.identities();
+        return new Set(rows.flatMap((row) => localNames.has(row.name) ? [row.name] : []));
+      }
+      onIdentityNotify(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+      }
+      trackIdentity(identityName) {
+        if (!this.watchClient) throw new Error("shared ours daemon host is not booted");
+        const existing = this.watchers.get(identityName);
+        if (existing) return () => this.untrack(identityName, existing);
+        const controller = new AbortController();
+        const watcher = { controller, work: Promise.resolve() };
+        watcher.work = this.follow(identityName, controller.signal);
+        this.watchers.set(identityName, watcher);
+        this.announce(identityName);
+        this.ensureStateResync();
+        return () => this.untrack(identityName, watcher);
+      }
+      close() {
+      }
+      async shutdown() {
+        if (this.closed) return { requiresProcessExit: false };
+        this.closed = true;
+        this.listeners.clear();
+        this.stopStateResync();
+        const watchers = [...this.watchers.values()];
+        this.watchers.clear();
+        for (const watcher of watchers) watcher.controller.abort();
+        await Promise.allSettled(watchers.map((watcher) => watcher.work));
+        const client = this.watchClient;
+        this.watchClient = void 0;
+        if (client) await client.releaseLease();
+        return { requiresProcessExit: false };
+      }
+      untrack(identityName, watcher) {
+        if (this.watchers.get(identityName) !== watcher) return;
+        this.watchers.delete(identityName);
+        watcher.controller.abort();
+        if (this.watchers.size === 0) this.stopStateResync();
+      }
+      ensureStateResync() {
+        if (this.resyncTimer) return;
+        this.resyncTimer = setInterval(() => {
+          for (const identityName of this.watchers.keys()) this.announce(identityName);
+        }, STATE_RESYNC_INTERVAL_MS);
+        this.resyncTimer.unref();
+      }
+      stopStateResync() {
+        if (!this.resyncTimer) return;
+        clearInterval(this.resyncTimer);
+        this.resyncTimer = void 0;
       }
-    });
-    MissionV1Schema = external_exports.object({
-      goal: MissionTextSchema,
-      briefing: MissionTextSchema
-    }).strict();
-    MissionSchema = external_exports.object({
-      goal: MissionTextSchema,
-      briefing: MissionTextSchema,
-      briefing_version: PositiveSafeIntegerSchema
-    }).strict();
-    RoleBriefingSchema = external_exports.object({
-      text: MissionTextSchema,
-      version: PositiveSafeIntegerSchema,
-      updated_at: Rfc3339Schema
-    }).strict();
-    RoomCommonShape = {
-      room_id: LowerCrockfordUlidSchema,
-      identity_name: NonEmptyStringSchema,
-      identity_cid: external_exports.string(),
-      state: RoomStateSchema,
-      status: NonEmptyStringSchema.optional(),
-      invites: external_exports.array(RoomInviteSchema),
-      created_at: Rfc3339Schema,
-      activated_at: Rfc3339Schema.optional(),
-      closed_at: Rfc3339Schema.optional()
-    };
-    RoomV1Schema = external_exports.object({
-      ...RoomCommonShape,
-      version: external_exports.literal(1),
-      mission: MissionV1Schema,
-      seats: external_exports.array(SeatV1Schema)
-    }).strict().superRefine(refineRoomLineage);
-    CurrentRoomSchema = external_exports.object({
-      ...RoomCommonShape,
-      room_name: RoomNameSchema,
-      version: external_exports.literal(2),
-      mission: MissionSchema,
-      role_briefings: external_exports.record(RoleSchema, RoleBriefingSchema),
       /**
-       * Roles a REST caller may author under. A plain array of names:
-       * the role name IS the identifier, so there is nothing per-role to store.
-       * Not a seat, not a membership: seat and membership invariants do not apply.
-       * The registry itself is an exact-name set, and reserves `room` for the
-       * room's own voice.
+       * Long-poll one identity forever, reconnecting with bounded backoff.
+       *
+       * A replacement stream primes at the daemon tip, so each reconnection also
+       * requests a full state resync. The periodic resync above covers the small
+       * request-prime race and daemon transitions that are not in the structured
+       * notification log; reconciliation is idempotent and self-coalescing.
        */
-      rest_roles: external_exports.array(RoleSchema).superRefine((roles, context) => {
-        const seen = /* @__PURE__ */ new Set();
-        for (const [index, role] of roles.entries()) {
-          if (role === ROOM_ROLE) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [index],
-              message: `role "${ROOM_ROLE}" is reserved for the room's own voice`
-            });
-          }
-          if (seen.has(role)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [index],
-              message: "REST role names must be unique within the room"
-            });
+      async follow(identityName, signal) {
+        let backoffMs = WATCH_RETRY_MIN_MS;
+        let resyncPending = false;
+        while (!signal.aborted) {
+          const client = this.watchClient;
+          if (!client) return;
+          try {
+            const stream = client.watchNotifications(identityName, { signal });
+            let step = stream.next();
+            if (resyncPending) {
+              resyncPending = false;
+              this.announce(identityName);
+            }
+            for (let settled = await step; !settled.done; settled = await step) {
+              backoffMs = WATCH_RETRY_MIN_MS;
+              this.announce(identityName);
+              step = stream.next();
+            }
+            if (!signal.aborted) {
+              resyncPending = true;
+              this.log(`[${identityName}] shared ours daemon notification watch ended; reconnecting`);
+            }
+          } catch (error) {
+            if (signal.aborted) return;
+            resyncPending = true;
+            this.log(`[${identityName}] shared ours daemon notification watch failed:`, error);
           }
-          seen.add(role);
+          if (signal.aborted) return;
+          await sleep(backoffMs, signal);
+          backoffMs = Math.min(backoffMs * 2, WATCH_RETRY_MAX_MS);
         }
-      }),
-      anonymous: external_exports.boolean(),
-      quiet_membership: external_exports.boolean(),
-      membership_epoch: external_exports.number().int().nonnegative().safe(),
-      seats: external_exports.array(SeatSchema)
-    }).strict().superRefine((room, context) => {
-      refineRoomLineage(room, context);
-      const byParticipant = /* @__PURE__ */ new Map();
-      const activeAliases = /* @__PURE__ */ new Set();
-      const authorizedCids = /* @__PURE__ */ new Set();
-      for (const [index, seat] of room.seats.entries()) {
-        if (byParticipant.has(seat.participant_id)) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "participant_id"],
-            message: "participant_id must be unique within the room"
-          });
-        }
-        byParticipant.set(seat.participant_id, seat);
-        if (seat.state === "pending" || seat.state === "active") {
-          if (authorizedCids.has(seat.identity)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: ["seats", index, "identity"],
-              message: "at most one pending or active seat may exist per CID"
-            });
-          }
-          authorizedCids.add(seat.identity);
-        }
-        if (room.anonymous && seat.alias === void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "alias"],
-            message: "anonymous rooms require an alias on every seat"
-          });
-        }
-        if (!room.anonymous && seat.alias !== void 0) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "alias"],
-            message: "aliases are reserved for anonymous rooms"
-          });
-        }
-        if (seat.state === "active" && seat.alias !== void 0) {
-          if (activeAliases.has(seat.alias)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: ["seats", index, "alias"],
-              message: "active seats must hold distinct aliases"
-            });
-          }
-          activeAliases.add(seat.alias);
-        }
-        if (seat.removed_epoch !== void 0 && seat.removed_epoch > room.membership_epoch) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "removed_epoch"],
-            message: "removed_epoch cannot exceed the room membership_epoch"
-          });
+      }
+      announce(identityName) {
+        for (const listener of this.listeners) {
+          try {
+            listener(identityName);
+          } catch (error) {
+            this.log(`cowork SDK notification listener failed for ${identityName}:`, error);
+          }
         }
       }
-      for (const [index, seat] of room.seats.entries()) {
-        if (seat.replaces_seat === void 0) continue;
-        const predecessor = byParticipant.get(seat.replaces_seat);
-        if (!predecessor || predecessor === seat || predecessor.state !== "removed") {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "replaces_seat"],
-            message: "replaces_seat must reference a removed seat in this room"
-          });
-          continue;
-        }
-        if (predecessor.role !== seat.role) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "role"],
-            message: "a replacement seat must inherit the predecessor role"
-          });
-        }
-        if (room.anonymous && seat.alias !== predecessor.alias) {
-          context.addIssue({
-            code: external_exports.ZodIssueCode.custom,
-            path: ["seats", index, "alias"],
-            message: "an anonymous replacement seat must inherit the predecessor alias"
-          });
-        }
-      }
-    });
-    RoomSchema = external_exports.preprocess((value) => {
-      if (typeof value !== "object" || value === null) return value;
-      const patch = {};
-      if (!Object.hasOwn(value, "room_name")) {
-        const roomId = value.room_id;
-        if (typeof roomId === "string" && LowerCrockfordUlidSchema.safeParse(roomId).success) {
-          patch.room_name = defaultRoomName(roomId);
-        }
-      }
-      if (!Object.hasOwn(value, "rest_roles")) patch.rest_roles = [];
-      if (Object.keys(patch).length === 0) return value;
-      return { ...value, ...patch };
-    }, CurrentRoomSchema);
-    CreateRoomInputSchema = external_exports.object({
-      name: RoomNameSchema.optional(),
-      goal: MissionTextSchema,
-      briefing: MissionTextSchema,
-      anonymous: external_exports.boolean().optional(),
-      quiet_membership: external_exports.boolean().optional()
-    }).strict();
-    UpdateRoomInputSchema = external_exports.object({
-      name: RoomNameSchema.optional(),
-      goal: MissionTextSchema.optional(),
-      briefing: MissionTextSchema.optional(),
-      status: NonEmptyStringSchema.optional(),
-      quiet_membership: external_exports.boolean().optional()
-    }).strict().refine((input) => Object.keys(input).length > 0, "at least one setting is required");
-    RoleBriefingSetInputSchema = external_exports.object({
-      role: RoleSchema,
-      text: MissionTextSchema
-    }).strict();
-    RoleBriefingDeleteInputSchema = external_exports.object({
-      role: RoleSchema
-    }).strict();
-    PostMessageInputSchema = external_exports.object({
-      text: MessageTextSchema
-    }).strict();
-    PostAsRoleInputSchema = external_exports.object({
-      role: RoleSchema,
-      text: MessageTextSchema
-    }).strict();
-    RestRoleInputSchema = external_exports.object({
-      role: RoleSchema
-    }).strict();
-    ContainerIdSchema = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
-    AcceptExternalInviteInputSchema = external_exports.object({
-      role: RoleSchema,
-      invite: external_exports.string().refine(
-        (value) => Buffer.byteLength(value, "utf8") <= MAX_EXTERNAL_INVITE_BYTES,
-        `invite input must be at most ${MAX_EXTERNAL_INVITE_BYTES} UTF-8 bytes`
-      ),
-      expected_cid: ContainerIdSchema.optional(),
-      replaces_seat: LowerCrockfordUlidSchema.optional()
-    }).strict();
-    AuthorSnapshotSchema = external_exports.object({
-      identity: NonEmptyStringSchema,
-      display_name: NonEmptyStringSchema,
-      role: RoleSchema
-    }).strict();
-    RecordCommonShape = {
-      version: external_exports.literal(1),
-      room_id: LowerCrockfordUlidSchema,
-      seq: PositiveSafeIntegerSchema,
-      record_id: NonEmptyStringSchema,
-      at: Rfc3339Schema
-    };
-    AppendCommonShape = {
-      version: external_exports.literal(1),
-      room_id: LowerCrockfordUlidSchema,
-      at: Rfc3339Schema
-    };
-    MembershipNoticeSchema = external_exports.object({
-      action: external_exports.enum(["remove"]),
-      alias: NonEmptyStringSchema.optional(),
-      role: RoleSchema.optional(),
-      epoch: external_exports.number().int().nonnegative().safe()
-    }).strict();
-    AuthorAliasSchema = external_exports.object({
-      participant_id: LowerCrockfordUlidSchema,
-      alias: NonEmptyStringSchema
-    }).strict();
-    ReplyReferenceSchema = external_exports.object({
-      wire_id: NonEmptyStringSchema,
-      sentence: PositiveSafeIntegerSchema.optional()
-    }).strict();
-    MessageShape = {
-      kind: external_exports.literal("message"),
-      message_id: LowerCrockfordUlidSchema,
-      author: AuthorSnapshotSchema,
-      author_alias: AuthorAliasSchema.optional(),
-      category: external_exports.enum(["briefing", "role_briefing", "chat", "membership"]),
-      briefing_role: RoleSchema.optional(),
-      briefing_version: PositiveSafeIntegerSchema.optional(),
-      membership: MembershipNoticeSchema.optional(),
-      text: MessageTextSchema,
-      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
-        const seen = /* @__PURE__ */ new Set();
-        for (const [index, identity] of identities.entries()) {
-          if (seen.has(identity)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [index],
-              message: "recipient identities must be unique"
-            });
-          }
-          seen.add(identity);
-        }
-      }),
-      source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
-      source_wire_id: NonEmptyStringSchema.optional(),
-      source_reply_to: ReplyReferenceSchema.optional()
-    };
-    RelayIntentShape = {
-      kind: external_exports.literal("relay_intent"),
-      message_id: LowerCrockfordUlidSchema.optional(),
-      file_id: LowerCrockfordUlidSchema.optional(),
-      recipient_identity: NonEmptyStringSchema
-    };
-    RelayResultStatusSchema = external_exports.enum(["queued", "send_failed", "skipped_removed"]);
-    RelayResultShape = {
-      kind: external_exports.literal("relay_result"),
-      intent_record_id: NonEmptyStringSchema,
-      message_id: LowerCrockfordUlidSchema.optional(),
-      file_id: LowerCrockfordUlidSchema.optional(),
-      recipient_identity: NonEmptyStringSchema,
-      status: RelayResultStatusSchema,
-      wire_id: NonEmptyStringSchema.optional(),
-      metadata_wire_id: NonEmptyStringSchema.optional()
     };
-    FileShape = {
-      kind: external_exports.literal("file"),
-      file_id: LowerCrockfordUlidSchema,
-      author: AuthorSnapshotSchema,
-      author_alias: AuthorAliasSchema.optional(),
-      filename: FileNameSchema,
-      mime: FileMimeSchema,
-      size: external_exports.number().int().nonnegative().max(MAX_FILE_BYTES),
-      sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
-      data_base64: external_exports.string(),
-      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
-        const seen = /* @__PURE__ */ new Set();
-        for (const [index, identity] of identities.entries()) {
-          if (seen.has(identity)) {
-            context.addIssue({
-              code: external_exports.ZodIssueCode.custom,
-              path: [index],
-              message: "recipient identities must be unique"
-            });
-          }
-          seen.add(identity);
-        }
-      }),
-      source_file_id: external_exports.number().int().nonnegative().safe(),
-      source_wire_id: NonEmptyStringSchema.optional(),
-      source_reply_to: ReplyReferenceSchema.optional()
-    };
-    MembershipIntentShape = {
-      kind: external_exports.literal("membership_intent"),
-      action: external_exports.enum(["remove"]),
-      participant_id: LowerCrockfordUlidSchema,
-      recipient_identity: NonEmptyStringSchema,
-      role: RoleSchema,
-      alias: NonEmptyStringSchema.optional(),
-      epoch: PositiveSafeIntegerSchema,
-      notify: external_exports.boolean()
-    };
-    MembershipResultShape = {
-      kind: external_exports.literal("membership_result"),
-      intent_record_id: NonEmptyStringSchema,
-      participant_id: LowerCrockfordUlidSchema,
-      status: RelayStatusSchema,
-      notified: external_exports.boolean(),
-      key_material_retained: external_exports.literal(true),
-      uncertain_after_restart: external_exports.literal(true).optional()
-    };
-    CloseNoticeIntentShape = {
-      kind: external_exports.literal("close_notice_intent"),
-      recipient_identity: NonEmptyStringSchema
-    };
-    CloseNoticeResultShape = {
-      kind: external_exports.literal("close_notice_result"),
-      intent_record_id: NonEmptyStringSchema,
-      recipient_identity: NonEmptyStringSchema,
-      status: RelayStatusSchema,
-      notified: external_exports.boolean(),
-      key_material_retained: external_exports.literal(true),
-      uncertain_after_restart: external_exports.literal(true).optional()
-    };
-    MessageRecordSchema = external_exports.object({ ...RecordCommonShape, ...MessageShape }).strict();
-    FileRecordSchema = external_exports.object({ ...RecordCommonShape, ...FileShape }).strict();
-    RelayIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayIntentShape }).strict();
-    RelayResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayResultShape }).strict();
-    MembershipIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipIntentShape }).strict();
-    MembershipResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipResultShape }).strict();
-    CloseNoticeIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeIntentShape }).strict();
-    CloseNoticeResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeResultShape }).strict();
-    RawCommunicationRecordSchema = external_exports.discriminatedUnion("kind", [
-      MessageRecordSchema,
-      FileRecordSchema,
-      RelayIntentRecordSchema,
-      RelayResultRecordSchema,
-      MembershipIntentRecordSchema,
-      MembershipResultRecordSchema,
-      CloseNoticeIntentRecordSchema,
-      CloseNoticeResultRecordSchema
-    ]);
-    CommunicationRecordSchema = RawCommunicationRecordSchema.superRefine((record, context) => {
-      if (record.record_id !== `${record.room_id}:${record.seq}`) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["record_id"],
-          message: 'record_id must equal room_id + ":" + seq'
-        });
-      }
-      if (record.kind === "message") refineMessageCategory(record, context);
-      refineRelaySubject(record, context);
-      refineFileRecord(record, context);
-    });
-    AppendRecordSchema = external_exports.discriminatedUnion("kind", [
-      external_exports.object({ ...AppendCommonShape, ...MessageShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...FileShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...RelayIntentShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...RelayResultShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...MembershipIntentShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...MembershipResultShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...CloseNoticeIntentShape }).strict(),
-      external_exports.object({ ...AppendCommonShape, ...CloseNoticeResultShape }).strict()
-    ]).superRefine((record, context) => {
-      if (record.kind === "message") refineMessageCategory(record, context);
-      refineRelaySubject(record, context);
-      refineFileRecord(record, context);
-    });
   }
 });
 
-// src/config.ts
-import * as nodeFs from "node:fs";
-import { homedir } from "node:os";
-import { dirname, isAbsolute, join, parse, resolve } from "node:path";
-function defaultConfig(home = homedir()) {
-  return {
-    version: 1,
-    stateDir: resolve(home, ".ours-cowork"),
-    roomIdentity: { nameMode: "stable_id" },
-    rest: { enabled: true, port: 3052 }
-  };
-}
-function loadConfig(env = process.env, io = {}) {
-  rejectRemovedEnvironment(env);
-  const fs2 = io.fs ?? nodeFs;
-  const defaults = defaultConfig(io.home);
-  const configPath = resolve(env.OURS_COWORK_CONFIG ?? join(io.home ?? homedir(), ".ours-cowork", "config.json"));
-  let file = defaults;
-  const stat = lstatIfPresent(fs2, configPath);
-  if (stat) {
-    assertSecureFile(fs2, configPath, "config file");
-    let parsed;
-    try {
-      parsed = JSON.parse(readSecureFile(fs2, configPath, "config file").toString("utf8"));
-    } catch (error) {
-      throw new CoworkConfigError(`malformed cowork config at ${configPath}`, { cause: error });
-    }
-    rejectRemovedConfig(parsed, configPath);
-    try {
-      file = CoworkConfigSchema.parse(parsed);
-    } catch (error) {
-      throw new CoworkConfigError(`invalid cowork config at ${configPath}`, { cause: error });
-    }
-  } else if (env.OURS_COWORK_CONFIG !== void 0) {
-    throw new CoworkConfigError(`configured cowork config does not exist: ${configPath}`);
-  }
-  const restPort = env.OURS_COWORK_REST_PORT === void 0 ? void 0 : parsePort(env.OURS_COWORK_REST_PORT);
-  try {
-    return CoworkConfigSchema.parse({
-      version: 1,
-      stateDir: resolve(env.OURS_COWORK_STATE_DIR ?? file.stateDir),
-      roomIdentity: file.roomIdentity,
-      rest: {
-        enabled: restPort === void 0 ? file.rest.enabled : true,
-        port: restPort ?? file.rest.port
-      }
-    });
-  } catch (error) {
-    throw new CoworkConfigError("invalid effective cowork config", { cause: error });
-  }
-}
-function rejectRemovedEnvironment(env) {
-  const removed = [
-    "OURS_COWORK_BROKER_URL",
-    "OURS_COWORK_DAEMON_MODE",
-    "OURS_COWORK_DAEMON_ENDPOINT",
-    "OURS_COWORK_DAEMON_STATE_DIR"
-  ].filter((name) => env[name] !== void 0);
-  if (removed.length === 0) return;
-  throw new CoworkConfigError(
-    `${removed.join(", ")} ${removed.length === 1 ? "was" : "were"} removed: ours-cowork now attaches only to the shared ours daemon. Configure that daemon with @ours.network/cli and select it through the standard OURS_CONFIG, OURS_PORT, and OURS_STATE_DIR inputs.`
+// src/contracts.ts
+import { createHash } from "node:crypto";
+function utf8Bounded(label, maximumBytes) {
+  return external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") >= 1, `${label} must be at least 1 UTF-8 byte`).refine(
+    (value) => Buffer.byteLength(value, "utf8") <= maximumBytes,
+    `${label} must be at most ${maximumBytes} UTF-8 bytes`
   );
 }
-function rejectRemovedConfig(value, path) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return;
-  const removed = ["brokerUrl", "daemon"].filter((key) => Object.hasOwn(value, key));
-  if (removed.length === 0) return;
-  throw new CoworkConfigError(
-    `cowork config at ${path} contains removed ${removed.join(" and ")} ${removed.length === 1 ? "key" : "keys"}: ours-cowork now attaches only to the shared ours daemon. Remove those keys and configure the daemon with @ours.network/cli.`
-  );
+function isStrictRfc3339(value) {
+  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))$/.exec(value);
+  if (!match) return false;
+  const [, yearText, monthText, dayText, hourText, minuteText, secondText, offsetHourText, offsetMinuteText] = match;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  const offsetHour = offsetHourText === void 0 ? 0 : Number(offsetHourText);
+  const offsetMinute = offsetMinuteText === void 0 ? 0 : Number(offsetMinuteText);
+  if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59) return false;
+  if (offsetHour > 23 || offsetMinute > 59) return false;
+  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const days = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return day >= 1 && day <= days[month - 1];
 }
-function ensureRuntimeState(config, io = {}) {
-  const parsed = CoworkConfigSchema.parse(config);
-  const fs2 = io.fs ?? nodeFs;
-  const stateDir = resolve(parsed.stateDir);
-  assertSecureAncestors(fs2, stateDir, "state directory");
-  const existing = lstatIfPresent(fs2, stateDir);
-  if (!existing) {
-    createSecureDirectoryTree(fs2, stateDir, "state directory");
-  }
-  assertSecureDirectory(fs2, stateDir, "state directory");
-  const roomsPath = join(stateDir, "rooms");
-  const rooms = lstatIfPresent(fs2, roomsPath);
-  if (!rooms) {
-    fs2.mkdirSync(roomsPath, { mode: DIRECTORY_MODE });
-    secureOpenedDirectory(fs2, roomsPath, "rooms directory");
-    fsyncDirectory(fs2, stateDir);
-  }
-  assertSecureDirectory(fs2, roomsPath, "rooms directory");
-  return {
-    socketPath: join(stateDir, "management.sock"),
-    pidPath: join(stateDir, "daemon.pid"),
-    lockPath: join(stateDir, "daemon.lock")
-  };
+function normalizeRoomName(value) {
+  return value.trim().normalize("NFC");
 }
-function parsePort(value) {
-  if (!/^[1-9][0-9]{0,4}$/.test(value)) {
-    throw new CoworkConfigError("OURS_COWORK_REST_PORT must be a decimal port from 1 to 65535");
-  }
-  const port = Number(value);
-  if (port > 65535) throw new CoworkConfigError("OURS_COWORK_REST_PORT must be from 1 to 65535");
-  return port;
+function roomIdentityName(roomName) {
+  return `${ROOM_IDENTITY_PREFIX}${RoomNameSchema.parse(roomName)}`;
 }
-function assertSecureAncestors(fs2, path, label) {
-  const absolute = isAbsolute(path) ? path : resolve(path);
-  const root = parse(absolute).root;
-  const rootOwner = fs2.lstatSync(root).uid;
-  let cursor = root;
-  const components = absolute.slice(root.length).split("/").filter(Boolean);
-  for (const [index, component] of components.entries()) {
-    cursor = join(cursor, component);
-    const stat = lstatIfPresent(fs2, cursor);
-    if (stat?.isSymbolicLink()) throw new CoworkConfigError(`${label} must not traverse a symbolic link (symlink): ${cursor}`);
-    if (!stat) break;
-    if (!stat.isDirectory()) {
-      if (index === components.length - 1) return;
-      throw new CoworkConfigError(`${label} ancestor is not a directory: ${cursor}`);
-    }
-    if (index < components.length - 1) assertTrustedAncestor(stat, rootOwner, cursor, label);
+function isPersistedRoomIdentityName(roomId, identityName) {
+  if (!LowerCrockfordUlidSchema.safeParse(roomId).success || !identityName.startsWith(ROOM_IDENTITY_PREFIX)) {
+    return false;
   }
+  const parsed = RoomNameSchema.safeParse(identityName.slice(ROOM_IDENTITY_PREFIX.length));
+  return parsed.success && identityName === `${ROOM_IDENTITY_PREFIX}${parsed.data}`;
 }
-function assertTrustedAncestor(stat, rootOwner, path, label) {
-  const uid = typeof process.getuid === "function" ? process.getuid() : stat.uid;
-  const trustedStickyDirectory = (stat.mode & 512) !== 0;
-  const writableByOthers = (stat.mode & 18) !== 0;
-  const trustedOwner = stat.uid === uid || stat.uid === 0 || stat.uid === rootOwner;
-  if (writableByOthers && (!trustedStickyDirectory || !trustedOwner)) {
-    throw new CoworkConfigError(`${label} has an unsafe writable ancestor: ${path}`);
-  }
+function isStandardRoomIdentityName(roomId, identityName) {
+  return isPersistedRoomIdentityName(roomId, identityName);
 }
-function createSecureDirectoryTree(fs2, path, label) {
-  const missing = [];
-  let cursor = path;
-  while (!lstatIfPresent(fs2, cursor)) {
-    missing.push(cursor);
-    const parent = dirname(cursor);
-    if (parent === cursor) throw new CoworkConfigError(`cannot locate an existing ancestor for ${label}`);
-    cursor = parent;
+function refineRoomLineage(room, context) {
+  const exactPacketPending = room.state === "provisioning" && room.status === "packet_pending" && isPersistedRoomIdentityName(room.room_id, room.identity_name) && room.invites.length === 0 && room.seats.length === 0 && room.activated_at === void 0 && room.closed_at === void 0;
+  if (room.identity_cid === "" && !exactPacketPending) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["identity_cid"],
+      message: "empty identity_cid is reserved for the exact packet_pending provisioning sentinel"
+    });
   }
-  assertSecureAncestors(fs2, path, label);
-  for (const directory of missing.reverse()) {
-    fs2.mkdirSync(directory, { mode: DIRECTORY_MODE });
-    secureOpenedDirectory(fs2, directory, label);
-    fsyncDirectory(fs2, dirname(directory));
+  if (room.identity_cid !== "" && room.status === "packet_pending") {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["status"],
+      message: "packet_pending status requires an empty identity_cid"
+    });
   }
-}
-function secureOpenedDirectory(fs2, path, label) {
-  let fd;
-  try {
-    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
-    const opened = fs2.fstatSync(fd);
-    const current = fs2.lstatSync(path);
-    if (!opened.isDirectory() || current.isSymbolicLink() || opened.dev !== current.dev || opened.ino !== current.ino) {
-      throw new CoworkConfigError(`${label} changed while opening`);
+  const pendingByRecovery = /* @__PURE__ */ new Map();
+  for (const [index, invite] of room.invites.entries()) {
+    if (invite.recovery_of === void 0) continue;
+    const recoveryOf = invite.recovery_of;
+    const source = room.invites.find((candidate) => candidate.invite_id === recoveryOf);
+    const validSourceState = invite.state === "receipt_pending" ? source?.state === "replacement_required" : invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required" ? source?.state === "revoked" : invite.state === "revoked" ? invite.recovery_confirmed === true ? source?.state === "revoked" : source?.state === "replacement_required" || source?.state === "revoked" : false;
+    if (!source || source.invite_id === invite.invite_id || !validSourceState) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["invites", index, "recovery_of"],
+        message: "recovery_of must point to a source invite in the state required by this recovery lineage"
+      });
+    } else if (invite.mode !== source.mode || invite.role !== source.role || invite.min_accepts !== source.min_accepts) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["invites", index],
+        message: "receipt_pending descriptor must copy source mode, role, and min_accepts"
+      });
+    }
+    if (invite.state === "receipt_pending") {
+      const count = (pendingByRecovery.get(recoveryOf) ?? 0) + 1;
+      pendingByRecovery.set(recoveryOf, count);
+      if (count > 1) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["invites", index, "recovery_of"],
+          message: "only one receipt_pending invite may exist per recovery_of pointer"
+        });
+      }
     }
-    fs2.fchmodSync(fd, DIRECTORY_MODE);
-    fs2.fsyncSync(fd);
-  } finally {
-    if (fd !== void 0) fs2.closeSync(fd);
   }
 }
-function assertSecureDirectory(fs2, path, label) {
-  const stat = fs2.lstatSync(path);
-  if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
-  if (!stat.isDirectory()) throw new CoworkConfigError(`${label} must be a directory`);
-  if ((stat.mode & 511) !== DIRECTORY_MODE) {
-    throw new CoworkConfigError(`${label} mode must be 0700`);
-  }
-  assertOwner(stat, label);
+function defaultRoomName(roomId) {
+  return `Room ${LowerCrockfordUlidSchema.parse(roomId).slice(0, 8)}`;
 }
-function assertSecureFile(fs2, path, label) {
-  const stat = fs2.lstatSync(path);
-  if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
-  if (!stat.isFile() || stat.nlink !== 1) throw new CoworkConfigError(`${label} must be a single-link regular file`);
-  if ((stat.mode & 511) !== FILE_MODE) throw new CoworkConfigError(`${label} mode must be 0600`);
-  assertOwner(stat, label);
+function migrateRoomV1(room, mintParticipantId) {
+  return RoomSchema.parse({
+    ...room,
+    version: 2,
+    mission: { ...room.mission, briefing_version: 1 },
+    role_briefings: {},
+    rest_roles: [],
+    anonymous: false,
+    quiet_membership: false,
+    membership_epoch: 0,
+    seats: room.seats.map((seat) => ({
+      ...seat,
+      participant_id: LowerCrockfordUlidSchema.parse(mintParticipantId()),
+      state: "active"
+    }))
+  });
 }
-function assertOwner(stat, label) {
-  if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
-    throw new CoworkConfigError(`${label} must be owned by the current user`);
+function refineRelaySubject(record, context) {
+  if (record.kind !== "relay_intent" && record.kind !== "relay_result") return;
+  if (record.message_id === void 0 === (record.file_id === void 0)) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["message_id"],
+      message: "relay records require exactly one of message_id or file_id"
+    });
   }
 }
-function readSecureFile(fs2, path, label) {
-  let fd;
-  try {
-    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
-    const opened = fs2.fstatSync(fd);
-    const current = fs2.lstatSync(path);
-    if (!opened.isFile() || opened.nlink !== 1 || (opened.mode & 511) !== FILE_MODE || typeof process.getuid === "function" && opened.uid !== process.getuid() || current.isSymbolicLink() || current.dev !== opened.dev || current.ino !== opened.ino) {
-      throw new CoworkConfigError(`${label} changed while opening`);
-    }
-    return fs2.readFileSync(fd);
-  } finally {
-    if (fd !== void 0) fs2.closeSync(fd);
+function refineFileRecord(record, context) {
+  if (record.kind !== "file" || record.data_base64 === void 0) return;
+  const bytes = Buffer.from(record.data_base64, "base64");
+  if (bytes.toString("base64") !== record.data_base64) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["data_base64"], message: "file bytes must use canonical base64" });
   }
-}
-function fsyncDirectory(fs2, path) {
-  let fd;
-  try {
-    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
-    fs2.fsyncSync(fd);
-  } finally {
-    if (fd !== void 0) fs2.closeSync(fd);
+  if (bytes.length !== record.size) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["size"], message: "file size must match decoded bytes" });
   }
-}
-function lstatIfPresent(fs2, path) {
-  try {
-    return fs2.lstatSync(path);
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throw error;
+  const digest = createHash("sha256").update(bytes).digest("hex");
+  if (digest !== record.sha256) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["sha256"], message: "file sha256 must match decoded bytes" });
   }
 }
-var DIRECTORY_MODE, FILE_MODE, NO_FOLLOW, CoworkConfigSchema, CoworkConfigError;
-var init_config = __esm({
-  "src/config.ts"() {
-    "use strict";
-    init_zod();
-    init_contracts();
-    DIRECTORY_MODE = 448;
-    FILE_MODE = 384;
-    NO_FOLLOW = nodeFs.constants.O_NOFOLLOW ?? 0;
-    CoworkConfigSchema = external_exports.object({
-      version: external_exports.literal(1),
-      stateDir: external_exports.string().min(1),
-      roomIdentity: external_exports.object({
-        nameMode: RoomIdentityNameModeSchema
-      }).strict().default({ nameMode: "stable_id" }),
-      rest: external_exports.object({
-        enabled: external_exports.boolean(),
-        port: external_exports.number().int().min(1).max(65535)
-      }).strict()
-    }).strict();
-    CoworkConfigError = class extends Error {
-      constructor(message, options) {
-        super(message, options);
-        this.name = "CoworkConfigError";
-      }
-    };
+function refineMessageCategory(message, context) {
+  const requires = (field, present) => {
+    if (present && message[field] === void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `${message.category} messages require ${field}`
+      });
+    }
+    if (!present && message[field] !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [field],
+        message: `${field} is forbidden on ${message.category} messages`
+      });
+    }
+  };
+  requires("briefing_role", message.category === "role_briefing");
+  requires("membership", message.category === "membership");
+  if (message.category === "role_briefing" && message.briefing_version === void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["briefing_version"],
+      message: "role_briefing messages require briefing_version"
+    });
   }
-});
-
-// src/ours-runtime.ts
-import { randomBytes } from "node:crypto";
-function createOursHost(_config, log = () => {
-}) {
-  return new SharedOursHost(log);
-}
-function sleep(ms, signal) {
-  return new Promise((resolveSleep) => {
-    const timer = setTimeout(finish, ms);
-    signal.addEventListener("abort", finish, { once: true });
-    function finish() {
-      clearTimeout(timer);
-      signal.removeEventListener("abort", finish);
-      resolveSleep();
+  if (message.category === "chat" || message.category === "membership") {
+    if (message.briefing_version !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["briefing_version"],
+        message: `briefing_version is forbidden on ${message.category} messages`
+      });
     }
-  });
+  }
 }
-var WATCH_RETRY_MIN_MS, WATCH_RETRY_MAX_MS, STATE_RESYNC_INTERVAL_MS, attachSharedClient, SharedOursHost;
-var init_ours_runtime = __esm({
-  "src/ours-runtime.ts"() {
+var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, RoleSchema, ROOM_ROLE, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, ContainerIdSchema, AcceptExternalInviteInputSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
+var init_contracts = __esm({
+  "src/contracts.ts"() {
     "use strict";
-    WATCH_RETRY_MIN_MS = 500;
-    WATCH_RETRY_MAX_MS = 3e4;
-    STATE_RESYNC_INTERVAL_MS = 2e3;
-    attachSharedClient = async (options) => {
-      const { attachOursClient } = await import("@ours.network/sdk");
-      return attachOursClient(options);
-    };
-    SharedOursHost = class {
-      log;
-      attach;
-      listeners = /* @__PURE__ */ new Set();
-      watchers = /* @__PURE__ */ new Map();
-      watchLeaseToken = `cowork-watch-${randomBytes(16).toString("hex")}`;
-      watchClient;
-      resyncTimer;
-      closed = false;
-      constructor(log = () => {
-      }, attach = attachSharedClient) {
-        this.log = log;
-        this.attach = attach;
-      }
-      async boot() {
-        if (this.watchClient) return;
-        if (this.closed) throw new Error("shared ours daemon host cannot restart in the same process");
-        this.watchClient = await this.attach({ leaseToken: this.watchLeaseToken });
+    init_zod();
+    MAX_TEXT_BYTES = 262144;
+    MAX_FILE_BYTES = 2 * 1024 * 1024;
+    MAX_HISTORY_PAGE_BYTES = 3 * 1024 * 1024;
+    MAX_MANAGEMENT_RESPONSE_BYTES = MAX_HISTORY_PAGE_BYTES + 1024 * 1024;
+    MAX_EXTERNAL_INVITE_BYTES = 48 * 1024;
+    MAX_FILE_NAME_BYTES = 255;
+    MAX_MIME_BYTES = 255;
+    MAX_ROLE_BYTES = 256;
+    MAX_ROOM_NAME_CHARACTERS = 64;
+    NonEmptyStringSchema = external_exports.string().min(1);
+    PositiveSafeIntegerSchema = external_exports.number().int().positive().safe();
+    LowerCrockfordUlidSchema = external_exports.string().regex(
+      /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
+      "must be a 26-character lowercase Crockford ULID"
+    );
+    Rfc3339Schema = external_exports.string().refine(isStrictRfc3339, "must be a valid RFC3339 timestamp");
+    RoomNameSchema = external_exports.string().refine(
+      (value) => !/[\p{Cc}\p{Cf}]/u.test(value),
+      "room name must not contain Unicode control or format characters"
+    ).transform(normalizeRoomName).superRefine((value, context) => {
+      const length = Array.from(value).length;
+      if (length < 1 || length > MAX_ROOM_NAME_CHARACTERS) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: `room name must contain 1-${MAX_ROOM_NAME_CHARACTERS} Unicode characters after normalization`
+        });
       }
-      async createClient(leaseToken = `cowork-${randomBytes(16).toString("hex")}`) {
-        if (!this.watchClient) throw new Error("shared ours daemon host is not booted");
-        return this.attach({ leaseToken });
+    });
+    ROOM_IDENTITY_PREFIX = "ours-cowork:";
+    RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
+    ROOM_ROLE = "room";
+    MissionTextSchema = utf8Bounded("mission text", MAX_TEXT_BYTES);
+    MessageTextSchema = utf8Bounded("message text", MAX_TEXT_BYTES);
+    FileNameSchema = utf8Bounded("file name", MAX_FILE_NAME_BYTES).refine((value) => value !== "." && value !== "..", "file name must not be a relative path token").refine((value) => !/[\x00/\\]/.test(value), "file name must be a single path-free name");
+    FileMimeSchema = external_exports.string().refine(
+      (value) => Buffer.byteLength(value, "utf8") <= MAX_MIME_BYTES,
+      `file MIME metadata must be at most ${MAX_MIME_BYTES} UTF-8 bytes`
+    );
+    RoomStateSchema = external_exports.enum(["provisioning", "active", "closing", "closed"]);
+    SeatStateSchema = external_exports.enum(["pending", "active", "removed"]);
+    InviteModeSchema = external_exports.enum(["one_time", "public"]);
+    DEFAULT_ROLE = "Participant";
+    InviteStateSchema = external_exports.enum([
+      "live",
+      "consumed",
+      "revoked",
+      "replacement_required",
+      "receipt_pending"
+    ]);
+    RelayStatusSchema = external_exports.enum(["queued", "send_failed"]);
+    SeatV1Schema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema,
+      invite_id: NonEmptyStringSchema,
+      accepted_at: Rfc3339Schema
+    }).strict();
+    SeatSchema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema,
+      invite_id: NonEmptyStringSchema,
+      accepted_at: Rfc3339Schema.optional(),
+      requested_at: Rfc3339Schema.optional(),
+      invite_sha256: external_exports.string().regex(/^[0-9a-f]{64}$/).optional(),
+      participant_id: LowerCrockfordUlidSchema,
+      state: SeatStateSchema,
+      alias: NonEmptyStringSchema.optional(),
+      removed_at: Rfc3339Schema.optional(),
+      removed_epoch: external_exports.number().int().nonnegative().safe().optional(),
+      replaces_seat: LowerCrockfordUlidSchema.optional(),
+      bounced_at: Rfc3339Schema.optional()
+    }).strict().superRefine((seat, context) => {
+      if (seat.state === "pending") {
+        for (const field of ["requested_at", "invite_sha256"]) {
+          if (seat[field] === void 0) {
+            context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `pending seats require ${field}` });
+          }
+        }
+        for (const field of ["accepted_at", "removed_at", "removed_epoch", "bounced_at"]) {
+          if (seat[field] !== void 0) {
+            context.addIssue({ code: external_exports.ZodIssueCode.custom, path: [field], message: `${field} is forbidden on pending seats` });
+          }
+        }
+      } else if (seat.state === "removed") {
+        if (seat.accepted_at === void 0 && seat.requested_at === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["accepted_at"],
+            message: "removed seats require accepted_at unless they are cancelled external admissions"
+          });
+        }
+        if (seat.removed_at === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["removed_at"],
+            message: "removed seats require removed_at"
+          });
+        }
+        if (seat.removed_epoch === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["removed_epoch"],
+            message: "removed seats require removed_epoch"
+          });
+        }
+      } else {
+        if (seat.accepted_at === void 0) {
+          context.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["accepted_at"], message: "active seats require accepted_at" });
+        }
+        for (const field of ["removed_at", "removed_epoch", "bounced_at"]) {
+          if (seat[field] !== void 0) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [field],
+              message: `${field} is reserved for removed seats`
+            });
+          }
+        }
       }
-      async listIdentityNames(localNames) {
-        if (!this.watchClient) throw new Error("shared ours daemon host is not booted");
-        const rows = await this.watchClient.identities();
-        return new Set(rows.flatMap((row) => localNames.has(row.name) ? [row.name] : []));
+      if (seat.requested_at === void 0 !== (seat.invite_sha256 === void 0)) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["invite_sha256"],
+          message: "external admission metadata requires both requested_at and invite_sha256"
+        });
       }
-      onIdentityNotify(listener) {
-        this.listeners.add(listener);
-        return () => this.listeners.delete(listener);
+    });
+    RoomInviteSchema = external_exports.object({
+      invite_id: NonEmptyStringSchema,
+      mode: InviteModeSchema,
+      role: RoleSchema,
+      min_accepts: PositiveSafeIntegerSchema,
+      accepted_cids: external_exports.array(NonEmptyStringSchema),
+      state: InviteStateSchema,
+      recovery_of: NonEmptyStringSchema.optional(),
+      recovery_confirmed: external_exports.boolean().optional(),
+      created_at: Rfc3339Schema,
+      replaces_seat: LowerCrockfordUlidSchema.optional()
+    }).strict().superRefine((invite, context) => {
+      if (invite.mode === "one_time" && invite.min_accepts !== 1) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["min_accepts"],
+          message: "one_time invites require min_accepts === 1"
+        });
       }
-      trackIdentity(identityName) {
-        if (!this.watchClient) throw new Error("shared ours daemon host is not booted");
-        const existing = this.watchers.get(identityName);
-        if (existing) return () => this.untrack(identityName, existing);
-        const controller = new AbortController();
-        const watcher = { controller, work: Promise.resolve() };
-        watcher.work = this.follow(identityName, controller.signal);
-        this.watchers.set(identityName, watcher);
-        this.announce(identityName);
-        this.ensureStateResync();
-        return () => this.untrack(identityName, watcher);
+      if (invite.state === "receipt_pending" && invite.recovery_of === void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_of"],
+          message: "receipt_pending invites require recovery_of"
+        });
       }
-      close() {
+      if (invite.recovery_of === void 0 && invite.recovery_confirmed !== void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "recovery_confirmed is forbidden without recovery_of"
+        });
       }
-      async shutdown() {
-        if (this.closed) return { requiresProcessExit: false };
-        this.closed = true;
-        this.listeners.clear();
-        this.stopStateResync();
-        const watchers = [...this.watchers.values()];
-        this.watchers.clear();
-        for (const watcher of watchers) watcher.controller.abort();
-        await Promise.allSettled(watchers.map((watcher) => watcher.work));
-        const client = this.watchClient;
-        this.watchClient = void 0;
-        if (client) await client.releaseLease();
-        return { requiresProcessExit: false };
+      if (invite.recovery_of !== void 0 && invite.recovery_confirmed === void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "recovery_confirmed is required with recovery_of"
+        });
       }
-      untrack(identityName, watcher) {
-        if (this.watchers.get(identityName) !== watcher) return;
-        this.watchers.delete(identityName);
-        watcher.controller.abort();
-        if (this.watchers.size === 0) this.stopStateResync();
+      if (invite.state === "receipt_pending" && invite.recovery_confirmed !== false) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "receipt_pending recovery lineage must be unconfirmed"
+        });
       }
-      ensureStateResync() {
-        if (this.resyncTimer) return;
-        this.resyncTimer = setInterval(() => {
-          for (const identityName of this.watchers.keys()) this.announce(identityName);
-        }, STATE_RESYNC_INTERVAL_MS);
-        this.resyncTimer.unref();
+      if (invite.recovery_of !== void 0 && (invite.state === "live" || invite.state === "consumed" || invite.state === "replacement_required") && invite.recovery_confirmed !== true) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["recovery_confirmed"],
+          message: "live, consumed, and replacement_required recovery lineage must be confirmed"
+        });
       }
-      stopStateResync() {
-        if (!this.resyncTimer) return;
-        clearInterval(this.resyncTimer);
-        this.resyncTimer = void 0;
+      if (invite.state === "receipt_pending" && invite.accepted_cids.length > 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["accepted_cids"],
+          message: "receipt_pending invites cannot have accepted CIDs"
+        });
       }
+    });
+    MissionV1Schema = external_exports.object({
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema
+    }).strict();
+    MissionSchema = external_exports.object({
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema,
+      briefing_version: PositiveSafeIntegerSchema
+    }).strict();
+    RoleBriefingSchema = external_exports.object({
+      text: MissionTextSchema,
+      version: PositiveSafeIntegerSchema,
+      updated_at: Rfc3339Schema
+    }).strict();
+    RoomCommonShape = {
+      room_id: LowerCrockfordUlidSchema,
+      identity_name: NonEmptyStringSchema,
+      identity_cid: external_exports.string(),
+      state: RoomStateSchema,
+      status: NonEmptyStringSchema.optional(),
+      invites: external_exports.array(RoomInviteSchema),
+      created_at: Rfc3339Schema,
+      activated_at: Rfc3339Schema.optional(),
+      closed_at: Rfc3339Schema.optional()
+    };
+    RoomV1Schema = external_exports.object({
+      ...RoomCommonShape,
+      version: external_exports.literal(1),
+      mission: MissionV1Schema,
+      seats: external_exports.array(SeatV1Schema)
+    }).strict().superRefine(refineRoomLineage);
+    CurrentRoomSchema = external_exports.object({
+      ...RoomCommonShape,
+      room_name: RoomNameSchema,
+      version: external_exports.literal(2),
+      mission: MissionSchema,
+      role_briefings: external_exports.record(RoleSchema, RoleBriefingSchema),
       /**
-       * Long-poll one identity forever, reconnecting with bounded backoff.
-       *
-       * A replacement stream primes at the daemon tip, so each reconnection also
-       * requests a full state resync. The periodic resync above covers the small
-       * request-prime race and daemon transitions that are not in the structured
-       * notification log; reconciliation is idempotent and self-coalescing.
+       * Roles a REST caller may author under. A plain array of names:
+       * the role name IS the identifier, so there is nothing per-role to store.
+       * Not a seat, not a membership: seat and membership invariants do not apply.
+       * The registry itself is an exact-name set, and reserves `room` for the
+       * room's own voice.
        */
-      async follow(identityName, signal) {
-        let backoffMs = WATCH_RETRY_MIN_MS;
-        let resyncPending = false;
-        while (!signal.aborted) {
-          const client = this.watchClient;
-          if (!client) return;
-          try {
-            const stream = client.watchNotifications(identityName, { signal });
-            let step = stream.next();
-            if (resyncPending) {
-              resyncPending = false;
-              this.announce(identityName);
-            }
-            for (let settled = await step; !settled.done; settled = await step) {
-              backoffMs = WATCH_RETRY_MIN_MS;
-              this.announce(identityName);
-              step = stream.next();
-            }
-            if (!signal.aborted) {
-              resyncPending = true;
-              this.log(`[${identityName}] shared ours daemon notification watch ended; reconnecting`);
-            }
-          } catch (error) {
-            if (signal.aborted) return;
-            resyncPending = true;
-            this.log(`[${identityName}] shared ours daemon notification watch failed:`, error);
+      rest_roles: external_exports.array(RoleSchema).superRefine((roles, context) => {
+        const seen = /* @__PURE__ */ new Set();
+        for (const [index, role] of roles.entries()) {
+          if (role === ROOM_ROLE) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [index],
+              message: `role "${ROOM_ROLE}" is reserved for the room's own voice`
+            });
           }
-          if (signal.aborted) return;
-          await sleep(backoffMs, signal);
-          backoffMs = Math.min(backoffMs * 2, WATCH_RETRY_MAX_MS);
+          if (seen.has(role)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [index],
+              message: "REST role names must be unique within the room"
+            });
+          }
+          seen.add(role);
+        }
+      }),
+      anonymous: external_exports.boolean(),
+      quiet_membership: external_exports.boolean(),
+      membership_epoch: external_exports.number().int().nonnegative().safe(),
+      seats: external_exports.array(SeatSchema)
+    }).strict().superRefine((room, context) => {
+      refineRoomLineage(room, context);
+      const byParticipant = /* @__PURE__ */ new Map();
+      const activeAliases = /* @__PURE__ */ new Set();
+      const authorizedCids = /* @__PURE__ */ new Set();
+      for (const [index, seat] of room.seats.entries()) {
+        if (byParticipant.has(seat.participant_id)) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "participant_id"],
+            message: "participant_id must be unique within the room"
+          });
+        }
+        byParticipant.set(seat.participant_id, seat);
+        if (seat.state === "pending" || seat.state === "active") {
+          if (authorizedCids.has(seat.identity)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: ["seats", index, "identity"],
+              message: "at most one pending or active seat may exist per CID"
+            });
+          }
+          authorizedCids.add(seat.identity);
+        }
+        if (room.anonymous && seat.alias === void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "anonymous rooms require an alias on every seat"
+          });
+        }
+        if (!room.anonymous && seat.alias !== void 0) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "aliases are reserved for anonymous rooms"
+          });
+        }
+        if (seat.state === "active" && seat.alias !== void 0) {
+          if (activeAliases.has(seat.alias)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: ["seats", index, "alias"],
+              message: "active seats must hold distinct aliases"
+            });
+          }
+          activeAliases.add(seat.alias);
+        }
+        if (seat.removed_epoch !== void 0 && seat.removed_epoch > room.membership_epoch) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "removed_epoch"],
+            message: "removed_epoch cannot exceed the room membership_epoch"
+          });
+        }
+      }
+      for (const [index, seat] of room.seats.entries()) {
+        if (seat.replaces_seat === void 0) continue;
+        const predecessor = byParticipant.get(seat.replaces_seat);
+        if (!predecessor || predecessor === seat || predecessor.state !== "removed") {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "replaces_seat"],
+            message: "replaces_seat must reference a removed seat in this room"
+          });
+          continue;
+        }
+        if (predecessor.role !== seat.role) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "role"],
+            message: "a replacement seat must inherit the predecessor role"
+          });
+        }
+        if (room.anonymous && seat.alias !== predecessor.alias) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["seats", index, "alias"],
+            message: "an anonymous replacement seat must inherit the predecessor alias"
+          });
+        }
+      }
+    });
+    RoomSchema = external_exports.preprocess((value) => {
+      if (typeof value !== "object" || value === null) return value;
+      const patch = {};
+      if (!Object.hasOwn(value, "room_name")) {
+        const roomId = value.room_id;
+        if (typeof roomId === "string" && LowerCrockfordUlidSchema.safeParse(roomId).success) {
+          patch.room_name = defaultRoomName(roomId);
+        }
+      }
+      if (!Object.hasOwn(value, "rest_roles")) patch.rest_roles = [];
+      if (Object.keys(patch).length === 0) return value;
+      return { ...value, ...patch };
+    }, CurrentRoomSchema);
+    CreateRoomInputSchema = external_exports.object({
+      name: RoomNameSchema.optional(),
+      goal: MissionTextSchema,
+      briefing: MissionTextSchema,
+      anonymous: external_exports.boolean().optional(),
+      quiet_membership: external_exports.boolean().optional()
+    }).strict();
+    UpdateRoomInputSchema = external_exports.object({
+      name: RoomNameSchema.optional(),
+      goal: MissionTextSchema.optional(),
+      briefing: MissionTextSchema.optional(),
+      status: NonEmptyStringSchema.optional(),
+      quiet_membership: external_exports.boolean().optional()
+    }).strict().refine((input) => Object.keys(input).length > 0, "at least one setting is required");
+    RoleBriefingSetInputSchema = external_exports.object({
+      role: RoleSchema,
+      text: MissionTextSchema
+    }).strict();
+    RoleBriefingDeleteInputSchema = external_exports.object({
+      role: RoleSchema
+    }).strict();
+    PostMessageInputSchema = external_exports.object({
+      text: MessageTextSchema
+    }).strict();
+    PostAsRoleInputSchema = external_exports.object({
+      role: RoleSchema,
+      text: MessageTextSchema
+    }).strict();
+    RestRoleInputSchema = external_exports.object({
+      role: RoleSchema
+    }).strict();
+    ContainerIdSchema = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
+    AcceptExternalInviteInputSchema = external_exports.object({
+      role: RoleSchema,
+      invite: external_exports.string().refine(
+        (value) => Buffer.byteLength(value, "utf8") <= MAX_EXTERNAL_INVITE_BYTES,
+        `invite input must be at most ${MAX_EXTERNAL_INVITE_BYTES} UTF-8 bytes`
+      ),
+      expected_cid: ContainerIdSchema.optional(),
+      replaces_seat: LowerCrockfordUlidSchema.optional()
+    }).strict();
+    AuthorSnapshotSchema = external_exports.object({
+      identity: NonEmptyStringSchema,
+      display_name: NonEmptyStringSchema,
+      role: RoleSchema
+    }).strict();
+    RecordCommonShape = {
+      version: external_exports.literal(1),
+      room_id: LowerCrockfordUlidSchema,
+      seq: PositiveSafeIntegerSchema,
+      record_id: NonEmptyStringSchema,
+      at: Rfc3339Schema
+    };
+    AppendCommonShape = {
+      version: external_exports.literal(1),
+      room_id: LowerCrockfordUlidSchema,
+      at: Rfc3339Schema
+    };
+    MembershipNoticeSchema = external_exports.object({
+      action: external_exports.enum(["remove"]),
+      alias: NonEmptyStringSchema.optional(),
+      role: RoleSchema.optional(),
+      epoch: external_exports.number().int().nonnegative().safe()
+    }).strict();
+    AuthorAliasSchema = external_exports.object({
+      participant_id: LowerCrockfordUlidSchema,
+      alias: NonEmptyStringSchema
+    }).strict();
+    ReplyReferenceSchema = external_exports.object({
+      wire_id: NonEmptyStringSchema,
+      sentence: PositiveSafeIntegerSchema.optional()
+    }).strict();
+    MessageShape = {
+      kind: external_exports.literal("message"),
+      message_id: LowerCrockfordUlidSchema,
+      author: AuthorSnapshotSchema,
+      author_alias: AuthorAliasSchema.optional(),
+      category: external_exports.enum(["briefing", "role_briefing", "chat", "membership"]),
+      briefing_role: RoleSchema.optional(),
+      briefing_version: PositiveSafeIntegerSchema.optional(),
+      membership: MembershipNoticeSchema.optional(),
+      text: MessageTextSchema,
+      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
+        const seen = /* @__PURE__ */ new Set();
+        for (const [index, identity] of identities.entries()) {
+          if (seen.has(identity)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [index],
+              message: "recipient identities must be unique"
+            });
+          }
+          seen.add(identity);
         }
-      }
-      announce(identityName) {
-        for (const listener of this.listeners) {
-          try {
-            listener(identityName);
-          } catch (error) {
-            this.log(`cowork SDK notification listener failed for ${identityName}:`, error);
+      }),
+      source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
+      source_wire_id: NonEmptyStringSchema.optional(),
+      source_reply_to: ReplyReferenceSchema.optional()
+    };
+    RelayIntentShape = {
+      kind: external_exports.literal("relay_intent"),
+      message_id: LowerCrockfordUlidSchema.optional(),
+      file_id: LowerCrockfordUlidSchema.optional(),
+      recipient_identity: NonEmptyStringSchema
+    };
+    RelayResultStatusSchema = external_exports.enum(["queued", "send_failed", "skipped_removed"]);
+    RelayResultShape = {
+      kind: external_exports.literal("relay_result"),
+      intent_record_id: NonEmptyStringSchema,
+      message_id: LowerCrockfordUlidSchema.optional(),
+      file_id: LowerCrockfordUlidSchema.optional(),
+      recipient_identity: NonEmptyStringSchema,
+      status: RelayResultStatusSchema,
+      wire_id: NonEmptyStringSchema.optional(),
+      metadata_wire_id: NonEmptyStringSchema.optional()
+    };
+    FileShape = {
+      kind: external_exports.literal("file"),
+      file_id: LowerCrockfordUlidSchema,
+      author: AuthorSnapshotSchema,
+      author_alias: AuthorAliasSchema.optional(),
+      filename: FileNameSchema,
+      mime: FileMimeSchema,
+      size: external_exports.number().int().nonnegative().max(MAX_FILE_BYTES),
+      sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+      data_base64: external_exports.string(),
+      recipient_identities: external_exports.array(NonEmptyStringSchema).superRefine((identities, context) => {
+        const seen = /* @__PURE__ */ new Set();
+        for (const [index, identity] of identities.entries()) {
+          if (seen.has(identity)) {
+            context.addIssue({
+              code: external_exports.ZodIssueCode.custom,
+              path: [index],
+              message: "recipient identities must be unique"
+            });
           }
+          seen.add(identity);
         }
-      }
+      }),
+      source_file_id: external_exports.number().int().nonnegative().safe(),
+      source_wire_id: NonEmptyStringSchema.optional(),
+      source_reply_to: ReplyReferenceSchema.optional()
+    };
+    MembershipIntentShape = {
+      kind: external_exports.literal("membership_intent"),
+      action: external_exports.enum(["remove"]),
+      participant_id: LowerCrockfordUlidSchema,
+      recipient_identity: NonEmptyStringSchema,
+      role: RoleSchema,
+      alias: NonEmptyStringSchema.optional(),
+      epoch: PositiveSafeIntegerSchema,
+      notify: external_exports.boolean()
+    };
+    MembershipResultShape = {
+      kind: external_exports.literal("membership_result"),
+      intent_record_id: NonEmptyStringSchema,
+      participant_id: LowerCrockfordUlidSchema,
+      status: RelayStatusSchema,
+      notified: external_exports.boolean(),
+      key_material_retained: external_exports.literal(true),
+      uncertain_after_restart: external_exports.literal(true).optional()
+    };
+    CloseNoticeIntentShape = {
+      kind: external_exports.literal("close_notice_intent"),
+      recipient_identity: NonEmptyStringSchema
     };
+    CloseNoticeResultShape = {
+      kind: external_exports.literal("close_notice_result"),
+      intent_record_id: NonEmptyStringSchema,
+      recipient_identity: NonEmptyStringSchema,
+      status: RelayStatusSchema,
+      notified: external_exports.boolean(),
+      key_material_retained: external_exports.literal(true),
+      uncertain_after_restart: external_exports.literal(true).optional()
+    };
+    MessageRecordSchema = external_exports.object({ ...RecordCommonShape, ...MessageShape }).strict();
+    FileRecordSchema = external_exports.object({ ...RecordCommonShape, ...FileShape }).strict();
+    RelayIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayIntentShape }).strict();
+    RelayResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayResultShape }).strict();
+    MembershipIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipIntentShape }).strict();
+    MembershipResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipResultShape }).strict();
+    CloseNoticeIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeIntentShape }).strict();
+    CloseNoticeResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeResultShape }).strict();
+    RawCommunicationRecordSchema = external_exports.discriminatedUnion("kind", [
+      MessageRecordSchema,
+      FileRecordSchema,
+      RelayIntentRecordSchema,
+      RelayResultRecordSchema,
+      MembershipIntentRecordSchema,
+      MembershipResultRecordSchema,
+      CloseNoticeIntentRecordSchema,
+      CloseNoticeResultRecordSchema
+    ]);
+    CommunicationRecordSchema = RawCommunicationRecordSchema.superRefine((record, context) => {
+      if (record.record_id !== `${record.room_id}:${record.seq}`) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["record_id"],
+          message: 'record_id must equal room_id + ":" + seq'
+        });
+      }
+      if (record.kind === "message") refineMessageCategory(record, context);
+      refineRelaySubject(record, context);
+      refineFileRecord(record, context);
+    });
+    AppendRecordSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ ...AppendCommonShape, ...MessageShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...FileShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...RelayIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...RelayResultShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...MembershipIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...MembershipResultShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...CloseNoticeIntentShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...CloseNoticeResultShape }).strict()
+    ]).superRefine((record, context) => {
+      if (record.kind === "message") refineMessageCategory(record, context);
+      refineRelaySubject(record, context);
+      refineFileRecord(record, context);
+    });
   }
 });
 
@@ -5464,7 +5432,7 @@ var init_packets = __esm({
       get(roomId) {
         return this.packets.get(roomId);
       }
-      async create(roomId, identityName = `ours-cowork-${roomId}`, bio = `ours-cowork mission room ${roomId}`) {
+      async create(roomId, identityName, bio = `ours-cowork mission room ${roomId}`) {
         validateRoomId(roomId);
         this.assertStandardIdentity(roomId, identityName);
         this.assertNoLegacyState(roomId);
@@ -5496,7 +5464,7 @@ var init_packets = __esm({
           throw new Error(`failed to provision standard SDK identity for room "${roomId}"`, { cause: error });
         }
       }
-      async restore(roomId, expectedCid, identityName = `ours-cowork-${roomId}`) {
+      async restore(roomId, expectedCid, identityName) {
         validateRoomId(roomId);
         this.assertStandardIdentity(roomId, identityName);
         this.assertNoLegacyState(roomId);
@@ -5768,6 +5736,20 @@ function sameReply2(stored, observed) {
   if (stored === void 0 || observed == null) return stored === void 0 && observed == null;
   return stored.wire_id === observed.wire_id && stored.sentence === observed.sentence;
 }
+async function queryStore(store, roomId, options) {
+  if (store.query) return store.query(roomId, options);
+  let records = await store.read(roomId);
+  records = records.filter((record) => {
+    const value = record;
+    return (options.kind === void 0 || record.kind === options.kind) && (options.messageId === void 0 || value.message_id === options.messageId) && (options.fileId === void 0 || value.file_id === options.fileId) && (options.sourceMsgId === void 0 || value.source_msg_id === options.sourceMsgId) && (options.sourceFileId === void 0 || value.source_file_id === options.sourceFileId) && (options.recipientIdentity === void 0 || value.recipient_identity === options.recipientIdentity);
+  });
+  if (options.unresolvedResultKind) {
+    const completed = new Set((await store.read(roomId)).filter((record) => record.kind === options.unresolvedResultKind).map((record) => record.intent_record_id));
+    records = records.filter((record) => !completed.has(record.record_id));
+  }
+  if (options.descending) records.reverse();
+  return records.slice(0, options.limit);
+}
 function canonicalValue(value) {
   if (Array.isArray(value)) return value.map(canonicalValue);
   if (value !== null && typeof value === "object") {
@@ -5795,13 +5777,14 @@ function wireKind(category) {
       return "room_msg";
   }
 }
-var INTAKE_BATCH_SIZE, IntakePump;
+var JOURNAL_WORK_BATCH_SIZE, INTAKE_BATCH_SIZE, IntakePump;
 var init_intake = __esm({
   "src/intake.ts"() {
     "use strict";
     init_zod();
     init_contracts();
     init_ulid();
+    JOURNAL_WORK_BATCH_SIZE = 64;
     INTAKE_BATCH_SIZE = 32;
     IntakePump = class {
       store;
@@ -5909,8 +5892,8 @@ var init_intake = __esm({
           await packet.acknowledgeFile(item);
           return;
         }
-        const records = await this.store.read(roomId);
-        let file = this.findSourceFile(records, item);
+        const [storedFile] = await queryStore(this.store, roomId, { kind: "file", sourceFileId: item.file_id, limit: 1 });
+        let file = this.findSourceFile(storedFile === void 0 ? [] : [storedFile], item);
         if (!file) {
           const recipientIdentities = unique(room.seats.filter((recipient) => recipient.state === "active").map((recipient) => recipient.identity).filter((identity) => identity !== seat.identity));
           const bytes = Buffer.from(item.data);
@@ -5948,8 +5931,8 @@ var init_intake = __esm({
           if (acknowledge) await this.acknowledgeMessage(roomId, packet, item);
           return;
         }
-        const before = await this.store.read(roomId);
-        let message = this.findSourceMessage(before, item);
+        const [storedMessage] = await queryStore(this.store, roomId, { kind: "message", sourceMsgId: item.msg_id, limit: 1 });
+        let message = this.findSourceMessage(storedMessage === void 0 ? [] : [storedMessage], item);
         if (!message) {
           const recipientIdentities = unique(room.seats.filter((recipient) => recipient.state === "active").map((recipient) => recipient.identity).filter((identity) => identity !== seat.identity));
           const appended = await this.store.append(roomId, {
@@ -6012,100 +5995,153 @@ var init_intake = __esm({
         }
       }
       async completeSnapshotIntents(roomId) {
-        const records = await this.store.read(roomId);
-        for (const message of records.filter(
-          (record) => record.kind === "message"
-        )) await this.completeMessageIntents(roomId, message);
-        for (const file of records.filter(
-          (record) => record.kind === "file"
-        )) await this.completeFileIntents(roomId, file);
+        if (!this.store.recordsNeedingRelayIntents) {
+          const records = await this.store.read(roomId);
+          for (const message of records.filter(
+            (record) => record.kind === "message"
+          )) await this.completeMessageIntents(roomId, message);
+          for (const file of records.filter(
+            (record) => record.kind === "file"
+          )) await this.completeFileIntents(roomId, file);
+          return;
+        }
+        for (; ; ) {
+          const records = await this.store.recordsNeedingRelayIntents(
+            roomId,
+            { limit: JOURNAL_WORK_BATCH_SIZE }
+          );
+          if (records.length === 0) return;
+          for (const record of records) {
+            if (record.kind === "message") await this.completeMessageIntents(roomId, record);
+            else if (record.kind === "file") await this.completeFileIntents(roomId, record);
+          }
+        }
       }
       async completeFileIntents(roomId, file) {
-        const records = await this.store.read(roomId);
-        const intended = new Set(records.filter((record) => record.kind === "relay_intent" && record.file_id === file.file_id).map((intent) => intent.recipient_identity));
+        if (this.store.relayRecipientsNeedingIntent) {
+          for (const recipientIdentity of await this.store.relayRecipientsNeedingIntent(roomId, file.seq)) {
+            await this.appendFileIntent(roomId, file.file_id, recipientIdentity);
+          }
+          return;
+        }
+        const records = await queryStore(this.store, roomId, { kind: "relay_intent", fileId: file.file_id });
+        const intended = new Set(records.map((record) => record.recipient_identity));
         for (const recipientIdentity of file.recipient_identities) {
           if (intended.has(recipientIdentity)) continue;
-          await this.store.append(roomId, {
-            version: 1,
-            kind: "relay_intent",
-            room_id: roomId,
-            at: this.now(),
-            file_id: file.file_id,
-            recipient_identity: recipientIdentity
-          });
+          await this.appendFileIntent(roomId, file.file_id, recipientIdentity);
           intended.add(recipientIdentity);
         }
       }
+      async appendFileIntent(roomId, fileId, recipientIdentity) {
+        await this.store.append(roomId, {
+          version: 1,
+          kind: "relay_intent",
+          room_id: roomId,
+          at: this.now(),
+          file_id: fileId,
+          recipient_identity: recipientIdentity
+        });
+      }
       async completeMessageIntents(roomId, message) {
-        const records = await this.store.read(roomId);
-        const intended = new Set(records.filter((record) => record.kind === "relay_intent" && record.message_id === message.message_id).map((intent) => intent.recipient_identity));
+        if (this.store.relayRecipientsNeedingIntent) {
+          for (const recipientIdentity of await this.store.relayRecipientsNeedingIntent(roomId, message.seq)) {
+            await this.appendMessageIntent(roomId, message.message_id, recipientIdentity);
+          }
+          return;
+        }
+        const records = await queryStore(this.store, roomId, { kind: "relay_intent", messageId: message.message_id });
+        const intended = new Set(records.map((record) => record.recipient_identity));
         for (const recipientIdentity of message.recipient_identities) {
           if (intended.has(recipientIdentity)) continue;
-          await this.store.append(roomId, {
-            version: 1,
-            kind: "relay_intent",
-            room_id: roomId,
-            at: this.now(),
-            message_id: message.message_id,
-            recipient_identity: recipientIdentity
-          });
+          await this.appendMessageIntent(roomId, message.message_id, recipientIdentity);
           intended.add(recipientIdentity);
         }
       }
+      async appendMessageIntent(roomId, messageId, recipientIdentity) {
+        await this.store.append(roomId, {
+          version: 1,
+          kind: "relay_intent",
+          room_id: roomId,
+          at: this.now(),
+          message_id: messageId,
+          recipient_identity: recipientIdentity
+        });
+      }
       async relayPendingUnlocked(roomId, packet) {
-        const records = await this.store.read(roomId);
         const room = await this.store.load(roomId);
         const activeCids = new Set(room.seats.filter((seat) => seat.state === "active").map((seat) => seat.identity));
         const removedCids = new Set(room.seats.filter((seat) => seat.state === "removed").map((seat) => seat.identity));
-        const messages = new Map(records.filter((record) => record.kind === "message").map((message) => [message.message_id, message]));
-        const files = new Map(records.filter((record) => record.kind === "file").map((file) => [file.file_id, file]));
-        const completed = new Set(records.filter((record) => record.kind === "relay_result").map((result) => result.kind === "relay_result" ? result.intent_record_id : ""));
-        for (const intent of records.filter(
-          (record) => record.kind === "relay_intent"
-        )) {
-          if (completed.has(intent.record_id)) continue;
-          const message = intent.message_id === void 0 ? void 0 : messages.get(intent.message_id);
-          const file = intent.file_id === void 0 ? void 0 : files.get(intent.file_id);
-          if (message === void 0 === (file === void 0)) continue;
-          const recipients = message?.recipient_identities ?? file.recipient_identities;
-          if (!recipients.includes(intent.recipient_identity)) continue;
-          if (!activeCids.has(intent.recipient_identity) && removedCids.has(intent.recipient_identity)) {
-            const skipped = await this.store.append(roomId, {
-              version: 1,
-              kind: "relay_result",
-              room_id: roomId,
-              at: this.now(),
-              intent_record_id: intent.record_id,
-              ...intent.message_id === void 0 ? {} : { message_id: intent.message_id },
-              ...intent.file_id === void 0 ? {} : { file_id: intent.file_id },
-              recipient_identity: intent.recipient_identity,
-              status: "skipped_removed"
-            });
-            if (skipped.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
-            completed.add(intent.record_id);
-            continue;
-          }
-          if (file !== void 0) {
-            const author = file.author_alias === void 0 ? file.author : {
-              identity: file.author_alias.participant_id,
-              display_name: file.author_alias.alias,
-              role: file.author.role
-            };
-            const metadata = await sendRoomBody(packet, intent.recipient_identity, {
-              version: 1,
-              kind: "room_file",
-              room_id: roomId,
-              room_name: room.room_name,
-              file_id: file.file_id,
-              author,
-              filename: file.filename,
-              mime: file.mime,
-              size: file.size,
-              sha256: file.sha256,
-              at: file.at
-            });
-            if (metadata.status === "send_failed") {
-              const failed = await this.store.append(roomId, {
+        let after = 0;
+        for (; ; ) {
+          const pending = await queryStore(this.store, roomId, {
+            kind: "relay_intent",
+            unresolvedResultKind: "relay_result",
+            after,
+            limit: JOURNAL_WORK_BATCH_SIZE
+          });
+          if (pending.length === 0) return;
+          for (const intent of pending) {
+            after = intent.seq;
+            const [message] = intent.message_id === void 0 ? [] : await queryStore(this.store, roomId, { kind: "message", messageId: intent.message_id, limit: 1 });
+            const [file] = intent.file_id === void 0 ? [] : await queryStore(this.store, roomId, { kind: "file", fileId: intent.file_id, limit: 1 });
+            if (message === void 0 === (file === void 0)) continue;
+            const recipients = message?.recipient_identities ?? file.recipient_identities;
+            if (!recipients.includes(intent.recipient_identity)) continue;
+            if (!activeCids.has(intent.recipient_identity) && removedCids.has(intent.recipient_identity)) {
+              const skipped = await this.store.append(roomId, {
+                version: 1,
+                kind: "relay_result",
+                room_id: roomId,
+                at: this.now(),
+                intent_record_id: intent.record_id,
+                ...intent.message_id === void 0 ? {} : { message_id: intent.message_id },
+                ...intent.file_id === void 0 ? {} : { file_id: intent.file_id },
+                recipient_identity: intent.recipient_identity,
+                status: "skipped_removed"
+              });
+              if (skipped.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
+              continue;
+            }
+            if (file !== void 0) {
+              const author = file.author_alias === void 0 ? file.author : {
+                identity: file.author_alias.participant_id,
+                display_name: file.author_alias.alias,
+                role: file.author.role
+              };
+              const metadata = await sendRoomBody(packet, intent.recipient_identity, {
+                version: 1,
+                kind: "room_file",
+                room_id: roomId,
+                room_name: room.room_name,
+                file_id: file.file_id,
+                author,
+                filename: file.filename,
+                mime: file.mime,
+                size: file.size,
+                sha256: file.sha256,
+                at: file.at
+              });
+              if (metadata.status === "send_failed") {
+                const failed = await this.store.append(roomId, {
+                  version: 1,
+                  kind: "relay_result",
+                  room_id: roomId,
+                  at: this.now(),
+                  intent_record_id: intent.record_id,
+                  file_id: file.file_id,
+                  recipient_identity: intent.recipient_identity,
+                  status: "send_failed"
+                });
+                if (failed.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
+                continue;
+              }
+              const outcome2 = await packet.sendFile(
+                intent.recipient_identity,
+                file.filename,
+                file.mime,
+                Buffer.from(file.data_base64, "base64")
+              );
+              const appended2 = await this.store.append(roomId, {
                 version: 1,
                 kind: "relay_result",
                 room_id: roomId,
@@ -6113,66 +6149,45 @@ var init_intake = __esm({
                 intent_record_id: intent.record_id,
                 file_id: file.file_id,
                 recipient_identity: intent.recipient_identity,
-                status: "send_failed"
+                status: outcome2.status,
+                ...outcome2.wire_id === void 0 || outcome2.wire_id === "" ? {} : { wire_id: outcome2.wire_id },
+                ...metadata.wire_id === void 0 || metadata.wire_id === "" ? {} : { metadata_wire_id: metadata.wire_id }
               });
-              if (failed.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
-              completed.add(intent.record_id);
+              if (appended2.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
               continue;
             }
-            const outcome2 = await packet.sendFile(
-              intent.recipient_identity,
-              file.filename,
-              file.mime,
-              Buffer.from(file.data_base64, "base64")
-            );
-            const appended2 = await this.store.append(roomId, {
+            const unsigned = {
+              version: 1,
+              kind: wireKind(message.category),
+              room_id: roomId,
+              room_name: room.room_name,
+              message_id: message.message_id,
+              // An anonymous author leaves the archive only in alias form.
+              author: message.author_alias === void 0 ? message.author : {
+                identity: message.author_alias.participant_id,
+                display_name: message.author_alias.alias,
+                role: message.author.role
+              },
+              text: message.text,
+              at: message.at,
+              ...message.briefing_role === void 0 ? {} : { briefing_role: message.briefing_role },
+              ...message.briefing_version === void 0 ? {} : { briefing_version: message.briefing_version },
+              ...message.membership === void 0 ? {} : { membership: message.membership }
+            };
+            const outcome = await sendRoomBody(packet, intent.recipient_identity, unsigned);
+            const appended = await this.store.append(roomId, {
               version: 1,
               kind: "relay_result",
               room_id: roomId,
               at: this.now(),
               intent_record_id: intent.record_id,
-              file_id: file.file_id,
+              message_id: intent.message_id,
               recipient_identity: intent.recipient_identity,
-              status: outcome2.status,
-              ...outcome2.wire_id === void 0 || outcome2.wire_id === "" ? {} : { wire_id: outcome2.wire_id },
-              ...metadata.wire_id === void 0 || metadata.wire_id === "" ? {} : { metadata_wire_id: metadata.wire_id }
+              status: outcome.status,
+              ...outcome.wire_id === void 0 || outcome.wire_id === "" ? {} : { wire_id: outcome.wire_id }
             });
-            if (appended2.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
-            completed.add(intent.record_id);
-            continue;
+            if (appended.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
           }
-          const unsigned = {
-            version: 1,
-            kind: wireKind(message.category),
-            room_id: roomId,
-            room_name: room.room_name,
-            message_id: message.message_id,
-            // An anonymous author leaves the archive only in alias form.
-            author: message.author_alias === void 0 ? message.author : {
-              identity: message.author_alias.participant_id,
-              display_name: message.author_alias.alias,
-              role: message.author.role
-            },
-            text: message.text,
-            at: message.at,
-            ...message.briefing_role === void 0 ? {} : { briefing_role: message.briefing_role },
-            ...message.briefing_version === void 0 ? {} : { briefing_version: message.briefing_version },
-            ...message.membership === void 0 ? {} : { membership: message.membership }
-          };
-          const outcome = await sendRoomBody(packet, intent.recipient_identity, unsigned);
-          const appended = await this.store.append(roomId, {
-            version: 1,
-            kind: "relay_result",
-            room_id: roomId,
-            at: this.now(),
-            intent_record_id: intent.record_id,
-            message_id: intent.message_id,
-            recipient_identity: intent.recipient_identity,
-            status: outcome.status,
-            ...outcome.wire_id === void 0 || outcome.wire_id === "" ? {} : { wire_id: outcome.wire_id }
-          });
-          if (appended.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
-          completed.add(intent.record_id);
         }
       }
       findSourceMessage(records, item) {
@@ -6231,6 +6246,21 @@ function byteBoundedHistoryPage(records) {
 function activeSeats(room) {
   return room.seats.filter((seat) => seat.state === "active");
 }
+async function queryStore2(store, roomId, options) {
+  if (store.query) return store.query(roomId, options);
+  let records = await store.read(roomId);
+  records = records.filter((record) => {
+    const value = record;
+    const membership = value.membership;
+    return (options.kind === void 0 || record.kind === options.kind) && (options.after === void 0 || record.seq > options.after) && (options.messageId === void 0 || value.message_id === options.messageId) && (options.fileId === void 0 || value.file_id === options.fileId) && (options.intentRecordId === void 0 || value.intent_record_id === options.intentRecordId) && (options.recipientIdentity === void 0 || value.recipient_identity === options.recipientIdentity) && (options.category === void 0 || value.category === options.category) && (options.membershipEpoch === void 0 || membership?.epoch === options.membershipEpoch);
+  });
+  if (options.unresolvedResultKind) {
+    const completed = new Set((await store.read(roomId)).filter((record) => record.kind === options.unresolvedResultKind).map((record) => record.intent_record_id));
+    records = records.filter((record) => !completed.has(record.record_id));
+  }
+  if (options.descending) records.reverse();
+  return records.slice(0, options.limit ?? Number.MAX_SAFE_INTEGER);
+}
 function isCancelledExternalSeat(seat) {
   return seat.state === "removed" && seat.accepted_at === void 0 && seat.requested_at !== void 0 && seat.invite_sha256 !== void 0;
 }
@@ -6243,7 +6273,7 @@ function uniqueIdentities(identities) {
 function currentContactIdentities(packet) {
   return new Set(packet.listContacts().map((contact) => contact.container_id));
 }
-var CreateInviteInputSchema, HistoryOptionsSchema, DeleteRoomInputSchema, RemoveParticipantInputSchema, ReplaceParticipantInputSchema, RoomServiceError, RoomService;
+var CreateInviteInputSchema, HistoryOptionsSchema, JOURNAL_WORK_BATCH_SIZE2, DeleteRoomInputSchema, RemoveParticipantInputSchema, ReplaceParticipantInputSchema, RoomServiceError, RoomService;
 var init_service = __esm({
   "src/service.ts"() {
     "use strict";
@@ -6270,6 +6300,7 @@ var init_service = __esm({
       limit: external_exports.number().int().positive().safe().optional(),
       view: external_exports.enum(["operator", "participant"]).optional()
     }).strict();
+    JOURNAL_WORK_BATCH_SIZE2 = 64;
     DeleteRoomInputSchema = external_exports.object({
       confirm: external_exports.literal(true)
     }).strict();
@@ -6297,7 +6328,6 @@ var init_service = __esm({
       nextMessageId;
       intake;
       provisioningCheckpoint;
-      identityNameMode;
       constructor(store, packets, options = {}) {
         this.store = store;
         this.packets = packets;
@@ -6306,7 +6336,6 @@ var init_service = __esm({
         this.nextMessageId = options.messageId ?? generateUlid;
         this.provisioningCheckpoint = options.provisioningCheckpoint ?? (() => {
         });
-        this.identityNameMode = options.identityNameMode ?? "stable_id";
         this.intake = new IntakePump(store, packets, {
           now: this.nowValue,
           messageId: this.nextMessageId
@@ -6316,7 +6345,7 @@ var init_service = __esm({
         const settings = CreateRoomInputSchema.parse(input);
         const roomId = LowerCrockfordUlidSchema.parse(this.nextRoomId());
         const roomName = settings.name ?? defaultRoomName(roomId);
-        const identityName = configuredRoomIdentityName(roomId, roomName, this.identityNameMode);
+        const identityName = roomIdentityName(roomName);
         return this.lock(roomId, async () => {
           const provisional = RoomSchema.parse({
             version: 2,
@@ -6754,8 +6783,11 @@ var init_service = __esm({
             membership_epoch: Math.max(current.membership_epoch, intent.epoch)
           }));
         }
-        const records = await this.store.read(current.room_id);
-        const existing = records.find((record) => record.kind === "membership_result" && record.intent_record_id === intent.record_id);
+        const [existing] = await queryStore2(this.store, current.room_id, {
+          kind: "membership_result",
+          intentRecordId: intent.record_id,
+          limit: 1
+        });
         let outcome;
         if (existing !== void 0 && existing.kind === "membership_result") {
           outcome = {
@@ -6794,8 +6826,13 @@ var init_service = __esm({
         };
       }
       async ensureMembershipNotice(room, intent) {
-        const records = await this.store.read(room.room_id);
-        const already = records.some((record) => record.kind === "message" && record.category === "membership" && record.membership?.action === "remove" && record.membership.epoch === intent.epoch);
+        const records = await queryStore2(this.store, room.room_id, {
+          kind: "message",
+          category: "membership",
+          membershipEpoch: intent.epoch,
+          limit: 1
+        });
+        const already = records.length > 0;
         if (already) return;
         const remaining = activeSeats(room);
         if (remaining.length === 0) return;
@@ -7005,7 +7042,7 @@ var init_service = __esm({
       async history(roomId, options = {}) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
         const { view, ...page } = HistoryOptionsSchema.parse(options);
-        const records = await this.store.read(id, view === "participant" ? { after: page.after } : page);
+        const records = view === "participant" ? await queryStore2(this.store, id, { kind: "message", after: page.after, limit: page.limit }) : await this.store.read(id, page);
         if (view !== "participant") return byteBoundedHistoryPage(records);
         const projected = records.filter((record) => record.kind === "message").map((record) => {
           const {
@@ -7272,13 +7309,19 @@ var init_service = __esm({
           invites,
           membership_epoch: room.membership_epoch + activatedPending.length + newSeats.length
         });
-        const journal = await this.store.read(next.room_id);
-        const completedIntents = new Set(journal.filter((record) => record.kind === "membership_result").map((record) => record.kind === "membership_result" ? record.intent_record_id : ""));
-        for (const intent of journal.filter(
-          (record) => record.kind === "membership_intent"
-        )) {
-          if (completedIntents.has(intent.record_id)) continue;
-          ({ room: next } = await this.completeRemovalUnlocked(next, intent));
+        let membershipAfter = 0;
+        for (; ; ) {
+          const journal = await queryStore2(this.store, next.room_id, {
+            kind: "membership_intent",
+            unresolvedResultKind: "membership_result",
+            after: membershipAfter,
+            limit: JOURNAL_WORK_BATCH_SIZE2
+          });
+          if (journal.length === 0) break;
+          for (const intent of journal) {
+            membershipAfter = intent.seq;
+            ({ room: next } = await this.completeRemovalUnlocked(next, intent));
+          }
         }
         const requirementsMet = invites.filter((invite) => invite.state !== "revoked").every((invite) => invite.accepted_cids.length >= invite.min_accepts);
         const admitted = [...activatedPending, ...newSeats];
@@ -7295,23 +7338,31 @@ var init_service = __esm({
         const packet = this.packets.get(roomId);
         if (packet) {
           await packet.refreshContacts();
-          let records = await this.store.read(roomId);
           let contacts = currentContactIdentities(packet);
-          const completed = new Set(records.filter((record) => record.kind === "close_notice_result").map((record) => record.kind === "close_notice_result" ? record.intent_record_id : ""));
-          const pending = records.filter(
-            (record) => record.kind === "close_notice_intent" && !completed.has(record.record_id)
-          );
-          for (const intent of pending) {
-            if (contacts.has(intent.recipient_identity)) continue;
-            await this.appendUncertainCloseResult(roomId, intent);
-            completed.add(intent.record_id);
+          let closeAfter = 0;
+          for (; ; ) {
+            const pending = await queryStore2(this.store, roomId, {
+              kind: "close_notice_intent",
+              unresolvedResultKind: "close_notice_result",
+              after: closeAfter,
+              limit: JOURNAL_WORK_BATCH_SIZE2
+            });
+            if (pending.length === 0) break;
+            for (const intent of pending) {
+              closeAfter = intent.seq;
+              if (contacts.has(intent.recipient_identity)) continue;
+              await this.appendUncertainCloseResult(roomId, intent);
+            }
           }
           for (const recipientIdentity of contacts) {
-            records = await this.store.read(roomId);
-            const currentCompleted = new Set(records.filter((record) => record.kind === "close_notice_result").map((record) => record.kind === "close_notice_result" ? record.intent_record_id : ""));
-            let intent = [...records].reverse().find(
-              (record) => record.kind === "close_notice_intent" && record.recipient_identity === recipientIdentity && !currentCompleted.has(record.record_id)
-            );
+            const [existingIntent] = await queryStore2(this.store, roomId, {
+              kind: "close_notice_intent",
+              recipientIdentity,
+              unresolvedResultKind: "close_notice_result",
+              descending: true,
+              limit: 1
+            });
+            let intent = existingIntent;
             if (!intent) {
               const appended2 = await this.store.append(roomId, {
                 version: 1,
@@ -7354,13 +7405,19 @@ var init_service = __esm({
             `room "${roomId}" live-state purge left residue: ${residue.join(", ") || "packet registry entry"}`
           );
         }
-        const afterPurge = await this.store.read(roomId);
-        const completedAfterPurge = new Set(afterPurge.filter((record) => record.kind === "close_notice_result").map((record) => record.kind === "close_notice_result" ? record.intent_record_id : ""));
-        for (const intent of afterPurge.filter(
-          (record) => record.kind === "close_notice_intent" && !completedAfterPurge.has(record.record_id)
-        )) {
-          await this.appendUncertainCloseResult(roomId, intent);
-          completedAfterPurge.add(intent.record_id);
+        let purgeAfter = 0;
+        for (; ; ) {
+          const afterPurge = await queryStore2(this.store, roomId, {
+            kind: "close_notice_intent",
+            unresolvedResultKind: "close_notice_result",
+            after: purgeAfter,
+            limit: JOURNAL_WORK_BATCH_SIZE2
+          });
+          if (afterPurge.length === 0) break;
+          for (const intent of afterPurge) {
+            purgeAfter = intent.seq;
+            await this.appendUncertainCloseResult(roomId, intent);
+          }
         }
         return this.store.save(RoomSchema.parse({ ...room, state: "closed", closed_at: this.now() }));
       }
@@ -7420,18 +7477,29 @@ var init_service = __esm({
         });
       }
       async ensureBriefingKind(room, recipients, briefing) {
-        const records = await this.store.read(room.room_id);
+        if (this.store.briefingDeliveryTimes) {
+          const recipientIdentities = uniqueIdentities(recipients.map((seat) => seat.identity));
+          const deliveries = await this.store.briefingDeliveryTimes(room.room_id, {
+            category: briefing.category,
+            briefingRole: briefing.briefing_role,
+            briefingVersion: briefing.briefing_version
+          }, recipientIdentities);
+          const missing2 = recipients.filter((seat) => !deliveries.has(seat.identity));
+          const appendedAt2 = await this.appendBriefingForMissing(room, missing2, briefing);
+          return [...deliveries.values(), ...appendedAt2 === void 0 ? [] : [appendedAt2]].sort()[0] ?? this.now();
+        }
+        const records = await queryStore2(this.store, room.room_id, {
+          kind: "message",
+          category: briefing.category
+        });
         const matching = records.filter((record) => record.kind === "message" && record.category === briefing.category && record.briefing_role === briefing.briefing_role && (record.briefing_version ?? 1) === briefing.briefing_version);
-        const intentsByMessage = /* @__PURE__ */ new Map();
-        for (const record of records) {
-          if (record.kind !== "relay_intent" || record.message_id === void 0) continue;
-          const intents = intentsByMessage.get(record.message_id) ?? /* @__PURE__ */ new Set();
-          intents.add(record.recipient_identity);
-          intentsByMessage.set(record.message_id, intents);
-        }
         const covered = /* @__PURE__ */ new Set();
         for (const message of matching) {
-          const intents = intentsByMessage.get(message.message_id) ?? /* @__PURE__ */ new Set();
+          const intentRecords = await queryStore2(this.store, room.room_id, {
+            kind: "relay_intent",
+            messageId: message.message_id
+          });
+          const intents = new Set(intentRecords.map((record) => record.recipient_identity));
           for (const recipientIdentity of message.recipient_identities) {
             covered.add(recipientIdentity);
             if (!intents.has(recipientIdentity)) {
@@ -7447,35 +7515,36 @@ var init_service = __esm({
           }
         }
         const missing = recipients.filter((seat) => !covered.has(seat.identity));
-        let appendedAt;
-        if (missing.length > 0) {
-          const appended = await this.store.append(room.room_id, {
+        const appendedAt = await this.appendBriefingForMissing(room, missing, briefing);
+        return matching[0]?.at ?? appendedAt ?? this.now();
+      }
+      async appendBriefingForMissing(room, missing, briefing) {
+        if (missing.length === 0) return void 0;
+        const appended = await this.store.append(room.room_id, {
+          version: 1,
+          kind: "message",
+          room_id: room.room_id,
+          at: this.now(),
+          message_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
+          author: { identity: room.identity_cid, display_name: room.identity_name, role: ROOM_ROLE },
+          category: briefing.category,
+          ...briefing.briefing_role === void 0 ? {} : { briefing_role: briefing.briefing_role },
+          briefing_version: briefing.briefing_version,
+          text: briefing.text,
+          recipient_identities: uniqueIdentities(missing.map((seat) => seat.identity))
+        });
+        if (appended.kind !== "message") throw new RoomServiceError("storage returned the wrong briefing record kind");
+        for (const recipientIdentity of appended.recipient_identities) {
+          await this.store.append(room.room_id, {
             version: 1,
-            kind: "message",
+            kind: "relay_intent",
             room_id: room.room_id,
             at: this.now(),
-            message_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
-            author: { identity: room.identity_cid, display_name: room.identity_name, role: ROOM_ROLE },
-            category: briefing.category,
-            ...briefing.briefing_role === void 0 ? {} : { briefing_role: briefing.briefing_role },
-            briefing_version: briefing.briefing_version,
-            text: briefing.text,
-            recipient_identities: uniqueIdentities(missing.map((seat) => seat.identity))
+            message_id: appended.message_id,
+            recipient_identity: recipientIdentity
           });
-          if (appended.kind !== "message") throw new RoomServiceError("storage returned the wrong briefing record kind");
-          appendedAt = appended.at;
-          for (const recipientIdentity of appended.recipient_identities) {
-            await this.store.append(room.room_id, {
-              version: 1,
-              kind: "relay_intent",
-              room_id: room.room_id,
-              at: this.now(),
-              message_id: appended.message_id,
-              recipient_identity: recipientIdentity
-            });
-          }
         }
-        return matching[0]?.at ?? appendedAt ?? this.now();
+        return appended.at;
       }
       lock(roomId, work) {
         return this.store.mutex(roomId).runExclusive(work);
@@ -7509,8 +7578,9 @@ var init_service = __esm({
 import { randomBytes as randomBytes3 } from "node:crypto";
 import * as nodeFs2 from "node:fs";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { dirname as dirname2, join as join3 } from "node:path";
-var DIRECTORY_MODE2, FILE_MODE2, NO_FOLLOW2, utf8Decoder, CoworkStorageError, RoomQueue, CoworkStore;
+import { basename, dirname as dirname2, join as join3 } from "node:path";
+import Database from "better-sqlite3";
+var DIRECTORY_MODE2, FILE_MODE2, NO_FOLLOW2, SQLITE_SCHEMA_VERSION, DEFAULT_WORK_BATCH_SIZE, utf8Decoder, CoworkStorageError, RoomQueue, CoworkStore;
 var init_storage = __esm({
   "src/storage.ts"() {
     "use strict";
@@ -7519,6 +7589,8 @@ var init_storage = __esm({
     DIRECTORY_MODE2 = 448;
     FILE_MODE2 = 384;
     NO_FOLLOW2 = nodeFs2.constants.O_NOFOLLOW ?? 0;
+    SQLITE_SCHEMA_VERSION = 1;
+    DEFAULT_WORK_BATCH_SIZE = 64;
     utf8Decoder = new TextDecoder("utf-8", { fatal: true });
     CoworkStorageError = class extends Error {
       constructor(message, options) {
@@ -7546,20 +7618,20 @@ var init_storage = __esm({
     CoworkStore = class {
       stateDir;
       fs;
-      // The standalone daemon is the sole writer. This is intentionally an
-      // in-process room FIFO, not an on-disk lock with stale-owner recovery.
+      beforeRecordCommit;
       roomMutexes = /* @__PURE__ */ new Map();
       lockOwnership = new AsyncLocalStorage();
-      nextSequences = /* @__PURE__ */ new Map();
+      reconciledBlobRooms = /* @__PURE__ */ new Set();
       constructor(stateDir, options = {}) {
         if (!stateDir) throw new CoworkStorageError("state directory is required");
         this.stateDir = stateDir;
         this.fs = options.fs ?? nodeFs2;
+        this.beforeRecordCommit = options.beforeRecordCommit;
       }
       mutex(roomId, work) {
-        const validRoomId = this.roomId(roomId);
-        if (work) return this.withRoomMutex(validRoomId, work);
-        return { runExclusive: (nested) => this.withRoomMutex(validRoomId, nested) };
+        const id = this.roomId(roomId);
+        if (work) return this.withRoomMutex(id, work);
+        return { runExclusive: (nested) => this.withRoomMutex(id, nested) };
       }
       withRoomMutex(roomId, work) {
         const inherited = this.lockOwnership.getStore();
@@ -7567,15 +7639,10 @@ var init_storage = __esm({
         if (ownership?.active) {
           const nested = Promise.resolve().then(work);
           ownership.pending.add(nested);
-          void nested.then(
-            () => {
-              ownership.pending.delete(nested);
-            },
-            (error) => {
-              ownership.pending.delete(nested);
-              ownership.failures.push(error);
-            }
-          );
+          void nested.then(() => ownership.pending.delete(nested), (error) => {
+            ownership.pending.delete(nested);
+            ownership.failures.push(error);
+          });
           return nested;
         }
         let queue = this.roomMutexes.get(roomId);
@@ -7597,9 +7664,7 @@ var init_storage = __esm({
               rootFailed = true;
               rootFailure = error;
             }
-            while (acquired.pending.size > 0) {
-              await Promise.allSettled([...acquired.pending]);
-            }
+            while (acquired.pending.size > 0) await Promise.allSettled([...acquired.pending]);
           } finally {
             acquired.active = false;
           }
@@ -7617,20 +7682,20 @@ var init_storage = __esm({
             this.rejectSymlink(roomDir, "room directory");
             throw new CoworkStorageError(`room "${room.room_id}" already exists`);
           }
-          let roomCreated = false;
+          let created = false;
           try {
             this.fs.mkdirSync(roomDir, { mode: DIRECTORY_MODE2 });
-            roomCreated = true;
+            created = true;
             this.fs.chmodSync(roomDir, DIRECTORY_MODE2);
+            this.fs.mkdirSync(this.blobsDirectory(room.room_id), { mode: DIRECTORY_MODE2 });
+            this.fs.chmodSync(this.blobsDirectory(room.room_id), DIRECTORY_MODE2);
             this.fsyncDirectory(roomDir);
             this.fsyncDirectory(this.roomsDirectory());
-            this.createArchive(room.room_id);
+            this.withDatabase(room.room_id, () => void 0, true);
             this.atomicMetadataWrite(this.metadataPath(room.room_id), room);
-            this.nextSequences.set(room.room_id, 1);
             return room;
           } catch (error) {
-            this.nextSequences.delete(room.room_id);
-            if (roomCreated) {
+            if (created) {
               try {
                 this.fs.rmSync(roomDir, { recursive: true, force: true });
                 this.fsyncDirectory(this.roomsDirectory());
@@ -7642,8 +7707,8 @@ var init_storage = __esm({
         });
       }
       async load(roomId) {
-        const validRoomId = this.roomId(roomId);
-        return this.mutex(validRoomId, () => this.loadUnlocked(validRoomId));
+        const id = this.roomId(roomId);
+        return this.mutex(id, () => this.loadUnlocked(id));
       }
       async save(input) {
         const room = RoomSchema.parse(input);
@@ -7655,176 +7720,435 @@ var init_storage = __esm({
       }
       async list() {
         this.ensureBaseDirectories();
-        const roomIds = this.fs.readdirSync(this.roomsDirectory(), { withFileTypes: true }).filter((entry) => LowerCrockfordUlidSchema.safeParse(entry.name).success).map((entry) => entry.name).sort();
+        const ids = this.fs.readdirSync(this.roomsDirectory(), { withFileTypes: true }).filter((entry) => entry.isDirectory() && LowerCrockfordUlidSchema.safeParse(entry.name).success).map((entry) => entry.name).sort();
         const rooms = [];
-        for (const roomId of roomIds) rooms.push(await this.load(roomId));
+        for (const id of ids) rooms.push(await this.load(id));
         return rooms;
       }
       async append(roomId, input) {
-        const validRoomId = this.roomId(roomId);
+        const id = this.roomId(roomId);
         const draft = AppendRecordSchema.parse(input);
-        if (draft.room_id !== validRoomId) {
-          throw new CoworkStorageError(`record room_id "${draft.room_id}" does not match room "${validRoomId}"`);
-        }
-        return this.mutex(validRoomId, () => {
-          this.assertRoomDirectory(validRoomId);
-          const archivePath = this.archivePath(validRoomId);
-          this.assertRegularFile(archivePath, "room archive");
-          let nextSequence = this.nextSequences.get(validRoomId);
-          if (nextSequence === void 0) {
-            nextSequence = this.scanArchive(validRoomId).nextSequence;
-          }
-          const record = CommunicationRecordSchema.parse({
-            ...draft,
-            seq: nextSequence,
-            record_id: `${validRoomId}:${nextSequence}`
-          });
-          const bytes = Buffer.from(`${JSON.stringify(record)}
-`, "utf8");
-          let fd;
-          let originalSize;
-          let writeStarted = false;
+        if (draft.room_id !== id) throw new CoworkStorageError(`record room_id "${draft.room_id}" does not match room "${id}"`);
+        return this.mutex(id, () => {
+          this.assertRoomDirectory(id);
+          if (!this.reconciledBlobRooms.has(id)) this.withDatabase(id, () => void 0);
+          let blob;
+          let storedDraft = draft;
+          if (draft.kind === "file") {
+            const bytes = Buffer.from(draft.data_base64, "base64");
+            blob = this.persistBlob(id, draft.sha256, bytes);
+            const { data_base64: _bytes, ...withoutBytes } = draft;
+            storedDraft = withoutBytes;
+          }
           try {
-            fd = this.fs.openSync(
-              archivePath,
-              nodeFs2.constants.O_WRONLY | nodeFs2.constants.O_APPEND | NO_FOLLOW2
-            );
-            const opened = this.validateOpenPath(fd, archivePath, "room archive", "file", true);
-            originalSize = opened.size;
-            this.fs.fchmodSync(fd, FILE_MODE2);
-            writeStarted = true;
-            this.writeAll(fd, bytes);
-            this.fs.fsyncSync(fd);
-            this.nextSequences.set(validRoomId, nextSequence + 1);
-            return record;
+            return this.withDatabase(id, (db) => {
+              const transaction = db.transaction(() => {
+                const next = db.prepare("SELECT COALESCE(MAX(seq), 0) + 1 AS next FROM records").get().next;
+                const record = { ...draft, seq: next, record_id: `${id}:${next}` };
+                const stored = { ...storedDraft, seq: next, record_id: record.record_id };
+                const values = this.indexValues(record);
+                db.prepare(`INSERT INTO records
+              (seq, record_id, kind, at, payload_json, blob_path, message_id, file_id, intent_record_id,
+               recipient_identity, source_msg_id, source_file_id, category, briefing_role, briefing_version, membership_epoch)
+              VALUES (@seq,@record_id,@kind,@at,@payload_json,@blob_path,@message_id,@file_id,@intent_record_id,
+               @recipient_identity,@source_msg_id,@source_file_id,@category,@briefing_role,@briefing_version,@membership_epoch)`).run({ ...values, payload_json: JSON.stringify(stored), blob_path: blob?.path ?? null });
+                if (record.kind === "message" || record.kind === "file") {
+                  const insert = db.prepare(`INSERT INTO record_recipients
+                (record_seq, recipient_identity, category, briefing_role, briefing_version)
+                VALUES (?, ?, ?, ?, ?)`);
+                  const enqueue = db.prepare("INSERT INTO relay_intent_work(record_seq, recipient_identity) VALUES (?, ?)");
+                  for (const recipient of record.recipient_identities) {
+                    insert.run(
+                      record.seq,
+                      recipient,
+                      record.kind === "message" ? record.category : null,
+                      record.kind === "message" ? record.briefing_role ?? null : null,
+                      record.kind === "message" ? record.briefing_version ?? 1 : null
+                    );
+                    enqueue.run(record.seq, recipient);
+                  }
+                } else if (record.kind === "relay_intent") {
+                  const sourceColumn = record.message_id === void 0 ? "file_id" : "message_id";
+                  const sourceId = record.message_id ?? record.file_id;
+                  db.prepare(`DELETE FROM relay_intent_work
+                WHERE recipient_identity = ? AND record_seq IN (
+                  SELECT seq FROM records WHERE kind = ? AND ${sourceColumn} = ?
+                )`).run(record.recipient_identity, record.message_id === void 0 ? "file" : "message", sourceId);
+                }
+                this.beforeRecordCommit?.();
+                return record;
+              });
+              return transaction.immediate();
+            });
           } catch (error) {
-            this.nextSequences.delete(validRoomId);
-            if (fd !== void 0 && originalSize !== void 0 && writeStarted) {
-              try {
-                this.fs.ftruncateSync(fd, originalSize);
-                this.fs.fsyncSync(fd);
-              } catch {
-              }
-            }
-            throw this.wrap(`failed to append room "${validRoomId}" archive`, error);
-          } finally {
-            if (fd !== void 0) {
-              try {
-                this.fs.closeSync(fd);
-              } catch {
-              }
-            }
+            if (blob?.created) this.removeUnreferencedBlob(id, blob.path);
+            throw this.wrap(`failed to append room "${id}" archive`, error);
           }
         });
       }
       async read(roomId, options = {}) {
-        const validRoomId = this.roomId(roomId);
+        const id = this.roomId(roomId);
         const after = options.after ?? 0;
         const limit = options.limit ?? Number.MAX_SAFE_INTEGER;
-        if (!Number.isSafeInteger(after) || after < 0) throw new CoworkStorageError("after must be a non-negative safe integer");
+        this.validatePage(after, limit);
+        return this.mutex(id, () => {
+          this.assertRoomDirectory(id);
+          return this.withDatabase(id, (db) => this.decodeRows(id, db.prepare(
+            "SELECT seq,payload_json,blob_path FROM records WHERE seq > ? ORDER BY seq ASC LIMIT ?"
+          ).all(after, limit)));
+        });
+      }
+      async query(roomId, options) {
+        const id = this.roomId(roomId);
+        const limit = options.limit ?? Number.MAX_SAFE_INTEGER;
         if (!Number.isSafeInteger(limit) || limit < 1) throw new CoworkStorageError("limit must be a positive safe integer");
-        return this.mutex(validRoomId, () => {
-          this.assertRoomDirectory(validRoomId);
-          const scan = this.scanArchive(validRoomId);
-          this.nextSequences.set(validRoomId, scan.nextSequence);
-          return scan.records.filter((record) => record.seq > after).slice(0, limit);
+        return this.mutex(id, () => {
+          this.assertRoomDirectory(id);
+          return this.withDatabase(id, (db) => {
+            const clauses = [];
+            const values = [];
+            const add = (column, value) => {
+              if (value !== void 0) {
+                clauses.push(`r.${column} = ?`);
+                values.push(value);
+              }
+            };
+            add("kind", options.kind);
+            add("message_id", options.messageId);
+            add("file_id", options.fileId);
+            add("source_msg_id", options.sourceMsgId);
+            add("source_file_id", options.sourceFileId);
+            add("intent_record_id", options.intentRecordId);
+            add("recipient_identity", options.recipientIdentity);
+            add("category", options.category);
+            add("membership_epoch", options.membershipEpoch);
+            if (options.after !== void 0) {
+              clauses.push("r.seq > ?");
+              values.push(options.after);
+            }
+            if (options.unresolvedResultKind) {
+              clauses.push("NOT EXISTS (SELECT 1 FROM records result WHERE result.kind = ? AND result.intent_record_id = r.record_id)");
+              values.push(options.unresolvedResultKind);
+            }
+            values.push(limit);
+            const sql = `SELECT r.seq,r.payload_json,r.blob_path FROM records r${clauses.length ? ` WHERE ${clauses.join(" AND ")}` : ""} ORDER BY r.seq ${options.descending ? "DESC" : "ASC"} LIMIT ?`;
+            return this.decodeRows(id, db.prepare(sql).all(...values));
+          });
         });
       }
+      async recipients(roomId, recordSeq) {
+        const id = this.roomId(roomId);
+        return this.mutex(id, () => this.withDatabase(id, (db) => db.prepare(
+          "SELECT recipient_identity FROM record_recipients WHERE record_seq = ? ORDER BY recipient_identity"
+        ).all(recordSeq).map((row) => row.recipient_identity)));
+      }
+      async recordsNeedingRelayIntents(roomId, options = {}) {
+        const id = this.roomId(roomId);
+        const after = options.after ?? 0;
+        const limit = options.limit ?? DEFAULT_WORK_BATCH_SIZE;
+        this.validatePage(after, limit);
+        return this.mutex(id, () => this.withDatabase(id, (db) => this.decodeRows(id, db.prepare(`
+      SELECT source.seq,source.payload_json,source.blob_path
+      FROM relay_intent_work work INDEXED BY relay_work_source
+      JOIN records source ON source.seq = work.record_seq
+      WHERE work.record_seq > ?
+      GROUP BY source.seq
+      ORDER BY source.seq ASC
+      LIMIT ?
+    `).all(after, limit))));
+      }
+      async relayRecipientsNeedingIntent(roomId, recordSeq, limit = DEFAULT_WORK_BATCH_SIZE) {
+        const id = this.roomId(roomId);
+        if (!Number.isSafeInteger(recordSeq) || recordSeq < 1) throw new CoworkStorageError("record sequence must be a positive safe integer");
+        if (!Number.isSafeInteger(limit) || limit < 1) throw new CoworkStorageError("limit must be a positive safe integer");
+        return this.mutex(id, () => this.withDatabase(id, (db) => db.prepare(
+          "SELECT recipient_identity FROM relay_intent_work WHERE record_seq = ? ORDER BY recipient_identity LIMIT ?"
+        ).all(recordSeq, limit).map((row) => row.recipient_identity)));
+      }
+      async briefingDeliveryTimes(roomId, key, recipientIdentities) {
+        const id = this.roomId(roomId);
+        if (recipientIdentities.length === 0) return /* @__PURE__ */ new Map();
+        return this.mutex(id, () => this.withDatabase(id, (db) => {
+          const lookup = db.prepare(`SELECT records.at FROM record_recipients recipients
+        INDEXED BY recipients_briefing_delivery
+        JOIN records ON records.seq = recipients.record_seq
+        WHERE recipients.recipient_identity = ? AND recipients.category = ?
+          AND recipients.briefing_role IS ? AND recipients.briefing_version = ?
+        ORDER BY recipients.record_seq ASC LIMIT 1`);
+          const deliveries = /* @__PURE__ */ new Map();
+          for (const recipient of recipientIdentities) {
+            const row = lookup.get(
+              recipient,
+              key.category,
+              key.briefingRole ?? null,
+              key.briefingVersion
+            );
+            if (row) deliveries.set(recipient, row.at);
+          }
+          return deliveries;
+        }));
+      }
+      async durability(roomId) {
+        const id = this.roomId(roomId);
+        return this.mutex(id, () => this.withDatabase(id, (db) => ({
+          journalMode: db.pragma("journal_mode", { simple: true }),
+          synchronous: db.pragma("synchronous", { simple: true })
+        })));
+      }
       async delete(roomId) {
-        const validRoomId = this.roomId(roomId);
-        await this.mutex(validRoomId, () => {
+        const id = this.roomId(roomId);
+        await this.mutex(id, () => {
           this.ensureBaseDirectories();
-          const roomDir = this.roomDirectory(validRoomId);
+          const roomDir = this.roomDirectory(id);
           if (!this.lstatIfPresent(roomDir)) {
             this.fsyncDirectory(this.roomsDirectory());
-            this.nextSequences.delete(validRoomId);
             return;
           }
-          this.ensurePrivateDirectory(roomDir, false, `room "${validRoomId}" directory`);
-          const archivePath = this.archivePath(validRoomId);
-          const metadataPath = this.metadataPath(validRoomId);
-          const archivePresent = this.lstatIfPresent(archivePath) !== void 0;
-          const metadataPresent = this.lstatIfPresent(metadataPath) !== void 0;
+          this.ensurePrivateDirectory(roomDir, false, `room "${id}" directory`);
+          const metadata = this.metadataPath(id);
+          const metadataPresent = this.lstatIfPresent(metadata) !== void 0;
+          const archivePresent = this.lstatIfPresent(this.archivePath(id)) !== void 0;
+          const blobsPresent = this.lstatIfPresent(this.blobsDirectory(id)) !== void 0;
           if (metadataPresent) {
-            const room = this.loadUnlocked(validRoomId);
-            if (room.state !== "closed") {
-              throw new CoworkStorageError(`room "${validRoomId}" must be closed before deletion`);
-            }
+            const room = this.loadUnlocked(id);
+            if (room.state !== "closed") throw new CoworkStorageError(`room "${id}" must be closed before deletion`);
             this.removeProvisioningArtifacts(roomDir);
-          } else if (archivePresent) {
-            throw new CoworkStorageError(
-              `room "${validRoomId}" has archive residue without deletion metadata`
-            );
+          } else if (archivePresent || blobsPresent) {
+            throw new CoworkStorageError(`room "${id}" has archive residue without deletion metadata`);
           }
-          const expected = /* @__PURE__ */ new Set(["archive.jsonl", "room.json", "room.json.v1.bak"]);
+          const expected = /* @__PURE__ */ new Set(["archive.sqlite3", "archive.sqlite3-wal", "archive.sqlite3-shm", "blobs", "room.json", "room.json.v1.bak"]);
           const unexpected = this.fs.readdirSync(roomDir).filter((name) => !expected.has(name));
-          if (unexpected.length > 0) {
-            throw new CoworkStorageError(`room "${validRoomId}" contains live or unexpected residue: ${unexpected.join(", ")}`);
+          if (unexpected.length) throw new CoworkStorageError(`room "${id}" contains live or unexpected residue: ${unexpected.join(", ")}`);
+          for (const name of ["archive.sqlite3-wal", "archive.sqlite3-shm", "archive.sqlite3", "room.json.v1.bak", "room.json"]) {
+            const path = join3(roomDir, name);
+            if (this.lstatIfPresent(path)) {
+              this.assertRegularFile(path, name);
+              this.fs.unlinkSync(path);
+            }
           }
-          const backupPath = `${metadataPath}.v1.bak`;
-          if (this.lstatIfPresent(backupPath)) {
-            this.assertRegularFile(backupPath, "room metadata v1 backup");
-            this.fs.unlinkSync(backupPath);
-            this.fsyncDirectory(roomDir);
+          const blobs = this.blobsDirectory(id);
+          if (this.lstatIfPresent(blobs)) this.fs.rmSync(blobs, { recursive: true, force: true });
+          this.fsyncDirectory(roomDir);
+          this.fs.rmdirSync(roomDir);
+          this.fsyncDirectory(this.roomsDirectory());
+        });
+      }
+      withDatabase(roomId, work, create = false) {
+        const path = this.archivePath(roomId);
+        let guardFd;
+        if (!create) {
+          this.assertRegularFile(path, "room archive database");
+          guardFd = this.fs.openSync(path, nodeFs2.constants.O_RDONLY | NO_FOLLOW2);
+          this.validateOpenPath(guardFd, path, "room archive database", "file", true);
+        }
+        let db;
+        try {
+          this.secureSqliteFiles(path);
+          db = new Database(path, { fileMustExist: !create });
+          if (guardFd !== void 0) this.validateOpenPath(guardFd, path, "room archive database", "file", true);
+          this.fs.chmodSync(path, FILE_MODE2);
+          db.pragma("journal_mode = WAL");
+          db.pragma("synchronous = FULL");
+          db.pragma("foreign_keys = ON");
+          db.pragma("busy_timeout = 5000");
+          if (create) {
+            db.exec(`CREATE TABLE records (
+        seq INTEGER PRIMARY KEY, record_id TEXT NOT NULL UNIQUE, kind TEXT NOT NULL, at TEXT NOT NULL,
+        payload_json TEXT NOT NULL, blob_path TEXT, message_id TEXT, file_id TEXT, intent_record_id TEXT,
+        recipient_identity TEXT, source_msg_id INTEGER, source_file_id INTEGER, category TEXT,
+        briefing_role TEXT, briefing_version INTEGER, membership_epoch INTEGER
+      );
+      CREATE TABLE record_recipients (
+        record_seq INTEGER NOT NULL REFERENCES records(seq) ON DELETE CASCADE,
+        recipient_identity TEXT NOT NULL, category TEXT, briefing_role TEXT,
+        briefing_version INTEGER, PRIMARY KEY(record_seq, recipient_identity)
+      );
+      CREATE TABLE relay_intent_work (
+        record_seq INTEGER NOT NULL REFERENCES records(seq) ON DELETE CASCADE,
+        recipient_identity TEXT NOT NULL, PRIMARY KEY(record_seq, recipient_identity)
+      );
+      CREATE INDEX relay_work_source ON relay_intent_work(record_seq, recipient_identity);
+      CREATE INDEX records_kind_seq ON records(kind, seq);
+      CREATE INDEX records_message ON records(message_id, kind, seq);
+      CREATE INDEX records_file ON records(file_id, kind, seq);
+      CREATE INDEX records_intent_result ON records(intent_record_id, kind);
+      CREATE INDEX records_relay_recipient ON records(kind, recipient_identity, seq);
+      CREATE UNIQUE INDEX records_source_message ON records(source_msg_id) WHERE kind='message' AND source_msg_id IS NOT NULL;
+      CREATE UNIQUE INDEX records_source_file ON records(source_file_id) WHERE kind='file' AND source_file_id IS NOT NULL;
+      CREATE INDEX records_briefing ON records(category, briefing_role, briefing_version, seq);
+      CREATE INDEX records_membership_epoch ON records(category, membership_epoch);
+      CREATE INDEX recipients_identity ON record_recipients(recipient_identity, record_seq);
+      CREATE INDEX recipients_briefing_delivery ON record_recipients
+        (recipient_identity, category, briefing_role, briefing_version, record_seq);`);
+            db.pragma(`user_version = ${SQLITE_SCHEMA_VERSION}`);
+            this.reconciledBlobRooms.add(roomId);
+          } else {
+            const version = db.pragma("user_version", { simple: true });
+            if (version !== SQLITE_SCHEMA_VERSION) {
+              throw new CoworkStorageError(`unsupported room archive schema version ${version}`);
+            }
+            if (!this.reconciledBlobRooms.has(roomId)) {
+              this.reconcileBlobDirectory(roomId, db);
+              this.reconciledBlobRooms.add(roomId);
+            }
           }
-          if (archivePresent) {
-            this.assertRegularFile(archivePath, "room archive");
-            this.fs.unlinkSync(archivePath);
-            this.fsyncDirectory(roomDir);
+          this.secureSqliteFiles(path);
+          const result = work(db);
+          this.secureSqliteFiles(path);
+          return result;
+        } catch (error) {
+          throw this.wrap(`failed to access room "${roomId}" SQLite archive`, error);
+        } finally {
+          try {
+            db?.close();
+          } catch {
           }
-          if (metadataPresent) {
-            this.assertRegularFile(metadataPath, "room metadata");
-            this.fs.unlinkSync(metadataPath);
-            this.fsyncDirectory(roomDir);
+          if (guardFd !== void 0) try {
+            this.fs.closeSync(guardFd);
+          } catch {
+          }
+          this.secureSqliteFiles(path);
+        }
+      }
+      indexValues(record) {
+        const subject = record;
+        return {
+          seq: record.seq,
+          record_id: record.record_id,
+          kind: record.kind,
+          at: record.at,
+          message_id: subject.message_id ?? null,
+          file_id: subject.file_id ?? null,
+          intent_record_id: subject.intent_record_id ?? null,
+          recipient_identity: subject.recipient_identity ?? null,
+          source_msg_id: subject.source_msg_id ?? null,
+          source_file_id: subject.source_file_id ?? null,
+          category: subject.category ?? null,
+          briefing_role: subject.briefing_role ?? null,
+          briefing_version: subject.briefing_version ?? null,
+          membership_epoch: typeof subject.membership === "object" && subject.membership !== null ? subject.membership.epoch ?? null : null
+        };
+      }
+      decodeRows(roomId, rows) {
+        return rows.map((row) => {
+          let decoded;
+          try {
+            decoded = JSON.parse(row.payload_json);
+          } catch (error) {
+            throw new CoworkStorageError(`malformed JSON in room "${roomId}" archive at sequence ${row.seq}`, { cause: error });
+          }
+          if (row.blob_path !== null) {
+            const subject = decoded;
+            const expectedPath = subject.kind === "file" && typeof subject.sha256 === "string" && /^[0-9a-f]{64}$/.test(subject.sha256) ? join3("blobs", subject.sha256) : void 0;
+            if (expectedPath === void 0 || row.blob_path !== expectedPath) {
+              throw new CoworkStorageError(`invalid blob reference in room "${roomId}" archive at sequence ${row.seq}`);
+            }
+            const bytes = this.readFileNoFollow(join3(this.roomDirectory(roomId), expectedPath), "room file blob");
+            decoded = { ...decoded, data_base64: bytes.toString("base64") };
+          }
+          try {
+            const record = CommunicationRecordSchema.parse(decoded);
+            if (record.room_id !== roomId || record.seq !== row.seq) throw new Error("indexed identity mismatch");
+            return record;
+          } catch (error) {
+            throw new CoworkStorageError(`invalid record in room "${roomId}" archive at sequence ${row.seq}`, { cause: error });
           }
-          this.fs.rmdirSync(roomDir);
-          this.fsyncDirectory(this.roomsDirectory());
-          this.nextSequences.delete(validRoomId);
         });
       }
-      removeProvisioningArtifacts(roomDir) {
-        const journalPath = join3(roomDir, ".cowork-provisioning-stage");
-        const targets = [join3(roomDir, "live"), join3(roomDir, "provisioning-residue")];
-        if (this.lstatIfPresent(journalPath)) {
-          this.assertRegularFile(journalPath, "provisioning staging journal");
-          const stagingName = this.fs.readFileSync(journalPath, "utf8").trim();
-          if (!/^live\.staging-[0-9a-f]{32}$/.test(stagingName)) {
-            throw new CoworkStorageError("invalid provisioning staging journal");
+      persistBlob(roomId, digest, bytes) {
+        const directory = this.blobsDirectory(roomId);
+        this.ensurePrivateDirectory(directory, true, "room blobs directory");
+        const final = join3(directory, digest);
+        if (this.lstatIfPresent(final)) {
+          this.assertRegularFile(final, "room file blob");
+          if (this.readFileNoFollow(final, "room file blob").equals(bytes)) return { path: join3("blobs", digest), created: false };
+          throw new CoworkStorageError(`immutable blob collision for ${digest}`);
+        }
+        const temp = join3(directory, `.tmp-${process.pid}-${randomBytes3(8).toString("hex")}`);
+        let fd;
+        try {
+          fd = this.fs.openSync(temp, nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2, FILE_MODE2);
+          this.writeAll(fd, bytes);
+          this.fs.fsyncSync(fd);
+          this.fs.closeSync(fd);
+          fd = void 0;
+          this.fs.renameSync(temp, final);
+          this.fsyncDirectory(directory);
+          this.fs.chmodSync(final, FILE_MODE2);
+          return { path: join3("blobs", digest), created: true };
+        } finally {
+          if (fd !== void 0) try {
+            this.fs.closeSync(fd);
+          } catch {
+          }
+          if (this.lstatIfPresent(temp)) try {
+            this.fs.unlinkSync(temp);
+          } catch {
           }
-          targets.push(join3(roomDir, stagingName));
         }
-        for (const target of targets) {
-          const stat = this.lstatIfPresent(target);
-          if (!stat) continue;
-          if (stat.isSymbolicLink() || !stat.isDirectory()) this.fs.unlinkSync(target);
-          else this.fs.rmSync(target, { recursive: true, force: true });
-          this.fsyncDirectory(roomDir);
+      }
+      removeUnreferencedBlob(roomId, relativePath) {
+        const absolute = join3(this.roomDirectory(roomId), relativePath);
+        try {
+          const referenced = this.withDatabase(roomId, (db) => db.prepare(
+            "SELECT EXISTS(SELECT 1 FROM records WHERE blob_path = ?) AS found"
+          ).get(relativePath).found !== 0);
+          if (referenced || !this.lstatIfPresent(absolute)) return;
+          this.assertRegularFile(absolute, "unreferenced room file blob");
+          this.fs.unlinkSync(absolute);
+          this.fsyncDirectory(dirname2(absolute));
+        } catch {
         }
-        if (this.lstatIfPresent(journalPath)) {
-          this.fs.unlinkSync(journalPath);
-          this.fsyncDirectory(roomDir);
+      }
+      reconcileBlobDirectory(roomId, db) {
+        const directory = this.blobsDirectory(roomId);
+        this.ensurePrivateDirectory(directory, true, "room blobs directory");
+        const referenced = new Set(db.prepare(
+          "SELECT blob_path FROM records WHERE blob_path IS NOT NULL"
+        ).all().map((row) => basename(row.blob_path)));
+        let changed = false;
+        for (const entry of this.fs.readdirSync(directory, { withFileTypes: true })) {
+          const path = join3(directory, entry.name);
+          if (/^\.tmp-[0-9]+-[0-9a-f]{16}$/.test(entry.name)) {
+            this.assertRegularFile(path, "crash-left room blob temporary file");
+            this.fs.unlinkSync(path);
+            changed = true;
+            continue;
+          }
+          if (!/^[0-9a-f]{64}$/.test(entry.name)) throw new CoworkStorageError(`unexpected room blob residue: ${entry.name}`);
+          this.assertRegularFile(path, referenced.has(entry.name) ? "room file blob" : "unreferenced room file blob");
+          this.fs.chmodSync(path, FILE_MODE2);
+          if (referenced.has(entry.name)) continue;
+          this.fs.unlinkSync(path);
+          changed = true;
+        }
+        if (changed) this.fsyncDirectory(directory);
+      }
+      secureSqliteFiles(path) {
+        for (const candidate of [path, `${path}-wal`, `${path}-shm`]) {
+          if (!this.lstatIfPresent(candidate)) continue;
+          this.assertRegularFile(candidate, `SQLite file ${basename(candidate)}`);
+          this.fs.chmodSync(candidate, FILE_MODE2);
         }
       }
+      validatePage(after, limit) {
+        if (!Number.isSafeInteger(after) || after < 0) throw new CoworkStorageError("after must be a non-negative safe integer");
+        if (!Number.isSafeInteger(limit) || limit < 1) throw new CoworkStorageError("limit must be a positive safe integer");
+      }
       loadUnlocked(roomId) {
         this.assertRoomDirectory(roomId);
         const path = this.metadataPath(roomId);
         this.assertRegularFile(path, "room metadata");
+        let decoded;
         let bytes;
         try {
           bytes = this.readFileNoFollow(path, "room metadata");
-        } catch (error) {
-          throw this.wrap(`failed to read room "${roomId}" metadata`, error);
-        }
-        let decoded;
-        try {
           decoded = JSON.parse(utf8Decoder.decode(bytes));
         } catch (error) {
           throw this.wrap(`malformed metadata for room "${roomId}"`, error);
         }
         const room = this.isVersion1(decoded) ? this.migrateUnlocked(roomId, decoded, bytes) : RoomSchema.parse(decoded);
-        if (!this.isVersion1(decoded) && this.persistedRoomName(decoded) !== room.room_name) {
-          this.atomicMetadataWrite(this.metadataPath(roomId), room);
-        }
+        if (!this.isVersion1(decoded) && this.persistedRoomName(decoded) !== room.room_name) this.atomicMetadataWrite(path, room);
         if (room.room_id !== roomId) throw new CoworkStorageError(`metadata room_id does not match room "${roomId}"`);
         return room;
       }
@@ -7834,79 +8158,54 @@ var init_storage = __esm({
       persistedRoomName(decoded) {
         return typeof decoded === "object" && decoded !== null ? decoded.room_name : void 0;
       }
-      /**
-       * Lazy additive v1 → v2 migration: preserve the exact pre-migration
-       * bytes once as room.json.v1.bak, then atomically persist the v2 metadata.
-       *
-       * THE BACKUP IS WRITTEN TEMP → FSYNC → RENAME, not opened in place, and the
-       * reason is a crash window that an existence check cannot see. The earlier
-       * version guarded with `if (!lstatIfPresent(backupPath))` and wrote straight
-       * into the final path under O_CREAT|O_EXCL. A crash inside that write leaves a
-       * PARTIAL file that nonetheless EXISTS, so the next load's existence check
-       * skips the backup, writes v2, and the pre-migration bytes are gone — no
-       * error, no warning, and the one artefact that exists to undo a bad migration
-       * is a truncated fragment. Measured before the fix: a 40-byte prefix of a
-       * 604-byte room, JSON.parse false, room.json already v2.
-       *
-       * A rename is atomic, so the final path now only ever appears complete. The
-       * temp file is created with O_EXCL under a pid+random name and removed on
-       * failure, so a crashed attempt leaves at most an orphan temp, never a
-       * plausible-looking backup.
-       *
-       * AND AN EXISTING BACKUP IS PARSED BEFORE IT IS TRUSTED, which repairs the
-       * case where a partial file is ALREADY on disk from a build without this fix —
-       * exactly the state a host that ran the previous code could be in right now.
-       * A backup that does not parse as v1 is replaced by the bytes we hold, because
-       * those are the real pre-migration bytes and the fragment is worthless.
-       *
-       * WHAT THE BACKUP IS NOT: restoring it is NOT a rollback. See the note on
-       * `restoreV1Backup` — re-migrating mints fresh participant ids.
-       */
-      migrateUnlocked(roomId, decoded, originalBytes) {
+      migrateUnlocked(roomId, decoded, original) {
         const v1 = RoomV1Schema.parse(decoded);
         if (v1.room_id !== roomId) throw new CoworkStorageError(`metadata room_id does not match room "${roomId}"`);
         const migrated = migrateRoomV1(v1, generateUlid);
-        const backupPath = `${this.metadataPath(roomId)}.v1.bak`;
-        if (!this.hasIntactV1Backup(backupPath)) {
-          this.atomicBytesWrite(backupPath, originalBytes, "room metadata v1 backup");
-        }
+        const backup = `${this.metadataPath(roomId)}.v1.bak`;
+        if (!this.hasIntactV1Backup(backup)) this.atomicBytesWrite(backup, original, "room metadata v1 backup");
         this.atomicMetadataWrite(this.metadataPath(roomId), migrated);
         return migrated;
       }
-      /**
-       * Is there already a backup we would be willing to hand back to an operator?
-       *
-       * Existence is not the question — a partial file exists. It must parse and
-       * still claim to be the v1 metadata for this room; anything else is a fragment
-       * and is better overwritten with the bytes we are holding right now.
-       */
-      hasIntactV1Backup(backupPath) {
-        if (!this.lstatIfPresent(backupPath)) return false;
+      hasIntactV1Backup(path) {
+        if (!this.lstatIfPresent(path)) return false;
         try {
-          const decoded = JSON.parse(utf8Decoder.decode(this.readFileNoFollow(backupPath, "room metadata v1 backup")));
-          return this.isVersion1(decoded);
+          return this.isVersion1(JSON.parse(utf8Decoder.decode(this.readFileNoFollow(path, "room metadata v1 backup"))));
         } catch {
           return false;
         }
       }
-      /**
-       * Durably place exact bytes at `path`: temp under O_EXCL, fsync, rename, fsync
-       * the directory. The same dance as atomicMetadataWrite, which serialises a Room
-       * rather than taking bytes verbatim — and taking them verbatim is the whole
-       * point for a backup, whose value is being byte-identical to what was there.
-       */
+      removeProvisioningArtifacts(roomDir) {
+        const journal = join3(roomDir, ".cowork-provisioning-stage");
+        const targets = [join3(roomDir, "live"), join3(roomDir, "provisioning-residue")];
+        if (this.lstatIfPresent(journal)) {
+          this.assertRegularFile(journal, "provisioning staging journal");
+          const name = this.fs.readFileSync(journal, "utf8").trim();
+          if (!/^live\.staging-[0-9a-f]{32}$/.test(name)) throw new CoworkStorageError("invalid provisioning staging journal");
+          targets.push(join3(roomDir, name));
+        }
+        for (const target of targets) {
+          const stat = this.lstatIfPresent(target);
+          if (!stat) continue;
+          if (stat.isSymbolicLink() || !stat.isDirectory()) this.fs.unlinkSync(target);
+          else this.fs.rmSync(target, { recursive: true, force: true });
+          this.fsyncDirectory(roomDir);
+        }
+        if (this.lstatIfPresent(journal)) {
+          this.fs.unlinkSync(journal);
+          this.fsyncDirectory(roomDir);
+        }
+      }
+      atomicMetadataWrite(path, room) {
+        this.atomicBytesWrite(path, Buffer.from(`${JSON.stringify(room)}
+`), "room metadata");
+      }
       atomicBytesWrite(path, bytes, label) {
         if (this.lstatIfPresent(path)) this.assertRegularFile(path, label);
         const temp = `${path}.tmp-${process.pid}-${randomBytes3(8).toString("hex")}`;
         let fd;
         try {
-          fd = this.fs.openSync(
-            temp,
-            nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2,
-            FILE_MODE2
-          );
-          this.validateOpenPath(fd, temp, `temporary ${label}`, "file", true);
-          this.fs.fchmodSync(fd, FILE_MODE2);
+          fd = this.fs.openSync(temp, nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2, FILE_MODE2);
           this.writeAll(fd, bytes);
           this.fs.fsyncSync(fd);
           this.fs.closeSync(fd);
@@ -7914,11 +8213,9 @@ var init_storage = __esm({
           this.fs.renameSync(temp, path);
           this.fsyncDirectory(dirname2(path));
         } catch (error) {
-          if (fd !== void 0) {
-            try {
-              this.fs.closeSync(fd);
-            } catch {
-            }
+          if (fd !== void 0) try {
+            this.fs.closeSync(fd);
+          } catch {
           }
           try {
             this.fs.rmSync(temp, { force: true });
@@ -7927,84 +8224,31 @@ var init_storage = __esm({
           throw this.wrap(`failed to write ${label} at ${path}`, error);
         }
       }
-      scanArchive(roomId) {
-        const path = this.archivePath(roomId);
-        this.assertRegularFile(path, "room archive");
-        let bytes;
-        try {
-          bytes = this.readFileNoFollow(path, "room archive");
-        } catch (error) {
-          throw this.wrap(`failed to read room "${roomId}" archive`, error);
-        }
-        const records = [];
-        let byteOffset = 0;
-        let expectedSequence = 1;
-        while (byteOffset < bytes.byteLength) {
-          const newline = bytes.indexOf(10, byteOffset);
-          if (newline === -1) {
-            throw new CoworkStorageError(`partial JSON record in room "${roomId}" archive at byte offset ${byteOffset}`);
-          }
-          const line = bytes.subarray(byteOffset, newline);
-          let decoded;
-          try {
-            decoded = JSON.parse(utf8Decoder.decode(line));
-          } catch (error) {
-            throw new CoworkStorageError(
-              `malformed JSON in room "${roomId}" archive at byte offset ${byteOffset}`,
-              { cause: error }
-            );
-          }
-          const observedSequence = typeof decoded === "object" && decoded !== null && "seq" in decoded ? decoded.seq : void 0;
-          if (observedSequence !== expectedSequence) {
-            throw new CoworkStorageError(
-              `non-monotonic sequence in room "${roomId}" archive at byte offset ${byteOffset}: expected ${expectedSequence}, found ${String(observedSequence)}`
-            );
-          }
-          let record;
-          try {
-            record = CommunicationRecordSchema.parse(decoded);
-          } catch (error) {
-            throw new CoworkStorageError(
-              `invalid record in room "${roomId}" archive at byte offset ${byteOffset}`,
-              { cause: error }
-            );
-          }
-          if (record.room_id !== roomId) {
-            throw new CoworkStorageError(
-              `record room_id mismatch in room "${roomId}" archive at byte offset ${byteOffset}`
-            );
-          }
-          records.push(record);
-          expectedSequence += 1;
-          byteOffset = newline + 1;
-        }
-        return { records, nextSequence: expectedSequence };
-      }
       ensureBaseDirectories() {
         this.ensurePrivateDirectory(this.stateDir, true, "state directory");
         this.ensurePrivateDirectory(this.roomsDirectory(), true, "rooms directory");
       }
+      assertRoomDirectory(roomId) {
+        this.ensureBaseDirectories();
+        this.ensurePrivateDirectory(this.roomDirectory(roomId), false, `room "${roomId}" directory`);
+      }
       ensurePrivateDirectory(path, create, label) {
         let stat = this.lstatIfPresent(path);
-        const created = stat === void 0;
-        if (created) {
+        if (!stat) {
           if (!create) throw new CoworkStorageError(`${label} does not exist`);
           this.createPrivateDirectoryTree(path, label);
           stat = this.fs.lstatSync(path);
         }
-        const current = stat;
-        if (current.isSymbolicLink()) throw new CoworkStorageError(`${label} must not be a symbolic link (symlink)`);
-        if (!current.isDirectory()) throw new CoworkStorageError(`${label} is not a directory`);
+        if (stat.isSymbolicLink() || !stat.isDirectory()) throw new CoworkStorageError(`${label} is not a private directory`);
         this.fs.chmodSync(path, DIRECTORY_MODE2);
       }
       createPrivateDirectoryTree(path, label) {
         const missing = [];
         let cursor = path;
         for (; ; ) {
-          const existing = this.lstatIfPresent(cursor);
-          if (existing) {
-            if (existing.isSymbolicLink()) throw new CoworkStorageError(`${label} parent must not be a symbolic link (symlink)`);
-            if (!existing.isDirectory()) throw new CoworkStorageError(`${label} parent is not a directory`);
+          const stat = this.lstatIfPresent(cursor);
+          if (stat) {
+            if (stat.isSymbolicLink() || !stat.isDirectory()) throw new CoworkStorageError(`${label} parent is unsafe`);
             break;
           }
           missing.push(cursor);
@@ -8012,120 +8256,45 @@ var init_storage = __esm({
           if (parent === cursor) throw new CoworkStorageError(`cannot find existing parent for ${label}`);
           cursor = parent;
         }
-        const created = [];
-        try {
-          for (const directory of missing.reverse()) {
-            this.fs.mkdirSync(directory, { mode: DIRECTORY_MODE2 });
-            created.push(directory);
-            this.fs.chmodSync(directory, DIRECTORY_MODE2);
-            this.fsyncDirectory(directory);
-            this.fsyncDirectory(dirname2(directory));
-          }
-        } catch (error) {
-          for (const directory of created.reverse()) {
-            try {
-              this.fs.rmdirSync(directory);
-              this.fsyncDirectory(dirname2(directory));
-            } catch {
-            }
-          }
-          throw error;
+        for (const directory of missing.reverse()) {
+          this.fs.mkdirSync(directory, { mode: DIRECTORY_MODE2 });
+          this.fs.chmodSync(directory, DIRECTORY_MODE2);
+          this.fsyncDirectory(directory);
+          this.fsyncDirectory(dirname2(directory));
         }
       }
-      assertRoomDirectory(roomId) {
-        this.ensureBaseDirectories();
-        this.ensurePrivateDirectory(this.roomDirectory(roomId), false, `room "${roomId}" directory`);
-      }
       rejectSymlink(path, label) {
-        if (this.fs.lstatSync(path).isSymbolicLink()) {
-          throw new CoworkStorageError(`${label} must not be a symbolic link (symlink)`);
-        }
+        if (this.fs.lstatSync(path).isSymbolicLink()) throw new CoworkStorageError(`${label} must not be a symbolic link (symlink)`);
       }
       assertRegularFile(path, label) {
         this.rejectSymlink(path, label);
         const stat = this.fs.lstatSync(path);
-        if (!stat.isFile()) throw new CoworkStorageError(`${label} is not a regular file`);
-        if (stat.nlink !== 1) throw new CoworkStorageError(`${label} has unsafe hardlink link count ${stat.nlink}`);
-      }
-      lstatIfPresent(path) {
-        try {
-          return this.fs.lstatSync(path);
-        } catch (error) {
-          if (error.code === "ENOENT") return void 0;
-          throw error;
-        }
+        if (!stat.isFile() || stat.nlink !== 1) throw new CoworkStorageError(`${label} is not a safe regular file`);
       }
       validateOpenPath(fd, path, label, kind, requireSingleLink) {
         const opened = this.fs.fstatSync(fd);
         const validKind = kind === "file" ? opened.isFile() : opened.isDirectory();
         if (!validKind) throw new CoworkStorageError(`${label} open descriptor is not a regular ${kind}`);
-        if (requireSingleLink && opened.nlink !== 1) {
-          throw new CoworkStorageError(`${label} has unsafe hardlink link count ${opened.nlink}`);
-        }
+        if (requireSingleLink && opened.nlink !== 1) throw new CoworkStorageError(`${label} has unsafe hardlink link count ${opened.nlink}`);
         const current = this.fs.lstatSync(path);
         if (current.isSymbolicLink()) throw new CoworkStorageError(`${label} must not be a symbolic link (symlink)`);
-        if (current.dev !== opened.dev || current.ino !== opened.ino) {
-          throw new CoworkStorageError(`${label} inode changed during open`);
-        }
+        if (current.dev !== opened.dev || current.ino !== opened.ino) throw new CoworkStorageError(`${label} inode changed during open`);
         return opened;
       }
-      createArchive(roomId) {
-        const path = this.archivePath(roomId);
-        let fd;
-        try {
-          fd = this.fs.openSync(
-            path,
-            nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2,
-            FILE_MODE2
-          );
-          this.validateOpenPath(fd, path, "room archive", "file", true);
-          this.fs.fchmodSync(fd, FILE_MODE2);
-          this.fs.fsyncSync(fd);
-        } finally {
-          if (fd !== void 0) this.fs.closeSync(fd);
-        }
-        this.fsyncDirectory(dirname2(path));
-      }
-      atomicMetadataWrite(path, room) {
-        if (this.lstatIfPresent(path)) this.assertRegularFile(path, "room metadata");
-        const temp = `${path}.tmp-${process.pid}-${randomBytes3(8).toString("hex")}`;
-        const bytes = Buffer.from(`${JSON.stringify(room)}
-`, "utf8");
-        let fd;
+      lstatIfPresent(path) {
         try {
-          fd = this.fs.openSync(
-            temp,
-            nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2,
-            FILE_MODE2
-          );
-          this.validateOpenPath(fd, temp, "temporary room metadata", "file", true);
-          this.fs.fchmodSync(fd, FILE_MODE2);
-          this.writeAll(fd, bytes);
-          this.fs.fsyncSync(fd);
-          this.fs.closeSync(fd);
-          fd = void 0;
-          this.fs.renameSync(temp, path);
-          this.fsyncDirectory(dirname2(path));
+          return this.fs.lstatSync(path);
         } catch (error) {
-          if (fd !== void 0) {
-            try {
-              this.fs.closeSync(fd);
-            } catch {
-            }
-          }
-          try {
-            this.fs.rmSync(temp, { force: true });
-          } catch {
-          }
-          throw this.wrap(`failed to atomically persist ${path}`, error);
+          if (error.code === "ENOENT") return void 0;
+          throw error;
         }
       }
       writeAll(fd, bytes) {
         let offset = 0;
-        while (offset < bytes.byteLength) {
-          const written = this.fs.writeSync(fd, bytes, offset, bytes.byteLength - offset, null);
-          if (written <= 0) throw new CoworkStorageError("write made no progress");
-          offset += written;
+        while (offset < bytes.length) {
+          const n = this.fs.writeSync(fd, bytes, offset, bytes.length - offset, null);
+          if (n <= 0) throw new CoworkStorageError("write made no progress");
+          offset += n;
         }
       }
       readFileNoFollow(path, label) {
@@ -8163,10 +8332,13 @@ var init_storage = __esm({
         return join3(this.roomDirectory(roomId), "room.json");
       }
       archivePath(roomId) {
-        return join3(this.roomDirectory(roomId), "archive.jsonl");
+        return join3(this.roomDirectory(roomId), "archive.sqlite3");
+      }
+      blobsDirectory(roomId) {
+        return join3(this.roomDirectory(roomId), "blobs");
       }
       wrap(message, error) {
-        return error instanceof CoworkStorageError ? new CoworkStorageError(`${message}: ${error.message}`, { cause: error }) : new CoworkStorageError(`${message}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+        return new CoworkStorageError(`${message}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
       }
     };
   }
@@ -9077,7 +9249,7 @@ import { randomBytes as randomBytes4 } from "node:crypto";
 import * as http from "node:http";
 import * as net from "node:net";
 import * as nodeFs4 from "node:fs";
-import { basename, dirname as dirname3, join as join5 } from "node:path";
+import { basename as basename2, dirname as dirname3, join as join5 } from "node:path";
 function createServiceRoutes(service) {
   return {
     "room.create": { auth: true, run: (params2) => service.createRoom(params2) },
@@ -9743,7 +9915,7 @@ var init_transports = __esm({
       }
       async cleanupStalePrivateSockets() {
         const directory = dirname3(this.options.socketPath);
-        const prefix = `${basename(this.options.socketPath)}.private-`;
+        const prefix = `${basename2(this.options.socketPath)}.private-`;
         const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
         const candidates = this.fs.readdirSync(directory).filter((name) => name.startsWith(prefix)).sort().slice(0, MAX_STALE_PRIVATE_SOCKET_CLEANUP);
         for (const name of candidates) {
@@ -10146,8 +10318,7 @@ var init_daemon_runtime = __esm({
           );
           this.service = this.options.service ?? new RoomService(
             this.store,
-            this.registry,
-            { identityNameMode: config.roomIdentity?.nameMode ?? "stable_id" }
+            this.registry
           );
           serviceRef = this.service;
           this.hostStartAttempted = true;