@ours.network/cowork 1.0.2 → 1.0.3

package/dist/daemon.js

@@ -5736,6 +5736,20 @@ function sameReply2(stored, observed) {
   if (stored === void 0 || observed == null) return stored === void 0 && observed == null;
   return stored.wire_id === observed.wire_id && stored.sentence === observed.sentence;
 }
+async function queryStore(store, roomId, options) {
+  if (store.query) return store.query(roomId, options);
+  let records = await store.read(roomId);
+  records = records.filter((record) => {
+    const value = record;
+    return (options.kind === void 0 || record.kind === options.kind) && (options.messageId === void 0 || value.message_id === options.messageId) && (options.fileId === void 0 || value.file_id === options.fileId) && (options.sourceMsgId === void 0 || value.source_msg_id === options.sourceMsgId) && (options.sourceFileId === void 0 || value.source_file_id === options.sourceFileId) && (options.recipientIdentity === void 0 || value.recipient_identity === options.recipientIdentity);
+  });
+  if (options.unresolvedResultKind) {
+    const completed = new Set((await store.read(roomId)).filter((record) => record.kind === options.unresolvedResultKind).map((record) => record.intent_record_id));
+    records = records.filter((record) => !completed.has(record.record_id));
+  }
+  if (options.descending) records.reverse();
+  return records.slice(0, options.limit);
+}
 function canonicalValue(value) {
   if (Array.isArray(value)) return value.map(canonicalValue);
   if (value !== null && typeof value === "object") {
@@ -5763,13 +5777,14 @@ function wireKind(category) {
       return "room_msg";
   }
 }
-var INTAKE_BATCH_SIZE, IntakePump;
+var JOURNAL_WORK_BATCH_SIZE, INTAKE_BATCH_SIZE, IntakePump;
 var init_intake = __esm({
   "src/intake.ts"() {
     "use strict";
     init_zod();
     init_contracts();
     init_ulid();
+    JOURNAL_WORK_BATCH_SIZE = 64;
     INTAKE_BATCH_SIZE = 32;
     IntakePump = class {
       store;
@@ -5877,8 +5892,8 @@ var init_intake = __esm({
           await packet.acknowledgeFile(item);
           return;
         }
-        const records = await this.store.read(roomId);
-        let file = this.findSourceFile(records, item);
+        const [storedFile] = await queryStore(this.store, roomId, { kind: "file", sourceFileId: item.file_id, limit: 1 });
+        let file = this.findSourceFile(storedFile === void 0 ? [] : [storedFile], item);
         if (!file) {
           const recipientIdentities = unique(room.seats.filter((recipient) => recipient.state === "active").map((recipient) => recipient.identity).filter((identity) => identity !== seat.identity));
           const bytes = Buffer.from(item.data);
@@ -5916,8 +5931,8 @@ var init_intake = __esm({
           if (acknowledge) await this.acknowledgeMessage(roomId, packet, item);
           return;
         }
-        const before = await this.store.read(roomId);
-        let message = this.findSourceMessage(before, item);
+        const [storedMessage] = await queryStore(this.store, roomId, { kind: "message", sourceMsgId: item.msg_id, limit: 1 });
+        let message = this.findSourceMessage(storedMessage === void 0 ? [] : [storedMessage], item);
         if (!message) {
           const recipientIdentities = unique(room.seats.filter((recipient) => recipient.state === "active").map((recipient) => recipient.identity).filter((identity) => identity !== seat.identity));
           const appended = await this.store.append(roomId, {
@@ -5980,100 +5995,153 @@ var init_intake = __esm({
         }
       }
       async completeSnapshotIntents(roomId) {
-        const records = await this.store.read(roomId);
-        for (const message of records.filter(
-          (record) => record.kind === "message"
-        )) await this.completeMessageIntents(roomId, message);
-        for (const file of records.filter(
-          (record) => record.kind === "file"
-        )) await this.completeFileIntents(roomId, file);
+        if (!this.store.recordsNeedingRelayIntents) {
+          const records = await this.store.read(roomId);
+          for (const message of records.filter(
+            (record) => record.kind === "message"
+          )) await this.completeMessageIntents(roomId, message);
+          for (const file of records.filter(
+            (record) => record.kind === "file"
+          )) await this.completeFileIntents(roomId, file);
+          return;
+        }
+        for (; ; ) {
+          const records = await this.store.recordsNeedingRelayIntents(
+            roomId,
+            { limit: JOURNAL_WORK_BATCH_SIZE }
+          );
+          if (records.length === 0) return;
+          for (const record of records) {
+            if (record.kind === "message") await this.completeMessageIntents(roomId, record);
+            else if (record.kind === "file") await this.completeFileIntents(roomId, record);
+          }
+        }
       }
       async completeFileIntents(roomId, file) {
-        const records = await this.store.read(roomId);
-        const intended = new Set(records.filter((record) => record.kind === "relay_intent" && record.file_id === file.file_id).map((intent) => intent.recipient_identity));
+        if (this.store.relayRecipientsNeedingIntent) {
+          for (const recipientIdentity of await this.store.relayRecipientsNeedingIntent(roomId, file.seq)) {
+            await this.appendFileIntent(roomId, file.file_id, recipientIdentity);
+          }
+          return;
+        }
+        const records = await queryStore(this.store, roomId, { kind: "relay_intent", fileId: file.file_id });
+        const intended = new Set(records.map((record) => record.recipient_identity));
         for (const recipientIdentity of file.recipient_identities) {
           if (intended.has(recipientIdentity)) continue;
-          await this.store.append(roomId, {
-            version: 1,
-            kind: "relay_intent",
-            room_id: roomId,
-            at: this.now(),
-            file_id: file.file_id,
-            recipient_identity: recipientIdentity
-          });
+          await this.appendFileIntent(roomId, file.file_id, recipientIdentity);
           intended.add(recipientIdentity);
         }
       }
+      async appendFileIntent(roomId, fileId, recipientIdentity) {
+        await this.store.append(roomId, {
+          version: 1,
+          kind: "relay_intent",
+          room_id: roomId,
+          at: this.now(),
+          file_id: fileId,
+          recipient_identity: recipientIdentity
+        });
+      }
       async completeMessageIntents(roomId, message) {
-        const records = await this.store.read(roomId);
-        const intended = new Set(records.filter((record) => record.kind === "relay_intent" && record.message_id === message.message_id).map((intent) => intent.recipient_identity));
+        if (this.store.relayRecipientsNeedingIntent) {
+          for (const recipientIdentity of await this.store.relayRecipientsNeedingIntent(roomId, message.seq)) {
+            await this.appendMessageIntent(roomId, message.message_id, recipientIdentity);
+          }
+          return;
+        }
+        const records = await queryStore(this.store, roomId, { kind: "relay_intent", messageId: message.message_id });
+        const intended = new Set(records.map((record) => record.recipient_identity));
         for (const recipientIdentity of message.recipient_identities) {
           if (intended.has(recipientIdentity)) continue;
-          await this.store.append(roomId, {
-            version: 1,
-            kind: "relay_intent",
-            room_id: roomId,
-            at: this.now(),
-            message_id: message.message_id,
-            recipient_identity: recipientIdentity
-          });
+          await this.appendMessageIntent(roomId, message.message_id, recipientIdentity);
           intended.add(recipientIdentity);
         }
       }
+      async appendMessageIntent(roomId, messageId, recipientIdentity) {
+        await this.store.append(roomId, {
+          version: 1,
+          kind: "relay_intent",
+          room_id: roomId,
+          at: this.now(),
+          message_id: messageId,
+          recipient_identity: recipientIdentity
+        });
+      }
       async relayPendingUnlocked(roomId, packet) {
-        const records = await this.store.read(roomId);
         const room = await this.store.load(roomId);
         const activeCids = new Set(room.seats.filter((seat) => seat.state === "active").map((seat) => seat.identity));
         const removedCids = new Set(room.seats.filter((seat) => seat.state === "removed").map((seat) => seat.identity));
-        const messages = new Map(records.filter((record) => record.kind === "message").map((message) => [message.message_id, message]));
-        const files = new Map(records.filter((record) => record.kind === "file").map((file) => [file.file_id, file]));
-        const completed = new Set(records.filter((record) => record.kind === "relay_result").map((result) => result.kind === "relay_result" ? result.intent_record_id : ""));
-        for (const intent of records.filter(
-          (record) => record.kind === "relay_intent"
-        )) {
-          if (completed.has(intent.record_id)) continue;
-          const message = intent.message_id === void 0 ? void 0 : messages.get(intent.message_id);
-          const file = intent.file_id === void 0 ? void 0 : files.get(intent.file_id);
-          if (message === void 0 === (file === void 0)) continue;
-          const recipients = message?.recipient_identities ?? file.recipient_identities;
-          if (!recipients.includes(intent.recipient_identity)) continue;
-          if (!activeCids.has(intent.recipient_identity) && removedCids.has(intent.recipient_identity)) {
-            const skipped = await this.store.append(roomId, {
-              version: 1,
-              kind: "relay_result",
-              room_id: roomId,
-              at: this.now(),
-              intent_record_id: intent.record_id,
-              ...intent.message_id === void 0 ? {} : { message_id: intent.message_id },
-              ...intent.file_id === void 0 ? {} : { file_id: intent.file_id },
-              recipient_identity: intent.recipient_identity,
-              status: "skipped_removed"
-            });
-            if (skipped.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
-            completed.add(intent.record_id);
-            continue;
-          }
-          if (file !== void 0) {
-            const author = file.author_alias === void 0 ? file.author : {
-              identity: file.author_alias.participant_id,
-              display_name: file.author_alias.alias,
-              role: file.author.role
-            };
-            const metadata = await sendRoomBody(packet, intent.recipient_identity, {
-              version: 1,
-              kind: "room_file",
-              room_id: roomId,
-              room_name: room.room_name,
-              file_id: file.file_id,
-              author,
-              filename: file.filename,
-              mime: file.mime,
-              size: file.size,
-              sha256: file.sha256,
-              at: file.at
-            });
-            if (metadata.status === "send_failed") {
-              const failed = await this.store.append(roomId, {
+        let after = 0;
+        for (; ; ) {
+          const pending = await queryStore(this.store, roomId, {
+            kind: "relay_intent",
+            unresolvedResultKind: "relay_result",
+            after,
+            limit: JOURNAL_WORK_BATCH_SIZE
+          });
+          if (pending.length === 0) return;
+          for (const intent of pending) {
+            after = intent.seq;
+            const [message] = intent.message_id === void 0 ? [] : await queryStore(this.store, roomId, { kind: "message", messageId: intent.message_id, limit: 1 });
+            const [file] = intent.file_id === void 0 ? [] : await queryStore(this.store, roomId, { kind: "file", fileId: intent.file_id, limit: 1 });
+            if (message === void 0 === (file === void 0)) continue;
+            const recipients = message?.recipient_identities ?? file.recipient_identities;
+            if (!recipients.includes(intent.recipient_identity)) continue;
+            if (!activeCids.has(intent.recipient_identity) && removedCids.has(intent.recipient_identity)) {
+              const skipped = await this.store.append(roomId, {
+                version: 1,
+                kind: "relay_result",
+                room_id: roomId,
+                at: this.now(),
+                intent_record_id: intent.record_id,
+                ...intent.message_id === void 0 ? {} : { message_id: intent.message_id },
+                ...intent.file_id === void 0 ? {} : { file_id: intent.file_id },
+                recipient_identity: intent.recipient_identity,
+                status: "skipped_removed"
+              });
+              if (skipped.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
+              continue;
+            }
+            if (file !== void 0) {
+              const author = file.author_alias === void 0 ? file.author : {
+                identity: file.author_alias.participant_id,
+                display_name: file.author_alias.alias,
+                role: file.author.role
+              };
+              const metadata = await sendRoomBody(packet, intent.recipient_identity, {
+                version: 1,
+                kind: "room_file",
+                room_id: roomId,
+                room_name: room.room_name,
+                file_id: file.file_id,
+                author,
+                filename: file.filename,
+                mime: file.mime,
+                size: file.size,
+                sha256: file.sha256,
+                at: file.at
+              });
+              if (metadata.status === "send_failed") {
+                const failed = await this.store.append(roomId, {
+                  version: 1,
+                  kind: "relay_result",
+                  room_id: roomId,
+                  at: this.now(),
+                  intent_record_id: intent.record_id,
+                  file_id: file.file_id,
+                  recipient_identity: intent.recipient_identity,
+                  status: "send_failed"
+                });
+                if (failed.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
+                continue;
+              }
+              const outcome2 = await packet.sendFile(
+                intent.recipient_identity,
+                file.filename,
+                file.mime,
+                Buffer.from(file.data_base64, "base64")
+              );
+              const appended2 = await this.store.append(roomId, {
                 version: 1,
                 kind: "relay_result",
                 room_id: roomId,
@@ -6081,66 +6149,45 @@ var init_intake = __esm({
                 intent_record_id: intent.record_id,
                 file_id: file.file_id,
                 recipient_identity: intent.recipient_identity,
-                status: "send_failed"
+                status: outcome2.status,
+                ...outcome2.wire_id === void 0 || outcome2.wire_id === "" ? {} : { wire_id: outcome2.wire_id },
+                ...metadata.wire_id === void 0 || metadata.wire_id === "" ? {} : { metadata_wire_id: metadata.wire_id }
               });
-              if (failed.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
-              completed.add(intent.record_id);
+              if (appended2.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
               continue;
             }
-            const outcome2 = await packet.sendFile(
-              intent.recipient_identity,
-              file.filename,
-              file.mime,
-              Buffer.from(file.data_base64, "base64")
-            );
-            const appended2 = await this.store.append(roomId, {
+            const unsigned = {
+              version: 1,
+              kind: wireKind(message.category),
+              room_id: roomId,
+              room_name: room.room_name,
+              message_id: message.message_id,
+              // An anonymous author leaves the archive only in alias form.
+              author: message.author_alias === void 0 ? message.author : {
+                identity: message.author_alias.participant_id,
+                display_name: message.author_alias.alias,
+                role: message.author.role
+              },
+              text: message.text,
+              at: message.at,
+              ...message.briefing_role === void 0 ? {} : { briefing_role: message.briefing_role },
+              ...message.briefing_version === void 0 ? {} : { briefing_version: message.briefing_version },
+              ...message.membership === void 0 ? {} : { membership: message.membership }
+            };
+            const outcome = await sendRoomBody(packet, intent.recipient_identity, unsigned);
+            const appended = await this.store.append(roomId, {
               version: 1,
               kind: "relay_result",
               room_id: roomId,
               at: this.now(),
               intent_record_id: intent.record_id,
-              file_id: file.file_id,
+              message_id: intent.message_id,
               recipient_identity: intent.recipient_identity,
-              status: outcome2.status,
-              ...outcome2.wire_id === void 0 || outcome2.wire_id === "" ? {} : { wire_id: outcome2.wire_id },
-              ...metadata.wire_id === void 0 || metadata.wire_id === "" ? {} : { metadata_wire_id: metadata.wire_id }
+              status: outcome.status,
+              ...outcome.wire_id === void 0 || outcome.wire_id === "" ? {} : { wire_id: outcome.wire_id }
             });
-            if (appended2.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
-            completed.add(intent.record_id);
-            continue;
+            if (appended.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
           }
-          const unsigned = {
-            version: 1,
-            kind: wireKind(message.category),
-            room_id: roomId,
-            room_name: room.room_name,
-            message_id: message.message_id,
-            // An anonymous author leaves the archive only in alias form.
-            author: message.author_alias === void 0 ? message.author : {
-              identity: message.author_alias.participant_id,
-              display_name: message.author_alias.alias,
-              role: message.author.role
-            },
-            text: message.text,
-            at: message.at,
-            ...message.briefing_role === void 0 ? {} : { briefing_role: message.briefing_role },
-            ...message.briefing_version === void 0 ? {} : { briefing_version: message.briefing_version },
-            ...message.membership === void 0 ? {} : { membership: message.membership }
-          };
-          const outcome = await sendRoomBody(packet, intent.recipient_identity, unsigned);
-          const appended = await this.store.append(roomId, {
-            version: 1,
-            kind: "relay_result",
-            room_id: roomId,
-            at: this.now(),
-            intent_record_id: intent.record_id,
-            message_id: intent.message_id,
-            recipient_identity: intent.recipient_identity,
-            status: outcome.status,
-            ...outcome.wire_id === void 0 || outcome.wire_id === "" ? {} : { wire_id: outcome.wire_id }
-          });
-          if (appended.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
-          completed.add(intent.record_id);
         }
       }
       findSourceMessage(records, item) {
@@ -6199,6 +6246,21 @@ function byteBoundedHistoryPage(records) {
 function activeSeats(room) {
   return room.seats.filter((seat) => seat.state === "active");
 }
+async function queryStore2(store, roomId, options) {
+  if (store.query) return store.query(roomId, options);
+  let records = await store.read(roomId);
+  records = records.filter((record) => {
+    const value = record;
+    const membership = value.membership;
+    return (options.kind === void 0 || record.kind === options.kind) && (options.after === void 0 || record.seq > options.after) && (options.messageId === void 0 || value.message_id === options.messageId) && (options.fileId === void 0 || value.file_id === options.fileId) && (options.intentRecordId === void 0 || value.intent_record_id === options.intentRecordId) && (options.recipientIdentity === void 0 || value.recipient_identity === options.recipientIdentity) && (options.category === void 0 || value.category === options.category) && (options.membershipEpoch === void 0 || membership?.epoch === options.membershipEpoch);
+  });
+  if (options.unresolvedResultKind) {
+    const completed = new Set((await store.read(roomId)).filter((record) => record.kind === options.unresolvedResultKind).map((record) => record.intent_record_id));
+    records = records.filter((record) => !completed.has(record.record_id));
+  }
+  if (options.descending) records.reverse();
+  return records.slice(0, options.limit ?? Number.MAX_SAFE_INTEGER);
+}
 function isCancelledExternalSeat(seat) {
   return seat.state === "removed" && seat.accepted_at === void 0 && seat.requested_at !== void 0 && seat.invite_sha256 !== void 0;
 }
@@ -6211,7 +6273,7 @@ function uniqueIdentities(identities) {
 function currentContactIdentities(packet) {
   return new Set(packet.listContacts().map((contact) => contact.container_id));
 }
-var CreateInviteInputSchema, HistoryOptionsSchema, DeleteRoomInputSchema, RemoveParticipantInputSchema, ReplaceParticipantInputSchema, RoomServiceError, RoomService;
+var CreateInviteInputSchema, HistoryOptionsSchema, JOURNAL_WORK_BATCH_SIZE2, DeleteRoomInputSchema, RemoveParticipantInputSchema, ReplaceParticipantInputSchema, RoomServiceError, RoomService;
 var init_service = __esm({
   "src/service.ts"() {
     "use strict";
@@ -6238,6 +6300,7 @@ var init_service = __esm({
       limit: external_exports.number().int().positive().safe().optional(),
       view: external_exports.enum(["operator", "participant"]).optional()
     }).strict();
+    JOURNAL_WORK_BATCH_SIZE2 = 64;
     DeleteRoomInputSchema = external_exports.object({
       confirm: external_exports.literal(true)
     }).strict();
@@ -6720,8 +6783,11 @@ var init_service = __esm({
             membership_epoch: Math.max(current.membership_epoch, intent.epoch)
           }));
         }
-        const records = await this.store.read(current.room_id);
-        const existing = records.find((record) => record.kind === "membership_result" && record.intent_record_id === intent.record_id);
+        const [existing] = await queryStore2(this.store, current.room_id, {
+          kind: "membership_result",
+          intentRecordId: intent.record_id,
+          limit: 1
+        });
         let outcome;
         if (existing !== void 0 && existing.kind === "membership_result") {
           outcome = {
@@ -6760,8 +6826,13 @@ var init_service = __esm({
         };
       }
       async ensureMembershipNotice(room, intent) {
-        const records = await this.store.read(room.room_id);
-        const already = records.some((record) => record.kind === "message" && record.category === "membership" && record.membership?.action === "remove" && record.membership.epoch === intent.epoch);
+        const records = await queryStore2(this.store, room.room_id, {
+          kind: "message",
+          category: "membership",
+          membershipEpoch: intent.epoch,
+          limit: 1
+        });
+        const already = records.length > 0;
         if (already) return;
         const remaining = activeSeats(room);
         if (remaining.length === 0) return;
@@ -6971,7 +7042,7 @@ var init_service = __esm({
       async history(roomId, options = {}) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
         const { view, ...page } = HistoryOptionsSchema.parse(options);
-        const records = await this.store.read(id, view === "participant" ? { after: page.after } : page);
+        const records = view === "participant" ? await queryStore2(this.store, id, { kind: "message", after: page.after, limit: page.limit }) : await this.store.read(id, page);
         if (view !== "participant") return byteBoundedHistoryPage(records);
         const projected = records.filter((record) => record.kind === "message").map((record) => {
           const {
@@ -7238,13 +7309,19 @@ var init_service = __esm({
           invites,
           membership_epoch: room.membership_epoch + activatedPending.length + newSeats.length
         });
-        const journal = await this.store.read(next.room_id);
-        const completedIntents = new Set(journal.filter((record) => record.kind === "membership_result").map((record) => record.kind === "membership_result" ? record.intent_record_id : ""));
-        for (const intent of journal.filter(
-          (record) => record.kind === "membership_intent"
-        )) {
-          if (completedIntents.has(intent.record_id)) continue;
-          ({ room: next } = await this.completeRemovalUnlocked(next, intent));
+        let membershipAfter = 0;
+        for (; ; ) {
+          const journal = await queryStore2(this.store, next.room_id, {
+            kind: "membership_intent",
+            unresolvedResultKind: "membership_result",
+            after: membershipAfter,
+            limit: JOURNAL_WORK_BATCH_SIZE2
+          });
+          if (journal.length === 0) break;
+          for (const intent of journal) {
+            membershipAfter = intent.seq;
+            ({ room: next } = await this.completeRemovalUnlocked(next, intent));
+          }
         }
         const requirementsMet = invites.filter((invite) => invite.state !== "revoked").every((invite) => invite.accepted_cids.length >= invite.min_accepts);
         const admitted = [...activatedPending, ...newSeats];
@@ -7261,23 +7338,31 @@ var init_service = __esm({
         const packet = this.packets.get(roomId);
         if (packet) {
           await packet.refreshContacts();
-          let records = await this.store.read(roomId);
           let contacts = currentContactIdentities(packet);
-          const completed = new Set(records.filter((record) => record.kind === "close_notice_result").map((record) => record.kind === "close_notice_result" ? record.intent_record_id : ""));
-          const pending = records.filter(
-            (record) => record.kind === "close_notice_intent" && !completed.has(record.record_id)
-          );
-          for (const intent of pending) {
-            if (contacts.has(intent.recipient_identity)) continue;
-            await this.appendUncertainCloseResult(roomId, intent);
-            completed.add(intent.record_id);
+          let closeAfter = 0;
+          for (; ; ) {
+            const pending = await queryStore2(this.store, roomId, {
+              kind: "close_notice_intent",
+              unresolvedResultKind: "close_notice_result",
+              after: closeAfter,
+              limit: JOURNAL_WORK_BATCH_SIZE2
+            });
+            if (pending.length === 0) break;
+            for (const intent of pending) {
+              closeAfter = intent.seq;
+              if (contacts.has(intent.recipient_identity)) continue;
+              await this.appendUncertainCloseResult(roomId, intent);
+            }
           }
           for (const recipientIdentity of contacts) {
-            records = await this.store.read(roomId);
-            const currentCompleted = new Set(records.filter((record) => record.kind === "close_notice_result").map((record) => record.kind === "close_notice_result" ? record.intent_record_id : ""));
-            let intent = [...records].reverse().find(
-              (record) => record.kind === "close_notice_intent" && record.recipient_identity === recipientIdentity && !currentCompleted.has(record.record_id)
-            );
+            const [existingIntent] = await queryStore2(this.store, roomId, {
+              kind: "close_notice_intent",
+              recipientIdentity,
+              unresolvedResultKind: "close_notice_result",
+              descending: true,
+              limit: 1
+            });
+            let intent = existingIntent;
             if (!intent) {
               const appended2 = await this.store.append(roomId, {
                 version: 1,
@@ -7320,13 +7405,19 @@ var init_service = __esm({
             `room "${roomId}" live-state purge left residue: ${residue.join(", ") || "packet registry entry"}`
           );
         }
-        const afterPurge = await this.store.read(roomId);
-        const completedAfterPurge = new Set(afterPurge.filter((record) => record.kind === "close_notice_result").map((record) => record.kind === "close_notice_result" ? record.intent_record_id : ""));
-        for (const intent of afterPurge.filter(
-          (record) => record.kind === "close_notice_intent" && !completedAfterPurge.has(record.record_id)
-        )) {
-          await this.appendUncertainCloseResult(roomId, intent);
-          completedAfterPurge.add(intent.record_id);
+        let purgeAfter = 0;
+        for (; ; ) {
+          const afterPurge = await queryStore2(this.store, roomId, {
+            kind: "close_notice_intent",
+            unresolvedResultKind: "close_notice_result",
+            after: purgeAfter,
+            limit: JOURNAL_WORK_BATCH_SIZE2
+          });
+          if (afterPurge.length === 0) break;
+          for (const intent of afterPurge) {
+            purgeAfter = intent.seq;
+            await this.appendUncertainCloseResult(roomId, intent);
+          }
         }
         return this.store.save(RoomSchema.parse({ ...room, state: "closed", closed_at: this.now() }));
       }
@@ -7386,18 +7477,29 @@ var init_service = __esm({
         });
       }
       async ensureBriefingKind(room, recipients, briefing) {
-        const records = await this.store.read(room.room_id);
+        if (this.store.briefingDeliveryTimes) {
+          const recipientIdentities = uniqueIdentities(recipients.map((seat) => seat.identity));
+          const deliveries = await this.store.briefingDeliveryTimes(room.room_id, {
+            category: briefing.category,
+            briefingRole: briefing.briefing_role,
+            briefingVersion: briefing.briefing_version
+          }, recipientIdentities);
+          const missing2 = recipients.filter((seat) => !deliveries.has(seat.identity));
+          const appendedAt2 = await this.appendBriefingForMissing(room, missing2, briefing);
+          return [...deliveries.values(), ...appendedAt2 === void 0 ? [] : [appendedAt2]].sort()[0] ?? this.now();
+        }
+        const records = await queryStore2(this.store, room.room_id, {
+          kind: "message",
+          category: briefing.category
+        });
         const matching = records.filter((record) => record.kind === "message" && record.category === briefing.category && record.briefing_role === briefing.briefing_role && (record.briefing_version ?? 1) === briefing.briefing_version);
-        const intentsByMessage = /* @__PURE__ */ new Map();
-        for (const record of records) {
-          if (record.kind !== "relay_intent" || record.message_id === void 0) continue;
-          const intents = intentsByMessage.get(record.message_id) ?? /* @__PURE__ */ new Set();
-          intents.add(record.recipient_identity);
-          intentsByMessage.set(record.message_id, intents);
-        }
         const covered = /* @__PURE__ */ new Set();
         for (const message of matching) {
-          const intents = intentsByMessage.get(message.message_id) ?? /* @__PURE__ */ new Set();
+          const intentRecords = await queryStore2(this.store, room.room_id, {
+            kind: "relay_intent",
+            messageId: message.message_id
+          });
+          const intents = new Set(intentRecords.map((record) => record.recipient_identity));
           for (const recipientIdentity of message.recipient_identities) {
             covered.add(recipientIdentity);
             if (!intents.has(recipientIdentity)) {
@@ -7413,35 +7515,36 @@ var init_service = __esm({
           }
         }
         const missing = recipients.filter((seat) => !covered.has(seat.identity));
-        let appendedAt;
-        if (missing.length > 0) {
-          const appended = await this.store.append(room.room_id, {
+        const appendedAt = await this.appendBriefingForMissing(room, missing, briefing);
+        return matching[0]?.at ?? appendedAt ?? this.now();
+      }
+      async appendBriefingForMissing(room, missing, briefing) {
+        if (missing.length === 0) return void 0;
+        const appended = await this.store.append(room.room_id, {
+          version: 1,
+          kind: "message",
+          room_id: room.room_id,
+          at: this.now(),
+          message_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
+          author: { identity: room.identity_cid, display_name: room.identity_name, role: ROOM_ROLE },
+          category: briefing.category,
+          ...briefing.briefing_role === void 0 ? {} : { briefing_role: briefing.briefing_role },
+          briefing_version: briefing.briefing_version,
+          text: briefing.text,
+          recipient_identities: uniqueIdentities(missing.map((seat) => seat.identity))
+        });
+        if (appended.kind !== "message") throw new RoomServiceError("storage returned the wrong briefing record kind");
+        for (const recipientIdentity of appended.recipient_identities) {
+          await this.store.append(room.room_id, {
             version: 1,
-            kind: "message",
+            kind: "relay_intent",
             room_id: room.room_id,
             at: this.now(),
-            message_id: LowerCrockfordUlidSchema.parse(this.nextMessageId()),
-            author: { identity: room.identity_cid, display_name: room.identity_name, role: ROOM_ROLE },
-            category: briefing.category,
-            ...briefing.briefing_role === void 0 ? {} : { briefing_role: briefing.briefing_role },
-            briefing_version: briefing.briefing_version,
-            text: briefing.text,
-            recipient_identities: uniqueIdentities(missing.map((seat) => seat.identity))
+            message_id: appended.message_id,
+            recipient_identity: recipientIdentity
           });
-          if (appended.kind !== "message") throw new RoomServiceError("storage returned the wrong briefing record kind");
-          appendedAt = appended.at;
-          for (const recipientIdentity of appended.recipient_identities) {
-            await this.store.append(room.room_id, {
-              version: 1,
-              kind: "relay_intent",
-              room_id: room.room_id,
-              at: this.now(),
-              message_id: appended.message_id,
-              recipient_identity: recipientIdentity
-            });
-          }
         }
-        return matching[0]?.at ?? appendedAt ?? this.now();
+        return appended.at;
       }
       lock(roomId, work) {
         return this.store.mutex(roomId).runExclusive(work);
@@ -7475,8 +7578,9 @@ var init_service = __esm({
 import { randomBytes as randomBytes3 } from "node:crypto";
 import * as nodeFs2 from "node:fs";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { dirname as dirname2, join as join3 } from "node:path";
-var DIRECTORY_MODE2, FILE_MODE2, NO_FOLLOW2, utf8Decoder, CoworkStorageError, RoomQueue, CoworkStore;
+import { basename, dirname as dirname2, join as join3 } from "node:path";
+import Database from "better-sqlite3";
+var DIRECTORY_MODE2, FILE_MODE2, NO_FOLLOW2, SQLITE_SCHEMA_VERSION, DEFAULT_WORK_BATCH_SIZE, utf8Decoder, CoworkStorageError, RoomQueue, CoworkStore;
 var init_storage = __esm({
   "src/storage.ts"() {
     "use strict";
@@ -7485,6 +7589,8 @@ var init_storage = __esm({
     DIRECTORY_MODE2 = 448;
     FILE_MODE2 = 384;
     NO_FOLLOW2 = nodeFs2.constants.O_NOFOLLOW ?? 0;
+    SQLITE_SCHEMA_VERSION = 1;
+    DEFAULT_WORK_BATCH_SIZE = 64;
     utf8Decoder = new TextDecoder("utf-8", { fatal: true });
     CoworkStorageError = class extends Error {
       constructor(message, options) {
@@ -7512,20 +7618,20 @@ var init_storage = __esm({
     CoworkStore = class {
       stateDir;
       fs;
-      // The standalone daemon is the sole writer. This is intentionally an
-      // in-process room FIFO, not an on-disk lock with stale-owner recovery.
+      beforeRecordCommit;
       roomMutexes = /* @__PURE__ */ new Map();
       lockOwnership = new AsyncLocalStorage();
-      nextSequences = /* @__PURE__ */ new Map();
+      reconciledBlobRooms = /* @__PURE__ */ new Set();
       constructor(stateDir, options = {}) {
         if (!stateDir) throw new CoworkStorageError("state directory is required");
         this.stateDir = stateDir;
         this.fs = options.fs ?? nodeFs2;
+        this.beforeRecordCommit = options.beforeRecordCommit;
       }
       mutex(roomId, work) {
-        const validRoomId = this.roomId(roomId);
-        if (work) return this.withRoomMutex(validRoomId, work);
-        return { runExclusive: (nested) => this.withRoomMutex(validRoomId, nested) };
+        const id = this.roomId(roomId);
+        if (work) return this.withRoomMutex(id, work);
+        return { runExclusive: (nested) => this.withRoomMutex(id, nested) };
       }
       withRoomMutex(roomId, work) {
         const inherited = this.lockOwnership.getStore();
@@ -7533,15 +7639,10 @@ var init_storage = __esm({
         if (ownership?.active) {
           const nested = Promise.resolve().then(work);
           ownership.pending.add(nested);
-          void nested.then(
-            () => {
-              ownership.pending.delete(nested);
-            },
-            (error) => {
-              ownership.pending.delete(nested);
-              ownership.failures.push(error);
-            }
-          );
+          void nested.then(() => ownership.pending.delete(nested), (error) => {
+            ownership.pending.delete(nested);
+            ownership.failures.push(error);
+          });
           return nested;
         }
         let queue = this.roomMutexes.get(roomId);
@@ -7563,9 +7664,7 @@ var init_storage = __esm({
               rootFailed = true;
               rootFailure = error;
             }
-            while (acquired.pending.size > 0) {
-              await Promise.allSettled([...acquired.pending]);
-            }
+            while (acquired.pending.size > 0) await Promise.allSettled([...acquired.pending]);
           } finally {
             acquired.active = false;
           }
@@ -7583,20 +7682,20 @@ var init_storage = __esm({
             this.rejectSymlink(roomDir, "room directory");
             throw new CoworkStorageError(`room "${room.room_id}" already exists`);
           }
-          let roomCreated = false;
+          let created = false;
           try {
             this.fs.mkdirSync(roomDir, { mode: DIRECTORY_MODE2 });
-            roomCreated = true;
+            created = true;
             this.fs.chmodSync(roomDir, DIRECTORY_MODE2);
+            this.fs.mkdirSync(this.blobsDirectory(room.room_id), { mode: DIRECTORY_MODE2 });
+            this.fs.chmodSync(this.blobsDirectory(room.room_id), DIRECTORY_MODE2);
             this.fsyncDirectory(roomDir);
             this.fsyncDirectory(this.roomsDirectory());
-            this.createArchive(room.room_id);
+            this.withDatabase(room.room_id, () => void 0, true);
             this.atomicMetadataWrite(this.metadataPath(room.room_id), room);
-            this.nextSequences.set(room.room_id, 1);
             return room;
           } catch (error) {
-            this.nextSequences.delete(room.room_id);
-            if (roomCreated) {
+            if (created) {
               try {
                 this.fs.rmSync(roomDir, { recursive: true, force: true });
                 this.fsyncDirectory(this.roomsDirectory());
@@ -7608,8 +7707,8 @@ var init_storage = __esm({
         });
       }
       async load(roomId) {
-        const validRoomId = this.roomId(roomId);
-        return this.mutex(validRoomId, () => this.loadUnlocked(validRoomId));
+        const id = this.roomId(roomId);
+        return this.mutex(id, () => this.loadUnlocked(id));
       }
       async save(input) {
         const room = RoomSchema.parse(input);
@@ -7621,176 +7720,435 @@ var init_storage = __esm({
       }
       async list() {
         this.ensureBaseDirectories();
-        const roomIds = this.fs.readdirSync(this.roomsDirectory(), { withFileTypes: true }).filter((entry) => LowerCrockfordUlidSchema.safeParse(entry.name).success).map((entry) => entry.name).sort();
+        const ids = this.fs.readdirSync(this.roomsDirectory(), { withFileTypes: true }).filter((entry) => entry.isDirectory() && LowerCrockfordUlidSchema.safeParse(entry.name).success).map((entry) => entry.name).sort();
         const rooms = [];
-        for (const roomId of roomIds) rooms.push(await this.load(roomId));
+        for (const id of ids) rooms.push(await this.load(id));
         return rooms;
       }
       async append(roomId, input) {
-        const validRoomId = this.roomId(roomId);
+        const id = this.roomId(roomId);
         const draft = AppendRecordSchema.parse(input);
-        if (draft.room_id !== validRoomId) {
-          throw new CoworkStorageError(`record room_id "${draft.room_id}" does not match room "${validRoomId}"`);
-        }
-        return this.mutex(validRoomId, () => {
-          this.assertRoomDirectory(validRoomId);
-          const archivePath = this.archivePath(validRoomId);
-          this.assertRegularFile(archivePath, "room archive");
-          let nextSequence = this.nextSequences.get(validRoomId);
-          if (nextSequence === void 0) {
-            nextSequence = this.scanArchive(validRoomId).nextSequence;
-          }
-          const record = CommunicationRecordSchema.parse({
-            ...draft,
-            seq: nextSequence,
-            record_id: `${validRoomId}:${nextSequence}`
-          });
-          const bytes = Buffer.from(`${JSON.stringify(record)}
-`, "utf8");
-          let fd;
-          let originalSize;
-          let writeStarted = false;
+        if (draft.room_id !== id) throw new CoworkStorageError(`record room_id "${draft.room_id}" does not match room "${id}"`);
+        return this.mutex(id, () => {
+          this.assertRoomDirectory(id);
+          if (!this.reconciledBlobRooms.has(id)) this.withDatabase(id, () => void 0);
+          let blob;
+          let storedDraft = draft;
+          if (draft.kind === "file") {
+            const bytes = Buffer.from(draft.data_base64, "base64");
+            blob = this.persistBlob(id, draft.sha256, bytes);
+            const { data_base64: _bytes, ...withoutBytes } = draft;
+            storedDraft = withoutBytes;
+          }
           try {
-            fd = this.fs.openSync(
-              archivePath,
-              nodeFs2.constants.O_WRONLY | nodeFs2.constants.O_APPEND | NO_FOLLOW2
-            );
-            const opened = this.validateOpenPath(fd, archivePath, "room archive", "file", true);
-            originalSize = opened.size;
-            this.fs.fchmodSync(fd, FILE_MODE2);
-            writeStarted = true;
-            this.writeAll(fd, bytes);
-            this.fs.fsyncSync(fd);
-            this.nextSequences.set(validRoomId, nextSequence + 1);
-            return record;
+            return this.withDatabase(id, (db) => {
+              const transaction = db.transaction(() => {
+                const next = db.prepare("SELECT COALESCE(MAX(seq), 0) + 1 AS next FROM records").get().next;
+                const record = { ...draft, seq: next, record_id: `${id}:${next}` };
+                const stored = { ...storedDraft, seq: next, record_id: record.record_id };
+                const values = this.indexValues(record);
+                db.prepare(`INSERT INTO records
+              (seq, record_id, kind, at, payload_json, blob_path, message_id, file_id, intent_record_id,
+               recipient_identity, source_msg_id, source_file_id, category, briefing_role, briefing_version, membership_epoch)
+              VALUES (@seq,@record_id,@kind,@at,@payload_json,@blob_path,@message_id,@file_id,@intent_record_id,
+               @recipient_identity,@source_msg_id,@source_file_id,@category,@briefing_role,@briefing_version,@membership_epoch)`).run({ ...values, payload_json: JSON.stringify(stored), blob_path: blob?.path ?? null });
+                if (record.kind === "message" || record.kind === "file") {
+                  const insert = db.prepare(`INSERT INTO record_recipients
+                (record_seq, recipient_identity, category, briefing_role, briefing_version)
+                VALUES (?, ?, ?, ?, ?)`);
+                  const enqueue = db.prepare("INSERT INTO relay_intent_work(record_seq, recipient_identity) VALUES (?, ?)");
+                  for (const recipient of record.recipient_identities) {
+                    insert.run(
+                      record.seq,
+                      recipient,
+                      record.kind === "message" ? record.category : null,
+                      record.kind === "message" ? record.briefing_role ?? null : null,
+                      record.kind === "message" ? record.briefing_version ?? 1 : null
+                    );
+                    enqueue.run(record.seq, recipient);
+                  }
+                } else if (record.kind === "relay_intent") {
+                  const sourceColumn = record.message_id === void 0 ? "file_id" : "message_id";
+                  const sourceId = record.message_id ?? record.file_id;
+                  db.prepare(`DELETE FROM relay_intent_work
+                WHERE recipient_identity = ? AND record_seq IN (
+                  SELECT seq FROM records WHERE kind = ? AND ${sourceColumn} = ?
+                )`).run(record.recipient_identity, record.message_id === void 0 ? "file" : "message", sourceId);
+                }
+                this.beforeRecordCommit?.();
+                return record;
+              });
+              return transaction.immediate();
+            });
           } catch (error) {
-            this.nextSequences.delete(validRoomId);
-            if (fd !== void 0 && originalSize !== void 0 && writeStarted) {
-              try {
-                this.fs.ftruncateSync(fd, originalSize);
-                this.fs.fsyncSync(fd);
-              } catch {
-              }
-            }
-            throw this.wrap(`failed to append room "${validRoomId}" archive`, error);
-          } finally {
-            if (fd !== void 0) {
-              try {
-                this.fs.closeSync(fd);
-              } catch {
-              }
-            }
+            if (blob?.created) this.removeUnreferencedBlob(id, blob.path);
+            throw this.wrap(`failed to append room "${id}" archive`, error);
           }
         });
       }
       async read(roomId, options = {}) {
-        const validRoomId = this.roomId(roomId);
+        const id = this.roomId(roomId);
         const after = options.after ?? 0;
         const limit = options.limit ?? Number.MAX_SAFE_INTEGER;
-        if (!Number.isSafeInteger(after) || after < 0) throw new CoworkStorageError("after must be a non-negative safe integer");
+        this.validatePage(after, limit);
+        return this.mutex(id, () => {
+          this.assertRoomDirectory(id);
+          return this.withDatabase(id, (db) => this.decodeRows(id, db.prepare(
+            "SELECT seq,payload_json,blob_path FROM records WHERE seq > ? ORDER BY seq ASC LIMIT ?"
+          ).all(after, limit)));
+        });
+      }
+      async query(roomId, options) {
+        const id = this.roomId(roomId);
+        const limit = options.limit ?? Number.MAX_SAFE_INTEGER;
         if (!Number.isSafeInteger(limit) || limit < 1) throw new CoworkStorageError("limit must be a positive safe integer");
-        return this.mutex(validRoomId, () => {
-          this.assertRoomDirectory(validRoomId);
-          const scan = this.scanArchive(validRoomId);
-          this.nextSequences.set(validRoomId, scan.nextSequence);
-          return scan.records.filter((record) => record.seq > after).slice(0, limit);
+        return this.mutex(id, () => {
+          this.assertRoomDirectory(id);
+          return this.withDatabase(id, (db) => {
+            const clauses = [];
+            const values = [];
+            const add = (column, value) => {
+              if (value !== void 0) {
+                clauses.push(`r.${column} = ?`);
+                values.push(value);
+              }
+            };
+            add("kind", options.kind);
+            add("message_id", options.messageId);
+            add("file_id", options.fileId);
+            add("source_msg_id", options.sourceMsgId);
+            add("source_file_id", options.sourceFileId);
+            add("intent_record_id", options.intentRecordId);
+            add("recipient_identity", options.recipientIdentity);
+            add("category", options.category);
+            add("membership_epoch", options.membershipEpoch);
+            if (options.after !== void 0) {
+              clauses.push("r.seq > ?");
+              values.push(options.after);
+            }
+            if (options.unresolvedResultKind) {
+              clauses.push("NOT EXISTS (SELECT 1 FROM records result WHERE result.kind = ? AND result.intent_record_id = r.record_id)");
+              values.push(options.unresolvedResultKind);
+            }
+            values.push(limit);
+            const sql = `SELECT r.seq,r.payload_json,r.blob_path FROM records r${clauses.length ? ` WHERE ${clauses.join(" AND ")}` : ""} ORDER BY r.seq ${options.descending ? "DESC" : "ASC"} LIMIT ?`;
+            return this.decodeRows(id, db.prepare(sql).all(...values));
+          });
         });
       }
+      async recipients(roomId, recordSeq) {
+        const id = this.roomId(roomId);
+        return this.mutex(id, () => this.withDatabase(id, (db) => db.prepare(
+          "SELECT recipient_identity FROM record_recipients WHERE record_seq = ? ORDER BY recipient_identity"
+        ).all(recordSeq).map((row) => row.recipient_identity)));
+      }
+      async recordsNeedingRelayIntents(roomId, options = {}) {
+        const id = this.roomId(roomId);
+        const after = options.after ?? 0;
+        const limit = options.limit ?? DEFAULT_WORK_BATCH_SIZE;
+        this.validatePage(after, limit);
+        return this.mutex(id, () => this.withDatabase(id, (db) => this.decodeRows(id, db.prepare(`
+      SELECT source.seq,source.payload_json,source.blob_path
+      FROM relay_intent_work work INDEXED BY relay_work_source
+      JOIN records source ON source.seq = work.record_seq
+      WHERE work.record_seq > ?
+      GROUP BY source.seq
+      ORDER BY source.seq ASC
+      LIMIT ?
+    `).all(after, limit))));
+      }
+      async relayRecipientsNeedingIntent(roomId, recordSeq, limit = DEFAULT_WORK_BATCH_SIZE) {
+        const id = this.roomId(roomId);
+        if (!Number.isSafeInteger(recordSeq) || recordSeq < 1) throw new CoworkStorageError("record sequence must be a positive safe integer");
+        if (!Number.isSafeInteger(limit) || limit < 1) throw new CoworkStorageError("limit must be a positive safe integer");
+        return this.mutex(id, () => this.withDatabase(id, (db) => db.prepare(
+          "SELECT recipient_identity FROM relay_intent_work WHERE record_seq = ? ORDER BY recipient_identity LIMIT ?"
+        ).all(recordSeq, limit).map((row) => row.recipient_identity)));
+      }
+      async briefingDeliveryTimes(roomId, key, recipientIdentities) {
+        const id = this.roomId(roomId);
+        if (recipientIdentities.length === 0) return /* @__PURE__ */ new Map();
+        return this.mutex(id, () => this.withDatabase(id, (db) => {
+          const lookup = db.prepare(`SELECT records.at FROM record_recipients recipients
+        INDEXED BY recipients_briefing_delivery
+        JOIN records ON records.seq = recipients.record_seq
+        WHERE recipients.recipient_identity = ? AND recipients.category = ?
+          AND recipients.briefing_role IS ? AND recipients.briefing_version = ?
+        ORDER BY recipients.record_seq ASC LIMIT 1`);
+          const deliveries = /* @__PURE__ */ new Map();
+          for (const recipient of recipientIdentities) {
+            const row = lookup.get(
+              recipient,
+              key.category,
+              key.briefingRole ?? null,
+              key.briefingVersion
+            );
+            if (row) deliveries.set(recipient, row.at);
+          }
+          return deliveries;
+        }));
+      }
+      async durability(roomId) {
+        const id = this.roomId(roomId);
+        return this.mutex(id, () => this.withDatabase(id, (db) => ({
+          journalMode: db.pragma("journal_mode", { simple: true }),
+          synchronous: db.pragma("synchronous", { simple: true })
+        })));
+      }
       async delete(roomId) {
-        const validRoomId = this.roomId(roomId);
-        await this.mutex(validRoomId, () => {
+        const id = this.roomId(roomId);
+        await this.mutex(id, () => {
           this.ensureBaseDirectories();
-          const roomDir = this.roomDirectory(validRoomId);
+          const roomDir = this.roomDirectory(id);
           if (!this.lstatIfPresent(roomDir)) {
             this.fsyncDirectory(this.roomsDirectory());
-            this.nextSequences.delete(validRoomId);
             return;
           }
-          this.ensurePrivateDirectory(roomDir, false, `room "${validRoomId}" directory`);
-          const archivePath = this.archivePath(validRoomId);
-          const metadataPath = this.metadataPath(validRoomId);
-          const archivePresent = this.lstatIfPresent(archivePath) !== void 0;
-          const metadataPresent = this.lstatIfPresent(metadataPath) !== void 0;
+          this.ensurePrivateDirectory(roomDir, false, `room "${id}" directory`);
+          const metadata = this.metadataPath(id);
+          const metadataPresent = this.lstatIfPresent(metadata) !== void 0;
+          const archivePresent = this.lstatIfPresent(this.archivePath(id)) !== void 0;
+          const blobsPresent = this.lstatIfPresent(this.blobsDirectory(id)) !== void 0;
           if (metadataPresent) {
-            const room = this.loadUnlocked(validRoomId);
-            if (room.state !== "closed") {
-              throw new CoworkStorageError(`room "${validRoomId}" must be closed before deletion`);
-            }
+            const room = this.loadUnlocked(id);
+            if (room.state !== "closed") throw new CoworkStorageError(`room "${id}" must be closed before deletion`);
             this.removeProvisioningArtifacts(roomDir);
-          } else if (archivePresent) {
-            throw new CoworkStorageError(
-              `room "${validRoomId}" has archive residue without deletion metadata`
-            );
+          } else if (archivePresent || blobsPresent) {
+            throw new CoworkStorageError(`room "${id}" has archive residue without deletion metadata`);
           }
-          const expected = /* @__PURE__ */ new Set(["archive.jsonl", "room.json", "room.json.v1.bak"]);
+          const expected = /* @__PURE__ */ new Set(["archive.sqlite3", "archive.sqlite3-wal", "archive.sqlite3-shm", "blobs", "room.json", "room.json.v1.bak"]);
           const unexpected = this.fs.readdirSync(roomDir).filter((name) => !expected.has(name));
-          if (unexpected.length > 0) {
-            throw new CoworkStorageError(`room "${validRoomId}" contains live or unexpected residue: ${unexpected.join(", ")}`);
+          if (unexpected.length) throw new CoworkStorageError(`room "${id}" contains live or unexpected residue: ${unexpected.join(", ")}`);
+          for (const name of ["archive.sqlite3-wal", "archive.sqlite3-shm", "archive.sqlite3", "room.json.v1.bak", "room.json"]) {
+            const path = join3(roomDir, name);
+            if (this.lstatIfPresent(path)) {
+              this.assertRegularFile(path, name);
+              this.fs.unlinkSync(path);
+            }
           }
-          const backupPath = `${metadataPath}.v1.bak`;
-          if (this.lstatIfPresent(backupPath)) {
-            this.assertRegularFile(backupPath, "room metadata v1 backup");
-            this.fs.unlinkSync(backupPath);
-            this.fsyncDirectory(roomDir);
+          const blobs = this.blobsDirectory(id);
+          if (this.lstatIfPresent(blobs)) this.fs.rmSync(blobs, { recursive: true, force: true });
+          this.fsyncDirectory(roomDir);
+          this.fs.rmdirSync(roomDir);
+          this.fsyncDirectory(this.roomsDirectory());
+        });
+      }
+      withDatabase(roomId, work, create = false) {
+        const path = this.archivePath(roomId);
+        let guardFd;
+        if (!create) {
+          this.assertRegularFile(path, "room archive database");
+          guardFd = this.fs.openSync(path, nodeFs2.constants.O_RDONLY | NO_FOLLOW2);
+          this.validateOpenPath(guardFd, path, "room archive database", "file", true);
+        }
+        let db;
+        try {
+          this.secureSqliteFiles(path);
+          db = new Database(path, { fileMustExist: !create });
+          if (guardFd !== void 0) this.validateOpenPath(guardFd, path, "room archive database", "file", true);
+          this.fs.chmodSync(path, FILE_MODE2);
+          db.pragma("journal_mode = WAL");
+          db.pragma("synchronous = FULL");
+          db.pragma("foreign_keys = ON");
+          db.pragma("busy_timeout = 5000");
+          if (create) {
+            db.exec(`CREATE TABLE records (
+        seq INTEGER PRIMARY KEY, record_id TEXT NOT NULL UNIQUE, kind TEXT NOT NULL, at TEXT NOT NULL,
+        payload_json TEXT NOT NULL, blob_path TEXT, message_id TEXT, file_id TEXT, intent_record_id TEXT,
+        recipient_identity TEXT, source_msg_id INTEGER, source_file_id INTEGER, category TEXT,
+        briefing_role TEXT, briefing_version INTEGER, membership_epoch INTEGER
+      );
+      CREATE TABLE record_recipients (
+        record_seq INTEGER NOT NULL REFERENCES records(seq) ON DELETE CASCADE,
+        recipient_identity TEXT NOT NULL, category TEXT, briefing_role TEXT,
+        briefing_version INTEGER, PRIMARY KEY(record_seq, recipient_identity)
+      );
+      CREATE TABLE relay_intent_work (
+        record_seq INTEGER NOT NULL REFERENCES records(seq) ON DELETE CASCADE,
+        recipient_identity TEXT NOT NULL, PRIMARY KEY(record_seq, recipient_identity)
+      );
+      CREATE INDEX relay_work_source ON relay_intent_work(record_seq, recipient_identity);
+      CREATE INDEX records_kind_seq ON records(kind, seq);
+      CREATE INDEX records_message ON records(message_id, kind, seq);
+      CREATE INDEX records_file ON records(file_id, kind, seq);
+      CREATE INDEX records_intent_result ON records(intent_record_id, kind);
+      CREATE INDEX records_relay_recipient ON records(kind, recipient_identity, seq);
+      CREATE UNIQUE INDEX records_source_message ON records(source_msg_id) WHERE kind='message' AND source_msg_id IS NOT NULL;
+      CREATE UNIQUE INDEX records_source_file ON records(source_file_id) WHERE kind='file' AND source_file_id IS NOT NULL;
+      CREATE INDEX records_briefing ON records(category, briefing_role, briefing_version, seq);
+      CREATE INDEX records_membership_epoch ON records(category, membership_epoch);
+      CREATE INDEX recipients_identity ON record_recipients(recipient_identity, record_seq);
+      CREATE INDEX recipients_briefing_delivery ON record_recipients
+        (recipient_identity, category, briefing_role, briefing_version, record_seq);`);
+            db.pragma(`user_version = ${SQLITE_SCHEMA_VERSION}`);
+            this.reconciledBlobRooms.add(roomId);
+          } else {
+            const version = db.pragma("user_version", { simple: true });
+            if (version !== SQLITE_SCHEMA_VERSION) {
+              throw new CoworkStorageError(`unsupported room archive schema version ${version}`);
+            }
+            if (!this.reconciledBlobRooms.has(roomId)) {
+              this.reconcileBlobDirectory(roomId, db);
+              this.reconciledBlobRooms.add(roomId);
+            }
           }
-          if (archivePresent) {
-            this.assertRegularFile(archivePath, "room archive");
-            this.fs.unlinkSync(archivePath);
-            this.fsyncDirectory(roomDir);
+          this.secureSqliteFiles(path);
+          const result = work(db);
+          this.secureSqliteFiles(path);
+          return result;
+        } catch (error) {
+          throw this.wrap(`failed to access room "${roomId}" SQLite archive`, error);
+        } finally {
+          try {
+            db?.close();
+          } catch {
           }
-          if (metadataPresent) {
-            this.assertRegularFile(metadataPath, "room metadata");
-            this.fs.unlinkSync(metadataPath);
-            this.fsyncDirectory(roomDir);
+          if (guardFd !== void 0) try {
+            this.fs.closeSync(guardFd);
+          } catch {
+          }
+          this.secureSqliteFiles(path);
+        }
+      }
+      indexValues(record) {
+        const subject = record;
+        return {
+          seq: record.seq,
+          record_id: record.record_id,
+          kind: record.kind,
+          at: record.at,
+          message_id: subject.message_id ?? null,
+          file_id: subject.file_id ?? null,
+          intent_record_id: subject.intent_record_id ?? null,
+          recipient_identity: subject.recipient_identity ?? null,
+          source_msg_id: subject.source_msg_id ?? null,
+          source_file_id: subject.source_file_id ?? null,
+          category: subject.category ?? null,
+          briefing_role: subject.briefing_role ?? null,
+          briefing_version: subject.briefing_version ?? null,
+          membership_epoch: typeof subject.membership === "object" && subject.membership !== null ? subject.membership.epoch ?? null : null
+        };
+      }
+      decodeRows(roomId, rows) {
+        return rows.map((row) => {
+          let decoded;
+          try {
+            decoded = JSON.parse(row.payload_json);
+          } catch (error) {
+            throw new CoworkStorageError(`malformed JSON in room "${roomId}" archive at sequence ${row.seq}`, { cause: error });
+          }
+          if (row.blob_path !== null) {
+            const subject = decoded;
+            const expectedPath = subject.kind === "file" && typeof subject.sha256 === "string" && /^[0-9a-f]{64}$/.test(subject.sha256) ? join3("blobs", subject.sha256) : void 0;
+            if (expectedPath === void 0 || row.blob_path !== expectedPath) {
+              throw new CoworkStorageError(`invalid blob reference in room "${roomId}" archive at sequence ${row.seq}`);
+            }
+            const bytes = this.readFileNoFollow(join3(this.roomDirectory(roomId), expectedPath), "room file blob");
+            decoded = { ...decoded, data_base64: bytes.toString("base64") };
+          }
+          try {
+            const record = CommunicationRecordSchema.parse(decoded);
+            if (record.room_id !== roomId || record.seq !== row.seq) throw new Error("indexed identity mismatch");
+            return record;
+          } catch (error) {
+            throw new CoworkStorageError(`invalid record in room "${roomId}" archive at sequence ${row.seq}`, { cause: error });
           }
-          this.fs.rmdirSync(roomDir);
-          this.fsyncDirectory(this.roomsDirectory());
-          this.nextSequences.delete(validRoomId);
         });
       }
-      removeProvisioningArtifacts(roomDir) {
-        const journalPath = join3(roomDir, ".cowork-provisioning-stage");
-        const targets = [join3(roomDir, "live"), join3(roomDir, "provisioning-residue")];
-        if (this.lstatIfPresent(journalPath)) {
-          this.assertRegularFile(journalPath, "provisioning staging journal");
-          const stagingName = this.fs.readFileSync(journalPath, "utf8").trim();
-          if (!/^live\.staging-[0-9a-f]{32}$/.test(stagingName)) {
-            throw new CoworkStorageError("invalid provisioning staging journal");
+      persistBlob(roomId, digest, bytes) {
+        const directory = this.blobsDirectory(roomId);
+        this.ensurePrivateDirectory(directory, true, "room blobs directory");
+        const final = join3(directory, digest);
+        if (this.lstatIfPresent(final)) {
+          this.assertRegularFile(final, "room file blob");
+          if (this.readFileNoFollow(final, "room file blob").equals(bytes)) return { path: join3("blobs", digest), created: false };
+          throw new CoworkStorageError(`immutable blob collision for ${digest}`);
+        }
+        const temp = join3(directory, `.tmp-${process.pid}-${randomBytes3(8).toString("hex")}`);
+        let fd;
+        try {
+          fd = this.fs.openSync(temp, nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2, FILE_MODE2);
+          this.writeAll(fd, bytes);
+          this.fs.fsyncSync(fd);
+          this.fs.closeSync(fd);
+          fd = void 0;
+          this.fs.renameSync(temp, final);
+          this.fsyncDirectory(directory);
+          this.fs.chmodSync(final, FILE_MODE2);
+          return { path: join3("blobs", digest), created: true };
+        } finally {
+          if (fd !== void 0) try {
+            this.fs.closeSync(fd);
+          } catch {
+          }
+          if (this.lstatIfPresent(temp)) try {
+            this.fs.unlinkSync(temp);
+          } catch {
           }
-          targets.push(join3(roomDir, stagingName));
         }
-        for (const target of targets) {
-          const stat = this.lstatIfPresent(target);
-          if (!stat) continue;
-          if (stat.isSymbolicLink() || !stat.isDirectory()) this.fs.unlinkSync(target);
-          else this.fs.rmSync(target, { recursive: true, force: true });
-          this.fsyncDirectory(roomDir);
+      }
+      removeUnreferencedBlob(roomId, relativePath) {
+        const absolute = join3(this.roomDirectory(roomId), relativePath);
+        try {
+          const referenced = this.withDatabase(roomId, (db) => db.prepare(
+            "SELECT EXISTS(SELECT 1 FROM records WHERE blob_path = ?) AS found"
+          ).get(relativePath).found !== 0);
+          if (referenced || !this.lstatIfPresent(absolute)) return;
+          this.assertRegularFile(absolute, "unreferenced room file blob");
+          this.fs.unlinkSync(absolute);
+          this.fsyncDirectory(dirname2(absolute));
+        } catch {
         }
-        if (this.lstatIfPresent(journalPath)) {
-          this.fs.unlinkSync(journalPath);
-          this.fsyncDirectory(roomDir);
+      }
+      reconcileBlobDirectory(roomId, db) {
+        const directory = this.blobsDirectory(roomId);
+        this.ensurePrivateDirectory(directory, true, "room blobs directory");
+        const referenced = new Set(db.prepare(
+          "SELECT blob_path FROM records WHERE blob_path IS NOT NULL"
+        ).all().map((row) => basename(row.blob_path)));
+        let changed = false;
+        for (const entry of this.fs.readdirSync(directory, { withFileTypes: true })) {
+          const path = join3(directory, entry.name);
+          if (/^\.tmp-[0-9]+-[0-9a-f]{16}$/.test(entry.name)) {
+            this.assertRegularFile(path, "crash-left room blob temporary file");
+            this.fs.unlinkSync(path);
+            changed = true;
+            continue;
+          }
+          if (!/^[0-9a-f]{64}$/.test(entry.name)) throw new CoworkStorageError(`unexpected room blob residue: ${entry.name}`);
+          this.assertRegularFile(path, referenced.has(entry.name) ? "room file blob" : "unreferenced room file blob");
+          this.fs.chmodSync(path, FILE_MODE2);
+          if (referenced.has(entry.name)) continue;
+          this.fs.unlinkSync(path);
+          changed = true;
+        }
+        if (changed) this.fsyncDirectory(directory);
+      }
+      secureSqliteFiles(path) {
+        for (const candidate of [path, `${path}-wal`, `${path}-shm`]) {
+          if (!this.lstatIfPresent(candidate)) continue;
+          this.assertRegularFile(candidate, `SQLite file ${basename(candidate)}`);
+          this.fs.chmodSync(candidate, FILE_MODE2);
         }
       }
+      validatePage(after, limit) {
+        if (!Number.isSafeInteger(after) || after < 0) throw new CoworkStorageError("after must be a non-negative safe integer");
+        if (!Number.isSafeInteger(limit) || limit < 1) throw new CoworkStorageError("limit must be a positive safe integer");
+      }
       loadUnlocked(roomId) {
         this.assertRoomDirectory(roomId);
         const path = this.metadataPath(roomId);
         this.assertRegularFile(path, "room metadata");
+        let decoded;
         let bytes;
         try {
           bytes = this.readFileNoFollow(path, "room metadata");
-        } catch (error) {
-          throw this.wrap(`failed to read room "${roomId}" metadata`, error);
-        }
-        let decoded;
-        try {
           decoded = JSON.parse(utf8Decoder.decode(bytes));
         } catch (error) {
           throw this.wrap(`malformed metadata for room "${roomId}"`, error);
         }
         const room = this.isVersion1(decoded) ? this.migrateUnlocked(roomId, decoded, bytes) : RoomSchema.parse(decoded);
-        if (!this.isVersion1(decoded) && this.persistedRoomName(decoded) !== room.room_name) {
-          this.atomicMetadataWrite(this.metadataPath(roomId), room);
-        }
+        if (!this.isVersion1(decoded) && this.persistedRoomName(decoded) !== room.room_name) this.atomicMetadataWrite(path, room);
         if (room.room_id !== roomId) throw new CoworkStorageError(`metadata room_id does not match room "${roomId}"`);
         return room;
       }
@@ -7800,79 +8158,54 @@ var init_storage = __esm({
       persistedRoomName(decoded) {
         return typeof decoded === "object" && decoded !== null ? decoded.room_name : void 0;
       }
-      /**
-       * Lazy additive v1 → v2 migration: preserve the exact pre-migration
-       * bytes once as room.json.v1.bak, then atomically persist the v2 metadata.
-       *
-       * THE BACKUP IS WRITTEN TEMP → FSYNC → RENAME, not opened in place, and the
-       * reason is a crash window that an existence check cannot see. The earlier
-       * version guarded with `if (!lstatIfPresent(backupPath))` and wrote straight
-       * into the final path under O_CREAT|O_EXCL. A crash inside that write leaves a
-       * PARTIAL file that nonetheless EXISTS, so the next load's existence check
-       * skips the backup, writes v2, and the pre-migration bytes are gone — no
-       * error, no warning, and the one artefact that exists to undo a bad migration
-       * is a truncated fragment. Measured before the fix: a 40-byte prefix of a
-       * 604-byte room, JSON.parse false, room.json already v2.
-       *
-       * A rename is atomic, so the final path now only ever appears complete. The
-       * temp file is created with O_EXCL under a pid+random name and removed on
-       * failure, so a crashed attempt leaves at most an orphan temp, never a
-       * plausible-looking backup.
-       *
-       * AND AN EXISTING BACKUP IS PARSED BEFORE IT IS TRUSTED, which repairs the
-       * case where a partial file is ALREADY on disk from a build without this fix —
-       * exactly the state a host that ran the previous code could be in right now.
-       * A backup that does not parse as v1 is replaced by the bytes we hold, because
-       * those are the real pre-migration bytes and the fragment is worthless.
-       *
-       * WHAT THE BACKUP IS NOT: restoring it is NOT a rollback. See the note on
-       * `restoreV1Backup` — re-migrating mints fresh participant ids.
-       */
-      migrateUnlocked(roomId, decoded, originalBytes) {
+      migrateUnlocked(roomId, decoded, original) {
         const v1 = RoomV1Schema.parse(decoded);
         if (v1.room_id !== roomId) throw new CoworkStorageError(`metadata room_id does not match room "${roomId}"`);
         const migrated = migrateRoomV1(v1, generateUlid);
-        const backupPath = `${this.metadataPath(roomId)}.v1.bak`;
-        if (!this.hasIntactV1Backup(backupPath)) {
-          this.atomicBytesWrite(backupPath, originalBytes, "room metadata v1 backup");
-        }
+        const backup = `${this.metadataPath(roomId)}.v1.bak`;
+        if (!this.hasIntactV1Backup(backup)) this.atomicBytesWrite(backup, original, "room metadata v1 backup");
         this.atomicMetadataWrite(this.metadataPath(roomId), migrated);
         return migrated;
       }
-      /**
-       * Is there already a backup we would be willing to hand back to an operator?
-       *
-       * Existence is not the question — a partial file exists. It must parse and
-       * still claim to be the v1 metadata for this room; anything else is a fragment
-       * and is better overwritten with the bytes we are holding right now.
-       */
-      hasIntactV1Backup(backupPath) {
-        if (!this.lstatIfPresent(backupPath)) return false;
+      hasIntactV1Backup(path) {
+        if (!this.lstatIfPresent(path)) return false;
         try {
-          const decoded = JSON.parse(utf8Decoder.decode(this.readFileNoFollow(backupPath, "room metadata v1 backup")));
-          return this.isVersion1(decoded);
+          return this.isVersion1(JSON.parse(utf8Decoder.decode(this.readFileNoFollow(path, "room metadata v1 backup"))));
         } catch {
           return false;
         }
       }
-      /**
-       * Durably place exact bytes at `path`: temp under O_EXCL, fsync, rename, fsync
-       * the directory. The same dance as atomicMetadataWrite, which serialises a Room
-       * rather than taking bytes verbatim — and taking them verbatim is the whole
-       * point for a backup, whose value is being byte-identical to what was there.
-       */
+      removeProvisioningArtifacts(roomDir) {
+        const journal = join3(roomDir, ".cowork-provisioning-stage");
+        const targets = [join3(roomDir, "live"), join3(roomDir, "provisioning-residue")];
+        if (this.lstatIfPresent(journal)) {
+          this.assertRegularFile(journal, "provisioning staging journal");
+          const name = this.fs.readFileSync(journal, "utf8").trim();
+          if (!/^live\.staging-[0-9a-f]{32}$/.test(name)) throw new CoworkStorageError("invalid provisioning staging journal");
+          targets.push(join3(roomDir, name));
+        }
+        for (const target of targets) {
+          const stat = this.lstatIfPresent(target);
+          if (!stat) continue;
+          if (stat.isSymbolicLink() || !stat.isDirectory()) this.fs.unlinkSync(target);
+          else this.fs.rmSync(target, { recursive: true, force: true });
+          this.fsyncDirectory(roomDir);
+        }
+        if (this.lstatIfPresent(journal)) {
+          this.fs.unlinkSync(journal);
+          this.fsyncDirectory(roomDir);
+        }
+      }
+      atomicMetadataWrite(path, room) {
+        this.atomicBytesWrite(path, Buffer.from(`${JSON.stringify(room)}
+`), "room metadata");
+      }
       atomicBytesWrite(path, bytes, label) {
         if (this.lstatIfPresent(path)) this.assertRegularFile(path, label);
         const temp = `${path}.tmp-${process.pid}-${randomBytes3(8).toString("hex")}`;
         let fd;
         try {
-          fd = this.fs.openSync(
-            temp,
-            nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2,
-            FILE_MODE2
-          );
-          this.validateOpenPath(fd, temp, `temporary ${label}`, "file", true);
-          this.fs.fchmodSync(fd, FILE_MODE2);
+          fd = this.fs.openSync(temp, nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2, FILE_MODE2);
           this.writeAll(fd, bytes);
           this.fs.fsyncSync(fd);
           this.fs.closeSync(fd);
@@ -7880,11 +8213,9 @@ var init_storage = __esm({
           this.fs.renameSync(temp, path);
           this.fsyncDirectory(dirname2(path));
         } catch (error) {
-          if (fd !== void 0) {
-            try {
-              this.fs.closeSync(fd);
-            } catch {
-            }
+          if (fd !== void 0) try {
+            this.fs.closeSync(fd);
+          } catch {
           }
           try {
             this.fs.rmSync(temp, { force: true });
@@ -7893,84 +8224,31 @@ var init_storage = __esm({
           throw this.wrap(`failed to write ${label} at ${path}`, error);
         }
       }
-      scanArchive(roomId) {
-        const path = this.archivePath(roomId);
-        this.assertRegularFile(path, "room archive");
-        let bytes;
-        try {
-          bytes = this.readFileNoFollow(path, "room archive");
-        } catch (error) {
-          throw this.wrap(`failed to read room "${roomId}" archive`, error);
-        }
-        const records = [];
-        let byteOffset = 0;
-        let expectedSequence = 1;
-        while (byteOffset < bytes.byteLength) {
-          const newline = bytes.indexOf(10, byteOffset);
-          if (newline === -1) {
-            throw new CoworkStorageError(`partial JSON record in room "${roomId}" archive at byte offset ${byteOffset}`);
-          }
-          const line = bytes.subarray(byteOffset, newline);
-          let decoded;
-          try {
-            decoded = JSON.parse(utf8Decoder.decode(line));
-          } catch (error) {
-            throw new CoworkStorageError(
-              `malformed JSON in room "${roomId}" archive at byte offset ${byteOffset}`,
-              { cause: error }
-            );
-          }
-          const observedSequence = typeof decoded === "object" && decoded !== null && "seq" in decoded ? decoded.seq : void 0;
-          if (observedSequence !== expectedSequence) {
-            throw new CoworkStorageError(
-              `non-monotonic sequence in room "${roomId}" archive at byte offset ${byteOffset}: expected ${expectedSequence}, found ${String(observedSequence)}`
-            );
-          }
-          let record;
-          try {
-            record = CommunicationRecordSchema.parse(decoded);
-          } catch (error) {
-            throw new CoworkStorageError(
-              `invalid record in room "${roomId}" archive at byte offset ${byteOffset}`,
-              { cause: error }
-            );
-          }
-          if (record.room_id !== roomId) {
-            throw new CoworkStorageError(
-              `record room_id mismatch in room "${roomId}" archive at byte offset ${byteOffset}`
-            );
-          }
-          records.push(record);
-          expectedSequence += 1;
-          byteOffset = newline + 1;
-        }
-        return { records, nextSequence: expectedSequence };
-      }
       ensureBaseDirectories() {
         this.ensurePrivateDirectory(this.stateDir, true, "state directory");
         this.ensurePrivateDirectory(this.roomsDirectory(), true, "rooms directory");
       }
+      assertRoomDirectory(roomId) {
+        this.ensureBaseDirectories();
+        this.ensurePrivateDirectory(this.roomDirectory(roomId), false, `room "${roomId}" directory`);
+      }
       ensurePrivateDirectory(path, create, label) {
         let stat = this.lstatIfPresent(path);
-        const created = stat === void 0;
-        if (created) {
+        if (!stat) {
           if (!create) throw new CoworkStorageError(`${label} does not exist`);
           this.createPrivateDirectoryTree(path, label);
           stat = this.fs.lstatSync(path);
         }
-        const current = stat;
-        if (current.isSymbolicLink()) throw new CoworkStorageError(`${label} must not be a symbolic link (symlink)`);
-        if (!current.isDirectory()) throw new CoworkStorageError(`${label} is not a directory`);
+        if (stat.isSymbolicLink() || !stat.isDirectory()) throw new CoworkStorageError(`${label} is not a private directory`);
         this.fs.chmodSync(path, DIRECTORY_MODE2);
       }
       createPrivateDirectoryTree(path, label) {
         const missing = [];
         let cursor = path;
         for (; ; ) {
-          const existing = this.lstatIfPresent(cursor);
-          if (existing) {
-            if (existing.isSymbolicLink()) throw new CoworkStorageError(`${label} parent must not be a symbolic link (symlink)`);
-            if (!existing.isDirectory()) throw new CoworkStorageError(`${label} parent is not a directory`);
+          const stat = this.lstatIfPresent(cursor);
+          if (stat) {
+            if (stat.isSymbolicLink() || !stat.isDirectory()) throw new CoworkStorageError(`${label} parent is unsafe`);
             break;
           }
           missing.push(cursor);
@@ -7978,120 +8256,45 @@ var init_storage = __esm({
           if (parent === cursor) throw new CoworkStorageError(`cannot find existing parent for ${label}`);
           cursor = parent;
         }
-        const created = [];
-        try {
-          for (const directory of missing.reverse()) {
-            this.fs.mkdirSync(directory, { mode: DIRECTORY_MODE2 });
-            created.push(directory);
-            this.fs.chmodSync(directory, DIRECTORY_MODE2);
-            this.fsyncDirectory(directory);
-            this.fsyncDirectory(dirname2(directory));
-          }
-        } catch (error) {
-          for (const directory of created.reverse()) {
-            try {
-              this.fs.rmdirSync(directory);
-              this.fsyncDirectory(dirname2(directory));
-            } catch {
-            }
-          }
-          throw error;
+        for (const directory of missing.reverse()) {
+          this.fs.mkdirSync(directory, { mode: DIRECTORY_MODE2 });
+          this.fs.chmodSync(directory, DIRECTORY_MODE2);
+          this.fsyncDirectory(directory);
+          this.fsyncDirectory(dirname2(directory));
         }
       }
-      assertRoomDirectory(roomId) {
-        this.ensureBaseDirectories();
-        this.ensurePrivateDirectory(this.roomDirectory(roomId), false, `room "${roomId}" directory`);
-      }
       rejectSymlink(path, label) {
-        if (this.fs.lstatSync(path).isSymbolicLink()) {
-          throw new CoworkStorageError(`${label} must not be a symbolic link (symlink)`);
-        }
+        if (this.fs.lstatSync(path).isSymbolicLink()) throw new CoworkStorageError(`${label} must not be a symbolic link (symlink)`);
       }
       assertRegularFile(path, label) {
         this.rejectSymlink(path, label);
         const stat = this.fs.lstatSync(path);
-        if (!stat.isFile()) throw new CoworkStorageError(`${label} is not a regular file`);
-        if (stat.nlink !== 1) throw new CoworkStorageError(`${label} has unsafe hardlink link count ${stat.nlink}`);
-      }
-      lstatIfPresent(path) {
-        try {
-          return this.fs.lstatSync(path);
-        } catch (error) {
-          if (error.code === "ENOENT") return void 0;
-          throw error;
-        }
+        if (!stat.isFile() || stat.nlink !== 1) throw new CoworkStorageError(`${label} is not a safe regular file`);
       }
       validateOpenPath(fd, path, label, kind, requireSingleLink) {
         const opened = this.fs.fstatSync(fd);
         const validKind = kind === "file" ? opened.isFile() : opened.isDirectory();
         if (!validKind) throw new CoworkStorageError(`${label} open descriptor is not a regular ${kind}`);
-        if (requireSingleLink && opened.nlink !== 1) {
-          throw new CoworkStorageError(`${label} has unsafe hardlink link count ${opened.nlink}`);
-        }
+        if (requireSingleLink && opened.nlink !== 1) throw new CoworkStorageError(`${label} has unsafe hardlink link count ${opened.nlink}`);
         const current = this.fs.lstatSync(path);
         if (current.isSymbolicLink()) throw new CoworkStorageError(`${label} must not be a symbolic link (symlink)`);
-        if (current.dev !== opened.dev || current.ino !== opened.ino) {
-          throw new CoworkStorageError(`${label} inode changed during open`);
-        }
+        if (current.dev !== opened.dev || current.ino !== opened.ino) throw new CoworkStorageError(`${label} inode changed during open`);
         return opened;
       }
-      createArchive(roomId) {
-        const path = this.archivePath(roomId);
-        let fd;
-        try {
-          fd = this.fs.openSync(
-            path,
-            nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2,
-            FILE_MODE2
-          );
-          this.validateOpenPath(fd, path, "room archive", "file", true);
-          this.fs.fchmodSync(fd, FILE_MODE2);
-          this.fs.fsyncSync(fd);
-        } finally {
-          if (fd !== void 0) this.fs.closeSync(fd);
-        }
-        this.fsyncDirectory(dirname2(path));
-      }
-      atomicMetadataWrite(path, room) {
-        if (this.lstatIfPresent(path)) this.assertRegularFile(path, "room metadata");
-        const temp = `${path}.tmp-${process.pid}-${randomBytes3(8).toString("hex")}`;
-        const bytes = Buffer.from(`${JSON.stringify(room)}
-`, "utf8");
-        let fd;
+      lstatIfPresent(path) {
         try {
-          fd = this.fs.openSync(
-            temp,
-            nodeFs2.constants.O_CREAT | nodeFs2.constants.O_EXCL | nodeFs2.constants.O_WRONLY | NO_FOLLOW2,
-            FILE_MODE2
-          );
-          this.validateOpenPath(fd, temp, "temporary room metadata", "file", true);
-          this.fs.fchmodSync(fd, FILE_MODE2);
-          this.writeAll(fd, bytes);
-          this.fs.fsyncSync(fd);
-          this.fs.closeSync(fd);
-          fd = void 0;
-          this.fs.renameSync(temp, path);
-          this.fsyncDirectory(dirname2(path));
+          return this.fs.lstatSync(path);
         } catch (error) {
-          if (fd !== void 0) {
-            try {
-              this.fs.closeSync(fd);
-            } catch {
-            }
-          }
-          try {
-            this.fs.rmSync(temp, { force: true });
-          } catch {
-          }
-          throw this.wrap(`failed to atomically persist ${path}`, error);
+          if (error.code === "ENOENT") return void 0;
+          throw error;
         }
       }
       writeAll(fd, bytes) {
         let offset = 0;
-        while (offset < bytes.byteLength) {
-          const written = this.fs.writeSync(fd, bytes, offset, bytes.byteLength - offset, null);
-          if (written <= 0) throw new CoworkStorageError("write made no progress");
-          offset += written;
+        while (offset < bytes.length) {
+          const n = this.fs.writeSync(fd, bytes, offset, bytes.length - offset, null);
+          if (n <= 0) throw new CoworkStorageError("write made no progress");
+          offset += n;
         }
       }
       readFileNoFollow(path, label) {
@@ -8129,10 +8332,13 @@ var init_storage = __esm({
         return join3(this.roomDirectory(roomId), "room.json");
       }
       archivePath(roomId) {
-        return join3(this.roomDirectory(roomId), "archive.jsonl");
+        return join3(this.roomDirectory(roomId), "archive.sqlite3");
+      }
+      blobsDirectory(roomId) {
+        return join3(this.roomDirectory(roomId), "blobs");
       }
       wrap(message, error) {
-        return error instanceof CoworkStorageError ? new CoworkStorageError(`${message}: ${error.message}`, { cause: error }) : new CoworkStorageError(`${message}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+        return new CoworkStorageError(`${message}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
       }
     };
   }
@@ -9043,7 +9249,7 @@ import { randomBytes as randomBytes4 } from "node:crypto";
 import * as http from "node:http";
 import * as net from "node:net";
 import * as nodeFs4 from "node:fs";
-import { basename, dirname as dirname3, join as join5 } from "node:path";
+import { basename as basename2, dirname as dirname3, join as join5 } from "node:path";
 function createServiceRoutes(service) {
   return {
     "room.create": { auth: true, run: (params2) => service.createRoom(params2) },
@@ -9709,7 +9915,7 @@ var init_transports = __esm({
       }
       async cleanupStalePrivateSockets() {
         const directory = dirname3(this.options.socketPath);
-        const prefix = `${basename(this.options.socketPath)}.private-`;
+        const prefix = `${basename2(this.options.socketPath)}.private-`;
         const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
         const candidates = this.fs.readdirSync(directory).filter((name) => name.startsWith(prefix)).sort().slice(0, MAX_STALE_PRIVATE_SOCKET_CLEANUP);
         for (const name of candidates) {