@ours.network/cowork 1.1.4 → 1.3.0

package/dist/daemon.js

@@ -11625,6 +11625,9 @@ var init_ours_runtime = __esm({
 });
 
 // src/command-names.ts
+function commandGrantMatches(pattern, command) {
+  return pattern === command || pattern === "*" || pattern.endsWith(".*") && command.startsWith(pattern.slice(0, -1)) && command.length > pattern.length - 1;
+}
 var SHARED_ROOM_COMMANDS, RUNTIME_COMMAND_NAMES;
 var init_command_names = __esm({
   "src/command-names.ts"() {
@@ -11656,6 +11659,7 @@ var init_command_names = __esm({
       "room.role.rest.remove"
     ];
     RUNTIME_COMMAND_NAMES = [
+      "start_thread",
       "list-members",
       "remove-member",
       ...SHARED_ROOM_COMMANDS
@@ -11663,6 +11667,93 @@ var init_command_names = __esm({
   }
 });
 
+// src/thread-contracts.ts
+var ParticipantIdSchema, ContainerIdSchema, TopicTextSchema, InputTopicSchema, StoredTopicSchema, IdempotencyKeySchema, ThreadMemberSchema, ThreadRootSchema, ThreadScopeSchema, StartThreadInputSchema, ThreadFailure;
+var init_thread_contracts = __esm({
+  "src/thread-contracts.ts"() {
+    "use strict";
+    init_zod();
+    ParticipantIdSchema = external_exports.string().regex(
+      /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
+      "must be a 26-character lowercase Crockford ULID"
+    );
+    ContainerIdSchema = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
+    TopicTextSchema = external_exports.string().refine(
+      (value) => Array.from(value).length >= 1 && Array.from(value).length <= 120 && value.trim().length > 0 && !/[\p{Cc}\p{Cf}]/u.test(value),
+      "topic must contain 1-120 Unicode characters without control or format characters"
+    );
+    InputTopicSchema = TopicTextSchema.transform((value) => value.trim());
+    StoredTopicSchema = TopicTextSchema.refine(
+      (value) => value === value.trim(),
+      "stored topic must already be trimmed"
+    );
+    IdempotencyKeySchema = external_exports.string().regex(
+      /^[A-Za-z0-9._:-]{1,128}$/,
+      "must contain 1-128 portable idempotency-key characters"
+    );
+    ThreadMemberSchema = external_exports.object({
+      participant_id: ParticipantIdSchema,
+      identity: ContainerIdSchema
+    }).strict();
+    ThreadRootSchema = external_exports.object({
+      schema_version: external_exports.literal(1),
+      thread_id: ParticipantIdSchema,
+      topic: StoredTopicSchema,
+      creator_participant_id: ParticipantIdSchema,
+      members: external_exports.array(ThreadMemberSchema).min(1),
+      idempotency_key: IdempotencyKeySchema,
+      fingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase SHA-256 digest")
+    }).strict().superRefine((root, context) => {
+      const participantIds = /* @__PURE__ */ new Set();
+      const identities = /* @__PURE__ */ new Set();
+      for (const [index, member] of root.members.entries()) {
+        if (participantIds.has(member.participant_id)) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["members", index, "participant_id"],
+            message: "thread member participant IDs must be unique"
+          });
+        }
+        participantIds.add(member.participant_id);
+        if (identities.has(member.identity)) {
+          context.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            path: ["members", index, "identity"],
+            message: "thread member identities must be unique"
+          });
+        }
+        identities.add(member.identity);
+      }
+      if (!participantIds.has(root.creator_participant_id)) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["creator_participant_id"],
+          message: "thread creator must be a member"
+        });
+      }
+    });
+    ThreadScopeSchema = external_exports.object({
+      thread_id: ParticipantIdSchema,
+      parent_key: external_exports.string().regex(
+        /^(?:message|file):[0-7][0-9a-hjkmnp-tv-z]{25}$/,
+        "must identify an immediate message or file parent"
+      ).optional()
+    }).strict();
+    StartThreadInputSchema = external_exports.object({
+      topic: InputTopicSchema,
+      participant_ids: external_exports.array(ParticipantIdSchema).min(1),
+      idempotency_key: IdempotencyKeySchema
+    }).strict();
+    ThreadFailure = class extends Error {
+      constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "ThreadFailure";
+      }
+    };
+  }
+});
+
 // src/contracts.ts
 import { createHash } from "node:crypto";
 function utf8Bounded(label, maximumBytes) {
@@ -11804,6 +11895,18 @@ function refineRelaySubject(record, context) {
     });
   }
 }
+function refineIntakeRejection(record, context) {
+  if (record.kind !== "intake_rejection") return;
+  const hasMessage = record.source_msg_id !== void 0;
+  const hasFile = record.source_file_id !== void 0;
+  if (hasMessage === hasFile || (record.source_kind === "message" ? !hasMessage : !hasFile)) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["source_kind"],
+      message: "intake rejections require exactly one numeric source field matching source_kind"
+    });
+  }
+}
 function refineFileRecord(record, context) {
   if (record.kind !== "file" || record.data_base64 === void 0) return;
   const bytes = Buffer.from(record.data_base64, "base64");
@@ -11854,13 +11957,110 @@ function refineMessageCategory(message, context) {
     }
   }
 }
-var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, MAX_ROOM_IDENTITY_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, ContainerIdSchema, RuntimeCommandNameSchema, RuntimeCommandGrantSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, MAX_ROOM_IDENTITY_TITLE_CHARACTERS, SDK_IDENTITY_NAME_FORBIDDEN, SDK_IDENTITY_NAME_RESERVED, CoworkIdentityNameError, RoleSchema, ROOM_ROLE, RuntimeRoleCommandGrantSchema, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, AcceptExternalInviteInputSchema, ListMembersCommandInputSchema, CommandIdempotencyKeySchema, RemoveMemberCommandInputSchema, RuntimeCommandGrantInputSchema, RuntimeRoleCommandGrantInputSchema, RuntimeCommandAuditSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
+function refineMessageThread(message, context) {
+  if (message.thread_root !== void 0) {
+    if (message.scope === void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["scope"],
+        message: "thread root messages require scope"
+      });
+      return;
+    }
+    if (message.scope.thread_id !== message.message_id || message.thread_root.thread_id !== message.message_id) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["thread_root", "thread_id"],
+        message: "thread root thread_id and scope thread_id must equal message_id"
+      });
+    }
+    if (message.scope.parent_key !== void 0) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["scope", "parent_key"],
+        message: "parent_key is forbidden on thread root messages"
+      });
+    }
+    if (message.category !== "chat") {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["category"],
+        message: "thread root messages must be chat messages"
+      });
+    }
+    if (message.text !== `Thread: ${message.thread_root.topic}`) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["text"],
+        message: "thread root message text must identify its topic"
+      });
+    }
+    const creator = message.thread_root.members.find(
+      (member) => member.participant_id === message.thread_root?.creator_participant_id
+    );
+    if (creator?.identity !== message.author.identity) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["thread_root", "creator_participant_id"],
+        message: "thread root creator must match the message author"
+      });
+    }
+    if (message.author_alias !== void 0 && message.author_alias.participant_id !== message.thread_root.creator_participant_id) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["author_alias", "participant_id"],
+        message: "thread root author alias must identify the creator"
+      });
+    }
+    for (const field of ["source_msg_id", "source_wire_id", "source_reply_to"]) {
+      if (message[field] !== void 0) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: [field],
+          message: `${field} is forbidden on thread root messages`
+        });
+      }
+    }
+    return;
+  }
+  if (message.scope === void 0) return;
+  if (message.scope.parent_key === void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["scope", "parent_key"],
+      message: "thread descendants require an immediate parent_key"
+    });
+  }
+  if (message.scope.thread_id === message.message_id) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["scope", "thread_id"],
+      message: "thread descendant thread_id must identify a distinct root message"
+    });
+  }
+  if (message.source_reply_to === void 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["source_reply_to"],
+      message: "thread descendants require source_reply_to"
+    });
+  }
+  if (message.category !== "chat") {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["category"],
+      message: "thread descendants must be chat messages"
+    });
+  }
+}
+var MAX_TEXT_BYTES, MAX_FILE_BYTES, MAX_HISTORY_PAGE_BYTES, MAX_MANAGEMENT_RESPONSE_BYTES, MAX_EXTERNAL_INVITE_BYTES, MAX_FILE_NAME_BYTES, MAX_MIME_BYTES, MAX_ROLE_BYTES, MAX_ROOM_NAME_CHARACTERS, MAX_ROOM_IDENTITY_NAME_CHARACTERS, NonEmptyStringSchema, PositiveSafeIntegerSchema, LowerCrockfordUlidSchema, ContainerIdSchema2, RuntimeCommandNameSchema, RuntimeCommandNamespacePatternSchema, RuntimeCommandGrantPatternSchema, RuntimeCommandGrantSchema, Rfc3339Schema, RoomNameSchema, ROOM_IDENTITY_PREFIX, MAX_ROOM_IDENTITY_TITLE_CHARACTERS, SDK_IDENTITY_NAME_FORBIDDEN, SDK_IDENTITY_NAME_RESERVED, CoworkIdentityNameError, RoleSchema, ROOM_ROLE, RuntimeRoleCommandGrantSchema, MissionTextSchema, MessageTextSchema, FileNameSchema, FileMimeSchema, RoomStateSchema, SeatStateSchema, InviteModeSchema, DEFAULT_ROLE, InviteStateSchema, RelayStatusSchema, SeatV1Schema, SeatSchema, RoomInviteSchema, MissionV1Schema, MissionSchema, RoleBriefingSchema, RoomCommonShape, RoomV1Schema, CurrentRoomSchema, RoomSchema, CreateRoomInputSchema, UpdateRoomInputSchema, RoleBriefingSetInputSchema, RoleBriefingDeleteInputSchema, PostMessageInputSchema, PostAsRoleInputSchema, RestRoleInputSchema, AcceptExternalInviteInputSchema, ListMembersCommandInputSchema, CommandIdempotencyKeySchema, RemoveMemberCommandInputSchema, RuntimeCommandGrantInputSchema, RuntimeRoleCommandGrantInputSchema, RuntimeCommandAuditSchema, AuthorSnapshotSchema, RecordCommonShape, AppendCommonShape, MembershipNoticeSchema, AuthorAliasSchema, ReplyReferenceSchema, MessageShape, RelayIntentShape, RelayResultStatusSchema, RelayResultShape, FileShape, IntakeRejectionShape, MembershipIntentShape, MembershipResultShape, CloseNoticeIntentShape, CloseNoticeResultShape, MessageRecordSchema, FileRecordSchema, RelayIntentRecordSchema, RelayResultRecordSchema, IntakeRejectionRecordSchema, MembershipIntentRecordSchema, MembershipResultRecordSchema, CloseNoticeIntentRecordSchema, CloseNoticeResultRecordSchema, RawCommunicationRecordSchema, CommunicationRecordSchema, AppendRecordSchema;
 var init_contracts = __esm({
   "src/contracts.ts"() {
     "use strict";
     init_zod();
     init_consumer_commands();
     init_command_names();
+    init_thread_contracts();
     MAX_TEXT_BYTES = 262144;
     MAX_FILE_BYTES = 2 * 1024 * 1024;
     MAX_HISTORY_PAGE_BYTES = 3 * 1024 * 1024;
@@ -11877,11 +12077,17 @@ var init_contracts = __esm({
       /^[0-7][0-9a-hjkmnp-tv-z]{25}$/,
       "must be a 26-character lowercase Crockford ULID"
     );
-    ContainerIdSchema = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
+    ContainerIdSchema2 = external_exports.string().regex(/^[0-9a-f]{64}$/i, "must be a 64-character hexadecimal CID").transform((value) => value.toUpperCase());
     RuntimeCommandNameSchema = external_exports.union([external_exports.enum(RUNTIME_COMMAND_NAMES), ConsumerCommandNameSchema]);
+    RuntimeCommandNamespacePatternSchema = external_exports.string().max(128).regex(/^(?:[a-z0-9][a-z0-9-]*\.)+\*$/);
+    RuntimeCommandGrantPatternSchema = external_exports.union([
+      RuntimeCommandNameSchema,
+      external_exports.literal("*"),
+      RuntimeCommandNamespacePatternSchema
+    ]);
     RuntimeCommandGrantSchema = external_exports.object({
-      caller_cid: ContainerIdSchema,
-      command: RuntimeCommandNameSchema
+      caller_cid: ContainerIdSchema2,
+      command: RuntimeCommandGrantPatternSchema
     }).strict();
     Rfc3339Schema = external_exports.string().refine(isStrictRfc3339, "must be a valid RFC3339 timestamp");
     RoomNameSchema = external_exports.string().refine(
@@ -11911,7 +12117,7 @@ var init_contracts = __esm({
     ROOM_ROLE = "room";
     RuntimeRoleCommandGrantSchema = external_exports.object({
       role: RoleSchema,
-      commands: external_exports.array(RuntimeCommandNameSchema).superRefine((commands, context) => {
+      commands: external_exports.array(RuntimeCommandGrantPatternSchema).superRefine((commands, context) => {
         const seen = /* @__PURE__ */ new Set();
         for (const [index, command] of commands.entries()) {
           if (seen.has(command)) {
@@ -12159,7 +12365,7 @@ var init_contracts = __esm({
       lifecycle_request: external_exports.object({
         request_id: external_exports.string().min(1).max(256),
         command: external_exports.enum(["room.close", "room.delete"]),
-        caller_cid: ContainerIdSchema,
+        caller_cid: ContainerIdSchema2,
         accepted_at: Rfc3339Schema,
         state: external_exports.enum(["pending", "failed", "completed"]),
         error: external_exports.literal("lifecycle_failed").optional()
@@ -12310,7 +12516,7 @@ var init_contracts = __esm({
         (value) => Buffer.byteLength(value, "utf8") <= MAX_EXTERNAL_INVITE_BYTES,
         `invite input must be at most ${MAX_EXTERNAL_INVITE_BYTES} UTF-8 bytes`
       ),
-      expected_cid: ContainerIdSchema.optional()
+      expected_cid: ContainerIdSchema2.optional()
     }).strict();
     ListMembersCommandInputSchema = external_exports.object({}).strict();
     CommandIdempotencyKeySchema = external_exports.string().regex(
@@ -12387,7 +12593,9 @@ var init_contracts = __esm({
       }),
       source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
       source_wire_id: NonEmptyStringSchema.optional(),
-      source_reply_to: ReplyReferenceSchema.optional()
+      source_reply_to: ReplyReferenceSchema.optional(),
+      scope: ThreadScopeSchema.optional(),
+      thread_root: ThreadRootSchema.optional()
     };
     RelayIntentShape = {
       kind: external_exports.literal("relay_intent"),
@@ -12395,7 +12603,12 @@ var init_contracts = __esm({
       file_id: LowerCrockfordUlidSchema.optional(),
       recipient_identity: NonEmptyStringSchema
     };
-    RelayResultStatusSchema = external_exports.enum(["queued", "send_failed", "skipped_removed"]);
+    RelayResultStatusSchema = external_exports.enum([
+      "queued",
+      "send_failed",
+      "skipped_removed",
+      "skipped_reply_unavailable"
+    ]);
     RelayResultShape = {
       kind: external_exports.literal("relay_result"),
       intent_record_id: NonEmptyStringSchema,
@@ -12433,6 +12646,18 @@ var init_contracts = __esm({
       source_wire_id: NonEmptyStringSchema.optional(),
       source_reply_to: ReplyReferenceSchema.optional()
     };
+    IntakeRejectionShape = {
+      kind: external_exports.literal("intake_rejection"),
+      source_kind: external_exports.enum(["message", "file"]),
+      source_msg_id: external_exports.number().int().nonnegative().safe().optional(),
+      source_file_id: external_exports.number().int().nonnegative().safe().optional(),
+      source_wire_id: NonEmptyStringSchema,
+      sender_identity: NonEmptyStringSchema,
+      sender_participant_id: LowerCrockfordUlidSchema,
+      fingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+      error: external_exports.enum(["reply_target_unavailable", "thread_files_unsupported"]),
+      notification_attempt_claimed: external_exports.literal(true)
+    };
     MembershipIntentShape = {
       kind: external_exports.literal("membership_intent"),
       action: external_exports.enum(["remove"]),
@@ -12470,6 +12695,7 @@ var init_contracts = __esm({
     FileRecordSchema = external_exports.object({ ...RecordCommonShape, ...FileShape }).strict();
     RelayIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayIntentShape }).strict();
     RelayResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...RelayResultShape }).strict();
+    IntakeRejectionRecordSchema = external_exports.object({ ...RecordCommonShape, ...IntakeRejectionShape }).strict();
     MembershipIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipIntentShape }).strict();
     MembershipResultRecordSchema = external_exports.object({ ...RecordCommonShape, ...MembershipResultShape }).strict();
     CloseNoticeIntentRecordSchema = external_exports.object({ ...RecordCommonShape, ...CloseNoticeIntentShape }).strict();
@@ -12479,6 +12705,7 @@ var init_contracts = __esm({
       FileRecordSchema,
       RelayIntentRecordSchema,
       RelayResultRecordSchema,
+      IntakeRejectionRecordSchema,
       MembershipIntentRecordSchema,
       MembershipResultRecordSchema,
       CloseNoticeIntentRecordSchema,
@@ -12492,8 +12719,12 @@ var init_contracts = __esm({
           message: 'record_id must equal room_id + ":" + seq'
         });
       }
-      if (record.kind === "message") refineMessageCategory(record, context);
+      if (record.kind === "message") {
+        refineMessageCategory(record, context);
+        refineMessageThread(record, context);
+      }
       refineRelaySubject(record, context);
+      refineIntakeRejection(record, context);
       refineFileRecord(record, context);
     });
     AppendRecordSchema = external_exports.discriminatedUnion("kind", [
@@ -12501,11 +12732,16 @@ var init_contracts = __esm({
       external_exports.object({ ...AppendCommonShape, ...FileShape }).strict(),
       external_exports.object({ ...AppendCommonShape, ...RelayIntentShape }).strict(),
       external_exports.object({ ...AppendCommonShape, ...RelayResultShape }).strict(),
+      external_exports.object({ ...AppendCommonShape, ...IntakeRejectionShape }).strict(),
       external_exports.object({ ...AppendCommonShape, ...CloseNoticeIntentShape }).strict(),
       external_exports.object({ ...AppendCommonShape, ...CloseNoticeResultShape }).strict()
     ]).superRefine((record, context) => {
-      if (record.kind === "message") refineMessageCategory(record, context);
+      if (record.kind === "message") {
+        refineMessageCategory(record, context);
+        refineMessageThread(record, context);
+      }
       refineRelaySubject(record, context);
+      refineIntakeRejection(record, context);
       refineFileRecord(record, context);
     });
   }
@@ -12746,7 +12982,7 @@ function apiDocsAsset(pathname) {
       return void 0;
   }
 }
-var RPC_PATH, OPENAPI_DOCUMENT_PATH, API_DOCS_PATH, API_DOCS_SCRIPT_PATH, API_DOCS_STYLESHEET_PATH, API_VERSION, EXAMPLE_ROOM_ID, roomIdProperty, roleProperty, restRoleProperty, missionTextProperty, roomNameProperty, inviteModeProperty, notifyProperty, PRIVATE_ROOM_RPC_METHODS, ROOM_RPC_METHODS, RPC_ERROR_CODES, DOCS_PAGE, DOCS_STYLESHEET, DOCS_SCRIPT;
+var RPC_PATH, OPENAPI_DOCUMENT_PATH, API_DOCS_PATH, API_DOCS_SCRIPT_PATH, API_DOCS_STYLESHEET_PATH, API_VERSION, commandGrantPatternProperty, EXAMPLE_ROOM_ID, roomIdProperty, roleProperty, restRoleProperty, missionTextProperty, roomNameProperty, inviteModeProperty, notifyProperty, PRIVATE_ROOM_RPC_METHODS, ROOM_RPC_METHODS, RPC_ERROR_CODES, DOCS_PAGE, DOCS_STYLESHEET, DOCS_SCRIPT;
 var init_openapi = __esm({
   "src/openapi.ts"() {
     "use strict";
@@ -12757,6 +12993,15 @@ var init_openapi = __esm({
     API_DOCS_SCRIPT_PATH = "/docs/ui.js";
     API_DOCS_STYLESHEET_PATH = "/docs/ui.css";
     API_VERSION = "1";
+    commandGrantPatternProperty = {
+      anyOf: [
+        { type: "string", enum: [...RUNTIME_COMMAND_NAMES] },
+        { type: "string", maxLength: 128, pattern: "^consumer\\.[a-z0-9][a-z0-9.-]*[a-z0-9]$" },
+        { type: "string", enum: ["*"] },
+        { type: "string", maxLength: 128, pattern: "^(?:[a-z0-9][a-z0-9-]*\\.)+\\*$" }
+      ],
+      description: "Exact command, * for all runtime commands, or terminal namespace.*. Patterns also cover future matching commands."
+    };
     EXAMPLE_ROOM_ID = "01jd7q4h9m2v8xk3znbc5regty";
     roomIdProperty = {
       type: "string",
@@ -12821,7 +13066,7 @@ var init_openapi = __esm({
       {
         method: "room.command.definition.put",
         summary: "Register or replace a consumer command",
-        description: "Registers a consumer.* command for the ours catalog using an exact host-configured handler reference. Replacement clears grants for that name. Local definitions cannot be replaced here. A published:false result means desired state is committed; use reload to retry publication.",
+        description: "Registers a consumer.* command for the ours catalog using an exact host-configured handler reference. Replacement clears exact grants for that name; wildcard grants remain effective. Local definitions cannot be replaced here. A published:false result means desired state is committed; use reload to retry publication.",
         params: params({ room_id: roomIdProperty, expected_revision: { type: "integer", minimum: 0 }, definition: {
           type: "object",
           additionalProperties: false,
@@ -12834,7 +13079,7 @@ var init_openapi = __esm({
       {
         method: "room.command.definition.delete",
         summary: "Delete a REST consumer command",
-        description: "Deletes the desired definition and its CID/role grants. Requires the current registry revision. Local commands must be removed from their file and reloaded.",
+        description: "Deletes the desired definition and its exact CID/role grants; wildcard grants remain stored. Requires the current registry revision. Local commands must be removed from their file and reloaded.",
         params: params({ room_id: roomIdProperty, expected_revision: { type: "integer", minimum: 0 }, name: { type: "string" } }, ["room_id", "expected_revision", "name"]),
         result: "Updated revision, published and definitions.",
         example: { room_id: EXAMPLE_ROOM_ID, expected_revision: 1, name: "consumer.orders" }
@@ -13004,7 +13249,7 @@ var init_openapi = __esm({
       {
         method: "room.command.grants",
         summary: "List runtime-command grants",
-        description: "Lists the default-deny grants that bind one active participant CID to one room runtime command.",
+        description: "Lists the default-deny grants that bind one active participant CID to one room runtime command name or stored wildcard pattern.",
         params: params({ room_id: roomIdProperty }, ["room_id"]),
         result: "An array of `{caller_cid, command}` grants.",
         example: { room_id: EXAMPLE_ROOM_ID }
@@ -13020,13 +13265,11 @@ var init_openapi = __esm({
       {
         method: "room.command.role.set",
         summary: "Set a role runtime-command policy",
-        description: "Atomically replaces the command policy for one exact role. An empty command list removes the policy without removing independent per-CID grants.",
+        description: "Atomically replaces the command policy for one exact role. An empty command list removes the policy without removing independent per-CID grants. Accepts exact names, * and namespace.* patterns.",
         params: params({
           room_id: roomIdProperty,
           role: { type: "string", minLength: 1, description: "Exact admitted seat role." },
-          commands: { type: "array", uniqueItems: true, items: {
-            anyOf: [{ type: "string", enum: [...RUNTIME_COMMAND_NAMES] }, { type: "string", maxLength: 128, pattern: "^consumer\\.[a-z0-9][a-z0-9.-]*[a-z0-9]$" }]
-          } }
+          commands: { type: "array", uniqueItems: true, items: commandGrantPatternProperty }
         }, ["room_id", "role", "commands"]),
         result: "The complete sorted role-policy list after the idempotent update.",
         example: { room_id: EXAMPLE_ROOM_ID, role: "Owner", commands: ["list-members", "remove-member"] }
@@ -13034,11 +13277,11 @@ var init_openapi = __esm({
       {
         method: "room.command.grant",
         summary: "Authorize a runtime command caller",
-        description: "Idempotently grants one command to one exact active participant CID. Display names and roles are never authority.",
+        description: "Idempotently grants one command name or dynamic pattern to one exact active participant CID. Display names and caller-supplied roles are never authority. * and room.* include permission administration and room lifecycle commands; * also covers future or replaced consumer commands.",
         params: params({
           room_id: roomIdProperty,
           caller_cid: { type: "string", pattern: "^[0-9A-Fa-f]{64}$", description: "Authenticated caller CID." },
-          command: { anyOf: [{ type: "string", enum: [...RUNTIME_COMMAND_NAMES] }, { type: "string", maxLength: 128, pattern: "^consumer\\.[a-z0-9][a-z0-9.-]*[a-z0-9]$" }] }
+          command: commandGrantPatternProperty
         }, ["room_id", "caller_cid", "command"]),
         result: "The complete sorted grant list after the idempotent update.",
         example: { room_id: EXAMPLE_ROOM_ID, caller_cid: "A".repeat(64), command: "list-members" }
@@ -13046,11 +13289,11 @@ var init_openapi = __esm({
       {
         method: "room.command.revoke",
         summary: "Revoke a runtime command caller",
-        description: "Idempotently removes one exact CID/command grant. Revocation is persisted before subsequent command dispatch can acquire the room mutex.",
+        description: "Idempotently removes only the exact stored CID/name or CID/pattern entry; overlapping grants remain effective. Revocation is persisted before subsequent command dispatch can acquire the room mutex.",
         params: params({
           room_id: roomIdProperty,
           caller_cid: { type: "string", pattern: "^[0-9A-Fa-f]{64}$", description: "Authenticated caller CID." },
-          command: { anyOf: [{ type: "string", enum: [...RUNTIME_COMMAND_NAMES] }, { type: "string", maxLength: 128, pattern: "^consumer\\.[a-z0-9][a-z0-9.-]*[a-z0-9]$" }] }
+          command: commandGrantPatternProperty
         }, ["room_id", "caller_cid", "command"]),
         result: "The complete sorted grant list after the idempotent update.",
         example: { room_id: EXAMPLE_ROOM_ID, caller_cid: "A".repeat(64), command: "remove-member" }
@@ -13842,6 +14085,34 @@ var init_packets = __esm({
         this.runtimeHandlers = handlers;
         await this.runBound(() => this.client.registerCommands([
           ...handlers.consumerCommands ?? [],
+          ...handlers.startThread === void 0 ? [] : [{
+            name: "start_thread",
+            description: "Create a scoped reply thread for an explicit set of room participant IDs.",
+            input_schema: {
+              type: "object",
+              additionalProperties: false,
+              required: ["topic", "participant_ids", "idempotency_key"],
+              properties: {
+                topic: {
+                  type: "string",
+                  minLength: 1,
+                  maxLength: 120,
+                  pattern: "^(?![\\s\\S]*[\\p{Cc}\\p{Cf}])[\\s\\S]*\\S[\\s\\S]*$"
+                },
+                participant_ids: {
+                  type: "array",
+                  minItems: 1,
+                  uniqueItems: true,
+                  items: { type: "string", pattern: "^[0-7][0-9a-hjkmnp-tv-z]{25}$" }
+                },
+                idempotency_key: {
+                  type: "string",
+                  pattern: "^[A-Za-z0-9._:-]{1,128}$"
+                }
+              }
+            },
+            handler: handlers.startThread
+          }],
           {
             name: "list-members",
             description: "List the room roster using contact-safe member fields.",
@@ -13866,9 +14137,10 @@ var init_packets = __esm({
           ...handlers.sharedCommand === void 0 ? [] : SHARED_ROOM_COMMANDS.map((name) => {
             const doc = [...ROOM_RPC_METHODS, ...PRIVATE_ROOM_RPC_METHODS].find((method) => method.method === name);
             const { room_id: _roomId, ...properties } = doc.params.properties;
+            if (name === "room.history") properties.view = { const: "participant" };
             return {
               name,
-              description: `${doc.description} Requires an explicit grant; applies only to this room.`,
+              description: `${name === "room.history" ? "Read your visible messages using viewer-local after cursors." : doc.description} Requires an explicit grant; applies only to this room.`,
               input_schema: {
                 ...doc.params,
                 properties,
@@ -14011,6 +14283,22 @@ var init_ulid = __esm({
 });
 
 // src/reply-threading.ts
+function buildAliasIndex(rows, roomId) {
+  const local = rows.filter((r) => r.room_id === roomId);
+  const items = local.filter((r) => r.kind === "message" || r.kind === "file");
+  const intents = local.filter((r) => r.kind === "relay_intent");
+  const results = local.filter((r) => r.kind === "relay_result");
+  const copies = (parent, cid) => results.filter((result) => {
+    if (result.status !== "queued" || result.recipient_identity !== cid || key(result) !== key(parent) || !parent.recipient_identities.includes(cid)) return false;
+    const matches = intents.filter((intent2) => intent2.record_id === result.intent_record_id);
+    if (matches.length !== 1) return false;
+    const intent = matches[0];
+    return key(intent) === key(parent) && intent.recipient_identity === cid && parent.seq < intent.seq && intent.seq < result.seq;
+  }).sort((a, b) => a.seq - b.seq);
+  const wires = (result, parent) => [result.wire_id, ...parent.kind === "file" ? [result.metadata_wire_id] : []].filter(nonempty);
+  const ownersFor = (wireId, cid) => items.filter((item) => item.author.identity === cid && item.source_wire_id === wireId || copies(item, cid).some((result) => wires(result, item).includes(wireId)));
+  return { items, copies, wires, ownersFor };
+}
 async function readReplyRows(store, roomId) {
   const rows = [];
   let after = 0;
@@ -14028,42 +14316,53 @@ async function readReplyRows(store, roomId) {
     after = last.seq;
   }
 }
-function selectReply(rows, roomId, child, recipientCid) {
-  if (child.room_id !== roomId) throw new Error("reply child room mismatch");
-  const incoming = child.source_reply_to?.wire_id;
-  if (!nonempty(incoming)) return { state: "none" };
-  const local = rows.filter((r) => r.room_id === roomId);
-  const items = local.filter((r) => r.kind === "message" || r.kind === "file");
-  const intents = local.filter((r) => r.kind === "relay_intent");
-  const results = local.filter((r) => r.kind === "relay_result");
-  const copies = (parent2, cid) => results.filter((result) => {
-    if (result.status !== "queued" || result.recipient_identity !== cid || key(result) !== key(parent2) || !parent2.recipient_identities.includes(cid)) return false;
-    const matches = intents.filter((intent2) => intent2.record_id === result.intent_record_id);
-    if (matches.length !== 1) return false;
-    const intent = matches[0];
-    return key(intent) === key(parent2) && intent.recipient_identity === cid && parent2.seq < intent.seq && intent.seq < result.seq;
-  }).sort((a, b) => a.seq - b.seq);
-  const wires = (r, parent2) => [r.wire_id, ...parent2.kind === "file" ? [r.metadata_wire_id] : []].filter(nonempty);
-  const ownersFor = (wireId2, cid) => items.filter((item) => item.author.identity === cid && item.source_wire_id === wireId2 || copies(item, cid).some((result) => wires(result, item).includes(wireId2)));
-  const candidates = items.filter((parent2) => parent2.author.identity === child.author.identity && parent2.source_wire_id === incoming || copies(parent2, child.author.identity).some((result) => wires(result, parent2).includes(incoming)));
+function resolveReplyParent(rows, roomId, senderCid, wireId, beforeSeq) {
+  if (wireId === void 0) return { state: "none" };
+  if (!nonempty(wireId)) return { state: "unknown_parent" };
+  const index = buildAliasIndex(rows, roomId);
+  const candidates = index.ownersFor(wireId, senderCid);
   if (candidates.length === 0) return { state: "unknown_parent" };
   if (candidates.length !== 1) return { state: "ambiguous_parent" };
   const parent = candidates[0];
-  if (parent.seq >= child.seq) return { state: "unknown_parent" };
+  if (parent.seq >= beforeSeq) return { state: "unknown_parent" };
   const parentKey = key(parent);
-  if (items.filter((item) => key(item) === parentKey).length !== 1) {
+  if (index.items.filter((item) => key(item) === parentKey).length !== 1) {
     return { state: "ambiguous_parent" };
   }
-  const recipientCopies = copies(parent, recipientCid);
+  return { state: "resolved", parent: { key: parentKey, item: parent } };
+}
+function mapReplyParent(rows, roomId, logicalParent, recipientCid) {
+  const index = buildAliasIndex(rows, roomId);
+  if (logicalParent.item.room_id !== roomId || key(logicalParent.item) !== logicalParent.key) {
+    return { state: "ambiguous_parent", parentKey: logicalParent.key };
+  }
+  const matches = index.items.filter((item) => key(item) === logicalParent.key);
+  if (matches.length !== 1) {
+    return { state: "ambiguous_parent", parentKey: logicalParent.key };
+  }
+  const parent = matches[0];
+  const recipientCopies = index.copies(parent, recipientCid);
   const sourceWire = parent.author.identity === recipientCid && nonempty(parent.source_wire_id) ? parent.source_wire_id : void 0;
-  const sourceOwners = sourceWire === void 0 ? [] : ownersFor(sourceWire, recipientCid);
-  const wireId = sourceOwners.length === 1 && key(sourceOwners[0]) === parentKey ? sourceWire : recipientCopies.map((copy) => wires(copy, parent)[0]).find(nonempty);
-  if (!nonempty(wireId)) return { state: "missing_copy", parentKey };
-  const owners = ownersFor(wireId, recipientCid);
-  if (owners.length !== 1 || key(owners[0]) !== parentKey) {
-    return { state: "ambiguous_parent", parentKey };
+  const sourceOwners = sourceWire === void 0 ? [] : index.ownersFor(sourceWire, recipientCid);
+  const wireId = sourceOwners.length === 1 && key(sourceOwners[0]) === logicalParent.key ? sourceWire : recipientCopies.map((copy) => index.wires(copy, parent)[0]).find(nonempty);
+  if (!nonempty(wireId)) return { state: "missing_copy", parentKey: logicalParent.key };
+  const owners = index.ownersFor(wireId, recipientCid);
+  if (owners.length !== 1 || key(owners[0]) !== logicalParent.key) {
+    return { state: "ambiguous_parent", parentKey: logicalParent.key };
   }
-  return { state: "linked", parentKey, replyTo: { wire_id: wireId } };
+  return { state: "linked", parentKey: logicalParent.key, replyTo: { wire_id: wireId } };
+}
+function selectReply(rows, roomId, child, recipientCid) {
+  if (child.room_id !== roomId) throw new Error("reply child room mismatch");
+  const resolution = resolveReplyParent(
+    rows,
+    roomId,
+    child.author.identity,
+    child.source_reply_to?.wire_id,
+    child.seq
+  );
+  if (resolution.state !== "resolved") return resolution;
+  return mapReplyParent(rows, roomId, resolution.parent, recipientCid);
 }
 var key, nonempty;
 var init_reply_threading = __esm({
@@ -14074,9 +14373,159 @@ var init_reply_threading = __esm({
   }
 });
 
+// src/threads.ts
+import { createHash as createHash3 } from "node:crypto";
+function publicThreadMetadata(root, room) {
+  let creator;
+  if (room.anonymous) {
+    const alias = AuthorAliasSchema.safeParse(root.author_alias);
+    if (!alias.success || alias.data.participant_id !== root.thread_root.creator_participant_id) {
+      throw new ThreadFailure("reply_target_unavailable");
+    }
+    creator = {
+      identity: alias.data.participant_id,
+      display_name: alias.data.alias,
+      role: root.author.role
+    };
+  } else {
+    creator = {
+      identity: root.author.identity,
+      display_name: root.author.display_name,
+      role: root.author.role
+    };
+  }
+  return {
+    schema_version: 1,
+    thread_id: root.thread_root.thread_id,
+    topic: root.thread_root.topic,
+    creator,
+    participant_ids: root.thread_root.members.map((member) => member.participant_id),
+    created_at: root.at
+  };
+}
+function selectThreadMembers(room, cid, input) {
+  const selected = new Set(input.participant_ids);
+  const active = room.seats.filter((seat) => seat.state === "active");
+  const creator = active.find((seat) => seat.identity === cid);
+  if (creator === void 0 || selected.size === 0 || selected.size !== input.participant_ids.length || selected.size > active.length || !selected.has(creator.participant_id)) {
+    throw new ThreadFailure("invalid_members");
+  }
+  const members = active.filter((seat) => selected.has(seat.participant_id));
+  if (members.length !== selected.size) throw new ThreadFailure("invalid_members");
+  return members.map(({ participant_id, identity }) => ({ participant_id, identity })).sort((left, right) => left.participant_id.localeCompare(right.participant_id));
+}
+function activeThreadSeat(room, root, cid) {
+  return room.seats.find((seat) => seat.state === "active" && seat.identity === cid && root.members.some((member) => member.identity === cid && member.participant_id === seat.participant_id));
+}
+function threadRelayEligible(room, root, cid) {
+  return activeThreadSeat(room, root, cid) !== void 0;
+}
+function publicThreadAuthor(message, root, room) {
+  const member = root.members.find((member2) => member2.identity === message.author.identity);
+  if (!member) throw new ThreadFailure("reply_target_unavailable");
+  if (!room.anonymous) return message.author;
+  const alias = AuthorAliasSchema.safeParse(message.author_alias);
+  if (!alias.success || alias.data.participant_id !== member.participant_id) {
+    throw new ThreadFailure("reply_target_unavailable");
+  }
+  return { identity: alias.data.participant_id, display_name: alias.data.alias, role: message.author.role };
+}
+function threadFingerprint(input) {
+  return createHash3("sha256").update(JSON.stringify({
+    topic: input.topic,
+    participant_ids: [...input.participant_ids].sort()
+  })).digest("hex");
+}
+function findThreadRoot(rows, id) {
+  const candidates = rows.filter((row) => row.kind === "message" && (row.message_id === id || row.thread_root?.thread_id === id || row.scope?.thread_id === id && row.scope.parent_key === void 0));
+  if (candidates.length === 0) return void 0;
+  if (candidates.length !== 1) throw new ThreadFailure("reply_target_unavailable");
+  const root = candidates[0];
+  const parsedRoot = ThreadRootSchema.safeParse(root.thread_root);
+  const parsedScope = ThreadScopeSchema.safeParse(root.scope);
+  const parsedAlias = AuthorAliasSchema.safeParse(root.author_alias);
+  const creator = parsedRoot.success ? parsedRoot.data.members.find((member) => member.participant_id === parsedRoot.data.creator_participant_id) : void 0;
+  if (!parsedRoot.success || !parsedScope.success || root.message_id !== id || parsedRoot.data.thread_id !== id || parsedScope.data.thread_id !== id || parsedScope.data.parent_key !== void 0 || root.category !== "chat" || creator?.identity !== root.author.identity || root.author_alias !== void 0 && (!parsedAlias.success || parsedAlias.data.participant_id !== parsedRoot.data.creator_participant_id) || root.source_msg_id !== void 0 || root.source_wire_id !== void 0 || root.source_reply_to !== void 0) {
+    throw new ThreadFailure("reply_target_unavailable");
+  }
+  return root;
+}
+function classifyThreadAssociation(room, rows, source) {
+  const chain = [];
+  const seen = /* @__PURE__ */ new Set();
+  let item = source;
+  for (; ; ) {
+    const key2 = item.kind === "message" ? `message:${item.message_id}` : `file:${item.file_id}`;
+    if (item.room_id !== room.room_id || seen.has(key2) || chain.length > rows.length) {
+      throw new ThreadFailure("reply_target_unavailable");
+    }
+    seen.add(key2);
+    const resolved = resolveReplyParent(
+      rows,
+      room.room_id,
+      item.author.identity,
+      item.source_reply_to?.wire_id,
+      item.seq
+    );
+    chain.push({ item, resolved });
+    if (resolved.state !== "resolved") break;
+    if (resolved.parent.item.seq >= item.seq) throw new ThreadFailure("reply_target_unavailable");
+    item = resolved.parent.item;
+  }
+  let association = { state: "ordinary" };
+  for (const { item: item2, resolved } of chain.reverse()) {
+    const declared = item2.kind === "message" && (item2.scope !== void 0 || item2.thread_root !== void 0);
+    if (!declared && association.state === "ordinary") continue;
+    const scope = ThreadScopeSchema.safeParse(item2.kind === "message" ? item2.scope : void 0);
+    if (item2.kind !== "message" || !scope.success || item2.category !== "chat" || rows.filter((row) => row.room_id === room.room_id && row.kind === "message" && row.message_id === item2.message_id).length !== 1) {
+      throw new ThreadFailure("reply_target_unavailable");
+    }
+    const root = findThreadRoot(rows.filter((row) => row.room_id === room.room_id), scope.data.thread_id);
+    if (!root?.thread_root) throw new ThreadFailure("reply_target_unavailable");
+    publicThreadMetadata({ ...root, thread_root: root.thread_root }, room);
+    publicThreadAuthor(item2, root.thread_root, room);
+    if (item2.message_id !== root.message_id) {
+      if (item2.thread_root !== void 0 || root.seq >= item2.seq || resolved.state !== "resolved" || scope.data.parent_key !== resolved.parent.key || association.state !== "scoped" || association.root.message_id !== root.message_id) {
+        throw new ThreadFailure("reply_target_unavailable");
+      }
+    }
+    association = { state: "scoped", root: { ...root, thread_root: root.thread_root }, scope: scope.data };
+  }
+  return association;
+}
+function resolveIntakeScope(room, rows, item, beforeSeq) {
+  const ordinary = () => ({ recipients: [...new Set(room.seats.filter((seat) => seat.state === "active" && seat.identity !== item.sender_id).map((seat) => seat.identity))] });
+  if (item.reply_to == null) return ordinary();
+  const reply = item.reply_to;
+  if (typeof reply.wire_id !== "string" || reply.wire_id.length === 0 || reply.wire_id.length > 256 || reply.sentence !== void 0 && (!Number.isSafeInteger(reply.sentence) || reply.sentence < 1) || room.state !== "active" || room.lifecycle_request?.state === "pending" || !room.seats.some((seat) => seat.identity === item.sender_id && seat.state === "active")) {
+    throw new ThreadFailure("reply_target_unavailable");
+  }
+  const resolved = resolveReplyParent(rows, room.room_id, item.sender_id, reply.wire_id, beforeSeq);
+  if (resolved.state !== "resolved") throw new ThreadFailure("reply_target_unavailable");
+  const association = classifyThreadAssociation(room, rows, resolved.parent.item);
+  if (association.state === "ordinary") return ordinary();
+  const { root } = association;
+  if (!activeThreadSeat(room, root.thread_root, item.sender_id)) {
+    throw new ThreadFailure("reply_target_unavailable");
+  }
+  if ("file_id" in item) throw new ThreadFailure("thread_files_unsupported");
+  return {
+    recipients: root.thread_root.members.filter((member) => member.identity !== item.sender_id && activeThreadSeat(room, root.thread_root, member.identity) !== void 0).map((member) => member.identity),
+    scope: { thread_id: root.message_id, parent_key: resolved.parent.key }
+  };
+}
+var init_threads = __esm({
+  "src/threads.ts"() {
+    "use strict";
+    init_reply_threading();
+    init_contracts();
+    init_thread_contracts();
+  }
+});
+
 // src/intake.ts
 import { AsyncLocalStorage } from "node:async_hooks";
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 function canonicalJson(value) {
   const encoded = JSON.stringify(canonicalValue(value));
   if (encoded === void 0) throw new TypeError("canonical JSON value is not serializable");
@@ -14091,13 +14540,25 @@ function sameReply2(stored, observed) {
 }
 async function queryStore(store, roomId, options) {
   if (store.query) return store.query(roomId, options);
-  let records = await store.read(roomId);
-  records = records.filter((record) => {
+  const archive = [];
+  let after = 0;
+  for (; ; ) {
+    const page = await store.read(roomId, { after, limit: JOURNAL_WORK_BATCH_SIZE });
+    if (page.length === 0) break;
+    for (const row of page) {
+      if (row.room_id !== roomId || !Number.isSafeInteger(row.seq) || row.seq <= after) {
+        throw new Error("intake archive cursor did not advance");
+      }
+      archive.push(row);
+      after = row.seq;
+    }
+  }
+  let records = archive.filter((record) => {
     const value = record;
-    return (options.kind === void 0 || record.kind === options.kind) && (options.messageId === void 0 || value.message_id === options.messageId) && (options.fileId === void 0 || value.file_id === options.fileId) && (options.sourceMsgId === void 0 || value.source_msg_id === options.sourceMsgId) && (options.sourceFileId === void 0 || value.source_file_id === options.sourceFileId) && (options.recipientIdentity === void 0 || value.recipient_identity === options.recipientIdentity);
+    return (options.after === void 0 || record.seq > options.after) && (options.kind === void 0 || record.kind === options.kind) && (options.messageId === void 0 || value.message_id === options.messageId) && (options.fileId === void 0 || value.file_id === options.fileId) && (options.sourceMsgId === void 0 || value.source_msg_id === options.sourceMsgId) && (options.sourceFileId === void 0 || value.source_file_id === options.sourceFileId) && (options.recipientIdentity === void 0 || value.recipient_identity === options.recipientIdentity);
   });
   if (options.unresolvedResultKind) {
-    const completed = new Set((await store.read(roomId)).filter((record) => record.kind === options.unresolvedResultKind).map((record) => record.intent_record_id));
+    const completed = new Set(archive.filter((record) => record.kind === options.unresolvedResultKind).map((record) => record.intent_record_id));
     records = records.filter((record) => !completed.has(record.record_id));
   }
   if (options.descending) records.reverse();
@@ -14115,8 +14576,20 @@ function canonicalValue(value) {
   }
   return value;
 }
-function unique(values) {
-  return [...new Set(values)];
+function inputFingerprint(item) {
+  return createHash4("sha256").update(canonicalJson({
+    sender: item.sender_id,
+    wire: item.wire_id,
+    date: item.date,
+    reply: item.reply_to ?? null,
+    ..."file_id" in item ? {
+      kind: "file",
+      id: item.file_id,
+      filename: item.filename,
+      mime: item.mime,
+      sha256: createHash4("sha256").update(item.data).digest("hex")
+    } : { kind: "message", id: item.msg_id, text: item.text }
+  })).digest("hex");
 }
 function wireKind(category) {
   switch (category) {
@@ -14138,6 +14611,8 @@ var init_intake = __esm({
     init_contracts();
     init_ulid();
     init_reply_threading();
+    init_threads();
+    init_thread_contracts();
     JOURNAL_WORK_BATCH_SIZE = 64;
     INTAKE_BATCH_SIZE = 32;
     IntakePump = class {
@@ -14282,28 +14757,36 @@ var init_intake = __esm({
         });
       }
       async processFileInboxItem(roomId, packet, item) {
-        const parsedName = FileNameSchema.safeParse(item.filename);
-        const parsedMime = FileMimeSchema.safeParse(item.mime);
-        if (!parsedName.success || !parsedMime.success) {
-          await packet.acknowledgeFile(item);
-          return;
-        }
-        if (item.data.length > MAX_FILE_BYTES) {
-          throw new RangeError(`room files must be at most ${MAX_FILE_BYTES} bytes (2 MiB)`);
-        }
         const room = await this.store.load(roomId);
-        const seat = room.seats.find(
-          (candidate) => candidate.identity === item.sender_id && candidate.state === "active"
-        );
-        if (room.state !== "active" || !seat) {
-          if (room.state === "active") await this.bounceRemovedSender(roomId, room, packet, item);
+        const [stored] = await queryStore(this.store, roomId, { sourceFileId: item.file_id, limit: 1 });
+        if (this.isRejectedReplay(stored, item)) {
           await packet.acknowledgeFile(item);
           return;
         }
-        const [storedFile] = await queryStore(this.store, roomId, { kind: "file", sourceFileId: item.file_id, limit: 1 });
-        let file = this.findSourceFile(storedFile === void 0 ? [] : [storedFile], item);
+        let file = this.findSourceFile(stored === void 0 ? [] : [stored], item);
         if (!file) {
-          const recipientIdentities = unique(room.seats.filter((recipient) => recipient.state === "active").map((recipient) => recipient.identity).filter((identity) => identity !== seat.identity));
+          const seat = room.seats.find((candidate) => candidate.identity === item.sender_id && candidate.state === "active");
+          const known = room.seats.some((candidate) => candidate.identity === item.sender_id);
+          if (!known || item.reply_to == null && (room.state !== "active" || !seat)) {
+            if (room.state === "active") await this.bounceRemovedSender(roomId, room, packet, item);
+            await packet.acknowledgeFile(item);
+            return;
+          }
+          const disposition = await this.freshScopeUnlocked(room, item);
+          if (!disposition) {
+            await packet.acknowledgeFile(item);
+            return;
+          }
+          if (!seat) throw new Error("authorized file sender has no active seat");
+          const parsedName = FileNameSchema.safeParse(item.filename);
+          const parsedMime = FileMimeSchema.safeParse(item.mime);
+          if (!parsedName.success || !parsedMime.success) {
+            await packet.acknowledgeFile(item);
+            return;
+          }
+          if (item.data.length > MAX_FILE_BYTES) {
+            throw new RangeError(`room files must be at most ${MAX_FILE_BYTES} bytes (2 MiB)`);
+          }
           const bytes = Buffer.from(item.data);
           const appended = await this.store.append(roomId, {
             version: 1,
@@ -14316,9 +14799,9 @@ var init_intake = __esm({
             filename: parsedName.data,
             mime: parsedMime.data,
             size: bytes.length,
-            sha256: createHash3("sha256").update(bytes).digest("hex"),
+            sha256: createHash4("sha256").update(bytes).digest("hex"),
             data_base64: bytes.toString("base64"),
-            recipient_identities: recipientIdentities,
+            recipient_identities: disposition.recipients,
             source_file_id: item.file_id,
             ...item.wire_id === "" ? {} : { source_wire_id: item.wire_id },
             ...item.reply_to == null ? {} : { source_reply_to: item.reply_to }
@@ -14331,18 +14814,26 @@ var init_intake = __esm({
       }
       async processInboxItem(roomId, packet, item, acknowledge = true) {
         const room = await this.store.load(roomId);
-        const seat = room.seats.find(
-          (candidate) => candidate.identity === item.sender_id && candidate.state === "active"
-        );
-        if (room.state !== "active" || !seat) {
-          if (room.state === "active") await this.bounceRemovedSender(roomId, room, packet, item);
+        const [stored] = await queryStore(this.store, roomId, { sourceMsgId: item.msg_id, limit: 1 });
+        if (this.isRejectedReplay(stored, item)) {
           if (acknowledge) await this.acknowledgeMessage(roomId, packet, item);
           return;
         }
-        const [storedMessage] = await queryStore(this.store, roomId, { kind: "message", sourceMsgId: item.msg_id, limit: 1 });
-        let message = this.findSourceMessage(storedMessage === void 0 ? [] : [storedMessage], item);
+        let message = this.findSourceMessage(stored === void 0 ? [] : [stored], item);
         if (!message) {
-          const recipientIdentities = unique(room.seats.filter((recipient) => recipient.state === "active").map((recipient) => recipient.identity).filter((identity) => identity !== seat.identity));
+          const seat = room.seats.find((candidate) => candidate.identity === item.sender_id && candidate.state === "active");
+          const known = room.seats.some((candidate) => candidate.identity === item.sender_id);
+          if (!known || item.reply_to == null && (room.state !== "active" || !seat)) {
+            if (room.state === "active") await this.bounceRemovedSender(roomId, room, packet, item);
+            if (acknowledge) await this.acknowledgeMessage(roomId, packet, item);
+            return;
+          }
+          const disposition = await this.freshScopeUnlocked(room, item);
+          if (!disposition) {
+            if (acknowledge) await this.acknowledgeMessage(roomId, packet, item);
+            return;
+          }
+          if (!seat) throw new Error("authorized message sender has no active seat");
           const appended = await this.store.append(roomId, {
             version: 1,
             kind: "message",
@@ -14359,7 +14850,8 @@ var init_intake = __esm({
             ...room.anonymous && seat.alias !== void 0 ? { author_alias: { participant_id: seat.participant_id, alias: seat.alias } } : {},
             category: "chat",
             text: item.text,
-            recipient_identities: recipientIdentities,
+            recipient_identities: disposition.recipients,
+            ...disposition.scope === void 0 ? {} : { scope: disposition.scope },
             source_msg_id: item.msg_id,
             ...item.wire_id === "" ? {} : { source_wire_id: item.wire_id },
             ...item.reply_to == null ? {} : { source_reply_to: item.reply_to }
@@ -14370,6 +14862,78 @@ var init_intake = __esm({
         await this.completeMessageIntents(roomId, message);
         if (acknowledge) await this.acknowledgeMessage(roomId, packet, item);
       }
+      async freshScopeUnlocked(room, item) {
+        try {
+          const rows = item.reply_to == null ? [] : await readReplyRows(this.store, room.room_id);
+          const beforeSeq = item.reply_to == null ? 1 : await this.nextRecordSeq(room.room_id);
+          return resolveIntakeScope(room, rows, item, beforeSeq);
+        } catch (error) {
+          if (!(error instanceof ThreadFailure)) throw error;
+          await this.recordRejectionUnlocked(room, item, error);
+          return void 0;
+        }
+      }
+      async nextRecordSeq(roomId) {
+        if (this.store.query) {
+          const [last] = await this.store.query(roomId, { descending: true, limit: 1 });
+          if (last && (last.room_id !== roomId || !Number.isSafeInteger(last.seq) || last.seq < 1)) {
+            throw new Error("intake archive tail is invalid");
+          }
+          return (last?.seq ?? 0) + 1;
+        }
+        let after = 0;
+        for (; ; ) {
+          const page = await this.store.read(roomId, { after, limit: JOURNAL_WORK_BATCH_SIZE });
+          if (page.length === 0) return after + 1;
+          for (const row of page) {
+            if (row.room_id !== roomId || !Number.isSafeInteger(row.seq) || row.seq <= after) {
+              throw new Error("intake archive cursor did not advance");
+            }
+            after = row.seq;
+          }
+        }
+      }
+      isRejectedReplay(record, item) {
+        if (record?.kind !== "intake_rejection") return false;
+        const file = "file_id" in item;
+        if (record.source_kind !== (file ? "file" : "message") || (file ? record.source_file_id !== item.file_id : record.source_msg_id !== item.msg_id) || record.source_wire_id !== item.wire_id || record.sender_identity !== item.sender_id || record.fingerprint !== inputFingerprint(item)) {
+          throw new Error("inbox source does not match its durable intake rejection");
+        }
+        return true;
+      }
+      async recordRejectionUnlocked(room, item, error) {
+        const seat = room.seats.find((seat2) => seat2.identity === item.sender_id && seat2.state === "active") ?? room.seats.find((seat2) => seat2.identity === item.sender_id);
+        if (!seat || typeof item.wire_id !== "string" || item.wire_id.length === 0) {
+          throw new Error("intake rejection requires a known seat and source wire");
+        }
+        if (error.code !== "reply_target_unavailable" && error.code !== "thread_files_unsupported") throw error;
+        await this.store.append(room.room_id, {
+          version: 1,
+          kind: "intake_rejection",
+          room_id: room.room_id,
+          at: this.now(),
+          ..."file_id" in item ? { source_kind: "file", source_file_id: item.file_id } : { source_kind: "message", source_msg_id: item.msg_id },
+          source_wire_id: item.wire_id,
+          sender_identity: item.sender_id,
+          sender_participant_id: seat.participant_id,
+          fingerprint: inputFingerprint(item),
+          error: error.code,
+          notification_attempt_claimed: true
+        });
+        try {
+          await sendRoomBody(this.packet(room.room_id), item.sender_id, {
+            version: 1,
+            kind: "room_msg",
+            room_id: room.room_id,
+            room_name: room.room_name,
+            message_id: this.nextMessageId(),
+            at: this.now(),
+            text: error.code,
+            author: { identity: room.identity_cid, display_name: room.identity_name, role: ROOM_ROLE }
+          });
+        } catch {
+        }
+      }
       acknowledgeMessage(roomId, packet, expected) {
         return packet.acknowledgeMessage(
           expected,
@@ -14493,26 +15057,44 @@ var init_intake = __esm({
             const [message] = intent.message_id === void 0 ? [] : await queryStore(this.store, roomId, { kind: "message", messageId: intent.message_id, limit: 1 });
             const [file] = intent.file_id === void 0 ? [] : await queryStore(this.store, roomId, { kind: "file", fileId: intent.file_id, limit: 1 });
             if (message === void 0 === (file === void 0)) continue;
-            const recipients = message?.recipient_identities ?? file.recipient_identities;
-            if (!recipients.includes(intent.recipient_identity)) continue;
-            if (!activeCids.has(intent.recipient_identity) && removedCids.has(intent.recipient_identity)) {
-              const skipped = await this.store.append(roomId, {
-                version: 1,
-                kind: "relay_result",
-                room_id: roomId,
-                at: this.now(),
-                intent_record_id: intent.record_id,
-                ...intent.message_id === void 0 ? {} : { message_id: intent.message_id },
-                ...intent.file_id === void 0 ? {} : { file_id: intent.file_id },
-                recipient_identity: intent.recipient_identity,
-                status: "skipped_removed"
-              });
-              if (skipped.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
-              continue;
-            }
             const source = message ?? file;
-            const replyRows = source.source_reply_to === void 0 ? [] : await readReplyRows(this.store, roomId);
+            const replyRows = source.source_reply_to === void 0 && message?.scope === void 0 && message?.thread_root === void 0 ? [] : await readReplyRows(this.store, roomId);
             const decision = selectReply(replyRows, roomId, source, intent.recipient_identity);
+            let publicThread = {};
+            let scopedAuthor;
+            try {
+              const association = classifyThreadAssociation(room, replyRows, source);
+              if (association.state === "scoped") {
+                const { root, scope } = association;
+                if (!message || !message.recipient_identities.includes(intent.recipient_identity) || message.seq >= intent.seq || !root.thread_root.members.some((member) => member.identity === intent.recipient_identity)) {
+                  throw new ThreadFailure("reply_target_unavailable");
+                }
+                if (!threadRelayEligible(room, root.thread_root, intent.recipient_identity)) {
+                  await this.skipRelay(roomId, intent, "skipped_removed");
+                  continue;
+                }
+                const metadata = publicThreadMetadata({ ...root, thread_root: root.thread_root }, room);
+                scopedAuthor = publicThreadAuthor(message, root.thread_root, room);
+                if (message.message_id === root.message_id) {
+                  publicThread = { thread: { schema_version: 1, thread_id: root.message_id }, thread_root: metadata };
+                } else {
+                  if (decision.state !== "linked" || decision.parentKey !== scope.parent_key) {
+                    throw new ThreadFailure("reply_target_unavailable");
+                  }
+                  publicThread = { thread: { schema_version: 1, thread_id: root.message_id } };
+                }
+              } else {
+                if (!source.recipient_identities.includes(intent.recipient_identity)) continue;
+                if (!activeCids.has(intent.recipient_identity) && removedCids.has(intent.recipient_identity)) {
+                  await this.skipRelay(roomId, intent, "skipped_removed");
+                  continue;
+                }
+              }
+            } catch (error) {
+              if (!(error instanceof ThreadFailure)) throw error;
+              await this.skipRelay(roomId, intent, "skipped_reply_unavailable");
+              continue;
+            }
             const replyTo = decision.replyTo;
             if (file !== void 0) {
               const uploader = file.author_alias?.alias ?? file.author.display_name;
@@ -14573,11 +15155,12 @@ var init_intake = __esm({
               room_name: room.room_name,
               message_id: message.message_id,
               // An anonymous author leaves the archive only in alias form.
-              author: message.author_alias === void 0 ? message.author : {
+              author: scopedAuthor ?? (message.author_alias === void 0 ? message.author : {
                 identity: message.author_alias.participant_id,
                 display_name: message.author_alias.alias,
                 role: message.author.role
-              },
+              }),
+              ...publicThread,
               text: message.text,
               at: message.at,
               ...message.briefing_role === void 0 ? {} : { briefing_role: message.briefing_role },
@@ -14600,6 +15183,20 @@ var init_intake = __esm({
           }
         }
       }
+      async skipRelay(roomId, intent, status) {
+        const result = await this.store.append(roomId, {
+          version: 1,
+          kind: "relay_result",
+          room_id: roomId,
+          at: this.now(),
+          intent_record_id: intent.record_id,
+          ...intent.message_id === void 0 ? {} : { message_id: intent.message_id },
+          ...intent.file_id === void 0 ? {} : { file_id: intent.file_id },
+          recipient_identity: intent.recipient_identity,
+          status
+        });
+        if (result.kind !== "relay_result") throw new Error("storage returned the wrong relay result kind");
+      }
       findSourceMessage(records, item) {
         const message = records.find((record) => record.kind === "message" && record.source_msg_id === item.msg_id);
         if (!message) return void 0;
@@ -14793,13 +15390,13 @@ var init_command_routes = __esm({
     }).strict();
     RuntimeCommandGrantParams = external_exports.object({
       room_id: external_exports.string(),
-      caller_cid: ContainerIdSchema,
-      command: RuntimeCommandNameSchema
+      caller_cid: ContainerIdSchema2,
+      command: RuntimeCommandGrantPatternSchema
     }).strict();
     RuntimeRoleCommandGrantParams = external_exports.object({
       room_id: external_exports.string(),
       role: external_exports.string(),
-      commands: external_exports.array(RuntimeCommandNameSchema)
+      commands: external_exports.array(RuntimeCommandGrantPatternSchema)
     }).strict();
     ParticipantRemoveParams = external_exports.object({
       room_id: external_exports.string(),
@@ -14815,9 +15412,132 @@ var init_command_routes = __esm({
   }
 });
 
+// src/thread-history.ts
+function publicHistoryMessage(record, author = record.author) {
+  return {
+    version: 1,
+    room_id: record.room_id,
+    seq: record.seq,
+    record_id: record.record_id,
+    at: record.at,
+    kind: "message",
+    message_id: record.message_id,
+    author: { identity: author.identity, display_name: author.display_name, role: author.role },
+    category: record.category,
+    text: record.text,
+    ...record.category === "role_briefing" ? { briefing_role: record.briefing_role } : {},
+    ...(record.category === "briefing" || record.category === "role_briefing") && record.briefing_version !== void 0 ? { briefing_version: record.briefing_version } : {},
+    ...record.category === "membership" && record.membership ? { membership: {
+      action: record.membership.action,
+      epoch: record.membership.epoch,
+      ...record.membership.alias === void 0 ? {} : { alias: record.membership.alias },
+      ...record.membership.role === void 0 ? {} : { role: record.membership.role }
+    } } : {}
+  };
+}
+function projectParticipantHistory(room, records, viewerCid, page) {
+  const viewer = room.seats.find((seat) => seat.state === "active" && seat.identity === viewerCid);
+  if (!viewer || room.state !== "active") throw new ThreadFailure("unauthorized");
+  const { after = 0, limit = 200 } = ParticipantHistoryPageSchema.parse(page);
+  const replyRows = records.filter((row) => ["message", "file", "relay_intent", "relay_result"].includes(row.kind));
+  const output = [];
+  let ordinal = 0, bytes = 2;
+  for (const record of records) {
+    if (record.kind !== "message" || record.room_id !== room.room_id) continue;
+    let author = record.author;
+    let thread;
+    let thread_root;
+    try {
+      const association = classifyThreadAssociation(room, replyRows, record);
+      if (association.state === "scoped") {
+        const { root } = association;
+        if (!activeThreadSeat(room, root.thread_root, viewerCid)) continue;
+        const metadata = publicThreadMetadata(root, room);
+        author = publicThreadAuthor(record, root.thread_root, room);
+        if (record.message_id === root.message_id) thread_root = metadata;
+        thread = { schema_version: 1, thread_id: root.message_id };
+      } else if (record.author_alias !== void 0) {
+        const alias = AuthorAliasSchema.parse(record.author_alias);
+        author = { identity: alias.participant_id, display_name: alias.alias, role: record.author.role };
+      }
+    } catch (error) {
+      if (error instanceof ThreadFailure || error instanceof external_exports.ZodError) continue;
+      throw error;
+    }
+    ordinal += 1;
+    if (ordinal <= after) continue;
+    const projected = {
+      ...publicHistoryMessage(record, author),
+      seq: ordinal,
+      record_id: `${room.room_id}:participant:${viewer.participant_id}:${ordinal}`,
+      ...thread ? { thread } : {},
+      ...thread_root ? { thread_root } : {}
+    };
+    const size = Buffer.byteLength(JSON.stringify(projected), "utf8") + (output.length ? 1 : 0);
+    if (bytes + size > MAX_HISTORY_PAGE_BYTES) {
+      if (output.length === 0) throw new RangeError("one participant history record exceeds the page byte contract");
+      break;
+    }
+    output.push(projected);
+    bytes += size;
+    if (output.length >= limit) break;
+  }
+  return output;
+}
+var PublicThreadSchema, PublicThreadMetadataSchema, PublicMessageShape, ParticipantHistoryRecordSchema, ParticipantHistoryPageSchema;
+var init_thread_history = __esm({
+  "src/thread-history.ts"() {
+    "use strict";
+    init_zod();
+    init_contracts();
+    init_thread_contracts();
+    init_threads();
+    PublicThreadSchema = external_exports.object({ schema_version: external_exports.literal(1), thread_id: LowerCrockfordUlidSchema }).strict();
+    PublicThreadMetadataSchema = PublicThreadSchema.extend({
+      topic: external_exports.string(),
+      creator: AuthorSnapshotSchema,
+      participant_ids: external_exports.array(LowerCrockfordUlidSchema),
+      created_at: Rfc3339Schema
+    }).strict();
+    PublicMessageShape = {
+      version: external_exports.literal(1),
+      room_id: LowerCrockfordUlidSchema,
+      seq: external_exports.number().int().positive().safe(),
+      record_id: external_exports.string(),
+      at: Rfc3339Schema,
+      kind: external_exports.literal("message"),
+      message_id: LowerCrockfordUlidSchema,
+      author: AuthorSnapshotSchema,
+      category: external_exports.enum(["briefing", "role_briefing", "chat", "membership"]),
+      briefing_role: RoleSchema.optional(),
+      briefing_version: external_exports.number().int().positive().safe().optional(),
+      membership: MembershipNoticeSchema.optional(),
+      text: MessageTextSchema
+    };
+    ParticipantHistoryRecordSchema = external_exports.object({
+      ...PublicMessageShape,
+      thread: PublicThreadSchema.optional(),
+      thread_root: PublicThreadMetadataSchema.optional()
+    }).strict().superRefine((row, ctx) => {
+      const prefix = `${row.room_id}:participant:`;
+      const participantId = row.record_id.slice(prefix.length, -(String(row.seq).length + 1));
+      if (!row.record_id.startsWith(prefix) || !LowerCrockfordUlidSchema.safeParse(participantId).success || row.record_id !== `${prefix}${participantId}:${row.seq}`) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["record_id"], message: "must identify the viewer and visible ordinal" });
+      }
+      if (row.thread_root && (!row.thread || row.thread.thread_id !== row.thread_root.thread_id || row.message_id !== row.thread.thread_id)) {
+        ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: ["thread_root"], message: "must identify this thread root" });
+      }
+    });
+    ParticipantHistoryPageSchema = external_exports.object({
+      after: external_exports.number().int().nonnegative().safe().optional(),
+      limit: external_exports.number().int().positive().safe().optional()
+    }).strict();
+  }
+});
+
 // src/service.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 function byteBoundedHistoryPage(records) {
   const page = [];
   let bytes = 2;
@@ -14874,7 +15594,7 @@ function uniqueIdentities(identities) {
 function currentContactIdentities(packet) {
   return new Set(packet.listContacts().map((contact) => contact.container_id));
 }
-var CreateInviteInputSchema, HistoryOptionsSchema, JOURNAL_WORK_BATCH_SIZE2, DeleteRoomInputSchema, RemoveParticipantInputSchema, RoomServiceError, RoomService;
+var MAX_ROOM_MESSAGE_BYTES, CreateInviteInputSchema, HistoryOptionsSchema, JOURNAL_WORK_BATCH_SIZE2, DeleteRoomInputSchema, RemoveParticipantInputSchema, RoomServiceError, RoomService;
 var init_service = __esm({
   "src/service.ts"() {
     "use strict";
@@ -14886,6 +15606,11 @@ var init_service = __esm({
     init_consumer_commands();
     init_command_names();
     init_ulid();
+    init_reply_threading();
+    init_thread_contracts();
+    init_thread_history();
+    init_threads();
+    MAX_ROOM_MESSAGE_BYTES = 262144;
     CreateInviteInputSchema = external_exports.object({
       mode: InviteModeSchema,
       role: RoleSchema.optional(),
@@ -15105,11 +15830,106 @@ var init_service = __esm({
             handler: (input, context) => this.invokeConsumerCommand(roomId, definition.name, input, context)
           })),
           sharedCommand: (name, input, context) => this.lock(roomId, () => this.sharedCommandUnlocked(roomId, name, input, context)),
+          startThread: async (input, context) => {
+            const result = await this.lock(roomId, () => this.startThreadCommandUnlocked(roomId, input, context));
+            if (result.ok === true) await this.intake.resumePending(roomId);
+            return result;
+          },
           listMembers: (input, context) => this.lock(roomId, () => this.listMembersCommandUnlocked(roomId, input, context)),
           removeMember: (input, context) => this.lock(roomId, () => this.removeMemberCommandUnlocked(roomId, input, context))
         });
         this.publishedConsumerRevisions.set(roomId, registered.consumer_commands_revision ?? 0);
       }
+      /** Called by the registered adapter while it owns the room mutex. */
+      async startThreadCommandUnlocked(roomId, input, context) {
+        const room = await this.store.load(roomId);
+        if (room.state !== "active" || room.lifecycle_request?.state === "pending") {
+          return { ok: false, error: "room_unavailable" };
+        }
+        const creator = room.seats.find((seat) => seat.state === "active" && seat.identity === context.sender_cid);
+        if (creator === void 0 || !this.hasRuntimeCommandGrant(room, context.sender_cid, "start_thread")) {
+          return { ok: false, error: "unauthorized" };
+        }
+        const parsed = StartThreadInputSchema.safeParse(input);
+        if (!parsed.success) return { ok: false, error: "invalid_request" };
+        const request = parsed.data;
+        const rows = await readReplyRows(this.store, roomId);
+        const prior = rows.filter((row) => row.kind === "message" && row.thread_root !== void 0 && row.author.identity === context.sender_cid && row.thread_root.idempotency_key === request.idempotency_key);
+        if (prior.length > 1) throw new Error("duplicate thread roots for creator idempotency key");
+        if (prior.length === 1) {
+          const root2 = prior[0];
+          if (root2.thread_root.creator_participant_id !== creator.participant_id) {
+            return { ok: false, error: "unauthorized" };
+          }
+          if (root2.thread_root.fingerprint !== threadFingerprint(request)) {
+            return { ok: false, error: "idempotency_conflict" };
+          }
+          return { ok: true, thread_id: root2.message_id, status: "accepted" };
+        }
+        let members;
+        try {
+          members = selectThreadMembers(room, context.sender_cid, request);
+        } catch (error) {
+          if (error instanceof ThreadFailure) return { ok: false, error: error.code };
+          throw error;
+        }
+        const threadId = LowerCrockfordUlidSchema.parse(this.nextMessageId());
+        const at = this.now();
+        const threadRoot = {
+          schema_version: 1,
+          thread_id: threadId,
+          topic: request.topic,
+          creator_participant_id: creator.participant_id,
+          members,
+          idempotency_key: request.idempotency_key,
+          fingerprint: threadFingerprint(request)
+        };
+        if (room.anonymous && creator.alias === void 0) {
+          throw new Error("anonymous thread creator is missing its room alias");
+        }
+        const root = {
+          version: 1,
+          kind: "message",
+          room_id: roomId,
+          at,
+          message_id: threadId,
+          author: {
+            identity: creator.identity,
+            display_name: creator.display_name,
+            role: creator.role
+          },
+          ...room.anonymous ? {
+            author_alias: { participant_id: creator.participant_id, alias: creator.alias }
+          } : {},
+          category: "chat",
+          text: `Thread: ${request.topic}`,
+          recipient_identities: members.map((member) => member.identity),
+          scope: { thread_id: threadId },
+          thread_root: threadRoot
+        };
+        const projected = {
+          version: 1,
+          kind: "room_msg",
+          room_id: roomId,
+          room_name: room.room_name,
+          message_id: threadId,
+          author: room.anonymous ? {
+            identity: creator.participant_id,
+            display_name: creator.alias,
+            role: creator.role
+          } : root.author,
+          text: root.text,
+          at,
+          thread: { schema_version: 1, thread_id: threadId },
+          thread_root: publicThreadMetadata(root, room)
+        };
+        if (Buffer.byteLength(JSON.stringify(projected), "utf8") > MAX_ROOM_MESSAGE_BYTES) {
+          return { ok: false, error: "invalid_request" };
+        }
+        const appended = await this.store.append(roomId, root);
+        if (appended.kind !== "message") throw new Error("storage returned the wrong thread root kind");
+        return { ok: true, thread_id: appended.message_id, status: "accepted" };
+      }
       /** The SDK supplies authenticated context; arguments never select another room. */
       async sharedCommandUnlocked(roomId, name, input, context) {
         if (!SHARED_ROOM_COMMANDS.includes(name) || input === null || typeof input !== "object" || Array.isArray(input) || Object.hasOwn(input, "room_id")) return { ok: false, error: "invalid_request" };
@@ -15150,8 +15970,30 @@ var init_service = __esm({
         try {
           return await this.commandScope.run(scope, async () => {
             try {
+              if (name === "room.history") {
+                const request = ParticipantHistoryPageSchema.extend({ view: external_exports.literal("participant").optional() }).safeParse(input);
+                if (!request.success) return { ok: false, error: "invalid_request" };
+                const { view: _view, ...page } = request.data;
+                return { ok: true, result: JSON.parse(JSON.stringify(await this.participantHistory(roomId, context.sender_cid, page))) };
+              }
+              if (name === "room.show" || name === "room.participants") {
+                external_exports.object({}).strict().parse(input);
+                const result2 = name === "room.show" ? {
+                  room_id: room.room_id,
+                  room_name: room.room_name,
+                  state: room.state,
+                  mission: { goal: room.mission.goal, briefing: room.mission.briefing, briefing_version: room.mission.briefing_version },
+                  anonymous: room.anonymous,
+                  quiet_membership: room.quiet_membership,
+                  membership_epoch: room.membership_epoch
+                } : room.seats.map(({ participant_id, role, state }) => ({ participant_id, role, state }));
+                return { ok: true, result: JSON.parse(JSON.stringify(result2)) };
+              }
               const routes = name === "room.accept" ? createPrivateServiceRoutes(this) : createServiceRoutes(this);
               const result = await routes[name].run({ ...input, room_id: roomId });
+              if (name === "room.message" || name === "room.say") {
+                return { ok: true, result: { message_id: result.message_id, accepted: true } };
+              }
               return { ok: true, result: JSON.parse(JSON.stringify(result)) };
             } catch (error) {
               return { ok: false, error: classifyServiceError(error) };
@@ -15322,7 +16164,7 @@ var init_service = __esm({
         } catch {
           throw new RoomServiceError("external invite is invalid or exceeds the 48 KiB decoded limit");
         }
-        const digest = createHash4("sha256").update(decoded).digest("hex");
+        const digest = createHash5("sha256").update(decoded).digest("hex");
         const receipt = await this.lock(id, async () => {
           const room = await this.store.load(id);
           this.assertMutable(room, "accept an external invite for");
@@ -15335,7 +16177,7 @@ var init_service = __esm({
           } catch {
             throw new RoomServiceError("external invite was rejected");
           }
-          const cid = ContainerIdSchema.parse(added.container_id);
+          const cid = ContainerIdSchema2.parse(added.container_id);
           if (request.expected_cid !== void 0 && cid !== request.expected_cid) {
             throw new RoomServiceError("external invite inviter CID did not match --expected-cid");
           }
@@ -15439,9 +16281,9 @@ var init_service = __esm({
         return seat;
       }
       hasRuntimeCommandGrant(room, callerCid, command) {
-        if (room.command_grants.some((grant) => grant.caller_cid === callerCid && grant.command === command)) return true;
+        if (room.command_grants.some((grant) => grant.caller_cid === callerCid && commandGrantMatches(grant.command, command))) return true;
         const caller = room.seats.find((seat) => seat.state === "active" && seat.identity === callerCid);
-        return caller !== void 0 && room.role_command_grants.some((grant) => grant.role === caller.role && grant.commands.includes(command));
+        return caller !== void 0 && room.role_command_grants.some((grant) => grant.role === caller.role && grant.commands.some((pattern) => commandGrantMatches(pattern, command)));
       }
       async beginRemovalUnlocked(room, seat, notify) {
         if (seat.state === "pending" || isCancelledExternalSeat(seat)) {
@@ -15749,7 +16591,7 @@ var init_service = __esm({
       }
       /** List the operator-managed runtime-command grants for one room. */
       assertRegisteredConsumerName(room, name) {
-        if (name.startsWith("consumer.") && !(room.consumer_commands ?? []).some((definition) => definition.name === name)) {
+        if (name.startsWith("consumer.") && !name.endsWith(".*") && !(room.consumer_commands ?? []).some((definition) => definition.name === name)) {
           throw new RoomServiceError("consumer command is not registered");
         }
       }
@@ -15893,7 +16735,7 @@ var init_service = __esm({
           return saved.role_command_grants.map((grant) => ({ role: grant.role, commands: [...grant.commands] }));
         });
       }
-      /** Grant one exact command to one active authenticated room identity. Idempotent. */
+      /** Grant one command selector to one active authenticated room identity. Idempotent. */
       async grantRuntimeCommand(roomId, input) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
         const request = RuntimeCommandGrantInputSchema.parse(input);
@@ -15912,7 +16754,7 @@ var init_service = __esm({
           return saved.command_grants.map((grant) => ({ ...grant }));
         });
       }
-      /** Revoke one exact command grant. Absence is already the requested state. */
+      /** Remove only the exact stored selector; overlapping grants remain effective. */
       async revokeRuntimeCommand(roomId, input) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
         const request = RuntimeCommandGrantInputSchema.parse(input);
@@ -15927,29 +16769,38 @@ var init_service = __esm({
           return saved.command_grants.map((grant) => ({ ...grant }));
         });
       }
+      /** Internal authenticated API; numeric cursors count only this viewer's visible messages. */
+      async participantHistory(roomId, viewerCid, page = {}) {
+        const id = LowerCrockfordUlidSchema.parse(roomId);
+        const request = ParticipantHistoryPageSchema.parse(page);
+        return this.lock(id, async () => {
+          const room = await this.store.load(id);
+          if (room.state !== "active" || !room.seats.some((seat) => seat.state === "active" && seat.identity === viewerCid)) {
+            throw new ThreadFailure("unauthorized");
+          }
+          const records = [];
+          let after = 0;
+          for (; ; ) {
+            const batch = await this.store.read(id, { after, limit: JOURNAL_WORK_BATCH_SIZE2 });
+            if (batch.length === 0) break;
+            const last = batch[batch.length - 1];
+            if (last.seq <= after || batch.some((row) => row.room_id !== id)) throw new Error("invalid participant history archive page");
+            records.push(...batch);
+            after = last.seq;
+          }
+          return projectParticipantHistory(room, records, viewerCid, request);
+        });
+      }
       async history(roomId, options = {}) {
         const id = LowerCrockfordUlidSchema.parse(roomId);
         const { view, ...page } = HistoryOptionsSchema.parse(options);
         const records = view === "participant" ? await queryStore2(this.store, id, { kind: "message", after: page.after, limit: page.limit }) : await this.store.read(id, page);
         if (view !== "participant") return byteBoundedHistoryPage(records);
-        const projected = records.filter((record) => record.kind === "message").map((record) => {
-          const {
-            author_alias,
-            recipient_identities: _recipients,
-            source_msg_id: _sourceMsg,
-            source_wire_id: _sourceWire,
-            source_reply_to: _sourceReplyTo,
-            ...rest
-          } = record;
-          return {
-            ...rest,
-            author: author_alias === void 0 ? record.author : {
-              identity: author_alias.participant_id,
-              display_name: author_alias.alias,
-              role: record.author.role
-            }
-          };
-        });
+        const projected = records.filter((record) => record.kind === "message").map((record) => publicHistoryMessage(record, record.author_alias === void 0 ? record.author : {
+          identity: record.author_alias.participant_id,
+          display_name: record.author_alias.alias,
+          role: record.author.role
+        }));
         return byteBoundedHistoryPage(projected.slice(0, page.limit ?? Number.MAX_SAFE_INTEGER));
       }
       /**
@@ -16509,7 +17360,7 @@ import * as nodeFs2 from "node:fs";
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
 import { basename, dirname as dirname3, join as join4 } from "node:path";
 import Database from "better-sqlite3";
-var DIRECTORY_MODE2, FILE_MODE2, NO_FOLLOW2, SQLITE_SCHEMA_VERSION, DEFAULT_WORK_BATCH_SIZE, utf8Decoder, CoworkStorageError, RoomQueue, CoworkStore;
+var DIRECTORY_MODE2, FILE_MODE2, NO_FOLLOW2, SQLITE_SCHEMA_VERSION, DEFAULT_WORK_BATCH_SIZE, utf8Decoder, SQLITE_V2_EXTENSION_DDL, CoworkStorageError, RoomQueue, CoworkStore;
 var init_storage = __esm({
   "src/storage.ts"() {
     "use strict";
@@ -16518,9 +17369,24 @@ var init_storage = __esm({
     DIRECTORY_MODE2 = 448;
     FILE_MODE2 = 384;
     NO_FOLLOW2 = nodeFs2.constants.O_NOFOLLOW ?? 0;
-    SQLITE_SCHEMA_VERSION = 1;
+    SQLITE_SCHEMA_VERSION = 2;
     DEFAULT_WORK_BATCH_SIZE = 64;
     utf8Decoder = new TextDecoder("utf-8", { fatal: true });
+    SQLITE_V2_EXTENSION_DDL = `
+  CREATE UNIQUE INDEX IF NOT EXISTS records_thread_creation_key
+  ON records(json_extract(payload_json,'$.author.identity'),
+             json_extract(payload_json,'$.thread_root.idempotency_key'))
+  WHERE kind='message' AND json_type(payload_json,'$.thread_root')='object';
+  CREATE INDEX IF NOT EXISTS records_thread_id
+  ON records(json_extract(payload_json,'$.scope.thread_id'))
+  WHERE kind='message' AND json_type(payload_json,'$.scope')='object';
+  DROP INDEX IF EXISTS records_source_message;
+  DROP INDEX IF EXISTS records_source_file;
+  CREATE UNIQUE INDEX records_source_message ON records(source_msg_id)
+  WHERE source_msg_id IS NOT NULL;
+  CREATE UNIQUE INDEX records_source_file ON records(source_file_id)
+  WHERE source_file_id IS NOT NULL;
+`;
     CoworkStorageError = class extends Error {
       constructor(message, options) {
         super(message, options);
@@ -16924,55 +17790,65 @@ var init_storage = __esm({
         try {
           this.secureSqliteFiles(path);
           db = new Database(path, { fileMustExist: !create });
+          const activeDb = db;
           if (guardFd !== void 0) this.validateOpenPath(guardFd, path, "room archive database", "file", true);
           this.fs.chmodSync(path, FILE_MODE2);
-          db.pragma("journal_mode = WAL");
-          db.pragma("synchronous = FULL");
-          db.pragma("foreign_keys = ON");
-          db.pragma("busy_timeout = 5000");
+          const existingVersion = create ? void 0 : activeDb.pragma("user_version", { simple: true });
+          if (existingVersion !== void 0 && existingVersion !== 1 && existingVersion !== SQLITE_SCHEMA_VERSION) {
+            throw new CoworkStorageError(`unsupported room archive schema version ${existingVersion}`);
+          }
+          activeDb.pragma("journal_mode = WAL");
+          activeDb.pragma("synchronous = FULL");
+          activeDb.pragma("foreign_keys = ON");
+          activeDb.pragma("busy_timeout = 5000");
           if (create) {
-            db.exec(`CREATE TABLE records (
-        seq INTEGER PRIMARY KEY, record_id TEXT NOT NULL UNIQUE, kind TEXT NOT NULL, at TEXT NOT NULL,
-        payload_json TEXT NOT NULL, blob_path TEXT, message_id TEXT, file_id TEXT, intent_record_id TEXT,
-        recipient_identity TEXT, source_msg_id INTEGER, source_file_id INTEGER, category TEXT,
-        briefing_role TEXT, briefing_version INTEGER, membership_epoch INTEGER
-      );
-      CREATE TABLE record_recipients (
-        record_seq INTEGER NOT NULL REFERENCES records(seq) ON DELETE CASCADE,
-        recipient_identity TEXT NOT NULL, category TEXT, briefing_role TEXT,
-        briefing_version INTEGER, PRIMARY KEY(record_seq, recipient_identity)
-      );
-      CREATE TABLE relay_intent_work (
-        record_seq INTEGER NOT NULL REFERENCES records(seq) ON DELETE CASCADE,
-        recipient_identity TEXT NOT NULL, PRIMARY KEY(record_seq, recipient_identity)
-      );
-      CREATE INDEX relay_work_source ON relay_intent_work(record_seq, recipient_identity);
-      CREATE INDEX records_kind_seq ON records(kind, seq);
-      CREATE INDEX records_message ON records(message_id, kind, seq);
-      CREATE INDEX records_file ON records(file_id, kind, seq);
-      CREATE INDEX records_intent_result ON records(intent_record_id, kind);
-      CREATE INDEX records_relay_recipient ON records(kind, recipient_identity, seq);
-      CREATE UNIQUE INDEX records_source_message ON records(source_msg_id) WHERE kind='message' AND source_msg_id IS NOT NULL;
-      CREATE UNIQUE INDEX records_source_file ON records(source_file_id) WHERE kind='file' AND source_file_id IS NOT NULL;
-      CREATE INDEX records_briefing ON records(category, briefing_role, briefing_version, seq);
-      CREATE INDEX records_membership_epoch ON records(category, membership_epoch);
-      CREATE INDEX recipients_identity ON record_recipients(recipient_identity, record_seq);
-      CREATE INDEX recipients_briefing_delivery ON record_recipients
-        (recipient_identity, category, briefing_role, briefing_version, record_seq);`);
-            db.pragma(`user_version = ${SQLITE_SCHEMA_VERSION}`);
+            activeDb.transaction(() => {
+              activeDb.exec(`CREATE TABLE records (
+          seq INTEGER PRIMARY KEY, record_id TEXT NOT NULL UNIQUE, kind TEXT NOT NULL, at TEXT NOT NULL,
+          payload_json TEXT NOT NULL, blob_path TEXT, message_id TEXT, file_id TEXT, intent_record_id TEXT,
+          recipient_identity TEXT, source_msg_id INTEGER, source_file_id INTEGER, category TEXT,
+          briefing_role TEXT, briefing_version INTEGER, membership_epoch INTEGER
+        );
+        CREATE TABLE record_recipients (
+          record_seq INTEGER NOT NULL REFERENCES records(seq) ON DELETE CASCADE,
+          recipient_identity TEXT NOT NULL, category TEXT, briefing_role TEXT,
+          briefing_version INTEGER, PRIMARY KEY(record_seq, recipient_identity)
+        );
+        CREATE TABLE relay_intent_work (
+          record_seq INTEGER NOT NULL REFERENCES records(seq) ON DELETE CASCADE,
+          recipient_identity TEXT NOT NULL, PRIMARY KEY(record_seq, recipient_identity)
+        );
+        CREATE INDEX relay_work_source ON relay_intent_work(record_seq, recipient_identity);
+        CREATE INDEX records_kind_seq ON records(kind, seq);
+        CREATE INDEX records_message ON records(message_id, kind, seq);
+        CREATE INDEX records_file ON records(file_id, kind, seq);
+        CREATE INDEX records_intent_result ON records(intent_record_id, kind);
+        CREATE INDEX records_relay_recipient ON records(kind, recipient_identity, seq);
+        CREATE UNIQUE INDEX records_source_message ON records(source_msg_id) WHERE kind='message' AND source_msg_id IS NOT NULL;
+        CREATE UNIQUE INDEX records_source_file ON records(source_file_id) WHERE kind='file' AND source_file_id IS NOT NULL;
+        CREATE INDEX records_briefing ON records(category, briefing_role, briefing_version, seq);
+        CREATE INDEX records_membership_epoch ON records(category, membership_epoch);
+        CREATE INDEX recipients_identity ON record_recipients(recipient_identity, record_seq);
+        CREATE INDEX recipients_briefing_delivery ON record_recipients
+          (recipient_identity, category, briefing_role, briefing_version, record_seq);`);
+              activeDb.exec(SQLITE_V2_EXTENSION_DDL);
+              activeDb.pragma(`user_version = ${SQLITE_SCHEMA_VERSION}`);
+            }).immediate();
             this.reconciledBlobRooms.add(roomId);
           } else {
-            const version = db.pragma("user_version", { simple: true });
-            if (version !== SQLITE_SCHEMA_VERSION) {
-              throw new CoworkStorageError(`unsupported room archive schema version ${version}`);
+            if (existingVersion === 1) {
+              activeDb.transaction(() => {
+                activeDb.exec(SQLITE_V2_EXTENSION_DDL);
+                activeDb.pragma(`user_version = ${SQLITE_SCHEMA_VERSION}`);
+              }).immediate();
             }
             if (!this.reconciledBlobRooms.has(roomId)) {
-              this.reconcileBlobDirectory(roomId, db);
+              this.reconcileBlobDirectory(roomId, activeDb);
               this.reconciledBlobRooms.add(roomId);
             }
           }
           this.secureSqliteFiles(path);
-          const result = work(db);
+          const result = work(activeDb);
           this.secureSqliteFiles(path);
           return result;
         } catch (error) {