@pmate/chat-sdk 0.12.0-next.57 → 0.12.0-next.59

package/README.md

@@ -254,3 +254,29 @@ permission change in another team does not discard this team's observations.
 Ordinary shutdown waits for accepted local reading writes, while access withdrawal
 rejects late results. Retired asynchronous reading entries reject through promises;
 refresh/subscription teardown remains safe.
+
+
+### Reading storage recovery
+
+Large reading snapshots use a persisted journal. The full plan becomes durable
+before canonical rows change; bounded transactions apply it, and the sync cursor
+commits last. A reader recovers an active plan before returning a snapshot. Failed
+staging leaves the previous snapshot authoritative; failure after activation keeps
+the old cursor until recovery completes. Pending reads retain their operation IDs.
+
+Writes use at most 128 records per transaction, including journal/lease records,
+and conservatively budget one MiB per batch. Message order is stored per row so a
+source no longer needs a growing array of every message ID. Ordinary observations
+continue to update only positions and pending operations. Locks serialize each
+owner across documents; a fenced IndexedDB lease supports contexts without Web Locks.
+
+The private reading database format is now 60. Existing stores are renamed by
+IndexedDB metadata operations, preserving keys and records. Older SDKs cannot
+write through the former namespace and need a page reload to use the new format.
+The message-body cache is separate and unchanged. The public reading state remains
+schema version 1; applications do not select storage formats or recovery steps.
+
+
+Pending voice snapshots contain `voiceAttachment` metadata, without loading audio bytes or creating Blob URLs at startup. For playback or transcription, acquire media through `await chat.getVoiceAttachment(threadId, messageId)`, use the returned `url`, and call `release()` when the consumer stops. The same method returns a remote voice reference for delivered messages. Attachment reads are charged before allocation, and close/revocation releases local URLs. A pending voice remains unread until the player actually starts; acquiring media does not mark it read.
+
+The outbox format upgrade renames the old canonical store without copying binary data in the schema transaction, then atomically separates inline payloads in bounded, resumable transactions. An already-open older application must reload; unsupported senders reject the new format. Original wire/hash, failed status and retry semantics are retained.

package/lib/runtime/chatSession.d.ts

@@ -6,7 +6,7 @@ import { type ReadCountsResult } from "./readCounts.js";
 import type { OnlineReachEvent } from "./reach.js";
 import { type MessageReadersQuery } from "./messageReaders.js";
 import { type MessageClientOptions, type MessageSnapshot } from "./messageClient.js";
-import { DurableChatSender, type SendMessageInput, type DurableSenderOptions } from "./durableSender.js";
+import { DurableChatSender, type SendMessageInput, type DurableSenderOptions, type VoiceAttachmentLease } from "./durableSender.js";
 import { ReadingClient, type ReadingClientOptions } from "./readingClient.js";
 import { ChatClient, type ChatClientOptions, type ChatConnectionState } from "./chatClient.js";
 import { unreadInConversation } from "./readIndex.js";
@@ -124,6 +124,8 @@ export declare class ChatSession<T extends StoredMessage> {
     sendMessage(thread: ChatConversation, input: OutgoingContent): Promise<ChatRuntimeMessage>;
     sendMessage(threadId: string, input: SendMessageInput): Promise<ChatRuntimeMessage>;
     getReaders(threadId: string, messageId: string, page?: Omit<MessageReadersQuery, "threadId" | "messageId">, signal?: AbortSignal): Promise<import("./messageReaders.js").MessageReadersPage>;
+    /** Resolve voice media uniformly; pending local bytes are loaded only on demand. */
+    getVoiceAttachment(threadId: string, messageId: string): Promise<VoiceAttachmentLease>;
     retryMessage(messageId: string): Promise<ChatRuntimeMessage>;
     observeMessages(threadId: string, ids: string[], event: "visible" | "played"): ReturnType<ReadingClient["recordVisible"]>;
     observeMessages(threadId: string | undefined, ids: string[], event: "receipts", clientInstanceId?: string): Promise<void>;

package/lib/runtime/chatSession.js

@@ -380,6 +380,37 @@ export class ChatSession {
         }
         return result;
     }
+    /** Resolve voice media uniformly; pending local bytes are loaded only on demand. */
+    async getVoiceAttachment(threadId, messageId) {
+        this.assertOpen();
+        const item = this.getSnapshot(threadId).timeline.find(item => item.id === messageId);
+        if (!item || item.recalled)
+            throw new Error("VOICE_ATTACHMENT_UNAVAILABLE");
+        const local = await this.sender.acquireVoice(messageId, threadId);
+        try {
+            this.assertOpen();
+        }
+        catch (error) {
+            local?.release();
+            throw error;
+        }
+        const stillVisible = this.getSnapshot(threadId).timeline.find(item => item.id === messageId);
+        if (!stillVisible || stillVisible.recalled) {
+            local?.release();
+            throw new Error("VOICE_ATTACHMENT_UNAVAILABLE");
+        }
+        if (local)
+            return local;
+        const current = this.getSnapshot(threadId).timeline.find(item => item.id === messageId);
+        const body = current?.message?.body;
+        const value = body?.content?.voice?.url;
+        if (!current || current.recalled || typeof value !== "string")
+            throw new Error("VOICE_ATTACHMENT_UNAVAILABLE");
+        const url = new URL(value);
+        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password)
+            throw new Error("INVALID_VOICE_ATTACHMENT_URL");
+        return { url: value, release: () => { } };
+    }
     retryMessage(messageId) { this.assertOpen(); return this.sender.retry(messageId); }
     observeMessages(threadId, ids, event, clientInstanceId) {
         if (this.closed || this.withdrawn) {

package/lib/runtime/durableSender.d.ts

@@ -15,6 +15,14 @@ export type OutgoingMessage = {
         bytes: ArrayBuffer;
         type: string;
     };
+    voiceAttachment?: {
+        size: number;
+        type: string;
+    };
+};
+export type VoiceAttachmentLease = {
+    url: string;
+    release: () => void;
 };
 export type SendMessageInput = {
     to: string;
@@ -40,9 +48,11 @@ export declare class DurableChatSender {
     private options;
     private db;
     private outbox;
+    private attachments;
+    private schemaReady;
+    private attachmentBytes;
+    private attachmentLeases;
     private epochs;
-    private localUrls;
-    private localViews;
     private uploads;
     private reconciliations;
     private firstDelivery;
@@ -104,9 +114,10 @@ export declare class DurableChatSender {
     retry(hash: string): Promise<ChatRuntimeMessage>;
     private transmit;
     private reconcile;
-    private releaseUrl;
-    private releaseUrls;
-    private localView;
+    /** Only explicit playback/transcription acquires a local payload, never snapshots. */
+    acquireVoice(hash: string, threadId: string): Promise<VoiceAttachmentLease | undefined>;
+    private reserveAttachment;
+    private readVoice;
     private prepareVoice;
     private save;
     private queueIO;

package/lib/runtime/durableSender.js

@@ -1,4 +1,5 @@
 import { Dexie } from "dexie";
+import { outboxDatabase, prepareOutboxSchema } from "./outboxSchema.js";
 import { blake3 } from "@noble/hashes/blake3.js";
 import { bytesToHex } from "@noble/hashes/utils.js";
 import { withChatTeam } from "./teamScope.js";
@@ -10,9 +11,11 @@ export class DurableChatSender {
     options;
     db;
     outbox;
+    attachments;
+    schemaReady;
+    attachmentBytes = 0;
+    attachmentLeases = new Map();
     epochs;
-    localUrls = new Map();
-    localViews = new WeakMap();
     uploads = new Set();
     reconciliations = new Set();
     firstDelivery = new Set();
@@ -54,11 +57,11 @@ export class DurableChatSender {
         this.options = options;
         this.scope = messageScopeKey(scope);
         this.identity = { ...scope };
-        this.db = new Dexie(options.name ?? "pmate-chat-outbox", { indexedDB: options.indexedDB ?? globalThis.indexedDB, IDBKeyRange: globalThis.IDBKeyRange });
-        this.db.version(1).stores({ outbox: "[scope+hash],scope,[scope+threadId]" });
-        this.db.version(2).stores({ scopeEpochs: "scope" });
-        this.db.version(3).stores({ outbox: "[scope+hash],scope,[scope+threadId],[scope+pendingState+hash]" });
-        this.outbox = this.db.table("outbox");
+        const factory = options.indexedDB ?? globalThis.indexedDB, name = options.name ?? "pmate-chat-outbox";
+        this.schemaReady = prepareOutboxSchema(factory, name);
+        this.db = outboxDatabase(factory, name);
+        this.outbox = this.db.table("outgoingMessages");
+        this.attachments = this.db.table("outgoingAttachments");
         this.epochs = this.db.table("scopeEpochs");
         this.outbox.hook("creating", (_key, row) => { row.pendingState = row.confirmed ? 0 : 1; });
         this.outbox.hook("updating", (changes, _key, row) => ({ pendingState: (Object.hasOwn(changes, "confirmed") ? changes.confirmed : row.confirmed) ? 0 : 1 }));
@@ -79,16 +82,19 @@ export class DurableChatSender {
     static async readSelected(scope, threadId, ids, version, options = {}) {
         if (ids.length > 100)
             throw new Error("INVALID_OUTBOX_SELECTION");
-        const key = messageScopeKey(scope), db = new Dexie(options.name ?? "pmate-chat-outbox", { indexedDB: options.indexedDB ?? globalThis.indexedDB, IDBKeyRange: globalThis.IDBKeyRange });
-        db.version(1).stores({ outbox: "[scope+hash],scope,[scope+threadId]" });
-        db.version(2).stores({ scopeEpochs: "scope" });
-        db.version(3).stores({ outbox: "[scope+hash],scope,[scope+threadId],[scope+pendingState+hash]" });
+        const key = messageScopeKey(scope), factory = options.indexedDB ?? globalThis.indexedDB, name = options.name ?? "pmate-chat-outbox";
+        await prepareOutboxSchema(factory, name);
+        const db = outboxDatabase(factory, name);
         try {
-            return await db.transaction("r", db.table("outbox"), db.table("scopeEpochs"), async () => {
+            return await db.transaction("r", db.table("outgoingMessages"), db.table("scopeEpochs"), async () => {
                 if (((await db.table("scopeEpochs").get(key))?.version ?? 0) !== version)
                     return [];
-                const rows = await db.table("outbox").bulkGet(ids.map(id => [key, id]));
-                return rows.flatMap(row => row && row.scope === key && row.threadId === threadId && !row.confirmed && (row.accessVersion ?? 0) === version ? [row] : []);
+                const rows = [];
+                for (const id of ids) {
+                    const row = await db.table("outgoingMessages").get([key, id]);
+                    rows.push(row ? splitAttachment(row).record : undefined);
+                }
+                return rows.flatMap(row => row && row.scope === key && row.threadId === threadId && !row.confirmed && (row.accessVersion ?? 0) === version ? [splitAttachment(row).record] : []);
             });
         }
         finally {
@@ -102,8 +108,9 @@ export class DurableChatSender {
         return access;
     }
     async restore() {
+        await this.schemaReady;
         const access = await this.readAccess();
-        const loaded = await this.db.transaction("rw", this.outbox, this.epochs, async () => {
+        const loaded = await this.db.transaction("rw", this.outbox, this.epochs, this.attachments, async () => {
             const current = (await this.epochs.get(this.scope))?.version ?? 0;
             const version = access?.version ?? current;
             if (version < current)
@@ -129,12 +136,12 @@ export class DurableChatSender {
         let after;
         const restored = new Map();
         while (!this.closed && !this.withdrawn) {
-            const batch = await this.db.transaction("rw", this.outbox, this.epochs, async () => {
+            const batch = await this.db.transaction("rw", this.outbox, this.epochs, this.attachments, async () => {
                 if (((await this.epochs.get(this.scope))?.version ?? 0) !== this.version)
                     throw new Error("OUTBOX_SCOPE_CHANGED");
                 const keys = await (loaded.legacy
                     ? this.outbox.where("[scope+hash]").between([this.scope, after ?? Dexie.minKey], [this.scope, Dexie.maxKey], after === undefined, true)
-                    : this.outbox.where("[scope+pendingState+hash]").between([this.scope, 1, after ?? Dexie.minKey], [this.scope, 1, Dexie.maxKey], after === undefined, true)).limit(128).primaryKeys();
+                    : this.outbox.where("[scope+pendingState+hash]").between([this.scope, 1, after ?? Dexie.minKey], [this.scope, 1, Dexie.maxKey], after === undefined, true)).limit(64).primaryKeys();
                 if (!keys.length)
                     return { last: undefined, records: [] };
                 const last = keys.at(-1)[1];
@@ -143,11 +150,36 @@ export class DurableChatSender {
                 const confirmed = loaded.legacy ? await this.outbox.where("[scope+pendingState+hash]").between([this.scope, 0, keys[0][1]], [this.scope, 0, last], true, true).primaryKeys() : [];
                 const confirmedHashes = new Set(confirmed.map(key => key[1]));
                 const needed = keys.filter(key => !confirmedHashes.has(key[1]));
-                const rows = (await this.outbox.bulkGet(needed)).filter((row) => Boolean(row));
-                const repairs = rows.filter(row => row.pendingState !== (row.confirmed ? 0 : 1));
-                if (repairs.length)
-                    await this.outbox.bulkPut(repairs.map(row => ({ ...row, pendingState: row.confirmed ? 0 : 1 })));
-                return { last, records: rows.filter(row => !row.confirmed && (row.accessVersion ?? 0) === this.version) };
+                const records = [], writes = [], payloads = [];
+                let bytes = 0, processed = last;
+                for (const key of needed) {
+                    const row = await this.outbox.get(key);
+                    if (!row)
+                        continue;
+                    const size = row.voiceData?.bytes.byteLength ?? row.voiceBlob?.size ?? 0;
+                    if (records.length && bytes + 2 * size > 16 * 1024 * 1024) {
+                        processed = records.at(-1).hash;
+                        break;
+                    }
+                    if (!row.confirmed && (row.accessVersion ?? 0) === this.version) {
+                        const split = splitAttachment(row);
+                        records.push(split.record);
+                        bytes += 2 * size;
+                        if (split.attachment) {
+                            payloads.push(split.attachment);
+                            writes.push(split.record);
+                        }
+                        else if (row.pendingState !== (row.confirmed ? 0 : 1))
+                            writes.push({ ...row, pendingState: row.confirmed ? 0 : 1 });
+                    }
+                    else if (row.pendingState !== (row.confirmed ? 0 : 1))
+                        writes.push({ ...row, pendingState: row.confirmed ? 0 : 1 });
+                }
+                if (payloads.length)
+                    await this.attachments.bulkPut(payloads);
+                if (writes.length)
+                    await this.outbox.bulkPut(writes);
+                return { last: processed, records };
             });
             for (const row of batch.records)
                 restored.set(row.hash, row);
@@ -181,7 +213,7 @@ export class DurableChatSender {
     async withEpoch(mode, operation) {
         await this.checkAccess();
         try {
-            return await this.db.transaction(mode, this.outbox, this.epochs, async () => {
+            return await this.db.transaction(mode, this.outbox, this.epochs, this.attachments, async () => {
                 if (this.closed || this.withdrawn)
                     throw new Error("OUTBOX_ACCESS_REVOKED");
                 if (((await this.epochs.get(this.scope))?.version ?? 0) !== this.version)
@@ -195,7 +227,10 @@ export class DurableChatSender {
             throw error;
         }
     }
-    deleteRows() { return this.outbox.where("[scope+hash]").between([this.scope, Dexie.minKey], [this.scope, Dexie.maxKey], true, true).delete(); }
+    async deleteRows() {
+        await this.outbox.where("[scope+hash]").between([this.scope, Dexie.minKey], [this.scope, Dexie.maxKey], true, true).delete();
+        await this.attachments.where("scope").equals(this.scope).delete();
+    }
     /** Stop disclosure immediately; durable invalidation is coordinated separately. */
     withdraw() {
         this.withdrawn = true;
@@ -205,7 +240,7 @@ export class DurableChatSender {
         this.uploads.forEach(controller => controller.abort());
         this.reconciliations.forEach(controller => controller.abort());
         this.firstDelivery.clear();
-        this.releaseUrls();
+        this.attachmentLeases.forEach(release => release());
         this.values.clear();
         this.emit();
     }
@@ -218,7 +253,7 @@ export class DurableChatSender {
         return this.revoking = (async () => {
             await this.ready.catch(error => { if (!String(error).includes("OUTBOX_SCOPE_CHANGED"))
                 throw error; });
-            const version = await this.db.transaction("rw", this.outbox, this.epochs, async () => {
+            const version = await this.db.transaction("rw", this.outbox, this.epochs, this.attachments, async () => {
                 const current = (await this.epochs.get(this.scope))?.version ?? 0;
                 const target = targetVersion ?? this.version + 1;
                 if (!Number.isSafeInteger(target) || target < 0)
@@ -239,7 +274,7 @@ export class DurableChatSender {
             return this.empty;
         let snapshot = this.snapshots.get(threadId);
         if (!snapshot) {
-            snapshot = [...this.values.values()].filter(record => threadId === undefined || record.threadId === threadId).map(record => this.localView(record));
+            snapshot = [...this.values.values()].filter(record => threadId === undefined || record.threadId === threadId);
             this.snapshots.set(threadId, snapshot);
         }
         return snapshot;
@@ -313,13 +348,14 @@ export class DurableChatSender {
     }
     drainAcceptances() {
         const task = (async () => {
-            let bytes = 0, count = 0;
+            let bytes = 0, count = 0, operations = 0;
             for (const item of this.acceptanceQueue) {
                 const size = item.bytes;
-                if (count >= 128 || (count > 0 && bytes + size > 20 * 1024 * 1024))
+                if (operations + (hasVoice(item.record) ? 2 : 1) > 128 || (count > 0 && bytes + size > 20 * 1024 * 1024))
                     break;
                 bytes += size;
                 count++;
+                operations += hasVoice(item.record) ? 2 : 1;
             }
             const batch = this.acceptanceQueue.splice(0, count);
             try {
@@ -342,9 +378,13 @@ export class DurableChatSender {
                                 known.set(record.hash, record);
                         }
                     }
-                    if (writes.length)
-                        await this.outbox.bulkPut(writes);
-                    return { writes, records };
+                    const split = writes.map(splitAttachment), payloads = split.flatMap(item => item.attachment ? [item.attachment] : []);
+                    if (payloads.length)
+                        await this.attachments.bulkPut(payloads);
+                    if (split.length)
+                        await this.outbox.bulkPut(split.map(item => item.record));
+                    const metadata = new Map(split.map(item => [item.record.hash, item.record]));
+                    return { writes: split.map(item => item.record), records: records.map(record => metadata.get(record.hash) ?? record) };
                 });
                 await this.checkAccess();
                 for (const record of result.writes)
@@ -475,28 +515,53 @@ export class DurableChatSender {
             this.reconciliations.delete(controller);
         }
     }
-    releaseUrl(hash) { const value = this.localUrls.get(hash); if (value) {
-        URL.revokeObjectURL(value.url);
-        this.localUrls.delete(hash);
-    } }
-    releaseUrls() { for (const hash of this.localUrls.keys())
-        this.releaseUrl(hash); }
-    localView(record) {
-        if (!hasVoice(record) || typeof URL.createObjectURL !== "function")
-            return record;
-        let cached = this.localViews.get(record);
-        if (cached)
-            return cached;
-        const blob = voiceBlob(record);
-        let local = this.localUrls.get(record.hash);
-        if (!local || local.blob !== blob) {
-            this.releaseUrl(record.hash);
-            local = { blob, url: URL.createObjectURL(blob) };
-            this.localUrls.set(record.hash, local);
+    /** Only explicit playback/transcription acquires a local payload, never snapshots. */
+    async acquireVoice(hash, threadId) {
+        await this.ready;
+        await this.checkAccess();
+        const record = await this.queueIO(hash);
+        if (!record || record.threadId !== threadId || !hasVoice(record))
+            return undefined;
+        const releaseBudget = this.reserveAttachment(record), key = Symbol(hash);
+        let url, released = false;
+        const release = () => { if (released)
+            return; released = true; if (url)
+            URL.revokeObjectURL(url); releaseBudget(); this.attachmentLeases.delete(key); };
+        this.attachmentLeases.set(key, release);
+        try {
+            const blob = await this.readVoice(record);
+            await this.checkAccess();
+            if (released || this.closing)
+                throw new Error("CHAT_SENDER_CLOSED");
+            url = URL.createObjectURL(blob);
+            return { url, release };
         }
-        cached = { ...record, voiceBlob: blob, message: withVoiceUrl(record.message, local.url) };
-        this.localViews.set(record, cached);
-        return cached;
+        catch (error) {
+            release();
+            throw error;
+        }
+    }
+    reserveAttachment(record) {
+        const size = record.voiceAttachment?.size ?? record.voiceData?.bytes.byteLength ?? record.voiceBlob?.size ?? 0;
+        if (!Number.isSafeInteger(size) || size <= 0 || size > 16 * 1024 * 1024)
+            throw new Error("INVALID_VOICE_ATTACHMENT");
+        // Charge both the native read buffer and Blob construction, including active leases.
+        const bytes = 2 * size;
+        if (this.attachmentBytes + bytes > 64 * 1024 * 1024)
+            throw new Error("VOICE_ATTACHMENT_BACKPRESSURE");
+        this.attachmentBytes += bytes;
+        let released = false;
+        return () => { if (!released) {
+            released = true;
+            this.attachmentBytes -= bytes;
+        } };
+    }
+    async readVoice(record) {
+        const row = await this.withEpoch("r", () => this.attachments.get([this.scope, record.hash]));
+        await this.checkAccess();
+        if (!row || row.accessVersion !== this.version || row.size !== record.voiceAttachment?.size || row.type !== record.voiceAttachment.type || (row.bytes?.byteLength ?? row.blob?.size) !== row.size)
+            throw new Error("VOICE_ATTACHMENT_UNAVAILABLE");
+        return row.blob ?? new Blob([row.bytes], { type: row.type });
     }
     async prepareVoice(record) {
         if (this.uploadWaiting >= 32)
@@ -517,14 +582,19 @@ export class DurableChatSender {
                 return latest;
             if (!this.options.uploadVoice)
                 throw new Error("VOICE_UPLOAD_UNAVAILABLE");
+            const release = this.reserveAttachment(latest);
             const controller = new AbortController();
             this.uploads.add(controller);
             const timeout = setTimeout(() => controller.abort(), 30_000);
             let url;
             try {
-                url = await this.options.uploadVoice(voiceBlob(latest), controller.signal);
+                const blob = await this.readVoice(latest);
+                if (controller.signal.aborted || this.closing)
+                    throw new Error("CHAT_SENDER_CLOSED");
+                url = await this.options.uploadVoice(blob, controller.signal);
             }
             finally {
+                release();
                 clearTimeout(timeout);
                 this.uploads.delete(controller);
             }
@@ -534,7 +604,7 @@ export class DurableChatSender {
             await this.checkAccess();
             if (this.closing)
                 throw new Error("CHAT_SENDER_CLOSED");
-            const { voiceBlob: _blob, voiceData: _data, ...uploaded } = latest;
+            const { voiceBlob: _blob, voiceData: _data, voiceAttachment: _attachment, ...uploaded } = latest;
             const committed = await this.queueIO(record.hash, { ...uploaded, message: withVoiceUrl(latest.message, url) }, true);
             if (!committed)
                 throw new Error("OUTGOING_MESSAGE_UNAVAILABLE");
@@ -575,12 +645,13 @@ export class DurableChatSender {
     }
     drainIO() {
         const task = (async () => {
-            let count = 0, bytes = 0;
+            let count = 0, bytes = 0, operations = 0;
             for (const item of this.ioQueue) {
-                if (count >= 128 || (count > 0 && bytes + item.bytes > 20 * 1024 * 1024))
+                if (operations + (item.uploaded ? 2 : 1) > 128 || (count > 0 && bytes + item.bytes > 20 * 1024 * 1024))
                     break;
                 count++;
                 bytes += item.bytes;
+                operations += item.uploaded ? 2 : 1;
             }
             const batch = this.ioQueue.splice(0, count);
             try {
@@ -598,8 +669,12 @@ export class DurableChatSender {
                         }
                         result.push(current.get(item.hash));
                     }
-                    if (writes.size)
+                    if (writes.size) {
                         await this.outbox.bulkPut([...writes.values()]);
+                        const released = [...writes.values()].filter(record => !hasVoice(record) && hasVoice(rows[hashes.indexOf(record.hash)]));
+                        if (released.length)
+                            await this.attachments.bulkDelete(released.map(record => [this.scope, record.hash]));
+                    }
                     return result;
                 });
                 await this.checkAccess();
@@ -610,7 +685,6 @@ export class DurableChatSender {
                     const record = records[index], old = this.values.get(item.hash);
                     if (!record || record.confirmed) {
                         changed = this.values.delete(item.hash) || changed;
-                        this.releaseUrl(item.hash);
                     }
                     else if (!old || old.status !== record.status || old.accessVersion !== record.accessVersion || JSON.stringify(old.message) !== JSON.stringify(record.message) || hasVoice(old) !== hasVoice(record)) {
                         this.values.set(item.hash, record);
@@ -694,21 +768,33 @@ export class DurableChatSender {
         await this.ready;
         let changed = false;
         try {
-            for (let offset = 0; offset < hashes.length; offset += 128) {
-                const batch = hashes.slice(offset, offset + 128);
+            for (let offset = 0; offset < hashes.length;) {
+                let end = offset, operations = 0;
+                while (end < hashes.length) {
+                    const known = this.values.get(hashes[end]), cost = known && !hasVoice(known) ? 1 : 2;
+                    if (operations + cost > 128)
+                        break;
+                    operations += cost;
+                    end++;
+                }
+                const batch = hashes.slice(offset, end);
                 await this.withEpoch("rw", async () => {
                     const previous = await this.outbox.bulkGet(batch.map(hash => [this.scope, hash]));
-                    const confirmed = previous.filter((record) => Boolean(record && !record.confirmed)).map(record => ({ ...record, voiceBlob: undefined, voiceData: undefined, status: "sent", confirmed: true }));
-                    if (confirmed.length)
+                    const confirmed = previous.filter((record) => Boolean(record && !record.confirmed)).map(record => ({ ...record, voiceBlob: undefined, voiceData: undefined, voiceAttachment: undefined, status: "sent", confirmed: true }));
+                    if (confirmed.length) {
                         await this.outbox.bulkPut(confirmed);
+                        const voices = previous.filter((record) => Boolean(record && hasVoice(record)));
+                        if (voices.length)
+                            await this.attachments.bulkDelete(voices.map(record => [this.scope, record.hash]));
+                    }
                 });
                 // Retire only committed rows. A later failed transaction leaves the
                 // remaining sends retryable, including after a browser restart.
                 for (const hash of batch) {
                     changed = this.values.delete(hash) || changed;
-                    this.releaseUrl(hash);
                 }
-                if (offset + batch.length < hashes.length)
+                offset = end;
+                if (offset < hashes.length)
                     await new Promise(resolve => setTimeout(resolve, 0));
             }
         }
@@ -738,6 +824,7 @@ export class DurableChatSender {
     }
     async close() {
         this.closing = true;
+        this.attachmentLeases.forEach(release => release());
         this.uploads.forEach(controller => controller.abort());
         this.reconciliations.forEach(controller => controller.abort());
         this.offConnection();
@@ -753,7 +840,7 @@ export class DurableChatSender {
             this.closed = true;
             this.failConfirmations(new Error("CHAT_SENDER_CLOSED"));
             this.firstDelivery.clear();
-            this.releaseUrls();
+            this.attachmentLeases.forEach(release => release());
             this.values.clear();
             this.snapshots.clear();
             this.db.close();
@@ -776,5 +863,11 @@ function withVoiceUrl(message, url) {
     const body = message.body;
     return { ...message, body: { ...body, content: { ...body.content, voice: { ...body.content.voice, url } } } };
 }
-function hasVoice(record) { return Boolean(record.voiceBlob || record.voiceData); }
-function voiceBlob(record) { return record.voiceBlob ?? new Blob([record.voiceData.bytes], { type: record.voiceData.type }); }
+function hasVoice(record) { return Boolean(record && (record.voiceBlob || record.voiceData || record.voiceAttachment)); }
+function splitAttachment(record) {
+    const { voiceBlob, voiceData, ...metadata } = record;
+    if (!voiceBlob && !voiceData)
+        return { record: metadata };
+    const size = voiceData?.bytes.byteLength ?? voiceBlob.size, type = voiceData?.type ?? voiceBlob.type;
+    return { record: { ...metadata, pendingState: record.confirmed ? 0 : 1, voiceAttachment: { size, type } }, attachment: { scope: record.scope, hash: record.hash, accessVersion: record.accessVersion ?? 0, size, type, ...(voiceData ? { bytes: voiceData.bytes } : { blob: voiceBlob }) } };
+}

package/lib/runtime/outboxSchema.d.ts

@@ -0,0 +1,5 @@
+import { Dexie } from "dexie";
+/** Rename canonical rows without copying attachments in a versionchange transaction.
+ * An old sender must fail closed, rather than send a metadata-only voice wire. */
+export declare function prepareOutboxSchema(factory: IDBFactory, name: string): Promise<void>;
+export declare function outboxDatabase(factory: IDBFactory, name: string): Dexie;

package/lib/runtime/outboxSchema.js

@@ -0,0 +1,58 @@
+import { Dexie } from "dexie";
+const messageSchema = "[scope+hash],scope,[scope+threadId],[scope+pendingState+hash]";
+/** Rename canonical rows without copying attachments in a versionchange transaction.
+ * An old sender must fail closed, rather than send a metadata-only voice wire. */
+export async function prepareOutboxSchema(factory, name) {
+    const existing = await new Promise((resolve, reject) => {
+        const request = factory.open(name);
+        let fresh = false;
+        request.onupgradeneeded = event => { if (event.oldVersion === 0) {
+            fresh = true;
+            request.transaction.abort();
+        } };
+        request.onerror = event => { event.preventDefault(); if (fresh)
+            resolve(undefined);
+        else
+            reject(request.error); };
+        request.onsuccess = () => resolve(request.result);
+    });
+    if (!existing)
+        return;
+    const version = existing.version, prepared = existing.objectStoreNames.contains("outgoingMessages") && existing.objectStoreNames.contains("outgoingAttachments");
+    existing.close();
+    if (version >= 40 && prepared)
+        return;
+    await new Promise((resolve, reject) => {
+        const request = factory.open(name, Math.max(40, version + 1));
+        request.onerror = () => reject(request.error);
+        request.onupgradeneeded = () => {
+            const db = request.result, tx = request.transaction;
+            if (db.objectStoreNames.contains("outbox")) {
+                if (db.objectStoreNames.contains("outgoingMessages")) {
+                    tx.abort();
+                    return;
+                }
+                tx.objectStore("outbox").name = "outgoingMessages";
+            }
+            db.createObjectStore("outbox", { keyPath: "unsupportedOutboxFormat" });
+            const define = (name, keyPath, indexes) => {
+                const store = db.objectStoreNames.contains(name) ? tx.objectStore(name) : db.createObjectStore(name, { keyPath });
+                for (const [index, path] of Object.entries(indexes))
+                    if (!store.indexNames.contains(index))
+                        store.createIndex(index, path);
+            };
+            define("outgoingMessages", ["scope", "hash"], { scope: "scope", "[scope+threadId]": ["scope", "threadId"], "[scope+pendingState+hash]": ["scope", "pendingState", "hash"] });
+            define("outgoingAttachments", ["scope", "hash"], { scope: "scope" });
+            define("scopeEpochs", "scope", {});
+        };
+        request.onsuccess = () => { request.result.close(); resolve(); };
+    });
+}
+export function outboxDatabase(factory, name) {
+    const db = new Dexie(name, { indexedDB: factory, IDBKeyRange: globalThis.IDBKeyRange });
+    db.version(1).stores({ outbox: "[scope+hash],scope,[scope+threadId]" });
+    db.version(2).stores({ scopeEpochs: "scope" });
+    db.version(3).stores({ outbox: messageSchema });
+    db.version(4).stores({ outbox: "unsupportedOutboxFormat", outgoingMessages: messageSchema, outgoingAttachments: "[scope+hash],scope" });
+    return db;
+}