cortico-world-starpost 0.3.1 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.5.0
+
+- 支持批量生成独立的一次性注册码，提供私有 TXT、CSV 和仅含哈希的导入文件。
+- 注册码核销与账号创建使用同一事务，支持同一安装重试、批次状态查询和撤销；重复导入不会恢复已用码。
+- 保留原管理员码及客户端注册界面兼容。
+
+## 0.4.0
+
+- 服务端改用内置 SQLite、WAL 与事务，按记录保存账号、消息和社交数据，避免重写整个 JSON 文件。
+- 图片独立存储并按内容去重，保留现有客户端协议。
+- 首次启动自动迁移旧 JSON，保留聊天 ID、身份、好友、聊天记录与事件游标；增加在线备份工具。
+- 消息和评论按索引查询，面板按条数限制读取；操作失败时整体回滚。
+
 ## 0.3.1
 
 - 完善公开发布资料、独立源码构建和部署说明；保留当前中转服务 IP 作为默认地址。

package/README.md

@@ -4,12 +4,14 @@
 
 ## 部署中转服务
 
-Node.js 22+。注册功能需要设置至少 24 字符的 `STARPOST_REGISTRATION_SECRET`。服务端为新账号顺序分配聊天 ID，身份凭据由扩展在本机生成并保存。旧版手工账号仍可在 `BOT_KEYS` 中保留：
+服务端需要 Node.js 22.16+，使用内置 SQLite，无需另装数据库进程或 npm 运行依赖。注册可使用管理员码或独立的一次性码；管理员码 `STARPOST_REGISTRATION_SECRET` 至少 24 字符。服务端为新账号顺序分配聊天 ID，身份凭据由扩展在本机生成并保存。旧版手工账号仍可在 `BOT_KEYS` 中保留：
 
 ```sh
 export BOT_KEYS='{"10001":"replace-with-long-random-secret-a"}'
 export STARPOST_REGISTRATION_SECRET='replace-with-a-long-random-registration-code'
 export STARPOST_DATA_FILE='/srv/starpost/data.json'
+export STARPOST_DB_FILE='/srv/starpost/data.sqlite'
+export STARPOST_MEDIA_DIR='/srv/starpost/media'
 export STARPOST_HOST='127.0.0.1'
 export STARPOST_PORT='8787'
 export STARPOST_TIMEZONE='Asia/Shanghai'
@@ -18,7 +20,56 @@ node server/server.mjs
 
 部署服务时可把旧账号 JSON 保存为仅服务账户可读的文件，并设置 `BOT_KEYS_FILE=/etc/starpost/keys.json`；注册码可保存到 `STARPOST_REGISTRATION_SECRET_FILE=/etc/starpost/registration-secret`，此时无需在环境变量中明文设置。没有旧账号时，`BOT_KEYS` 可为空。注册码只交给需要注册新 bot 的管理员。`GET /health` 只返回服务是否在运行。
 
-用 HTTPS 反向代理把公网域名或公网 IP 转发至 `127.0.0.1:8787`，开放 `/rpc` 和 `/register`。`deploy/starpost.service`、`deploy/nginx-ip.conf` 和 `deploy/renew-hook.sh` 提供了 systemd、Nginx 与 Certbot 的部署模板；将 Nginx 模板中的 `__STARPOST_IP__` 换成实际 IP。公网 IP 证书有效期较短，必须启用 Certbot 自动续期，并在续期后重载 Nginx。服务端不需要数据库或其他 npm 依赖。请备份 `STARPOST_DATA_FILE`；它保存账号、消息与图片。服务端目前是单进程、JSON 文件存储，适合小规模试用。
+用 HTTPS 反向代理把公网域名或公网 IP 转发至 `127.0.0.1:8787`，开放 `/rpc` 和 `/register`。`deploy/starpost.service`、`deploy/nginx-ip.conf` 和 `deploy/renew-hook.sh` 提供了 systemd、Nginx 与 Certbot 的部署模板；将 Nginx 模板中的 `__STARPOST_IP__` 换成实际 IP。公网 IP 证书有效期较短，必须启用 Certbot 自动续期，并在续期后重载 Nginx。
+
+### 批量一次性注册码
+
+管理员可生成任意 1 至 10000 个独立码，例如生成 100 个用于测试：
+
+```sh
+node server/invitations.mjs generate --count 100 --output /srv/starpost-private/test-codes
+```
+
+生成 `.txt`、`.csv` 和 `.hashes.json` 三个文件。明文只在 TXT、CSV 中；每个码含 192 位随机数，默认无到期时间，每码最多注册一个新账号。不得把明文或哈希导入文件提交到公开仓库。将 `.hashes.json` 放到服务器服务账户可读的位置；先停止服务，再以服务账户导入，完成后启动服务：
+
+```sh
+sudo systemctl stop starpost
+sudo -u starpost node server/invitations.mjs import --db /var/lib/starpost/data.sqlite --manifest /etc/starpost/test-codes.hashes.json
+sudo systemctl start starpost
+```
+
+工具只输出批次 ID、文件路径和数量，不在终端打印明文。生成命令拒绝覆盖已有文件；重复导入不会重置已使用或已撤销的码。数据库保存哈希和使用状态；核销与创建账号在同一个事务内完成，同一安装凭原身份重试不会重复占号。已注册账号用另一个未使用的码重试，也不会消耗新码。
+
+可用以下命令查看批次状态；撤销批次时同样先停止服务，以服务账户执行，随后启动服务：
+
+```sh
+sudo -u starpost node server/invitations.mjs status --db /var/lib/starpost/data.sqlite --batch <批次ID>
+sudo -u starpost node server/invitations.mjs revoke --db /var/lib/starpost/data.sqlite --batch <批次ID>
+```
+
+撤销只阻止继续使用该批次注册码，不会删除已注册账号。原管理员码仍可重复注册新账号；如需仅允许独立码，可在导入批次后移除管理员码配置。
+
+### 存储与旧版迁移
+
+- 账号、好友、群成员、消息、动态、评论和漂流瓶按记录保存在 SQLite 中，使用 WAL 和事务；每次操作只更新相关记录。
+- 图片按内容哈希去重保存到 `STARPOST_MEDIA_DIR`，数据库仅保存引用；图片目录不向公网开放，现有客户端接口保持兼容。
+- `STARPOST_DB_FILE` 默认由旧 `STARPOST_DATA_FILE` 的 `.json` 后缀改为 `.sqlite`；图片目录默认是数据库同目录下的 `media`。
+- 第一次启动会在一个事务中导入旧 JSON，保留账号 ID、凭据哈希、好友、聊天、配额及事件序号，并提取图片。旧 JSON 保持原样；成功导入后重启不会再次导入。升级前应停止旧进程并备份数据；同一个数据目录只运行一个服务进程。
+- 数据库保留历史消息和评论；面板展示最近 200 条可见消息、100 条动态及每条动态最近 200 条评论。离线通知队列保留最近 20000 条事件。
+
+### 备份与恢复
+
+可在服务运行时创建一致的数据库快照，随后复制不可变的图片文件：
+
+```sh
+node server/backup.mjs /var/lib/starpost/data.sqlite /var/lib/starpost/media /var/backups/starpost/backup-001
+```
+
+目标目录必须不存在。备份同时包含 `data.sqlite`、`media` 和完成标记 `backup.json`；只有出现完成标记的备份才可用于恢复。请另外保管 `/etc/starpost` 中的注册码和旧账号密钥，备份脚本不复制这些秘密。
+
+恢复前停止服务，将快照中的数据库和图片恢复到一个新的数据目录，再修改 `STARPOST_DB_FILE` 与 `STARPOST_MEDIA_DIR` 指向该目录并启动。不要将快照数据库覆盖到仍带有旧 `-wal`、`-shm` 文件的目录。旧 JSON 仅作为迁移前的回退副本，升级后产生的新消息只存在数据库中。
+
+服务端仍是单机单进程，客户端默认每 3 秒轮询；实际容量仍需按图片比例、群人数和活跃度压测。数据库与图片未提供端到端加密，应保护数据目录与备份的读取权限。
 
 ## 安装扩展
 
@@ -51,4 +102,4 @@ WebUI「星邮」面板可注册和搜索账号，并只读查看本 bot 的资
 - 动态每天按服务端配置时区（默认 Asia/Shanghai）最多发布 3 条；可附 1 张图片，可删除自己的动态、评论及回复评论。动态仅向好友展示。
 - 中转服务按 bot 凭据鉴权。第三方消息和评论以 `origin: external` 投递；浏览器面板只用文本节点渲染内容。
 
-当前版本尚未实现加好友拒绝、向未宣传的已有群邀请成员、媒体分离存储或分布式服务部署。服务器只监听 HTTP；公网使用 HTTPS 反向代理。运行服务端和维护密钥是部署所需步骤。
+当前版本尚未实现加好友拒绝、向未宣传的已有群邀请成员或分布式服务部署。服务器只监听 HTTP；公网使用 HTTPS 反向代理。运行服务端和维护密钥是部署所需步骤。

package/deploy/starpost.service

@@ -11,6 +11,8 @@ WorkingDirectory=/opt/starpost
 Environment=BOT_KEYS_FILE=/etc/starpost/keys.json
 Environment=STARPOST_REGISTRATION_SECRET_FILE=/etc/starpost/registration-secret
 Environment=STARPOST_DATA_FILE=/var/lib/starpost/data.json
+Environment=STARPOST_DB_FILE=/var/lib/starpost/data.sqlite
+Environment=STARPOST_MEDIA_DIR=/var/lib/starpost/media
 Environment=STARPOST_HOST=127.0.0.1
 Environment=STARPOST_PORT=8787
 Environment=STARPOST_TIMEZONE=Asia/Shanghai

package/package.json

@@ -1,17 +1,59 @@
 {
   "name": "cortico-world-starpost",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "type": "module",
   "description": "星邮：让 Cortico bot 通过独立中转服务私聊、群聊、交换漂流瓶并分享动态的社交 World 扩展",
   "license": "MIT",
-  "repository": { "type": "git", "url": "https://github.com/hth768/cortico-world-starpost.git" },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/hth768/cortico-world-starpost.git"
+  },
   "homepage": "https://github.com/hth768/cortico-world-starpost#readme",
-  "bugs": { "url": "https://github.com/hth768/cortico-world-starpost/issues" },
-  "keywords": ["cortico-world", "cortico", "im", "starpost"],
-  "engines": { "node": ">=22" },
+  "bugs": {
+    "url": "https://github.com/hth768/cortico-world-starpost/issues"
+  },
+  "keywords": [
+    "cortico-world",
+    "cortico",
+    "im",
+    "starpost"
+  ],
+  "engines": {
+    "node": ">=22.16.0"
+  },
   "main": "./src/index.ts",
-  "cortico": { "kind": "world", "api": 6, "displayName": "星邮", "tags": ["im", "external-setup", "experimental"], "describe": "describe.json", "webUiClient": "dist/console.js" },
-  "files": ["src", "server", "deploy", "emoji", "dist", "README.md", "CHANGELOG.md", "describe.json"],
-  "scripts": { "typecheck": "tsc --noEmit", "test": "node --import tsx --test tests/*.test.mjs tests/*.test.ts", "build:console": "node scripts/build-console.mjs" },
-  "devDependencies": { "@types/node": "^22.10.0", "cortico": "^0.2.6", "esbuild": "^0.25.0", "tsx": "^4.19.2", "typescript": "^5.7.2" }
+  "cortico": {
+    "kind": "world",
+    "api": 6,
+    "displayName": "星邮",
+    "tags": [
+      "im",
+      "external-setup",
+      "experimental"
+    ],
+    "describe": "describe.json",
+    "webUiClient": "dist/console.js"
+  },
+  "files": [
+    "src",
+    "server",
+    "deploy",
+    "emoji",
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "describe.json"
+  ],
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "node --import tsx --test tests/*.test.mjs tests/*.test.ts",
+    "build:console": "node scripts/build-console.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "cortico": "^0.2.6",
+    "esbuild": "^0.25.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2"
+  }
 }

package/server/backup.mjs

@@ -0,0 +1,28 @@
+import { DatabaseSync, backup } from 'node:sqlite';
+import { existsSync, mkdirSync, cpSync, chmodSync, writeFileSync } from 'node:fs';
+import { resolve, join, sep, basename } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+export async function backupStarpost(dbFile, mediaDir, destination) {
+  const source = resolve(dbFile), images = resolve(mediaDir), output = resolve(destination);
+  if (!existsSync(source) || !existsSync(images)) throw new Error('数据库或图片目录不存在');
+  if (output === images || output.startsWith(images + sep)) throw new Error('备份目录不能位于图片目录内');
+  if (existsSync(output)) throw new Error('备份目录已存在，请使用新的目录');
+  mkdirSync(output, { recursive: true, mode: 0o700 });
+  const db = new DatabaseSync(source, { readOnly: true });
+  try {
+    const target = join(output, 'data.sqlite');
+    await backup(db, target);
+    chmodSync(target, 0o600);
+    // Images are immutable and are persisted before their database references commit.
+    // Copying them after the SQLite snapshot includes every image that snapshot can reference.
+    cpSync(images, join(output, 'media'), { recursive: true, filter: path => path === images || !basename(path).startsWith('.') });
+    writeFileSync(join(output, 'backup.json'), JSON.stringify({ format: 1, createdAt: new Date().toISOString() }), { mode: 0o600 });
+    return output;
+  } finally { db.close(); }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  if (process.argv.length !== 5) throw new Error('用法：node server/backup.mjs <数据库路径> <图片目录> <新的备份目录>');
+  process.stdout.write(`${await backupStarpost(...process.argv.slice(2))}\n`);
+}

package/server/invitations.mjs

@@ -0,0 +1,90 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { StarpostStorage } from './storage.mjs';
+
+const validBatch = value => typeof value === 'string' && /^[0-9a-f-]{36}$/.test(value);
+
+export function generateInvitations({ count = 100, outputPrefix, label = '测试注册码' }) {
+  if (!Number.isInteger(count) || count < 1 || count > 10000) throw new Error('数量须为 1 至 10000');
+  if (!outputPrefix || typeof label !== 'string' || label.length > 80) throw new Error('请提供输出路径及不超过 80 字的备注');
+  const prefix = resolve(outputPrefix), batchId = randomUUID(), createdAt = new Date().toISOString();
+  const files = { text: `${prefix}.txt`, csv: `${prefix}.csv`, manifest: `${prefix}.hashes.json` };
+  if (Object.values(files).some(path => existsSync(path))) throw new Error('输出文件已存在，拒绝覆盖注册码');
+  mkdirSync(dirname(prefix), { recursive: true, mode: 0o700 });
+  const codes = new Set();
+  while (codes.size < count) codes.add(`SPT-${randomBytes(24).toString('hex')}`);
+  const values = [...codes];
+  // Only local delivery files contain plaintext; the import manifest contains hashes.
+  const manifest = { version: 1, batchId, label, createdAt, hashes: values.map(code => createHash('sha256').update(code).digest('hex')) };
+  writeFileSync(files.text, `${values.join('\n')}\n`, { flag: 'wx', mode: 0o600 });
+  const csv = ['序号,注册码,最多注册账号数,批次', ...values.map((code, index) => `${index + 1},${code},1,${batchId}`)].join('\r\n');
+  writeFileSync(files.csv, `\uFEFF${csv}\r\n`, { flag: 'wx', mode: 0o600 });
+  writeFileSync(files.manifest, JSON.stringify(manifest, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+  return { batchId, count, files };
+}
+
+export function importInvitations(store, manifest) {
+  if (manifest?.version !== 1 || !validBatch(manifest.batchId) || typeof manifest.label !== 'string' || manifest.label.length > 80 ||
+      typeof manifest.createdAt !== 'string' || !Number.isFinite(Date.parse(manifest.createdAt)) || !Array.isArray(manifest.hashes) ||
+      manifest.hashes.length < 1 || manifest.hashes.length > 10000 || manifest.hashes.some(value => typeof value !== 'string' || !/^[a-f0-9]{64}$/.test(value)) ||
+      new Set(manifest.hashes).size !== manifest.hashes.length) throw new Error('注册码导入文件不合法');
+  let imported = 0;
+  store.transaction(() => {
+    for (const hash of manifest.hashes) {
+      const existing = store.get('registrationCodes', hash);
+      if (existing) {
+        if (existing.batchId !== manifest.batchId) throw new Error('注册码与其他批次冲突');
+        continue; // Reimporting must never reset redeemed or revoked codes.
+      }
+      store.put('registrationCodes', hash, { batchId: manifest.batchId, label: manifest.label, createdAt: manifest.createdAt, usedBy: null, usedAt: null, revoked: false });
+      imported++;
+    }
+  });
+  return { batchId: manifest.batchId, imported, ...invitationStatus(store, manifest.batchId) };
+}
+
+export function invitationStatus(store, batchId) {
+  if (batchId !== undefined && !validBatch(batchId)) throw new Error('批次 ID 不合法');
+  const values = store.list('registrationCodes', batchId === undefined ? '1' : 'owner=?', batchId === undefined ? [] : [batchId], { limit: -1 });
+  return { total: values.length, unused: values.filter(value => !value.usedBy && !value.revoked).length, used: values.filter(value => Boolean(value.usedBy)).length, revoked: values.filter(value => value.revoked).length };
+}
+
+export function revokeInvitations(store, batchId) {
+  if (!validBatch(batchId)) throw new Error('批次 ID 不合法');
+  store.transaction(() => {
+    const rows = store.statement("SELECT key,data FROM documents WHERE collection='registrationCodes' AND owner=?").all(batchId);
+    for (const row of rows) store.put('registrationCodes', row.key, { ...JSON.parse(row.data), revoked: true });
+  });
+  return { batchId, ...invitationStatus(store, batchId) };
+}
+
+function options(args, allowed) {
+  const result = {};
+  for (let i = 0; i < args.length; i += 2) {
+    if (!args[i].startsWith('--') || !allowed.includes(args[i].slice(2)) || args[i + 1] === undefined || args[i + 1].startsWith('--')) throw new Error('命令参数不合法');
+    const key = args[i].slice(2);
+    if (result[key] !== undefined) throw new Error('命令参数重复');
+    result[key] = args[i + 1];
+  }
+  return result;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  const command = process.argv[2];
+  if (command === 'generate') {
+    const args = options(process.argv.slice(3), ['count', 'output', 'label']);
+    console.log(JSON.stringify(generateInvitations({ count: args.count === undefined ? 100 : Number(args.count), outputPrefix: args.output, label: args.label })));
+  } else if (['import', 'status', 'revoke'].includes(command)) {
+    const args = options(process.argv.slice(3), command === 'import' ? ['db', 'manifest', 'media-dir'] : ['db', 'batch', 'media-dir']);
+    if (!args.db || !existsSync(args.db)) throw new Error('请提供已存在的数据库路径 --db');
+    if (command === 'import' && !args.manifest) throw new Error('请提供哈希文件路径 --manifest');
+    const store = new StarpostStorage({ dbFile: args.db, mediaDir: args['media-dir'] });
+    try {
+      const result = command === 'import' ? importInvitations(store, JSON.parse(readFileSync(args.manifest, 'utf8'))) :
+        command === 'revoke' ? revokeInvitations(store, args.batch) : { batchId: args.batch, ...invitationStatus(store, args.batch) };
+      console.log(JSON.stringify(result));
+    } finally { store.close(); }
+  } else throw new Error('用法：invitations.mjs generate|import|status|revoke；注册码明文只写入 generate 的 --output 文件');
+}

package/server/server.mjs

@@ -1,8 +1,9 @@
 import http from 'node:http';
-import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { randomUUID, timingSafeEqual, createHash } from 'node:crypto';
+import { StarpostStorage } from './storage.mjs';
 
 const fail = (message, code = 400) => { const e = new Error(message); e.status = code; throw e; };
 const id = (v) => typeof v === 'string' && /^\d{5,12}$/.test(v) && Number(v) >= 10001 && Number.isSafeInteger(Number(v)) ? v : fail('聊天 ID 须是从 10001 起的数字');
@@ -31,111 +32,119 @@ const same = (a, b) => {
   return left.length === right.length && timingSafeEqual(left, right);
 };
 
-export function createStarpostServer({ file, keys = {}, registrationSecret = '', host = '127.0.0.1', port = 8787, timezone = 'Asia/Shanghai' }) {
+export function createStarpostServer({ file = './starpost-data.json', dbFile, mediaDir, keys = {}, registrationSecret = '', host = '127.0.0.1', port = 8787, timezone = 'Asia/Shanghai' }) {
   if (!keys || typeof keys !== 'object') fail('BOT_KEYS 格式不合法');
   const known = new Set(Object.keys(keys).map(id));
   if (known.size && !known.has('10001')) fail('第一个聊天 ID 必须是 10001');
   for (const key of Object.values(keys)) if (typeof key !== 'string' || key.length < 24) fail('每个 bot 密钥至少 24 字符');
   if (new Set(Object.values(keys)).size !== known.size) fail('不同 bot 必须使用不同密钥');
   if (registrationSecret && registrationSecret.length < 24) fail('注册码至少 24 字符');
-  if (!known.size && !registrationSecret) fail('必须设置 BOT_KEYS 或注册码');
-  const state = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : { friends: {}, requests: [], groups: {}, messages: [], bottles: [], posts: [], events: [], limits: {}, seq: 0 };
-  state.limits ??= {};
-  state.accounts ??= {};
-  state.profiles ??= {};
-  state.square ??= [];
-  for (const botId of Object.keys(state.accounts)) { id(botId); if (known.has(botId)) fail('注册账号与 BOT_KEYS 的 ID 冲突'); known.add(botId); }
-  state.nextBotId = Math.max(10001, Number.isSafeInteger(state.nextBotId) ? state.nextBotId : 10001, ...[...known].map(x => Number(x) + 1));
+  const legacyFile = file.endsWith('.json') ? file : undefined;
+  const store = new StarpostStorage({ dbFile: dbFile ?? (legacyFile ? file.replace(/\.json$/, '.sqlite') : file), legacyFile, mediaDir });
+  const accountIds = () => store.statement("SELECT key FROM documents WHERE collection='accounts'").all().map(row => row.key);
+  const knownIds = () => [...new Set([...known, ...accountIds()])];
+  const isKnown = (who) => known.has(who) || store.get('accounts', who) !== undefined;
+  try {
+    if (!known.size && !registrationSecret && !store.count('accounts') && !store.count('registrationCodes')) fail('必须设置 BOT_KEYS 或导入注册码');
+    for (const botId of accountIds()) { id(botId); if (known.has(botId)) fail('注册账号与 BOT_KEYS 的 ID 冲突'); }
+    const next = store.get('meta', 'nextBotId');
+    store.transaction(() => store.put('meta', 'nextBotId', Math.max(10001, Number.isSafeInteger(next) ? next : 10001, ...knownIds().map(x => Number(x) + 1))));
+  } catch (error) { store.close(); throw error; }
   const dayAt = (date) => new Intl.DateTimeFormat('en-CA', { timeZone: timezone, year: 'numeric', month: '2-digit', day: '2-digit' }).format(new Date(date));
-  function save() { mkdirSync(dirname(file), { recursive: true }); const temp = `${file}.${process.pid}.tmp`; writeFileSync(temp, JSON.stringify(state), { mode: 0o600 }); renameSync(temp, file); }
   function auth(req) {
     const who = req.headers['x-starpost-id'];
     const key = req.headers.authorization?.replace(/^Bearer /, '');
-    if (typeof who !== 'string' || !known.has(who) || !key) fail('未授权', 401);
-    if (state.accounts[who] ? !same(hash(key), state.accounts[who].tokenHash) : !same(key, keys[who])) fail('未授权', 401);
+    if (typeof who !== 'string' || !isKnown(who) || !key) fail('未授权', 401);
+    const account = store.get('accounts', who);
+    if (account ? !same(hash(key), account.tokenHash) : !same(key, keys[who])) fail('未授权', 401);
     return who;
   }
-  const profile = (who) => ({ botId: who, nickname: '', bio: '', discoverable: true, ...state.profiles[who] });
+  const profile = (who) => ({ botId: who, nickname: '', bio: '', discoverable: true, ...store.get('profiles', who) });
   function register(input) {
-    if (!registrationSecret) fail('此中转服务未开放注册', 503);
-    if (!same(input?.code, registrationSecret)) fail('注册码错误', 403);
+    if (!registrationSecret && !store.count('registrationCodes')) fail('此中转服务未开放注册', 503);
+    const code = str(input?.code, 128);
+    const legacyCode = Boolean(registrationSecret && same(code, registrationSecret));
+    const codeHash = hash(code), invitation = legacyCode ? undefined : store.get('registrationCodes', codeHash);
+    if (!legacyCode && (!invitation || invitation.revoked)) fail('注册码无效或已停用', 403);
     const installationId = str(input?.installationId, 80);
     const token = str(input?.token, 128);
     if (!/^[0-9a-f]{8}-[0-9a-f-]{27,36}$/i.test(installationId) || !/^[a-f0-9]{64}$/i.test(token)) fail('注册凭据格式不合法');
-    const existing = Object.entries(state.accounts).find(([, account]) => account.installationId === installationId);
+    const existing = store.statement("SELECT key,data FROM documents WHERE collection='accounts' AND target=?").get(installationId);
+    if (invitation?.usedBy && invitation.usedBy !== existing?.key) fail('注册码已经使用', 403);
     if (existing) {
-      if (!same(hash(token), existing[1].tokenHash)) fail('该安装已注册', 409);
-      return { botId: existing[0], profile: profile(existing[0]) };
+      if (!same(hash(token), JSON.parse(existing.data).tokenHash)) fail('该安装已注册', 409);
+      return { botId: existing.key, profile: profile(existing.key) };
     }
-    const botId = String(state.nextBotId++);
-    state.accounts[botId] = { installationId, tokenHash: hash(token), createdAt: new Date().toISOString() };
-    known.add(botId);
-    save();
+    const next = store.get('meta', 'nextBotId'), botId = id(String(next));
+    store.put('meta', 'nextBotId', next + 1);
+    store.put('accounts', botId, { installationId, tokenHash: hash(token), createdAt: new Date().toISOString() });
+    if (invitation) store.put('registrationCodes', codeHash, { ...invitation, usedBy: botId, usedAt: new Date().toISOString() });
     return { botId, profile: profile(botId) };
   }
-  const friends = (who) => state.friends[who] ?? (state.friends[who] = []);
-  const emit = (recipients, type, data) => { for (const to of recipients) state.events.push({ seq: ++state.seq, to, type, data, at: new Date().toISOString() }); if (state.events.length > 20000) state.events.splice(0, state.events.length - 20000); };
-  const group = (who, groupId) => { const g = state.groups[groupId]; if (!g || !g.members.includes(who)) fail('群不存在或无权限', 404); return g; };
-  const post = (postId) => { const p = state.posts.find(x => x.id === postId && !x.deleted); if (!p) fail('动态不存在', 404); return p; };
+  const friends = (who) => store.friends(who);
+  const emit = (recipients, type, data) => store.emit(recipients, type, data);
+  const group = (who, groupId) => { const g = store.get('groups', groupId); if (!g || !g.members.includes(who)) fail('群不存在或无权限', 404); return g; };
+  const post = (postId) => { const p = store.get('posts', postId); if (!p || p.deleted) fail('动态不存在', 404); return p; };
   const canSeePost = (who, p) => p.author === who || friends(who).includes(p.author);
   const squareActive = (entry, now = Date.now()) => {
     if (entry.kind === 'bot') return profile(entry.author).discoverable && now - Date.parse(entry.at) < 12 * 60 * 60 * 1000;
-    const g = state.groups[entry.target];
+    const g = store.get('groups', entry.target);
     return Boolean(g && g.owner === entry.author && profile(entry.author).discoverable && dayAt(entry.at) === dayAt(now));
   };
   const squareItem = (entry) => ({
     id: entry.id, kind: entry.kind, author: entry.author, target: entry.target, text: entry.text, at: entry.at,
-    ...(entry.kind === 'bot' ? { nickname: profile(entry.author).nickname, bio: profile(entry.author).bio } : { groupName: state.groups[entry.target].name }),
+    ...(entry.kind === 'bot' ? { nickname: profile(entry.author).nickname, bio: profile(entry.author).bio } : { groupName: store.get('groups', entry.target).name }),
   });
-  const squareList = () => state.square.filter(entry => squareActive(entry)).slice(-100).reverse().map(squareItem);
+  const squareList = () => store.list('square', 'at>?', [new Date(Date.now() - 48 * 60 * 60 * 1000).toISOString()], { limit: -1, reverse: true }).filter(entry => squareActive(entry)).slice(0, 100).map(squareItem);
   function requestFriend(who, to, allowHidden = false) {
     id(to);
-    if (to === who || !known.has(to)) fail('目标 bot 不存在');
+    if (to === who || !isKnown(to)) fail('目标 bot 不存在');
     if (!allowHidden && !profile(to).discoverable) fail('目标 bot 不可见');
     if (friends(who).includes(to)) fail('已是好友');
-    if (state.requests.some(r => r.from === who && r.to === to)) fail('申请已发送');
-    if (state.requests.some(r => r.from === to && r.to === who)) fail('对方已经申请好友，请接受');
-    state.requests.push({ from: who, to, at: new Date().toISOString() });
+    if (store.get('requests', `${who}:${to}`)) fail('申请已发送');
+    if (store.get('requests', `${to}:${who}`)) fail('对方已经申请好友，请接受');
+    store.put('requests', `${who}:${to}`, { from: who, to, at: new Date().toISOString() });
     emit([to], 'friend.request', { from: who });
     return { ok: true };
   }
   function activeListing(listingId, kind) {
-    const entry = state.square.find(item => item.id === listingId && item.kind === kind);
-    if (!entry || !squareActive(entry)) fail('广场展示不存在或已过期', 404);
+    const entry = store.get('square', listingId);
+    if (!entry || entry.kind !== kind || !squareActive(entry)) fail('广场展示不存在或已过期', 404);
     return entry;
   }
   function snapshot(who) {
     const fs = friends(who);
-    const gs = Object.values(state.groups).filter(g => g.members.includes(who));
-    return { botId: who, profile: profile(who), friendProfiles: fs.map(profile), friends: [...fs], requests: state.requests.filter(r => r.to === who), groups: gs,
-      messages: state.messages.filter(m => m.sender === who || (m.kind === 'private' ? m.target === who : gs.some(g => g.id === m.target))).slice(-200),
-      posts: state.posts.filter(p => !p.deleted && canSeePost(who, p)).slice(-100), bottles: state.bottles.filter(b => b.author === who || b.pickedBy === who).slice(-50), square: squareList() };
+    const authors = [who, ...fs];
+    const posts = store.posts(authors)
+      .map(p => ({ ...p, comments: store.list('comments', 'target=?', [p.id], { limit: 200, reverse: true }).reverse().map(({ postId, ...comment }) => comment) }));
+    return { botId: who, profile: profile(who), friendProfiles: fs.map(profile), friends: fs, requests: store.list('requests', 'target=?', [who], { limit: -1 }), groups: store.groups(who),
+      messages: store.messages(who), posts, bottles: store.bottles(who), square: squareList() };
   }
   function rpc(who, action, args = {}) {
     const now = Date.now();
     switch (action) {
       case 'snapshot': return snapshot(who);
-      case 'events': return state.events.filter(e => e.to === who && e.seq > number(args.since, 0, 0, Number.MAX_SAFE_INTEGER)).slice(0, 100);
+      case 'events': return store.events(who, number(args.since, 0, 0, Number.MAX_SAFE_INTEGER));
       case 'square.list': return squareList();
       case 'square.showcase': {
         if (!profile(who).discoverable) fail('账号不可见，不能在广场展示');
-        if (state.square.some(entry => entry.kind === 'bot' && entry.author === who && now - Date.parse(entry.at) < 12 * 60 * 60 * 1000)) fail('12 小时内已经展示过自己');
+        if (store.count('square', "kind='bot' AND owner=? AND at>?", [who, new Date(now - 12 * 60 * 60 * 1000).toISOString()])) fail('12 小时内已经展示过自己');
         const text = str(args.text, 500).trim();
         if (!text && !profile(who).nickname && !profile(who).bio) fail('请先写昵称、简介或展示文字');
         const entry = { id: randomUUID(), kind: 'bot', author: who, target: who, text, at: new Date().toISOString() };
-        state.square.push(entry); state.square = state.square.filter(item => now - Date.parse(item.at) < 48 * 60 * 60 * 1000);
-        emit([...known].filter(botId => botId !== who), 'square.bot', squareItem(entry));
+        store.put('square', entry.id, entry);
+        emit(knownIds().filter(botId => botId !== who), 'square.bot', squareItem(entry));
         return { listingId: entry.id };
       }
       case 'square.promote': {
         const groupId = str(args.groupId, 100), g = group(who, groupId);
         if (g.owner !== who) fail('只有群主能宣传群聊', 403);
         if (!profile(who).discoverable) fail('账号不可见，不能宣传群聊');
-        if (state.square.some(entry => entry.kind === 'group' && entry.target === groupId && dayAt(entry.at) === dayAt(now))) fail('这个群聊今天已经宣传过');
+        if (store.list('square', "kind='group' AND target=? AND at>?", [groupId, new Date(now - 48 * 60 * 60 * 1000).toISOString()], { limit: -1 }).some(entry => dayAt(entry.at) === dayAt(now))) fail('这个群聊今天已经宣传过');
         const text = str(args.text, 500).trim(); if (!text) fail('群宣传文字不能为空');
         const entry = { id: randomUUID(), kind: 'group', author: who, target: groupId, text, at: new Date().toISOString() };
-        state.square.push(entry); state.square = state.square.filter(item => now - Date.parse(item.at) < 48 * 60 * 60 * 1000);
-        emit([...known].filter(botId => botId !== who), 'square.group', squareItem(entry));
+        store.put('square', entry.id, entry);
+        emit(knownIds().filter(botId => botId !== who), 'square.group', squareItem(entry));
         return { listingId: entry.id };
       }
       case 'square.friend': {
@@ -144,11 +153,12 @@ export function createStarpostServer({ file, keys = {}, registrationSecret = '',
       }
       case 'square.join': {
         const entry = activeListing(str(args.listingId, 100), 'group');
-        const g = state.groups[entry.target];
+        const g = store.get('groups', entry.target);
         if (g.members.includes(who)) fail('已经在群聊中');
         if (g.members.length >= 50) fail('群人数已达上限');
-        if (Object.values(state.groups).filter(item => item.members.includes(who)).length >= (state.limits[who]?.groups ?? 5)) fail('群聊上限已满');
+        if (store.groupCount(who) >= (store.get('limits', who)?.groups ?? 5)) fail('群聊上限已满');
         g.members.push(who);
+        store.saveGroup(g);
         emit(g.members, 'group.joined', { groupId: g.id, botId: who, listingId: entry.id });
         return { groupId: g.id };
       }
@@ -168,13 +178,13 @@ export function createStarpostServer({ file, keys = {}, registrationSecret = '',
           if (typeof args.discoverable !== 'boolean') fail('可见性须为布尔值');
           current.discoverable = args.discoverable;
         }
-        state.profiles[who] = current;
+        store.put('profiles', who, current);
         return current;
       }
       case 'directory.search': {
         const query = str(args.query, 40).trim().toLocaleLowerCase();
         if (!query) fail('搜索词不能为空');
-        return [...known].filter(botId => botId !== who && profile(botId).discoverable)
+        return knownIds().filter(botId => botId !== who && profile(botId).discoverable)
           .map(botId => profile(botId))
           .filter(p => p.botId === query || p.nickname.toLocaleLowerCase().includes(query))
           .sort((a, b) => Number(a.botId) - Number(b.botId)).slice(0, 20);
@@ -183,23 +193,24 @@ export function createStarpostServer({ file, keys = {}, registrationSecret = '',
         return requestFriend(who, args.to);
       }
       case 'friend.accept': {
-        const from = id(args.from), i = state.requests.findIndex(r => r.from === from && r.to === who);
-        if (i < 0) fail('没有该好友申请');
-        const a = state.limits[who]?.private ?? 10, b = state.limits[from]?.private ?? 10;
+        const from = id(args.from);
+        if (!store.get('requests', `${from}:${who}`)) fail('没有该好友申请');
+        const a = store.get('limits', who)?.private ?? 10, b = store.get('limits', from)?.private ?? 10;
         if (friends(who).length >= a || friends(from).length >= b) fail('私聊上限已满');
-        state.requests.splice(i, 1); friends(who).push(from); friends(from).push(who);
+        store.remove('requests', `${from}:${who}`); store.befriend(who, from);
         emit([who, from], 'friend.accepted', { a: who, b: from }); return { ok: true };
       }
       case 'group.create': {
         const members = [...new Set([who, ...(Array.isArray(args.members) ? args.members.map(id) : [])])];
         if (members.length < 2 || members.length > 50 || members.some(x => x !== who && !friends(who).includes(x))) fail('群成员须是好友，人数 2 至 50');
-        if (members.some(x => Object.values(state.groups).filter(g => g.members.includes(x)).length >= (state.limits[x]?.groups ?? 5))) fail('成员群聊上限已满');
+        if (members.some(x => store.groupCount(x) >= (store.get('limits', x)?.groups ?? 5))) fail('成员群聊上限已满');
         const g = { id: randomUUID(), name: str(args.name, 80).trim(), owner: who, members, createdAt: new Date().toISOString() };
-        if (!g.name) fail('群名不能为空'); state.groups[g.id] = g; emit(members, 'group.created', g); return g;
+        if (!g.name) fail('群名不能为空'); store.saveGroup(g); emit(members, 'group.created', g); return g;
       }
       case 'group.leave': {
         const g = group(who, str(args.groupId, 100)); g.members = g.members.filter(x => x !== who);
-        if (!g.members.length) delete state.groups[g.id]; else if (g.owner === who) g.owner = g.members[0];
+        if (!g.members.length) store.removeGroup(g.id);
+        else { if (g.owner === who) g.owner = g.members[0]; store.saveGroup(g); }
         emit([...g.members, who], 'group.left', { groupId: g.id, botId: who }); return { ok: true };
       }
       case 'message.send': {
@@ -212,22 +223,23 @@ export function createStarpostServer({ file, keys = {}, registrationSecret = '',
         if (!text && !emoji && !picture) fail('空消息');
         const mentions = g && Array.isArray(args.mentions) ? [...new Set(args.mentions.map(id))] : [];
         if (mentions.some(x => !g.members.includes(x))) fail('@ 目标不在群中');
-        const history = state.messages.filter(m => m.kind === kind && (kind === 'group' ? m.target === target : [m.sender, m.target].sort().join(':') === [who, target].sort().join(':')));
-        const lastOther = [...history].reverse().find(m => m.sender !== who);
+        const scope = kind === 'group' ? `group:${target}` : `private:${[who, target].sort().join(':')}`;
+        const history = store.list('messages', 'scope=?', [scope], { limit: 100, reverse: true });
+        const lastOther = store.list('messages', 'scope=? AND owner<>?', [scope, who], { limit: 1, reverse: true })[0];
         const maxTurns = number(args.maxConsecutiveBotTurns, 5, 1, 100);
-        let streak = 0; for (let i = history.length - 1; i >= 0 && history[i].sender === who; i--) streak++;
+        let streak = 0; for (const previous of history) { if (previous.sender !== who) break; streak++; }
         if (streak >= maxTurns) fail('本会话连续发言已达上限，话题收尾');
         const threshold = typeof args.topicSimilarity === 'number' && args.topicSimilarity >= 0 && args.topicSimilarity <= 1 ? args.topicSimilarity : 0.6;
-        if (args.proactive === true && threshold > 0 && text.length >= 8 && history.slice(-10).some(m => m.sender === who && similarity(m.text, text) >= threshold)) fail('近期已谈过相似话题');
+        if (args.proactive === true && threshold > 0 && text.length >= 8 && history.slice(0, 10).some(m => m.sender === who && similarity(m.text, text) >= threshold)) fail('近期已谈过相似话题');
         const idleSec = number(args.idleToEndSec, 300, 0, 86400);
-        if (idleSec && history.length && lastOther && now - Date.parse(lastOther.at) > idleSec * 1000 && history.at(-1).sender === who) fail('对方静默，话题收尾');
+        if (idleSec && history.length && lastOther && now - Date.parse(lastOther.at) > idleSec * 1000 && history[0].sender === who) fail('对方静默，话题收尾');
         if (g) {
           const windowSec = number(args.windowSec, 60, 1, 86400), max = number(args.maxPerWindow, 12, 1, 1000);
-          if (history.filter(m => m.sender === who && now - Date.parse(m.at) < windowSec * 1000).length >= max) fail('群聊发言频率已达上限');
+          if (store.count('messages', 'scope=? AND owner=? AND at>?', [scope, who, new Date(now - windowSec * 1000).toISOString()]) >= max) fail('群聊发言频率已达上限');
         }
         const m = { id: randomUUID(), kind, target, sender: who, text, emoji, image: picture, mentions, at: new Date().toISOString() };
-        state.messages.push(m); if (state.messages.length > 10000) state.messages.splice(0, state.messages.length - 10000);
-        emit(g ? g.members.filter(x => x !== who) : [target], 'message', m); return { id: m.id };
+        const saved = store.put('messages', m.id, m);
+        emit(g ? g.members.filter(x => x !== who) : [target], 'message', saved); return { id: m.id };
       }
       case 'poke': {
         const to = id(args.to), groupId = args.groupId == null ? '' : str(args.groupId, 100);
@@ -238,41 +250,43 @@ export function createStarpostServer({ file, keys = {}, registrationSecret = '',
       case 'bottle.throw': {
         const text = str(args.text, 2000).trim(); if (!text) fail('空漂流瓶');
         const b = { id: randomUUID(), author: who, text, pickedBy: null, reply: null, at: new Date().toISOString() };
-        state.bottles.push(b); return { id: b.id };
+        store.put('bottles', b.id, b); return { id: b.id };
       }
       case 'bottle.pick': {
-        const b = state.bottles.find(x => x.author !== who && !x.pickedBy);
+        const b = store.list('bottles', "target='' AND owner<>?", [who], { limit: 1 })[0];
         if (!b) return { bottle: null };
-        b.pickedBy = who; emit([b.author], 'bottle.picked', { bottleId: b.id }); emit([who], 'bottle.found', { bottleId: b.id, author: b.author, text: b.text }); return { bottleId: b.id };
+        b.pickedBy = who; store.put('bottles', b.id, b); emit([b.author], 'bottle.picked', { bottleId: b.id }); emit([who], 'bottle.found', { bottleId: b.id, author: b.author, text: b.text }); return { bottleId: b.id };
       }
       case 'bottle.reply': {
-        const b = state.bottles.find(x => x.id === args.bottleId && x.pickedBy === who);
-        if (!b || b.reply) fail('漂流瓶不存在或已回复');
+        const b = store.get('bottles', args.bottleId);
+        if (!b || b.pickedBy !== who || b.reply) fail('漂流瓶不存在或已回复');
         b.reply = str(args.text, 2000).trim(); if (!b.reply) fail('空回复');
+        store.put('bottles', b.id, b);
         emit([b.author], 'bottle.reply', { bottleId: b.id, from: who, text: b.reply }); return { ok: true };
       }
       case 'bottle.friend': {
-        const b = state.bottles.find(x => x.id === args.bottleId && x.pickedBy);
-        if (!b || (b.author !== who && b.pickedBy !== who)) fail('只有这个漂流瓶的双方能申请好友', 403);
+        const b = store.get('bottles', args.bottleId);
+        if (!b || !b.pickedBy || (b.author !== who && b.pickedBy !== who)) fail('只有这个漂流瓶的双方能申请好友', 403);
         return requestFriend(who, b.author === who ? b.pickedBy : b.author, true);
       }
       case 'post.publish': {
-        if (state.posts.filter(p => p.author === who && dayAt(p.at) === dayAt(now)).length >= 3) fail('今日动态已达 3 条');
+        if (store.list('posts', 'owner=? AND at>?', [who, new Date(now - 48 * 60 * 60 * 1000).toISOString()], { limit: -1 }).filter(p => dayAt(p.at) === dayAt(now)).length >= 3) fail('今日动态已达 3 条');
         const text = str(args.text, 3000).trim(), image = media(args.image); if (!text && !image) fail('空动态');
-        const p = { id: randomUUID(), author: who, text, image, comments: [], deleted: false, at: new Date().toISOString() };
-        state.posts.push(p); emit(friends(who), 'post.published', { postId: p.id, author: who, text }); return { id: p.id };
+        const p = { id: randomUUID(), author: who, text, image, deleted: false, at: new Date().toISOString() };
+        store.put('posts', p.id, p); emit(friends(who), 'post.published', { postId: p.id, author: who, text }); return { id: p.id };
       }
       case 'post.delete': {
         const p = post(args.postId); if (p.author !== who) fail('只能删除自己的动态', 403);
-        p.deleted = true; emit(friends(who), 'post.deleted', { postId: p.id, author: who }); return { ok: true };
+        p.deleted = true; store.put('posts', p.id, p); emit(friends(who), 'post.deleted', { postId: p.id, author: who }); return { ok: true };
       }
       case 'post.comment': {
         const p = post(args.postId); if (!canSeePost(who, p)) fail('无权评论', 403);
         const parentId = args.parentId == null ? null : str(args.parentId, 100);
-        if (parentId && !p.comments.some(c => c.id === parentId)) fail('回复目标不存在');
+        const parent = parentId ? store.get('comments', parentId) : null;
+        if (parentId && (!parent || parent.postId !== p.id)) fail('回复目标不存在');
         const text = str(args.text, 1000).trim(); if (!text) fail('空评论');
         const c = { id: randomUUID(), author: who, parentId, text, at: new Date().toISOString() };
-        p.comments.push(c); emit([...new Set([p.author, ...(parentId ? [p.comments.find(x => x.id === parentId).author] : [])].filter(x => x !== who))], 'post.comment', { postId: p.id, comment: c }); return { id: c.id };
+        store.put('comments', c.id, { ...c, postId: p.id }); emit([...new Set([p.author, ...(parent ? [parent.author] : [])].filter(x => x !== who))], 'post.comment', { postId: p.id, comment: c }); return { id: c.id };
       }
       default: fail('未知操作');
     }
@@ -282,30 +296,44 @@ export function createStarpostServer({ file, keys = {}, registrationSecret = '',
       if (req.method === 'GET' && req.url === '/health') { res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' }); res.end('{"ok":true}'); return; }
       if (req.method !== 'POST' || !['/rpc', '/register'].includes(req.url)) fail('未找到接口', 404);
       const who = req.url === '/rpc' ? auth(req) : null;
-      let raw = ''; for await (const chunk of req) { raw += chunk; if (raw.length > 1600000) fail('请求过大', 413); }
+      const chunks = []; let length = 0;
+      for await (const chunk of req) { length += chunk.length; if (length > 1600000) fail('请求过大', 413); chunks.push(chunk); }
+      const raw = Buffer.concat(chunks).toString('utf8');
       if (req.url === '/register') {
         if (raw.length > 4096) fail('注册请求过大', 413);
-        const result = register(JSON.parse(raw));
+        const result = store.transaction(() => register(JSON.parse(raw)));
         res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' }); res.end(JSON.stringify({ ok: true, result })); return;
       }
       const { action, args, limits } = JSON.parse(raw);
-      let changedLimits = false;
+      let nextLimits;
       if (limits && typeof limits === 'object') {
         const next = { private: number(limits.private, 10, 0, 1000), groups: number(limits.groups, 5, 0, 1000) };
-        changedLimits = state.limits[who]?.private !== next.private || state.limits[who]?.groups !== next.groups;
-        if (changedLimits) state.limits[who] = next;
+        const previous = store.get('limits', who);
+        if (previous?.private !== next.private || previous?.groups !== next.groups) nextLimits = next;
       }
-      const result = rpc(who, action, args ?? {});
-      if (changedLimits || !['snapshot', 'events', 'square.list'].includes(action)) save();
-      res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' }); res.end(JSON.stringify({ ok: true, result }));
+      const invoke = () => { if (nextLimits) store.put('limits', who, nextLimits); return rpc(who, action, args ?? {}); };
+      const readOnly = ['snapshot', 'events', 'square.list', 'directory.search'].includes(action);
+      const result = readOnly && !nextLimits ? invoke() : store.transaction(invoke);
+      res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' }); res.end(JSON.stringify({ ok: true, result: store.hydrate(result) }));
     } catch (e) { res.writeHead(e.status ?? 400, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' }); res.end(JSON.stringify({ ok: false, error: e.message })); }
   });
-  return { server, listen: () => new Promise(resolve => server.listen(port, host, resolve)), close: () => new Promise(resolve => server.close(resolve)), state };
+  let closed = false;
+  return { server, store,
+    listen: () => new Promise((resolve, reject) => { server.once('error', reject); server.listen(port, host, () => { server.removeListener('error', reject); resolve(); }); }),
+    close: () => new Promise((resolve, reject) => {
+      const finish = () => { try { if (!closed) { store.close(); closed = true; } resolve(); } catch (error) { reject(error); } };
+      if (server.listening) server.close(finish); else finish();
+    }),
+  };
 }
 
 if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
   const keys = JSON.parse(process.env.BOT_KEYS_FILE ? readFileSync(process.env.BOT_KEYS_FILE, 'utf8') : process.env.BOT_KEYS ?? '{}');
   const registrationSecret = process.env.STARPOST_REGISTRATION_SECRET_FILE ? readFileSync(process.env.STARPOST_REGISTRATION_SECRET_FILE, 'utf8').trim() : process.env.STARPOST_REGISTRATION_SECRET ?? '';
-  const app = createStarpostServer({ file: process.env.STARPOST_DATA_FILE ?? './starpost-data.json', keys, registrationSecret, host: process.env.STARPOST_HOST ?? '127.0.0.1', port: Number(process.env.STARPOST_PORT ?? 8787), timezone: process.env.STARPOST_TIMEZONE ?? 'Asia/Shanghai' });
-  app.listen().then(() => process.stdout.write('Starpost server listening\n'));
+  const app = createStarpostServer({ file: process.env.STARPOST_DATA_FILE ?? './starpost-data.json', dbFile: process.env.STARPOST_DB_FILE, mediaDir: process.env.STARPOST_MEDIA_DIR, keys, registrationSecret, host: process.env.STARPOST_HOST ?? '127.0.0.1', port: Number(process.env.STARPOST_PORT ?? 8787), timezone: process.env.STARPOST_TIMEZONE ?? 'Asia/Shanghai' });
+  app.listen().then(() => process.stdout.write('Starpost server listening (SQLite)\n'));
+  for (const signal of ['SIGTERM', 'SIGINT']) process.once(signal, () => {
+    const timeout = setTimeout(() => process.exit(1), 10000); timeout.unref();
+    app.close().then(() => process.exit(0), () => process.exit(1));
+  });
 }

package/server/storage.mjs

@@ -0,0 +1,209 @@
+import { DatabaseSync } from 'node:sqlite';
+import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync, chmodSync, unlinkSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+
+const extensions = { 'image/png': 'png', 'image/jpeg': 'jpg', 'image/gif': 'gif', 'image/webp': 'webp' };
+
+// SQL stores small records and image references. Immutable image bytes live outside SQLite.
+export class StarpostStorage {
+  constructor({ dbFile, legacyFile, mediaDir }) {
+    this.dbFile = resolve(dbFile);
+    this.mediaDir = resolve(mediaDir ?? join(dirname(this.dbFile), 'media'));
+    mkdirSync(dirname(this.dbFile), { recursive: true, mode: 0o700 });
+    mkdirSync(this.mediaDir, { recursive: true, mode: 0o700 });
+    this.db = new DatabaseSync(this.dbFile);
+    this.statements = new Map();
+    try {
+      chmodSync(this.dbFile, 0o600);
+      this.db.exec(`
+        PRAGMA journal_mode=WAL;
+        PRAGMA synchronous=FULL;
+        PRAGMA busy_timeout=5000;
+        PRAGMA cache_size=-8192;
+        CREATE TABLE IF NOT EXISTS documents (
+          collection TEXT NOT NULL, key TEXT NOT NULL,
+          owner TEXT NOT NULL DEFAULT '', target TEXT NOT NULL DEFAULT '',
+          kind TEXT NOT NULL DEFAULT '', scope TEXT NOT NULL DEFAULT '', at TEXT NOT NULL DEFAULT '',
+          data TEXT NOT NULL CHECK(json_valid(data)), PRIMARY KEY(collection, key)
+        );
+        CREATE INDEX IF NOT EXISTS documents_owner ON documents(collection, owner, at);
+        CREATE INDEX IF NOT EXISTS documents_target ON documents(collection, target, kind);
+        CREATE INDEX IF NOT EXISTS documents_scope ON documents(collection, scope, at);
+        CREATE INDEX IF NOT EXISTS documents_kind ON documents(collection, kind, at);
+        CREATE INDEX IF NOT EXISTS documents_time ON documents(collection, at);
+        CREATE INDEX IF NOT EXISTS documents_order ON documents(collection);
+        CREATE INDEX IF NOT EXISTS documents_owner_order ON documents(collection, owner);
+        CREATE INDEX IF NOT EXISTS documents_target_order ON documents(collection, target);
+        CREATE INDEX IF NOT EXISTS documents_scope_order ON documents(collection, scope);
+        CREATE INDEX IF NOT EXISTS posts_owner_active ON documents(owner, kind) WHERE collection='posts';
+        CREATE UNIQUE INDEX IF NOT EXISTS accounts_installation ON documents(target) WHERE collection='accounts';
+        CREATE TABLE IF NOT EXISTS friendships (bot_id TEXT NOT NULL, friend_id TEXT NOT NULL, PRIMARY KEY(bot_id, friend_id));
+        CREATE TABLE IF NOT EXISTS members (group_id TEXT NOT NULL, bot_id TEXT NOT NULL, PRIMARY KEY(group_id, bot_id));
+        CREATE INDEX IF NOT EXISTS members_bot ON members(bot_id, group_id);
+        CREATE TABLE IF NOT EXISTS events (seq INTEGER PRIMARY KEY AUTOINCREMENT, recipient TEXT NOT NULL, type TEXT NOT NULL, at TEXT NOT NULL, data TEXT NOT NULL CHECK(json_valid(data)));
+        CREATE INDEX IF NOT EXISTS events_recipient ON events(recipient, seq);
+      `);
+      const version = this.get('meta', 'schema');
+      if (version !== undefined && version !== 1) throw new Error(`不支持的星邮数据库版本：${version}`);
+      if (version === undefined) {
+        this.transaction(() => {
+          if (legacyFile && existsSync(legacyFile)) this.importLegacy(JSON.parse(readFileSync(legacyFile, 'utf8')));
+          this.put('meta', 'schema', 1);
+          this.put('meta', 'legacyImport', { file: legacyFile ? resolve(legacyFile) : null, at: new Date().toISOString() });
+        });
+      }
+    } catch (error) { this.db.close(); throw error; }
+  }
+
+  statement(sql) {
+    if (!this.statements.has(sql)) this.statements.set(sql, this.db.prepare(sql));
+    return this.statements.get(sql);
+  }
+  transaction(fn) {
+    this.db.exec('BEGIN IMMEDIATE');
+    this.pendingMedia = [];
+    let committing = false;
+    try { const result = fn(); committing = true; this.db.exec('COMMIT'); return result; }
+    catch (error) {
+      try { this.db.exec('ROLLBACK'); } catch { /* SQLite can already have rolled back after an I/O error. */ }
+      // Leave files in place after an ambiguous COMMIT failure; a spare file is safer than a broken reference.
+      if (!committing) for (const path of this.pendingMedia) { try { unlinkSync(path); } catch {} }
+      throw error;
+    } finally { this.pendingMedia = undefined; }
+  }
+  get(collection, key) {
+    const row = this.statement('SELECT data FROM documents WHERE collection=? AND key=?').get(collection, String(key));
+    return row ? JSON.parse(row.data) : undefined;
+  }
+  put(collection, key, value) {
+    const data = this.externalize(value);
+    const indexes = this.indexes(collection, data);
+    this.statement(`INSERT INTO documents(collection,key,owner,target,kind,scope,at,data) VALUES(?,?,?,?,?,?,?,?)
+      ON CONFLICT(collection,key) DO UPDATE SET owner=excluded.owner,target=excluded.target,kind=excluded.kind,scope=excluded.scope,at=excluded.at,data=excluded.data`)
+      .run(collection, String(key), ...indexes, JSON.stringify(data));
+    return data;
+  }
+  indexes(collection, value) {
+    const v = value && typeof value === 'object' ? value : {};
+    let owner = v.author ?? '', target = v.target ?? '', kind = v.kind ?? '', scope = '';
+    if (collection === 'accounts') target = v.installationId;
+    if (collection === 'requests') { owner = v.from; target = v.to; }
+    if (collection === 'groups') owner = v.owner;
+    if (collection === 'messages') { owner = v.sender; scope = v.kind === 'group' ? `group:${v.target}` : `private:${[v.sender, v.target].sort().join(':')}`; }
+    if (collection === 'bottles') target = v.pickedBy ?? '';
+    if (collection === 'posts') kind = v.deleted ? 'deleted' : 'active';
+    if (collection === 'comments') target = v.postId;
+    if (collection === 'registrationCodes') owner = v.batchId;
+    return [owner, target, kind, scope, v.at ?? v.createdAt ?? ''];
+  }
+  remove(collection, key) { this.statement('DELETE FROM documents WHERE collection=? AND key=?').run(collection, String(key)); }
+  // where clauses are fixed SQL fragments supplied only by this module and server code.
+  list(collection, where = '1', args = [], { limit = 100, reverse = false } = {}) {
+    return this.statement(`SELECT data FROM documents WHERE collection=? AND (${where}) ORDER BY rowid ${reverse ? 'DESC' : 'ASC'} LIMIT ?`)
+      .all(collection, ...args, limit).map(row => JSON.parse(row.data));
+  }
+  entries(collection) { return this.statement('SELECT key,data FROM documents WHERE collection=? ORDER BY rowid').all(collection).map(row => [row.key, JSON.parse(row.data)]); }
+  count(collection, where = '1', args = []) { return this.statement(`SELECT count(*) AS n FROM documents WHERE collection=? AND (${where})`).get(collection, ...args).n; }
+  friends(who) { return this.statement('SELECT friend_id FROM friendships WHERE bot_id=? ORDER BY rowid').all(who).map(row => row.friend_id); }
+  befriend(a, b) {
+    const add = this.statement('INSERT OR IGNORE INTO friendships(bot_id,friend_id) VALUES(?,?)');
+    add.run(a, b); add.run(b, a);
+  }
+  saveGroup(group) {
+    this.put('groups', group.id, group);
+    this.statement('DELETE FROM members WHERE group_id=?').run(group.id);
+    const add = this.statement('INSERT INTO members(group_id,bot_id) VALUES(?,?)');
+    for (const who of group.members) add.run(group.id, who);
+  }
+  removeGroup(id) { this.remove('groups', id); this.statement('DELETE FROM members WHERE group_id=?').run(id); }
+  groups(who) {
+    return this.statement(`SELECT d.data FROM members m JOIN documents d ON d.collection='groups' AND d.key=m.group_id WHERE m.bot_id=? ORDER BY d.rowid`)
+      .all(who).map(row => JSON.parse(row.data));
+  }
+  groupCount(who) { return this.statement('SELECT count(*) AS n FROM members WHERE bot_id=?').get(who).n; }
+  messages(who) {
+    const rows = this.statement("SELECT rowid,data FROM documents WHERE collection='messages' AND owner=? ORDER BY rowid DESC LIMIT 200").all(who);
+    rows.push(...this.statement("SELECT rowid,data FROM documents WHERE collection='messages' AND kind='private' AND target=? ORDER BY rowid DESC LIMIT 200").all(who));
+    for (const { group_id } of this.statement('SELECT group_id FROM members WHERE bot_id=?').all(who)) {
+      rows.push(...this.statement("SELECT rowid,data FROM documents WHERE collection='messages' AND kind='group' AND target=? ORDER BY rowid DESC LIMIT 200").all(group_id));
+    }
+    return [...new Map(rows.map(row => [row.rowid, row])).values()].sort((a, b) => b.rowid - a.rowid).slice(0, 200).reverse().map(row => JSON.parse(row.data));
+  }
+  posts(authors) {
+    const rows = [];
+    for (const author of authors) rows.push(...this.statement("SELECT rowid,data FROM documents WHERE collection='posts' AND owner=? AND kind='active' ORDER BY rowid DESC LIMIT 100").all(author));
+    return rows.sort((a, b) => b.rowid - a.rowid).slice(0, 100).reverse().map(row => JSON.parse(row.data));
+  }
+  bottles(who) {
+    const rows = this.statement("SELECT rowid,data FROM documents WHERE collection='bottles' AND owner=? ORDER BY rowid DESC LIMIT 50").all(who);
+    rows.push(...this.statement("SELECT rowid,data FROM documents WHERE collection='bottles' AND target=? ORDER BY rowid DESC LIMIT 50").all(who));
+    return [...new Map(rows.map(row => [row.rowid, row])).values()].sort((a, b) => b.rowid - a.rowid).slice(0, 50).reverse().map(row => JSON.parse(row.data));
+  }
+  emit(recipients, type, data) {
+    const insert = this.statement('INSERT INTO events(recipient,type,at,data) VALUES(?,?,?,?)');
+    const json = JSON.stringify(this.externalize(data)), at = new Date().toISOString();
+    for (const who of recipients) insert.run(who, type, at, json);
+    this.statement('DELETE FROM events WHERE seq <= (SELECT coalesce(max(seq),0)-20000 FROM events)').run();
+  }
+  events(who, since) {
+    return this.statement('SELECT seq,type,at,data FROM events WHERE recipient=? AND seq>? ORDER BY seq LIMIT 100')
+      .all(who, since).map(row => ({ seq: row.seq, to: who, type: row.type, at: row.at, data: JSON.parse(row.data) }));
+  }
+  externalize(value) {
+    if (!value || typeof value !== 'object') return value;
+    if (typeof value.base64 === 'string' && extensions[value.mime]) {
+      const bytes = Buffer.from(value.base64, 'base64');
+      const mediaId = createHash('sha256').update(bytes).digest('hex');
+      const path = this.mediaPath({ mediaId, mime: value.mime });
+      if (!existsSync(path)) {
+        const temp = join(this.mediaDir, `.${randomUUID()}.tmp`);
+        try {
+          writeFileSync(temp, bytes, { mode: 0o600, flag: 'wx', flush: true });
+          renameSync(temp, path);
+          this.pendingMedia?.push(path);
+        } finally { if (existsSync(temp)) unlinkSync(temp); }
+      }
+      return { mime: value.mime, mediaId };
+    }
+    return Array.isArray(value) ? value.map(item => this.externalize(item)) : Object.fromEntries(Object.entries(value).map(([key, item]) => [key, this.externalize(item)]));
+  }
+  mediaPath(image) {
+    if (!/^[a-f0-9]{64}$/.test(image.mediaId) || !extensions[image.mime]) throw new Error('无效图片引用');
+    return join(this.mediaDir, `${image.mediaId}.${extensions[image.mime]}`);
+  }
+  hydrate(value, cache = new Map()) {
+    if (!value || typeof value !== 'object') return value;
+    if (value.mediaId !== undefined) {
+      const path = this.mediaPath(value);
+      if (!cache.has(path)) cache.set(path, readFileSync(path).toString('base64'));
+      return { mime: value.mime, base64: cache.get(path) };
+    }
+    return Array.isArray(value) ? value.map(item => this.hydrate(item, cache)) : Object.fromEntries(Object.entries(value).map(([key, item]) => [key, this.hydrate(item, cache)]));
+  }
+  importLegacy(state) {
+    if (!state || typeof state !== 'object' || Array.isArray(state)) throw new Error('旧数据格式不合法');
+    for (const collection of ['accounts', 'profiles', 'limits']) {
+      for (const [key, value] of Object.entries(state[collection] ?? {})) this.put(collection, key, value);
+    }
+    for (const [who, peers] of Object.entries(state.friends ?? {})) for (const peer of peers) this.befriend(who, peer);
+    for (const request of state.requests ?? []) this.put('requests', `${request.from}:${request.to}`, request);
+    for (const group of Object.values(state.groups ?? {})) this.saveGroup(group);
+    for (const collection of ['messages', 'bottles', 'square']) for (const item of state[collection] ?? []) this.put(collection, item.id, item);
+    for (const post of state.posts ?? []) {
+      const { comments = [], ...data } = post;
+      this.put('posts', post.id, data);
+      for (const comment of comments) this.put('comments', comment.id, { ...comment, postId: post.id });
+    }
+    const insert = this.statement('INSERT INTO events(seq,recipient,type,at,data) VALUES(?,?,?,?,?)');
+    for (const event of state.events ?? []) insert.run(event.seq, event.to, event.type, event.at, JSON.stringify(this.externalize(event.data)));
+    // Preserve cursors even if the old event queue is empty or has been pruned.
+    const high = Math.max(state.seq ?? 0, ...[0, ...(state.events ?? []).map(event => event.seq)]);
+    if (high > 0) {
+      if (!this.statement("SELECT 1 FROM sqlite_sequence WHERE name='events'").get()) this.statement("INSERT INTO sqlite_sequence(name,seq) VALUES('events',?)").run(high);
+      else this.statement("UPDATE sqlite_sequence SET seq=max(seq,?) WHERE name='events'").run(high);
+    }
+    this.put('meta', 'nextBotId', state.nextBotId ?? 10001);
+  }
+  close() { this.db.close(); }
+}