libp2r2p 0.5.0 → 0.6.0

package/README.md

@@ -148,6 +148,16 @@ does not clear persisted messages, recovery material, or channel state. Pass
 `temporaryStorageArea: localStorage` when constructing a messenger to opt into
 a different Storage area.
 
+Recovery metadata is separate from that temporary send staging. Per-channel
+`lastSeenAt`, offline ranges, and related state are stored in IndexedDB. Raw
+incomplete receive chunks are also stored in IndexedDB, expire after one hour,
+and share a 16 MiB logical budget. Capacity eviction removes whole
+least-recently-used message groups so a partial group is never mistaken for a
+complete one. `receivedChunkTtlMs`, `receivedChunkMaxBytes`, and
+`receivedChunkIndexedDB` may be supplied to the private-channel APIs when an
+embedding environment needs different limits or an injected IDB factory.
+Legacy Web Storage recovery records are neither read nor migrated.
+
 Signers are expected to expose the Nostr-style methods used by the messenger,
 including `getPublicKey()`, `signEvent(event)`, and the NIP-44 v3 methods
 needed by private channels. For double-DH content-key use, pass a

package/idb-queue/index.js

@@ -7,6 +7,29 @@ const STATE_KEY = 'queue'
 const DEFAULT_EVICTION_HEADROOM_RATIO = 0.1
 const MAX_EVICTION_HEADROOM_BYTES = 64 * 1024 // 64 KiB
 
+/*
+IndexedDB schema, scoped per queue prefix:
+
+database `${prefix}:idb-queue`, version managed additively
+
+items, keyPath "position"
+  position  integer ordering key between the queue head and tail
+  byteSize  logical serialized size used by the queue capacity limit
+  item      caller-provided queued value
+
+items indexes
+  Declared by each createQueue() caller. A requested keyPath such as "status"
+  is stored as "item.status"; compound paths receive the same "item." prefix.
+  The database version is incremented when declared indexes need to be added.
+
+state, keyPath "key"
+  key        state record name, currently "queue"
+  head/tail  half-open range containing allocated item positions
+  usedBytes  sum of the queued items' logical byte sizes
+
+The queue state record is absent while the queue is empty.
+*/
+
 function deferred () {
   let resolve
   let reject

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libp2r2p",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Peer-to-relay-to-peer",
   "keywords": [
     "p2r2p",

package/private-channel/index.js

@@ -670,14 +670,14 @@ function createProcessor ({
   onError,
   receivedChunkTtlMs = DEFAULT_RECEIVED_CHUNK_TTL_MS,
   receivedChunkMaxBytes = DEFAULT_RECEIVED_CHUNK_MAX_BYTES,
-  receivedChunkStorageArea,
+  receivedChunkIndexedDB = globalThis.indexedDB,
   ignoredGroupTtlMs = DEFAULT_IGNORED_GROUP_TTL_MS,
   ignoredGroupMaxEntries = DEFAULT_IGNORED_GROUP_MAX_ENTRIES
 }) {
   const receivedChunks = createReceivedChunkStore({
     ttlMs: receivedChunkTtlMs,
     maxBytes: receivedChunkMaxBytes,
-    storageArea: receivedChunkStorageArea
+    indexedDB: receivedChunkIndexedDB
   })
   const ignoredGroups = createTtlSet({
     ttlMs: ignoredGroupTtlMs,
@@ -707,14 +707,14 @@ function createProcessor ({
         groupKey = receivedChunks.groupKeyFor(channelPubkey, nymCarrierGroupId(carrier))
         if (ignoredGroups.has(groupKey)) return
 
-        const meta = receivedChunks.put({
+        const meta = await receivedChunks.put({
           channelPubkey,
           routerPubkey: nymCarrierGroupId(carrier),
           index,
           total,
-          content: JSON.stringify(carrier)
+          contentBytes: encoder.encode(JSON.stringify(carrier))
         })
-        const status = receivedChunks.status(meta)
+        const status = await receivedChunks.status(meta)
         onChunk?.({
           outer,
           nymCarrier: carrier,
@@ -726,7 +726,7 @@ function createProcessor ({
         })
         if (status.received < total) return
 
-        const carriers = receivedChunks.readChunkContents(groupKey).map(raw => JSON.parse(raw))
+        const carriers = (await receivedChunks.readChunkContents(groupKey)).map(raw => JSON.parse(raw))
         const event = eventFromNymCarriers(carriers)
         const shouldSeed = storesRecoverySeeds(channelMode)
         if (shouldSeed) {
@@ -744,7 +744,7 @@ function createProcessor ({
           carriers,
           channelPubkey
         })
-        receivedChunks.removeGroup(groupKey)
+        await receivedChunks.removeGroup(groupKey)
         return
       }
       const router = decrypted
@@ -757,14 +757,14 @@ function createProcessor ({
 
       const imkcPubkey = readImkcTag(router)
       assertValidRouterImkcProof({ router, senderPubkey, imkcPubkey, imkcProof: readImkcProof(router) })
-      const meta = receivedChunks.put({
+      const meta = await receivedChunks.put({
         channelPubkey,
         routerPubkey: router.pubkey,
         index,
         total,
-        content: router.content
+        contentBytes: base64ToBytes(router.content)
       })
-      const status = receivedChunks.status(meta)
+      const status = await receivedChunks.status(meta)
       onChunk?.({
         outer,
         router,
@@ -826,15 +826,15 @@ function createProcessor ({
       if (event && !mustScanWholeBundle) {
         await onEvent?.(event, outer, { router: joinedRouter(router), channelPubkey })
         ignoredGroups.add(groupKey)
-        receivedChunks.removeGroup(groupKey)
+        await receivedChunks.removeGroup(groupKey)
         return
       }
 
       if (!drained.complete) return
 
       const receiverPubkeys = drained.meta?.receiverPubkeys || []
-      const content = shouldSeed ? receivedChunks.readEnvelopeBundleContent(groupKey) : ''
-      const jsonl = shouldSeed ? receivedChunks.readEnvelopeBundleText(groupKey) : ''
+      const content = shouldSeed ? await receivedChunks.readEnvelopeBundleContent(groupKey) : ''
+      const jsonl = shouldSeed ? await receivedChunks.readEnvelopeBundleText(groupKey) : ''
       const completeRouter = joinedRouter(router, content)
 
       emitSentContentKeyUsage({
@@ -848,11 +848,11 @@ function createProcessor ({
       if (shouldSeed) await onSeedEvent?.({ recordType: 'routerRow_v1', outer, router: completeRouter, channelPubkey, jsonl, innerEventIdsByRowIndex })
       if (event) await onEvent?.(event, outer, { router: completeRouter, channelPubkey, jsonl })
 
-      receivedChunks.removeGroup(groupKey)
+      await receivedChunks.removeGroup(groupKey)
     } catch (err) {
       if (shouldIgnoreGroupError(err) && groupKey) {
         ignoredGroups.add(groupKey)
-        receivedChunks.removeGroup(groupKey)
+        await receivedChunks.removeGroup(groupKey).catch(() => {})
       }
       onError?.(err)
     }
@@ -875,13 +875,14 @@ function shouldIgnoreGroupError (err) {
     'INVALID_RECIPIENT_ENVELOPE',
     'INVALID_SIGNED_INNER_EVENT',
     'MISSING_PAYLOAD_ENVELOPE',
+    'RECEIVED_CHUNK_GROUP_TOO_LARGE',
     'MISMATCHED_NYM_CARRIER_CHUNKS',
     'MISSING_NYM_CARRIER_CHUNK',
     'MISSING_NYM_CARRIER_ID'
   ].includes(err?.message)
 }
 
-export async function fetch ({ receiverSigner, iykcSigner, privateChannelSigner = receiverSigner, privateChannelSignersByPubkey, privateChannelReaderSigner = privateChannelSigner, privateChannelReaderSignersByPubkey, privateChannelReaderPubkey, privateChannelReaderPubkeysByPubkey, privateChannelPubkey, privateChannelPubkeys, receiverPubkey, relays, onChunk, onEvent, onNymEvent, onSeedEvent, onContentKeyUsage, onError, since, until, limit, mode = 'leecher', modeByPubkey, receivedChunkTtlMs = DEFAULT_RECEIVED_CHUNK_TTL_MS, receivedChunkMaxBytes = DEFAULT_RECEIVED_CHUNK_MAX_BYTES, receivedChunkStorageArea, ignoredGroupTtlMs = DEFAULT_IGNORED_GROUP_TTL_MS, ignoredGroupMaxEntries = DEFAULT_IGNORED_GROUP_MAX_ENTRIES, _getEvents = getEvents }) {
+export async function fetch ({ receiverSigner, iykcSigner, privateChannelSigner = receiverSigner, privateChannelSignersByPubkey, privateChannelReaderSigner = privateChannelSigner, privateChannelReaderSignersByPubkey, privateChannelReaderPubkey, privateChannelReaderPubkeysByPubkey, privateChannelPubkey, privateChannelPubkeys, receiverPubkey, relays, onChunk, onEvent, onNymEvent, onSeedEvent, onContentKeyUsage, onError, since, until, limit, mode = 'leecher', modeByPubkey, receivedChunkTtlMs = DEFAULT_RECEIVED_CHUNK_TTL_MS, receivedChunkMaxBytes = DEFAULT_RECEIVED_CHUNK_MAX_BYTES, receivedChunkIndexedDB = globalThis.indexedDB, ignoredGroupTtlMs = DEFAULT_IGNORED_GROUP_TTL_MS, ignoredGroupMaxEntries = DEFAULT_IGNORED_GROUP_MAX_ENTRIES, _getEvents = getEvents }) {
   if (!relays?.length) throw new Error('NO_RELAYS')
   const authors = privateChannelPubkeyList({ privateChannelPubkey, privateChannelPubkeys })
   const filter = { kinds: [PRIVATE_BROADCAST_KIND] }
@@ -895,12 +896,12 @@ export async function fetch ({ receiverSigner, iykcSigner, privateChannelSigner
     timeoutAfterFirstEose: null
   })
   events.sort((a, b) => a.created_at - b.created_at)
-  const processOuterEvent = createProcessor({ receiverSigner, iykcSigner, privateChannelSigner, privateChannelSignersByPubkey, privateChannelReaderSigner, privateChannelReaderSignersByPubkey, privateChannelReaderPubkey, privateChannelReaderPubkeysByPubkey, receiverPubkey, mode, modeByPubkey, onChunk, onEvent, onNymEvent, onSeedEvent, onContentKeyUsage, onError, receivedChunkTtlMs, receivedChunkMaxBytes, receivedChunkStorageArea, ignoredGroupTtlMs, ignoredGroupMaxEntries })
+  const processOuterEvent = createProcessor({ receiverSigner, iykcSigner, privateChannelSigner, privateChannelSignersByPubkey, privateChannelReaderSigner, privateChannelReaderSignersByPubkey, privateChannelReaderPubkey, privateChannelReaderPubkeysByPubkey, receiverPubkey, mode, modeByPubkey, onChunk, onEvent, onNymEvent, onSeedEvent, onContentKeyUsage, onError, receivedChunkTtlMs, receivedChunkMaxBytes, receivedChunkIndexedDB, ignoredGroupTtlMs, ignoredGroupMaxEntries })
   for (const event of events) await processOuterEvent(event)
   return events
 }
 
-export function subscribe ({ receiverSigner, iykcSigner, privateChannelSigner = receiverSigner, privateChannelSignersByPubkey, privateChannelReaderSigner = privateChannelSigner, privateChannelReaderSignersByPubkey, privateChannelReaderPubkey, privateChannelReaderPubkeysByPubkey, privateChannelPubkey, privateChannelPubkeys, receiverPubkey, relays, onChunk, onEvent, onNymEvent, onSeedEvent, onContentKeyUsage, onError, since = nowSeconds() - 5, limit, liveOnly = false, mode = 'leecher', modeByPubkey, receivedChunkTtlMs = DEFAULT_RECEIVED_CHUNK_TTL_MS, receivedChunkMaxBytes = DEFAULT_RECEIVED_CHUNK_MAX_BYTES, receivedChunkStorageArea, ignoredGroupTtlMs = DEFAULT_IGNORED_GROUP_TTL_MS, ignoredGroupMaxEntries = DEFAULT_IGNORED_GROUP_MAX_ENTRIES, _liveEventsGenerator = getLiveEventsGenerator, _eventsFeedGenerator = getEventsFeedGenerator }) {
+export function subscribe ({ receiverSigner, iykcSigner, privateChannelSigner = receiverSigner, privateChannelSignersByPubkey, privateChannelReaderSigner = privateChannelSigner, privateChannelReaderSignersByPubkey, privateChannelReaderPubkey, privateChannelReaderPubkeysByPubkey, privateChannelPubkey, privateChannelPubkeys, receiverPubkey, relays, onChunk, onEvent, onNymEvent, onSeedEvent, onContentKeyUsage, onError, since = nowSeconds() - 5, limit, liveOnly = false, mode = 'leecher', modeByPubkey, receivedChunkTtlMs = DEFAULT_RECEIVED_CHUNK_TTL_MS, receivedChunkMaxBytes = DEFAULT_RECEIVED_CHUNK_MAX_BYTES, receivedChunkIndexedDB = globalThis.indexedDB, ignoredGroupTtlMs = DEFAULT_IGNORED_GROUP_TTL_MS, ignoredGroupMaxEntries = DEFAULT_IGNORED_GROUP_MAX_ENTRIES, _liveEventsGenerator = getLiveEventsGenerator, _eventsFeedGenerator = getEventsFeedGenerator }) {
   if (!relays?.length) throw new Error('NO_RELAYS')
   if (receiverSigner && !receiverSigner?.nip44DecryptDoubleDH && !receiverSigner?.nip44v3Decrypt) throw new Error('RECEIVER_SIGNER_NIP44V3_DECRYPT_UNSUPPORTED')
   if (!privateChannelReaderSigner && !privateChannelReaderSignersByPubkey && !privateChannelSigner && !privateChannelSignersByPubkey) throw new Error('PRIVATE_CHANNEL_READER_REQUIRED')
@@ -909,7 +910,7 @@ export function subscribe ({ receiverSigner, iykcSigner, privateChannelSigner =
   const filter = { kinds: [PRIVATE_BROADCAST_KIND], since }
   if (authors.length) filter.authors = authors
   if (limit != null) filter.limit = limit
-  const processOuterEvent = createProcessor({ receiverSigner, iykcSigner, privateChannelSigner, privateChannelSignersByPubkey, privateChannelReaderSigner, privateChannelReaderSignersByPubkey, privateChannelReaderPubkey, privateChannelReaderPubkeysByPubkey, receiverPubkey, mode, modeByPubkey, onChunk, onEvent, onNymEvent, onSeedEvent, onContentKeyUsage, onError, receivedChunkTtlMs, receivedChunkMaxBytes, receivedChunkStorageArea, ignoredGroupTtlMs, ignoredGroupMaxEntries })
+  const processOuterEvent = createProcessor({ receiverSigner, iykcSigner, privateChannelSigner, privateChannelSignersByPubkey, privateChannelReaderSigner, privateChannelReaderSignersByPubkey, privateChannelReaderPubkey, privateChannelReaderPubkeysByPubkey, receiverPubkey, mode, modeByPubkey, onChunk, onEvent, onNymEvent, onSeedEvent, onContentKeyUsage, onError, receivedChunkTtlMs, receivedChunkMaxBytes, receivedChunkIndexedDB, ignoredGroupTtlMs, ignoredGroupMaxEntries })
   const controller = new AbortController()
   const events = liveOnly
     ? _liveEventsGenerator(filter, relays, {

package/private-channel/services/received-chunks.js

@@ -1,34 +1,115 @@
-import { base64ToBytes, bytesToBase64 } from '../../base64/index.js'
-import { JSONL_CHUNK_BYTES } from '../helpers/chunk-size.js'
+import { bytesToBase64 } from '../../base64/index.js'
+import { run } from '../../idb/index.js'
 
 export const DEFAULT_RECEIVED_CHUNK_TTL_MS = 60 * 60 * 1000 // 1 hour
-// For illustration purposes: A 280-character rumor would take approximately
-// 23 chunks (~0.65 MiB) to be sent if encrypted to 1000 participants.
-export const DEFAULT_RECEIVED_CHUNK_MAX_BYTES = Math.min(JSONL_CHUNK_BYTES * 64, 3 * 1024 * 1024 /* 3 MiB cap */)
+export const DEFAULT_RECEIVED_CHUNK_MAX_BYTES = 16 * 1024 * 1024 // 16 MiB
 
 const DEFAULT_PREFIX = 'libp2r2p:private-channel:received'
-const encoder = new TextEncoder()
+const DATABASE_VERSION = 1
+const GROUPS_STORE = 'groups'
+const CHUNKS_STORE = 'chunks'
+const STATE_STORE = 'state'
+const USAGE_KEY = 'usage'
+const DRAIN_LEASE_MS = 30_000
 const decoder = new TextDecoder()
 
-// Receive buffers survive reloads briefly, unlike send-side temporary chunks.
-// Stale cleanup handles peers that never publish the remaining chunks.
+/*
+IndexedDB schema, scoped per received-chunk prefix:
+
+database `${prefix}:idb`, version 1
+
+groups, keyPath "groupKey"
+  groupKey                  `${channelPubkey}:${routerPubkey}`
+  channelPubkey/routerPubkey private-channel coordinates
+  total                     expected chunk count
+  received/receivedCount    sparse received-index map and its count
+  nextIndex/rowIndex/carry  incremental payload decoding state
+  payloadCiphertext         accumulated encrypted payload text
+  receiverPubkeys           deduplicated intended receivers
+  byteSize                  logical bytes charged to this group
+  createdAt/updatedAt        lifecycle timestamps in milliseconds
+  drainToken/drainUntil      optional drain lease owner and expiry
+
+groups indexes
+  byUpdatedAt  updatedAt
+
+chunks, keyPath ["groupKey", "index"]
+  groupKey  owning group coordinate
+  index     zero-based chunk position
+  bytes     raw chunk bytes stored as Uint8Array
+
+chunks indexes
+  byGroup  groupKey
+
+state, keyPath "key"
+  key        state record name, currently "usage"
+  usedBytes  total logical bytes held by all groups
+*/
+
+function deferred () {
+  let resolve
+  let reject
+  const promise = new Promise((nextResolve, nextReject) => {
+    resolve = nextResolve
+    reject = nextReject
+  })
+  return { promise, resolve, reject }
+}
+
+function transactionDone (tx) {
+  const p = deferred()
+  tx.oncomplete = () => p.resolve()
+  tx.onabort = () => p.reject(tx.error || new Error('IDB_TRANSACTION_ABORTED'))
+  tx.onerror = () => p.reject(tx.error || new Error('IDB_TRANSACTION_FAILED'))
+  return p.promise
+}
+
+function openDatabase (indexedDB, name) {
+  if (!indexedDB?.open) return Promise.reject(new Error('IDB_UNAVAILABLE'))
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(name, DATABASE_VERSION)
+    request.onerror = () => reject(request.error || new Error('IDB_OPEN_FAILED'))
+    request.onblocked = () => reject(new Error('IDB_DATABASE_BLOCKED'))
+    request.onupgradeneeded = () => {
+      const db = request.result
+      const tx = request.transaction
+      let groups
+      if (!db.objectStoreNames.contains(GROUPS_STORE)) {
+        groups = db.createObjectStore(GROUPS_STORE, { keyPath: 'groupKey' })
+      } else {
+        groups = tx.objectStore(GROUPS_STORE)
+      }
+      if (!groups.indexNames.contains('byUpdatedAt')) groups.createIndex('byUpdatedAt', 'updatedAt')
+
+      let chunks
+      if (!db.objectStoreNames.contains(CHUNKS_STORE)) {
+        chunks = db.createObjectStore(CHUNKS_STORE, { keyPath: ['groupKey', 'index'] })
+      } else {
+        chunks = tx.objectStore(CHUNKS_STORE)
+      }
+      if (!chunks.indexNames.contains('byGroup')) chunks.createIndex('byGroup', 'groupKey')
 
-function byteLength (value) {
-  return encoder.encode(String(value)).length
+      if (!db.objectStoreNames.contains(STATE_STORE)) db.createObjectStore(STATE_STORE, { keyPath: 'key' })
+    }
+    request.onsuccess = () => {
+      const db = request.result
+      db.onversionchange = () => db.close()
+      resolve(db)
+    }
+  })
 }
 
-function parseJson (raw, fallback) {
-  try { return JSON.parse(raw || '') } catch { return fallback }
+function normalizeBytes (value) {
+  if (value instanceof Uint8Array) return new Uint8Array(value)
+  if (value instanceof ArrayBuffer) return new Uint8Array(value)
+  if (ArrayBuffer.isView(value)) return new Uint8Array(value.buffer, value.byteOffset, value.byteLength)
+  throw new Error('RECEIVED_CHUNK_BYTES_REQUIRED')
 }
 
 function uniq (values) {
   return [...new Set((values || []).filter(Boolean))]
 }
 
-function normalizeGroupKeys (value) {
-  return Array.isArray(value) ? uniq(value.filter(key => typeof key === 'string' && key)) : []
-}
-
 function normalizeReceived (received) {
   if (!received || typeof received !== 'object' || Array.isArray(received)) return {}
   return Object.fromEntries(
@@ -38,14 +119,14 @@ function normalizeReceived (received) {
   )
 }
 
-function normalizeMeta (meta, groupKey) {
+function normalizeMeta (meta) {
   if (!meta || typeof meta !== 'object') return null
   const total = Number(meta.total)
   const nextIndex = Number(meta.nextIndex)
   const rowIndex = Number(meta.rowIndex)
-  if (!Number.isSafeInteger(total) || total < 1) return null
+  if (!meta.groupKey || !Number.isSafeInteger(total) || total < 1) return null
   return {
-    groupKey,
+    groupKey: String(meta.groupKey),
     channelPubkey: String(meta.channelPubkey || ''),
     routerPubkey: String(meta.routerPubkey || ''),
     total,
@@ -55,10 +136,19 @@ function normalizeMeta (meta, groupKey) {
     rowIndex: Number.isSafeInteger(rowIndex) && rowIndex >= 0 ? rowIndex : 0,
     carry: typeof meta.carry === 'string' ? meta.carry : '',
     payloadCiphertext: typeof meta.payloadCiphertext === 'string' ? meta.payloadCiphertext : '',
-    receiverPubkeys: uniq(meta.receiverPubkeys || []),
+    receiverPubkeys: uniq(meta.receiverPubkeys),
     byteSize: Math.max(0, Number(meta.byteSize) || 0),
     createdAt: Number(meta.createdAt) || Date.now(),
-    updatedAt: Number(meta.updatedAt) || Date.now()
+    updatedAt: Number(meta.updatedAt) || Date.now(),
+    drainToken: typeof meta.drainToken === 'string' ? meta.drainToken : '',
+    drainUntil: Math.max(0, Number(meta.drainUntil) || 0)
+  }
+}
+
+function normalizeUsage (value) {
+  return {
+    key: USAGE_KEY,
+    usedBytes: Number.isSafeInteger(value?.usedBytes) && value.usedBytes >= 0 ? value.usedBytes : 0
   }
 }
 
@@ -70,217 +160,218 @@ function isQuotaExceeded (err) {
     /quota/i.test(err?.message || '')
 }
 
-function joinBase64Chunks (parts) {
-  let out = ''
-  let carry = new Uint8Array()
-
-  for (const part of parts) {
-    const bytes = base64ToBytes(part)
-    const joined = new Uint8Array(carry.length + bytes.length)
-    joined.set(carry)
-    joined.set(bytes, carry.length)
-
-    const completeLength = joined.length - (joined.length % 3)
-    if (completeLength) out += bytesToBase64(joined.slice(0, completeLength))
-    carry = joined.slice(completeLength)
-  }
+function randomToken () {
+  const bytes = globalThis.crypto?.getRandomValues?.(new Uint8Array(16))
+  if (bytes) return [...bytes].map(value => value.toString(16).padStart(2, '0')).join('')
+  return `${Date.now().toString(16)}:${Math.random().toString(16).slice(2)}`
+}
 
-  if (carry.length) out += bytesToBase64(carry)
-  return out
+function wait (ms) {
+  return new Promise(resolve => setTimeout(resolve, ms))
 }
 
 export function createReceivedChunkStore ({
   prefix = DEFAULT_PREFIX,
-  storageArea = globalThis.localStorage,
+  indexedDB = globalThis.indexedDB,
   ttlMs = DEFAULT_RECEIVED_CHUNK_TTL_MS,
   maxBytes = DEFAULT_RECEIVED_CHUNK_MAX_BYTES
 } = {}) {
-  const groupsKey = `${prefix}:groups`
   const configuredTtlMs = Number.isFinite(ttlMs) && ttlMs >= 0 ? ttlMs : DEFAULT_RECEIVED_CHUNK_TTL_MS
   const configuredMaxBytes = Number.isFinite(maxBytes) && maxBytes > 0 ? maxBytes : Infinity
+  let dbPromise
+  let readyPromise
 
-  function storage () {
-    return storageArea
-  }
-
-  function metaKey (groupKey) {
-    return `${prefix}:group:${groupKey}:meta`
+  function database () {
+    dbPromise ||= openDatabase(indexedDB, `${prefix}:idb`)
+    return dbPromise
   }
 
-  function chunkKey (groupKey, index) {
-    return `${prefix}:group:${groupKey}:chunk:${index}`
+  async function transaction (storeNames, mode, work) {
+    const db = await database()
+    const tx = db.transaction(storeNames, mode)
+    const done = transactionDone(tx)
+    try {
+      // `work` may await only IDB requests issued through `run` with this tx.
+      const result = await work(tx)
+      await done
+      return result
+    } catch (err) {
+      try { tx.abort() } catch {}
+      try { await done } catch {}
+      throw err
+    }
   }
 
   function groupKeyFor (channelPubkey, routerPubkey) {
     return `${channelPubkey}:${routerPubkey}`
   }
 
-  function readGroupKeys () {
-    return normalizeGroupKeys(parseJson(storage().getItem(groupsKey), []))
+  async function readUsage (tx) {
+    return normalizeUsage((await run('get', [USAGE_KEY], STATE_STORE, null, { tx })).result)
   }
 
-  function writeGroupKeys (keys) {
-    const normalized = normalizeGroupKeys(keys)
-    if (normalized.length) storage().setItem(groupsKey, JSON.stringify(normalized))
-    else storage().removeItem(groupsKey)
+  async function writeUsage (tx, usage) {
+    await run('put', [normalizeUsage(usage)], STATE_STORE, null, { tx })
   }
 
-  function addGroupKey (groupKey) {
-    const keys = readGroupKeys()
-    if (!keys.includes(groupKey)) writeGroupKeys(keys.concat(groupKey))
+  async function deleteGroupInTransaction (tx, groupKey, usage, knownMeta) {
+    const meta = knownMeta || normalizeMeta((await run('get', [groupKey], GROUPS_STORE, null, { tx })).result)
+    const keys = (await run('getAllKeys', [globalThis.IDBKeyRange?.only?.(groupKey) ?? groupKey], CHUNKS_STORE, 'byGroup', { tx })).result
+    for (const key of keys) await run('delete', [key], CHUNKS_STORE, null, { tx })
+    await run('delete', [groupKey], GROUPS_STORE, null, { tx })
+    if (usage && meta) usage.usedBytes = Math.max(0, usage.usedBytes - meta.byteSize)
+    return Boolean(meta || keys.length)
   }
 
-  function removeGroupKey (groupKey) {
-    writeGroupKeys(readGroupKeys().filter(key => key !== groupKey))
+  async function oldestGroupsInTransaction (tx, except = '') {
+    const values = (await run('getAll', [], GROUPS_STORE, null, { tx })).result
+    return values
+      .map(normalizeMeta)
+      .filter(meta => meta && meta.groupKey !== except)
+      .sort((left, right) => left.updatedAt - right.updatedAt || left.groupKey.localeCompare(right.groupKey))
   }
 
-  function readMeta (groupKey) {
-    return normalizeMeta(parseJson(storage().getItem(metaKey(groupKey)), null), groupKey)
-  }
-
-  function writeMeta (meta) {
-    storage().setItem(metaKey(meta.groupKey), JSON.stringify(meta))
-  }
-
-  function removeGroup (groupKey) {
-    const meta = readMeta(groupKey)
-    if (meta) {
-      for (const index of Object.keys(meta.received)) {
-        storage().removeItem(chunkKey(groupKey, index))
+  async function cleanupStaleRaw (nowMs = Date.now()) {
+    const cutoff = nowMs - configuredTtlMs
+    return transaction([GROUPS_STORE, CHUNKS_STORE, STATE_STORE], 'readwrite', async tx => {
+      const usage = await readUsage(tx)
+      const groups = await oldestGroupsInTransaction(tx)
+      let removed = 0
+      for (const meta of groups) {
+        if (meta.updatedAt > cutoff && (!Number.isFinite(configuredMaxBytes) || usage.usedBytes <= configuredMaxBytes)) continue
+        await deleteGroupInTransaction(tx, meta.groupKey, usage, meta)
+        removed++
       }
-    }
-    storage().removeItem(metaKey(groupKey))
-    removeGroupKey(groupKey)
+      await writeUsage(tx, usage)
+      return removed
+    })
   }
 
-  function allMetas () {
-    const keys = readGroupKeys()
-    const metas = []
-    const liveKeys = []
-    for (const groupKey of keys) {
-      const meta = readMeta(groupKey)
-      if (!meta) continue
-      metas.push(meta)
-      liveKeys.push(groupKey)
-    }
-    if (liveKeys.length !== keys.length) writeGroupKeys(liveKeys)
-    return metas
+  function ready () {
+    readyPromise ||= cleanupStaleRaw()
+    return readyPromise
   }
 
-  function totalStoredBytes () {
-    return allMetas().reduce((total, meta) => {
-      return total + meta.byteSize + byteLength(JSON.stringify(meta))
-    }, 0)
+  async function cleanupStale (nowMs = Date.now()) {
+    await ready()
+    return cleanupStaleRaw(nowMs)
   }
 
-  function oldestGroupKey ({ except } = {}) {
-    return allMetas()
-      .filter(meta => meta.groupKey !== except)
-      .sort((a, b) => a.updatedAt - b.updatedAt)[0]?.groupKey || ''
-  }
+  async function putOnce ({ channelPubkey, routerPubkey, index, total, contentBytes }) {
+    const groupKey = groupKeyFor(channelPubkey, routerPubkey)
+    const bytes = normalizeBytes(contentBytes)
+    const now = Date.now()
 
-  function evictOldestUntilFits (requiredBytes = 0, { except } = {}) {
-    if (!Number.isFinite(configuredMaxBytes)) return
-    while (totalStoredBytes() + requiredBytes > configuredMaxBytes) {
-      const groupKey = oldestGroupKey({ except })
-      if (!groupKey) break
-      removeGroup(groupKey)
-    }
-  }
+    return transaction([GROUPS_STORE, CHUNKS_STORE, STATE_STORE], 'readwrite', async tx => {
+      const usage = await readUsage(tx)
+      let meta = normalizeMeta((await run('get', [groupKey], GROUPS_STORE, null, { tx })).result)
+      const staleCutoff = now - configuredTtlMs
+      if (meta && meta.updatedAt <= staleCutoff) {
+        await deleteGroupInTransaction(tx, groupKey, usage, meta)
+        meta = null
+      }
+      if (meta && meta.total !== total) {
+        await deleteGroupInTransaction(tx, groupKey, usage, meta)
+        meta = null
+      }
+      if (!meta) {
+        meta = normalizeMeta({
+          groupKey,
+          channelPubkey,
+          routerPubkey,
+          total,
+          received: {},
+          receivedCount: 0,
+          nextIndex: 0,
+          rowIndex: 0,
+          carry: '',
+          payloadCiphertext: '',
+          receiverPubkeys: [],
+          byteSize: 0,
+          createdAt: now,
+          updatedAt: now
+        })
+      }
 
-  function writeChunk (key, value, requiredBytes, except) {
-    evictOldestUntilFits(requiredBytes, { except })
-    try {
-      storage().setItem(key, value)
-      return
-    } catch (err) {
-      if (!isQuotaExceeded(err)) throw err
-    }
+      const existing = (await run('get', [[groupKey, index]], CHUNKS_STORE, null, { tx })).result
+      if (!existing) {
+        if (bytes.byteLength > configuredMaxBytes || meta.byteSize + bytes.byteLength > configuredMaxBytes) {
+          await deleteGroupInTransaction(tx, groupKey, usage, meta)
+          await writeUsage(tx, usage)
+          return { tooLarge: true, meta: null }
+        }
 
-    let groupKey = oldestGroupKey({ except })
-    while (groupKey) {
-      removeGroup(groupKey)
-      try {
-        storage().setItem(key, value)
-        return
-      } catch (err) {
-        if (!isQuotaExceeded(err)) throw err
+        const requiredBytes = bytes.byteLength
+        const candidates = await oldestGroupsInTransaction(tx, groupKey)
+        for (const candidate of candidates) {
+          if (candidate.updatedAt > staleCutoff) continue
+          await deleteGroupInTransaction(tx, candidate.groupKey, usage, candidate)
+        }
+        for (const candidate of candidates) {
+          if (candidate.updatedAt <= staleCutoff) continue
+          if (!Number.isFinite(configuredMaxBytes) || usage.usedBytes + requiredBytes <= configuredMaxBytes) break
+          await deleteGroupInTransaction(tx, candidate.groupKey, usage, candidate)
+        }
+        if (Number.isFinite(configuredMaxBytes) && usage.usedBytes + requiredBytes > configuredMaxBytes) {
+          await deleteGroupInTransaction(tx, groupKey, usage, meta)
+          await writeUsage(tx, usage)
+          return { tooLarge: true, meta: null }
+        }
+
+        await run('put', [{ groupKey, index, bytes }], CHUNKS_STORE, null, { tx })
+        meta.received[String(index)] = true
+        meta.receivedCount++
+        meta.byteSize += requiredBytes
+        usage.usedBytes += requiredBytes
       }
-      groupKey = oldestGroupKey({ except })
-    }
 
-    storage().setItem(key, value)
+      meta.total = total
+      meta.updatedAt = now
+      await run('put', [meta], GROUPS_STORE, null, { tx })
+      await writeUsage(tx, usage)
+      return { tooLarge: false, meta }
+    })
   }
 
-  function cleanupStale (nowMs = Date.now()) {
-    const cutoff = nowMs - configuredTtlMs
-    for (const meta of allMetas()) {
-      if (meta.updatedAt <= cutoff) removeGroup(meta.groupKey)
-    }
-    evictOldestUntilFits(0)
+  async function evictOldestGroup (except = '') {
+    return transaction([GROUPS_STORE, CHUNKS_STORE, STATE_STORE], 'readwrite', async tx => {
+      const usage = await readUsage(tx)
+      const oldest = (await oldestGroupsInTransaction(tx, except))[0]
+      if (!oldest) return false
+      await deleteGroupInTransaction(tx, oldest.groupKey, usage, oldest)
+      await writeUsage(tx, usage)
+      return true
+    })
   }
 
-  function put ({ channelPubkey, routerPubkey, index, total, content }) {
+  async function put ({ channelPubkey, routerPubkey, index, total, contentBytes }) {
     if (!channelPubkey || !routerPubkey) throw new Error('RECEIVED_CHUNK_GROUP_REQUIRED')
     if (!Number.isSafeInteger(index) || !Number.isSafeInteger(total) || index < 0 || total < 1 || index >= total) {
       throw new Error('INVALID_RECEIVED_CHUNK_INDEX')
     }
-
-    cleanupStale()
-
-    const groupKey = groupKeyFor(channelPubkey, routerPubkey)
-    const now = Date.now()
-    const chunk = String(content || '')
-    const nextBytes = byteLength(chunk)
-    let meta = readMeta(groupKey)
-
-    if (meta && meta.total !== total) {
-      removeGroup(groupKey)
-      meta = null
-    }
-
-    if (!meta) {
-      meta = normalizeMeta({
-        channelPubkey,
-        routerPubkey,
-        total,
-        received: {},
-        receivedCount: 0,
-        nextIndex: 0,
-        rowIndex: 0,
-        carry: '',
-        payloadCiphertext: '',
-        receiverPubkeys: [],
-        byteSize: 0,
-        createdAt: now,
-        updatedAt: now
-      }, groupKey)
-      addGroupKey(groupKey)
-      writeMeta(meta)
-    }
-
-    if (!meta.received[String(index)]) {
-      if (meta.byteSize + nextBytes > configuredMaxBytes) {
-        removeGroup(groupKey)
-        throw new Error('RECEIVED_CHUNK_GROUP_TOO_LARGE')
+    const bytes = normalizeBytes(contentBytes)
+    await ready()
+    while (true) {
+      try {
+        const result = await putOnce({ channelPubkey, routerPubkey, index, total, contentBytes: bytes })
+        if (result.tooLarge) throw new Error('RECEIVED_CHUNK_GROUP_TOO_LARGE')
+        return result.meta
+      } catch (err) {
+        if (!isQuotaExceeded(err) || !await evictOldestGroup(groupKeyFor(channelPubkey, routerPubkey))) throw err
       }
-      writeChunk(chunkKey(groupKey, index), chunk, nextBytes, groupKey)
-      meta.received[String(index)] = true
-      meta.receivedCount++
-      meta.byteSize += nextBytes
     }
+  }
 
-    meta.total = total
-    meta.updatedAt = now
-    writeMeta(meta)
-    evictOldestUntilFits(0, { except: groupKey })
-    return meta
+  async function readMeta (groupKey) {
+    await ready()
+    return transaction([GROUPS_STORE], 'readonly', async tx => {
+      return normalizeMeta((await run('get', [groupKey], GROUPS_STORE, null, { tx })).result)
+    })
   }
 
-  function status (metaOrGroupKey) {
-    const meta = typeof metaOrGroupKey === 'string' ? readMeta(metaOrGroupKey) : metaOrGroupKey
+  async function status (metaOrGroupKey) {
+    const meta = typeof metaOrGroupKey === 'string' ? await readMeta(metaOrGroupKey) : normalizeMeta(metaOrGroupKey)
     if (!meta) return { received: 0, missing: [] }
-
     const missing = []
     let received = 0
     for (let index = 0; index < meta.total; index++) {
@@ -291,98 +382,174 @@ export function createReceivedChunkStore ({
   }
 
   function rememberReceiverPubkey (meta, pubkey) {
-    if (!pubkey || meta.receiverPubkeys.includes(pubkey)) return
-    meta.receiverPubkeys.push(pubkey)
+    if (pubkey && !meta.receiverPubkeys.includes(pubkey)) meta.receiverPubkeys.push(pubkey)
   }
 
   function rememberPayloadCiphertext (meta, ciphertext) {
     if (!meta.payloadCiphertext) meta.payloadCiphertext = ciphertext
   }
 
-  async function drainAvailable (groupKey, { onLine } = {}) {
-    const meta = readMeta(groupKey)
-    if (!meta) return { complete: false, stopped: false, meta: null }
+  async function claimDrain (groupKey, token) {
+    while (true) {
+      const now = Date.now()
+      const result = await transaction([GROUPS_STORE], 'readwrite', async tx => {
+        const meta = normalizeMeta((await run('get', [groupKey], GROUPS_STORE, null, { tx })).result)
+        if (!meta) return { meta: null, waitMs: 0 }
+        if (meta.drainToken && meta.drainToken !== token && meta.drainUntil > now) {
+          return { meta: null, waitMs: Math.min(DRAIN_LEASE_MS, meta.drainUntil - now) }
+        }
+        meta.drainToken = token
+        meta.drainUntil = now + DRAIN_LEASE_MS
+        await run('put', [meta], GROUPS_STORE, null, { tx })
+        return { meta, waitMs: 0 }
+      })
+      if (!result.waitMs) return result.meta
+      await wait(result.waitMs)
+    }
+  }
 
-    while (meta.nextIndex < meta.total) {
-      const index = meta.nextIndex
-      const raw = storage().getItem(chunkKey(groupKey, index))
-      if (raw == null) break
+  async function readDrainChunk (groupKey, token) {
+    return transaction([GROUPS_STORE, CHUNKS_STORE], 'readonly', async tx => {
+      const meta = normalizeMeta((await run('get', [groupKey], GROUPS_STORE, null, { tx })).result)
+      if (!meta || meta.drainToken !== token) return { meta: null, bytes: null }
+      if (meta.nextIndex >= meta.total) return { meta, bytes: null }
+      const chunk = (await run('get', [[groupKey, meta.nextIndex]], CHUNKS_STORE, null, { tx })).result
+      return { meta, bytes: chunk ? normalizeBytes(chunk.bytes) : null }
+    })
+  }
+
+  async function commitDrainMeta (nextMeta, token) {
+    return transaction([GROUPS_STORE], 'readwrite', async tx => {
+      const current = normalizeMeta((await run('get', [nextMeta.groupKey], GROUPS_STORE, null, { tx })).result)
+      if (!current || current.drainToken !== token) return null
+      current.nextIndex = nextMeta.nextIndex
+      current.rowIndex = nextMeta.rowIndex
+      current.carry = nextMeta.carry
+      current.payloadCiphertext = nextMeta.payloadCiphertext
+      current.receiverPubkeys = uniq(nextMeta.receiverPubkeys)
+      current.updatedAt = nextMeta.updatedAt
+      current.drainUntil = Date.now() + DRAIN_LEASE_MS
+      await run('put', [current], GROUPS_STORE, null, { tx })
+      return current
+    })
+  }
 
-      const text = `${meta.carry}${decoder.decode(base64ToBytes(raw))}`
-      let start = 0
-      let end = text.indexOf('\n', start)
+  async function releaseDrain (groupKey, token) {
+    return transaction([GROUPS_STORE], 'readwrite', async tx => {
+      const meta = normalizeMeta((await run('get', [groupKey], GROUPS_STORE, null, { tx })).result)
+      if (!meta || meta.drainToken !== token) return false
+      meta.drainToken = ''
+      meta.drainUntil = 0
+      await run('put', [meta], GROUPS_STORE, null, { tx })
+      return true
+    })
+  }
+
+  async function drainAvailable (groupKey, { onLine } = {}) {
+    await ready()
+    const token = randomToken()
+    let meta = await claimDrain(groupKey, token)
+    if (!meta) return { complete: false, stopped: false, meta: null }
+    try {
+      while (meta.nextIndex < meta.total) {
+        const snapshot = await readDrainChunk(groupKey, token)
+        meta = snapshot.meta
+        if (!meta || !snapshot.bytes) break
+
+        const text = `${meta.carry}${decoder.decode(snapshot.bytes)}`
+        let start = 0
+        let end = text.indexOf('\n', start)
+        while (end !== -1) {
+          const line = text.slice(start, end)
+          start = end + 1
+          if (line) {
+            const result = await onLine?.(line, meta.rowIndex, meta, { rememberPayloadCiphertext, rememberReceiverPubkey })
+            meta.rowIndex++
+            if (result?.stop) {
+              meta.updatedAt = Date.now()
+              meta = await commitDrainMeta(meta, token)
+              return { complete: false, stopped: true, meta }
+            }
+          }
+          end = text.indexOf('\n', start)
+        }
+        meta.carry = text.slice(start)
+        meta.nextIndex++
+        meta.updatedAt = Date.now()
+        meta = await commitDrainMeta(meta, token)
+        if (!meta) break
+      }
 
-      while (end !== -1) {
-        const line = text.slice(start, end)
-        start = end + 1
-        if (line) {
-          const result = await onLine?.(line, meta.rowIndex, meta, { rememberPayloadCiphertext, rememberReceiverPubkey })
+      if (meta && meta.nextIndex >= meta.total) {
+        if (meta.carry) {
+          const result = await onLine?.(meta.carry, meta.rowIndex, meta, { rememberPayloadCiphertext, rememberReceiverPubkey })
           meta.rowIndex++
+          meta.carry = ''
           if (result?.stop) {
             meta.updatedAt = Date.now()
-            writeMeta(meta)
+            meta = await commitDrainMeta(meta, token)
             return { complete: false, stopped: true, meta }
           }
         }
-        end = text.indexOf('\n', start)
+        meta.updatedAt = Date.now()
+        meta = await commitDrainMeta(meta, token)
+        return { complete: Boolean(meta), stopped: false, meta }
       }
-
-      meta.carry = text.slice(start)
-
-      meta.nextIndex++
-      meta.updatedAt = Date.now()
-      writeMeta(meta)
+      return { complete: false, stopped: false, meta }
+    } finally {
+      await releaseDrain(groupKey, token).catch(() => {})
     }
+  }
 
-    if (meta.nextIndex >= meta.total) {
-      if (meta.carry) {
-        const result = await onLine?.(meta.carry, meta.rowIndex, meta, { rememberPayloadCiphertext, rememberReceiverPubkey })
-        meta.rowIndex++
-        meta.carry = ''
-        if (result?.stop) {
-          meta.updatedAt = Date.now()
-          writeMeta(meta)
-          return { complete: false, stopped: true, meta }
-        }
+  async function readChunkBytes (groupKey) {
+    await ready()
+    return transaction([GROUPS_STORE, CHUNKS_STORE], 'readonly', async tx => {
+      const meta = normalizeMeta((await run('get', [groupKey], GROUPS_STORE, null, { tx })).result)
+      if (!meta) return { meta: null, chunks: [] }
+      const chunks = []
+      for (let index = 0; index < meta.total; index++) {
+        const chunk = (await run('get', [[groupKey, index]], CHUNKS_STORE, null, { tx })).result
+        if (!chunk) throw new Error('RECEIVED_CHUNK_MISSING')
+        chunks.push(normalizeBytes(chunk.bytes))
       }
-      meta.updatedAt = Date.now()
-      writeMeta(meta)
-      return { complete: true, stopped: false, meta }
-    }
-
-    return { complete: false, stopped: false, meta }
+      return { meta, chunks }
+    })
   }
 
-  function readEnvelopeBundleContent (groupKey) {
-    const meta = readMeta(groupKey)
-    if (!meta) return ''
-    const parts = []
-    for (let index = 0; index < meta.total; index++) {
-      const chunk = storage().getItem(chunkKey(groupKey, index))
-      if (chunk == null) throw new Error('RECEIVED_CHUNK_MISSING')
-      parts.push(chunk)
-    }
-    return joinBase64Chunks(parts)
+  async function readChunkContents (groupKey) {
+    return (await readChunkBytes(groupKey)).chunks.map(bytes => decoder.decode(bytes))
   }
 
-  function readEnvelopeBundleText (groupKey) {
-    const content = readEnvelopeBundleContent(groupKey)
-    return decoder.decode(base64ToBytes(content))
+  async function readEnvelopeBundleContent (groupKey) {
+    const { chunks } = await readChunkBytes(groupKey)
+    return bytesToBase64(joinChunks(chunks))
   }
 
-  function readChunkContents (groupKey) {
-    const meta = readMeta(groupKey)
-    if (!meta) return []
-    const parts = []
-    for (let index = 0; index < meta.total; index++) {
-      const chunk = storage().getItem(chunkKey(groupKey, index))
-      if (chunk == null) throw new Error('RECEIVED_CHUNK_MISSING')
-      parts.push(chunk)
+  function joinChunks (chunks) {
+    let length = 0
+    for (const chunk of chunks) length += chunk.byteLength
+    const joined = new Uint8Array(length)
+    let offset = 0
+    for (const chunk of chunks) {
+      joined.set(chunk, offset)
+      offset += chunk.byteLength
     }
-    return parts
+    return joined
   }
 
-  cleanupStale()
+  async function readEnvelopeBundleText (groupKey) {
+    return decoder.decode(joinChunks((await readChunkBytes(groupKey)).chunks))
+  }
+
+  async function removeGroup (groupKey) {
+    await ready()
+    return transaction([GROUPS_STORE, CHUNKS_STORE, STATE_STORE], 'readwrite', async tx => {
+      const usage = await readUsage(tx)
+      const removed = await deleteGroupInTransaction(tx, groupKey, usage)
+      await writeUsage(tx, usage)
+      return removed
+    })
+  }
 
   return {
     cleanupStale,

package/private-message/index.js

@@ -301,7 +301,7 @@ function rebuildSubscriptions ({ _subscribe = privateChannel.subscribe, graceful
       modeByPubkey: modesForChannels(channelList),
       receivedChunkTtlMs: maxWatchNumber(channelList, 'receivedChunkTtlMs'),
       receivedChunkMaxBytes: maxWatchNumber(channelList, 'receivedChunkMaxBytes'),
-      receivedChunkStorageArea: firstWatchValue(channelList, 'receivedChunkStorageArea'),
+      receivedChunkIndexedDB: firstWatchValue(channelList, 'receivedChunkIndexedDB'),
       ignoredGroupTtlMs: maxWatchNumber(channelList, 'ignoredGroupTtlMs'),
       ignoredGroupMaxEntries: maxWatchNumber(channelList, 'ignoredGroupMaxEntries'),
       limit: 0,
@@ -348,7 +348,7 @@ export async function watch ({
   onError,
   receivedChunkTtlMs,
   receivedChunkMaxBytes,
-  receivedChunkStorageArea,
+  receivedChunkIndexedDB,
   ignoredGroupTtlMs,
   ignoredGroupMaxEntries,
   since = nowSeconds(),
@@ -372,7 +372,7 @@ export async function watch ({
       mode,
       receivedChunkTtlMs,
       receivedChunkMaxBytes,
-      receivedChunkStorageArea,
+      receivedChunkIndexedDB,
       ignoredGroupTtlMs,
       ignoredGroupMaxEntries,
       callbacks,
@@ -388,7 +388,7 @@ export async function watch ({
       current.mode === next.mode &&
       current.receivedChunkTtlMs === next.receivedChunkTtlMs &&
       current.receivedChunkMaxBytes === next.receivedChunkMaxBytes &&
-      current.receivedChunkStorageArea === next.receivedChunkStorageArea &&
+      current.receivedChunkIndexedDB === next.receivedChunkIndexedDB &&
       current.ignoredGroupTtlMs === next.ignoredGroupTtlMs &&
       current.ignoredGroupMaxEntries === next.ignoredGroupMaxEntries
     ) {

package/private-messenger/index.js

@@ -26,7 +26,7 @@
 // await messenger.clearChannel(channelPubkey)
 //
 // Missed-message recovery:
-// - Each watched channel stores lastSeenAt/lastWatchedAt in localStorage.
+// - Each watched channel stores lastSeenAt/lastWatchedAt in IndexedDB.
 // - Re-watching after reload fetches the gap from lastSeenAt to now.
 // - Browser offline/online events add explicit offline ranges with a small skew.
 // - Ranges older than 7 days are ignored; channel state not watched for 45 days is pruned.
@@ -42,6 +42,7 @@ import { getRelaysByPubkey, pickRelaysForPubkeys, subscribeRelayListUpdates } fr
 import * as privateChannel from '../private-channel/index.js'
 import { cleanupTemporaryStorage as cleanupTemporaryChannelStorage } from '../temporary-storage/index.js'
 import { createQueue } from '../idb-queue/index.js'
+import { createChannelStateStore } from './services/channel-state.js'
 import { DEFAULT_STALE_CHANNEL_SECONDS } from './constants/index.js'
 import {
   compactSeedNymCarriers,
@@ -121,14 +122,14 @@ function isPlainObject (value) {
   return value && typeof value === 'object' && !Array.isArray(value)
 }
 
-function storesRecoverySeeds (mode) {
-  return mode === 'seeder' || mode === 'watchtower'
-}
-
 function parseJson (raw, fallback) {
   try { return JSON.parse(raw || '') } catch { return fallback }
 }
 
+function storesRecoverySeeds (mode) {
+  return mode === 'seeder' || mode === 'watchtower'
+}
+
 export class PrivateMessenger {
   static cleanupTemporaryStorage ({ storageArea = globalThis.sessionStorage } = {}) {
     cleanupTemporaryChannelStorage({ storageArea })
@@ -195,6 +196,9 @@ export class PrivateMessenger {
     this.prefix = ''
     this.queue = null
     this.seedQueue = null
+    this.stateStore = null
+    this.state = { channels: {} }
+    this.stateWriteTail = Promise.resolve()
     this.channels = new Map()
     this.stopByChannel = new Map()
     this.presenceTimers = new Map()
@@ -229,6 +233,11 @@ export class PrivateMessenger {
       evictionPolicy: 'fifo',
       indexedDB: this._indexedDB
     })
+    this.stateStore = await createChannelStateStore({
+      prefix: this.prefix,
+      indexedDB: this._indexedDB
+    })
+    this.state = { channels: await this.stateStore.load() }
     await this.cleanupStaleChannels()
     await this.update({ userSigner, contentKeySigner, nymSigner: this.nymSigner, channels, relays, mode })
     return this
@@ -372,18 +381,25 @@ export class PrivateMessenger {
     return { relayToReceivers: derived, recoveryRelays }
   }
 
-  stateKey () {
-    return `${this.prefix}:state`
-  }
-
   readState () {
-    const state = parseJson(localStorage.getItem(this.stateKey()), { channels: {} })
-    if (!isPlainObject(state.channels)) state.channels = {}
-    return state
+    return structuredClone(this.state)
   }
 
   writeState (state) {
-    localStorage.setItem(this.stateKey(), JSON.stringify(state))
+    const next = {
+      channels: isPlainObject(state?.channels) ? structuredClone(state.channels) : {}
+    }
+    this.state = next
+    const snapshot = structuredClone(next.channels)
+    const write = this.stateWriteTail.then(() => this.stateStore.replace(snapshot))
+    this.stateWriteTail = write.catch(err => {
+      try { this.onError?.(err) } catch {}
+    })
+    return write
+  }
+
+  async flushStateWrites () {
+    await this.stateWriteTail
   }
 
   updateChannelState (pubkey, patch) {
@@ -589,6 +605,7 @@ export class PrivateMessenger {
         onSeed: seed => this.queueIncoming(() => this.enqueueSeed(pubkey, seed)),
         onContentKeyUsage: usage => this.handleContentKeyUsage(pubkey, usage),
         receivedChunkTtlMs: this.offlineRecoverySeconds * 1000,
+        receivedChunkIndexedDB: this._indexedDB,
         onError: err => this.onError?.(err)
       })
       this.stopByChannel.set(pubkey, stop)
@@ -1272,6 +1289,7 @@ export class PrivateMessenger {
             mode: channel.mode,
             modeByPubkey: { [pubkey]: channel.mode },
             receivedChunkTtlMs: this.offlineRecoverySeconds * 1000,
+            receivedChunkIndexedDB: this._indexedDB,
             onEvent: (event, outer, meta) => this.queueIncoming(() => this.enqueueRumor(eventType(event), pubkey, { event, outer, meta, payload: parseEventContent(event) })),
             onNymEvent: (event, outer, meta) => this.queueIncoming(() => this.enqueueRumor('nym', pubkey, { event, outer, meta, payload: parseEventContent(event) })),
             onSeedEvent: seed => this.queueIncoming(() => this.enqueueSeed(pubkey, seed)),
@@ -1299,6 +1317,7 @@ export class PrivateMessenger {
       this._privateMessage.clearChannelState?.(pubkey)
       this.channels.delete(pubkey)
       this.removeChannelState(pubkey)
+      await this.flushStateWrites()
       await this.queue.removeBy('byChannel', pubkey)
       await this.seedQueue.removeBy('byChannel', pubkey)
       this.ensureRelayListWatcher()
@@ -1321,6 +1340,7 @@ export class PrivateMessenger {
         await this.seedQueue?.removeBy('byChannel', pubkey)
       }
       this.writeState(state)
+      await this.flushStateWrites()
     })
   }
 

package/private-messenger/services/channel-state.js

@@ -0,0 +1,103 @@
+import { run } from '../../idb/index.js'
+
+const DATABASE_VERSION = 1
+const CHANNELS_STORE = 'channels'
+
+/*
+IndexedDB schema, scoped per private-messenger prefix:
+
+database `${prefix}:state:idb`, version 1
+
+channels, keyPath "pubkey"
+  pubkey  watched channel public key
+  value   evolving channel-recovery state, including last-seen/watched times,
+          mode, relays, seeders, offline ranges, active offline-range start,
+          per-seeder activity, and sent/received content-key usage
+
+The complete channels snapshot is replaced atomically on each persisted state
+change; value remains an extensible internal object rather than a public schema.
+*/
+
+function deferred () {
+  let resolve
+  let reject
+  const promise = new Promise((nextResolve, nextReject) => {
+    resolve = nextResolve
+    reject = nextReject
+  })
+  return { promise, resolve, reject }
+}
+
+function transactionDone (tx) {
+  const pending = deferred()
+  tx.oncomplete = () => pending.resolve()
+  tx.onabort = () => pending.reject(tx.error || new Error('IDB_TRANSACTION_ABORTED'))
+  tx.onerror = () => pending.reject(tx.error || new Error('IDB_TRANSACTION_FAILED'))
+  return pending.promise
+}
+
+function openDatabase (indexedDB, name) {
+  if (!indexedDB?.open) return Promise.reject(new Error('IDB_UNAVAILABLE'))
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(name, DATABASE_VERSION)
+    request.onerror = () => reject(request.error || new Error('IDB_OPEN_FAILED'))
+    request.onblocked = () => reject(new Error('IDB_DATABASE_BLOCKED'))
+    request.onupgradeneeded = () => {
+      const db = request.result
+      if (!db.objectStoreNames.contains(CHANNELS_STORE)) {
+        db.createObjectStore(CHANNELS_STORE, { keyPath: 'pubkey' })
+      }
+    }
+    request.onsuccess = () => {
+      const db = request.result
+      db.onversionchange = () => db.close()
+      resolve(db)
+    }
+  })
+}
+
+async function transaction (db, mode, work) {
+  const tx = db.transaction([CHANNELS_STORE], mode)
+  // Attach completion handlers before issuing the first request. The callback
+  // may await only requests belonging to this transaction.
+  const done = transactionDone(tx)
+  try {
+    const result = await work(tx)
+    await done
+    return result
+  } catch (err) {
+    try { tx.abort() } catch {}
+    try { await done } catch {}
+    throw err
+  }
+}
+
+function cloneChannels (channels) {
+  return structuredClone(channels || {})
+}
+
+export async function createChannelStateStore ({ prefix, indexedDB = globalThis.indexedDB } = {}) {
+  if (!prefix) throw new Error('PRIVATE_MESSENGER_STATE_PREFIX_REQUIRED')
+  const db = await openDatabase(indexedDB, `${prefix}:state:idb`)
+
+  async function load () {
+    return transaction(db, 'readonly', async tx => {
+      const records = (await run('getAll', [], CHANNELS_STORE, null, { tx })).result
+      return Object.fromEntries(records
+        .filter(record => typeof record?.pubkey === 'string' && record.pubkey)
+        .map(({ pubkey, value }) => [pubkey, value && typeof value === 'object' ? value : {}]))
+    })
+  }
+
+  async function replace (channels) {
+    const snapshot = cloneChannels(channels)
+    await transaction(db, 'readwrite', async tx => {
+      await run('clear', [], CHANNELS_STORE, null, { tx })
+      for (const [pubkey, value] of Object.entries(snapshot)) {
+        await run('put', [{ pubkey, value }], CHANNELS_STORE, null, { tx })
+      }
+    })
+  }
+
+  return { load, replace }
+}