Implement experimental file-based encrypted private chat

Add fixed-suite Rust/WASI identity files, signed challenge authentication, ciphertext-only SQLite storage, a minimal LibreJS-compatible interface, and consistent backup snapshots. Keep production unchanged and document the local workflow, limits, source distribution, and browser recovery tests.

4 files changed, 896 insertions, 0 deletions

diff --git a/crates/chat-server/src/http.rs b/crates/chat-server/src/http.rs
new file mode 100644
index 0000000..bb618d9
--- /dev/null
+++ b/crates/chat-server/src/http.rs
@@ -0,0 +1,160 @@
+// Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as
+// published by the Free Software Foundation, either version 3 of the
+// License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+use crate::service::Service;
+use anyhow::Result;
+use axum::{
+    Json, Router,
+    extract::{DefaultBodyLimit, State},
+    http::{HeaderMap, HeaderValue, StatusCode},
+    response::{IntoResponse, Response},
+    routing::{get, post},
+};
+use serde_json::{Value, json};
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+use tokio::sync::Semaphore;
+
+#[derive(Clone)]
+struct App {
+    service: Arc<Mutex<Service>>,
+    permits: Arc<Semaphore>,
+    root: PathBuf,
+    origin: String,
+}
+
+fn secured(mut response: Response) -> Response {
+    for (name, value) in [
+        ("cache-control", "no-store, max-age=0"),
+        (
+            "content-security-policy",
+            "default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self'; connect-src 'self'; style-src 'self'; img-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; object-src 'none'",
+        ),
+        ("referrer-policy", "no-referrer"),
+        ("x-content-type-options", "nosniff"),
+        ("cross-origin-opener-policy", "same-origin"),
+        ("cross-origin-resource-policy", "same-origin"),
+        (
+            "permissions-policy",
+            "camera=(), microphone=(), geolocation=(), payment=(), usb=()",
+        ),
+    ] {
+        response
+            .headers_mut()
+            .insert(name, HeaderValue::from_static(value));
+    }
+    response
+}
+
+async fn api(State(app): State<App>, headers: HeaderMap, Json(request): Json<Value>) -> Response {
+    if headers.get("origin").and_then(|value| value.to_str().ok()) != Some(app.origin.as_str()) {
+        return secured(
+            (
+                StatusCode::FORBIDDEN,
+                Json(json!({"error":"Origin rejected"})),
+            )
+                .into_response(),
+        );
+    }
+    let Ok(permit) = Arc::clone(&app.permits).try_acquire_owned() else {
+        return secured(
+            (
+                StatusCode::TOO_MANY_REQUESTS,
+                Json(json!({"error":"Server busy"})),
+            )
+                .into_response(),
+        );
+    };
+    let result = tokio::task::spawn_blocking(move || {
+        let _permit = permit;
+        app.service
+            .lock()
+            .map_err(|_| anyhow::anyhow!("Service unavailable"))?
+            .call(&request)
+    })
+    .await;
+    match result {
+        Ok(Ok(value)) => secured(Json(value).into_response()),
+        _ => secured((StatusCode::BAD_REQUEST,Json(json!({"error":"Request rejected. Unlock again if your session expired; check credentials, message limits, and conversation access."}))).into_response()),
+    }
+}
+
+async fn asset(State(app): State<App>, uri: axum::http::Uri) -> Response {
+    let (path, mime) = match uri.path() {
+        "/" => (
+            "crates/chat-server/web/index.html",
+            "text/html; charset=utf-8",
+        ),
+        "/app.js" => (
+            "crates/chat-server/web/app.js",
+            "text/javascript; charset=utf-8",
+        ),
+        "/worker.js" => (
+            "crates/chat-server/web/worker.js",
+            "text/javascript; charset=utf-8",
+        ),
+        "/wasi.mjs" => (
+            "crates/chat-crypto/browser/wasi.mjs",
+            "text/javascript; charset=utf-8",
+        ),
+        "/style.css" => (
+            "crates/chat-server/web/style.css",
+            "text/css; charset=utf-8",
+        ),
+        "/crypto.wasm" => (
+            "target/wasm32-wasip1/release/stack-chat-crypto.wasm",
+            "application/wasm",
+        ),
+        "/javascript.html" => (
+            "crates/chat-server/web/javascript.html",
+            "text/html; charset=utf-8",
+        ),
+        "/SOURCE.tar.gz" => ("var/build/chat-source.tar.gz", "application/gzip"),
+        "/THIRD-PARTY-LICENSES.html" => {
+            ("web/THIRD-PARTY-LICENSES.html", "text/html; charset=utf-8")
+        }
+        "/LIMITATIONS.txt" => ("docs/CHAT-APPLICATION.txt", "text/plain; charset=utf-8"),
+        "/LICENSE" => ("LICENSE", "text/plain; charset=utf-8"),
+        _ => return secured(StatusCode::NOT_FOUND.into_response()),
+    };
+    tokio::fs::read(app.root.join(path)).await.map_or_else(
+        |_| secured(StatusCode::NOT_FOUND.into_response()),
+        |bytes| secured(([("content-type", mime)], bytes).into_response()),
+    )
+}
+
+pub(crate) async fn serve(
+    listener: tokio::net::TcpListener,
+    service: Service,
+    root: &Path,
+) -> Result<()> {
+    let app = App {
+        origin: service.origin.clone(),
+        service: Arc::new(Mutex::new(service)),
+        permits: Arc::new(Semaphore::new(4)),
+        root: root.to_path_buf(),
+    };
+    let routes = Router::new()
+        .route("/api", post(api))
+        .fallback(get(asset))
+        .layer(DefaultBodyLimit::max(262_144))
+        .with_state(app);
+    axum::serve(listener, routes)
+        .with_graceful_shutdown(async {
+            drop(tokio::signal::ctrl_c().await);
+        })
+        .await?;
+    Ok(())
+}
diff --git a/crates/chat-server/src/main.rs b/crates/chat-server/src/main.rs
new file mode 100644
index 0000000..6c7f4e1
--- /dev/null
+++ b/crates/chat-server/src/main.rs
@@ -0,0 +1,129 @@
+// Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as
+// published by the Free Software Foundation, either version 3 of the
+// License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+#![doc = "Local experimental chat server with ciphertext-only durable storage."]
+
+mod http;
+mod service;
+mod store;
+
+use anyhow::{Context, Result, ensure};
+use clap::Parser;
+use std::io::Write;
+use std::net::SocketAddr;
+use std::path::PathBuf;
+use std::process::ExitCode;
+
+#[derive(Debug, Parser)]
+#[command(about = "Run the experimental private chat locally; production is not enabled")]
+struct Arguments {
+    #[arg(long, default_value = ".")]
+    root: PathBuf,
+    #[arg(long, default_value = "127.0.0.1:9080")]
+    bind: SocketAddr,
+    #[arg(long)]
+    init: bool,
+    #[arg(long)]
+    snapshot: Option<PathBuf>,
+}
+
+fn initialize(root: &std::path::Path) -> Result<()> {
+    let env = root.join(".env");
+    let existing = if env.exists() {
+        std::fs::read_to_string(&env)?
+    } else {
+        String::new()
+    };
+    ensure!(
+        !existing
+            .lines()
+            .any(|line| line.starts_with("CHAT_SETUP_TOKEN=")),
+        "CHAT_SETUP_TOKEN already exists"
+    );
+    let mut file = std::fs::OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(&env)?;
+    std::fs::set_permissions(&env, std::os::unix::fs::PermissionsExt::from_mode(0o600))?;
+    writeln!(file, "\nCHAT_SETUP_TOKEN={}", service::token()?)?;
+    if !existing
+        .lines()
+        .any(|line| line.starts_with("CHAT_ORIGIN="))
+    {
+        writeln!(file, "CHAT_ORIGIN=http://127.0.0.1:9080")?;
+    }
+    Ok(())
+}
+
+async fn run(arguments: Arguments) -> Result<()> {
+    let root = arguments.root.canonicalize()?;
+    if arguments.init {
+        return initialize(&root);
+    }
+    let data = root.join("var/data/chat");
+    std::fs::create_dir_all(&data)?;
+    std::fs::set_permissions(&data, std::os::unix::fs::PermissionsExt::from_mode(0o700))?;
+    let database = data.join("chat.sqlite");
+    let store = store::Store::open(&database)?;
+    std::fs::set_permissions(
+        &database,
+        std::os::unix::fs::PermissionsExt::from_mode(0o600),
+    )?;
+    if let Some(destination) = arguments.snapshot {
+        store.snapshot(&destination)?;
+        std::fs::set_permissions(
+            destination,
+            std::os::unix::fs::PermissionsExt::from_mode(0o600),
+        )?;
+        return Ok(());
+    }
+    ensure!(
+        arguments.bind.ip().is_loopback(),
+        "Experimental server must bind to loopback"
+    );
+    let settings = dotenvy::from_path_iter(root.join(".env"))?
+        .collect::<std::result::Result<std::collections::HashMap<_, _>, _>>()?;
+    let origin = settings
+        .get("CHAT_ORIGIN")
+        .context("Run --init to configure chat")?;
+    ensure!(
+        origin == &format!("http://{}", arguments.bind),
+        "This development server requires CHAT_ORIGIN to match its loopback bind address"
+    );
+    let setup = settings
+        .get("CHAT_SETUP_TOKEN")
+        .context("Missing CHAT_SETUP_TOKEN")?;
+    let state = service::Service::new(store, origin.clone(), setup.clone());
+    let listener = tokio::net::TcpListener::bind(arguments.bind).await?;
+    writeln!(
+        std::io::stdout().lock(),
+        "Experimental chat: {origin} (owner setup: /#setup)"
+    )?;
+    http::serve(listener, state, &root).await
+}
+
+#[tokio::main]
+async fn main() -> ExitCode {
+    match run(Arguments::parse()).await {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            drop(writeln!(
+                std::io::stderr().lock(),
+                "Chat server failed: {error:#}"
+            ));
+            ExitCode::FAILURE
+        }
+    }
+}
diff --git a/crates/chat-server/src/service.rs b/crates/chat-server/src/service.rs
new file mode 100644
index 0000000..3f9b6ee
--- /dev/null
+++ b/crates/chat-server/src/service.rs
@@ -0,0 +1,438 @@
+// Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as
+// published by the Free Software Foundation, either version 3 of the
+// License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+use crate::store::Store;
+use anyhow::{Context, Result, ensure};
+use base64::{Engine, prelude::BASE64_STANDARD};
+use serde_json::{Value, json};
+use std::collections::HashMap;
+use std::time::{Duration, Instant};
+
+struct Challenge {
+    certificate: String,
+    text: String,
+    expiry: Instant,
+    setup: bool,
+}
+
+struct Session {
+    identity: String,
+    expiry: Instant,
+}
+
+pub(crate) struct Service {
+    pub(crate) store: Store,
+    pub(crate) origin: String,
+    setup_token: String,
+    challenges: HashMap<String, Challenge>,
+    sessions: HashMap<String, Session>,
+    window: Instant,
+    attempts: u16,
+}
+
+pub(crate) fn token() -> Result<String> {
+    let mut bytes = [0; 32];
+    openssl::rand::rand_bytes(&mut bytes)?;
+    Ok(hex::encode(bytes))
+}
+
+pub(crate) fn field<'a>(request: &'a Value, key: &str) -> Result<&'a str> {
+    request
+        .get(key)
+        .and_then(Value::as_str)
+        .context("Missing string field")
+}
+
+fn ciphertext(request: &Value) -> Result<&str> {
+    let encoded = field(request, "ciphertext")?;
+    ensure!(
+        encoded.len() <= 65_536 && BASE64_STANDARD.decode(encoded)?.len() >= 64,
+        "Invalid ciphertext length"
+    );
+    Ok(encoded)
+}
+
+fn identifier(value: &str) -> Result<()> {
+    ensure!(
+        value.len() == 64 && value.bytes().all(|byte| byte.is_ascii_hexdigit()),
+        "Invalid identifier"
+    );
+    Ok(())
+}
+
+impl Service {
+    pub(crate) fn new(store: Store, origin: String, setup_token: String) -> Self {
+        Self {
+            store,
+            origin,
+            setup_token,
+            challenges: HashMap::new(),
+            sessions: HashMap::new(),
+            window: Instant::now(),
+            attempts: 0,
+        }
+    }
+
+    fn owner_id(&self) -> Result<String> {
+        stack_chat_crypto::public_identity(&self.store.owner()?.context("Owner not initialized")?)
+    }
+
+    fn challenge(&mut self, request: &Value) -> Result<Value> {
+        if self.window.elapsed() >= Duration::from_secs(60) {
+            self.window = Instant::now();
+            self.attempts = 0;
+        }
+        ensure!(self.attempts < 60, "Authentication rate exceeded");
+        self.attempts = self
+            .attempts
+            .checked_add(1)
+            .context("Rate counter overflow")?;
+        self.challenges
+            .retain(|_, challenge| challenge.expiry > Instant::now());
+        ensure!(self.challenges.len() < 128, "Too many pending challenges");
+        let certificate = field(request, "public")?;
+        let fingerprint = stack_chat_crypto::public_identity(certificate)?;
+        let setup = self.store.owner()?.is_none();
+        if setup {
+            let supplied = field(request, "setup_token")?;
+            ensure!(
+                self.setup_token.len() == 64
+                    && supplied.len() == 64
+                    && openssl::memcmp::eq(supplied.as_bytes(), self.setup_token.as_bytes()),
+                "Invalid setup credential"
+            );
+        }
+        let nonce = token()?;
+        let expires = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)?
+            .as_secs()
+            .checked_add(60)
+            .context("Clock overflow")?;
+        let owner = if setup {
+            fingerprint.clone()
+        } else {
+            self.owner_id()?
+        };
+        let text = format!(
+            "stack-chat-auth/v1\n{}\n{fingerprint}\n{nonce}\n{expires}\n{owner}",
+            self.origin
+        );
+        self.challenges.insert(
+            nonce.clone(),
+            Challenge {
+                certificate: certificate.into(),
+                text: text.clone(),
+                expiry: Instant::now()
+                    .checked_add(Duration::from_secs(60))
+                    .context("Clock overflow")?,
+                setup,
+            },
+        );
+        Ok(json!({"id":nonce,"challenge":text}))
+    }
+
+    fn authenticate(&mut self, request: &Value) -> Result<Value> {
+        let challenge = self
+            .challenges
+            .remove(field(request, "id")?)
+            .context("Missing or consumed challenge")?;
+        ensure!(challenge.expiry > Instant::now(), "Expired challenge");
+        stack_chat_crypto::verify_proof(
+            &challenge.certificate,
+            &challenge.text,
+            field(request, "signature")?,
+        )?;
+        let identity = stack_chat_crypto::public_identity(&challenge.certificate)?;
+        if challenge.setup {
+            self.store.install_owner(&challenge.certificate)?;
+            self.setup_token.clear();
+        }
+        let owner = identity == self.owner_id()?;
+        if !owner {
+            self.store.register(&identity, &challenge.certificate)?;
+        }
+        self.sessions
+            .retain(|_, session| session.expiry > Instant::now());
+        ensure!(self.sessions.len() < 256, "Too many sessions");
+        let credential = token()?;
+        self.sessions.insert(
+            credential.clone(),
+            Session {
+                identity: identity.clone(),
+                expiry: Instant::now()
+                    .checked_add(Duration::from_mins(30))
+                    .context("Clock overflow")?,
+            },
+        );
+        Ok(json!({"token":credential,"owner":owner,"id":identity,"expires_seconds":1800}))
+    }
+
+    fn principal(&mut self, request: &Value) -> Result<String> {
+        self.sessions
+            .retain(|_, session| session.expiry > Instant::now());
+        Ok(self
+            .sessions
+            .get(field(request, "token")?)
+            .context("Missing or expired session")?
+            .identity
+            .clone())
+    }
+
+    fn authorized(&self, request: &Value, identity: &str) -> Result<String> {
+        let conversation = field(request, "conversation")?;
+        identifier(conversation)?;
+        ensure!(
+            identity == conversation || identity == self.owner_id()?,
+            "Forbidden conversation"
+        );
+        self.store.conversation(conversation)?;
+        Ok(conversation.into())
+    }
+
+    pub(crate) fn call(&mut self, request: &Value) -> Result<Value> {
+        match field(request, "op")? {
+            "config" => Ok(
+                json!({"owner":self.store.owner()?,"origin":self.origin,"protocol":"stack-chat/v1"}),
+            ),
+            "challenge" => self.challenge(request),
+            "authenticate" => self.authenticate(request),
+            _ => self.authenticated(request),
+        }
+    }
+
+    fn authenticated(&mut self, request: &Value) -> Result<Value> {
+        let identity = self.principal(request)?;
+        let operation = field(request, "op")?;
+        if operation == "lock" {
+            self.sessions.remove(field(request, "token")?);
+            return Ok(json!({"locked":true}));
+        }
+        if operation == "inbox" {
+            ensure!(identity == self.owner_id()?, "Owner only");
+            return self.store.inbox();
+        }
+        let conversation = self.authorized(request, &identity)?;
+        match operation {
+            "history" => self.store.messages(
+                &conversation,
+                request
+                    .get("count")
+                    .and_then(Value::as_u64)
+                    .context("Missing count")?,
+                request.get("before").and_then(Value::as_u64).unwrap_or(0),
+            ),
+            "profile" => {
+                ensure!(identity == conversation, "Visitor only");
+                self.store.profile(&conversation, ciphertext(request)?)?;
+                Ok(json!({"stored":true}))
+            }
+            "send" => {
+                let id = field(request, "id")?;
+                identifier(id)?;
+                self.store
+                    .send(&conversation, id, &identity, ciphertext(request)?)
+            }
+            _ => anyhow::bail!("Unknown operation"),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::TempDir;
+
+    struct Identity {
+        file: String,
+        public: String,
+        fingerprint: String,
+    }
+
+    fn crypto(request: &Value) -> Result<Value> {
+        let response =
+            stack_chat_crypto::dispatch(&request.to_string()).map_err(anyhow::Error::msg)?;
+        Ok(serde_json::from_str(&response)?)
+    }
+
+    fn identity(name: &str, owner: &str) -> Result<Identity> {
+        let created = crypto(
+            &json!({"op":"create","origin":"http://127.0.0.1:9080","name":name,"password":"test-only-strong-password","owner":owner}),
+        )?;
+        let file = field(&created, "file")?;
+        let opened = crypto(
+            &json!({"op":"open","origin":"http://127.0.0.1:9080","file":file,"password":"test-only-strong-password"}),
+        )?;
+        Ok(Identity {
+            file: file.into(),
+            public: field(&opened, "public")?.into(),
+            fingerprint: field(&opened, "fingerprint")?.into(),
+        })
+    }
+
+    fn authenticate(service: &mut Service, identity: &Identity, setup: &str) -> Result<Value> {
+        let challenge = service
+            .call(&json!({"op":"challenge","public":identity.public,"setup_token":setup}))?;
+        let proof = crypto(
+            &json!({"op":"proof","file":identity.file,"password":"test-only-strong-password","origin":service.origin,"challenge":field(&challenge,"challenge")?}),
+        )?;
+        let request = json!({"op":"authenticate","id":field(&challenge,"id")?,"signature":field(&proof,"signature")?});
+        let result = service.call(&request)?;
+        ensure!(service.call(&request).is_err(), "Challenge was replayed");
+        Ok(result)
+    }
+
+    fn reject_expired_and_failed_proofs(service: &mut Service, identity: &Identity) -> Result<()> {
+        let challenge = service.call(&json!({"op":"challenge","public":identity.public}))?;
+        let challenge_id = field(&challenge, "id")?;
+        service
+            .challenges
+            .get_mut(challenge_id)
+            .context("Challenge")?
+            .expiry = Instant::now();
+        let expired = json!({"op":"authenticate","id":challenge_id,"signature":""});
+        ensure!(
+            service.call(&expired).is_err(),
+            "Expired challenge accepted"
+        );
+        ensure!(
+            !service.challenges.contains_key(challenge_id),
+            "Expired challenge retained"
+        );
+        let invalid = service.call(&json!({"op":"challenge","public":identity.public}))?;
+        let invalid_id = field(&invalid, "id")?;
+        ensure!(
+            service
+                .call(&json!({"op":"authenticate","id":invalid_id,"signature":""}))
+                .is_err(),
+            "Invalid proof accepted"
+        );
+        ensure!(
+            !service.challenges.contains_key(invalid_id),
+            "Failed challenge reusable"
+        );
+        service.attempts = 60;
+        ensure!(
+            service
+                .call(&json!({"op":"challenge","public":identity.public}))
+                .is_err(),
+            "Challenge rate bound"
+        );
+        ensure!(
+            service.store.install_owner(&identity.public).is_err(),
+            "Owner overwritten"
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn authorization_replays_history_and_snapshot_recovery() -> Result<()> {
+        let directory = TempDir::new()?;
+        let path = directory.path().join("chat.sqlite");
+        let setup = token()?;
+        let mut service = Service::new(
+            Store::open(&path)?,
+            "http://127.0.0.1:9080".into(),
+            setup.clone(),
+        );
+        let owner = identity("Owner", "")?;
+        ensure!(
+            service
+                .call(&json!({"op":"challenge","public":owner.public,"setup_token":"wrong"}))
+                .is_err(),
+            "Setup unauthenticated"
+        );
+        let owner_session = authenticate(&mut service, &owner, &setup)?;
+        ensure!(
+            owner_session.get("owner") == Some(&json!(true)),
+            "Owner role"
+        );
+        let visitor = identity("Visitor", &owner.public)?;
+        let visitor_session = authenticate(&mut service, &visitor, "")?;
+        let visitor_token = field(&visitor_session, "token")?;
+        let owner_token = field(&owner_session, "token")?;
+        let ciphertext = BASE64_STANDARD.encode([42; 128]);
+        let message_id = token()?;
+        let send = json!({"op":"send","conversation":visitor.fingerprint,"token":visitor_token,"id":message_id,"ciphertext":ciphertext});
+        service.call(&send)?;
+        service.call(&send)?;
+        let conflicting = json!({"op":"send","conversation":visitor.fingerprint,"token":visitor_token,"id":message_id,"ciphertext":BASE64_STANDARD.encode([43;128])});
+        ensure!(
+            service.call(&conflicting).is_err(),
+            "Conflicting ID accepted"
+        );
+        let empty = service.call(&json!({"op":"history","conversation":visitor.fingerprint,"token":visitor_token,"count":0}))?;
+        ensure!(
+            empty
+                .get("messages")
+                .and_then(Value::as_array)
+                .is_some_and(Vec::is_empty),
+            "N=0"
+        );
+        ensure!(
+            empty
+                .get("conversation")
+                .and_then(|value| value.get("total"))
+                == Some(&json!(1)),
+            "Retry duplicated message"
+        );
+        ensure!(
+            service
+                .call(&json!({"op":"inbox","token":visitor_token}))
+                .is_err(),
+            "Visitor read inbox"
+        );
+        ensure!(service.call(&json!({"op":"history","conversation":owner.fingerprint,"token":visitor_token,"count":1})).is_err(), "Wrong conversation accepted");
+        service.call(&json!({"op":"send","conversation":visitor.fingerprint,"token":owner_token,"id":token()?,"ciphertext":ciphertext}))?;
+        let latest = service.call(&json!({"op":"history","conversation":visitor.fingerprint,"token":visitor_token,"count":1}))?;
+        let sequence = latest
+            .get("messages")
+            .and_then(Value::as_array)
+            .and_then(|messages| messages.first())
+            .and_then(|message| message.get("seq"))
+            .context("Sequence")?;
+        let older = service.call(&json!({"op":"history","conversation":visitor.fingerprint,"token":visitor_token,"count":1,"before":sequence}))?;
+        ensure!(
+            older
+                .get("messages")
+                .and_then(Value::as_array)
+                .is_some_and(|messages| messages.len() == 1),
+            "Pagination"
+        );
+        ensure!(service.call(&json!({"op":"history","conversation":visitor.fingerprint,"token":visitor_token,"count":51})).is_err(), "History quota");
+        reject_expired_and_failed_proofs(&mut service, &visitor)?;
+        let snapshot = directory.path().join("snapshot.sqlite");
+        service.store.snapshot(&snapshot)?;
+        let restored = Store::open(&snapshot)?;
+        ensure!(
+            restored.owner()? == Some(owner.public),
+            "Owner missing after restore"
+        );
+        ensure!(
+            restored.conversation(&visitor.fingerprint)?.get("total") == Some(&json!(2)),
+            "Restored count"
+        );
+        service.call(&json!({"op":"lock","token":visitor_token}))?;
+        ensure!(service.call(&json!({"op":"history","conversation":visitor.fingerprint,"token":visitor_token,"count":0})).is_err(), "Locked session accepted");
+        let session = service.sessions.get_mut(owner_token).context("Session")?;
+        session.expiry = Instant::now();
+        ensure!(
+            service
+                .call(&json!({"op":"inbox","token":owner_token}))
+                .is_err(),
+            "Expired session accepted"
+        );
+        Ok(())
+    }
+}
diff --git a/crates/chat-server/src/store.rs b/crates/chat-server/src/store.rs
new file mode 100644
index 0000000..fce3bb3
--- /dev/null
+++ b/crates/chat-server/src/store.rs
@@ -0,0 +1,169 @@
+// Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as
+// published by the Free Software Foundation, either version 3 of the
+// License, or (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+use anyhow::{Context, Result, ensure};
+use rusqlite::{Connection, OptionalExtension, params};
+use serde_json::{Value, json};
+use std::path::Path;
+
+pub(crate) struct Store {
+    connection: Connection,
+}
+
+impl Store {
+    pub(crate) fn open(path: &Path) -> Result<Self> {
+        let connection = Connection::open(path)?;
+        connection.execute_batch("PRAGMA foreign_keys=ON; PRAGMA journal_mode=DELETE; PRAGMA synchronous=FULL; PRAGMA secure_delete=ON; CREATE TABLE IF NOT EXISTS metadata (key TEXT PRIMARY KEY, value TEXT NOT NULL); CREATE TABLE IF NOT EXISTS conversations (id TEXT PRIMARY KEY, cert TEXT NOT NULL, profile TEXT); CREATE TABLE IF NOT EXISTS messages (seq INTEGER PRIMARY KEY AUTOINCREMENT, conversation TEXT NOT NULL REFERENCES conversations(id), id TEXT NOT NULL UNIQUE, sender TEXT NOT NULL, ciphertext TEXT NOT NULL);")?;
+        Ok(Self { connection })
+    }
+
+    pub(crate) fn owner(&self) -> Result<Option<String>> {
+        Ok(self
+            .connection
+            .query_row("SELECT value FROM metadata WHERE key='owner'", [], |row| {
+                row.get(0)
+            })
+            .optional()?)
+    }
+
+    pub(crate) fn install_owner(&self, cert: &str) -> Result<()> {
+        ensure!(self.owner()?.is_none(), "Already initialized");
+        self.connection
+            .execute("INSERT INTO metadata VALUES ('owner', ?1)", [cert])?;
+        Ok(())
+    }
+
+    pub(crate) fn register(&self, id: &str, cert: &str) -> Result<()> {
+        if self.connection.query_row(
+            "SELECT EXISTS(SELECT 1 FROM conversations WHERE id=?1)",
+            [id],
+            |row| row.get::<_, bool>(0),
+        )? {
+            return Ok(());
+        }
+        let count: i64 =
+            self.connection
+                .query_row("SELECT COUNT(*) FROM conversations", [], |row| row.get(0))?;
+        ensure!(count < 1000, "Conversation limit reached");
+        self.connection.execute(
+            "INSERT INTO conversations (id,cert) VALUES (?1,?2)",
+            params![id, cert],
+        )?;
+        Ok(())
+    }
+
+    pub(crate) fn conversation(&self, id: &str) -> Result<Value> {
+        let (cert, profile): (String, Option<String>) = self.connection.query_row(
+            "SELECT cert,profile FROM conversations WHERE id=?1",
+            [id],
+            |row| Ok((row.get(0)?, row.get(1)?)),
+        )?;
+        let (total, visitor): (i64, i64) = self.connection.query_row(
+            "SELECT COUNT(*),COALESCE(SUM(sender=?1),0) FROM messages WHERE conversation=?1",
+            [id],
+            |row| Ok((row.get(0)?, row.get(1)?)),
+        )?;
+        Ok(
+            json!({"id":id,"public":cert,"profile":profile,"total":total,"visitor_sent":visitor,"owner_sent":total.checked_sub(visitor).context("Counter invariant")?}),
+        )
+    }
+
+    pub(crate) fn inbox(&self) -> Result<Value> {
+        let mut statement = self
+            .connection
+            .prepare("SELECT id FROM conversations ORDER BY id")?;
+        let ids = statement
+            .query_map([], |row| row.get::<_, String>(0))?
+            .collect::<rusqlite::Result<Vec<_>>>()?;
+        let conversations = ids
+            .iter()
+            .map(|id| self.conversation(id))
+            .collect::<Result<Vec<_>>>()?;
+        Ok(json!({"conversations":conversations}))
+    }
+
+    pub(crate) fn profile(&self, id: &str, ciphertext: &str) -> Result<()> {
+        self.connection.execute(
+            "UPDATE conversations SET profile=?2 WHERE id=?1 AND profile IS NULL",
+            params![id, ciphertext],
+        )?;
+        Ok(())
+    }
+
+    pub(crate) fn messages(&self, id: &str, count: u64, before: u64) -> Result<Value> {
+        ensure!(
+            count <= 50 && before <= i64::MAX.unsigned_abs(),
+            "Invalid history window"
+        );
+        let mut statement = self.connection.prepare("SELECT seq,id,sender,ciphertext FROM messages WHERE conversation=?1 AND (?3=0 OR seq<?3) ORDER BY seq DESC LIMIT ?2")?;
+        let messages = statement.query_map(params![id,i64::try_from(count)?,i64::try_from(before)?], |row| Ok(json!({"seq":row.get::<_,i64>(0)?,"id":row.get::<_,String>(1)?,"sender":row.get::<_,String>(2)?,"ciphertext":row.get::<_,String>(3)?})))?.collect::<rusqlite::Result<Vec<_>>>()?;
+        Ok(json!({"conversation":self.conversation(id)?,"messages":messages}))
+    }
+
+    pub(crate) fn send(
+        &mut self,
+        conversation: &str,
+        id: &str,
+        sender: &str,
+        ciphertext: &str,
+    ) -> Result<Value> {
+        let transaction = self.connection.transaction()?;
+        let existing: Option<(i64, String, String, String)> = transaction
+            .query_row(
+                "SELECT seq,conversation,sender,ciphertext FROM messages WHERE id=?1",
+                [id],
+                |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?, row.get(3)?)),
+            )
+            .optional()?;
+        if let Some((seq, previous_conversation, previous_sender, previous_ciphertext)) = existing {
+            ensure!(
+                previous_conversation == conversation
+                    && previous_sender == sender
+                    && previous_ciphertext == ciphertext,
+                "Conflicting message identifier"
+            );
+            transaction.commit()?;
+            return Ok(json!({"seq":seq,"conversation":self.conversation(conversation)?}));
+        }
+        let count: i64 = transaction.query_row(
+            "SELECT COUNT(*) FROM messages WHERE conversation=?1",
+            [conversation],
+            |row| row.get(0),
+        )?;
+        let used: i64 = transaction.query_row(
+            "SELECT COALESCE(SUM(LENGTH(ciphertext)),0) FROM messages",
+            [],
+            |row| row.get(0),
+        )?;
+        ensure!(
+            count < 10_000 && used < 1_000_000_000,
+            "Storage quota reached"
+        );
+        transaction.execute(
+            "INSERT INTO messages (conversation,id,sender,ciphertext) VALUES (?1,?2,?3,?4)",
+            params![conversation, id, sender, ciphertext],
+        )?;
+        let sequence = transaction.last_insert_rowid();
+        transaction.commit()?;
+        Ok(json!({"seq":sequence,"conversation":self.conversation(conversation)?}))
+    }
+
+    pub(crate) fn snapshot(&self, destination: &Path) -> Result<()> {
+        ensure!(!destination.exists(), "Snapshot destination already exists");
+        self.connection
+            .backup("main", destination, None::<fn(rusqlite::backup::Progress)>)?;
+        Ok(())
+    }
+}