@athenaintel/react 0.41.3 → 0.42.2

package/dist/agent-runtime/src/thread-prewarm-controller.d.ts

@@ -0,0 +1,76 @@
+import type { DeepAgentMessageWindowDeclaration } from "./message-window";
+import { type DeepAgentHeadersResolver, type DeepAgentWakeFetch } from "./deep-agent-transport-recipe";
+import { type AttachRetryGate, type DeepAgentAttachTimingEvent } from "./statewire-attach-observer";
+import { type DeepAgentPrewarmTransportFactory, type DeepAgentThreadPrewarmPool, type DeepAgentThreadPrewarmPoolOptions } from "./thread-prewarm";
+/** What signalled the intent to open the thread. */
+export type DeepAgentPrewarmReason = "hover" | "pointerdown" | "click" | "route";
+export interface DeepAgentThreadPrewarmControllerOptions<TState> {
+    /** Base URL of the deep-agent statewire host (the `…/v2/threads` mount). */
+    baseUrl: string;
+    /** The mounted thread's auth resolver — a pooled attach must be the attach the thread would open. */
+    headers: DeepAgentHeadersResolver;
+    /** The mounted thread's head window declaration (`useDeepAgentThread({ messageWindow })`); the pooled dial must ask for the same shape. */
+    messageWindow?: DeepAgentMessageWindowDeclaration | undefined;
+    /** The mounted thread's lane paging (`useDeepAgentThread({ laneHistory })`); the pooled dial and the wake must declare the same contract version. */
+    laneHistory?: boolean | undefined;
+    /** SSE when true, WebSocket otherwise; match the mounted thread. */
+    sse?: boolean;
+    /** Attach timing + retry hints for both the wake and the pooled dials. */
+    onAttachTiming?: (input: {
+        threadId: string;
+        event: DeepAgentAttachTimingEvent;
+    }) => void;
+    /** A pooled hello landed (hosts with a snapshot cache remember it here). */
+    onState?: DeepAgentThreadPrewarmPoolOptions<TState>["onState"];
+    onDiscard?: DeepAgentThreadPrewarmPoolOptions<TState>["onDiscard"];
+    /** Pool sizing; defaults are the pool's own. */
+    pool?: Pick<DeepAgentThreadPrewarmPoolOptions<TState>, "maxEntries" | "graceMs" | "ttlMs">;
+    /** One wake per thread per window: the route is idempotent, a flickering hover must not hammer it. */
+    wakeDedupeMs?: number;
+    maxWakeRecords?: number;
+    /** Test seams. */
+    fetch?: DeepAgentWakeFetch;
+    retryGate?: AttachRetryGate;
+    createTransport?: DeepAgentPrewarmTransportFactory<TState>;
+    now?: () => number;
+}
+export interface DeepAgentThreadPrewarmController<TState> {
+    /** Hand this to `useDeepAgentThread` / `useDeepAgentRuntime` as `prewarmPool`. */
+    readonly pool: DeepAgentThreadPrewarmPool<TState>;
+    /**
+     * Warm a thread the user is about to open. Every intent wakes the server
+     * instance (`POST …/prewarm`, deduped); only a hover dwell also dials a
+     * pooled attach — a pointer-down or click is followed by the thread's own
+     * attach within a frame or two, and a pooled dial started then is disposed
+     * before its handshake completes. Returns whether a pooled dial started.
+     */
+    prewarm(threadId: string, input: {
+        reason: DeepAgentPrewarmReason;
+    }): boolean;
+    /** The intent lapsed (pointer left the row): keep the dial warm for the grace window. */
+    release(threadId: string): void;
+    /** Whether a switch to `threadId` can seed its first frame from a pooled hello. */
+    isWarm(threadId: string): boolean;
+    /** Logout / identity change: drop every pooled dial and wake record. */
+    clear(): void;
+}
+/**
+ * The host-agnostic half of a surface's thread prewarm: the wake-then-dial
+ * policy Olympus runs from its sidebar, over the shared attach recipe, so a
+ * conversation list in any surface warms a thread the same way. A host binds
+ * one controller per (statewire host, principal) and clears it when either
+ * changes: a pooled attach dials with that principal's token.
+ *
+ * The wake's `Retry-After` (503/429) lands in the retry gate keyed by the
+ * thread URL, and the attach recipe waits that floor out before it dials —
+ * both the pooled attach and the thread's own attach after the click honour
+ * the server's hint without any host code. The one dial that can race the
+ * hint is the hover's own speculative attach, started alongside the wake; a
+ * floor that arrives while it is still handshaking discards it.
+ */
+export declare function createDeepAgentThreadPrewarmController<TState>({ baseUrl, headers, messageWindow, laneHistory, sse, onAttachTiming, onState, onDiscard, pool: poolOptions, wakeDedupeMs, maxWakeRecords, fetch: fetchOverride, retryGate, createTransport, now, }: DeepAgentThreadPrewarmControllerOptions<TState>): DeepAgentThreadPrewarmController<TState>;
+/** The retry-gate key the wake and the attach share for a thread. */
+export declare function deepAgentPrewarmGateKey({ baseUrl, threadId, }: {
+    baseUrl: string;
+    threadId: string;
+}): string;

package/dist/agent-runtime/src/thread-prewarm.d.ts

@@ -0,0 +1,118 @@
+import { type ResourceElement } from '@assistant-ui/tap';
+import type { Statewire } from 'statewire';
+/**
+ * Pre-dialed statewire attaches for threads the user is ABOUT to open.
+ *
+ * A thread switch today starts its network work only after React has torn
+ * down the previous thread and mounted the new one — the attach (socket open
+ * + server authorize + history load + hello) queues behind the heaviest part
+ * of the switch. The pool moves that attach ahead of the click: on sidebar
+ * hover (dwell-gated) or pointer-down the host asks the pool to `prewarm` a
+ * thread, and the pool mounts the thread's transport in a standalone tap root
+ * — built by the same recipe the thread uses — so it dials immediately. The
+ * server does its expensive work (authorize, `_load_history`, the hello) while
+ * the pointer is still on the row, and the instance it activates stays warm
+ * for the click.
+ *
+ * A pooled attach rides a process-local session lane, never the thread's
+ * persisted one: a persisted lane is single-consumer per tab (its Web Lock
+ * serializes every session mounted on it), and a pooled root sharing the
+ * lane with the thread's own session stalled the thread's dial behind the
+ * held lock and livelocked its teardown. The pool never hands its client over,
+ * so it has no use for the lane.
+ *
+ * Warm-and-seed, not a live handoff: when the thread mounts it `take`s the
+ * pooled hello as its seed — its first frame is the transcript, with no
+ * loading treatment — and dials its OWN attach against the now-warm instance;
+ * the pooled root is disposed in the same step, so one socket is live per
+ * thread after mount. A statewire session is a single-consumer object: handing
+ * a root one tap tree mounted to another tree's client left the client's
+ * change feed unreliable, and the outgoing thread's teardown redialed the
+ * shared root in a tight loop — so the pool never shares a live root.
+ *
+ * A take that arrives BEFORE the pooled hello does not close the socket. The
+ * server is still mid-`authorize`/activation on it, and pinned treats a client
+ * that leaves before it is served as grounds to discard the half-built
+ * instance record (`LocalDirectory.discard_unserved`) — with the wake and the
+ * thread's own attach still resolving on that same record, both then bounce
+ * off "instance closing; retry" (a 503 on the wake, a 1011 close on the
+ * attach) and the click pays a statewire backoff plus a cold re-activation
+ * instead of the warm instance the hover paid for (staging, 2026-09-04: every
+ * hover the pointer clicked through within a few hundred ms did this). The
+ * taken dial is kept as an orphan until its hello lands — remembered through
+ * `onState`, then disposed — or the grace window passes. `has` / `hasState` /
+ * `take` no longer see it, but it is still a live socket: it counts toward
+ * `maxEntries` (the oldest live root evicts first, orphan or not), and a
+ * renewed `prewarm` for the same thread re-adopts it instead of dialing a
+ * second socket.
+ *
+ * Bounds: at most `maxEntries` live roots (oldest evicts), each released
+ * entry disposed after `graceMs`, every entry disposed after `ttlMs`. A root
+ * that is refused (`gone`, or an `unauthorized` retry) or whose dial fails is
+ * discarded at once so the pool never retries a denial or a dead server the
+ * thread's own attach handles (and parks) with its full policy. Nothing here
+ * decides *what* to prewarm — hosts gate on their own rules (never the active
+ * thread, never a new chat, never under a view-as lens).
+ */
+type TransportValue<TState> = Statewire<TState | undefined>;
+type TransportElement<TState> = ResourceElement<TransportValue<TState>>;
+/** Builds the thread's transport element — once per prewarm. The transport must
+ * leave its session process-local (no `sessionStore`; see the module notes). */
+export type DeepAgentPrewarmTransportFactory<TState> = (input: {
+    threadId: string;
+}) => TransportElement<TState>;
+export type DeepAgentPrewarmDiscardReason = 'released' | 'expired' | 'evicted' | 'refused' | 'failed' | 'taken' | 'cleared' | 'discarded';
+export interface DeepAgentThreadPrewarmPoolOptions<TState> {
+    createTransport: DeepAgentPrewarmTransportFactory<TState>;
+    /** Live roots retained; the oldest evicts beyond this. */
+    maxEntries?: number;
+    /** How long a released (hover-left) entry stays warm before disposal. */
+    graceMs?: number;
+    /** Hard lifetime of any entry since its prewarm. */
+    ttlMs?: number;
+    /** The hello landed on a pooled root (state is the live wire state). */
+    onState?: (input: {
+        threadId: string;
+        state: TState;
+    }) => void;
+    onDiscard?: (input: {
+        threadId: string;
+        reason: DeepAgentPrewarmDiscardReason;
+    }) => void;
+    now?: () => number;
+}
+/** What a mounting thread takes from the pool: the hello, if it landed. */
+export interface PrewarmedDeepAgentHello<TState> {
+    threadId: string;
+    /** The wire state the pooled attach replicated, or `undefined` before the hello. */
+    state: TState | undefined;
+    /** Whether the pooled attach had reached `connected` when taken. */
+    connected: boolean;
+    /** `now()` at prewarm — when the dial started. */
+    dialedAt: number;
+}
+export interface DeepAgentThreadPrewarmPool<TState> {
+    /** Start (or refresh) a warm root for the thread. Returns `true` when a dial was started. */
+    prewarm(threadId: string): boolean;
+    /** The intent lapsed (hover left): keep the root warm for `graceMs`, then dispose. */
+    release(threadId: string): void;
+    has(threadId: string): boolean;
+    /** The root has replicated a hello. */
+    hasState(threadId: string): boolean;
+    /**
+     * Hand the pooled hello to the mounting thread and dispose the root (its
+     * socket closes): the thread seeds its first frame from the state and dials
+     * its own attach against the instance the pool warmed. Before the hello the
+     * dial stays up alongside the thread's own attach until it lands (or the
+     * grace window passes) — see the module notes — and the entry leaves the
+     * pool's view either way (`has` is false, a second take is `null`) while
+     * still counting toward `maxEntries`.
+     */
+    take(threadId: string): PrewarmedDeepAgentHello<TState> | null;
+    /** Dispose one entry immediately (e.g. the thread attaches on its own terms). */
+    discard(threadId: string): void;
+    clear(): void;
+    readonly size: number;
+}
+export declare function createDeepAgentThreadPrewarmPool<TState>({ createTransport, maxEntries, graceMs, ttlMs, onState, onDiscard, now, }: DeepAgentThreadPrewarmPoolOptions<TState>): DeepAgentThreadPrewarmPool<TState>;
+export {};

package/dist/agent-runtime/src/thread-snapshot-cache.d.ts

@@ -0,0 +1,99 @@
+import type { DeepAgentStreamValues } from './types';
+/**
+ * Per-tab LRU of the last wire state seen per thread, so a switch back to a
+ * recently-visited thread can mount with that snapshot instead of an empty
+ * "loading" state (see `UseDeepAgentThreadOptions.snapshotCache`). Entries are
+ * references into states the wire already produced — remembering is O(1) and
+ * copies nothing; the bound is `maxThreads` retained states.
+ */
+export interface DeepAgentThreadSnapshotCache {
+    /** Record the latest hydrated wire state for a thread. */
+    remember(threadId: string, state: DeepAgentStreamValues): void;
+    /** The freshest remembered state for a thread, or `undefined` when none is
+     * held or the entry aged out. */
+    take(threadId: string): DeepAgentStreamValues | undefined;
+    /**
+     * Drop a single thread's entry. Called when the server refuses
+     * authorization for the thread — a refused thread must not warm-paint on
+     * its next mount.
+     */
+    forget(threadId: string): void;
+    /**
+     * Drop every entry. Called when the acting identity changes — a snapshot
+     * captured under one account must never seed a mount under another.
+     */
+    clear(): void;
+    /**
+     * Whether a fresh entry is held for the thread, without consuming or
+     * touching it. Hosts read it at selection time to decide whether the switch
+     * can paint from a seed (no loading treatment) or must cover the attach
+     * wait. Optional so hand-rolled caches keep type-checking; the built-in
+     * cache implements it.
+     */
+    peek?(threadId: string): boolean;
+}
+/** A write observed on the cache — the durable-mirror seam (see `onChange`). */
+export type DeepAgentThreadSnapshotCacheChange = {
+    type: 'remember';
+    threadId: string;
+    state: DeepAgentStreamValues;
+    at: number;
+} | {
+    type: 'forget';
+    threadId: string;
+} | {
+    type: 'clear';
+};
+export interface DeepAgentThreadSnapshotCacheOptions {
+    /** Threads retained; the least-recently written entry evicts beyond this. */
+    maxThreads?: number;
+    /**
+     * Entries older than this are dropped at read time. The seed's value is
+     * "the thread you just left" — a snapshot from long ago is more likely to
+     * flash content the server has since rewritten than to save a paint.
+     */
+    maxAgeMs?: number;
+    /**
+     * Observer of every write (`remember`, `forget`, `clear`). Hosts mirror
+     * entries into durable storage from here so a reload can seed too; the
+     * observer is never invoked for `restore`, which re-admits mirrored entries.
+     * Exceptions are swallowed — a mirror fault must not break the wire path.
+     */
+    onChange?: (change: DeepAgentThreadSnapshotCacheChange) => void;
+    /** Injectable clock (tests). */
+    now?: () => number;
+}
+/** The built-in cache: the host contract plus the durable-mirror re-admission. */
+export interface CreatedDeepAgentThreadSnapshotCache extends DeepAgentThreadSnapshotCache {
+    peek(threadId: string): boolean;
+    /**
+     * Re-admit an entry captured earlier — a mirrored snapshot after a reload —
+     * under its ORIGINAL capture time, so the age bound still applies. Never
+     * displaces a fresher in-memory entry and never notifies `onChange`.
+     */
+    restore(threadId: string, state: DeepAgentStreamValues, at: number): void;
+}
+export declare function createDeepAgentThreadSnapshotCache(options?: DeepAgentThreadSnapshotCacheOptions): CreatedDeepAgentThreadSnapshotCache;
+/**
+ * Shape a remembered wire state for use as a mount's `initialState`.
+ *
+ * Messages/todos and the other app-owned keys seed as captured. The run lane
+ * seeds by what the user left: a thread whose run was `running` when the
+ * snapshot was taken seeds a running entry (see {@link seedRunsLane}) so the
+ * switch back reads Running with a Stop control on its first frame — the same
+ * frame `runs: []` would render as "ready" with a Send button over a thread the
+ * server is still mid-run on. Every other live-lifecycle lane normalizes to
+ * resting: a seeded input request could collect a decision the server may have
+ * already resolved, so an `input-required` entry seeds as no run at all.
+ * `__interrupt__` is dropped for the same reason, and so are `ptc_subagents`
+ * (the live in-eval dispatch lane — a seeded "running" dispatch card under a
+ * resting thread would render active with no eval behind it) and
+ * `outOfBandRunActive` (the host's out-of-band-run-in-progress flag — seeding a
+ * finished run's `true` would hide the composer until the attach corrected
+ * it). Durable thread properties (`runConfig`, `config`, `sessionPersisted`, …)
+ * seed as captured; the attach snapshot then replaces the whole seed. The
+ * protocol lane seeds as a seed's own copy (`withSeedProtocolLane`), so
+ * `isDeepAgentHostState` never reads the seed, or a state folded over it, as
+ * what the host holds now.
+ */
+export declare function toThreadSnapshotSeed(state: DeepAgentStreamValues): DeepAgentStreamValues;

package/dist/agent-runtime/src/thread-snapshot-mirror.cjs

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const sealedIdb = require("./sealed-idb.cjs");
 const THREAD_SNAPSHOT_MIRROR_DATABASE = "athena-thread-snapshots:v2";
 const THREAD_SNAPSHOT_MIRROR_FORMAT = 1;
 const MAX_MIRRORED_SNAPSHOTS_PER_OWNER = 30;
@@ -10,77 +11,16 @@ const SNAPSHOTS_STORE = "snapshots";
 const LISTS_STORE = "lists";
 const BY_OWNER = "byOwner";
 const BY_OWNER_AT = "byOwnerAt";
-const IV_BYTES = 12;
-const idbGlobals = globalThis;
-const encoder = new TextEncoder();
-const decoder = new TextDecoder();
-async function sha256Hex(value) {
-  const digest = await crypto.subtle.digest("SHA-256", encoder.encode(value));
-  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-async function sealJson({ key, value, aad }) {
-  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
-  const ciphertext = new Uint8Array(
-    await crypto.subtle.encrypt(
-      { name: "AES-GCM", iv, additionalData: encoder.encode(aad) },
-      key,
-      encoder.encode(JSON.stringify(value))
-    )
-  );
-  const sealed = new Uint8Array(IV_BYTES + ciphertext.byteLength);
-  sealed.set(iv, 0);
-  sealed.set(ciphertext, IV_BYTES);
-  return sealed;
-}
-async function openJson({ key, sealed, aad }) {
-  const iv = sealed.subarray(0, IV_BYTES);
-  const plaintext = await crypto.subtle.decrypt(
-    { name: "AES-GCM", iv, additionalData: encoder.encode(aad) },
-    key,
-    sealed.subarray(IV_BYTES)
-  );
-  return JSON.parse(decoder.decode(plaintext));
-}
-function requestToPromise(request) {
-  return new Promise((resolve, reject) => {
-    request.onsuccess = () => resolve(request.result);
-    request.onerror = () => reject(request.error ?? new Error("IndexedDB request failed"));
-  });
-}
-function transactionDone(tx) {
-  return new Promise((resolve, reject) => {
-    tx.oncomplete = () => resolve();
-    tx.onabort = () => reject(tx.error ?? new Error("IndexedDB transaction aborted"));
-    tx.onerror = () => reject(tx.error ?? new Error("IndexedDB transaction failed"));
-  });
-}
-function openDatabase(factory, name) {
-  return new Promise((resolve) => {
-    try {
-      const request = factory.open(name, DATABASE_VERSION);
-      request.onupgradeneeded = () => {
-        const db = request.result;
-        if (!db.objectStoreNames.contains(SNAPSHOTS_STORE)) {
-          const store = db.createObjectStore(SNAPSHOTS_STORE, { keyPath: "key" });
-          store.createIndex(BY_OWNER, "owner", { unique: false });
-          store.createIndex(BY_OWNER_AT, ["owner", "at"], { unique: false });
-        }
-        if (!db.objectStoreNames.contains(LISTS_STORE)) {
-          const lists = db.createObjectStore(LISTS_STORE, { keyPath: "key" });
-          lists.createIndex(BY_OWNER, "owner", { unique: false });
-        }
-      };
-      request.onsuccess = () => {
-        const db = request.result;
-        db.onversionchange = () => db.close();
-        resolve(db);
-      };
-      request.onerror = () => resolve(null);
-      request.onblocked = () => resolve(null);
-    } catch {
-      resolve(null);
-    }
-  });
+function upgradeMirrorDatabase(db) {
+  if (!db.objectStoreNames.contains(SNAPSHOTS_STORE)) {
+    const store = db.createObjectStore(SNAPSHOTS_STORE, { keyPath: "key" });
+    store.createIndex(BY_OWNER, "owner", { unique: false });
+    store.createIndex(BY_OWNER_AT, ["owner", "at"], { unique: false });
+  }
+  if (!db.objectStoreNames.contains(LISTS_STORE)) {
+    const lists = db.createObjectStore(LISTS_STORE, { keyPath: "key" });
+    lists.createIndex(BY_OWNER, "owner", { unique: false });
+  }
 }
 function isRestingThreadSnapshot(state) {
   var _a;
@@ -104,29 +44,18 @@ function isRecord(value) {
 }
 function createThreadSnapshotMirror({
   getKey,
-  factory = idbGlobals.indexedDB,
+  factory = sealedIdb.idbGlobals.indexedDB,
   databaseName = THREAD_SNAPSHOT_MIRROR_DATABASE,
   debounceMs = SNAPSHOT_MIRROR_DEBOUNCE_MS,
   maxPerOwner = MAX_MIRRORED_SNAPSHOTS_PER_OWNER,
   maxMessages = MAX_MIRRORED_SNAPSHOT_MESSAGES
 }) {
-  let databasePromise = null;
-  const database = () => {
-    if (!factory || typeof crypto === "undefined" || !crypto.subtle) return Promise.resolve(null);
-    databasePromise ?? (databasePromise = openDatabase(factory, databaseName).then((db) => {
-      if (db) {
-        const forget = () => {
-          databasePromise = null;
-        };
-        db.addEventListener("versionchange", forget);
-        db.addEventListener("close", forget);
-      } else {
-        databasePromise = null;
-      }
-      return db;
-    }));
-    return databasePromise;
-  };
+  const database = sealedIdb.lazySealedDatabase({
+    factory,
+    name: databaseName,
+    version: DATABASE_VERSION,
+    upgrade: upgradeMirrorDatabase
+  });
   const keyOf = async (ownerId, purpose) => {
     try {
       return await getKey(ownerId, purpose);
@@ -144,7 +73,7 @@ function createThreadSnapshotMirror({
     return queue;
   };
   const pruneOwner = async (db, owner) => {
-    const KeyRange = idbGlobals.IDBKeyRange;
+    const KeyRange = sealedIdb.idbGlobals.IDBKeyRange;
     if (!KeyRange) return;
     const tx = db.transaction(SNAPSHOTS_STORE, "readwrite");
     const store = tx.objectStore(SNAPSHOTS_STORE);
@@ -167,25 +96,25 @@ function createThreadSnapshotMirror({
       request.onerror = () => reject(request.error ?? new Error("IndexedDB cursor failed"));
     });
     for (const key of beyond) {
-      if (isOwnFormat(await requestToPromise(store.get(key)))) store.delete(key);
+      if (isOwnFormat(await sealedIdb.requestToPromise(store.get(key)))) store.delete(key);
     }
-    await transactionDone(tx);
+    await sealedIdb.transactionDone(tx);
   };
   const put = (input) => enqueue(async () => {
     const db = await database();
     if (!db) return;
     const cryptoKey = await keyOf(input.ownerId, "write");
     if (!cryptoKey) return;
-    const owner = await sha256Hex(input.ownerId);
-    const key = await sha256Hex(`${input.ownerId}|${input.threadId}`);
-    const sealed = await sealJson({
+    const owner = await sealedIdb.sha256Hex(input.ownerId);
+    const key = await sealedIdb.sha256Hex(`${input.ownerId}|${input.threadId}`);
+    const sealed = await sealedIdb.sealJson({
       key: cryptoKey,
       value: { threadId: input.threadId, state: input.state },
       aad: aadOf("snapshot", owner, key)
     });
     const tx = db.transaction(SNAPSHOTS_STORE, "readwrite");
     const store = tx.objectStore(SNAPSHOTS_STORE);
-    if (isOwnFormat(await requestToPromise(store.get(key)))) {
+    if (isOwnFormat(await sealedIdb.requestToPromise(store.get(key)))) {
       store.put({
         key,
         owner,
@@ -194,17 +123,17 @@ function createThreadSnapshotMirror({
         sealed
       });
     }
-    await transactionDone(tx);
+    await sealedIdb.transactionDone(tx);
     await pruneOwner(db, owner);
   });
   const deleteSnapshot = (input) => enqueue(async () => {
     const db = await database();
     if (!db) return;
-    const key = await sha256Hex(`${input.ownerId}|${input.threadId}`);
+    const key = await sealedIdb.sha256Hex(`${input.ownerId}|${input.threadId}`);
     const tx = db.transaction(SNAPSHOTS_STORE, "readwrite");
     const store = tx.objectStore(SNAPSHOTS_STORE);
-    if (isOwnFormat(await requestToPromise(store.get(key)))) store.delete(key);
-    await transactionDone(tx);
+    if (isOwnFormat(await sealedIdb.requestToPromise(store.get(key)))) store.delete(key);
+    await sealedIdb.transactionDone(tx);
   });
   const pendingKey = (ownerId, threadId) => `${ownerId}\0${threadId}`;
   const flushPending = (key) => {
@@ -219,12 +148,12 @@ function createThreadSnapshotMirror({
     if (!db) return;
     const cryptoKey = await keyOf(input.ownerId, "write");
     if (!cryptoKey) return;
-    const owner = await sha256Hex(input.ownerId);
-    const key = await sha256Hex(`${input.ownerId}|list|${input.listKey}`);
-    const sealed = await sealJson({ key: cryptoKey, value: input.value, aad: aadOf("list", owner, key) });
+    const owner = await sealedIdb.sha256Hex(input.ownerId);
+    const key = await sealedIdb.sha256Hex(`${input.ownerId}|list|${input.listKey}`);
+    const sealed = await sealedIdb.sealJson({ key: cryptoKey, value: input.value, aad: aadOf("list", owner, key) });
     const tx = db.transaction(LISTS_STORE, "readwrite");
     const store = tx.objectStore(LISTS_STORE);
-    if (isOwnFormat(await requestToPromise(store.get(key)))) {
+    if (isOwnFormat(await sealedIdb.requestToPromise(store.get(key)))) {
       store.put({
         key,
         owner,
@@ -233,7 +162,7 @@ function createThreadSnapshotMirror({
         sealed
       });
     }
-    await transactionDone(tx);
+    await sealedIdb.transactionDone(tx);
   });
   const flushList = (key) => {
     const entry = pendingLists.get(key);
@@ -263,8 +192,8 @@ function createThreadSnapshotMirror({
         if (!db) return [];
         const cryptoKey = await keyOf(ownerId, "read");
         if (!cryptoKey) return [];
-        const owner = await sha256Hex(ownerId);
-        const records = await requestToPromise(
+        const owner = await sealedIdb.sha256Hex(ownerId);
+        const records = await sealedIdb.requestToPromise(
           db.transaction(SNAPSHOTS_STORE, "readonly").objectStore(SNAPSHOTS_STORE).index(BY_OWNER).getAll(owner)
         );
         const loaded = [];
@@ -272,7 +201,7 @@ function createThreadSnapshotMirror({
         for (const record of records) {
           if (!record || record.format > THREAD_SNAPSHOT_MIRROR_FORMAT) continue;
           try {
-            const value = await openJson({
+            const value = await sealedIdb.openJson({
               key: cryptoKey,
               sealed: record.sealed,
               aad: aadOf("snapshot", owner, record.key)
@@ -288,7 +217,7 @@ function createThreadSnapshotMirror({
           void enqueue(async () => {
             const tx = db.transaction(SNAPSHOTS_STORE, "readwrite");
             for (const key of unreadable) tx.objectStore(SNAPSHOTS_STORE).delete(key);
-            await transactionDone(tx);
+            await sealedIdb.transactionDone(tx);
           });
         }
         return loaded.sort((a, b) => a.at - b.at);
@@ -340,14 +269,14 @@ function createThreadSnapshotMirror({
         if (!db) return null;
         const cryptoKey = await keyOf(ownerId, "read");
         if (!cryptoKey) return null;
-        const owner = await sha256Hex(ownerId);
-        const key = await sha256Hex(`${ownerId}|list|${listKey}`);
-        const record = await requestToPromise(
+        const owner = await sealedIdb.sha256Hex(ownerId);
+        const key = await sealedIdb.sha256Hex(`${ownerId}|list|${listKey}`);
+        const record = await sealedIdb.requestToPromise(
           db.transaction(LISTS_STORE, "readonly").objectStore(LISTS_STORE).get(key)
         );
         if (!record || record.format > THREAD_SNAPSHOT_MIRROR_FORMAT || record.owner !== owner) return null;
         try {
-          const value = await openJson({ key: cryptoKey, sealed: record.sealed, aad: aadOf("list", owner, key) });
+          const value = await sealedIdb.openJson({ key: cryptoKey, sealed: record.sealed, aad: aadOf("list", owner, key) });
           return { value, at: record.at };
         } catch {
           return null;
@@ -361,14 +290,14 @@ function createThreadSnapshotMirror({
       return enqueue(async () => {
         const db = await database();
         if (!db) return;
-        const owner = await sha256Hex(ownerId);
+        const owner = await sealedIdb.sha256Hex(ownerId);
         const tx = db.transaction([SNAPSHOTS_STORE, LISTS_STORE], "readwrite");
         for (const storeName of [SNAPSHOTS_STORE, LISTS_STORE]) {
           const store = tx.objectStore(storeName);
-          const keys = await requestToPromise(store.index(BY_OWNER).getAllKeys(owner));
+          const keys = await sealedIdb.requestToPromise(store.index(BY_OWNER).getAllKeys(owner));
           for (const key of keys) store.delete(key);
         }
-        await transactionDone(tx);
+        await sealedIdb.transactionDone(tx);
       });
     },
     clearAll() {
@@ -379,7 +308,7 @@ function createThreadSnapshotMirror({
         const tx = db.transaction([SNAPSHOTS_STORE, LISTS_STORE], "readwrite");
         tx.objectStore(SNAPSHOTS_STORE).clear();
         tx.objectStore(LISTS_STORE).clear();
-        await transactionDone(tx);
+        await sealedIdb.transactionDone(tx);
       });
     },
     async flush() {