@atlastodo/client-core 0.1.13 → 0.1.14-rc.1

package/dist/index.js

@@ -496,6 +496,9 @@ function safetyNumberGroups(number) {
   return number.match(/\d{5}/g) ?? [];
 }
 // src/crypto/field.ts
+import { hkdf as hkdf4 } from "@noble/hashes/hkdf.js";
+import { hmac } from "@noble/hashes/hmac.js";
+import { sha256 as sha2564 } from "@noble/hashes/sha2.js";
 var FIELD_ENVELOPE_VERSION = 2;
 function sameKeyScope(a, b) {
   if (a.kind !== b.kind)
@@ -516,16 +519,16 @@ function fieldAad(at, scope, kid) {
     kid
   ]));
 }
-function paddedLength(n) {
+function paddedLength(n, min = 32) {
   const needed = n + 1;
-  if (needed <= 32)
-    return 32;
+  if (needed <= min)
+    return min;
   if (needed <= 1024)
     return 2 ** Math.ceil(Math.log2(needed));
   return Math.ceil(needed / 1024) * 1024;
 }
-function padPlaintext(data) {
-  const out = new Uint8Array(paddedLength(data.length));
+function padPlaintext(data, min = 32) {
+  const out = new Uint8Array(paddedLength(data.length, min));
   out.set(data, 0);
   out[data.length] = 128;
   return out;
@@ -547,6 +550,49 @@ function decryptField(key, scope, at, envelope) {
   const plain = decryptAesGcm(key, envelope, fieldAad(at, scope, envelope.kid));
   return JSON.parse(bytesToUtf8(unpadPlaintext(plain)));
 }
+var FIELD_ENVELOPE_V3 = 3;
+var FIELD_V3_MIN_PADDING = 64;
+function fieldAadV3(at, scope, kid) {
+  return utf8ToBytes(JSON.stringify([
+    "atlas-field",
+    FIELD_ENVELOPE_V3,
+    at.entity,
+    at.entityId,
+    at.field,
+    keyScopeLabel(scope),
+    kid
+  ]));
+}
+function sealField(key, kid, scope, at, sealed) {
+  const plain = padPlaintext(utf8ToBytes(JSON.stringify([sealed.kind, sealed.field, sealed.value ?? null])), FIELD_V3_MIN_PADDING);
+  const { iv, ct } = encryptAesGcm(key, plain, fieldAadV3(at, scope, kid));
+  return { __enc: 3, kid, iv, ct };
+}
+function openSealedField(key, scope, at, envelope) {
+  const plain = decryptAesGcm(key, envelope, fieldAadV3(at, scope, envelope.kid));
+  const parsed = JSON.parse(bytesToUtf8(unpadPlaintext(plain)));
+  if (!Array.isArray(parsed) || parsed.length !== 3 || typeof parsed[0] !== "string" || typeof parsed[1] !== "string") {
+    throw new Error("malformed sealed field");
+  }
+  return { kind: parsed[0], field: parsed[1], value: parsed[2] };
+}
+function isFieldEnvelopeV3(v) {
+  if (typeof v !== "object" || v === null)
+    return false;
+  const o = v;
+  return o.__enc === 3 && typeof o.kid === "string" && typeof o.iv === "string" && typeof o.ct === "string";
+}
+function fieldTagKey(key) {
+  return hkdf4(sha2564, key, undefined, utf8ToBytes("atlas-field-tag-v1"), 32);
+}
+var TAG_RE = /^[0-9a-f]{32}$/;
+function fieldTag(tagKey, entityId, kind, field) {
+  const mac = hmac(sha2564, tagKey, utf8ToBytes(JSON.stringify(["atlas-field-tag", 1, entityId, kind, field])));
+  return bytesToHex(mac.subarray(0, 16));
+}
+function isFieldTag(name) {
+  return TAG_RE.test(name);
+}
 function isFieldEnvelopeV2(v) {
   if (typeof v !== "object" || v === null)
     return false;
@@ -595,17 +641,17 @@ function isEncryptedEnvelope(v) {
   const o = v;
   if (typeof o.iv !== "string" || typeof o.ct !== "string")
     return false;
-  return o.__enc === 1 || o.__enc === 2 && typeof o.kid === "string";
+  return o.__enc === 1 || (o.__enc === 2 || o.__enc === 3) && typeof o.kid === "string";
 }
 // src/crypto/keyring.ts
-import { sha256 as sha2564 } from "@noble/hashes/sha2.js";
+import { sha256 as sha2565 } from "@noble/hashes/sha2.js";
 var DEK_KEY_ID = "dek";
 var KEY_ID_DOMAIN = utf8ToBytes("atlas-pek-id-v1");
 function projectKeyId(pek) {
   const input = new Uint8Array(KEY_ID_DOMAIN.length + pek.length);
   input.set(KEY_ID_DOMAIN, 0);
   input.set(pek, KEY_ID_DOMAIN.length);
-  return bytesToHex(sha2564(input).subarray(0, 16));
+  return bytesToHex(sha2565(input).subarray(0, 16));
 }
 
 class MissingScopeKey extends Error {
@@ -994,8 +1040,8 @@ class BlobOpener {
   }
 }
 // src/crypto/apiToken.ts
-import { sha256 as sha2565 } from "@noble/hashes/sha2.js";
-import { hkdf as hkdf4 } from "@noble/hashes/hkdf.js";
+import { sha256 as sha2566 } from "@noble/hashes/sha2.js";
+import { hkdf as hkdf5 } from "@noble/hashes/hkdf.js";
 var API_TOKEN_PREFIX = "atlas_pat_";
 var ID_BYTES = 16;
 var SECRET_BYTES = 32;
@@ -1036,8 +1082,8 @@ function parseApiToken(token) {
 function deriveApiTokenKeys(parts) {
   const salt = hexToBytes(parts.id.replace(/-/g, ""));
   return {
-    auth: bytesToHex(hkdf4(sha2565, parts.secret, salt, utf8ToBytes("atlas-pat-auth-v1"), 32)),
-    wrapKey: hkdf4(sha2565, parts.secret, salt, utf8ToBytes("atlas-pat-wrap-v1"), 32)
+    auth: bytesToHex(hkdf5(sha2566, parts.secret, salt, utf8ToBytes("atlas-pat-auth-v1"), 32)),
+    wrapKey: hkdf5(sha2566, parts.secret, salt, utf8ToBytes("atlas-pat-wrap-v1"), 32)
   };
 }
 var wrapAad = (userId, tokenId, slot) => utf8ToBytes(JSON.stringify(["atlas-pat-wrap", 1, userId.toLowerCase(), tokenId.toLowerCase(), slot]));
@@ -1096,8 +1142,8 @@ function unwrapApiTokenAppKeys(parts, userId, app, wrapped) {
 }
 // src/crypto/rootKey.ts
 import { x25519 as x255193 } from "@noble/curves/ed25519.js";
-import { sha256 as sha2566 } from "@noble/hashes/sha2.js";
-import { hkdf as hkdf5 } from "@noble/hashes/hkdf.js";
+import { sha256 as sha2567 } from "@noble/hashes/sha2.js";
+import { hkdf as hkdf6 } from "@noble/hashes/hkdf.js";
 var TODO_APP = "todo";
 var JOURNAL_APP = "journal";
 var KEY_BYTES = 32;
@@ -1135,7 +1181,7 @@ function wrapRootKey(root, wrappingKey, userId, slot) {
 function unwrapRootKey(wrap, wrappingKey, userId, slot) {
   return unwrapWith(wrappingKey, wrap, rootAad(userId, slot), "root key");
 }
-var sealKeyFrom = (shared) => hkdf5(sha2566, shared, undefined, utf8ToBytes("atlas-root-seal-v1"), 32);
+var sealKeyFrom = (shared) => hkdf6(sha2567, shared, undefined, utf8ToBytes("atlas-root-seal-v1"), 32);
 function sealRootKey(root, recoveryPublicKeyHex, userId) {
   const ephemeral = x255193.keygen();
   const shared = x255193.getSharedSecret(ephemeral.secretKey, hexToBytes(recoveryPublicKeyHex));
@@ -1170,8 +1216,8 @@ function unwrapAppPrivateKey(wrap, appKey, userId, app) {
   return unwrapWith(appKey, wrap, appIdentityAad(userId, app), "private key");
 }
 // src/crypto/passkey.ts
-import { sha256 as sha2567 } from "@noble/hashes/sha2.js";
-import { hkdf as hkdf6 } from "@noble/hashes/hkdf.js";
+import { sha256 as sha2568 } from "@noble/hashes/sha2.js";
+import { hkdf as hkdf7 } from "@noble/hashes/hkdf.js";
 
 // src/text.ts
 function trimTrailing(text, char) {
@@ -1187,7 +1233,7 @@ function trimTrailing(text, char) {
 var PASSKEY_PRF_LABEL = "atlas-passkey-prf-v1";
 var SLOT_INFO = "atlas-passkey-slot-v1";
 function passkeyPrfInput() {
-  return sha2567(utf8ToBytes(PASSKEY_PRF_LABEL));
+  return sha2568(utf8ToBytes(PASSKEY_PRF_LABEL));
 }
 function passkeyPrfInputBase64Url() {
   return bytesToBase64Url(passkeyPrfInput());
@@ -1207,7 +1253,32 @@ function passkeySlot(credentialId) {
 function derivePasskeySlotKey(prfOutput, credentialId) {
   if (prfOutput.byteLength !== 32)
     throw new Error("a PRF output is 32 bytes");
-  return hkdf6(sha2567, prfOutput, decodeBase64Url(credentialId), utf8ToBytes(SLOT_INFO), 32);
+  return hkdf7(sha2568, prfOutput, decodeBase64Url(credentialId), utf8ToBytes(SLOT_INFO), 32);
+}
+// src/crypto/invitePreview.ts
+function previewAad(projectId, kid) {
+  return utf8ToBytes(JSON.stringify(["atlas-invite-preview", 1, projectId, kid]));
+}
+function sealInvitePreview(pek, kid, projectId, preview) {
+  const { name, icon, color, kind } = preview;
+  const plain = padPlaintext(utf8ToBytes(JSON.stringify({ name, icon, color, kind })), 64);
+  const { iv, ct } = encryptAesGcm(pek, plain, previewAad(projectId, kid));
+  return { v: 1, kid, iv, ct };
+}
+function openInvitePreview(pek, projectId, sealed) {
+  const plain = decryptAesGcm(pek, sealed, previewAad(projectId, sealed.kid));
+  const parsed = JSON.parse(bytesToUtf8(unpadPlaintext(plain)));
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error("malformed invite preview");
+  }
+  const { name, icon, color, kind } = parsed;
+  return { name, icon, color, kind };
+}
+function isSealedInvitePreview(v) {
+  if (typeof v !== "object" || v === null)
+    return false;
+  const o = v;
+  return o.v === 1 && typeof o.kid === "string" && typeof o.iv === "string" && typeof o.ct === "string";
 }
 // src/realtime.ts
 var REALTIME_BACKOFF_BASE_MS = 1000;
@@ -1227,7 +1298,7 @@ function retryAfterOf(err) {
   const ms = err?.retryAfterMs;
   return typeof ms === "number" && ms > 0 ? ms : undefined;
 }
-var SYNC_PROTOCOL = 6;
+var SYNC_PROTOCOL = 7;
 function buildSyncWsUrl(baseUrl, ticket, since) {
   const base = baseUrl.replace(/\/$/, "").replace(/^http/, "ws");
   return `${base}/sync/ws?ticket=${encodeURIComponent(ticket)}&since=${since}&protocol=${SYNC_PROTOCOL}`;
@@ -1454,50 +1525,59 @@ function assertServerCompatible(discovery, required) {
 }
 // ../../manifests/journal.json
 var journal_default = {
-  _doc: "The Atlas Journal app manifest: daily journal entries, end-to-end encrypted. Its kinds are namespaced `journal.<kind>`. Journal v1 is personal: the server never fans its ops out to another account and reads none of their fields, so every field value is encrypted (no plaintext_fields). `journal.entry` is one entry (date, title, body, mood, tags, …), `journal.preference` one of the app's settings. Bump `version` whenever the kinds or their plaintext fields change.",
+  _doc: "The Atlas Journal app manifest: daily journal entries, end-to-end encrypted. Its kinds are namespaced `journal.<kind>`; on the wire (sync protocol 7, docs/decisions/0006) every one is `journal.sealed`, with opaque field tags and the real kind inside the encrypted value. Journal v1 is personal: the server never fans its ops out to another account and reads none of their fields, so nothing is public or plaintext. `journal.entry` is one entry (date, title, body, mood, tags, …), `journal.preference` one of the app's settings. Rows written before protocol 7 carry the real kind as their wire kind and stay readable until clients migrate them. Bump `version` whenever the kinds or their fields change.",
   app: "journal",
   name: "Atlas Journal",
-  version: 1,
+  version: 2,
   kinds: {
-    "journal.entry": { plaintext_fields: [] },
-    "journal.preference": { plaintext_fields: [] }
+    "journal.entry": { wire: "journal.sealed" },
+    "journal.preference": { wire: "journal.sealed" }
   }
 };
 // ../../manifests/todo.json
 var todo_default = {
-  _doc: 'The Atlas Todo app manifest, compiled into the server (atlas-core) and bundled by the clients (packages/client-core); operators never load manifests from disk. `kinds` lists the entity kinds the app syncs: todo\'s kinds keep their original bare names on the wire, every later app namespaces its kinds as `<app>.<kind>`. `plaintext_fields` lists, per kind, the fields a client sends WITHOUT end-to-end encryption; every other field value is encrypted. Only values the server must read stay plaintext: fan-out and membership checks (project_id, task_id, assignee_id, actor_id) and attachment blob addressing (blob_sha, thumb_sha); wrapped_key and meta are already ciphertext. project_member rows are server-authored ("all"). The client encrypts by this table and the server asserts that every field value it reads is listed here. Bump `version` whenever the kinds or their plaintext fields change.',
+  _doc: "The Atlas Todo app manifest, compiled into the server (atlas-core) and bundled by the clients (packages/client-core); operators never load manifests from disk. `kinds` lists the entity kinds the app syncs, by their real names, which only clients see (sync protocol 7, docs/decisions/0006). `wire` is the kind the server sees instead: `todo.project` for a project, `todo.sealed` for everything else, `project_member` for the server-authored membership rows. Every field travels under an opaque per-entity tag inside an encrypted value, except `public_fields`, which keep their names because the server acts on them: a project's `deleted_at`/`archived_at` are owner-only (values still encrypted), an attachment's `blob_sha`/`thumb_sha` address its blobs. `plaintext_fields` (a subset of `public_fields`, or \"all\" for server-authored kinds) travel unencrypted. `legacy_plaintext_fields` are the fields protocol 6 sent in plaintext, under the real kind name as the wire kind; such rows stay readable until clients migrate them (POST /sync/legacy/drop). Bump `version` whenever the kinds or their fields change.",
   app: "todo",
   name: "Atlas Todo",
-  version: 1,
+  version: 2,
   kinds: {
-    task: { plaintext_fields: ["project_id", "assignee_id"] },
-    project: { plaintext_fields: [] },
-    section: { plaintext_fields: ["project_id"] },
-    label: { plaintext_fields: [] },
-    comment: { plaintext_fields: ["task_id"] },
-    preference: { plaintext_fields: [] },
-    saved_filter: { plaintext_fields: [] },
-    reminder: { plaintext_fields: [] },
-    project_member: { plaintext_fields: "all" },
-    activity: { plaintext_fields: ["task_id", "actor_id"] },
-    focus_session: { plaintext_fields: [] },
-    habit: { plaintext_fields: [] },
-    habit_checkin: { plaintext_fields: [] },
+    task: { wire: "todo.sealed", legacy_plaintext_fields: ["project_id", "assignee_id"] },
+    project: { wire: "todo.project", public_fields: ["deleted_at", "archived_at"] },
+    section: { wire: "todo.sealed", legacy_plaintext_fields: ["project_id"] },
+    label: { wire: "todo.sealed" },
+    comment: { wire: "todo.sealed", legacy_plaintext_fields: ["task_id"] },
+    preference: { wire: "todo.sealed" },
+    saved_filter: { wire: "todo.sealed" },
+    reminder: { wire: "todo.sealed" },
+    project_member: { wire: "project_member", plaintext_fields: "all" },
+    activity: { wire: "todo.sealed", legacy_plaintext_fields: ["task_id", "actor_id"] },
+    focus_session: { wire: "todo.sealed" },
+    habit: { wire: "todo.sealed" },
+    habit_checkin: { wire: "todo.sealed" },
     attachment: {
-      plaintext_fields: ["task_id", "blob_sha", "thumb_sha", "wrapped_key", "meta"]
+      wire: "todo.sealed",
+      public_fields: ["blob_sha", "thumb_sha"],
+      plaintext_fields: ["blob_sha", "thumb_sha"],
+      legacy_plaintext_fields: ["task_id", "blob_sha", "thumb_sha", "wrapped_key", "meta"]
     }
   }
 };
 // ../../manifests/vault.json
 var vault_default = {
-  _doc: "The Atlas Vault app manifest: a password manager, end-to-end encrypted, held to a stricter threat model than todo. Its kinds are namespaced `vault.<kind>`. Vault v1 is personal: the server never fans its ops out to another account and reads none of their fields, so every field value is encrypted (no plaintext_fields), including the item type, its folder and its timestamps. `vault.item` is one item (login, note, card, identity, ssh_key, api_key: name, typed fields, urls, notes, tags, folder, favorite, secret field history), `vault.folder` one folder, `vault.preference` one of the app's settings. `api_tokens` is the policy for API tokens that include the app, which the server enforces: an expiry is required, at most `max_lifetime_days` after creation, a token is read-only unless its creator opts in to writes, and it is for the vault alone (`exclusive`: no other app's key travels with a vault secret). Bump `version` whenever the kinds, their plaintext fields or the token policy change.",
+  _doc: "The Atlas Vault app manifest: a password manager, end-to-end encrypted, held to a stricter threat model than todo. Its kinds are namespaced `vault.<kind>`; on the wire (sync protocol 7, docs/decisions/0006) every one is `vault.sealed`, with opaque field tags and the real kind inside the encrypted value, and rows written before protocol 7 (under the real kind) stay readable until clients migrate them. Vault v1 is personal: the server never fans its ops out to another account and reads none of their fields, so every field value is encrypted (nothing public or plaintext), including the item type, its folder and its timestamps. `vault.item` is one item (login, note, card, identity, ssh_key, api_key: name, typed fields, urls, notes, tags, folder, favorite, secret field history), `vault.folder` one folder, `vault.preference` one of the app's settings. `api_tokens` is the policy for API tokens that include the app, which the server enforces: an expiry is required, at most `max_lifetime_days` after creation, a token is read-only unless its creator opts in to writes, and it is for the vault alone (`exclusive`: no other app's key travels with a vault secret). Bump `version` whenever the kinds, their plaintext fields or the token policy change.",
   app: "vault",
   name: "Atlas Vault",
-  version: 2,
+  version: 3,
   kinds: {
-    "vault.item": { plaintext_fields: [] },
-    "vault.folder": { plaintext_fields: [] },
-    "vault.preference": { plaintext_fields: [] }
+    "vault.item": {
+      wire: "vault.sealed"
+    },
+    "vault.folder": {
+      wire: "vault.sealed"
+    },
+    "vault.preference": {
+      wire: "vault.sealed"
+    }
   },
   api_tokens: {
     expiry_required: true,
@@ -1560,11 +1640,18 @@ var ENTITY_KINDS = {
   "vault.folder": true,
   "vault.preference": true
 };
+function kindSpec(kind) {
+  return appOfKind(kind)?.kinds[kind];
+}
 function loadTable(manifests) {
   const table = {};
   for (const kind of Object.keys(ENTITY_KINDS)) {
     const owner = manifests.find((m) => Object.prototype.hasOwnProperty.call(m.kinds, kind));
-    const entry = owner?.kinds[kind]?.plaintext_fields;
+    const spec = owner?.kinds[kind];
+    if (typeof spec?.wire !== "string") {
+      throw new Error(`app manifests: no wire kind for "${kind}"`);
+    }
+    const entry = spec.plaintext_fields ?? [];
     if (entry === "all")
       table[kind] = "all";
     else if (Array.isArray(entry) && entry.every((f) => typeof f === "string"))
@@ -1575,8 +1662,20 @@ function loadTable(manifests) {
   return Object.freeze(table);
 }
 var PLAINTEXT_FIELDS = loadTable(BUNDLED_MANIFESTS);
+function appOfWire(name) {
+  return appOfKind(name) ?? BUNDLED_MANIFESTS.find((m) => Object.values(m.kinds).some((k) => k.wire === name));
+}
+function wireKindOf(kind) {
+  return kindSpec(kind)?.wire ?? null;
+}
+function isPublicField(kind, field) {
+  const spec = kindSpec(kind);
+  if (!spec)
+    return false;
+  return spec.plaintext_fields === "all" || (spec.public_fields ?? []).includes(field);
+}
 function shouldEncryptKindField(entity, field) {
-  const plain = appOfKind(entity)?.kinds[entity]?.plaintext_fields;
+  const plain = kindSpec(entity)?.plaintext_fields;
   if (plain === "all")
     return false;
   return !plain?.includes(field);
@@ -1587,6 +1686,28 @@ function shouldEncryptField(entity, field) {
     return false;
   return !plain?.includes(field);
 }
+function legacyEncrypted(kind, field) {
+  const spec = kindSpec(kind);
+  if (spec?.plaintext_fields === "all")
+    return false;
+  return !(spec?.legacy_plaintext_fields ?? []).includes(field);
+}
+function isLegacyWireKind(name) {
+  const spec = kindSpec(name);
+  return spec !== undefined && spec.wire !== name;
+}
+function kindsOfWire(wire) {
+  return Object.keys(ENTITY_KINDS).filter((k) => kindSpec(k)?.wire === wire);
+}
+function realKindOf(wire, publicField) {
+  const kinds = kindsOfWire(wire);
+  if (kinds.length === 1)
+    return kinds[0];
+  if (publicField === undefined)
+    return null;
+  const naming = kinds.filter((k) => isPublicField(k, publicField));
+  return naming.length === 1 ? naming[0] : null;
+}
 
 // src/scope.ts
 import { sha1 } from "@noble/hashes/legacy.js";
@@ -1787,6 +1908,178 @@ function recordKeyTrustBaseline(store, keyring, userId) {
   write(store, "keys_initialized", true);
 }
 
+// src/wire.ts
+function isSealedPlaceholder(v) {
+  return isFieldEnvelopeV3(v) && "scope" in v;
+}
+function isSealedWireKind(name) {
+  return kindsOfWire(name).length > 0 && !isLegacyWireKind(name) && name !== "project_member";
+}
+var tagKeys = new WeakMap;
+function tagKeyOf(key) {
+  let tagKey = tagKeys.get(key);
+  if (!tagKey)
+    tagKeys.set(key, tagKey = fieldTagKey(key));
+  return tagKey;
+}
+function wireFieldOf(key, kind, entityId, field) {
+  return isPublicField(kind, field) ? field : fieldTag(tagKeyOf(key), entityId, kind, field);
+}
+function scopeOfKey(scope) {
+  return scope.kind === "project" ? scope.projectId : null;
+}
+function encodeOp(op, k) {
+  const wire = wireKindOf(op.entity);
+  if (!wire || wire === "project_member")
+    throw new Error(`cannot push ${op.entity} ops`);
+  const ts = { wall_ms: op.ts.wallMs, counter: op.ts.counter, node: op.ts.node };
+  const base = { id: op.id, entity: wire, entity_id: op.entityId, scope: scopeOfKey(k.scope), ts };
+  if (op.op === "delete")
+    return { ...base, op: "delete" };
+  const field = wireFieldOf(k.key, op.entity, op.entityId, op.field);
+  const value = shouldEncryptField(op.entity, op.field) ? sealField(k.key, k.keyId, k.scope, { entity: wire, entityId: op.entityId, field }, { kind: op.entity, field: op.field, value: op.value }) : op.value;
+  return { ...base, op: "set", field, value };
+}
+function keysFor(keyring, scope, kid) {
+  if (scope === null) {
+    if (kid !== DEK_KEY_ID)
+      return [];
+    return [{ key: keyring.getDek(), keyId: DEK_KEY_ID, scope: { kind: "personal" } }];
+  }
+  const key = keyring.projectKey(scope, kid);
+  return key ? [{ key, keyId: kid, scope: { kind: "project", projectId: scope } }] : [];
+}
+function openSealed(keyring, wire, entityId, wireField, scope, envelope) {
+  for (const k of keysFor(keyring, scope, envelope.kid)) {
+    let sealed;
+    try {
+      sealed = openSealedField(k.key, k.scope, { entity: wire, entityId, field: wireField }, envelope);
+    } catch {
+      continue;
+    }
+    const kind = sealed.kind;
+    if (wireKindOf(kind) !== wire)
+      return null;
+    if (wireFieldOf(k.key, kind, entityId, sealed.field) !== wireField)
+      return null;
+    return { kind, field: sealed.field, value: sealed.value, keyId: k.keyId, scope: k.scope };
+  }
+  return null;
+}
+function hlcOf(w) {
+  return { wallMs: w.ts.wall_ms, counter: w.ts.counter, node: w.ts.node };
+}
+function decodeOps(wireOps, ctx) {
+  const out = [];
+  const pageKinds = new Map;
+  const pendingDeletes = [];
+  for (const w of wireOps) {
+    const ts = hlcOf(w);
+    const base = { id: w.id, entityId: w.entity_id, ts };
+    if (isLegacyWireKind(w.entity) || w.entity === "project_member") {
+      const kind = w.entity;
+      pageKinds.set(w.entity_id, kind);
+      if (w.op === "delete") {
+        out.push({
+          op: { ...base, entity: kind, op: "delete" },
+          legacy: w.entity !== "project_member"
+        });
+        continue;
+      }
+      const op = { ...base, entity: kind, op: "set", field: w.field, value: w.value };
+      if (w.entity === "project_member" || !legacyEncrypted(kind, w.field)) {
+        out.push({ op, legacy: w.entity !== "project_member" });
+        continue;
+      }
+      const opened = ctx.openLegacy(op);
+      out.push(opened ? { op: opened, legacy: true } : null);
+      continue;
+    }
+    if (w.op === "delete") {
+      const kind = realKindOf(w.entity) ?? ctx.store.kindOf(w.entity_id);
+      out.push({
+        op: { ...base, entity: kind ?? w.entity, op: "delete" },
+        legacy: false
+      });
+      if (!kind)
+        pendingDeletes.push(out.length - 1);
+      continue;
+    }
+    const scope = w.scope ?? null;
+    const publicKind = isPublicFieldOfWire(w.entity, w.field) ? realKindOf(w.entity, w.field) : null;
+    if (publicKind && !shouldEncryptField(publicKind, w.field)) {
+      pageKinds.set(w.entity_id, publicKind);
+      out.push({
+        op: { ...base, entity: publicKind, op: "set", field: w.field, value: w.value },
+        legacy: false
+      });
+      continue;
+    }
+    if (!isFieldEnvelopeV3(w.value)) {
+      console.warn(`[atlas-e2ee] dropped a value that is no sealed envelope (${w.entity_id})`);
+      out.push(null);
+      continue;
+    }
+    const opened = ctx.keyring ? openSealed(ctx.keyring, w.entity, w.entity_id, w.field, scope, w.value) : null;
+    if (!opened) {
+      console.warn(`[atlas-e2ee] no key opens ${w.entity} ${w.field} (${w.entity_id})`);
+      const placeholder = { ...w.value, scope };
+      out.push({
+        op: {
+          ...base,
+          entity: w.entity,
+          op: "set",
+          field: w.field,
+          value: placeholder
+        },
+        legacy: false
+      });
+      continue;
+    }
+    if (opened.kind === "activity" && opened.field === "actor_id") {
+      if (!w.pushed_by || opened.value !== w.pushed_by) {
+        console.warn(`[atlas-e2ee] dropped an activity whose actor did not push it (${w.entity_id})`);
+        out.push(null);
+        continue;
+      }
+    }
+    pageKinds.set(w.entity_id, opened.kind);
+    out.push({
+      op: { ...base, entity: opened.kind, op: "set", field: opened.field, value: opened.value },
+      opened: { keyId: opened.keyId, scope: opened.scope },
+      legacy: false
+    });
+  }
+  for (const i of pendingDeletes) {
+    const d = out[i];
+    const kind = pageKinds.get(d.op.entityId);
+    if (kind)
+      d.op = { ...d.op, entity: kind };
+  }
+  return out.filter((d) => d !== null);
+}
+function isPublicFieldOfWire(wire, field) {
+  return kindsOfWire(wire).some((k) => isPublicField(k, field));
+}
+function sealedRepair(d, expected, isCanonical) {
+  if (d.op.op !== "set" || !d.opened)
+    return null;
+  const { keyId, scope } = d.opened;
+  if (expected && sameKeyScope(expected, scope) && isCanonical(keyId, expected))
+    return null;
+  return {
+    entity: d.op.entity,
+    entityId: d.op.entityId,
+    field: d.op.field,
+    ts: d.op.ts,
+    value: d.op.value,
+    reason: "key",
+    keyId,
+    scope,
+    version: 3
+  };
+}
+
 // src/scope.ts
 var EMPTY_SCOPE_STORE = {
   list: () => [],
@@ -2049,9 +2342,9 @@ function confirmRepairs(store, keyring, userId, repairs) {
       const desired = preferredKey(keyring, resolveScope(store, r.entity, r.entityId), shared);
       if (!desired || !r.scope || !sameKeyScope(desired.scope, r.scope))
         return false;
-      if (desired.keyId === r.keyId && r.version === 2)
+      if (desired.keyId === r.keyId && (r.version === 2 || r.version === 3))
         return false;
-      if (r.version === 2 && r.keyId !== undefined && r.scope.kind === "project" && keyring.isRetired(r.scope.projectId, r.keyId)) {
+      if ((r.version === 2 || r.version === 3) && r.keyId !== undefined && r.scope.kind === "project" && keyring.isRetired(r.scope.projectId, r.keyId)) {
         return false;
       }
     }
@@ -2088,8 +2381,22 @@ function reviveLockedValues(store, keyring, userId, personalV1 = true) {
       adoptPersonalV1: expected?.kind === "project" && sole.has(expected.projectId)
     });
   });
-  const repairs = confirmRepairs(store, keyring, userId, revived.map((r) => ({ ...r, reason: "key" })));
-  return { revived: revived.length, repaired: applyRepairs(store, repairs) };
+  const sealed = store.reviveSealed((wire, entityId, wireField, placeholder) => openSealed(keyring, wire, entityId, wireField, placeholder.scope, placeholder));
+  const repairs = confirmRepairs(store, keyring, userId, [
+    ...revived.map((r) => ({ ...r, reason: "key" })),
+    ...sealed.map((r) => ({
+      entity: r.entity,
+      entityId: r.entityId,
+      field: r.field,
+      ts: r.ts,
+      value: r.value,
+      reason: "key",
+      keyId: r.keyId,
+      scope: r.scope,
+      version: 3
+    }))
+  ]);
+  return { revived: revived.length + sealed.length, repaired: applyRepairs(store, repairs) };
 }
 function isPayload(v) {
   return typeof v === "object" && v !== null && typeof v.iv === "string" && typeof v.ct === "string";
@@ -2187,20 +2494,9 @@ class E2eeLockedError extends Error {
   }
 }
 function encodeWireOp(op, keyring, key) {
-  const ts = { wall_ms: op.ts.wallMs, counter: op.ts.counter, node: op.ts.node };
-  const base = { id: op.id, entity: op.entity, entity_id: op.entityId, ts };
-  if (op.op === "delete")
-    return { ...base, op: "delete" };
-  let value = op.value;
-  if (shouldEncryptField(op.entity, op.field)) {
-    if (!keyring?.hasKeys())
-      throw new E2eeLockedError;
-    const k = key();
-    const at = { entity: op.entity, entityId: op.entityId, field: op.field };
-    const encryptedValue = encryptField(k.key, k.keyId, k.scope, at, op.value);
-    value = encryptedValue;
-  }
-  return { ...base, op: "set", field: op.field, value };
+  if (!keyring?.hasKeys())
+    throw new E2eeLockedError;
+  return encodeOp(op, key());
 }
 function toEncryptedWire(op, keyring, projectId) {
   return encodeWireOp(op, keyring, () => {
@@ -2214,15 +2510,25 @@ function toEncryptedWire(op, keyring, projectId) {
   });
 }
 function fromEncryptedWire(w, keyring, projectId) {
+  if (!isLegacyWireKind(w.entity) && w.entity !== "project_member") {
+    const [d] = decodeOps([w], {
+      keyring: keyring?.hasKeys() ? keyring : null,
+      store: { kindOf: () => null },
+      openLegacy: () => null
+    });
+    if (!d)
+      throw new Error(`dropped ${w.entity} op ${w.id}`);
+    return d.op;
+  }
   const ts = { wallMs: w.ts.wall_ms, counter: w.ts.counter, node: w.ts.node };
   const base = { id: w.id, entity: w.entity, entityId: w.entity_id, ts };
   if (w.op === "delete")
     return { ...base, op: "delete" };
   let value = w.value;
-  if (keyring?.hasKeys() && isEncryptedEnvelope(value)) {
+  if (keyring?.hasKeys() && isEncryptedEnvelope(value) && legacyEncrypted(w.entity, w.field)) {
     const expected = projectId === undefined ? null : projectId === null ? { kind: "personal" } : { kind: "project", projectId };
     const at = { entity: w.entity, entityId: w.entity_id, field: w.field };
-    const opened = openFieldValue(keyring, value, at, expected, openOptionsFor(w.entity, w.entity_id, true));
+    const opened = openFieldValue(keyring, value, at, expected, openOptionsFor(base.entity, w.entity_id, true));
     if (opened)
       value = opened.value;
     else
@@ -2431,6 +2737,10 @@ class ApiClient {
   isLegacyMigrated() {
     return this.legacyDone || readKeyTrust(this.scopeStore ?? EMPTY_SCOPE_STORE).legacyMigrated;
   }
+  kindOfEntity(id) {
+    const store = this.scopeStore;
+    return store?.kindOf?.(id) ?? null;
+  }
   isCanonical(keyId, scope) {
     if (scope.kind === "personal")
       return keyId === DEK_KEY_ID;
@@ -2975,43 +3285,76 @@ class ApiClient {
       throw new Error("malformed sync payload");
     const wireOps = operations;
     const store = this.scopeStore ?? EMPTY_SCOPE_STORE;
-    const decoded = wireOps.map((w) => fromEncryptedWire(w, null));
-    const batch = batchLinksOf(decoded);
-    const shared = sharedProjectIds(store);
     const legacy = !this.isLegacyMigrated();
-    const repairs = [];
-    const out = [];
-    for (const op of decoded) {
-      if (op.op !== "set" || !shouldEncryptField(op.entity, op.field)) {
-        out.push(op);
-        continue;
-      }
-      const at = { entity: op.entity, entityId: op.entityId, field: op.field, ts: op.ts };
-      const trustState = op.entity === "preference" && op.entityId === KEY_TRUST_ID;
-      if (!isEncryptedEnvelope(op.value)) {
-        if (!legacy || trustState) {
-          console.warn(`[atlas-e2ee] dropped plaintext in ${op.entity}.${op.field} (${op.entityId})`);
-          continue;
+    const legacyLinks = batchLinksOf(wireOps.filter((w) => isLegacyWireKind(w.entity)).map((w) => fromEncryptedWire(w, null)));
+    const shared = sharedProjectIds(store);
+    const ctx = {
+      keyring,
+      store: { kindOf: (id) => this.kindOfEntity(id) },
+      openLegacy: (op) => {
+        const at = { entity: op.entity, entityId: op.entityId, field: op.field, ts: op.ts };
+        const trustState = op.entity === "preference" && op.entityId === KEY_TRUST_ID;
+        if (!isEncryptedEnvelope(op.value)) {
+          if (!legacy || trustState) {
+            console.warn(`[atlas-e2ee] dropped plaintext in ${op.entity}.${op.field} (${op.entityId})`);
+            return null;
+          }
+          return op;
         }
-        repairs.push({ ...at, value: op.value, reason: "plaintext" });
-        out.push(op);
-        continue;
+        const expected = expectedKeyScope(keyring, resolveScope(store, op.entity, op.entityId, legacyLinks), shared);
+        const opened = openFieldValue(keyring, op.value, at, expected, openOptionsFor(op.entity, op.entityId, legacy));
+        if (!opened) {
+          console.warn(`[atlas-e2ee] no key opens ${op.entity}.${op.field} (${op.entityId})`);
+          return op;
+        }
+        return { ...op, value: opened.value };
       }
-      const expected = expectedKeyScope(keyring, resolveScope(store, op.entity, op.entityId, batch), shared);
-      const opened = openFieldValue(keyring, op.value, at, expected, openOptionsFor(op.entity, op.entityId, legacy));
-      if (!opened) {
-        console.warn(`[atlas-e2ee] no key opens ${op.entity}.${op.field} (${op.entityId})`);
-        out.push(op);
+    };
+    const decoded = decodeOps(wireOps, ctx);
+    const batch = batchLinksOf(decoded.map((d) => d.op));
+    const repairs = [];
+    for (const d of decoded) {
+      if (d.legacy || !d.opened)
         continue;
-      }
-      if (!expected || opened.version === 1 || !this.isCanonical(opened.keyId, expected)) {
-        const { keyId, scope, version } = opened;
-        repairs.push({ ...at, value: opened.value, reason: "key", keyId, scope, version });
-      }
-      out.push({ ...op, value: opened.value });
+      const expected = expectedKeyScope(keyring, resolveScope(store, d.op.entity, d.op.entityId, batch), shared);
+      const repair = sealedRepair(d, expected, (keyId, scope) => this.isCanonical(keyId, scope));
+      if (repair)
+        repairs.push(repair);
     }
+    const out = decoded.map((d) => d.op);
     return { operations: out, cursor, from: typeof from === "number" ? from : undefined, repairs };
   }
+  legacyKeys(next) {
+    const q = next === undefined ? "" : `?next=${encodeURIComponent(next)}`;
+    return this.request("GET", `/sync/legacy/keys${q}`);
+  }
+  async dropLegacy(keys) {
+    const res = await this.request("POST", "/sync/legacy/drop", {
+      entities: keys
+    });
+    return res.dropped;
+  }
+  mayReencode(kind, entityId) {
+    const store = this.scopeStore;
+    const user = this.scopeUserId;
+    if (!store || !user)
+      return false;
+    if (kind === "activity" && store.rawField("activity", entityId, "actor_id") !== user) {
+      return false;
+    }
+    const scope = resolveScope(store, kind, entityId);
+    if (scope.kind === "unknown")
+      return false;
+    if (scope.kind === "personal")
+      return true;
+    const rows = store.list("project_member").filter((e) => e.fields.project_id === scope.projectId && e.fields.state === "active");
+    if (rows.length === 0)
+      return true;
+    const mine = rows.find((e) => e.fields.user_id === user);
+    if (!mine)
+      return false;
+    return kind !== "project" || mine.fields.role === "owner";
+  }
   async syncWsUrl(since) {
     if (!this.token)
       return null;
@@ -3021,8 +3364,12 @@ class ApiClient {
   listMembers(projectId) {
     return this.request("GET", `/projects/${projectId}/members`);
   }
-  inviteMember(projectId, email, role) {
-    return this.request("POST", `/projects/${projectId}/members`, { email, role });
+  inviteMember(projectId, email, role, preview) {
+    return this.request("POST", `/projects/${projectId}/members`, {
+      email,
+      role,
+      ...preview ? { preview } : {}
+    });
   }
   acceptInvite(projectId) {
     return this.request("POST", `/projects/${projectId}/accept`);
@@ -3816,6 +4163,8 @@ class LocalStore {
     let state = byId.get(op.entityId);
     if (!state) {
       state = { fields: new Map, deleted: null, deletedOp: null };
+      if (!isSealedWireKind(op.entity))
+        this.inheritTombstone(op.entityId, state);
       byId.set(op.entityId, state);
     }
     let changed;
@@ -3836,6 +4185,26 @@ class LocalStore {
       this.kindChanged.set(op.entity, ++this.changeSeq);
     return changed;
   }
+  inheritTombstone(entityId, state) {
+    for (const [kind, byId] of this.entities) {
+      if (!isSealedWireKind(kind))
+        continue;
+      const pending = byId.get(entityId);
+      if (!pending?.deleted)
+        continue;
+      if (state.deleted === null || compareHlc(pending.deleted, state.deleted) > 0) {
+        state.deleted = pending.deleted;
+        state.deletedOp = pending.deletedOp;
+      }
+    }
+  }
+  kindOf(entityId) {
+    for (const [kind, byId] of this.entities) {
+      if (!isSealedWireKind(kind) && byId.has(entityId))
+        return kind;
+    }
+    return null;
+  }
   state(entity, entityId) {
     return this.entities.get(entity)?.get(entityId);
   }
@@ -3886,6 +4255,10 @@ class LocalStore {
       return null;
     return { ...fs.ts };
   }
+  tombstoneTs(entity, entityId) {
+    const deleted = this.state(entity, entityId)?.deleted;
+    return deleted ? { ...deleted } : null;
+  }
   visibleFieldStates(entity, entityId) {
     const state = this.state(entity, entityId);
     if (!state)
@@ -3913,6 +4286,8 @@ class LocalStore {
     const revived = [];
     const ops = [];
     for (const [entity, byId] of this.entities) {
+      if (isSealedWireKind(entity))
+        continue;
       for (const [entityId, state] of byId) {
         for (const [field, fs] of state.fields) {
           if (!isEncryptedEnvelope(fs.value))
@@ -3944,6 +4319,56 @@ class LocalStore {
     }
     return revived;
   }
+  reviveSealed(open) {
+    const revived = [];
+    const ops = [];
+    const gone = [];
+    for (const [wire, byId] of this.entities) {
+      if (!isSealedWireKind(wire))
+        continue;
+      for (const [entityId, state] of byId) {
+        for (const [wireField, fs] of state.fields) {
+          if (!isSealedPlaceholder(fs.value))
+            continue;
+          const opened = open(wire, entityId, wireField, fs.value);
+          if (!opened)
+            continue;
+          state.fields.delete(wireField);
+          gone.push(fs.op);
+          const op = {
+            id: this.newId(),
+            entity: opened.kind,
+            entityId,
+            ts: { ...fs.ts },
+            op: "set",
+            field: opened.field,
+            value: opened.value
+          };
+          this.applied.add(op.id);
+          if (this.mergeInto(op))
+            ops.push(op);
+          revived.push({
+            ...opened,
+            entity: opened.kind,
+            entityId,
+            field: opened.field,
+            ts: { ...fs.ts }
+          });
+        }
+        if (state.fields.size === 0 && state.deleted === null)
+          byId.delete(entityId);
+      }
+    }
+    if (ops.length > 0)
+      this.persistBatch(ops, true);
+    const p = this.persistence;
+    if (p?.deleteOps && gone.length > 0) {
+      this.writeChain = this.writeChain.then(() => p.deleteOps(gone)).catch((err) => this.reportPersistError(err));
+    }
+    if (revived.length > 0)
+      this.emit();
+    return revived;
+  }
   visibleFields(state) {
     const visible = {};
     for (const [name, fs] of state.fields) {
@@ -4716,14 +5141,14 @@ function rowToOp(r) {
   };
 }
 // src/sealedPersistence.ts
-import { hkdf as hkdf7 } from "@noble/hashes/hkdf.js";
-import { sha256 as sha2568 } from "@noble/hashes/sha2.js";
+import { hkdf as hkdf8 } from "@noble/hashes/hkdf.js";
+import { sha256 as sha2569 } from "@noble/hashes/sha2.js";
 var LOCAL_STORE_KEY_ID = "local-v1";
 var SCOPE = { kind: "personal" };
 function deriveLocalStoreKey(appKey, userId) {
   if (appKey.length !== 32)
     throw new Error("the app key must be 32 bytes");
-  return hkdf7(sha2568, appKey, utf8ToBytes(userId), utf8ToBytes("atlas-local-store-v1"), 32);
+  return hkdf8(sha2569, appKey, utf8ToBytes(userId), utf8ToBytes("atlas-local-store-v1"), 32);
 }
 
 class SealedStoreError extends Error {
@@ -4818,7 +5243,7 @@ function sealPersistence(inner, key) {
   return sealed;
 }
 // src/attachments.ts
-import { sha256 as sha2569 } from "@noble/hashes/sha2.js";
+import { sha256 as sha25610 } from "@noble/hashes/sha2.js";
 var DEFAULT_MAX_BLOB_BYTES = 25 * 1024 * 1024;
 function maxAttachmentBytes(maxBlobBytes = DEFAULT_MAX_BLOB_BYTES) {
   return maxPlainSize(maxBlobBytes);
@@ -4836,7 +5261,7 @@ function generateAek() {
   return randomBytes(32);
 }
 function sha256Hex(bytes) {
-  return bytesToHex(sha2569(bytes));
+  return bytesToHex(sha25610(bytes));
 }
 function bytesSource(bytes) {
   return {
@@ -4895,8 +5320,8 @@ async function sealSource(aek, source, opts = {}) {
   const expected = sealedBlobSize(total);
   const sink = opts.asBlob ? new BlobSink : new BufferSink(expected);
   const sealer = new BlobSealer(aek);
-  const blobHash = sha2569.create();
-  const plainHash = sha2569.create();
+  const blobHash = sha25610.create();
+  const plainHash = sha25610.create();
   let size = 0;
   const emit = (bytes) => {
     blobHash.update(bytes);
@@ -4959,7 +5384,7 @@ class PlainCollector {
   out;
   parts = [];
   length = 0;
-  hash = sha2569.create();
+  hash = sha25610.create();
   constructor(blobSize) {
     this.out = blobSize !== null && blobSize <= MAX_PREALLOCATION ? new Uint8Array(blobSize) : null;
   }
@@ -5037,7 +5462,7 @@ async function fetchBlob(transport, sha, aek, plainSha) {
   const download = body instanceof Uint8Array ? { size: body.length, chunks: [body] } : body;
   const opener = new BlobOpener(aek);
   const plain = new PlainCollector(download.size);
-  const received = sha2569.create();
+  const received = sha25610.create();
   for await (const piece of download.chunks) {
     received.update(piece);
     for (const chunk of opener.push(piece))
@@ -5662,6 +6087,70 @@ class ExpoSqlDatabase {
     await this.db.closeAsync?.();
   }
 }
+// src/legacy.ts
+var ENTITIES_PER_PUSH = 100;
+function reencode(store, kind, id) {
+  if (!store.exists(kind, id))
+    return null;
+  const fields = store.visibleFieldStates(kind, id);
+  if (fields.some((f) => isEncryptedEnvelope(f.value)))
+    return null;
+  const ops = fields.map((f) => ({
+    id: store.newEntityId(),
+    entity: kind,
+    entityId: id,
+    ts: f.ts,
+    op: "set",
+    field: f.field,
+    value: f.value
+  }));
+  const deleted = store.tombstoneTs(kind, id);
+  if (deleted)
+    ops.push({ id: store.newEntityId(), entity: kind, entityId: id, ts: deleted, op: "delete" });
+  return ops;
+}
+async function migrateLegacy(store, transport) {
+  const result = { reencoded: 0, covered: 0, left: 0 };
+  let next;
+  do {
+    const page = await transport.legacyKeys(next);
+    next = page.next;
+    const drop = [];
+    const pending = [];
+    for (const key of page.entities) {
+      if (key.covered) {
+        drop.push(key);
+        result.covered++;
+        continue;
+      }
+      const kind = key.entity;
+      const ops = transport.mayReencode?.(kind, key.entity_id) === false ? null : reencode(store, kind, key.entity_id);
+      if (!ops || ops.length === 0) {
+        result.left++;
+        continue;
+      }
+      pending.push({ key, ops });
+    }
+    for (let i = 0;i < pending.length; i += ENTITIES_PER_PUSH) {
+      const chunk = pending.slice(i, i + ENTITIES_PER_PUSH);
+      const { deferred = [] } = await transport.syncPush(chunk.flatMap((c) => c.ops));
+      const waiting = new Set(deferred);
+      for (const { key, ops } of chunk) {
+        if (ops.some((op) => waiting.has(op.id))) {
+          result.left++;
+          continue;
+        }
+        drop.push(key);
+        result.reencoded++;
+      }
+    }
+    if (drop.length > 0) {
+      await transport.dropLegacy(drop.map(({ entity, entity_id }) => ({ entity, entity_id })));
+    }
+  } while (next);
+  return result;
+}
+
 // src/sync-client.ts
 var MAX_PUSH_OPS = 500;
 var MAX_PUSH_BYTES = 1.5 * 1024 * 1024;
@@ -5716,6 +6205,7 @@ function isBadSnapshotToken(err) {
 function isSnapshotUnsupported(err) {
   return err instanceof ApiError && err.status === 404;
 }
+var LEGACY_RETRY_MS = 10 * 60000;
 var THROTTLE_BASE_MS = 5000;
 var THROTTLE_MAX_MS = 5 * 60000;
 function isRateLimited(err) {
@@ -5752,6 +6242,8 @@ class SyncClient {
   clockSkew = null;
   resumeTimer = null;
   epoch = 0;
+  legacyDone = false;
+  legacyNextAt = 0;
   constructor(store, transport, opts = {}) {
     this.store = store;
     this.transport = transport;
@@ -5878,6 +6370,7 @@ class SyncClient {
       }
       if (repaired > 0)
         await this.pushOutbox(this.store.unsyncedOps());
+      await this.migrateLegacyRows();
       this.initialSyncDone = true;
       this.firstCycleDone = true;
       this.throttleStreak = 0;
@@ -5907,6 +6400,28 @@ class SyncClient {
       throw err;
     }
   }
+  async migrateLegacyRows() {
+    const t = this.transport;
+    if (this.legacyDone || !t.legacyKeys || !t.dropLegacy || Date.now() < this.legacyNextAt)
+      return;
+    try {
+      const result = await migrateLegacy(this.store, {
+        legacyKeys: (next) => t.legacyKeys(next),
+        dropLegacy: (keys) => t.dropLegacy(keys),
+        syncPush: (ops) => t.syncPush(ops),
+        mayReencode: t.mayReencode?.bind(t)
+      });
+      this.legacyDone = result.left === 0;
+      if (result.reencoded + result.covered > 0)
+        this.opts.onLegacyMigrated?.(result);
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 404)
+        this.legacyDone = true;
+      else
+        console.warn("[atlas SyncClient] protocol 6 migration pass failed:", err);
+    }
+    this.legacyNextAt = Date.now() + LEGACY_RETRY_MS;
+  }
   async pullPhase(firstPage) {
     if (this.needsBootstrap && await this.bootstrapFromSnapshot(firstPage) === null) {
       return this.replayFromZero();
@@ -6799,7 +7314,9 @@ export {
   EMPTY_KEY_TRUST,
   EMPTY_SCOPE_STORE,
   ExpoSqlDatabase,
+  FIELD_ENVELOPE_V3,
   FIELD_ENVELOPE_VERSION,
+  FIELD_V3_MIN_PADDING,
   HlcClock,
   IndexedDbPersistence,
   InvalidApiTokenError,
@@ -6808,6 +7325,7 @@ export {
   Keyring,
   LEGACY_DISCOVERY,
   LEGACY_KDF,
+  LEGACY_RETRY_MS,
   LOCAL_STORE_KEY_ID,
   LocalStore,
   MAX_CLOCK_DRIFT_MS,
@@ -6848,6 +7366,7 @@ export {
   addPasskey,
   apiErrorCode,
   appOfKind,
+  appOfWire,
   applyRepairs,
   argon2idPortable,
   assertServerCompatible,
@@ -6876,6 +7395,7 @@ export {
   createPasskeySlot,
   decodeBase64Url,
   decodeOpLogFile,
+  decodeOps,
   decryptAesGcm,
   decryptBlob,
   decryptField,
@@ -6891,6 +7411,7 @@ export {
   deriveRecoveryKey,
   deriveRecoveryKeys,
   enableApp,
+  encodeOp,
   encodeOpLogFile,
   encryptAesGcm,
   encryptBlob,
@@ -6901,6 +7422,8 @@ export {
   ensureSigningKey,
   expectedKeyScope,
   fetchBlob,
+  fieldTag,
+  fieldTagKey,
   forgetIdentity,
   formatApiToken,
   fromEncryptedWire,
@@ -6921,9 +7444,16 @@ export {
   isAdmin,
   isEncryptedEnvelope,
   isFieldEnvelopeV2,
+  isFieldEnvelopeV3,
+  isFieldTag,
+  isLegacyWireKind,
   isProjectCreator,
   isProjectShared,
+  isPublicField,
+  isSealedInvitePreview,
   isSealedKeyRow,
+  isSealedPlaceholder,
+  isSealedWireKind,
   isVerified,
   isWellFormedOp,
   isWrappedAttachmentKey,
@@ -6932,21 +7462,27 @@ export {
   kdfToWire,
   keyForScope,
   keyScopeLabel,
+  kindsOfWire,
+  legacyEncrypted,
   maxAttachmentBytes,
   maxPlainSize,
   memberEntityId,
   mergeOpLogs,
   mergeRotatedTokens,
+  migrateLegacy,
   normalizeCredentialId,
   observeIdentity,
   openAccountKeys,
   openAppKey,
   openFieldValue,
+  openInvitePreview,
   openOptionsFor,
   openPasskeyAccountKeys,
   openPasskeySlot,
   openProjectKeyRow,
   openRecoverySlot,
+  openSealed,
+  openSealedField,
   openTodoAppKey,
   padPlaintext,
   paddedLength,
@@ -6963,6 +7499,7 @@ export {
   projectKeyId,
   randomBytes,
   readKeyTrust,
+  realKindOf,
   reauthenticateWithPasskey,
   reconcileStoredSession,
   recordAcceptedProject,
@@ -6986,11 +7523,14 @@ export {
   sameKdf,
   sameKeyScope,
   sealDelivery,
+  sealField,
+  sealInvitePreview,
   sealKey,
   sealPersistence,
   sealRootKey,
   sealSource,
   sealedBlobSize,
+  sealedRepair,
   serverIncompatibility,
   sessionFromAuth,
   setArgon2idProvider,
@@ -7029,6 +7569,8 @@ export {
   validateRecoveryPhrase,
   verifyAccountPassword,
   verifyDelivery,
+  wireFieldOf,
+  wireKindOf,
   withoutCiphertext,
   withoutPrfOutput,
   wrapAek,