@docstack/client 0.1.8 → 0.2.0

package/lib/index.js

@@ -1,8 +1,8 @@
 import PouchDB from 'pouchdb-browser';
-import z$1, { z } from 'zod';
-import PouchDBFind from 'pouchdb-find';
 import semver from 'semver';
 import { diff } from 'jsondiffpatch';
+import z$1, { z } from 'zod';
+import PouchDBFind from 'pouchdb-find';
 
 /******************************************************************************
 Copyright (c) Microsoft Corporation.
@@ -925,6 +925,80 @@ Attribute.build = async (attributeObj) => {
     }
 };
 
+const attributeEffect = async (operation, model, classObj, doc) => {
+    const attribute = new Attribute(null, model.name, model.type, model.description, model.config);
+    if (operation === "add" && !(attribute.name in doc)) {
+        // Only documents that lack the key get the empty value. A document may
+        // already hold one - a repair patch re-declaring an attribute the model
+        // lost is exactly that case (ADR-0038) - and stamping `getEmpty()` over
+        // it would be data loss; validation below still runs against it.
+        doc = Object.assign(Object.assign({}, doc), attribute.getEmpty());
+    }
+    if (operation === "delete") {
+        delete doc[attribute.name];
+    }
+    else { // when addition or change also perform validation
+        const res = await attribute.validate(doc[attribute.name]);
+        // `safeParseAsync` resolves to a result object, which is truthy whether or not the
+        // value is valid: the outcome has to be read off `success`, otherwise every invalid
+        // value passes straight through.
+        if (!res.success) {
+            throw new Error(`Attribute '${classObj.name}.${attribute.name}' ${operation} fails for current document because of its validation: ${z$1.prettifyError(res.error)}`);
+        }
+    }
+    if (attribute.isPrimaryKey()) {
+        const result = classObj.bulkUniqueCheck(classObj.getPrimaryKeys());
+        if (!result) {
+            throw new Error(`With attribute '${attribute.name}' ${operation} of class '${classObj.name}', docs fail primary keys check.`);
+        }
+    }
+    if (operation !== "delete" && attribute.isMandatory() && doc[attribute.name] == undefined) {
+        throw new Error(`Attribute '${classObj.name}.${attribute.name}' is mandatory but has no value.`);
+    }
+    return doc;
+};
+const applySchemaDelta = async (doc, schemaDelta, classObj, newSchema) => {
+    const fnLogger = createLogger().child({ method: "applySchemaDelta" });
+    let updatedDoc = Object.assign({}, doc);
+    // Every entry applies - the delta names one attribute per key, and a schema
+    // change routinely touches several. Returning after the first one is how a
+    // two-attribute patch used to stamp only whichever came first (ADR-0036).
+    for (const [name, delta] of Object.entries(schemaDelta)) {
+        fnLogger.debug(`Delta of attribute '${name}'`);
+        if (Array.isArray(delta)) {
+            // jsondiffpatch's array shapes: [new] is an addition, [old, new] a
+            // wholesale replacement, [old, 0, 0] a removal.
+            if (delta.length === 1) {
+                updatedDoc = await attributeEffect("add", delta[0], classObj, updatedDoc);
+            }
+            else if (delta.length === 2) {
+                // The *new* model: validating against the one on its way out
+                // would pin every document to the definition being replaced.
+                updatedDoc = await attributeEffect("change", delta[1], classObj, updatedDoc);
+            }
+            else if (delta.length === 3) {
+                updatedDoc = await attributeEffect("delete", delta[0], classObj, updatedDoc);
+            }
+        }
+        else {
+            // A nested delta: jsondiffpatch recurses into object values, so an
+            // attribute model edited in place (one config flag, a description)
+            // lands here rather than in the [old, new] branch above - this is the
+            // ordinary shape of an edit, not an exotic one. The delta carries
+            // only the changed fragment, so the full model to validate against
+            // comes from the schema being written.
+            const attrModel = newSchema === null || newSchema === void 0 ? void 0 : newSchema[name];
+            if (attrModel) {
+                updatedDoc = await attributeEffect("change", attrModel, classObj, updatedDoc);
+            }
+            else {
+                fnLogger.warn(`Unhandled delta shape for attribute '${name}': no new model to validate against`, { delta });
+            }
+        }
+    }
+    return updatedDoc;
+};
+
 /**
  * The Trigger class dynamically hydrates a function from a string.
  * This allows for declarative, data-driven logic to be executed at runtime.
@@ -3564,10 +3638,12 @@ const sys_016 = {
             "name": "class",
             "description": "A class document representing a data model class",
             "~class": "~self",
-            // Patch hydration is a shallow merge: this `schema` REPLACES the stored one,
-            // it does not add to it. So a patch to the `class` document must carry the
-            // full attribute set - dropping `ephemeral`/`simple` here silently strips
-            // those flags from every class model on the next validated write.
+            // Patch hydration merges `schema` attribute by attribute (ADR-0038): an
+            // entry here overlays the stored one, an absent attribute stays as stored,
+            // and an explicit `null` drops it. The restatement of `ephemeral`/`simple`
+            // below predates the merge - hydration used to replace the whole schema, so
+            // a patch had to carry the full set - and is kept: under merge it lands on
+            // identical definitions and changes nothing.
             "schema": {
                 "ephemeral": {
                     "name": "ephemeral",
@@ -3602,7 +3678,32 @@ const sys_016 = {
         }
     ]
 };
-syspatches.push(sys_011, sys_012, sys_013, sys_014, sys_015, sys_016);
+/**
+ * `~JobRun.jobId` becomes optional (ADR-0044): a patch's one-shot job leaves its
+ * receipt as a `~JobRun`, but patch jobs are deliberately never persisted as
+ * `~Job` documents, so their receipts have no row to point at - they omit
+ * `jobId` and carry the patch identity in `runtimeArgs` instead. A scheduler run
+ * still writes its `jobId`; the foreign key still validates whenever present.
+ * An ADR-0038 merge fragment: one attribute restated, everything else untouched.
+ */
+const sys_017 = {
+    "_id": "~sys-0.0.17",
+    "~class": "patch",
+    "version": "0.0.17",
+    "target": "system",
+    "changelog": "### Schema Patch: v0.0.17\\n#### ~JobRun.jobId optional (patch job receipts, ADR-0044)",
+    "docs": [
+        {
+            "_id": "~JobRun",
+            "_rev": "auto",
+            "~class": "class",
+            "schema": {
+                "jobId": { "name": "jobId", "type": "foreign_key", "config": { "mandatory": false, "targetClass": "~Job" } }
+            }
+        }
+    ]
+};
+syspatches.push(sys_011, sys_012, sys_013, sys_014, sys_015, sys_016, sys_017);
 /**
  * Every document id the system patches seed.
  *
@@ -3642,64 +3743,7 @@ async function getSystemPatches(currentVersion) {
         .map((patch) => JSON.parse(JSON.stringify(patch)));
 }
 
-const attributeEffect = async (operation, model, classObj, doc) => {
-    const attribute = new Attribute(null, model.name, model.type, model.description, model.config);
-    if (operation === "add") {
-        doc = Object.assign(Object.assign({}, doc), attribute.getEmpty());
-    }
-    if (operation === "delete") {
-        delete doc[attribute.name];
-    }
-    else { // when addition or change also perform validation
-        const res = await attribute.validate(doc[attribute.name]);
-        // `safeParseAsync` resolves to a result object, which is truthy whether or not the
-        // value is valid: the outcome has to be read off `success`, otherwise every invalid
-        // value passes straight through.
-        if (!res.success) {
-            throw new Error(`Attribute '${classObj.name}.${attribute.name}' ${operation} fails for current document because of its validation: ${z$1.prettifyError(res.error)}`);
-        }
-    }
-    if (attribute.isPrimaryKey()) {
-        const result = classObj.bulkUniqueCheck(classObj.getPrimaryKeys());
-        if (!result) {
-            throw new Error(`With attribute '${attribute.name}' ${operation} of class '${classObj.name}', docs fail primary keys check.`);
-        }
-    }
-    if (operation !== "delete" && attribute.isMandatory() && doc[attribute.name] == undefined) {
-        throw new Error(`Attribute '${classObj.name}.${attribute.name}' is mandatory but has no value.`);
-    }
-    return doc;
-};
-const applySchemaDelta = async (doc, schemaDelta, classObj) => {
-    const fnLogger = createLogger().child({ method: "applySchemaDelta" });
-    let updatedDoc = Object.assign({}, doc);
-    const t = Object.entries(schemaDelta);
-    for (const e of t) {
-        fnLogger.debug(`Delta of attribute '${e[0]}'`);
-        if (Array.isArray(e[1])) {
-            // e[1] can represent an addition, a deletion or an edit
-            // it's an addition when the array has only one element
-            if (e[1].length === 1) {
-                const attrModel = e[1][0];
-                updatedDoc = await attributeEffect("add", attrModel, classObj, updatedDoc);
-            }
-            // it's an edit when it has 2 elements
-            if (e[1].length === 1) {
-                const attrModel = e[1][0];
-                updatedDoc = await attributeEffect("change", attrModel, classObj, updatedDoc);
-            }
-            // it's a removal when it has 3 elements
-            if (e[1].length === 3) {
-                const attrModel = e[1][0];
-                updatedDoc = await attributeEffect("delete", attrModel, classObj, updatedDoc);
-            }
-            return updatedDoc;
-        }
-    }
-    return updatedDoc;
-};
-
-const logger$3 = createLogger().child({ module: "pouchdb" });
+const logger$4 = createLogger().child({ module: "pouchdb" });
 /**
  * Raised when a locked stack is asked to write a class carrying encrypted attributes.
  *
@@ -3768,7 +3812,7 @@ const StackPlugin = (pouch, stack, pristine) => {
             return Promise.resolve("pong");
         },
         bulkDocs: async function (docs, options, callback) {
-            const fnLogger = logger$3.child({ method: "bulkDocs" });
+            const fnLogger = logger$4.child({ method: "bulkDocs" });
             if (typeof options == 'function') {
                 callback = options;
                 options = {};
@@ -3831,10 +3875,7 @@ const StackPlugin = (pouch, stack, pristine) => {
             const triggerQueue = Object.create(null);
             const classCache = new Map();
             const postOperations = async (error, result) => {
-                if (error) {
-                    return { error, result };
-                }
-                else if (result) {
+                if (result) {
                     const docs = [];
                     for (const docRes of result) {
                         if (docRes.id) {
@@ -3927,25 +3968,22 @@ const StackPlugin = (pouch, stack, pristine) => {
                         // When a class document is updated, its change must have an effect on its children
                         const classDocId = doc._id;
                         const className = typeof doc.name === "string" ? doc.name : classDocId;
+                        // Fetch the version this write replaces. Its *absence* is what
+                        // "just created" means - a revision count is not: a stored class
+                        // at rev 1 receiving its first schema change already has documents
+                        // to propagate to, and the old `_revisions.ids.length == 1` check
+                        // skipped exactly that write (ADR-0038).
+                        let previousClassDoc;
                         try {
-                            // Get the previous version of the class model
-                            const docWithRevs = await stack.db.get(classDocId, { revs: true });
-                            const revisionIDList = docWithRevs._revisions.ids;
-                            if (revisionIDList.length == 1) {
-                                fnLogger.info(`Class '${className}' (doc '${classDocId}') was just created. Nothing to do.`);
-                                continue;
-                                return pouchBulkDocs.call(this, docs, options, postExec);
-                            }
+                            previousClassDoc = await stack.db.get(classDocId);
                         }
                         catch (e) {
                             if (e.name === 'not_found') {
                                 fnLogger.info(`Class '${className}' (doc '${classDocId}') was just created. Nothing to do.`);
                                 continue;
-                                return pouchBulkDocs.call(this, docs, options, postExec);
                             }
+                            throw e;
                         }
-                        // Fetch the current (next old) version of the class document.
-                        const previousClassDoc = await stack.db.get(classDocId);
                         // Built rather than looked up: this is the class as it was *before*
                         // this write, which the cache does not hold. Detached, because all it
                         // is used for is diffing and applying the delta.
@@ -3961,16 +3999,54 @@ const StackPlugin = (pouch, stack, pristine) => {
                             fnLogger.info(`Class '${className}' has no changes on schema.`);
                             continue;
                         }
-                        const documents = await classObj.getCards();
+                        // System-level read, not getCards: propagation must see every
+                        // document of the class - a policy-filtered read would rewrite
+                        // only the session's subset - and it runs during create()'s
+                        // patch application, before any session exists (ADR-0044).
+                        // Encrypted attributes are opened explicitly when a key is
+                        // present; a keyless encrypting class never reaches here, its
+                        // patch deferred upstream (ADR-0040).
+                        const rawFetch = await stack.db.find({
+                            selector: { "~class": className, active: true },
+                            limit: 2 ** 31 - 1,
+                        });
+                        const fetched = rawFetch.docs;
+                        if (stack.cryptoEngine.isEnabled() && stack.cryptoEngine.getDocumentKey()
+                            && classObj.getEncryptedAttributes().length) {
+                            for (const stored of fetched) {
+                                await stack.cryptoEngine.decryptDocument(stored, classObj);
+                            }
+                        }
+                        // A committed document superseded by a batch-mate belongs to the
+                        // batch, not to propagation (ADR-0044): its batch version - a
+                        // pre-apply job's massage - is validated by the document branch
+                        // against the batch model, and judging or stamping the stale
+                        // committed copy here would refuse (or undo) exactly what the
+                        // massage fixed. A delegation, not a skip.
+                        const superseded = new Set(documentsToProcess.map((mate) => mate === null || mate === void 0 ? void 0 : mate._id).filter((id) => typeof id === "string"));
+                        const documents = fetched.filter(existing => !superseded.has(existing._id));
                         if (documents.length === 0) {
                             fnLogger.info(`No documents found for class '${className}' after its update.`);
                             continue;
                         }
+                        // The schema being written, captured before the map shadows `doc`:
+                        // an attribute edited in place arrives as a nested delta carrying
+                        // only the changed fragment, and the full new model to validate
+                        // against has to come from here.
+                        const nextSchema = doc.schema;
                         const updates = await Promise.all(documents.map(async (doc) => {
-                            const updatedDoc = await applySchemaDelta(doc, schemaDelta, classObj);
+                            const updatedDoc = await applySchemaDelta(doc, schemaDelta, classObj, nextSchema);
                             return updatedDoc;
                         }));
-                        await stack.db.bulkDocs(updates);
+                        // PouchDB reports per-document failures in the *resolved* array,
+                        // not by rejecting - awaiting alone would let a conflicted update
+                        // silently drop one document's propagation.
+                        const propagated = await stack.db.bulkDocs(updates);
+                        const failures = propagated.filter(entry => entry && entry.error);
+                        if (failures.length) {
+                            throw new Error(`Schema propagation failed for ${failures.length} document(s) of class '${className}': ` +
+                                failures.map((f) => { var _a; return `${f.id}: ${(_a = f.message) !== null && _a !== void 0 ? _a : f.name}`; }).join("; "));
+                        }
                         fnLogger.info('Propagated updates');
                     }
                     else if (isRelation(doc)) {
@@ -3981,9 +4057,20 @@ const StackPlugin = (pouch, stack, pristine) => {
                         if (doc.sourceClass !== domain.sourceClass.id || doc.targetClass !== domain.targetClass.id) {
                             throw new Error(`Relation document classes do not match domain '${domain.name}'.`);
                         }
+                        // An endpoint may be a batch-mate rather than stored: a relation
+                        // written together with its documents in one bulkDocs - which is
+                        // exactly what a transaction commit is (ADR-0039) - checks the
+                        // batch before declaring the endpoint missing.
+                        const resolveEndpoint = async (endpointId) => {
+                            var _a;
+                            const stored = await stack.db.get(endpointId).catch(() => null);
+                            if (stored)
+                                return stored;
+                            return (_a = documentsToProcess.find((mate) => (mate === null || mate === void 0 ? void 0 : mate._id) === endpointId && !(mate === null || mate === void 0 ? void 0 : mate._deleted))) !== null && _a !== void 0 ? _a : null;
+                        };
                         const [sourceDoc, targetDoc] = await Promise.all([
-                            stack.db.get(doc.sourceId).catch(() => null),
-                            stack.db.get(doc.targetId).catch(() => null),
+                            resolveEndpoint(doc.sourceId),
+                            resolveEndpoint(doc.targetId),
                         ]);
                         if (!sourceDoc) {
                             throw new Error(`Source document '${doc.sourceId}' does not exist for domain '${domain.name}'.`);
@@ -4009,8 +4096,29 @@ const StackPlugin = (pouch, stack, pristine) => {
                             continue;
                         try {
                             let classObj;
+                            // The newest statement of a schema may ride this same batch
+                            // (ADR-0043): a patch introduces a class and seeds its first
+                            // document in one docs array. The batch outranks the store even
+                            // for a class that already exists - it is what is about to be
+                            // committed - and the search sees the whole array, so ordering
+                            // within the batch does not matter. The relation branch above
+                            // has made the same decision for its endpoints since ADR-0039.
+                            const batchModel = documentsToProcess.find((mate) => isClassModel(mate) && !mate._deleted
+                                && (mate.name === className || mate._id === className));
                             try {
-                                classObj = classCache.get(className) || await stack.getClassSnapshot(className);
+                                // Built DETACHED - `Class.get` + `setModel`, the same path
+                                // `buildFromModel` takes for a stored doc. `buildFromModel`
+                                // itself would route a rev-less model through `Class.create`,
+                                // which writes the class doc and makes the batch's own
+                                // insert conflict with it.
+                                let fromBatch = null;
+                                if (batchModel && !classCache.has(className)) {
+                                    fromBatch = Class.get(stack, batchModel._id, batchModel.name, batchModel["~class"], batchModel.description, batchModel.schema, { subscribe: false });
+                                    fromBatch.setModel(batchModel);
+                                }
+                                classObj = classCache.get(className)
+                                    || fromBatch
+                                    || await stack.getClassSnapshot(className);
                             }
                             catch (error) {
                                 throw new Error(`Class '${className}' not found for document '${doc._id}'.`);
@@ -4205,6 +4313,19 @@ const StackPlugin = (pouch, stack, pristine) => {
             const exec = async () => {
                 var _a, _b;
                 const result = await pouchGet.call(this, docId, options !== null && options !== void 0 ? options : {});
+                // A revision-addressed read serves the STORED form, never plaintext.
+                // This is not an optimization but the seal on the replication surface
+                // (ADR-0040): PouchDB hard-binds its instance methods at construction,
+                // so the pristine `bulkGet` the sync layer uses cannot be pointed away
+                // from this instance - its shim, and `get`'s own `open_revs` branch,
+                // re-enter THIS override per revision (`{rev}` / `{open_revs}`).
+                // Decrypting those hops pushed every encrypted attribute to remotes in
+                // plaintext under the local revision id. Taxonomically it is the same
+                // line ADR-0020 draws: naming a revision is a replication/forensic
+                // read; the winning-revision read below is the one that decrypts.
+                if ((options === null || options === void 0 ? void 0 : options.rev) || (options === null || options === void 0 ? void 0 : options.open_revs)) {
+                    return result;
+                }
                 // Optional-chained on purpose: this override serves `initialize` itself
                 // (`checkSystem` reads `~system` through it), which runs before the
                 // crypto engine is constructed. And gated on the *key*, not just the
@@ -4417,6 +4538,13 @@ const createGuardedDb = (db) => {
  * @internal
  */
 const createReplicationDb = (db, pristine) => {
+    // Note the limit of what this handle can restore: PouchDB hard-binds instance
+    // methods at construction (`this.bulkGet = adapterFun(...).bind(this)`), so the
+    // pristine functions run against the raw instance no matter what they are bound
+    // to here - and pouchdb-core's `bulkGet`/`open_revs` internals re-enter
+    // `this.get`, which is the plugin's override. The override itself is therefore
+    // the one place that can keep those internal hops raw: it serves the stored form
+    // for any revision-addressed read (ADR-0040).
     const bulkDocs = pristine.bulkDocs.bind(db);
     const bulkGet = pristine.bulkGet.bind(db);
     // `get` restored for the same reason as `bulkGet`: since ADR-0032 the plugin
@@ -4932,7 +5060,7 @@ const deriveTenantScope = async (stacks, entitlement) => {
     return scope;
 };
 
-const logger$2 = createLogger().child({ module: "sync" });
+const logger$3 = createLogger().child({ module: "sync" });
 /**
  * Raised when a remote is ahead of this device's data model.
  *
@@ -4942,14 +5070,18 @@ const logger$2 = createLogger().child({ module: "sync" });
  * tells the application to ship the newer build.
  */
 class SyncSchemaMismatchError extends Error {
-    constructor(stack, localVersion, remoteVersion) {
-        super(`Stack '${stack}' cannot sync: the remote was last written with schema version ` +
-            `${remoteVersion}, this device has ${localVersion || "no schema version"}. Update the ` +
-            `application so its patches reach ${remoteVersion} before syncing again.`);
+    constructor(stack, localVersion, remoteVersion, scope = "system") {
+        super(`Stack '${stack}' cannot sync: the remote was last written with ` +
+            `${scope === "consumer" ? "consumer patch" : "schema"} version ` +
+            `${remoteVersion}, this device has ${localVersion || "none"}. ` +
+            (scope === "consumer"
+                ? `Apply the application's patches up to ${remoteVersion} - a deferred patch applies on unlock - before syncing again.`
+                : `Update the application so its patches reach ${remoteVersion} before syncing again.`));
         this.name = "SyncSchemaMismatchError";
         this.stack = stack;
         this.localVersion = localVersion;
         this.remoteVersion = remoteVersion;
+        this.scope = scope;
     }
 }
 /**
@@ -4985,6 +5117,20 @@ const readRemoteSchemaVersion = async (remote) => {
     });
     return (system === null || system === void 0 ? void 0 : system.schemaVersion) || null;
 };
+/**
+ * Reads the highest consumer patch version recorded on a remote.
+ *
+ * `null` for a remote nobody has written, or one written only by builds that
+ * predate the consumer half of the gate.
+ */
+const readRemoteConsumerSchemaVersion = async (remote) => {
+    const meta = await remote.get(SYNC_META_DOC_ID).catch((error) => {
+        if (isMissing(error))
+            return null;
+        throw error;
+    });
+    return (meta === null || meta === void 0 ? void 0 : meta.consumerSchemaVersion) || null;
+};
 /**
  * Records this device's schema version on a remote, if it is the newest seen.
  *
@@ -4992,20 +5138,27 @@ const readRemoteSchemaVersion = async (remote) => {
  * @param schemaVersion - The local schema version; a missing value writes nothing.
  * @param appVersion - The local application version, stored for diagnostics.
  */
-const publishSchemaVersion = async (remote, schemaVersion, appVersion) => {
-    if (!schemaVersion)
+const publishSchemaVersion = async (remote, schemaVersion, appVersion, consumerSchemaVersion) => {
+    if (!schemaVersion && !consumerSchemaVersion)
         return;
     const existing = await remote.get(SYNC_META_DOC_ID).catch((error) => {
         if (isMissing(error))
             return null;
         throw error;
     });
-    const recorded = existing === null || existing === void 0 ? void 0 : existing.schemaVersion;
-    if (recorded && semver.valid(recorded) && semver.valid(schemaVersion) && !semver.gt(schemaVersion, recorded)) {
+    // Each version field is monotonic on its own: the marker records the highest
+    // either kind has ever reached, whichever device wrote it.
+    const advances = (candidate, recorded) => Boolean(candidate) && (!recorded
+        || !semver.valid(recorded) || !semver.valid(candidate)
+        || semver.gt(candidate, recorded));
+    const systemAdvances = advances(schemaVersion, existing === null || existing === void 0 ? void 0 : existing.schemaVersion);
+    const consumerAdvances = advances(consumerSchemaVersion, existing === null || existing === void 0 ? void 0 : existing.consumerSchemaVersion);
+    if (!systemAdvances && !consumerAdvances) {
         return;
     }
-    const doc = Object.assign(Object.assign({}, (existing || {})), { _id: SYNC_META_DOC_ID, schemaVersion,
-        appVersion, updatedAt: Date.now() });
+    const doc = Object.assign(Object.assign(Object.assign(Object.assign({}, (existing || {})), { _id: SYNC_META_DOC_ID, schemaVersion: systemAdvances ? schemaVersion : existing === null || existing === void 0 ? void 0 : existing.schemaVersion }), (consumerAdvances
+        ? { consumerSchemaVersion: consumerSchemaVersion }
+        : ((existing === null || existing === void 0 ? void 0 : existing.consumerSchemaVersion) ? { consumerSchemaVersion: existing.consumerSchemaVersion } : {}))), { appVersion, updatedAt: Date.now() });
     await remote.put(doc).catch((error) => {
         // Another device claimed the same version between the read and the write; its
         // document says the same thing this one would have.
@@ -5097,7 +5250,7 @@ class StackSyncHandle extends EventTarget {
      * @throws {SyncSchemaMismatchError} When the remote is ahead of this device.
      */
     async start() {
-        const fnLogger = logger$2.child({ method: "start", stack: this.stack.name });
+        const fnLogger = logger$3.child({ method: "start", stack: this.stack.name });
         this.cancelled = false;
         this.setState("starting");
         try {
@@ -5136,7 +5289,7 @@ class StackSyncHandle extends EventTarget {
                 this.replication.cancel();
             }
             catch (error) {
-                logger$2.warn("Error while cancelling replication", { error, stack: this.stack.name });
+                logger$3.warn("Error while cancelling replication", { error, stack: this.stack.name });
             }
             if (typeof this.replication.removeAllListeners === "function") {
                 this.replication.removeAllListeners();
@@ -5220,11 +5373,27 @@ class StackSyncHandle extends EventTarget {
                 throw new SyncSchemaMismatchError(this.stack.name, localVersion, remoteVersion);
             }
         }
+        // The consumer half of the gate: the system version cannot see consumer-patch
+        // skew - two devices on the same build always agree on it - so a device whose
+        // application patches trail the remote (deferred behind the document key, or
+        // an older build) would pull documents shaped by a schema it does not have,
+        // and the deferred replay would then propagate over them (ADR-0040). The
+        // ledger answers locally; a remote written only by older builds records
+        // nothing and gates nothing.
+        const localConsumer = await this.stack.getConsumerSchemaVersion();
+        const remoteConsumer = await readRemoteConsumerSchemaVersion(remote);
+        if (remoteConsumer && semver.valid(remoteConsumer)) {
+            const ahead = !localConsumer
+                || (Boolean(semver.valid(localConsumer)) && semver.gt(remoteConsumer, localConsumer));
+            if (ahead) {
+                throw new SyncSchemaMismatchError(this.stack.name, localConsumer !== null && localConsumer !== void 0 ? localConsumer : undefined, remoteConsumer, "consumer");
+            }
+        }
         // Only a device that writes to the remote gets to claim its schema version.
         // A pull-only device publishing would lock older peers out of a remote that
         // holds nothing they cannot read.
         if (this.direction !== "pull") {
-            await publishSchemaVersion(remote, localVersion, this.stack.appVersion);
+            await publishSchemaVersion(remote, localVersion, this.stack.appVersion, localConsumer);
         }
     }
     seededDocIdsFromPatches() {
@@ -7758,7 +7927,7 @@ const calculateHash = async (content) => {
     const buffer = await crypto.subtle.digest('SHA-256', data);
     return Array.from(new Uint8Array(buffer)).map(b => b.toString(16).padStart(2, '0')).join('');
 };
-const now = () => Date.now();
+const now$1 = () => Date.now();
 /**
  * Represents an executable job that can perform background tasks.
  *
@@ -7829,7 +7998,7 @@ class Job {
             jobId: this.model._id,
             status: "PENDING",
             triggerType,
-            startTime: now(),
+            startTime: now$1(),
             runtimeArgs,
             initialMetadata: this.model.metadata ? Object.assign({}, this.model.metadata) : undefined,
         };
@@ -7873,7 +8042,7 @@ class Job {
         if (!this.model.isEnabled) {
             run.status = "SKIPPED";
             run.errorMessage = `Job ${this.model._id} is disabled`;
-            run.endTime = now();
+            run.endTime = now$1();
             run.durationMs = run.endTime - run.startTime;
             await this.persistRun(run);
             throw new Error(run.errorMessage);
@@ -7881,14 +8050,14 @@ class Job {
         if (await this.hasRunningInstance()) {
             run.status = "SKIPPED";
             run.errorMessage = `Job ${this.model._id} already has a running instance`;
-            run.endTime = now();
+            run.endTime = now$1();
             run.durationMs = run.endTime - run.startTime;
             await this.persistRun(run);
             throw new Error(run.errorMessage);
         }
         try {
             run.status = "RUNNING";
-            run.startTime = now();
+            run.startTime = now$1();
             run = await this.persistRun(run);
             const executor = this.hydrate();
             const params = Object.assign(Object.assign({}, (this.model.defaultParams || {})), (runtimeArgs || {}));
@@ -7900,7 +8069,7 @@ class Job {
                 await this.persistJobMetadata(finalMetadata);
             }
             run.status = "SUCCESS";
-            run.endTime = now();
+            run.endTime = now$1();
             run.durationMs = run.endTime - run.startTime;
             return await this.persistRun(run);
         }
@@ -7908,7 +8077,7 @@ class Job {
             run.status = "FAILURE";
             run.errorMessage = (error === null || error === void 0 ? void 0 : error.message) || String(error);
             run.errorStack = error === null || error === void 0 ? void 0 : error.stack;
-            run.endTime = now();
+            run.endTime = now$1();
             run.durationMs = run.endTime - run.startTime;
             return await this.persistRun(run);
         }
@@ -8171,7 +8340,7 @@ const isImplausible = (nextRunAt, schedule, now) => nextRunAt - now > periodCeil
  *
  * @module
  */
-const logger$1 = createLogger().child({ module: "job-scheduler" });
+const logger$2 = createLogger().child({ module: "job-scheduler" });
 /** The `_local/` document holding this device's schedule state. Never replicates. */
 const JOB_SCHEDULE_DOC_ID = "_local/docstack-job-schedule";
 const DEFAULTS = {
@@ -8321,7 +8490,7 @@ class JobScheduler {
                 if (pinned && pinned !== job.hash) {
                     // Fail closed. The content behind an unexpected hash is exactly the case
                     // the allow-list exists for.
-                    logger$1.warn("tick - job hash does not match the pinned value; not running", { jobId });
+                    logger$2.warn("tick - job hash does not match the pinned value; not running", { jobId });
                     report.skipped.push({ jobId, reason: "hash-mismatch" });
                     continue;
                 }
@@ -8331,7 +8500,7 @@ class JobScheduler {
                 }
                 const schedule = parseSchedule(job.schedule);
                 if (!schedule) {
-                    logger$1.warn("tick - job carries a schedule this client cannot read", {
+                    logger$2.warn("tick - job carries a schedule this client cannot read", {
                         jobId,
                         schedule: job.schedule,
                     });
@@ -8354,7 +8523,7 @@ class JobScheduler {
                     continue;
                 }
                 if (isImplausible(state.nextRunAt, schedule, at)) {
-                    logger$1.warn("tick - stored nextRunAt is further out than the schedule allows; recomputing", {
+                    logger$2.warn("tick - stored nextRunAt is further out than the schedule allows; recomputing", {
                         jobId,
                         nextRunAt: state.nextRunAt,
                     });
@@ -8402,7 +8571,7 @@ class JobScheduler {
             // rejects if the content hash no longer matches. All three are outcomes, not
             // crashes; the backoff is what keeps a permanently broken job from becoming
             // a write per minute.
-            logger$1.warn("dispatch - scheduled job did not run", { jobId, error: (error === null || error === void 0 ? void 0 : error.message) || String(error) });
+            logger$2.warn("dispatch - scheduled job did not run", { jobId, error: (error === null || error === void 0 ? void 0 : error.message) || String(error) });
             await this.recordOutcome(jobId, "FAILURE", options);
         }
         finally {
@@ -8449,11 +8618,11 @@ class JobScheduler {
             if (!stale.length)
                 return 0;
             await this.host.db.bulkDocs(stale.map((run) => (Object.assign(Object.assign({}, run), { status: "CANCELED", endTime: at, durationMs: at - run.startTime, errorMessage: "Run abandoned — the client stopped before it finished." }))));
-            logger$1.info("sweepAbandonedRuns - reaped abandoned runs", { count: stale.length });
+            logger$2.info("sweepAbandonedRuns - reaped abandoned runs", { count: stale.length });
             return stale.length;
         }
         catch (error) {
-            logger$1.warn("sweepAbandonedRuns - could not sweep", { error: (error === null || error === void 0 ? void 0 : error.message) || String(error) });
+            logger$2.warn("sweepAbandonedRuns - could not sweep", { error: (error === null || error === void 0 ? void 0 : error.message) || String(error) });
             return 0;
         }
     }
@@ -8478,7 +8647,7 @@ class JobScheduler {
         catch (error) {
             // A 409 means another tick wrote first; its state is as good as this one's,
             // and the next tick reads the winner.
-            logger$1.warn("writeState - could not persist schedule state", {
+            logger$2.warn("writeState - could not persist schedule state", {
                 error: (error === null || error === void 0 ? void 0 : error.message) || String(error),
             });
         }
@@ -9267,113 +9436,3189 @@ class CryptoEngine {
 }
 
 /**
- * Moving a stack's *content* between databases, without its datamodel.
- *
- * `stack.dump()` is the other kind of export: every document exactly as stored, which
- * means class models, patches, users, sessions, policies, design documents - and
- * encrypted attributes as unreadable {@link EncryptedPayload} blobs. That is a debugging
- * tool and a backup of one database.
- *
- * This is the portable one. It carries the documents an application put in, in the clear,
- * so that {@link ClientStack.importContent} can place them into a *different* stack -
- * different device, different key, schema built by that stack's own patches.
+ * The write journal of one transaction: authored documents keyed by id, in memory.
  *
- * @module
+ * Also partitioned by class (`~class`, or `~domain` for relations) so a read can ask
+ * "could this stage affect a query over class X" in O(1) - the overlay only pays the
+ * merge for queries whose class the transaction actually touched (ADR-0039).
  */
-/** The envelope format identifier, so an importer can refuse what it does not understand. */
-const CONTENT_EXPORT_FORMAT = "docstack/content-export@1";
+class TransactionStage {
+    constructor() {
+        this.entries = new Map();
+        this.partitions = new Map();
+    }
+    partitionKeys(doc) {
+        const keys = [];
+        const className = doc["~class"];
+        const domainName = doc["~domain"];
+        if (typeof className === "string")
+            keys.push(className);
+        if (typeof domainName === "string")
+            keys.push(domainName);
+        return keys;
+    }
+    /**
+     * Stages an entry. Re-staging an id replaces the document but keeps the original
+     * `baseRev` and `isNew` - the conflict check is against the world as it was when
+     * the transaction first touched the id, not against its own previous draft.
+     */
+    set(id, entry) {
+        var _a;
+        const existing = this.entries.get(id);
+        if (existing) {
+            for (const key of this.partitionKeys(existing.doc)) {
+                (_a = this.partitions.get(key)) === null || _a === void 0 ? void 0 : _a.delete(id);
+            }
+            entry = Object.assign(Object.assign({}, entry), { baseRev: existing.baseRev, isNew: existing.isNew });
+        }
+        this.entries.set(id, entry);
+        for (const key of this.partitionKeys(entry.doc)) {
+            let ids = this.partitions.get(key);
+            if (!ids)
+                this.partitions.set(key, (ids = new Set()));
+            ids.add(id);
+        }
+    }
+    get(id) {
+        return this.entries.get(id);
+    }
+    has(id) {
+        return this.entries.has(id);
+    }
+    get size() {
+        return this.entries.size;
+    }
+    ids() {
+        return [...this.entries.keys()];
+    }
+    /** Entries in stage order (insertion order of first staging). */
+    values() {
+        return [...this.entries.values()];
+    }
+    hasPartition(name) {
+        var _a, _b;
+        return ((_b = (_a = this.partitions.get(name)) === null || _a === void 0 ? void 0 : _a.size) !== null && _b !== void 0 ? _b : 0) > 0;
+    }
+    /** Keeps only the given ids - what a partial commit leaves behind. */
+    retain(ids) {
+        for (const id of [...this.entries.keys()]) {
+            if (!ids.has(id))
+                this.remove(id);
+        }
+    }
+    /**
+     * A point-in-time copy of the journal, for {@link restore}. Used by the patch
+     * chain (ADR-0044) to unwind exactly one patch's staging - a pre-apply job's
+     * writes included - when a locked refusal converts that patch to a deferral
+     * while the already-staged prefix goes on to commit.
+     */
+    snapshot() {
+        return new Map(this.entries);
+    }
+    restore(snapshot) {
+        this.clear();
+        for (const [id, entry] of snapshot) {
+            this.set(id, entry);
+        }
+    }
+    remove(id) {
+        var _a;
+        const entry = this.entries.get(id);
+        if (!entry)
+            return;
+        for (const key of this.partitionKeys(entry.doc)) {
+            (_a = this.partitions.get(key)) === null || _a === void 0 ? void 0 : _a.delete(id);
+        }
+        this.entries.delete(id);
+    }
+    clear() {
+        this.entries.clear();
+        this.partitions.clear();
+    }
+}
+
 /**
- * `~class` values that describe the stack rather than hold its content.
+ * Errors of the transaction engine (ADR-0039).
  *
- * `~self` is the bootstrap class-of-classes; `class` and `superclass` are class models;
- * `domain` is a relation definition; `patch` is the local ledger of applied patches.
+ * Every one of them leaves the database untouched: a transaction failure is a refusal,
+ * never a partial application. The one exception is named where it happens -
+ * a commit on a non-atomic adapter can land a subset, and that outcome is reported as
+ * a `partial` status on the handle, not thrown as one of these.
+ *
+ * @module
  */
-const META_CLASSES = ["~self", "class", "superclass", "domain", "patch"];
+/** Raised by `beginTransaction()` on a stack opened without `transactions: true`. */
+class TransactionsDisabledError extends Error {
+    constructor(stackName) {
+        super(`Stack '${stackName}' was opened without 'transactions: true'. ` +
+            `Transactions are enabled per stack through its configuration, like encryption.`);
+        this.name = "TransactionsDisabledError";
+    }
+}
+/** Raised when a handle is used in a state that cannot accept the operation. */
+class TransactionStateError extends Error {
+    constructor(transactionId, status, operation) {
+        super(`Transaction '${transactionId}' is '${status}' and cannot ${operation}.`);
+        this.name = "TransactionStateError";
+    }
+}
 /**
- * Reports whether a class name belongs to application content.
- *
- * DocStack names everything it owns with a leading `~` - `~User`, `~Group`, `~Policy`,
- * `~Job`, `~JobRun`, `~UserSession`, `~AuthModule`, `~lock` - and reserves the handful of
- * unprefixed names in {@link META_CLASSES} for the datamodel itself. Everything else was
- * created by an application.
- *
- * @param className - A `~class` value or class-model id.
- *
- * @example
- * ```typescript
- * isContentClassName("Task");   // true
- * isContentClassName("~User");  // false - DocStack's own
- * isContentClassName("class");  // false - a class model
- * ```
+ * Raised when the validation sweep refuses a document - at stage time (the write is
+ * not staged) or at commit time (nothing is written, the transaction stays open).
  */
-const isContentClassName = (className) => {
-    if (typeof className !== "string" || !className.length)
-        return false;
-    if (className.startsWith("~"))
-        return false;
-    return !META_CLASSES.includes(className);
-};
+class TransactionValidationError extends Error {
+    constructor(message, docId) {
+        super(message);
+        this.name = "TransactionValidationError";
+        this.docId = docId;
+    }
+}
 /**
- * Reports whether a document is application content rather than part of the stack.
- *
- * @param doc - Any stored document.
+ * Raised by commit when a staged document's base revision no longer matches the
+ * stored winner - a direct write, another transaction's commit, or replication moved
+ * it. Nothing is written; the transaction stays open for re-staging or discard.
  */
-const isContentDocument = (doc) => {
-    if (!doc || typeof doc._id !== "string")
-        return false;
-    // A design document has no `~class` and would fall through the class test.
-    if (doc._id.startsWith("_"))
-        return false;
-    return isContentClassName(doc["~class"]);
-};
+class TransactionConflictError extends Error {
+    constructor(conflicts) {
+        super(`Commit refused: ${conflicts.length} staged document(s) changed underneath the transaction: ` +
+            conflicts.map(conflict => conflict.id).join(", "));
+        this.name = "TransactionConflictError";
+        this.conflicts = conflicts;
+    }
+}
 /**
- * Reports whether a document is an application relation.
- *
- * Relations carry `~domain` and no `~class` (see `isRelation` in `@docstack/shared`), so
- * they need their own test rather than falling out of {@link isContentDocument}.
- *
- * @param doc - Any stored document.
+ * Raised at stage time for documents transactions cannot carry: class models (their
+ * write propagates to other documents mid-pipeline and cannot be staged or rolled
+ * back - ADR-0039), `_local/` device state, and design documents.
  */
-const isContentRelation = (doc) => {
-    if (!doc || typeof doc._id !== "string")
-        return false;
-    if (doc["~class"] !== undefined)
-        return false;
-    return isContentClassName(doc["~domain"]);
-};
-/** Fields PouchDB owns, or that describe one database's copy of a document. */
-const TRANSIENT_FIELDS = ["_rev", "_revisions", "_revs_info", "_conflicts", "_deleted"];
+class TransactionUnsupportedDocError extends Error {
+    constructor(docId, reason) {
+        super(`Document '${docId}' cannot be staged: ${reason}`);
+        this.name = "TransactionUnsupportedDocError";
+    }
+}
+
 /**
- * Strips the fields that belong to the source database rather than to the document.
- *
- * `_rev` above all: a revision from one database means nothing in another, and carrying
- * it into an import turns every write into a conflict.
- *
- * @param doc - The document to clean.
- * @returns A copy without the transient fields.
+ * Resolves a class from the transaction's own stage: the ADR-0043 rule
+ * (the batch outranks the store - it is what is about to be committed) applied to
+ * staging. A patch chain's job can create documents of a class an earlier patch
+ * staged (ADR-0044), and the sweep must judge them by that staged model, not by a
+ * committed predecessor or a not-found. Built DETACHED - `Class.get` + `setModel`,
+ * never `buildFromModel`, which writes rev-less models (ADR-0043).
  */
-const stripTransientFields = (doc) => {
-    const clone = Object.assign({}, doc);
-    for (const field of TRANSIENT_FIELDS)
-        delete clone[field];
-    return clone;
+const classFromStage = (stack, stage, className) => {
+    for (const entry of stage.values()) {
+        const doc = entry.doc;
+        if (entry.op !== "delete" && isClassModel(doc) && (doc._id === className || doc.name === className)) {
+            const built = Class.get(stack, doc._id, doc.name, doc["~class"], doc.description, doc.schema, { subscribe: false });
+            built.setModel(doc);
+            return built;
+        }
+    }
+    return null;
 };
 /**
- * Validates an import payload's envelope before anything is written.
- *
- * A plain validator rather than an `asserts` signature: the caller already types its
- * parameter, so there is nothing to narrow, and an assertion function reached through an
- * import needs a declaration TypeScript can see (TS2775).
+ * The validation sweep - the transaction's atomicity boundary in practice.
  *
- * @param payload - The value handed to {@link ClientStack.importContent}.
- * @throws Error when it is not a content export this version understands.
+ * Runs read-only checks against public stack APIs: it decides whether a document
+ * *could* be written, and touches nothing. Stage time runs it so a bad write fails at
+ * the call site with zero consequences; commit re-runs it so the batch is judged
+ * against the world as it stands at commit. The commit-time pipeline (the plugin's
+ * `bulkDocs`) remains the sole authority - this sweep is a deliberate subset, and a
+ * document it passes can still be refused there, atomically for the whole batch.
  */
-const assertContentExport = (payload) => {
-    const value = payload;
-    if (!value || typeof value !== "object") {
-        throw new Error("importContent - payload is not a content export.");
-    }
-    if (value.format !== CONTENT_EXPORT_FORMAT) {
+const sweepEntry = async (stack, stage, entry, options) => {
+    var _a;
+    const doc = entry.doc;
+    const docId = doc._id;
+    if (typeof docId === "string") {
+        if (docId.startsWith("_local/")) {
+            throw new TransactionUnsupportedDocError(docId, "'_local/' documents are device state, not transactional content.");
+        }
+        if (docId.startsWith("_design/")) {
+            throw new TransactionUnsupportedDocError(docId, "design documents are index machinery, not transactional content.");
+        }
+    }
+    if (isClassModel(doc)) {
+        // Public transactions refuse class models: a class commit's propagation is a
+        // side effect beyond the batch, and a public handle promises none (ADR-0039).
+        // An INTERNAL handle - patch application, ADR-0042 - claims only staged
+        // validation and a single class-write batch, so it stages them; the parent
+        // validation the pipeline would run at commit runs here instead, where a
+        // refusal still costs nothing.
+        if (!(options === null || options === void 0 ? void 0 : options.allowClassModels)) {
+            throw new TransactionUnsupportedDocError(docId, "a class-model write propagates to the class's documents mid-pipeline and cannot be staged or rolled back (ADR-0039).");
+        }
+        const parentName = doc["~class"];
+        if (parentName !== "~self") {
+            const parentClass = await stack.getClass(parentName);
+            if (!parentClass) {
+                throw new TransactionValidationError(`Parent class '${parentName}' not found for class model '${docId}'.`, docId);
+            }
+            const valid = await parentClass.validate(doc);
+            if (!valid) {
+                throw new TransactionValidationError(`Class model '${docId}' is not valid for its parent class '${parentName}'.`, docId);
+            }
+        }
+        return;
+    }
+    if (isPatch(doc)) {
+        throw new TransactionUnsupportedDocError(docId, "patches carry class models and apply through 'applyPatch'.");
+    }
+    // A hard delete carries no content to validate; write access is still the
+    // author's to prove - unless this is DocStack's own machinery (an internal
+    // handle: patch application runs before any session exists, and the patch
+    // path's direct writes never pass through policy either - ADR-0044).
+    if (entry.op === "delete") {
+        const type = doc["~class"];
+        if (typeof type === "string" && !(options === null || options === void 0 ? void 0 : options.skipPolicy)) {
+            await stack.policyEngine.ensureWriteAllowed(type, doc);
+        }
+        return;
+    }
+    if (isRelation(doc)) {
+        const domain = await stack.getDomain(doc["~domain"]);
+        if (!domain) {
+            throw new TransactionValidationError(`Domain not found: ${doc["~domain"]}`, docId);
+        }
+        // An endpoint is resolvable if it is committed, or staged in this same
+        // transaction - the batch commits together (the plugin resolves batch-mates
+        // since ADR-0039).
+        for (const endpoint of [doc.sourceId, doc.targetId]) {
+            if (stage.has(endpoint) && stage.get(endpoint).op !== "delete")
+                continue;
+            const stored = await stack.db.get(endpoint).catch(() => null);
+            if (!stored) {
+                throw new TransactionValidationError(`Relation endpoint '${endpoint}' does not exist, committed or staged, for domain '${domain.name}'.`, docId);
+            }
+        }
+        return;
+    }
+    const type = doc["~class"];
+    if (typeof type !== "string" || !type) {
+        throw new TransactionValidationError(`Document '${docId}' carries no '~class'.`, docId);
+    }
+    if (stack.isSimpleClass(type))
+        return;
+    const classObj = (_a = classFromStage(stack, stage, type)) !== null && _a !== void 0 ? _a : await stack.getClassSnapshot(type).catch(() => null);
+    if (!classObj) {
+        throw new TransactionValidationError(`Class '${type}' not found for document '${docId}'.`, docId);
+    }
+    // Same refusal the plugin makes (ADR-0018): a locked stack cannot encrypt, and
+    // committing later while still locked would land the fields in the clear.
+    if (classObj.getEncryptedAttributes().length && stack.isLocked()) {
+        throw new StackLockedError(type);
+    }
+    const valid = await classObj.validate(doc);
+    if (!valid) {
+        throw new TransactionValidationError(`Document '${docId}' does not validate against class '${type}'.`, docId);
+    }
+    if (!(options === null || options === void 0 ? void 0 : options.skipPolicy)) {
+        await stack.policyEngine.ensureWriteAllowed(type, doc);
+    }
+};
+
+class PouchError extends Error {
+  constructor(status, error, reason) {
+    super();
+    this.status = status;
+    this.name = error;
+    this.message = reason;
+    this.error = true;
+  }
+
+  toString() {
+    return JSON.stringify({
+      status: this.status,
+      name: this.name,
+      message: this.message,
+      reason: this.reason
+    });
+  }
+}
+
+new PouchError(401, 'unauthorized', "Name or password is incorrect.");
+new PouchError(400, 'bad_request', "Missing JSON list of 'docs'");
+new PouchError(404, 'not_found', 'missing');
+new PouchError(409, 'conflict', 'Document update conflict');
+new PouchError(400, 'bad_request', '_id field must contain a string');
+new PouchError(412, 'missing_id', '_id is required for puts');
+new PouchError(400, 'bad_request', 'Only reserved document ids may start with underscore.');
+new PouchError(412, 'precondition_failed', 'Database not open');
+new PouchError(500, 'unknown_error', 'Database encountered an unknown error');
+new PouchError(500, 'badarg', 'Some query argument is invalid');
+new PouchError(400, 'invalid_request', 'Request was invalid');
+new PouchError(400, 'query_parse_error', 'Some query parameter is invalid');
+new PouchError(500, 'doc_validation', 'Bad special document member');
+new PouchError(400, 'bad_request', 'Something wrong with the request');
+new PouchError(400, 'bad_request', 'Document must be a JSON object');
+new PouchError(404, 'not_found', 'Database not found');
+new PouchError(500, 'indexed_db_went_bad', 'unknown');
+new PouchError(500, 'web_sql_went_bad', 'unknown');
+new PouchError(500, 'levelDB_went_went_bad', 'unknown');
+new PouchError(403, 'forbidden', 'Forbidden by design doc validate_doc_update function');
+new PouchError(400, 'bad_request', 'Invalid rev format');
+new PouchError(412, 'file_exists', 'The database could not be created, the file already exists.');
+new PouchError(412, 'missing_stub', 'A pre-existing attachment stub wasn\'t found');
+new PouchError(413, 'invalid_url', 'Provided URL is invalid');
+
+var events = {exports: {}};
+
+var R = typeof Reflect === 'object' ? Reflect : null;
+var ReflectApply = R && typeof R.apply === 'function'
+  ? R.apply
+  : function ReflectApply(target, receiver, args) {
+    return Function.prototype.apply.call(target, receiver, args);
+  };
+
+var ReflectOwnKeys;
+if (R && typeof R.ownKeys === 'function') {
+  ReflectOwnKeys = R.ownKeys;
+} else if (Object.getOwnPropertySymbols) {
+  ReflectOwnKeys = function ReflectOwnKeys(target) {
+    return Object.getOwnPropertyNames(target)
+      .concat(Object.getOwnPropertySymbols(target));
+  };
+} else {
+  ReflectOwnKeys = function ReflectOwnKeys(target) {
+    return Object.getOwnPropertyNames(target);
+  };
+}
+
+function ProcessEmitWarning(warning) {
+  if (console && console.warn) console.warn(warning);
+}
+
+var NumberIsNaN = Number.isNaN || function NumberIsNaN(value) {
+  return value !== value;
+};
+
+function EventEmitter() {
+  EventEmitter.init.call(this);
+}
+events.exports = EventEmitter;
+events.exports.once = once;
+
+// Backwards-compat with node 0.10.x
+EventEmitter.EventEmitter = EventEmitter;
+
+EventEmitter.prototype._events = undefined;
+EventEmitter.prototype._eventsCount = 0;
+EventEmitter.prototype._maxListeners = undefined;
+
+// By default EventEmitters will print a warning if more than 10 listeners are
+// added to it. This is a useful default which helps finding memory leaks.
+var defaultMaxListeners = 10;
+
+function checkListener(listener) {
+  if (typeof listener !== 'function') {
+    throw new TypeError('The "listener" argument must be of type Function. Received type ' + typeof listener);
+  }
+}
+
+Object.defineProperty(EventEmitter, 'defaultMaxListeners', {
+  enumerable: true,
+  get: function() {
+    return defaultMaxListeners;
+  },
+  set: function(arg) {
+    if (typeof arg !== 'number' || arg < 0 || NumberIsNaN(arg)) {
+      throw new RangeError('The value of "defaultMaxListeners" is out of range. It must be a non-negative number. Received ' + arg + '.');
+    }
+    defaultMaxListeners = arg;
+  }
+});
+
+EventEmitter.init = function() {
+
+  if (this._events === undefined ||
+      this._events === Object.getPrototypeOf(this)._events) {
+    this._events = Object.create(null);
+    this._eventsCount = 0;
+  }
+
+  this._maxListeners = this._maxListeners || undefined;
+};
+
+// Obviously not all Emitters should be limited to 10. This function allows
+// that to be increased. Set to zero for unlimited.
+EventEmitter.prototype.setMaxListeners = function setMaxListeners(n) {
+  if (typeof n !== 'number' || n < 0 || NumberIsNaN(n)) {
+    throw new RangeError('The value of "n" is out of range. It must be a non-negative number. Received ' + n + '.');
+  }
+  this._maxListeners = n;
+  return this;
+};
+
+function _getMaxListeners(that) {
+  if (that._maxListeners === undefined)
+    return EventEmitter.defaultMaxListeners;
+  return that._maxListeners;
+}
+
+EventEmitter.prototype.getMaxListeners = function getMaxListeners() {
+  return _getMaxListeners(this);
+};
+
+EventEmitter.prototype.emit = function emit(type) {
+  var args = [];
+  for (var i = 1; i < arguments.length; i++) args.push(arguments[i]);
+  var doError = (type === 'error');
+
+  var events = this._events;
+  if (events !== undefined)
+    doError = (doError && events.error === undefined);
+  else if (!doError)
+    return false;
+
+  // If there is no 'error' event listener then throw.
+  if (doError) {
+    var er;
+    if (args.length > 0)
+      er = args[0];
+    if (er instanceof Error) {
+      // Note: The comments on the `throw` lines are intentional, they show
+      // up in Node's output if this results in an unhandled exception.
+      throw er; // Unhandled 'error' event
+    }
+    // At least give some kind of context to the user
+    var err = new Error('Unhandled error.' + (er ? ' (' + er.message + ')' : ''));
+    err.context = er;
+    throw err; // Unhandled 'error' event
+  }
+
+  var handler = events[type];
+
+  if (handler === undefined)
+    return false;
+
+  if (typeof handler === 'function') {
+    ReflectApply(handler, this, args);
+  } else {
+    var len = handler.length;
+    var listeners = arrayClone(handler, len);
+    for (var i = 0; i < len; ++i)
+      ReflectApply(listeners[i], this, args);
+  }
+
+  return true;
+};
+
+function _addListener(target, type, listener, prepend) {
+  var m;
+  var events;
+  var existing;
+
+  checkListener(listener);
+
+  events = target._events;
+  if (events === undefined) {
+    events = target._events = Object.create(null);
+    target._eventsCount = 0;
+  } else {
+    // To avoid recursion in the case that type === "newListener"! Before
+    // adding it to the listeners, first emit "newListener".
+    if (events.newListener !== undefined) {
+      target.emit('newListener', type,
+                  listener.listener ? listener.listener : listener);
+
+      // Re-assign `events` because a newListener handler could have caused the
+      // this._events to be assigned to a new object
+      events = target._events;
+    }
+    existing = events[type];
+  }
+
+  if (existing === undefined) {
+    // Optimize the case of one listener. Don't need the extra array object.
+    existing = events[type] = listener;
+    ++target._eventsCount;
+  } else {
+    if (typeof existing === 'function') {
+      // Adding the second element, need to change to array.
+      existing = events[type] =
+        prepend ? [listener, existing] : [existing, listener];
+      // If we've already got an array, just append.
+    } else if (prepend) {
+      existing.unshift(listener);
+    } else {
+      existing.push(listener);
+    }
+
+    // Check for listener leak
+    m = _getMaxListeners(target);
+    if (m > 0 && existing.length > m && !existing.warned) {
+      existing.warned = true;
+      // No error code for this since it is a Warning
+      // eslint-disable-next-line no-restricted-syntax
+      var w = new Error('Possible EventEmitter memory leak detected. ' +
+                          existing.length + ' ' + String(type) + ' listeners ' +
+                          'added. Use emitter.setMaxListeners() to ' +
+                          'increase limit');
+      w.name = 'MaxListenersExceededWarning';
+      w.emitter = target;
+      w.type = type;
+      w.count = existing.length;
+      ProcessEmitWarning(w);
+    }
+  }
+
+  return target;
+}
+
+EventEmitter.prototype.addListener = function addListener(type, listener) {
+  return _addListener(this, type, listener, false);
+};
+
+EventEmitter.prototype.on = EventEmitter.prototype.addListener;
+
+EventEmitter.prototype.prependListener =
+    function prependListener(type, listener) {
+      return _addListener(this, type, listener, true);
+    };
+
+function onceWrapper() {
+  if (!this.fired) {
+    this.target.removeListener(this.type, this.wrapFn);
+    this.fired = true;
+    if (arguments.length === 0)
+      return this.listener.call(this.target);
+    return this.listener.apply(this.target, arguments);
+  }
+}
+
+function _onceWrap(target, type, listener) {
+  var state = { fired: false, wrapFn: undefined, target: target, type: type, listener: listener };
+  var wrapped = onceWrapper.bind(state);
+  wrapped.listener = listener;
+  state.wrapFn = wrapped;
+  return wrapped;
+}
+
+EventEmitter.prototype.once = function once(type, listener) {
+  checkListener(listener);
+  this.on(type, _onceWrap(this, type, listener));
+  return this;
+};
+
+EventEmitter.prototype.prependOnceListener =
+    function prependOnceListener(type, listener) {
+      checkListener(listener);
+      this.prependListener(type, _onceWrap(this, type, listener));
+      return this;
+    };
+
+// Emits a 'removeListener' event if and only if the listener was removed.
+EventEmitter.prototype.removeListener =
+    function removeListener(type, listener) {
+      var list, events, position, i, originalListener;
+
+      checkListener(listener);
+
+      events = this._events;
+      if (events === undefined)
+        return this;
+
+      list = events[type];
+      if (list === undefined)
+        return this;
+
+      if (list === listener || list.listener === listener) {
+        if (--this._eventsCount === 0)
+          this._events = Object.create(null);
+        else {
+          delete events[type];
+          if (events.removeListener)
+            this.emit('removeListener', type, list.listener || listener);
+        }
+      } else if (typeof list !== 'function') {
+        position = -1;
+
+        for (i = list.length - 1; i >= 0; i--) {
+          if (list[i] === listener || list[i].listener === listener) {
+            originalListener = list[i].listener;
+            position = i;
+            break;
+          }
+        }
+
+        if (position < 0)
+          return this;
+
+        if (position === 0)
+          list.shift();
+        else {
+          spliceOne(list, position);
+        }
+
+        if (list.length === 1)
+          events[type] = list[0];
+
+        if (events.removeListener !== undefined)
+          this.emit('removeListener', type, originalListener || listener);
+      }
+
+      return this;
+    };
+
+EventEmitter.prototype.off = EventEmitter.prototype.removeListener;
+
+EventEmitter.prototype.removeAllListeners =
+    function removeAllListeners(type) {
+      var listeners, events, i;
+
+      events = this._events;
+      if (events === undefined)
+        return this;
+
+      // not listening for removeListener, no need to emit
+      if (events.removeListener === undefined) {
+        if (arguments.length === 0) {
+          this._events = Object.create(null);
+          this._eventsCount = 0;
+        } else if (events[type] !== undefined) {
+          if (--this._eventsCount === 0)
+            this._events = Object.create(null);
+          else
+            delete events[type];
+        }
+        return this;
+      }
+
+      // emit removeListener for all listeners on all events
+      if (arguments.length === 0) {
+        var keys = Object.keys(events);
+        var key;
+        for (i = 0; i < keys.length; ++i) {
+          key = keys[i];
+          if (key === 'removeListener') continue;
+          this.removeAllListeners(key);
+        }
+        this.removeAllListeners('removeListener');
+        this._events = Object.create(null);
+        this._eventsCount = 0;
+        return this;
+      }
+
+      listeners = events[type];
+
+      if (typeof listeners === 'function') {
+        this.removeListener(type, listeners);
+      } else if (listeners !== undefined) {
+        // LIFO order
+        for (i = listeners.length - 1; i >= 0; i--) {
+          this.removeListener(type, listeners[i]);
+        }
+      }
+
+      return this;
+    };
+
+function _listeners(target, type, unwrap) {
+  var events = target._events;
+
+  if (events === undefined)
+    return [];
+
+  var evlistener = events[type];
+  if (evlistener === undefined)
+    return [];
+
+  if (typeof evlistener === 'function')
+    return unwrap ? [evlistener.listener || evlistener] : [evlistener];
+
+  return unwrap ?
+    unwrapListeners(evlistener) : arrayClone(evlistener, evlistener.length);
+}
+
+EventEmitter.prototype.listeners = function listeners(type) {
+  return _listeners(this, type, true);
+};
+
+EventEmitter.prototype.rawListeners = function rawListeners(type) {
+  return _listeners(this, type, false);
+};
+
+EventEmitter.listenerCount = function(emitter, type) {
+  if (typeof emitter.listenerCount === 'function') {
+    return emitter.listenerCount(type);
+  } else {
+    return listenerCount.call(emitter, type);
+  }
+};
+
+EventEmitter.prototype.listenerCount = listenerCount;
+function listenerCount(type) {
+  var events = this._events;
+
+  if (events !== undefined) {
+    var evlistener = events[type];
+
+    if (typeof evlistener === 'function') {
+      return 1;
+    } else if (evlistener !== undefined) {
+      return evlistener.length;
+    }
+  }
+
+  return 0;
+}
+
+EventEmitter.prototype.eventNames = function eventNames() {
+  return this._eventsCount > 0 ? ReflectOwnKeys(this._events) : [];
+};
+
+function arrayClone(arr, n) {
+  var copy = new Array(n);
+  for (var i = 0; i < n; ++i)
+    copy[i] = arr[i];
+  return copy;
+}
+
+function spliceOne(list, index) {
+  for (; index + 1 < list.length; index++)
+    list[index] = list[index + 1];
+  list.pop();
+}
+
+function unwrapListeners(arr) {
+  var ret = new Array(arr.length);
+  for (var i = 0; i < ret.length; ++i) {
+    ret[i] = arr[i].listener || arr[i];
+  }
+  return ret;
+}
+
+function once(emitter, name) {
+  return new Promise(function (resolve, reject) {
+    function errorListener(err) {
+      emitter.removeListener(name, resolver);
+      reject(err);
+    }
+
+    function resolver() {
+      if (typeof emitter.removeListener === 'function') {
+        emitter.removeListener('error', errorListener);
+      }
+      resolve([].slice.call(arguments));
+    }
+    eventTargetAgnosticAddListener(emitter, name, resolver, { once: true });
+    if (name !== 'error') {
+      addErrorHandlerIfEventEmitter(emitter, errorListener, { once: true });
+    }
+  });
+}
+
+function addErrorHandlerIfEventEmitter(emitter, handler, flags) {
+  if (typeof emitter.on === 'function') {
+    eventTargetAgnosticAddListener(emitter, 'error', handler, flags);
+  }
+}
+
+function eventTargetAgnosticAddListener(emitter, name, listener, flags) {
+  if (typeof emitter.on === 'function') {
+    if (flags.once) {
+      emitter.once(name, listener);
+    } else {
+      emitter.on(name, listener);
+    }
+  } else if (typeof emitter.addEventListener === 'function') {
+    // EventTarget does not have `error` event semantics like Node
+    // EventEmitters, we do not listen for `error` events here.
+    emitter.addEventListener(name, function wrapListener(arg) {
+      // IE does not have builtin `{ once: true }` support so we
+      // have to do it manually.
+      if (flags.once) {
+        emitter.removeEventListener(name, wrapListener);
+      }
+      listener(arg);
+    });
+  } else {
+    throw new TypeError('The "emitter" argument must be of type EventEmitter. Received type ' + typeof emitter);
+  }
+}
+
+var sparkMd5 = {exports: {}};
+
+(function (module, exports$1) {
+	(function (factory) {
+	    {
+	        // Node/CommonJS
+	        module.exports = factory();
+	    }
+	}(function (undefined$1) {
+
+	    /*
+	     * Fastest md5 implementation around (JKM md5).
+	     * Credits: Joseph Myers
+	     *
+	     * @see http://www.myersdaily.org/joseph/javascript/md5-text.html
+	     * @see http://jsperf.com/md5-shootout/7
+	     */
+
+	    /* this function is much faster,
+	      so if possible we use it. Some IEs
+	      are the only ones I know of that
+	      need the idiotic second function,
+	      generated by an if clause.  */
+	    var hex_chr = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'];
+
+	    function md5cycle(x, k) {
+	        var a = x[0],
+	            b = x[1],
+	            c = x[2],
+	            d = x[3];
+
+	        a += (b & c | ~b & d) + k[0] - 680876936 | 0;
+	        a  = (a << 7 | a >>> 25) + b | 0;
+	        d += (a & b | ~a & c) + k[1] - 389564586 | 0;
+	        d  = (d << 12 | d >>> 20) + a | 0;
+	        c += (d & a | ~d & b) + k[2] + 606105819 | 0;
+	        c  = (c << 17 | c >>> 15) + d | 0;
+	        b += (c & d | ~c & a) + k[3] - 1044525330 | 0;
+	        b  = (b << 22 | b >>> 10) + c | 0;
+	        a += (b & c | ~b & d) + k[4] - 176418897 | 0;
+	        a  = (a << 7 | a >>> 25) + b | 0;
+	        d += (a & b | ~a & c) + k[5] + 1200080426 | 0;
+	        d  = (d << 12 | d >>> 20) + a | 0;
+	        c += (d & a | ~d & b) + k[6] - 1473231341 | 0;
+	        c  = (c << 17 | c >>> 15) + d | 0;
+	        b += (c & d | ~c & a) + k[7] - 45705983 | 0;
+	        b  = (b << 22 | b >>> 10) + c | 0;
+	        a += (b & c | ~b & d) + k[8] + 1770035416 | 0;
+	        a  = (a << 7 | a >>> 25) + b | 0;
+	        d += (a & b | ~a & c) + k[9] - 1958414417 | 0;
+	        d  = (d << 12 | d >>> 20) + a | 0;
+	        c += (d & a | ~d & b) + k[10] - 42063 | 0;
+	        c  = (c << 17 | c >>> 15) + d | 0;
+	        b += (c & d | ~c & a) + k[11] - 1990404162 | 0;
+	        b  = (b << 22 | b >>> 10) + c | 0;
+	        a += (b & c | ~b & d) + k[12] + 1804603682 | 0;
+	        a  = (a << 7 | a >>> 25) + b | 0;
+	        d += (a & b | ~a & c) + k[13] - 40341101 | 0;
+	        d  = (d << 12 | d >>> 20) + a | 0;
+	        c += (d & a | ~d & b) + k[14] - 1502002290 | 0;
+	        c  = (c << 17 | c >>> 15) + d | 0;
+	        b += (c & d | ~c & a) + k[15] + 1236535329 | 0;
+	        b  = (b << 22 | b >>> 10) + c | 0;
+
+	        a += (b & d | c & ~d) + k[1] - 165796510 | 0;
+	        a  = (a << 5 | a >>> 27) + b | 0;
+	        d += (a & c | b & ~c) + k[6] - 1069501632 | 0;
+	        d  = (d << 9 | d >>> 23) + a | 0;
+	        c += (d & b | a & ~b) + k[11] + 643717713 | 0;
+	        c  = (c << 14 | c >>> 18) + d | 0;
+	        b += (c & a | d & ~a) + k[0] - 373897302 | 0;
+	        b  = (b << 20 | b >>> 12) + c | 0;
+	        a += (b & d | c & ~d) + k[5] - 701558691 | 0;
+	        a  = (a << 5 | a >>> 27) + b | 0;
+	        d += (a & c | b & ~c) + k[10] + 38016083 | 0;
+	        d  = (d << 9 | d >>> 23) + a | 0;
+	        c += (d & b | a & ~b) + k[15] - 660478335 | 0;
+	        c  = (c << 14 | c >>> 18) + d | 0;
+	        b += (c & a | d & ~a) + k[4] - 405537848 | 0;
+	        b  = (b << 20 | b >>> 12) + c | 0;
+	        a += (b & d | c & ~d) + k[9] + 568446438 | 0;
+	        a  = (a << 5 | a >>> 27) + b | 0;
+	        d += (a & c | b & ~c) + k[14] - 1019803690 | 0;
+	        d  = (d << 9 | d >>> 23) + a | 0;
+	        c += (d & b | a & ~b) + k[3] - 187363961 | 0;
+	        c  = (c << 14 | c >>> 18) + d | 0;
+	        b += (c & a | d & ~a) + k[8] + 1163531501 | 0;
+	        b  = (b << 20 | b >>> 12) + c | 0;
+	        a += (b & d | c & ~d) + k[13] - 1444681467 | 0;
+	        a  = (a << 5 | a >>> 27) + b | 0;
+	        d += (a & c | b & ~c) + k[2] - 51403784 | 0;
+	        d  = (d << 9 | d >>> 23) + a | 0;
+	        c += (d & b | a & ~b) + k[7] + 1735328473 | 0;
+	        c  = (c << 14 | c >>> 18) + d | 0;
+	        b += (c & a | d & ~a) + k[12] - 1926607734 | 0;
+	        b  = (b << 20 | b >>> 12) + c | 0;
+
+	        a += (b ^ c ^ d) + k[5] - 378558 | 0;
+	        a  = (a << 4 | a >>> 28) + b | 0;
+	        d += (a ^ b ^ c) + k[8] - 2022574463 | 0;
+	        d  = (d << 11 | d >>> 21) + a | 0;
+	        c += (d ^ a ^ b) + k[11] + 1839030562 | 0;
+	        c  = (c << 16 | c >>> 16) + d | 0;
+	        b += (c ^ d ^ a) + k[14] - 35309556 | 0;
+	        b  = (b << 23 | b >>> 9) + c | 0;
+	        a += (b ^ c ^ d) + k[1] - 1530992060 | 0;
+	        a  = (a << 4 | a >>> 28) + b | 0;
+	        d += (a ^ b ^ c) + k[4] + 1272893353 | 0;
+	        d  = (d << 11 | d >>> 21) + a | 0;
+	        c += (d ^ a ^ b) + k[7] - 155497632 | 0;
+	        c  = (c << 16 | c >>> 16) + d | 0;
+	        b += (c ^ d ^ a) + k[10] - 1094730640 | 0;
+	        b  = (b << 23 | b >>> 9) + c | 0;
+	        a += (b ^ c ^ d) + k[13] + 681279174 | 0;
+	        a  = (a << 4 | a >>> 28) + b | 0;
+	        d += (a ^ b ^ c) + k[0] - 358537222 | 0;
+	        d  = (d << 11 | d >>> 21) + a | 0;
+	        c += (d ^ a ^ b) + k[3] - 722521979 | 0;
+	        c  = (c << 16 | c >>> 16) + d | 0;
+	        b += (c ^ d ^ a) + k[6] + 76029189 | 0;
+	        b  = (b << 23 | b >>> 9) + c | 0;
+	        a += (b ^ c ^ d) + k[9] - 640364487 | 0;
+	        a  = (a << 4 | a >>> 28) + b | 0;
+	        d += (a ^ b ^ c) + k[12] - 421815835 | 0;
+	        d  = (d << 11 | d >>> 21) + a | 0;
+	        c += (d ^ a ^ b) + k[15] + 530742520 | 0;
+	        c  = (c << 16 | c >>> 16) + d | 0;
+	        b += (c ^ d ^ a) + k[2] - 995338651 | 0;
+	        b  = (b << 23 | b >>> 9) + c | 0;
+
+	        a += (c ^ (b | ~d)) + k[0] - 198630844 | 0;
+	        a  = (a << 6 | a >>> 26) + b | 0;
+	        d += (b ^ (a | ~c)) + k[7] + 1126891415 | 0;
+	        d  = (d << 10 | d >>> 22) + a | 0;
+	        c += (a ^ (d | ~b)) + k[14] - 1416354905 | 0;
+	        c  = (c << 15 | c >>> 17) + d | 0;
+	        b += (d ^ (c | ~a)) + k[5] - 57434055 | 0;
+	        b  = (b << 21 |b >>> 11) + c | 0;
+	        a += (c ^ (b | ~d)) + k[12] + 1700485571 | 0;
+	        a  = (a << 6 | a >>> 26) + b | 0;
+	        d += (b ^ (a | ~c)) + k[3] - 1894986606 | 0;
+	        d  = (d << 10 | d >>> 22) + a | 0;
+	        c += (a ^ (d | ~b)) + k[10] - 1051523 | 0;
+	        c  = (c << 15 | c >>> 17) + d | 0;
+	        b += (d ^ (c | ~a)) + k[1] - 2054922799 | 0;
+	        b  = (b << 21 |b >>> 11) + c | 0;
+	        a += (c ^ (b | ~d)) + k[8] + 1873313359 | 0;
+	        a  = (a << 6 | a >>> 26) + b | 0;
+	        d += (b ^ (a | ~c)) + k[15] - 30611744 | 0;
+	        d  = (d << 10 | d >>> 22) + a | 0;
+	        c += (a ^ (d | ~b)) + k[6] - 1560198380 | 0;
+	        c  = (c << 15 | c >>> 17) + d | 0;
+	        b += (d ^ (c | ~a)) + k[13] + 1309151649 | 0;
+	        b  = (b << 21 |b >>> 11) + c | 0;
+	        a += (c ^ (b | ~d)) + k[4] - 145523070 | 0;
+	        a  = (a << 6 | a >>> 26) + b | 0;
+	        d += (b ^ (a | ~c)) + k[11] - 1120210379 | 0;
+	        d  = (d << 10 | d >>> 22) + a | 0;
+	        c += (a ^ (d | ~b)) + k[2] + 718787259 | 0;
+	        c  = (c << 15 | c >>> 17) + d | 0;
+	        b += (d ^ (c | ~a)) + k[9] - 343485551 | 0;
+	        b  = (b << 21 | b >>> 11) + c | 0;
+
+	        x[0] = a + x[0] | 0;
+	        x[1] = b + x[1] | 0;
+	        x[2] = c + x[2] | 0;
+	        x[3] = d + x[3] | 0;
+	    }
+
+	    function md5blk(s) {
+	        var md5blks = [],
+	            i; /* Andy King said do it this way. */
+
+	        for (i = 0; i < 64; i += 4) {
+	            md5blks[i >> 2] = s.charCodeAt(i) + (s.charCodeAt(i + 1) << 8) + (s.charCodeAt(i + 2) << 16) + (s.charCodeAt(i + 3) << 24);
+	        }
+	        return md5blks;
+	    }
+
+	    function md5blk_array(a) {
+	        var md5blks = [],
+	            i; /* Andy King said do it this way. */
+
+	        for (i = 0; i < 64; i += 4) {
+	            md5blks[i >> 2] = a[i] + (a[i + 1] << 8) + (a[i + 2] << 16) + (a[i + 3] << 24);
+	        }
+	        return md5blks;
+	    }
+
+	    function md51(s) {
+	        var n = s.length,
+	            state = [1732584193, -271733879, -1732584194, 271733878],
+	            i,
+	            length,
+	            tail,
+	            tmp,
+	            lo,
+	            hi;
+
+	        for (i = 64; i <= n; i += 64) {
+	            md5cycle(state, md5blk(s.substring(i - 64, i)));
+	        }
+	        s = s.substring(i - 64);
+	        length = s.length;
+	        tail = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+	        for (i = 0; i < length; i += 1) {
+	            tail[i >> 2] |= s.charCodeAt(i) << ((i % 4) << 3);
+	        }
+	        tail[i >> 2] |= 0x80 << ((i % 4) << 3);
+	        if (i > 55) {
+	            md5cycle(state, tail);
+	            for (i = 0; i < 16; i += 1) {
+	                tail[i] = 0;
+	            }
+	        }
+
+	        // Beware that the final length might not fit in 32 bits so we take care of that
+	        tmp = n * 8;
+	        tmp = tmp.toString(16).match(/(.*?)(.{0,8})$/);
+	        lo = parseInt(tmp[2], 16);
+	        hi = parseInt(tmp[1], 16) || 0;
+
+	        tail[14] = lo;
+	        tail[15] = hi;
+
+	        md5cycle(state, tail);
+	        return state;
+	    }
+
+	    function md51_array(a) {
+	        var n = a.length,
+	            state = [1732584193, -271733879, -1732584194, 271733878],
+	            i,
+	            length,
+	            tail,
+	            tmp,
+	            lo,
+	            hi;
+
+	        for (i = 64; i <= n; i += 64) {
+	            md5cycle(state, md5blk_array(a.subarray(i - 64, i)));
+	        }
+
+	        // Not sure if it is a bug, however IE10 will always produce a sub array of length 1
+	        // containing the last element of the parent array if the sub array specified starts
+	        // beyond the length of the parent array - weird.
+	        // https://connect.microsoft.com/IE/feedback/details/771452/typed-array-subarray-issue
+	        a = (i - 64) < n ? a.subarray(i - 64) : new Uint8Array(0);
+
+	        length = a.length;
+	        tail = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+	        for (i = 0; i < length; i += 1) {
+	            tail[i >> 2] |= a[i] << ((i % 4) << 3);
+	        }
+
+	        tail[i >> 2] |= 0x80 << ((i % 4) << 3);
+	        if (i > 55) {
+	            md5cycle(state, tail);
+	            for (i = 0; i < 16; i += 1) {
+	                tail[i] = 0;
+	            }
+	        }
+
+	        // Beware that the final length might not fit in 32 bits so we take care of that
+	        tmp = n * 8;
+	        tmp = tmp.toString(16).match(/(.*?)(.{0,8})$/);
+	        lo = parseInt(tmp[2], 16);
+	        hi = parseInt(tmp[1], 16) || 0;
+
+	        tail[14] = lo;
+	        tail[15] = hi;
+
+	        md5cycle(state, tail);
+
+	        return state;
+	    }
+
+	    function rhex(n) {
+	        var s = '',
+	            j;
+	        for (j = 0; j < 4; j += 1) {
+	            s += hex_chr[(n >> (j * 8 + 4)) & 0x0F] + hex_chr[(n >> (j * 8)) & 0x0F];
+	        }
+	        return s;
+	    }
+
+	    function hex(x) {
+	        var i;
+	        for (i = 0; i < x.length; i += 1) {
+	            x[i] = rhex(x[i]);
+	        }
+	        return x.join('');
+	    }
+
+	    // In some cases the fast add32 function cannot be used..
+	    if (hex(md51('hello')) !== '5d41402abc4b2a76b9719d911017c592') ;
+
+	    // ---------------------------------------------------
+
+	    /**
+	     * ArrayBuffer slice polyfill.
+	     *
+	     * @see https://github.com/ttaubert/node-arraybuffer-slice
+	     */
+
+	    if (typeof ArrayBuffer !== 'undefined' && !ArrayBuffer.prototype.slice) {
+	        (function () {
+	            function clamp(val, length) {
+	                val = (val | 0) || 0;
+
+	                if (val < 0) {
+	                    return Math.max(val + length, 0);
+	                }
+
+	                return Math.min(val, length);
+	            }
+
+	            ArrayBuffer.prototype.slice = function (from, to) {
+	                var length = this.byteLength,
+	                    begin = clamp(from, length),
+	                    end = length,
+	                    num,
+	                    target,
+	                    targetArray,
+	                    sourceArray;
+
+	                if (to !== undefined$1) {
+	                    end = clamp(to, length);
+	                }
+
+	                if (begin > end) {
+	                    return new ArrayBuffer(0);
+	                }
+
+	                num = end - begin;
+	                target = new ArrayBuffer(num);
+	                targetArray = new Uint8Array(target);
+
+	                sourceArray = new Uint8Array(this, begin, num);
+	                targetArray.set(sourceArray);
+
+	                return target;
+	            };
+	        })();
+	    }
+
+	    // ---------------------------------------------------
+
+	    /**
+	     * Helpers.
+	     */
+
+	    function toUtf8(str) {
+	        if (/[\u0080-\uFFFF]/.test(str)) {
+	            str = unescape(encodeURIComponent(str));
+	        }
+
+	        return str;
+	    }
+
+	    function utf8Str2ArrayBuffer(str, returnUInt8Array) {
+	        var length = str.length,
+	           buff = new ArrayBuffer(length),
+	           arr = new Uint8Array(buff),
+	           i;
+
+	        for (i = 0; i < length; i += 1) {
+	            arr[i] = str.charCodeAt(i);
+	        }
+
+	        return returnUInt8Array ? arr : buff;
+	    }
+
+	    function arrayBuffer2Utf8Str(buff) {
+	        return String.fromCharCode.apply(null, new Uint8Array(buff));
+	    }
+
+	    function concatenateArrayBuffers(first, second, returnUInt8Array) {
+	        var result = new Uint8Array(first.byteLength + second.byteLength);
+
+	        result.set(new Uint8Array(first));
+	        result.set(new Uint8Array(second), first.byteLength);
+
+	        return result ;
+	    }
+
+	    function hexToBinaryString(hex) {
+	        var bytes = [],
+	            length = hex.length,
+	            x;
+
+	        for (x = 0; x < length - 1; x += 2) {
+	            bytes.push(parseInt(hex.substr(x, 2), 16));
+	        }
+
+	        return String.fromCharCode.apply(String, bytes);
+	    }
+
+	    // ---------------------------------------------------
+
+	    /**
+	     * SparkMD5 OOP implementation.
+	     *
+	     * Use this class to perform an incremental md5, otherwise use the
+	     * static methods instead.
+	     */
+
+	    function SparkMD5() {
+	        // call reset to init the instance
+	        this.reset();
+	    }
+
+	    /**
+	     * Appends a string.
+	     * A conversion will be applied if an utf8 string is detected.
+	     *
+	     * @param {String} str The string to be appended
+	     *
+	     * @return {SparkMD5} The instance itself
+	     */
+	    SparkMD5.prototype.append = function (str) {
+	        // Converts the string to utf8 bytes if necessary
+	        // Then append as binary
+	        this.appendBinary(toUtf8(str));
+
+	        return this;
+	    };
+
+	    /**
+	     * Appends a binary string.
+	     *
+	     * @param {String} contents The binary string to be appended
+	     *
+	     * @return {SparkMD5} The instance itself
+	     */
+	    SparkMD5.prototype.appendBinary = function (contents) {
+	        this._buff += contents;
+	        this._length += contents.length;
+
+	        var length = this._buff.length,
+	            i;
+
+	        for (i = 64; i <= length; i += 64) {
+	            md5cycle(this._hash, md5blk(this._buff.substring(i - 64, i)));
+	        }
+
+	        this._buff = this._buff.substring(i - 64);
+
+	        return this;
+	    };
+
+	    /**
+	     * Finishes the incremental computation, reseting the internal state and
+	     * returning the result.
+	     *
+	     * @param {Boolean} raw True to get the raw string, false to get the hex string
+	     *
+	     * @return {String} The result
+	     */
+	    SparkMD5.prototype.end = function (raw) {
+	        var buff = this._buff,
+	            length = buff.length,
+	            i,
+	            tail = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+	            ret;
+
+	        for (i = 0; i < length; i += 1) {
+	            tail[i >> 2] |= buff.charCodeAt(i) << ((i % 4) << 3);
+	        }
+
+	        this._finish(tail, length);
+	        ret = hex(this._hash);
+
+	        if (raw) {
+	            ret = hexToBinaryString(ret);
+	        }
+
+	        this.reset();
+
+	        return ret;
+	    };
+
+	    /**
+	     * Resets the internal state of the computation.
+	     *
+	     * @return {SparkMD5} The instance itself
+	     */
+	    SparkMD5.prototype.reset = function () {
+	        this._buff = '';
+	        this._length = 0;
+	        this._hash = [1732584193, -271733879, -1732584194, 271733878];
+
+	        return this;
+	    };
+
+	    /**
+	     * Gets the internal state of the computation.
+	     *
+	     * @return {Object} The state
+	     */
+	    SparkMD5.prototype.getState = function () {
+	        return {
+	            buff: this._buff,
+	            length: this._length,
+	            hash: this._hash.slice()
+	        };
+	    };
+
+	    /**
+	     * Gets the internal state of the computation.
+	     *
+	     * @param {Object} state The state
+	     *
+	     * @return {SparkMD5} The instance itself
+	     */
+	    SparkMD5.prototype.setState = function (state) {
+	        this._buff = state.buff;
+	        this._length = state.length;
+	        this._hash = state.hash;
+
+	        return this;
+	    };
+
+	    /**
+	     * Releases memory used by the incremental buffer and other additional
+	     * resources. If you plan to use the instance again, use reset instead.
+	     */
+	    SparkMD5.prototype.destroy = function () {
+	        delete this._hash;
+	        delete this._buff;
+	        delete this._length;
+	    };
+
+	    /**
+	     * Finish the final calculation based on the tail.
+	     *
+	     * @param {Array}  tail   The tail (will be modified)
+	     * @param {Number} length The length of the remaining buffer
+	     */
+	    SparkMD5.prototype._finish = function (tail, length) {
+	        var i = length,
+	            tmp,
+	            lo,
+	            hi;
+
+	        tail[i >> 2] |= 0x80 << ((i % 4) << 3);
+	        if (i > 55) {
+	            md5cycle(this._hash, tail);
+	            for (i = 0; i < 16; i += 1) {
+	                tail[i] = 0;
+	            }
+	        }
+
+	        // Do the final computation based on the tail and length
+	        // Beware that the final length may not fit in 32 bits so we take care of that
+	        tmp = this._length * 8;
+	        tmp = tmp.toString(16).match(/(.*?)(.{0,8})$/);
+	        lo = parseInt(tmp[2], 16);
+	        hi = parseInt(tmp[1], 16) || 0;
+
+	        tail[14] = lo;
+	        tail[15] = hi;
+	        md5cycle(this._hash, tail);
+	    };
+
+	    /**
+	     * Performs the md5 hash on a string.
+	     * A conversion will be applied if utf8 string is detected.
+	     *
+	     * @param {String}  str The string
+	     * @param {Boolean} [raw] True to get the raw string, false to get the hex string
+	     *
+	     * @return {String} The result
+	     */
+	    SparkMD5.hash = function (str, raw) {
+	        // Converts the string to utf8 bytes if necessary
+	        // Then compute it using the binary function
+	        return SparkMD5.hashBinary(toUtf8(str), raw);
+	    };
+
+	    /**
+	     * Performs the md5 hash on a binary string.
+	     *
+	     * @param {String}  content The binary string
+	     * @param {Boolean} [raw]     True to get the raw string, false to get the hex string
+	     *
+	     * @return {String} The result
+	     */
+	    SparkMD5.hashBinary = function (content, raw) {
+	        var hash = md51(content),
+	            ret = hex(hash);
+
+	        return raw ? hexToBinaryString(ret) : ret;
+	    };
+
+	    // ---------------------------------------------------
+
+	    /**
+	     * SparkMD5 OOP implementation for array buffers.
+	     *
+	     * Use this class to perform an incremental md5 ONLY for array buffers.
+	     */
+	    SparkMD5.ArrayBuffer = function () {
+	        // call reset to init the instance
+	        this.reset();
+	    };
+
+	    /**
+	     * Appends an array buffer.
+	     *
+	     * @param {ArrayBuffer} arr The array to be appended
+	     *
+	     * @return {SparkMD5.ArrayBuffer} The instance itself
+	     */
+	    SparkMD5.ArrayBuffer.prototype.append = function (arr) {
+	        var buff = concatenateArrayBuffers(this._buff.buffer, arr),
+	            length = buff.length,
+	            i;
+
+	        this._length += arr.byteLength;
+
+	        for (i = 64; i <= length; i += 64) {
+	            md5cycle(this._hash, md5blk_array(buff.subarray(i - 64, i)));
+	        }
+
+	        this._buff = (i - 64) < length ? new Uint8Array(buff.buffer.slice(i - 64)) : new Uint8Array(0);
+
+	        return this;
+	    };
+
+	    /**
+	     * Finishes the incremental computation, reseting the internal state and
+	     * returning the result.
+	     *
+	     * @param {Boolean} raw True to get the raw string, false to get the hex string
+	     *
+	     * @return {String} The result
+	     */
+	    SparkMD5.ArrayBuffer.prototype.end = function (raw) {
+	        var buff = this._buff,
+	            length = buff.length,
+	            tail = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+	            i,
+	            ret;
+
+	        for (i = 0; i < length; i += 1) {
+	            tail[i >> 2] |= buff[i] << ((i % 4) << 3);
+	        }
+
+	        this._finish(tail, length);
+	        ret = hex(this._hash);
+
+	        if (raw) {
+	            ret = hexToBinaryString(ret);
+	        }
+
+	        this.reset();
+
+	        return ret;
+	    };
+
+	    /**
+	     * Resets the internal state of the computation.
+	     *
+	     * @return {SparkMD5.ArrayBuffer} The instance itself
+	     */
+	    SparkMD5.ArrayBuffer.prototype.reset = function () {
+	        this._buff = new Uint8Array(0);
+	        this._length = 0;
+	        this._hash = [1732584193, -271733879, -1732584194, 271733878];
+
+	        return this;
+	    };
+
+	    /**
+	     * Gets the internal state of the computation.
+	     *
+	     * @return {Object} The state
+	     */
+	    SparkMD5.ArrayBuffer.prototype.getState = function () {
+	        var state = SparkMD5.prototype.getState.call(this);
+
+	        // Convert buffer to a string
+	        state.buff = arrayBuffer2Utf8Str(state.buff);
+
+	        return state;
+	    };
+
+	    /**
+	     * Gets the internal state of the computation.
+	     *
+	     * @param {Object} state The state
+	     *
+	     * @return {SparkMD5.ArrayBuffer} The instance itself
+	     */
+	    SparkMD5.ArrayBuffer.prototype.setState = function (state) {
+	        // Convert string to buffer
+	        state.buff = utf8Str2ArrayBuffer(state.buff, true);
+
+	        return SparkMD5.prototype.setState.call(this, state);
+	    };
+
+	    SparkMD5.ArrayBuffer.prototype.destroy = SparkMD5.prototype.destroy;
+
+	    SparkMD5.ArrayBuffer.prototype._finish = SparkMD5.prototype._finish;
+
+	    /**
+	     * Performs the md5 hash on an array buffer.
+	     *
+	     * @param {ArrayBuffer} arr The array buffer
+	     * @param {Boolean}     [raw] True to get the raw string, false to get the hex one
+	     *
+	     * @return {String} The result
+	     */
+	    SparkMD5.ArrayBuffer.hash = function (arr, raw) {
+	        var hash = md51_array(new Uint8Array(arr)),
+	            ret = hex(hash);
+
+	        return raw ? hexToBinaryString(ret) : ret;
+	    };
+
+	    return SparkMD5;
+	})); 
+} (sparkMd5));
+
+function isBinaryObject(object) {
+  return (typeof ArrayBuffer !== 'undefined' && object instanceof ArrayBuffer) ||
+    (typeof Blob !== 'undefined' && object instanceof Blob);
+}
+
+/**
+ * @template {ArrayBuffer | Blob} T
+ * @param {T} object
+ * @returns {T}
+ */
+function cloneBinaryObject(object) {
+  return object instanceof ArrayBuffer
+    ? object.slice(0)
+    : object.slice(0, object.size, object.type);
+}
+
+// most of this is borrowed from lodash.isPlainObject:
+// https://github.com/fis-components/lodash.isplainobject/
+// blob/29c358140a74f252aeb08c9eb28bef86f2217d4a/index.js
+
+var funcToString = Function.prototype.toString;
+var objectCtorString = funcToString.call(Object);
+
+function isPlainObject(value) {
+  var proto = Object.getPrototypeOf(value);
+  /* istanbul ignore if */
+  if (proto === null) { // not sure when this happens, but I guess it can
+    return true;
+  }
+  var Ctor = proto.constructor;
+  return (typeof Ctor == 'function' &&
+    Ctor instanceof Ctor && funcToString.call(Ctor) == objectCtorString);
+}
+
+function clone(object) {
+  var newObject;
+  var i;
+  var len;
+
+  if (!object || typeof object !== 'object') {
+    return object;
+  }
+
+  if (Array.isArray(object)) {
+    newObject = [];
+    for (i = 0, len = object.length; i < len; i++) {
+      newObject[i] = clone(object[i]);
+    }
+    return newObject;
+  }
+
+  // special case: to avoid inconsistencies between IndexedDB
+  // and other backends, we automatically stringify Dates
+  if (object instanceof Date && isFinite(object)) {
+    return object.toISOString();
+  }
+
+  if (isBinaryObject(object)) {
+    return cloneBinaryObject(object);
+  }
+
+  if (!isPlainObject(object)) {
+    return object; // don't clone objects like Workers
+  }
+
+  newObject = {};
+  for (i in object) {
+    /* istanbul ignore else */
+    if (Object.prototype.hasOwnProperty.call(object, i)) {
+      var value = clone(object[i]);
+      if (typeof value !== 'undefined') {
+        newObject[i] = value;
+      }
+    }
+  }
+  return newObject;
+}
+
+var hasLocal;
+
+try {
+  localStorage.setItem('_pouch_check_localstorage', 1);
+  hasLocal = !!localStorage.getItem('_pouch_check_localstorage');
+} catch (e) {
+  hasLocal = false;
+}
+
+function collate(a, b) {
+
+  if (a === b) {
+    return 0;
+  }
+
+  a = normalizeKey(a);
+  b = normalizeKey(b);
+
+  var ai = collationIndex(a);
+  var bi = collationIndex(b);
+  if ((ai - bi) !== 0) {
+    return ai - bi;
+  }
+  switch (typeof a) {
+    case 'number':
+      return a - b;
+    case 'boolean':
+      return a < b ? -1 : 1;
+    case 'string':
+      return stringCollate(a, b);
+  }
+  return Array.isArray(a) ? arrayCollate(a, b) : objectCollate(a, b);
+}
+
+// couch considers null/NaN/Infinity/-Infinity === undefined,
+// for the purposes of mapreduce indexes. also, dates get stringified.
+function normalizeKey(key) {
+  switch (typeof key) {
+    case 'undefined':
+      return null;
+    case 'number':
+      if (key === Infinity || key === -Infinity || isNaN(key)) {
+        return null;
+      }
+      return key;
+    case 'object':
+      var origKey = key;
+      if (Array.isArray(key)) {
+        var len = key.length;
+        key = new Array(len);
+        for (var i = 0; i < len; i++) {
+          key[i] = normalizeKey(origKey[i]);
+        }
+      /* istanbul ignore next */
+      } else if (key instanceof Date) {
+        return key.toJSON();
+      } else if (key !== null) { // generic object
+        key = {};
+        for (var k in origKey) {
+          if (Object.prototype.hasOwnProperty.call(origKey, k)) {
+            var val = origKey[k];
+            if (typeof val !== 'undefined') {
+              key[k] = normalizeKey(val);
+            }
+          }
+        }
+      }
+  }
+  return key;
+}
+
+function arrayCollate(a, b) {
+  var len = Math.min(a.length, b.length);
+  for (var i = 0; i < len; i++) {
+    var sort = collate(a[i], b[i]);
+    if (sort !== 0) {
+      return sort;
+    }
+  }
+  return (a.length === b.length) ? 0 :
+    (a.length > b.length) ? 1 : -1;
+}
+function stringCollate(a, b) {
+  // See: https://github.com/daleharvey/pouchdb/issues/40
+  // This is incompatible with the CouchDB implementation, but its the
+  // best we can do for now
+  return (a === b) ? 0 : ((a > b) ? 1 : -1);
+}
+function objectCollate(a, b) {
+  var ak = Object.keys(a), bk = Object.keys(b);
+  var len = Math.min(ak.length, bk.length);
+  for (var i = 0; i < len; i++) {
+    // First sort the keys
+    var sort = collate(ak[i], bk[i]);
+    if (sort !== 0) {
+      return sort;
+    }
+    // if the keys are equal sort the values
+    sort = collate(a[ak[i]], b[bk[i]]);
+    if (sort !== 0) {
+      return sort;
+    }
+
+  }
+  return (ak.length === bk.length) ? 0 :
+    (ak.length > bk.length) ? 1 : -1;
+}
+// The collation is defined by erlangs ordered terms
+// the atoms null, true, false come first, then numbers, strings,
+// arrays, then objects
+// null/undefined/NaN/Infinity/-Infinity are all considered null
+function collationIndex(x) {
+  var id = ['boolean', 'number', 'string', 'object'];
+  var idx = id.indexOf(typeof x);
+  //false if -1 otherwise true, but fast!!!!1
+  if (~idx) {
+    if (x === null) {
+      return 1;
+    }
+    if (Array.isArray(x)) {
+      return 5;
+    }
+    return idx < 3 ? (idx + 2) : (idx + 3);
+  }
+  /* istanbul ignore next */
+  if (Array.isArray(x)) {
+    return 5;
+  }
+}
+
+// this would just be "return doc[field]", but fields
+// can be "deep" due to dot notation
+function getFieldFromDoc(doc, parsedField) {
+  var value = doc;
+  for (var i = 0, len = parsedField.length; i < len; i++) {
+    var key = parsedField[i];
+    value = value[key];
+    if (!value) {
+      break;
+    }
+  }
+  return value;
+}
+
+function compare(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+// Converts a string in dot notation to an array of its components, with backslash escaping
+function parseField(fieldName) {
+  // fields may be deep (e.g. "foo.bar.baz"), so parse
+  var fields = [];
+  var current = '';
+  for (var i = 0, len = fieldName.length; i < len; i++) {
+    var ch = fieldName[i];
+    if (i > 0 && fieldName[i - 1] === '\\' && (ch === '$' || ch === '.')) {
+      // escaped delimiter
+      current = current.substring(0, current.length - 1) + ch;
+    } else if (ch === '.') {
+      // When `.` is not escaped (above), it is a field delimiter
+      fields.push(current);
+      current = '';
+    } else { // normal character
+      current += ch;
+    }
+  }
+  fields.push(current);
+  return fields;
+}
+
+var combinationFields = ['$or', '$nor', '$not'];
+function isCombinationalField(field) {
+  return combinationFields.indexOf(field) > -1;
+}
+
+function getKey(obj) {
+  return Object.keys(obj)[0];
+}
+
+function getValue(obj) {
+  return obj[getKey(obj)];
+}
+
+
+// flatten an array of selectors joined by an $and operator
+function mergeAndedSelectors(selectors) {
+
+  // sort to ensure that e.g. if the user specified
+  // $and: [{$gt: 'a'}, {$gt: 'b'}], then it's collapsed into
+  // just {$gt: 'b'}
+  var res = {};
+  var first = {$or: true, $nor: true};
+
+  selectors.forEach(function (selector) {
+    Object.keys(selector).forEach(function (field) {
+      var matcher = selector[field];
+      if (typeof matcher !== 'object') {
+        matcher = {$eq: matcher};
+      }
+
+      if (isCombinationalField(field)) {
+        // or, nor
+        if (matcher instanceof Array) {
+          if (first[field]) {
+            first[field] = false;
+            res[field] = matcher;
+            return;
+          }
+
+          var entries = [];
+          res[field].forEach(function (existing) {
+            Object.keys(matcher).forEach(function (key) {
+              var m = matcher[key];
+              var longest = Math.max(Object.keys(existing).length, Object.keys(m).length);
+              var merged = mergeAndedSelectors([existing, m]);
+              if (Object.keys(merged).length <= longest) {
+                // we have a situation like: (a :{$eq :1} || ...) && (a {$eq: 2} || ...)
+                // merging would produce a $eq 2 when actually we shouldn't ever match against these merged conditions
+                // merged should always contain more values to be valid
+                return;
+              }
+              entries.push(merged);
+            });
+          });
+          res[field] = entries;
+        } else {
+          // not
+          res[field] = mergeAndedSelectors([matcher]);
+        }
+      } else {
+        var fieldMatchers = res[field] = res[field] || {};
+        Object.keys(matcher).forEach(function (operator) {
+          var value = matcher[operator];
+
+          if (operator === '$gt' || operator === '$gte') {
+            return mergeGtGte(operator, value, fieldMatchers);
+          } else if (operator === '$lt' || operator === '$lte') {
+            return mergeLtLte(operator, value, fieldMatchers);
+          } else if (operator === '$ne') {
+            return mergeNe(value, fieldMatchers);
+          } else if (operator === '$eq') {
+            return mergeEq(value, fieldMatchers);
+          } else if (operator === "$regex") {
+            return mergeRegex(value, fieldMatchers);
+          }
+          fieldMatchers[operator] = value;
+        });
+      }
+    });
+  });
+
+  return res;
+}
+
+
+
+// collapse logically equivalent gt/gte values
+function mergeGtGte(operator, value, fieldMatchers) {
+  if (typeof fieldMatchers.$eq !== 'undefined') {
+    return; // do nothing
+  }
+  if (typeof fieldMatchers.$gte !== 'undefined') {
+    if (operator === '$gte') {
+      if (value > fieldMatchers.$gte) { // more specificity
+        fieldMatchers.$gte = value;
+      }
+    } else { // operator === '$gt'
+      if (value >= fieldMatchers.$gte) { // more specificity
+        delete fieldMatchers.$gte;
+        fieldMatchers.$gt = value;
+      }
+    }
+  } else if (typeof fieldMatchers.$gt !== 'undefined') {
+    if (operator === '$gte') {
+      if (value > fieldMatchers.$gt) { // more specificity
+        delete fieldMatchers.$gt;
+        fieldMatchers.$gte = value;
+      }
+    } else { // operator === '$gt'
+      if (value > fieldMatchers.$gt) { // more specificity
+        fieldMatchers.$gt = value;
+      }
+    }
+  } else {
+    fieldMatchers[operator] = value;
+  }
+}
+
+// collapse logically equivalent lt/lte values
+function mergeLtLte(operator, value, fieldMatchers) {
+  if (typeof fieldMatchers.$eq !== 'undefined') {
+    return; // do nothing
+  }
+  if (typeof fieldMatchers.$lte !== 'undefined') {
+    if (operator === '$lte') {
+      if (value < fieldMatchers.$lte) { // more specificity
+        fieldMatchers.$lte = value;
+      }
+    } else { // operator === '$gt'
+      if (value <= fieldMatchers.$lte) { // more specificity
+        delete fieldMatchers.$lte;
+        fieldMatchers.$lt = value;
+      }
+    }
+  } else if (typeof fieldMatchers.$lt !== 'undefined') {
+    if (operator === '$lte') {
+      if (value < fieldMatchers.$lt) { // more specificity
+        delete fieldMatchers.$lt;
+        fieldMatchers.$lte = value;
+      }
+    } else { // operator === '$gt'
+      if (value < fieldMatchers.$lt) { // more specificity
+        fieldMatchers.$lt = value;
+      }
+    }
+  } else {
+    fieldMatchers[operator] = value;
+  }
+}
+
+// combine $ne values into one array
+function mergeNe(value, fieldMatchers) {
+  if ('$ne' in fieldMatchers) {
+    // there are many things this could "not" be
+    fieldMatchers.$ne.push(value);
+  } else { // doesn't exist yet
+    fieldMatchers.$ne = [value];
+  }
+}
+
+// add $eq into the mix
+function mergeEq(value, fieldMatchers) {
+  // these all have less specificity than the $eq
+  // TODO: check for user errors here
+  delete fieldMatchers.$gt;
+  delete fieldMatchers.$gte;
+  delete fieldMatchers.$lt;
+  delete fieldMatchers.$lte;
+  delete fieldMatchers.$ne;
+  fieldMatchers.$eq = value;
+}
+
+// combine $regex values into one array
+function mergeRegex(value, fieldMatchers) {
+  if ('$regex' in fieldMatchers) {
+    // a value could match multiple regexes
+    fieldMatchers.$regex.push(value);
+  } else { // doesn't exist yet
+    fieldMatchers.$regex = [value];
+  }
+}
+
+//#7458: execute function mergeAndedSelectors on nested $and
+function mergeAndedSelectorsNested(obj) {
+    for (var prop in obj) {
+        if (Array.isArray(obj)) {
+            for (var i in obj) {
+                if (obj[i]['$and']) {
+                    obj[i] = mergeAndedSelectors(obj[i]['$and']);
+                }
+            }
+        }
+        var value = obj[prop];
+        if (typeof value === 'object') {
+            mergeAndedSelectorsNested(value); // <- recursive call
+        }
+    }
+    return obj;
+}
+
+//#7458: determine id $and is present in selector (at any level)
+function isAndInSelector(obj, isAnd) {
+    for (var prop in obj) {
+        if (prop === '$and') {
+            isAnd = true;
+        }
+        var value = obj[prop];
+        if (typeof value === 'object') {
+            isAnd = isAndInSelector(value, isAnd); // <- recursive call
+        }
+    }
+    return isAnd;
+}
+
+//
+// normalize the selector
+//
+function massageSelector(input) {
+  var result = clone(input);
+
+  //#7458: if $and is present in selector (at any level) merge nested $and
+  if (isAndInSelector(result, false)) {
+    result = mergeAndedSelectorsNested(result);
+    if ('$and' in result) {
+      result = mergeAndedSelectors(result['$and']);
+    }
+  }
+
+  ['$or', '$nor'].forEach(function (orOrNor) {
+    if (orOrNor in result) {
+      // message each individual selector
+      // e.g. {foo: 'bar'} becomes {foo: {$eq: 'bar'}}
+      result[orOrNor].forEach(function (subSelector) {
+        var fields = Object.keys(subSelector);
+        for (var i = 0; i < fields.length; i++) {
+          var field = fields[i];
+          var matcher = subSelector[field];
+          if (typeof matcher !== 'object' || matcher === null) {
+            subSelector[field] = {$eq: matcher};
+          }
+        }
+      });
+    }
+  });
+
+  if ('$not' in result) {
+    //This feels a little like forcing, but it will work for now,
+    //I would like to come back to this and make the merging of selectors a little more generic
+    result['$not'] = mergeAndedSelectors([result['$not']]);
+  }
+
+  var fields = Object.keys(result);
+
+  for (var i = 0; i < fields.length; i++) {
+    var field = fields[i];
+    var matcher = result[field];
+
+    if (typeof matcher !== 'object' || matcher === null) {
+      matcher = {$eq: matcher};
+    }
+    result[field] = matcher;
+  }
+
+  normalizeArrayOperators(result);
+
+  return result;
+}
+
+//
+// The $ne and $regex values must be placed in an array because these operators can be used multiple times on the same field.
+// When $and is used, mergeAndedSelectors takes care of putting some of them into arrays, otherwise it's done here.
+//
+function normalizeArrayOperators(selector) {
+  Object.keys(selector).forEach(function (field) {
+    var matcher = selector[field];
+
+    if (Array.isArray(matcher)) {
+      matcher.forEach(function (matcherItem) {
+        if (matcherItem && typeof matcherItem === 'object') {
+          normalizeArrayOperators(matcherItem);
+        }
+      });
+    } else if (field === '$ne') {
+      selector.$ne = [matcher];
+    } else if (field === '$regex') {
+      selector.$regex = [matcher];
+    } else if (matcher && typeof matcher === 'object') {
+      normalizeArrayOperators(matcher);
+    }
+  });
+}
+
+// create a comparator based on the sort object
+function createFieldSorter(sort) {
+
+  function getFieldValuesAsArray(doc) {
+    return sort.map(function (sorting) {
+      var fieldName = getKey(sorting);
+      var parsedField = parseField(fieldName);
+      var docFieldValue = getFieldFromDoc(doc, parsedField);
+      return docFieldValue;
+    });
+  }
+
+  return function (aRow, bRow) {
+    var aFieldValues = getFieldValuesAsArray(aRow.doc);
+    var bFieldValues = getFieldValuesAsArray(bRow.doc);
+    var collation = collate(aFieldValues, bFieldValues);
+    if (collation !== 0) {
+      return collation;
+    }
+    // this is what mango seems to do
+    return compare(aRow.doc._id, bRow.doc._id);
+  };
+}
+
+function filterInMemoryFields(rows, requestDef, inMemoryFields) {
+  rows = rows.filter(function (row) {
+    return rowFilter(row.doc, requestDef.selector, inMemoryFields);
+  });
+
+  if (requestDef.sort) {
+    // in-memory sort
+    var fieldSorter = createFieldSorter(requestDef.sort);
+    rows = rows.sort(fieldSorter);
+    if (typeof requestDef.sort[0] !== 'string' &&
+        getValue(requestDef.sort[0]) === 'desc') {
+      rows = rows.reverse();
+    }
+  }
+
+  if ('limit' in requestDef || 'skip' in requestDef) {
+    // have to do the limit in-memory
+    var skip = requestDef.skip || 0;
+    var limit = ('limit' in requestDef ? requestDef.limit : rows.length) + skip;
+    rows = rows.slice(skip, limit);
+  }
+  return rows;
+}
+
+function rowFilter(doc, selector, inMemoryFields) {
+  return inMemoryFields.every(function (field) {
+    var matcher = selector[field];
+    var parsedField = parseField(field);
+    var docFieldValue = getFieldFromDoc(doc, parsedField);
+    if (isCombinationalField(field)) {
+      return matchCominationalSelector(field, matcher, doc);
+    }
+
+    return matchSelector(matcher, doc, parsedField, docFieldValue);
+  });
+}
+
+function matchSelector(matcher, doc, parsedField, docFieldValue) {
+  if (!matcher) {
+    // no filtering necessary; this field is just needed for sorting
+    return true;
+  }
+
+  // is matcher an object, if so continue recursion
+  if (typeof matcher === 'object') {
+    return Object.keys(matcher).every(function (maybeUserOperator) {
+      var userValue = matcher[ maybeUserOperator ];
+      // explicit operator
+      if (maybeUserOperator.indexOf("$") === 0) {
+        return match(maybeUserOperator, doc, userValue, parsedField, docFieldValue);
+      } else {
+        var subParsedField = parseField(maybeUserOperator);
+
+        if (
+          docFieldValue === undefined &&
+          typeof userValue !== "object" &&
+          subParsedField.length > 0
+        ) {
+          // the field does not exist, return or getFieldFromDoc will throw
+          return false;
+        }
+
+        var subDocFieldValue = getFieldFromDoc(docFieldValue, subParsedField);
+
+        if (typeof userValue === "object") {
+          // field value is an object that might contain more operators
+          return matchSelector(userValue, doc, parsedField, subDocFieldValue);
+        }
+
+        // implicit operator
+        return match("$eq", doc, userValue, subParsedField, subDocFieldValue);
+      }
+    });
+  }
+
+  // no more depth, No need to recurse further
+  return matcher === docFieldValue;
+}
+
+function matchCominationalSelector(field, matcher, doc) {
+
+  if (field === '$or') {
+    return matcher.some(function (orMatchers) {
+      return rowFilter(doc, orMatchers, Object.keys(orMatchers));
+    });
+  }
+
+  if (field === '$not') {
+    return !rowFilter(doc, matcher, Object.keys(matcher));
+  }
+
+  //`$nor`
+  return !matcher.find(function (orMatchers) {
+    return rowFilter(doc, orMatchers, Object.keys(orMatchers));
+  });
+
+}
+
+function match(userOperator, doc, userValue, parsedField, docFieldValue) {
+  if (!matchers[userOperator]) {
+    /* istanbul ignore next */
+    throw new Error('unknown operator "' + userOperator +
+      '" - should be one of $eq, $lte, $lt, $gt, $gte, $exists, $ne, $in, ' +
+      '$nin, $size, $mod, $regex, $elemMatch, $type, $allMatch or $all');
+  }
+  return matchers[userOperator](doc, userValue, parsedField, docFieldValue);
+}
+
+function fieldExists(docFieldValue) {
+  return typeof docFieldValue !== 'undefined' && docFieldValue !== null;
+}
+
+function fieldIsNotUndefined(docFieldValue) {
+  return typeof docFieldValue !== 'undefined';
+}
+
+function modField(docFieldValue, userValue) {
+  if (typeof docFieldValue !== "number" ||
+    parseInt(docFieldValue, 10) !== docFieldValue) {
+    return false;
+  }
+
+  var divisor = userValue[0];
+  var mod = userValue[1];
+
+  return docFieldValue % divisor === mod;
+}
+
+function arrayContainsValue(docFieldValue, userValue) {
+  return userValue.some(function (val) {
+    if (docFieldValue instanceof Array) {
+      return docFieldValue.some(function (docFieldValueItem) {
+        return collate(val, docFieldValueItem) === 0;
+      });
+    }
+
+    return collate(val, docFieldValue) === 0;
+  });
+}
+
+function arrayContainsAllValues(docFieldValue, userValue) {
+  return userValue.every(function (val) {
+    return docFieldValue.some(function (docFieldValueItem) {
+      return collate(val, docFieldValueItem) === 0;
+    });
+  });
+}
+
+function arraySize(docFieldValue, userValue) {
+  return docFieldValue.length === userValue;
+}
+
+function regexMatch(docFieldValue, userValue) {
+  var re = new RegExp(userValue);
+
+  return re.test(docFieldValue);
+}
+
+function typeMatch(docFieldValue, userValue) {
+
+  switch (userValue) {
+    case 'null':
+      return docFieldValue === null;
+    case 'boolean':
+      return typeof (docFieldValue) === 'boolean';
+    case 'number':
+      return typeof (docFieldValue) === 'number';
+    case 'string':
+      return typeof (docFieldValue) === 'string';
+    case 'array':
+      return docFieldValue instanceof Array;
+    case 'object':
+      return ({}).toString.call(docFieldValue) === '[object Object]';
+  }
+}
+
+var matchers = {
+
+  '$elemMatch': function (doc, userValue, parsedField, docFieldValue) {
+    if (!Array.isArray(docFieldValue)) {
+      return false;
+    }
+
+    if (docFieldValue.length === 0) {
+      return false;
+    }
+
+    if (typeof docFieldValue[0] === 'object' &&  docFieldValue[0] !== null) {
+      return docFieldValue.some(function (val) {
+        return rowFilter(val, userValue, Object.keys(userValue));
+      });
+    }
+
+    return docFieldValue.some(function (val) {
+      return matchSelector(userValue, doc, parsedField, val);
+    });
+  },
+
+  '$allMatch': function (doc, userValue, parsedField, docFieldValue) {
+    if (!Array.isArray(docFieldValue)) {
+      return false;
+    }
+
+    /* istanbul ignore next */
+    if (docFieldValue.length === 0) {
+      return false;
+    }
+
+    if (typeof docFieldValue[0] === 'object' &&  docFieldValue[0] !== null) {
+      return docFieldValue.every(function (val) {
+        return rowFilter(val, userValue, Object.keys(userValue));
+      });
+    }
+
+    return docFieldValue.every(function (val) {
+      return matchSelector(userValue, doc, parsedField, val);
+    });
+  },
+
+  '$eq': function (doc, userValue, parsedField, docFieldValue) {
+    return fieldIsNotUndefined(docFieldValue) && collate(docFieldValue, userValue) === 0;
+  },
+
+  '$gte': function (doc, userValue, parsedField, docFieldValue) {
+    return fieldIsNotUndefined(docFieldValue) && collate(docFieldValue, userValue) >= 0;
+  },
+
+  '$gt': function (doc, userValue, parsedField, docFieldValue) {
+    return fieldIsNotUndefined(docFieldValue) && collate(docFieldValue, userValue) > 0;
+  },
+
+  '$lte': function (doc, userValue, parsedField, docFieldValue) {
+    return fieldIsNotUndefined(docFieldValue) && collate(docFieldValue, userValue) <= 0;
+  },
+
+  '$lt': function (doc, userValue, parsedField, docFieldValue) {
+    return fieldIsNotUndefined(docFieldValue) && collate(docFieldValue, userValue) < 0;
+  },
+
+  '$exists': function (doc, userValue, parsedField, docFieldValue) {
+    //a field that is null is still considered to exist
+    if (userValue) {
+      return fieldIsNotUndefined(docFieldValue);
+    }
+
+    return !fieldIsNotUndefined(docFieldValue);
+  },
+
+  '$mod': function (doc, userValue, parsedField, docFieldValue) {
+    return fieldExists(docFieldValue) && modField(docFieldValue, userValue);
+  },
+
+  '$ne': function (doc, userValue, parsedField, docFieldValue) {
+    return userValue.every(function (neValue) {
+      return collate(docFieldValue, neValue) !== 0;
+    });
+  },
+  '$in': function (doc, userValue, parsedField, docFieldValue) {
+    return fieldExists(docFieldValue) && arrayContainsValue(docFieldValue, userValue);
+  },
+
+  '$nin': function (doc, userValue, parsedField, docFieldValue) {
+    return fieldExists(docFieldValue) && !arrayContainsValue(docFieldValue, userValue);
+  },
+
+  '$size': function (doc, userValue, parsedField, docFieldValue) {
+    return fieldExists(docFieldValue) &&
+      Array.isArray(docFieldValue) &&
+      arraySize(docFieldValue, userValue);
+  },
+
+  '$all': function (doc, userValue, parsedField, docFieldValue) {
+    return Array.isArray(docFieldValue) && arrayContainsAllValues(docFieldValue, userValue);
+  },
+
+  '$regex': function (doc, userValue, parsedField, docFieldValue) {
+    return fieldExists(docFieldValue) &&
+      typeof docFieldValue == "string" &&
+      userValue.every(function (regexValue) {
+        return regexMatch(docFieldValue, regexValue);
+      });
+  },
+
+  '$type': function (doc, userValue, parsedField, docFieldValue) {
+    return typeMatch(docFieldValue, userValue);
+  }
+};
+
+// return true if the given doc matches the supplied selector
+function matchesSelector(doc, selector) {
+  /* istanbul ignore if */
+  if (typeof selector !== 'object') {
+    // match the CouchDB error message
+    throw new Error('Selector error: expected a JSON object');
+  }
+
+  selector = massageSelector(selector);
+  var row = {
+    doc
+  };
+
+  var rowsMatched = filterInMemoryFields([row], { selector }, Object.keys(selector));
+  return rowsMatched && rowsMatched.length === 1;
+}
+
+// pouchdb-find's own matcher and collation - using anything else would let overlay
+// semantics drift from what the same selector means against the database.
+/**
+ * True when a query with this selector could see documents this stage holds.
+ *
+ * Derived from the selector's `~class` / `~domain` constraint against the stage's
+ * partitions; a selector naming no class is answered conservatively. This is the
+ * per-query fast path: a find over a class the transaction never touched runs
+ * exactly as it would outside the transaction.
+ */
+const stageCoversSelector = (stage, selector) => {
+    if (stage.size === 0)
+        return false;
+    const names = [
+        ...constraintNames(selector["~class"]),
+        ...constraintNames(selector["~domain"]),
+    ];
+    if (!names.length)
+        return true;
+    return names.some(name => stage.hasPartition(name));
+};
+const constraintNames = (constraint) => {
+    if (typeof constraint === "string")
+        return [constraint];
+    if (constraint && typeof constraint === "object") {
+        const eq = constraint.$eq;
+        if (typeof eq === "string")
+            return [eq];
+        const within = constraint.$in;
+        if (Array.isArray(within))
+            return within.filter((name) => typeof name === "string");
+    }
+    return [];
+};
+/**
+ * Fields the widened committed query (and the staged docs) must carry beyond the
+ * caller's projection, so masking, sorting and the read pipeline can work; the
+ * extras are stripped again after the merge.
+ */
+const widenProjection = (fields, sort) => {
+    if (!fields || !fields.length)
+        return { queryFields: undefined, extras: [] };
+    const needed = new Set(["_id", "~class"]);
+    for (const entry of sort !== null && sort !== void 0 ? sort : []) {
+        needed.add(typeof entry === "string" ? entry : Object.keys(entry)[0]);
+    }
+    const extras = [...needed].filter(field => !fields.includes(field));
+    return { queryFields: [...fields, ...extras], extras };
+};
+const projectDoc = (doc, fields) => {
+    const projected = {};
+    for (const field of fields) {
+        const value = getFieldFromDoc(doc, parseField(field));
+        if (value !== undefined)
+            projected[field] = value;
+    }
+    return projected;
+};
+const sortComparator = (sort) => {
+    const parts = sort.map(entry => {
+        const field = typeof entry === "string" ? entry : Object.keys(entry)[0];
+        const direction = typeof entry === "string" ? "asc" : entry[field];
+        return { parsed: parseField(field), factor: direction === "desc" ? -1 : 1 };
+    });
+    return (a, b) => {
+        for (const { parsed, factor } of parts) {
+            const result = compare(getFieldFromDoc(a, parsed), getFieldFromDoc(b, parsed)) * factor;
+            if (result !== 0)
+                return result;
+        }
+        return 0;
+    };
+};
+/**
+ * Merges a stage into a committed query result: every staged id masks its committed
+ * row (superseded and deleted alike), staged writes matching the selector join the
+ * set, then sort, window and projection apply in memory - the database's index can
+ * never see a staged document, so the window has to be computed after the union.
+ *
+ * `committedDocs` must come from a query WITHOUT skip/limit (the mask changes what
+ * the window contains) and carrying `widenProjection`'s fields.
+ */
+const mergeStageIntoResults = (stage, selector, committedDocs, options = {}) => {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    const survivors = committedDocs.filter(doc => !stage.has(doc._id));
+    for (const entry of stage.values()) {
+        if (entry.op !== "write")
+            continue;
+        if (!matchesSelector(entry.doc, selector))
+            continue;
+        const overlaid = Object.assign({}, structuredClone(entry.doc));
+        if (entry.baseRev)
+            overlaid._rev = (_a = overlaid._rev) !== null && _a !== void 0 ? _a : entry.baseRev;
+        survivors.push(((_b = options.fields) === null || _b === void 0 ? void 0 : _b.length)
+            ? projectDoc(overlaid, [...options.fields, ...((_c = options.extras) !== null && _c !== void 0 ? _c : [])])
+            : overlaid);
+    }
+    if ((_d = options.sort) === null || _d === void 0 ? void 0 : _d.length)
+        survivors.sort(sortComparator(options.sort));
+    const skip = (_e = options.skip) !== null && _e !== void 0 ? _e : 0;
+    const limit = (_f = options.limit) !== null && _f !== void 0 ? _f : survivors.length;
+    const windowed = survivors.slice(skip, skip + limit);
+    if (((_g = options.fields) === null || _g === void 0 ? void 0 : _g.length) && ((_h = options.extras) === null || _h === void 0 ? void 0 : _h.length)) {
+        return windowed.map(doc => projectDoc(doc, options.fields));
+    }
+    return windowed;
+};
+/** A PouchDB-shaped `not_found`, so overlay reads refuse like the database does. */
+const notFoundError = (id) => {
+    const error = new Error("missing");
+    error.status = 404;
+    error.name = "not_found";
+    error.error = true;
+    error.reason = "deleted";
+    error.docId = id;
+    return error;
+};
+/**
+ * Read-your-writes for a point read: a staged delete is a 404, a staged write is the
+ * authored plaintext (its `_rev` is the base revision - the revision the commit will
+ * replace), anything else is the stack's ordinary decrypting read.
+ */
+const overlayGet = async (stack, stage, id, options) => {
+    const entry = stage.get(id);
+    if (entry) {
+        if (entry.op === "delete")
+            throw notFoundError(id);
+        const doc = structuredClone(entry.doc);
+        if (entry.baseRev && doc._rev === undefined)
+            doc._rev = entry.baseRev;
+        return doc;
+    }
+    return stack.db.get(id, options !== null && options !== void 0 ? options : {});
+};
+/** `bulkGet` counterpart of {@link overlayGet}, preserving request order. */
+const overlayBulkGet = async (stack, stage, request) => {
+    var _a, _b, _c, _d;
+    const passthrough = ((_a = request.docs) !== null && _a !== void 0 ? _a : []).filter(item => !stage.has(item.id));
+    const fetched = passthrough.length
+        ? await stack.db.bulkGet(Object.assign(Object.assign({}, request), { docs: passthrough }))
+        : { results: [] };
+    const byId = new Map();
+    for (const result of (_b = fetched.results) !== null && _b !== void 0 ? _b : []) {
+        const list = (_c = byId.get(result.id)) !== null && _c !== void 0 ? _c : [];
+        list.push(result);
+        byId.set(result.id, list);
+    }
+    const results = ((_d = request.docs) !== null && _d !== void 0 ? _d : []).map(item => {
+        var _a, _b;
+        const entry = stage.get(item.id);
+        if (!entry)
+            return (_b = (_a = byId.get(item.id)) === null || _a === void 0 ? void 0 : _a.shift()) !== null && _b !== void 0 ? _b : { id: item.id, docs: [{ error: notFoundError(item.id) }] };
+        if (entry.op === "delete")
+            return { id: item.id, docs: [{ error: notFoundError(item.id) }] };
+        const doc = structuredClone(entry.doc);
+        if (entry.baseRev && doc._rev === undefined)
+            doc._rev = entry.baseRev;
+        return { id: item.id, docs: [{ ok: doc }] };
+    });
+    return { results };
+};
+
+const conflictError = (id) => {
+    const error = new Error("Document update conflict");
+    error.status = 409;
+    error.name = "conflict";
+    error.error = true;
+    error.docId = id;
+    return error;
+};
+/**
+ * One transaction: a private write journal plus a read view that overlays it on
+ * committed state (ADR-0039).
+ *
+ * Writes through the handle are validated at the call site (the sweep - failing
+ * stages nothing) and stage in memory; nothing reaches the database until
+ * {@link commit}, which flushes the journal as one batch through the stack's full
+ * authoring pipeline. Reads through the handle see the journal; `stack.db`, other
+ * handles, replication and live subscriptions see only committed state.
+ *
+ * @example
+ * ```typescript
+ * const t = stack.beginTransaction();
+ * await t.createDoc(null, "Task", { title: "write-up" });
+ * await t.db.put({ ...(await t.db.get("Task-77")), done: true });
+ * const drafted = await t.findDocuments({ "~class": { $eq: "Task" } });
+ * const report = await t.commit();   // or stack.commit(t)
+ * ```
+ */
+class TransactionHandle {
+    /** @internal */
+    constructor(stack, engine, id, internal = false) {
+        /** @internal */
+        this.stage = new TransactionStage();
+        /** @internal - ids this handle minted, counted into the id counter after commit. */
+        this.mintedIds = new Set();
+        this.statusValue = "open";
+        this.stack = stack;
+        this.engine = engine;
+        this.id = id;
+        this.internal = internal;
+        this.db = new TransactionDb(stack, this);
+    }
+    get status() {
+        return this.statusValue;
+    }
+    /** @internal */
+    setStatus(status) {
+        this.statusValue = status;
+    }
+    stagedCount() {
+        return this.stage.size;
+    }
+    /** @internal */
+    assertWritable(operation) {
+        if (this.statusValue !== "open" && this.statusValue !== "partial") {
+            throw new TransactionStateError(this.id, this.statusValue, operation);
+        }
+    }
+    /**
+     * Stages a write. The sweep runs first: a document that fails validation, policy,
+     * or the locked-stack check is not staged and the journal is untouched.
+     * @internal
+     */
+    async stageWrite(doc, op = "write") {
+        this.assertWritable("accept writes");
+        const docId = doc._id;
+        if (typeof docId !== "string" || !docId) {
+            throw new Error("A staged document needs an '_id' - transactions do not mint ids implicitly; use createDoc(null, ...).");
+        }
+        const already = this.stage.get(docId);
+        let baseRev;
+        let isNew;
+        if (already) {
+            baseRev = already.baseRev;
+            isNew = already.isNew;
+        }
+        else {
+            baseRev = await this.stack.getDocRevision(docId).catch(() => undefined) || undefined;
+            isNew = baseRev === undefined;
+        }
+        // PouchDB's optimistic-concurrency contract, kept: updating requires stating
+        // the revision being replaced - here, the overlay-visible one.
+        const statedRev = doc._rev;
+        if (!isNew && statedRev !== baseRev)
+            throw conflictError(docId);
+        if (isNew && statedRev !== undefined)
+            throw conflictError(docId);
+        const entry = {
+            doc: structuredClone(Object.assign(Object.assign({}, doc), { _rev: undefined })),
+            baseRev,
+            op,
+            isNew,
+            stagedAt: Date.now(),
+        };
+        delete entry.doc._rev;
+        await sweepEntry(this.stack, this.stage, entry, { allowClassModels: this.internal, skipPolicy: this.internal });
+        this.stage.set(docId, entry);
+        return this.stage.get(docId);
+    }
+    /**
+     * Creates or updates a document in the transaction - `stack.createDoc`'s UX with
+     * a staged destination: `docId: null` mints an id, an existing id merges params
+     * over the overlay-visible document.
+     */
+    async createDoc(docId, type, params) {
+        this.assertWritable("create documents");
+        let base = null;
+        if (docId) {
+            base = await overlayGet(this.stack, this.stage, docId).catch(() => null);
+            if (base && base["~class"] !== type) {
+                throw new Error(`Existing document '${docId}' is a '${base["~class"]}', not a '${type}'.`);
+            }
+        }
+        else {
+            docId = this.stack.generateDocId(type);
+            this.mintedIds.add(docId);
+        }
+        const draft = base
+            ? Object.assign(Object.assign(Object.assign({}, base), params), { _id: docId, "~updateTimestamp": new Date().getTime() }) : Object.assign(Object.assign(Object.assign({}, this.stack.prepareDoc(docId, type, params, "~class")), params), { _id: docId });
+        const entry = await this.stageWrite(draft, "write").catch(error => {
+            // An id minted for a write that never staged is simply dropped - the
+            // counter only ever advances for committed documents.
+            if (!base && docId)
+                this.mintedIds.delete(docId);
+            throw error;
+        });
+        return structuredClone(entry.doc);
+    }
+    /** Batch counterpart of {@link createDoc}; validated sequentially, fail-fast. */
+    async createDocs(docs, type) {
+        const created = [];
+        for (const draft of docs) {
+            created.push(await this.createDoc(draft.docId, type, draft.params));
+        }
+        return created;
+    }
+    /** Soft-deletes in the transaction: the overlay stops showing the document under the default `active: true`. */
+    async deleteDocument(docId) {
+        var _a, _b;
+        this.assertWritable("delete documents");
+        const doc = await overlayGet(this.stack, this.stage, docId).catch(() => null);
+        if (!doc)
+            return false;
+        await this.stageWrite(Object.assign(Object.assign({}, doc), { active: false, _rev: (_b = (_a = this.stage.get(docId)) === null || _a === void 0 ? void 0 : _a.baseRev) !== null && _b !== void 0 ? _b : doc._rev }), "write");
+        return true;
+    }
+    /** The stack's polished read, against this transaction's view. */
+    async findDocuments(selector, fields, skip, limit, sort) {
+        this.assertWritable("read");
+        return this.stack.findDocumentsForView(this.stage, selector, fields, skip, limit, sort);
+    }
+    /**
+     * SQL against this transaction's view. The executor reaches data only through
+     * stack APIs, so a facade routes them at the overlay; LIMIT/OFFSET pushdown and
+     * sort indexes are disabled while staged - staged documents exist in no index,
+     * so windows and orderings must be computed after the merge.
+     */
+    async query(sql, ...params) {
+        this.assertWritable("query");
+        const stack = this.stack;
+        const stage = this.stage;
+        const facade = Object.create(stack);
+        facade.findDocuments = (selector, fields, skip, limit, sort) => stack.findDocumentsForView(stage, selector, fields, skip, limit, sort);
+        facade.findDocumentsIterator = function (selector_1) {
+            return __asyncGenerator(this, arguments, function* (selector, options = {}) {
+                const result = yield __await(facade.findDocuments(selector, options.fields));
+                for (const doc of result.docs)
+                    yield yield __await(doc);
+            });
+        };
+        facade.canApplyQueryLimitEarly = async () => false;
+        facade.ensureSortIndex = async () => false;
+        facade.getClass = async (name, ...rest) => {
+            const real = await stack.getClass(name, ...rest);
+            if (!real)
+                return real;
+            const wrapped = Object.create(real);
+            // `getCards` is an own arrow property bound to the real stack; shadowed so
+            // the executor's fetches route through the overlay.
+            wrapped.getCards = (selector, fields, skip, limit, sort) => facade.findDocuments(Object.assign(Object.assign({}, (selector || {})), { "~class": { $eq: real.name } }), fields, skip, limit, sort)
+                .then((result) => result.docs);
+            return wrapped;
+        };
+        return stack.runQuery(sql, params, facade);
+    }
+    /** Flushes the journal - sugar for `stack.commit(t)`. */
+    commit() {
+        return this.engine.commit(this);
+    }
+    /** Drops the journal - sugar for `stack.discardTransaction(t)`. */
+    discard() {
+        this.engine.discard(this);
+    }
+}
+/**
+ * The handle's db-like surface. Writes stage; reads overlay. Not a Proxy over the
+ * guarded db on purpose: this object *has no* adapter methods or escape hatches to
+ * forward, so staging cannot become a fourth door around the authoring path.
+ */
+class TransactionDb {
+    /** @internal */
+    constructor(stack, handle) {
+        this.stack = stack;
+        this.handle = handle;
+    }
+    async get(docId, options) {
+        this.handle.assertWritable("read");
+        return overlayGet(this.stack, this.handle.stage, docId, options);
+    }
+    async bulkGet(request) {
+        this.handle.assertWritable("read");
+        return overlayBulkGet(this.stack, this.handle.stage, request);
+    }
+    /**
+     * Raw-style Mango find over the transaction's view. Like `stack.db.find`, this
+     * skips the read pipeline (no policy filter, no decryption of committed rows);
+     * `findDocuments` on the handle is the polished read.
+     */
+    async find(query) {
+        this.handle.assertWritable("read");
+        const stage = this.handle.stage;
+        const { selector, fields, skip, limit, sort } = query;
+        const { queryFields, extras } = widenProjection(fields, sort);
+        const committed = await this.stack.db.find(Object.assign(Object.assign({ selector }, (queryFields ? { fields: queryFields } : {})), { limit: 2 ** 31 - 1 }));
+        const docs = mergeStageIntoResults(stage, selector, committed.docs, { sort, skip, limit, fields, extras });
+        return { docs };
+    }
+    async put(doc, options) {
+        if (options && (options.new_edits === false || options.force)) {
+            throw new Error("Writing with 'new_edits: false' or 'force' is reserved for DocStack's sync layer, in and out of transactions.");
+        }
+        const entry = await this.handle.stageWrite(doc, "write");
+        return { ok: true, id: doc._id, rev: entry.baseRev, staged: true };
+    }
+    async post(doc) {
+        var _a;
+        const type = (_a = doc["~class"]) !== null && _a !== void 0 ? _a : doc["~domain"];
+        if (typeof type !== "string" || !type) {
+            throw new Error("post needs '~class' (or '~domain') to mint an id for the document.");
+        }
+        const id = this.stack.generateDocId(type);
+        this.handle.mintedIds.add(id);
+        const entry = await this.handle.stageWrite(Object.assign(Object.assign({}, doc), { _id: id }), "write").catch(error => {
+            this.handle.mintedIds.delete(id);
+            throw error;
+        });
+        return { ok: true, id, rev: entry.baseRev, staged: true };
+    }
+    /** Hard removal, staged: the commit writes `_deleted: true`. Soft deletion is `handle.deleteDocument`. */
+    async remove(doc, rev) {
+        const id = typeof doc === "string" ? doc : doc._id;
+        const statedRev = typeof doc === "string" ? rev : doc._rev;
+        const current = await overlayGet(this.stack, this.handle.stage, id).catch(() => { throw notFoundError(id); });
+        await this.handle.stageWrite(Object.assign(Object.assign({}, current), { _id: id, _rev: statedRev !== null && statedRev !== void 0 ? statedRev : current._rev }), "delete");
+        return { ok: true, id, staged: true };
+    }
+    /**
+     * Stages a batch. Validated sequentially - the first refusal unwinds every entry
+     * this call staged, so a failing batch stages nothing. Documents stage before
+     * relations, mirroring the commit batch, so a relation and its endpoint can
+     * arrive in one array in any order.
+     */
+    async bulkDocs(docs, options) {
+        const list = Array.isArray(docs) ? docs : docs === null || docs === void 0 ? void 0 : docs.docs;
+        if (!Array.isArray(list))
+            throw new Error("bulkDocs expects an array of documents or { docs: [...] }.");
+        if (readNewEdits(docs, options !== null && options !== void 0 ? options : null) === false || (options === null || options === void 0 ? void 0 : options.force)) {
+            throw new Error("Writing with 'new_edits: false' or 'force' is reserved for DocStack's sync layer, in and out of transactions.");
+        }
+        this.handle.assertWritable("accept writes");
+        const stage = this.handle.stage;
+        const before = new Map();
+        const ordered = [
+            ...list.filter(doc => typeof doc["~domain"] !== "string"),
+            ...list.filter(doc => typeof doc["~domain"] === "string"),
+        ];
+        try {
+            const results = [];
+            for (const doc of ordered) {
+                const id = doc._id;
+                if (typeof id === "string" && !before.has(id))
+                    before.set(id, stage.get(id));
+                await this.handle.stageWrite(doc, "write");
+                results.push({ ok: true, id, staged: true });
+            }
+            return results;
+        }
+        catch (error) {
+            // Unwind this call's staging so a failed batch has no consequences at all.
+            for (const [id, previous] of before) {
+                if (previous)
+                    stage.set(id, previous);
+                else
+                    stage.remove(id);
+            }
+            throw error;
+        }
+    }
+}
+
+const logger$1 = createLogger().child({ module: "TransactionEngine" });
+/**
+ * Which adapters commit one `bulkDocs` batch as a single storage transaction.
+ * tauri-sqlite composes the whole batch into one `BEGIN IMMEDIATE … COMMIT`;
+ * IndexedDB and the bridge/channel adapters report per document. Reported to
+ * consumers on every commit rather than silently assumed (ADR-0039).
+ */
+const ADAPTER_ATOMICITY = {
+    "tauri-sqlite": true,
+};
+const now = () => { var _a, _b; return ((_b = (_a = globalThis.performance) === null || _a === void 0 ? void 0 : _a.now()) !== null && _b !== void 0 ? _b : Date.now()); };
+/**
+ * Named write transactions for one stack (ADR-0039).
+ *
+ * Enabled per stack by `transactions: true` in its configuration - the flag only
+ * unlocks {@link begin}; direct writes stay immediate, and the framework's own
+ * writers (scheduler, jobs, sync) always write directly. The stage lives above the
+ * plugin: nothing a transaction does touches the database until commit, and commit
+ * is exactly one `stack.db.bulkDocs` through the full authoring pipeline.
+ */
+class TransactionEngine {
+    constructor(stack, enabled) {
+        this.handles = new Map();
+        /** Commits serialize here so one commit's rev pre-flight cannot be invalidated by another's write. */
+        this.commitChain = Promise.resolve();
+        this.stack = stack;
+        this.enabled = enabled;
+    }
+    isEnabled() {
+        return this.enabled;
+    }
+    /** How many transactions are currently open (or partial). */
+    openCount() {
+        return this.handles.size;
+    }
+    begin() {
+        var _a;
+        if (!this.enabled)
+            throw new TransactionsDisabledError((_a = this.stack.name) !== null && _a !== void 0 ? _a : "");
+        const id = `tx-${this.stack.cryptoEngine.generateRandomString(8)}`;
+        const handle = new TransactionHandle(this.stack, this, id);
+        this.handles.set(id, handle);
+        return handle;
+    }
+    /**
+     * Opens a transaction for DocStack's own machinery - patch application
+     * (ADR-0042). Independent of the `transactions: true` config gate (the flag
+     * governs the consumer feature, not the framework's internals) and permitted to
+     * stage class models: an internal handle claims staged validation and a single
+     * class-write batch, never propagation atomicity.
+     * @internal
+     */
+    beginInternal() {
+        const id = `tx-internal-${this.stack.cryptoEngine.generateRandomString(8)}`;
+        const handle = new TransactionHandle(this.stack, this, id, true);
+        this.handles.set(id, handle);
+        return handle;
+    }
+    resolve(t, operation) {
+        const handle = typeof t === "string" ? this.handles.get(t) : t;
+        if (!handle)
+            throw new TransactionStateError(typeof t === "string" ? t : "(unknown)", "unknown", operation);
+        return handle;
+    }
+    /**
+     * Drops a transaction's journal. Idempotent, and a no-op on a handle already in
+     * a terminal state - discarding what is already gone is not an error.
+     */
+    discard(t) {
+        const handle = this.resolve(t, "be discarded");
+        if (handle.status === "discarded" || handle.status === "committed")
+            return;
+        handle.stage.clear();
+        handle.setStatus("discarded");
+        this.handles.delete(handle.id);
+        this.stack.dispatchEvent(new CustomEvent("transactionDiscard", { detail: { transactionId: handle.id } }));
+    }
+    /** Discards every open transaction - what `close()` and `reset()` do. */
+    discardAll() {
+        for (const handle of [...this.handles.values()])
+            this.discard(handle);
+    }
+    /**
+     * Flushes a transaction's journal as one batch through the stack's authoring
+     * pipeline. Refusals - validation, or a staged document whose base revision
+     * moved - throw with nothing persisted and the transaction still open.
+     */
+    commit(t) {
+        const handle = this.resolve(t, "commit");
+        const run = () => this.commitNow(handle);
+        const chained = this.commitChain.then(run, run);
+        // The chain must survive a refused commit; the caller still sees the rejection.
+        this.commitChain = chained.catch(() => undefined);
+        return chained;
+    }
+    async commitNow(handle) {
+        var _a, _b, _c, _d, _e, _f;
+        const started = now();
+        if (handle.status !== "open" && handle.status !== "partial") {
+            throw new TransactionStateError(handle.id, handle.status, "commit");
+        }
+        const stage = handle.stage;
+        const entries = stage.values();
+        const stagedCount = entries.length;
+        const report = {
+            transactionId: handle.id,
+            written: [],
+            failed: [],
+            stagedCount,
+            durationMs: 0,
+            adapter: this.adapterInfo(),
+        };
+        if (!stagedCount) {
+            handle.setStatus("committed");
+            this.handles.delete(handle.id);
+            report.durationMs = now() - started;
+            return report;
+        }
+        // 1. The sweep again, against the world as it stands now - stage-time answers
+        //    can be stale (a policy changed, a class tightened). Zero consequences on
+        //    refusal.
+        for (const entry of entries) {
+            await sweepEntry(this.stack, stage, entry, { allowClassModels: handle.internal, skipPolicy: handle.internal });
+        }
+        // 2. Rev pre-flight: every staged id's stored winner must still be the
+        //    revision it was staged against. `allDocs` is below the plugin - revs
+        //    only, no decrypt cost.
+        const ids = stage.ids();
+        const stored = await this.stack.db.allDocs({ keys: ids });
+        const currentRevs = new Map();
+        for (const row of (_a = stored.rows) !== null && _a !== void 0 ? _a : []) {
+            const id = (_b = row.key) !== null && _b !== void 0 ? _b : row.id;
+            currentRevs.set(id, row.value && !row.value.deleted ? row.value.rev : undefined);
+        }
+        const conflicts = [];
+        for (const id of ids) {
+            const entry = stage.get(id);
+            const current = currentRevs.get(id);
+            const expected = entry.isNew ? undefined : entry.baseRev;
+            if (current !== expected)
+                conflicts.push({ id, baseRev: entry.baseRev, currentRev: current });
+        }
+        if (conflicts.length)
+            throw new TransactionConflictError(conflicts);
+        // 3. One batch: stage order, documents before relations so endpoint checks
+        //    can resolve batch-mates.
+        const toBatchDoc = (id) => {
+            const entry = stage.get(id);
+            const doc = structuredClone(entry.doc);
+            if (entry.baseRev)
+                doc._rev = entry.baseRev;
+            else
+                delete doc._rev;
+            if (entry.op === "delete")
+                doc._deleted = true;
+            return doc;
+        };
+        const batchIds = [
+            ...ids.filter(id => typeof stage.get(id).doc["~domain"] !== "string"),
+            ...ids.filter(id => typeof stage.get(id).doc["~domain"] === "string"),
+        ];
+        const batch = batchIds.map(toBatchDoc);
+        // 4. The full authoring pipeline, unchanged: triggers, relation checks,
+        //    encryption, and the single adapter write. A pipeline refusal rejects the
+        //    whole call before anything is written.
+        const response = await this.stack.db.bulkDocs(batch);
+        const failedIds = new Set();
+        for (let index = 0; index < response.length; index++) {
+            const result = response[index];
+            const id = (_c = result === null || result === void 0 ? void 0 : result.id) !== null && _c !== void 0 ? _c : batchIds[index];
+            if (result && result.ok) {
+                report.written.push({ id, rev: result.rev });
+            }
+            else {
+                failedIds.add(id);
+                report.failed.push({
+                    id,
+                    error: (_e = (_d = result === null || result === void 0 ? void 0 : result.message) !== null && _d !== void 0 ? _d : result === null || result === void 0 ? void 0 : result.reason) !== null && _e !== void 0 ? _e : String((_f = result === null || result === void 0 ? void 0 : result.name) !== null && _f !== void 0 ? _f : "write failed"),
+                    name: result === null || result === void 0 ? void 0 : result.name,
+                });
+            }
+        }
+        // 5. The id counter advances only for minted ids that actually landed -
+        //    uniqueness is the promise, not density (as in createDocs).
+        const mintedWritten = report.written.filter(entry => handle.mintedIds.has(entry.id)).length;
+        if (mintedWritten > 0) {
+            await this.stack.advanceLastDocId(mintedWritten);
+        }
+        if (failedIds.size === 0) {
+            stage.clear();
+            handle.setStatus("committed");
+            this.handles.delete(handle.id);
+        }
+        else {
+            // Possible only on adapters without an atomic batch (or a write racing
+            // the pre-flight window). Failed entries keep their base revisions: a
+            // straggler that simply didn't land retries cleanly, and one that was
+            // raced surfaces as a conflict on the next commit instead of being
+            // silently overwritten.
+            stage.retain(failedIds);
+            handle.setStatus("partial");
+            logger$1.warn("Transaction committed partially", { transactionId: handle.id, failed: report.failed });
+        }
+        report.durationMs = now() - started;
+        this.stack.dispatchEvent(new CustomEvent("transactionCommit", { detail: report }));
+        return report;
+    }
+    adapterInfo() {
+        var _a, _b;
+        const name = String((_b = (_a = this.stack.rawDb) === null || _a === void 0 ? void 0 : _a.adapter) !== null && _b !== void 0 ? _b : "unknown");
+        const atomicBatch = ADAPTER_ATOMICITY[name] === true;
+        if (!(name in ADAPTER_ATOMICITY) && name !== "idb" && name !== "indexeddb") {
+            logger$1.warn("Unknown adapter for transaction atomicity - reporting atomicBatch: false", { adapter: name });
+        }
+        return { name, atomicBatch };
+    }
+}
+
+/**
+ * Moving a stack's *content* between databases, without its datamodel.
+ *
+ * `stack.dump()` is the other kind of export: every document exactly as stored, which
+ * means class models, patches, users, sessions, policies, design documents - and
+ * encrypted attributes as unreadable {@link EncryptedPayload} blobs. That is a debugging
+ * tool and a backup of one database.
+ *
+ * This is the portable one. It carries the documents an application put in, in the clear,
+ * so that {@link ClientStack.importContent} can place them into a *different* stack -
+ * different device, different key, schema built by that stack's own patches.
+ *
+ * @module
+ */
+/** The envelope format identifier, so an importer can refuse what it does not understand. */
+const CONTENT_EXPORT_FORMAT = "docstack/content-export@1";
+/**
+ * `~class` values that describe the stack rather than hold its content.
+ *
+ * `~self` is the bootstrap class-of-classes; `class` and `superclass` are class models;
+ * `domain` is a relation definition; `patch` is the local ledger of applied patches.
+ */
+const META_CLASSES = ["~self", "class", "superclass", "domain", "patch"];
+/**
+ * Reports whether a class name belongs to application content.
+ *
+ * DocStack names everything it owns with a leading `~` - `~User`, `~Group`, `~Policy`,
+ * `~Job`, `~JobRun`, `~UserSession`, `~AuthModule`, `~lock` - and reserves the handful of
+ * unprefixed names in {@link META_CLASSES} for the datamodel itself. Everything else was
+ * created by an application.
+ *
+ * @param className - A `~class` value or class-model id.
+ *
+ * @example
+ * ```typescript
+ * isContentClassName("Task");   // true
+ * isContentClassName("~User");  // false - DocStack's own
+ * isContentClassName("class");  // false - a class model
+ * ```
+ */
+const isContentClassName = (className) => {
+    if (typeof className !== "string" || !className.length)
+        return false;
+    if (className.startsWith("~"))
+        return false;
+    return !META_CLASSES.includes(className);
+};
+/**
+ * Reports whether a document is application content rather than part of the stack.
+ *
+ * @param doc - Any stored document.
+ */
+const isContentDocument = (doc) => {
+    if (!doc || typeof doc._id !== "string")
+        return false;
+    // A design document has no `~class` and would fall through the class test.
+    if (doc._id.startsWith("_"))
+        return false;
+    return isContentClassName(doc["~class"]);
+};
+/**
+ * Reports whether a document is an application relation.
+ *
+ * Relations carry `~domain` and no `~class` (see `isRelation` in `@docstack/shared`), so
+ * they need their own test rather than falling out of {@link isContentDocument}.
+ *
+ * @param doc - Any stored document.
+ */
+const isContentRelation = (doc) => {
+    if (!doc || typeof doc._id !== "string")
+        return false;
+    if (doc["~class"] !== undefined)
+        return false;
+    return isContentClassName(doc["~domain"]);
+};
+/** Fields PouchDB owns, or that describe one database's copy of a document. */
+const TRANSIENT_FIELDS = ["_rev", "_revisions", "_revs_info", "_conflicts", "_deleted"];
+/**
+ * Strips the fields that belong to the source database rather than to the document.
+ *
+ * `_rev` above all: a revision from one database means nothing in another, and carrying
+ * it into an import turns every write into a conflict.
+ *
+ * @param doc - The document to clean.
+ * @returns A copy without the transient fields.
+ */
+const stripTransientFields = (doc) => {
+    const clone = Object.assign({}, doc);
+    for (const field of TRANSIENT_FIELDS)
+        delete clone[field];
+    return clone;
+};
+/**
+ * Validates an import payload's envelope before anything is written.
+ *
+ * A plain validator rather than an `asserts` signature: the caller already types its
+ * parameter, so there is nothing to narrow, and an assertion function reached through an
+ * import needs a declaration TypeScript can see (TS2775).
+ *
+ * @param payload - The value handed to {@link ClientStack.importContent}.
+ * @throws Error when it is not a content export this version understands.
+ */
+const assertContentExport = (payload) => {
+    const value = payload;
+    if (!value || typeof value !== "object") {
+        throw new Error("importContent - payload is not a content export.");
+    }
+    if (value.format !== CONTENT_EXPORT_FORMAT) {
         throw new Error(`importContent - unsupported format '${String(value.format)}'. ` +
             `This build reads '${CONTENT_EXPORT_FORMAT}'.`);
     }
@@ -9397,6 +12642,8 @@ const DOCSTACK_OPTION_KEYS = [
     "credentials",
     "disableCryptoEngine",
     "documentKey",
+    "transactions",
+    "logLevel",
 ];
 /**
  * Extracts the PouchDB half of a {@link StackOptions} object.
@@ -9947,45 +13194,52 @@ class ClientStack extends Stack {
         };
         this.applyPatch = async (patch) => {
             const fnLogger = logger.child({ method: "applyPatch", args: { patch } });
-            return new Promise(async (resolve, reject) => {
-                try {
-                    fnLogger.info("Attempting to apply patch", { patch });
-                    fnLogger.info("applyPatch - starting to hydrate patch docs", { docCount: patch.docs.length });
-                    const hydratedDocs = await Promise.all(patch.docs.map(async (sourceDoc) => {
-                        // Work on a copy: the patch definition must survive intact. System
-                        // patches are module-level objects shared by every stack in the
-                        // process, so deleting `_rev` from one would strip the "auto" marker
-                        // permanently — the next ClientStack created in the same context
-                        // would then rewrite those documents as fresh inserts, hit a 409,
-                        // and end up without its `class` class model.
-                        let doc = Object.assign({}, sourceDoc);
-                        if (doc._rev === "auto") {
-                            delete doc._rev;
-                            const existingDoc = await this.db.get(doc._id);
-                            if (existingDoc) {
-                                doc = Object.assign(Object.assign({}, existingDoc), doc);
-                            }
-                        }
-                        return doc;
-                    }));
-                    fnLogger.info("applyPatch - hydration complete, calling bulkDocs", { docCount: hydratedDocs.length });
-                    await this.db.bulkDocs(hydratedDocs, { isPatch: true }).then((result) => {
-                        fnLogger.warn("applyPatch - bulkDocs completed with result", { result });
-                        fnLogger.warn("Successfully processed patch", { version: patch.version });
-                    }).catch((error) => {
-                        fnLogger.error("applyPatch - bulkDocs error", { error });
-                        reject(error);
-                    });
-                    // Store patch itself
-                    await this.db.post(Object.assign({ createTimestamp: (new Date()).valueOf() }, patch));
-                    fnLogger.info("Successfully stored patch", { version: patch.version, target: patch.target });
-                    resolve(patch.version);
-                }
-                catch (e) {
-                    fnLogger.error("Failed to apply patch", e);
-                    reject(new Error(e));
+            if (patch.preApply || patch.postApply) {
+                // Jobs stage through the chain transaction; this path has none, and
+                // silently ignoring them would apply the model without its migration.
+                throw new Error(`applyPatch - patch '${patch.version}' carries one-shot jobs; ` +
+                    `job-carrying patches apply through the configured patch chain (ADR-0044).`);
+            }
+            fnLogger.info("Attempting to apply patch", { patch });
+            fnLogger.info("applyPatch - starting to hydrate patch docs", { docCount: patch.docs.length });
+            const hydratedDocs = await Promise.all(patch.docs.map(async (sourceDoc) => {
+                // Work on a copy: the patch definition must survive intact. System
+                // patches are module-level objects shared by every stack in the
+                // process, so deleting `_rev` from one would strip the "auto" marker
+                // permanently — the next ClientStack created in the same context
+                // would then rewrite those documents as fresh inserts, hit a 409,
+                // and end up without its `class` class model.
+                let doc = Object.assign({}, sourceDoc);
+                if (doc._rev === "auto") {
+                    delete doc._rev;
+                    const existingDoc = await this.db.get(doc._id);
+                    if (existingDoc) {
+                        doc = Object.assign(Object.assign({}, existingDoc), doc);
+                        ClientStack.mergePatchSchema(sourceDoc, existingDoc, doc);
+                    }
                 }
-            });
+                return doc;
+            }));
+            fnLogger.info("applyPatch - hydration complete, calling bulkDocs", { docCount: hydratedDocs.length });
+            // A failing batch throws here and nothing below runs: the ledger records the
+            // moment of SUCCESSFUL application, never the attempt. The old flow rejected
+            // on failure but kept executing, so a failed patch was recorded as applied
+            // and never retried - a device whose schema trailed forever (ADR-0041).
+            const result = await this.db.bulkDocs(hydratedDocs, { isPatch: true });
+            // Per-document failures arrive in the RESOLVED array (the ADR-0038 discipline):
+            // a patch whose batch half-landed must not arm its ledger entry, or the next
+            // open would skip it and apply its dependents against a schema it never
+            // finished installing. The retry converges - hydration re-merges over whatever
+            // did land.
+            const failures = result.filter(entry => entry && entry.error);
+            if (failures.length) {
+                throw new Error(`applyPatch - patch '${patch.version}' failed for ${failures.length} document(s): ` +
+                    failures.map((f) => { var _a; return `${f.id}: ${(_a = f.message) !== null && _a !== void 0 ? _a : f.name}`; }).join("; "));
+            }
+            fnLogger.info("applyPatch - bulkDocs completed", { result });
+            await this.recordPatchApplication(patch);
+            fnLogger.info("Successfully applied and recorded patch", { version: patch.version, target: patch.target });
+            return patch.version;
         };
         this.setListeners = () => {
             const fnLogger = logger.child({ method: "setListeners" });
@@ -10469,15 +13723,46 @@ class ClientStack extends Stack {
          * Removes event listeners and terminates background workers.
          */
         this.close = () => {
-            var _a;
+            var _a, _b;
+            // First, and before the listeners go, so the discard events can still be
+            // observed: an uncommitted transaction is not real, and close drops it -
+            // database-transaction semantics, by decision (ADR-0039).
+            (_a = this.transactionEngine) === null || _a === void 0 ? void 0 : _a.discardAll();
             this.cancelSync();
             // Before the listeners go: a surviving interval would tick against a database
             // this stack no longer serves.
-            (_a = this.jobScheduler) === null || _a === void 0 ? void 0 : _a.stop();
+            (_b = this.jobScheduler) === null || _b === void 0 ? void 0 : _b.stop();
             this.removeAllListeners();
             if (this.modelWorker)
                 this.modelWorker.terminate();
         };
+        /**
+         * Opens a named write transaction (ADR-0039). Requires the stack to have been
+         * opened with `transactions: true`.
+         *
+         * Writes through the handle validate at the call site and stage in memory;
+         * reads through it see the staged state overlaid on committed state. Nothing
+         * reaches the database - or replication, or any other reader - until
+         * {@link commit}. `stack.db` stays live and unchanged next to open transactions:
+         * direct writes land immediately, and only touch a transaction by making its
+         * commit refuse when they advance a staged document's revision.
+         */
+        this.beginTransaction = () => {
+            return this.transactionEngine.begin();
+        };
+        /**
+         * Flushes a transaction's staged writes as one batch through the authoring
+         * pipeline. On refusal - validation, or a document changed underneath - nothing
+         * is persisted and the transaction stays open. The report says what landed and
+         * on what storage guarantee (`adapter.atomicBatch`).
+         */
+        this.commit = (t) => {
+            return this.transactionEngine.commit(t);
+        };
+        /** Drops a transaction's staged writes. Idempotent. */
+        this.discardTransaction = (t) => {
+            this.transactionEngine.discard(t);
+        };
         /**
          * Retrieves a Class instance by name.
          * Results are cached for 15 minutes to improve performance.
@@ -10598,11 +13883,33 @@ class ClientStack extends Stack {
          * ```
          */
         this.findDocuments = async (selector, fields, skip, limit, sort) => {
+            return this.findDocumentsForView(undefined, selector, fields, skip, limit, sort);
+        };
+        /**
+         * {@link findDocuments} with an optional transaction stage overlaid - the shared
+         * implementation, so a transaction's reads and ordinary reads run the identical
+         * pipeline (policy, decryption, field visibility) and cannot drift (ADR-0039).
+         *
+         * With a stage: the database's index cannot see staged documents, so the
+         * committed query runs unwindowed, staged ids mask their committed rows, staged
+         * matches join the set, and sort/skip/limit apply after the merge. A selector
+         * over a class the stage never touched skips all of that.
+         *
+         * @internal
+         */
+        this.findDocumentsForView = async (stage, selector, fields, skip, limit, sort) => {
             const fnLogger = logger.child({ method: "findDocuments", args: { selector, fields, skip, limit, sort } });
             // By default request for only active documents
             if (!selector.hasOwnProperty("active")) {
                 selector["active"] = true;
             }
+            if (stage && stageCoversSelector(stage, selector)) {
+                const { queryFields, extras } = widenProjection(fields, sort);
+                const found = await this.db.find(Object.assign(Object.assign({ selector }, (queryFields ? { fields: queryFields } : {})), { limit: 2 ** 31 - 1 }));
+                const merged = mergeStageIntoResults(stage, selector, found.docs, { sort, skip, limit, fields, extras });
+                const readableDocs = await this.processFoundDocuments(merged, fields);
+                return { docs: readableDocs, selector, skip, limit };
+            }
             let indexFields = Object.keys(selector);
             fnLogger.info("Produced index fields from selector", { indexFields });
             let result = {
@@ -11486,6 +14793,17 @@ class ClientStack extends Stack {
             }
         };
         this.query = async (sql, ...params) => {
+            return this.runQuery(sql, params, this);
+        };
+        /**
+         * {@link query}'s implementation, with the executor's data source as a
+         * parameter: the executor reaches documents only through stack APIs, so a
+         * transaction hands in a facade that routes them at its overlay while everything
+         * else - parsing, binding, planning - stays exactly this code (ADR-0039).
+         *
+         * @internal
+         */
+        this.runQuery = async (sql, params, execStack) => {
             const fnLogger = logger.child({ method: "query", args: { sql, params } });
             fnLogger.info("Executing query");
             let astList = [];
@@ -11502,7 +14820,7 @@ class ClientStack extends Stack {
             if (astList.length > 0) {
                 try {
                     const plan = createPlan(astList);
-                    const rows = await executePlan(this, plan, params);
+                    const rows = await executePlan(execStack, plan, params);
                     // The AST for the whole query (including unions) is the list
                     fnLogger.info("Query executed successfully", { rows, astList });
                     return { rows, ast: astList };
@@ -11605,6 +14923,9 @@ class ClientStack extends Stack {
         this.jobScheduler = new JobScheduler(this);
         this.policyEngine = new PolicyEngine(this);
         this.cryptoEngine = new CryptoEngine(this);
+        // Re-created, never carried over: `reset()` re-runs initialize, and a stage
+        // surviving a reset would resurrect uncommitted writes (ADR-0039).
+        this.transactionEngine = new TransactionEngine(this, Boolean(options === null || options === void 0 ? void 0 : options.transactions));
         if (options === null || options === void 0 ? void 0 : options.documentKey) {
             await this.cryptoEngine.setDocumentKey(options.documentKey);
         }
@@ -11942,11 +15263,18 @@ class ClientStack extends Stack {
         await stack.initialize(conn, options);
         await stack.initdb();
         if ((options === null || options === void 0 ? void 0 : options.patches) && options.patches.length) {
-            const patches = await stack.findDocuments({
-                "~class": { $eq: "patch" }
+            // Raw find, not findDocuments: `active` carries the ledger's own meaning
+            // (ADR-0041) - `true` is applied, `false` is deferred and must be
+            // re-attempted, absent is a legacy entry from before the flag, treated as
+            // applied. Read through the visibility filter, the dedupe saw nothing at
+            // all and every open re-applied every consumer patch (ADR-0040).
+            const ledger = await stack.db.find({
+                selector: { "~class": "patch" },
+                limit: 2 ** 31 - 1,
             });
-            await stack.applyConsumerPatches(options.patches.filter(p => !patches.docs.find(existing => existing.version === p.version
-                && existing.target === p.target)));
+            await stack.applyConsumerPatches(options.patches.filter(p => !ledger.docs.find(existing => existing.version === p.version
+                && existing.target === p.target
+                && existing.active !== false)));
         }
         if (options === null || options === void 0 ? void 0 : options.credentials) {
             await stack.authenticate(options.credentials);
@@ -11967,21 +15295,419 @@ class ClientStack extends Stack {
      *
      * @param patches - Patches not yet present in this stack.
      */
+    /**
+     * The highest consumer patch version this device has applied, from the patch
+     * ledger - `null` when no consumer patch has ever applied (or they are all
+     * deferred, which for the schema gate is the same thing: the schema those
+     * patches install is not here yet). The sync layer folds this into what it
+     * publishes and compares, so consumer-schema skew between devices refuses at
+     * the gate instead of pulling documents this device's schema cannot describe
+     * (ADR-0040).
+     */
+    async getConsumerSchemaVersion() {
+        // Raw find: ledger documents carry no `active` flag (see the dedupe in
+        // {@link create}).
+        const ledger = await this.db.find({
+            selector: { "~class": "patch" },
+            limit: 2 ** 31 - 1,
+        }).catch(() => ({ docs: [] }));
+        let highest = null;
+        for (const doc of ledger.docs) {
+            if (doc.target === "system")
+                continue;
+            // A dormant entry is a deferral (ADR-0041): the patch is known, its
+            // schema is not here - counting it would tell the sync gate this device
+            // is current and let it pull documents it cannot describe.
+            if (doc.active === false)
+                continue;
+            const version = doc.version;
+            if (typeof version !== "string" || !semver.valid(version))
+                continue;
+            if (!highest || semver.gt(version, highest))
+                highest = version;
+        }
+        return highest;
+    }
     async applyConsumerPatches(patches) {
-        const fnLogger = logger.child({ method: "applyConsumerPatches" });
-        for (let index = 0; index < patches.length; index++) {
-            const patch = patches[index];
-            if (this.isLocked() && await this.patchNeedsDocumentKey(patch)) {
-                this.deferredPatches = patches.slice(index);
-                fnLogger.warn("Deferred patches that write encrypted attributes until the stack is unlocked", {
-                    from: patch.version,
-                    count: this.deferredPatches.length,
-                });
+        if (!patches.length) {
+            this.deferredPatches = [];
+            return;
+        }
+        // EVERY consumer chain - class models, data documents, jobs, mixed - stages
+        // through the one internal transaction (ADR-0042). The original protocol
+        // scoped itself to class-only chains and kept a sequential fallback for the
+        // rest; the mixed extension it recorded turned out to be already built (the
+        // sweep judges data docs by staged models since ADR-0044, and the pipeline
+        // resolves batch-mates regardless of order since ADR-0043), so the fork was
+        // deleted rather than extended. A data-only chain gains the same contract:
+        // all-or-nothing, nothing armed unless the whole chain lands.
+        return this.applyConsumerPatchChain(patches);
+    }
+    /**
+     * The stack a patch job executes against (ADR-0044): reads see the chain
+     * transaction's overlay, writes stage into it - so a migration's data
+     * transformation lands in the same commit as the model it prepares, or not at
+     * all. While the stack is locked, class-aware reads of an encrypting class
+     * THROW instead of serving the null convention: a migration wants the refusal
+     * (a `requiresKey: false` job that was declared wrongly must fail loudly, and
+     * the chain converts that failure to a deferral). Raw reads (`db.find`) bypass
+     * the class-aware path by design and stay the author's responsibility.
+     */
+    createPatchJobStack(t) {
+        const stack = this;
+        const resolveClass = async (className) => {
+            var _a;
+            return (_a = classFromStage(stack, t.stage, className)) !== null && _a !== void 0 ? _a : await stack.getClassSnapshot(className).catch(() => null);
+        };
+        const assertReadableWhileLocked = async (className) => {
+            if (!stack.isLocked() || typeof className !== "string" || !className)
                 return;
+            const classObj = await resolveClass(className);
+            if (classObj && classObj.getEncryptedAttributes().length) {
+                throw new StackLockedError(className);
+            }
+        };
+        const selectorClassNames = (selector) => {
+            const constraint = selector === null || selector === void 0 ? void 0 : selector["~class"];
+            if (typeof constraint === "string")
+                return [constraint];
+            if (constraint && typeof constraint === "object") {
+                if (typeof constraint.$eq === "string")
+                    return [constraint.$eq];
+                if (Array.isArray(constraint.$in))
+                    return constraint.$in.filter((name) => typeof name === "string");
             }
-            await this.applyPatch(patch);
+            return [];
+        };
+        // Reads are SYSTEM-LEVEL: raw overlay plus decrypt-when-keyed, never the
+        // policy-filtered pipeline. A migration runs before any session exists,
+        // and a policy-filtered massage would silently transform only the subset
+        // an absent session could see - the patch path's own direct writes never
+        // pass through policy either.
+        const openWhenKeyed = async (doc) => {
+            var _a;
+            if (!doc || !((_a = stack.cryptoEngine) === null || _a === void 0 ? void 0 : _a.isEnabled()) || !stack.cryptoEngine.getDocumentKey())
+                return doc;
+            if (!stack.cryptoEngine.identifyEncryptedKeys(doc).length)
+                return doc;
+            const classObj = await stack.getClassSnapshot(doc["~class"]).catch(() => null);
+            if (classObj)
+                await stack.cryptoEngine.decryptDocument(doc, classObj);
+            return doc;
+        };
+        const facade = Object.create(stack);
+        facade.findDocuments = async (selector, fields, skip, limit, sort) => {
+            for (const name of selectorClassNames(selector))
+                await assertReadableWhileLocked(name);
+            const withDefault = (selector === null || selector === void 0 ? void 0 : selector.hasOwnProperty("active")) ? selector : Object.assign(Object.assign({}, selector), { active: true });
+            const { docs } = await t.db.find({ selector: withDefault, fields, skip, limit, sort });
+            for (const doc of docs)
+                await openWhenKeyed(doc);
+            return { docs, selector: withDefault, skip, limit };
+        };
+        facade.findDocumentsIterator = function (selector_1) {
+            return __asyncGenerator(this, arguments, function* (selector, options = {}) {
+                const result = yield __await(facade.findDocuments(selector, options.fields));
+                for (const doc of result.docs)
+                    yield yield __await(doc);
+            });
+        };
+        facade.canApplyQueryLimitEarly = async () => false;
+        facade.ensureSortIndex = async () => false;
+        facade.query = (sql, ...params) => stack.runQuery(sql, params, facade);
+        facade.getDocument = async (docId) => {
+            const doc = await t.db.get(docId);
+            await assertReadableWhileLocked(doc === null || doc === void 0 ? void 0 : doc["~class"]);
+            return openWhenKeyed(doc);
+        };
+        facade.createDoc = (docId, type, _classObj, params) => t.createDoc(docId, type, params);
+        facade.createDocs = (docs, type) => t.createDocs(docs, type);
+        facade.deleteDocument = (docId) => t.deleteDocument(docId);
+        facade.getClass = async (name, ...rest) => {
+            var _a;
+            // A class an earlier patch staged exists for this job even though it is
+            // not committed yet - the ADR-0043 rule, applied to the chain.
+            const real = (_a = classFromStage(stack, t.stage, name)) !== null && _a !== void 0 ? _a : await stack.getClass(name, ...rest);
+            if (!real)
+                return real;
+            const wrapped = Object.create(real);
+            wrapped.getCards = (selector, fields, skip, limit, sort) => facade.findDocuments(Object.assign(Object.assign({}, (selector || {})), { "~class": { $eq: real.name } }), fields, skip, limit, sort)
+                .then((result) => result.docs);
+            wrapped.addCard = (params) => t.createDoc(null, real.name, params);
+            wrapped.addCards = (cards) => t.createDocs(cards.map((params) => ({ docId: null, params })), real.name);
+            wrapped.deleteCard = (cardId) => t.deleteDocument(cardId);
+            return wrapped;
+        };
+        facade.db = {
+            get: async (docId, options) => {
+                const doc = await t.db.get(docId, options);
+                await assertReadableWhileLocked(doc === null || doc === void 0 ? void 0 : doc["~class"]);
+                return openWhenKeyed(doc);
+            },
+            bulkGet: (request) => t.db.bulkGet(request),
+            find: (query) => t.db.find(query),
+            put: (doc, options) => t.db.put(doc, options),
+            post: (doc) => t.db.post(doc),
+            remove: (doc, rev) => t.db.remove(doc, rev),
+            bulkDocs: (docs, options) => t.db.bulkDocs(docs, options),
+        };
+        return facade;
+    }
+    /**
+     * Runs one of a patch's one-shot jobs against the transaction facade. The run
+     * receipt is a `~JobRun` with NO `jobId` - patch jobs are deliberately never
+     * persisted as `~Job` documents, so there is no row to point at (`~sys-0.0.17`
+     * made the foreign key optional for exactly this) - carrying the patch
+     * identity in `runtimeArgs`. It writes DIRECTLY, win or lose: a failed
+     * migration's receipt is the troubleshooting trail and must survive the
+     * discard that protects everything else (ADR-0044).
+     */
+    async runPatchJob(t, patch, phase) {
+        var _a, _b, _c;
+        const job = patch[phase];
+        const shortPhase = phase === "preApply" ? "pre" : "post";
+        const startTime = Date.now();
+        const receipt = {
+            _id: `JobRun-${this.cryptoEngine.generateRandomString(12)}`,
+            "~class": "~JobRun",
+            status: "FAILURE",
+            triggerType: "event",
+            startTime,
+            runtimeArgs: {
+                patchVersion: patch.version,
+                patchTarget: (_a = patch.target) !== null && _a !== void 0 ? _a : "app",
+                phase: shortPhase,
+                jobName: job.name,
+            },
+        };
+        try {
+            const facade = this.createPatchJobStack(t);
+            // The ~Job convention, verbatim: content defines execute(stack, params, job).
+            const fn = new Function("stack", "params", "job", `"use strict"; ${job.content}; return execute(stack, params, job);`);
+            await fn(facade, (_b = job.params) !== null && _b !== void 0 ? _b : {}, { name: job.name, phase: shortPhase, version: patch.version });
+            receipt.status = "SUCCESS";
+        }
+        catch (error) {
+            receipt.errorMessage = String((_c = error === null || error === void 0 ? void 0 : error.message) !== null && _c !== void 0 ? _c : error);
+            throw error;
+        }
+        finally {
+            receipt.endTime = Date.now();
+            receipt.durationMs = receipt.endTime - startTime;
+            await this.db.bulkDocs([receipt]).catch(() => undefined);
         }
+    }
+    /**
+     * The ADR-0042 protocol: the whole pending chain stages through one internal
+     * transaction - patch N+1 hydrates against the classes patch N staged, so the
+     * ADR-0038 merge composes in memory before anything is real - propagation is
+     * validated dry with nothing kept, and one commit lands every staged doc (class
+     * models and data documents alike, since the mixed extension) as one batch
+     * through the unchanged pipeline, where real propagation runs. The ledger
+     * (ADR-0041) arms only after that commit; any refusal beforehand persists
+     * nothing and names the patch at fault.
+     */
+    async applyConsumerPatchChain(patches) {
+        var _a, _b, _c;
+        const fnLogger = logger.child({ method: "applyConsumerPatchChain" });
         this.deferredPatches = [];
+        const t = this.transactionEngine.beginInternal();
+        // How the deferral barrier sees the chain: a class staged by an earlier
+        // patch counts as existing, so patch N+1 defers exactly as it would have
+        // when patch N had already committed - "unchanged" (ADR-0042 §2) means
+        // unchanged decisions, not unchanged lookups.
+        const stagedClassSchema = (className) => {
+            var _a;
+            for (const entry of t.stage.values()) {
+                const doc = entry.doc;
+                if (isClassModel(doc) && (doc._id === className || doc.name === className)) {
+                    return (_a = doc.schema) !== null && _a !== void 0 ? _a : null;
+                }
+            }
+            return null;
+        };
+        // For the dry-run's error report: which patch last touched a class.
+        const patchByClassId = new Map();
+        const deferFrom = async (index) => {
+            this.deferredPatches = patches.slice(index);
+            fnLogger.warn("Deferred patches until the stack is unlocked", {
+                from: patches[index].version,
+                count: this.deferredPatches.length,
+            });
+            for (const deferred of this.deferredPatches) {
+                await this.recordPatchDeferral(deferred);
+            }
+        };
+        const stagedPatches = [];
+        try {
+            for (let index = 0; index < patches.length; index++) {
+                const patch = patches[index];
+                if (this.isLocked() && await this.patchNeedsDocumentKey(patch, stagedClassSchema)) {
+                    await deferFrom(index);
+                    break;
+                }
+                // One patch's whole staging - pre-apply job writes included - can be
+                // unwound alone: a locked refusal converts this patch to a deferral
+                // while the already-staged prefix goes on to commit.
+                const before = t.stage.snapshot();
+                try {
+                    if (patch.preApply) {
+                        await this.runPatchJob(t, patch, "preApply");
+                    }
+                    await this.stagePatch(t, patch);
+                }
+                catch (error) {
+                    if (this.isLocked() && (error === null || error === void 0 ? void 0 : error.name) === "StackLockedError") {
+                        // A `requiresKey: false` claimed wrongly (ADR-0044): degrade
+                        // to what a correct declaration would have done, instead of
+                        // failing the open.
+                        t.stage.restore(before);
+                        await deferFrom(index);
+                        break;
+                    }
+                    // Patch fault or init-state fault (ADR-0042): zero persisted.
+                    throw new Error(`Patch '${patch.version}' refused while ${patch.preApply ? "preparing" : "staging"}: ${(_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : error}`);
+                }
+                for (const doc of (_b = patch.docs) !== null && _b !== void 0 ? _b : []) {
+                    if (isClassModel(doc))
+                        patchByClassId.set(doc._id, patch.version);
+                }
+                stagedPatches.push(patch);
+            }
+            if (!stagedPatches.length) {
+                this.transactionEngine.discard(t);
+                return;
+            }
+            await this.validateChainPropagation(t, patchByClassId);
+            // Environment faults from here - a concurrent write between dry-run and
+            // commit, a per-document conflict - reject as they are: nothing recorded,
+            // the chain retries next open.
+            await this.transactionEngine.commit(t);
+        }
+        catch (error) {
+            this.transactionEngine.discard(t);
+            throw error;
+        }
+        // Post-apply phase (ADR-0044): the models have landed; backfills run in a
+        // second staged transaction, one commit of their own, and the ledger arms
+        // only after. A post failure leaves the chain unarmed: the next open
+        // re-stages to an empty diff and re-runs post - which is why jobs must be
+        // idempotent.
+        if (stagedPatches.some(patch => patch.postApply)) {
+            const post = this.transactionEngine.beginInternal();
+            try {
+                for (const patch of stagedPatches) {
+                    if (!patch.postApply)
+                        continue;
+                    await this.runPatchJob(post, patch, "postApply");
+                }
+                await this.transactionEngine.commit(post);
+            }
+            catch (error) {
+                this.transactionEngine.discard(post);
+                if (this.isLocked() && (error === null || error === void 0 ? void 0 : error.name) === "StackLockedError") {
+                    // Models landed, backfill needs the key: hold the arming behind
+                    // it. Dormant entries keep the sync gate honest, and the unlock
+                    // replay re-runs the (idempotent) chain and arms.
+                    for (const patch of stagedPatches) {
+                        await this.recordPatchDeferral(patch);
+                    }
+                    this.deferredPatches = [...stagedPatches, ...this.deferredPatches];
+                    return;
+                }
+                throw new Error(`Patch chain post-apply failed: ${(_c = error === null || error === void 0 ? void 0 : error.message) !== null && _c !== void 0 ? _c : error}`);
+            }
+        }
+        for (const patch of stagedPatches) {
+            await this.recordPatchApplication(patch);
+        }
+        fnLogger.info("Applied patch chain", { count: stagedPatches.length });
+    }
+    /**
+     * Stages one patch's documents into the chain transaction. Hydration reads
+     * through the transaction's overlay, so an `_rev: "auto"` document merges onto
+     * what an earlier patch staged - or onto committed state when the chain has not
+     * touched it.
+     */
+    async stagePatch(t, patch) {
+        var _a;
+        for (const sourceDoc of (_a = patch.docs) !== null && _a !== void 0 ? _a : []) {
+            let doc = Object.assign({}, sourceDoc);
+            if (doc._rev === "auto") {
+                delete doc._rev;
+                const existingDoc = await t.db.get(doc._id);
+                doc = Object.assign(Object.assign({}, existingDoc), doc);
+                ClientStack.mergePatchSchema(sourceDoc, existingDoc, doc);
+                // The overlay hands staged docs back without a revision until one
+                // exists; the stated revision must match what the write replaces.
+                if (existingDoc._rev !== undefined)
+                    doc._rev = existingDoc._rev;
+                else
+                    delete doc._rev;
+            }
+            await t.db.put(doc);
+        }
+    }
+    /**
+     * ADR-0042 §3 - propagation, validated dry: for every class the chain staged
+     * over a committed predecessor, run the schema delta across the class's
+     * committed documents and keep nothing. The point is the refusal - a document
+     * that cannot satisfy the new model fails here, before the first write, naming
+     * the patch, the document and the attribute.
+     */
+    async validateChainPropagation(t, patchByClassId) {
+        var _a, _b;
+        for (const entry of t.stage.values()) {
+            const staged = entry.doc;
+            if (!isClassModel(staged))
+                continue;
+            const previous = await this.db.get(staged._id).catch((error) => {
+                if ((error === null || error === void 0 ? void 0 : error.name) === "not_found" || (error === null || error === void 0 ? void 0 : error.status) === 404)
+                    return null;
+                throw error;
+            });
+            // A class the chain creates propagates to nothing.
+            if (!previous)
+                continue;
+            const schemaDelta = diff(previous.schema, staged.schema);
+            if (!schemaDelta)
+                continue;
+            const classObj = await Class.buildFromModel(this, previous, { subscribe: false });
+            // Raw read, not getCards: patches apply during `create()`, before any
+            // session exists, and the policy-checked read path refuses without one.
+            // The dry-run wants the stored documents; encrypted attributes are
+            // opened explicitly when a key is present (a keyless encrypting class
+            // never reaches here - the deferral barrier held its patch back).
+            const found = await this.db.find({
+                selector: { "~class": classObj.name, active: true },
+                limit: 2 ** 31 - 1,
+            });
+            const decrypts = ((_a = this.cryptoEngine) === null || _a === void 0 ? void 0 : _a.isEnabled())
+                && this.cryptoEngine.getDocumentKey()
+                && classObj.getEncryptedAttributes().length > 0;
+            for (let document of found.docs) {
+                // A committed document superseded in the stage - a pre-apply job's
+                // massage (ADR-0044) - is judged as its staged version: that is what
+                // the commit will actually write. A staged delete leaves nothing to
+                // propagate onto.
+                const supersededBy = t.stage.get(document._id);
+                if (supersededBy) {
+                    if (supersededBy.op === "delete")
+                        continue;
+                    document = structuredClone(supersededBy.doc);
+                }
+                else if (decrypts) {
+                    await this.cryptoEngine.decryptDocument(document, classObj);
+                }
+                try {
+                    await applySchemaDelta(document, schemaDelta, classObj, staged.schema);
+                }
+                catch (error) {
+                    const version = patchByClassId.get(staged._id);
+                    throw new Error(`Patch '${version !== null && version !== void 0 ? version : "?"}' cannot apply to class '${classObj.name}': ${(_b = error === null || error === void 0 ? void 0 : error.message) !== null && _b !== void 0 ? _b : error}`);
+                }
+            }
+        }
     }
     /**
      * Decides whether applying a patch would write an encrypted attribute.
@@ -11993,26 +15719,54 @@ class ClientStack extends Stack {
      * simulate schema evolution ahead of time.
      *
      * @param patch - The patch about to be applied.
+     * @param stagedSchema - Chain staging only (ADR-0042): resolves a class the
+     * current transaction already staged, so patch N+1 defers exactly as it would
+     * have when patch N had committed.
      * @returns `true` if any document in it belongs to a class with encrypted attributes.
      */
-    async patchNeedsDocumentKey(patch) {
+    async patchNeedsDocumentKey(patch, stagedSchema) {
+        var _a;
+        // A one-shot job's touch-set cannot be inspected, so the author answers the
+        // barrier's question: unstated defaults to "needs the key" - forgetting the
+        // flag costs latency (the job runs at unlock), never correctness. An
+        // explicit `requiresKey: false` opts into locked execution (ADR-0044).
+        const jobs = [patch.preApply, patch.postApply].filter(Boolean);
+        if (jobs.some(job => job.requiresKey !== false))
+            return true;
         const hasEncryptedAttribute = (schema) => !!schema && Object.values(schema).some((attribute) => { var _a; return ((_a = attribute === null || attribute === void 0 ? void 0 : attribute.config) === null || _a === void 0 ? void 0 : _a.encrypted) === true; });
+        const knownSchema = async (className) => {
+            const staged = stagedSchema === null || stagedSchema === void 0 ? void 0 : stagedSchema(className);
+            if (staged)
+                return staged;
+            const stored = await this.getClassModel(className).catch(() => null);
+            return stored === null || stored === void 0 ? void 0 : stored.schema;
+        };
         const schemasInPatch = new Map();
         for (const doc of patch.docs) {
             if (isClassModel(doc) && doc.schema)
                 schemasInPatch.set(doc._id, doc.schema);
         }
         for (const doc of patch.docs) {
-            // Class models describe encryption; they never carry an encrypted value.
-            if (isClassModel(doc))
+            // A class model carries no encrypted value itself - but *updating* one
+            // triggers propagation over the class's existing documents (ADR-0038),
+            // and when the class encrypts, that propagation both decrypts (getCards)
+            // and re-encrypts (the rewrite): key work on both sides. A locked stack
+            // must defer it or the replay fails on the first document (ADR-0040).
+            // A class that does not exist yet propagates to nothing and stays safe
+            // to apply locked - that is how the schema itself can arrive pre-unlock.
+            if (isClassModel(doc)) {
+                const predecessor = await knownSchema((_a = doc.name) !== null && _a !== void 0 ? _a : doc._id);
+                if (predecessor && (hasEncryptedAttribute(predecessor) || hasEncryptedAttribute(doc.schema))) {
+                    return true;
+                }
                 continue;
+            }
             const className = doc["~class"];
             if (!className)
                 continue;
             if (hasEncryptedAttribute(schemasInPatch.get(className)))
                 return true;
-            const stored = await this.getClassModel(className).catch(() => null);
-            if (hasEncryptedAttribute(stored === null || stored === void 0 ? void 0 : stored.schema))
+            if (hasEncryptedAttribute(await knownSchema(className)))
                 return true;
         }
         return false;
@@ -12197,6 +15951,68 @@ class ClientStack extends Stack {
             throw new Error(e);
         }
     }
+    /**
+     * Finds a patch's ledger entry, raw - ledger documents are read outside the
+     * `active: true` visibility convention because `active` carries the ledger's own
+     * meaning here: `true` is applied, `false` is deferred, absent is a legacy entry
+     * from before the flag (treated as applied). See ADR-0041.
+     */
+    async findPatchLedgerEntry(patch) {
+        var _a;
+        const selector = { "~class": "patch", version: patch.version };
+        // A targetless patch is legal; `undefined` in a Mango selector is not.
+        if (patch.target !== undefined)
+            selector.target = patch.target;
+        const found = await this.db.find({ selector, limit: 10 }).catch(() => ({ docs: [] }));
+        return (_a = found.docs[0]) !== null && _a !== void 0 ? _a : null;
+    }
+    /**
+     * Records a successful application: the ledger entry arms with `active: true` -
+     * flipping the deferral entry in place when one exists, so a replayed patch does
+     * not duplicate its record.
+     */
+    async recordPatchApplication(patch) {
+        const existing = await this.findPatchLedgerEntry(patch);
+        if (existing) {
+            if (existing.active === true)
+                return;
+            await this.db.put(Object.assign(Object.assign({}, existing), { active: true, appliedTimestamp: Date.now() }));
+            return;
+        }
+        await this.db.post(Object.assign(Object.assign({ createTimestamp: Date.now() }, patch), { active: true }));
+    }
+    /**
+     * Records a deferral: the patch is known but dormant (`active: false`), waiting
+     * on the document key. The entry is what makes a deferred device honest at the
+     * sync gate - {@link getConsumerSchemaVersion} does not count it.
+     */
+    async recordPatchDeferral(patch) {
+        const existing = await this.findPatchLedgerEntry(patch);
+        if (existing)
+            return;
+        await this.db.post(Object.assign(Object.assign({ createTimestamp: Date.now() }, patch), { active: false }));
+    }
+    /**
+     * The ADR-0038 half of patch hydration: `schema` does not ride the shallow
+     * merge, which would replace it wholesale - it merges attribute by attribute.
+     * A patch states only the attributes it changes, an absent attribute stays as
+     * stored, and an explicit `null` entry drops the attribute - from the model
+     * here, and from the documents when the write propagates. Shared by
+     * {@link applyPatch} and the chain staging of ADR-0042 so the two cannot drift.
+     */
+    static mergePatchSchema(sourceDoc, existingDoc, doc) {
+        const incoming = sourceDoc === null || sourceDoc === void 0 ? void 0 : sourceDoc.schema;
+        const stored = existingDoc === null || existingDoc === void 0 ? void 0 : existingDoc.schema;
+        if (incoming && typeof incoming === "object" && !Array.isArray(incoming)
+            && stored && typeof stored === "object" && !Array.isArray(stored)) {
+            const merged = Object.assign(Object.assign({}, stored), incoming);
+            for (const name of Object.keys(incoming)) {
+                if (incoming[name] === null)
+                    delete merged[name];
+            }
+            doc.schema = merged;
+        }
+    }
     async applyPatches(schemaVersion) {
         const fnLogger = logger.child({ method: "applyPatches", args: { schemaVersion } });
         let _schemaVersion = schemaVersion;
@@ -13515,4 +17331,4 @@ class DocStack extends EventTarget {
     }
 }
 
-export { Attribute, CONTENT_EXPORT_FORMAT, Class, ClientStack, DATA_MODEL_CLASSES, DocStack, DocStackSyncHandle, Domain, INTERNAL_DOC_CLASSES, INTERNAL_DOC_IDS, INTERNAL_DOC_ID_PREFIXES, JOB_SCHEDULE_DOC_ID, JobEngine, JobScheduler, META_CLASSES, OPTIONAL_INTERNAL_DOC_CLASSES, SYNC_META_DOC_ID, SYSTEM_SEEDED_DOC_IDS, StackLockedError, StackSyncHandle, StackWriteGuardError, SyncSchemaMismatchError, Trigger, classTenants, collectQueryClasses, createClassFilter, createReplicationFilter, DocStack as default, deriveKeyId, deriveTenantScope, describeFilter, hasClassRules, isContentClassName, isContentDocument, isContentRelation, isEncryptedPayload, isInternalDoc, nextOccurrence, parseSchedule, publishSchemaVersion, readRemoteSchemaVersion, resolveInternalClasses, withFilterIdentity };
+export { Attribute, CONTENT_EXPORT_FORMAT, Class, ClientStack, DATA_MODEL_CLASSES, DocStack, DocStackSyncHandle, Domain, INTERNAL_DOC_CLASSES, INTERNAL_DOC_IDS, INTERNAL_DOC_ID_PREFIXES, JOB_SCHEDULE_DOC_ID, JobEngine, JobScheduler, META_CLASSES, OPTIONAL_INTERNAL_DOC_CLASSES, SYNC_META_DOC_ID, SYSTEM_SEEDED_DOC_IDS, StackLockedError, StackSyncHandle, StackWriteGuardError, SyncSchemaMismatchError, TransactionConflictError, TransactionDb, TransactionEngine, TransactionHandle, TransactionStateError, TransactionUnsupportedDocError, TransactionValidationError, TransactionsDisabledError, Trigger, classTenants, collectQueryClasses, createClassFilter, createReplicationFilter, DocStack as default, deriveKeyId, deriveTenantScope, describeFilter, hasClassRules, isContentClassName, isContentDocument, isContentRelation, isEncryptedPayload, isInternalDoc, nextOccurrence, parseSchedule, publishSchemaVersion, readRemoteConsumerSchemaVersion, readRemoteSchemaVersion, resolveInternalClasses, withFilterIdentity };