@docstack/client 0.1.8 → 0.2.0

package/lib/index.umd.js

@@ -1,8 +1,8 @@
 (function (global, factory) {
-    typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('pouchdb-browser'), require('zod'), require('pouchdb-find'), require('semver'), require('jsondiffpatch')) :
-    typeof define === 'function' && define.amd ? define(['exports', 'pouchdb-browser', 'zod', 'pouchdb-find', 'semver', 'jsondiffpatch'], factory) :
-    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.docstack = {}, global.PouchDB, global.z, global.PouchDBFind, global.semver, global.jsondiffpatch));
-})(this, (function (exports, PouchDB, z, PouchDBFind, semver, jsondiffpatch) { 'use strict';
+    typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('pouchdb-browser'), require('semver'), require('jsondiffpatch'), require('zod'), require('pouchdb-find')) :
+    typeof define === 'function' && define.amd ? define(['exports', 'pouchdb-browser', 'semver', 'jsondiffpatch', 'zod', 'pouchdb-find'], factory) :
+    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.docstack = {}, global.PouchDB, global.semver, global.jsondiffpatch, global.z, global.PouchDBFind));
+})(this, (function (exports, PouchDB, semver, jsondiffpatch, z, PouchDBFind) { 'use strict';
 
     /******************************************************************************
     Copyright (c) Microsoft Corporation.
@@ -925,6 +925,80 @@
         }
     };
 
+    const attributeEffect = async (operation, model, classObj, doc) => {
+        const attribute = new Attribute(null, model.name, model.type, model.description, model.config);
+        if (operation === "add" && !(attribute.name in doc)) {
+            // Only documents that lack the key get the empty value. A document may
+            // already hold one - a repair patch re-declaring an attribute the model
+            // lost is exactly that case (ADR-0038) - and stamping `getEmpty()` over
+            // it would be data loss; validation below still runs against it.
+            doc = Object.assign(Object.assign({}, doc), attribute.getEmpty());
+        }
+        if (operation === "delete") {
+            delete doc[attribute.name];
+        }
+        else { // when addition or change also perform validation
+            const res = await attribute.validate(doc[attribute.name]);
+            // `safeParseAsync` resolves to a result object, which is truthy whether or not the
+            // value is valid: the outcome has to be read off `success`, otherwise every invalid
+            // value passes straight through.
+            if (!res.success) {
+                throw new Error(`Attribute '${classObj.name}.${attribute.name}' ${operation} fails for current document because of its validation: ${z.prettifyError(res.error)}`);
+            }
+        }
+        if (attribute.isPrimaryKey()) {
+            const result = classObj.bulkUniqueCheck(classObj.getPrimaryKeys());
+            if (!result) {
+                throw new Error(`With attribute '${attribute.name}' ${operation} of class '${classObj.name}', docs fail primary keys check.`);
+            }
+        }
+        if (operation !== "delete" && attribute.isMandatory() && doc[attribute.name] == undefined) {
+            throw new Error(`Attribute '${classObj.name}.${attribute.name}' is mandatory but has no value.`);
+        }
+        return doc;
+    };
+    const applySchemaDelta = async (doc, schemaDelta, classObj, newSchema) => {
+        const fnLogger = createLogger().child({ method: "applySchemaDelta" });
+        let updatedDoc = Object.assign({}, doc);
+        // Every entry applies - the delta names one attribute per key, and a schema
+        // change routinely touches several. Returning after the first one is how a
+        // two-attribute patch used to stamp only whichever came first (ADR-0036).
+        for (const [name, delta] of Object.entries(schemaDelta)) {
+            fnLogger.debug(`Delta of attribute '${name}'`);
+            if (Array.isArray(delta)) {
+                // jsondiffpatch's array shapes: [new] is an addition, [old, new] a
+                // wholesale replacement, [old, 0, 0] a removal.
+                if (delta.length === 1) {
+                    updatedDoc = await attributeEffect("add", delta[0], classObj, updatedDoc);
+                }
+                else if (delta.length === 2) {
+                    // The *new* model: validating against the one on its way out
+                    // would pin every document to the definition being replaced.
+                    updatedDoc = await attributeEffect("change", delta[1], classObj, updatedDoc);
+                }
+                else if (delta.length === 3) {
+                    updatedDoc = await attributeEffect("delete", delta[0], classObj, updatedDoc);
+                }
+            }
+            else {
+                // A nested delta: jsondiffpatch recurses into object values, so an
+                // attribute model edited in place (one config flag, a description)
+                // lands here rather than in the [old, new] branch above - this is the
+                // ordinary shape of an edit, not an exotic one. The delta carries
+                // only the changed fragment, so the full model to validate against
+                // comes from the schema being written.
+                const attrModel = newSchema === null || newSchema === void 0 ? void 0 : newSchema[name];
+                if (attrModel) {
+                    updatedDoc = await attributeEffect("change", attrModel, classObj, updatedDoc);
+                }
+                else {
+                    fnLogger.warn(`Unhandled delta shape for attribute '${name}': no new model to validate against`, { delta });
+                }
+            }
+        }
+        return updatedDoc;
+    };
+
     /**
      * The Trigger class dynamically hydrates a function from a string.
      * This allows for declarative, data-driven logic to be executed at runtime.
@@ -3564,10 +3638,12 @@ async function execute(_stack, params) {
                 "name": "class",
                 "description": "A class document representing a data model class",
                 "~class": "~self",
-                // Patch hydration is a shallow merge: this `schema` REPLACES the stored one,
-                // it does not add to it. So a patch to the `class` document must carry the
-                // full attribute set - dropping `ephemeral`/`simple` here silently strips
-                // those flags from every class model on the next validated write.
+                // Patch hydration merges `schema` attribute by attribute (ADR-0038): an
+                // entry here overlays the stored one, an absent attribute stays as stored,
+                // and an explicit `null` drops it. The restatement of `ephemeral`/`simple`
+                // below predates the merge - hydration used to replace the whole schema, so
+                // a patch had to carry the full set - and is kept: under merge it lands on
+                // identical definitions and changes nothing.
                 "schema": {
                     "ephemeral": {
                         "name": "ephemeral",
@@ -3602,7 +3678,32 @@ async function execute(_stack, params) {
             }
         ]
     };
-    syspatches.push(sys_011, sys_012, sys_013, sys_014, sys_015, sys_016);
+    /**
+     * `~JobRun.jobId` becomes optional (ADR-0044): a patch's one-shot job leaves its
+     * receipt as a `~JobRun`, but patch jobs are deliberately never persisted as
+     * `~Job` documents, so their receipts have no row to point at - they omit
+     * `jobId` and carry the patch identity in `runtimeArgs` instead. A scheduler run
+     * still writes its `jobId`; the foreign key still validates whenever present.
+     * An ADR-0038 merge fragment: one attribute restated, everything else untouched.
+     */
+    const sys_017 = {
+        "_id": "~sys-0.0.17",
+        "~class": "patch",
+        "version": "0.0.17",
+        "target": "system",
+        "changelog": "### Schema Patch: v0.0.17\\n#### ~JobRun.jobId optional (patch job receipts, ADR-0044)",
+        "docs": [
+            {
+                "_id": "~JobRun",
+                "_rev": "auto",
+                "~class": "class",
+                "schema": {
+                    "jobId": { "name": "jobId", "type": "foreign_key", "config": { "mandatory": false, "targetClass": "~Job" } }
+                }
+            }
+        ]
+    };
+    syspatches.push(sys_011, sys_012, sys_013, sys_014, sys_015, sys_016, sys_017);
     /**
      * Every document id the system patches seed.
      *
@@ -3642,64 +3743,7 @@ async function execute(_stack, params) {
             .map((patch) => JSON.parse(JSON.stringify(patch)));
     }
 
-    const attributeEffect = async (operation, model, classObj, doc) => {
-        const attribute = new Attribute(null, model.name, model.type, model.description, model.config);
-        if (operation === "add") {
-            doc = Object.assign(Object.assign({}, doc), attribute.getEmpty());
-        }
-        if (operation === "delete") {
-            delete doc[attribute.name];
-        }
-        else { // when addition or change also perform validation
-            const res = await attribute.validate(doc[attribute.name]);
-            // `safeParseAsync` resolves to a result object, which is truthy whether or not the
-            // value is valid: the outcome has to be read off `success`, otherwise every invalid
-            // value passes straight through.
-            if (!res.success) {
-                throw new Error(`Attribute '${classObj.name}.${attribute.name}' ${operation} fails for current document because of its validation: ${z.prettifyError(res.error)}`);
-            }
-        }
-        if (attribute.isPrimaryKey()) {
-            const result = classObj.bulkUniqueCheck(classObj.getPrimaryKeys());
-            if (!result) {
-                throw new Error(`With attribute '${attribute.name}' ${operation} of class '${classObj.name}', docs fail primary keys check.`);
-            }
-        }
-        if (operation !== "delete" && attribute.isMandatory() && doc[attribute.name] == undefined) {
-            throw new Error(`Attribute '${classObj.name}.${attribute.name}' is mandatory but has no value.`);
-        }
-        return doc;
-    };
-    const applySchemaDelta = async (doc, schemaDelta, classObj) => {
-        const fnLogger = createLogger().child({ method: "applySchemaDelta" });
-        let updatedDoc = Object.assign({}, doc);
-        const t = Object.entries(schemaDelta);
-        for (const e of t) {
-            fnLogger.debug(`Delta of attribute '${e[0]}'`);
-            if (Array.isArray(e[1])) {
-                // e[1] can represent an addition, a deletion or an edit
-                // it's an addition when the array has only one element
-                if (e[1].length === 1) {
-                    const attrModel = e[1][0];
-                    updatedDoc = await attributeEffect("add", attrModel, classObj, updatedDoc);
-                }
-                // it's an edit when it has 2 elements
-                if (e[1].length === 1) {
-                    const attrModel = e[1][0];
-                    updatedDoc = await attributeEffect("change", attrModel, classObj, updatedDoc);
-                }
-                // it's a removal when it has 3 elements
-                if (e[1].length === 3) {
-                    const attrModel = e[1][0];
-                    updatedDoc = await attributeEffect("delete", attrModel, classObj, updatedDoc);
-                }
-                return updatedDoc;
-            }
-        }
-        return updatedDoc;
-    };
-
-    const logger$3 = createLogger().child({ module: "pouchdb" });
+    const logger$4 = createLogger().child({ module: "pouchdb" });
     /**
      * Raised when a locked stack is asked to write a class carrying encrypted attributes.
      *
@@ -3768,7 +3812,7 @@ async function execute(_stack, params) {
                 return Promise.resolve("pong");
             },
             bulkDocs: async function (docs, options, callback) {
-                const fnLogger = logger$3.child({ method: "bulkDocs" });
+                const fnLogger = logger$4.child({ method: "bulkDocs" });
                 if (typeof options == 'function') {
                     callback = options;
                     options = {};
@@ -3831,10 +3875,7 @@ async function execute(_stack, params) {
                 const triggerQueue = Object.create(null);
                 const classCache = new Map();
                 const postOperations = async (error, result) => {
-                    if (error) {
-                        return { error, result };
-                    }
-                    else if (result) {
+                    if (result) {
                         const docs = [];
                         for (const docRes of result) {
                             if (docRes.id) {
@@ -3927,25 +3968,22 @@ async function execute(_stack, params) {
                             // When a class document is updated, its change must have an effect on its children
                             const classDocId = doc._id;
                             const className = typeof doc.name === "string" ? doc.name : classDocId;
+                            // Fetch the version this write replaces. Its *absence* is what
+                            // "just created" means - a revision count is not: a stored class
+                            // at rev 1 receiving its first schema change already has documents
+                            // to propagate to, and the old `_revisions.ids.length == 1` check
+                            // skipped exactly that write (ADR-0038).
+                            let previousClassDoc;
                             try {
-                                // Get the previous version of the class model
-                                const docWithRevs = await stack.db.get(classDocId, { revs: true });
-                                const revisionIDList = docWithRevs._revisions.ids;
-                                if (revisionIDList.length == 1) {
-                                    fnLogger.info(`Class '${className}' (doc '${classDocId}') was just created. Nothing to do.`);
-                                    continue;
-                                    return pouchBulkDocs.call(this, docs, options, postExec);
-                                }
+                                previousClassDoc = await stack.db.get(classDocId);
                             }
                             catch (e) {
                                 if (e.name === 'not_found') {
                                     fnLogger.info(`Class '${className}' (doc '${classDocId}') was just created. Nothing to do.`);
                                     continue;
-                                    return pouchBulkDocs.call(this, docs, options, postExec);
                                 }
+                                throw e;
                             }
-                            // Fetch the current (next old) version of the class document.
-                            const previousClassDoc = await stack.db.get(classDocId);
                             // Built rather than looked up: this is the class as it was *before*
                             // this write, which the cache does not hold. Detached, because all it
                             // is used for is diffing and applying the delta.
@@ -3961,16 +3999,54 @@ async function execute(_stack, params) {
                                 fnLogger.info(`Class '${className}' has no changes on schema.`);
                                 continue;
                             }
-                            const documents = await classObj.getCards();
+                            // System-level read, not getCards: propagation must see every
+                            // document of the class - a policy-filtered read would rewrite
+                            // only the session's subset - and it runs during create()'s
+                            // patch application, before any session exists (ADR-0044).
+                            // Encrypted attributes are opened explicitly when a key is
+                            // present; a keyless encrypting class never reaches here, its
+                            // patch deferred upstream (ADR-0040).
+                            const rawFetch = await stack.db.find({
+                                selector: { "~class": className, active: true },
+                                limit: 2 ** 31 - 1,
+                            });
+                            const fetched = rawFetch.docs;
+                            if (stack.cryptoEngine.isEnabled() && stack.cryptoEngine.getDocumentKey()
+                                && classObj.getEncryptedAttributes().length) {
+                                for (const stored of fetched) {
+                                    await stack.cryptoEngine.decryptDocument(stored, classObj);
+                                }
+                            }
+                            // A committed document superseded by a batch-mate belongs to the
+                            // batch, not to propagation (ADR-0044): its batch version - a
+                            // pre-apply job's massage - is validated by the document branch
+                            // against the batch model, and judging or stamping the stale
+                            // committed copy here would refuse (or undo) exactly what the
+                            // massage fixed. A delegation, not a skip.
+                            const superseded = new Set(documentsToProcess.map((mate) => mate === null || mate === void 0 ? void 0 : mate._id).filter((id) => typeof id === "string"));
+                            const documents = fetched.filter(existing => !superseded.has(existing._id));
                             if (documents.length === 0) {
                                 fnLogger.info(`No documents found for class '${className}' after its update.`);
                                 continue;
                             }
+                            // The schema being written, captured before the map shadows `doc`:
+                            // an attribute edited in place arrives as a nested delta carrying
+                            // only the changed fragment, and the full new model to validate
+                            // against has to come from here.
+                            const nextSchema = doc.schema;
                             const updates = await Promise.all(documents.map(async (doc) => {
-                                const updatedDoc = await applySchemaDelta(doc, schemaDelta, classObj);
+                                const updatedDoc = await applySchemaDelta(doc, schemaDelta, classObj, nextSchema);
                                 return updatedDoc;
                             }));
-                            await stack.db.bulkDocs(updates);
+                            // PouchDB reports per-document failures in the *resolved* array,
+                            // not by rejecting - awaiting alone would let a conflicted update
+                            // silently drop one document's propagation.
+                            const propagated = await stack.db.bulkDocs(updates);
+                            const failures = propagated.filter(entry => entry && entry.error);
+                            if (failures.length) {
+                                throw new Error(`Schema propagation failed for ${failures.length} document(s) of class '${className}': ` +
+                                    failures.map((f) => { var _a; return `${f.id}: ${(_a = f.message) !== null && _a !== void 0 ? _a : f.name}`; }).join("; "));
+                            }
                             fnLogger.info('Propagated updates');
                         }
                         else if (isRelation(doc)) {
@@ -3981,9 +4057,20 @@ async function execute(_stack, params) {
                             if (doc.sourceClass !== domain.sourceClass.id || doc.targetClass !== domain.targetClass.id) {
                                 throw new Error(`Relation document classes do not match domain '${domain.name}'.`);
                             }
+                            // An endpoint may be a batch-mate rather than stored: a relation
+                            // written together with its documents in one bulkDocs - which is
+                            // exactly what a transaction commit is (ADR-0039) - checks the
+                            // batch before declaring the endpoint missing.
+                            const resolveEndpoint = async (endpointId) => {
+                                var _a;
+                                const stored = await stack.db.get(endpointId).catch(() => null);
+                                if (stored)
+                                    return stored;
+                                return (_a = documentsToProcess.find((mate) => (mate === null || mate === void 0 ? void 0 : mate._id) === endpointId && !(mate === null || mate === void 0 ? void 0 : mate._deleted))) !== null && _a !== void 0 ? _a : null;
+                            };
                             const [sourceDoc, targetDoc] = await Promise.all([
-                                stack.db.get(doc.sourceId).catch(() => null),
-                                stack.db.get(doc.targetId).catch(() => null),
+                                resolveEndpoint(doc.sourceId),
+                                resolveEndpoint(doc.targetId),
                             ]);
                             if (!sourceDoc) {
                                 throw new Error(`Source document '${doc.sourceId}' does not exist for domain '${domain.name}'.`);
@@ -4009,8 +4096,29 @@ async function execute(_stack, params) {
                                 continue;
                             try {
                                 let classObj;
+                                // The newest statement of a schema may ride this same batch
+                                // (ADR-0043): a patch introduces a class and seeds its first
+                                // document in one docs array. The batch outranks the store even
+                                // for a class that already exists - it is what is about to be
+                                // committed - and the search sees the whole array, so ordering
+                                // within the batch does not matter. The relation branch above
+                                // has made the same decision for its endpoints since ADR-0039.
+                                const batchModel = documentsToProcess.find((mate) => isClassModel(mate) && !mate._deleted
+                                    && (mate.name === className || mate._id === className));
                                 try {
-                                    classObj = classCache.get(className) || await stack.getClassSnapshot(className);
+                                    // Built DETACHED - `Class.get` + `setModel`, the same path
+                                    // `buildFromModel` takes for a stored doc. `buildFromModel`
+                                    // itself would route a rev-less model through `Class.create`,
+                                    // which writes the class doc and makes the batch's own
+                                    // insert conflict with it.
+                                    let fromBatch = null;
+                                    if (batchModel && !classCache.has(className)) {
+                                        fromBatch = Class.get(stack, batchModel._id, batchModel.name, batchModel["~class"], batchModel.description, batchModel.schema, { subscribe: false });
+                                        fromBatch.setModel(batchModel);
+                                    }
+                                    classObj = classCache.get(className)
+                                        || fromBatch
+                                        || await stack.getClassSnapshot(className);
                                 }
                                 catch (error) {
                                     throw new Error(`Class '${className}' not found for document '${doc._id}'.`);
@@ -4205,6 +4313,19 @@ async function execute(_stack, params) {
                 const exec = async () => {
                     var _a, _b;
                     const result = await pouchGet.call(this, docId, options !== null && options !== void 0 ? options : {});
+                    // A revision-addressed read serves the STORED form, never plaintext.
+                    // This is not an optimization but the seal on the replication surface
+                    // (ADR-0040): PouchDB hard-binds its instance methods at construction,
+                    // so the pristine `bulkGet` the sync layer uses cannot be pointed away
+                    // from this instance - its shim, and `get`'s own `open_revs` branch,
+                    // re-enter THIS override per revision (`{rev}` / `{open_revs}`).
+                    // Decrypting those hops pushed every encrypted attribute to remotes in
+                    // plaintext under the local revision id. Taxonomically it is the same
+                    // line ADR-0020 draws: naming a revision is a replication/forensic
+                    // read; the winning-revision read below is the one that decrypts.
+                    if ((options === null || options === void 0 ? void 0 : options.rev) || (options === null || options === void 0 ? void 0 : options.open_revs)) {
+                        return result;
+                    }
                     // Optional-chained on purpose: this override serves `initialize` itself
                     // (`checkSystem` reads `~system` through it), which runs before the
                     // crypto engine is constructed. And gated on the *key*, not just the
@@ -4417,6 +4538,13 @@ async function execute(_stack, params) {
      * @internal
      */
     const createReplicationDb = (db, pristine) => {
+        // Note the limit of what this handle can restore: PouchDB hard-binds instance
+        // methods at construction (`this.bulkGet = adapterFun(...).bind(this)`), so the
+        // pristine functions run against the raw instance no matter what they are bound
+        // to here - and pouchdb-core's `bulkGet`/`open_revs` internals re-enter
+        // `this.get`, which is the plugin's override. The override itself is therefore
+        // the one place that can keep those internal hops raw: it serves the stored form
+        // for any revision-addressed read (ADR-0040).
         const bulkDocs = pristine.bulkDocs.bind(db);
         const bulkGet = pristine.bulkGet.bind(db);
         // `get` restored for the same reason as `bulkGet`: since ADR-0032 the plugin
@@ -4932,7 +5060,7 @@ async function execute(_stack, params) {
         return scope;
     };
 
-    const logger$2 = createLogger().child({ module: "sync" });
+    const logger$3 = createLogger().child({ module: "sync" });
     /**
      * Raised when a remote is ahead of this device's data model.
      *
@@ -4942,14 +5070,18 @@ async function execute(_stack, params) {
      * tells the application to ship the newer build.
      */
     class SyncSchemaMismatchError extends Error {
-        constructor(stack, localVersion, remoteVersion) {
-            super(`Stack '${stack}' cannot sync: the remote was last written with schema version ` +
-                `${remoteVersion}, this device has ${localVersion || "no schema version"}. Update the ` +
-                `application so its patches reach ${remoteVersion} before syncing again.`);
+        constructor(stack, localVersion, remoteVersion, scope = "system") {
+            super(`Stack '${stack}' cannot sync: the remote was last written with ` +
+                `${scope === "consumer" ? "consumer patch" : "schema"} version ` +
+                `${remoteVersion}, this device has ${localVersion || "none"}. ` +
+                (scope === "consumer"
+                    ? `Apply the application's patches up to ${remoteVersion} - a deferred patch applies on unlock - before syncing again.`
+                    : `Update the application so its patches reach ${remoteVersion} before syncing again.`));
             this.name = "SyncSchemaMismatchError";
             this.stack = stack;
             this.localVersion = localVersion;
             this.remoteVersion = remoteVersion;
+            this.scope = scope;
         }
     }
     /**
@@ -4985,6 +5117,20 @@ async function execute(_stack, params) {
         });
         return (system === null || system === void 0 ? void 0 : system.schemaVersion) || null;
     };
+    /**
+     * Reads the highest consumer patch version recorded on a remote.
+     *
+     * `null` for a remote nobody has written, or one written only by builds that
+     * predate the consumer half of the gate.
+     */
+    const readRemoteConsumerSchemaVersion = async (remote) => {
+        const meta = await remote.get(SYNC_META_DOC_ID).catch((error) => {
+            if (isMissing(error))
+                return null;
+            throw error;
+        });
+        return (meta === null || meta === void 0 ? void 0 : meta.consumerSchemaVersion) || null;
+    };
     /**
      * Records this device's schema version on a remote, if it is the newest seen.
      *
@@ -4992,20 +5138,27 @@ async function execute(_stack, params) {
      * @param schemaVersion - The local schema version; a missing value writes nothing.
      * @param appVersion - The local application version, stored for diagnostics.
      */
-    const publishSchemaVersion = async (remote, schemaVersion, appVersion) => {
-        if (!schemaVersion)
+    const publishSchemaVersion = async (remote, schemaVersion, appVersion, consumerSchemaVersion) => {
+        if (!schemaVersion && !consumerSchemaVersion)
             return;
         const existing = await remote.get(SYNC_META_DOC_ID).catch((error) => {
             if (isMissing(error))
                 return null;
             throw error;
         });
-        const recorded = existing === null || existing === void 0 ? void 0 : existing.schemaVersion;
-        if (recorded && semver.valid(recorded) && semver.valid(schemaVersion) && !semver.gt(schemaVersion, recorded)) {
+        // Each version field is monotonic on its own: the marker records the highest
+        // either kind has ever reached, whichever device wrote it.
+        const advances = (candidate, recorded) => Boolean(candidate) && (!recorded
+            || !semver.valid(recorded) || !semver.valid(candidate)
+            || semver.gt(candidate, recorded));
+        const systemAdvances = advances(schemaVersion, existing === null || existing === void 0 ? void 0 : existing.schemaVersion);
+        const consumerAdvances = advances(consumerSchemaVersion, existing === null || existing === void 0 ? void 0 : existing.consumerSchemaVersion);
+        if (!systemAdvances && !consumerAdvances) {
             return;
         }
-        const doc = Object.assign(Object.assign({}, (existing || {})), { _id: SYNC_META_DOC_ID, schemaVersion,
-            appVersion, updatedAt: Date.now() });
+        const doc = Object.assign(Object.assign(Object.assign(Object.assign({}, (existing || {})), { _id: SYNC_META_DOC_ID, schemaVersion: systemAdvances ? schemaVersion : existing === null || existing === void 0 ? void 0 : existing.schemaVersion }), (consumerAdvances
+            ? { consumerSchemaVersion: consumerSchemaVersion }
+            : ((existing === null || existing === void 0 ? void 0 : existing.consumerSchemaVersion) ? { consumerSchemaVersion: existing.consumerSchemaVersion } : {}))), { appVersion, updatedAt: Date.now() });
         await remote.put(doc).catch((error) => {
             // Another device claimed the same version between the read and the write; its
             // document says the same thing this one would have.
@@ -5097,7 +5250,7 @@ async function execute(_stack, params) {
          * @throws {SyncSchemaMismatchError} When the remote is ahead of this device.
          */
         async start() {
-            const fnLogger = logger$2.child({ method: "start", stack: this.stack.name });
+            const fnLogger = logger$3.child({ method: "start", stack: this.stack.name });
             this.cancelled = false;
             this.setState("starting");
             try {
@@ -5136,7 +5289,7 @@ async function execute(_stack, params) {
                     this.replication.cancel();
                 }
                 catch (error) {
-                    logger$2.warn("Error while cancelling replication", { error, stack: this.stack.name });
+                    logger$3.warn("Error while cancelling replication", { error, stack: this.stack.name });
                 }
                 if (typeof this.replication.removeAllListeners === "function") {
                     this.replication.removeAllListeners();
@@ -5220,11 +5373,27 @@ async function execute(_stack, params) {
                     throw new SyncSchemaMismatchError(this.stack.name, localVersion, remoteVersion);
                 }
             }
+            // The consumer half of the gate: the system version cannot see consumer-patch
+            // skew - two devices on the same build always agree on it - so a device whose
+            // application patches trail the remote (deferred behind the document key, or
+            // an older build) would pull documents shaped by a schema it does not have,
+            // and the deferred replay would then propagate over them (ADR-0040). The
+            // ledger answers locally; a remote written only by older builds records
+            // nothing and gates nothing.
+            const localConsumer = await this.stack.getConsumerSchemaVersion();
+            const remoteConsumer = await readRemoteConsumerSchemaVersion(remote);
+            if (remoteConsumer && semver.valid(remoteConsumer)) {
+                const ahead = !localConsumer
+                    || (Boolean(semver.valid(localConsumer)) && semver.gt(remoteConsumer, localConsumer));
+                if (ahead) {
+                    throw new SyncSchemaMismatchError(this.stack.name, localConsumer !== null && localConsumer !== void 0 ? localConsumer : undefined, remoteConsumer, "consumer");
+                }
+            }
             // Only a device that writes to the remote gets to claim its schema version.
             // A pull-only device publishing would lock older peers out of a remote that
             // holds nothing they cannot read.
             if (this.direction !== "pull") {
-                await publishSchemaVersion(remote, localVersion, this.stack.appVersion);
+                await publishSchemaVersion(remote, localVersion, this.stack.appVersion, localConsumer);
             }
         }
         seededDocIdsFromPatches() {
@@ -7758,7 +7927,7 @@ async function execute(_stack, params) {
         const buffer = await crypto.subtle.digest('SHA-256', data);
         return Array.from(new Uint8Array(buffer)).map(b => b.toString(16).padStart(2, '0')).join('');
     };
-    const now = () => Date.now();
+    const now$1 = () => Date.now();
     /**
      * Represents an executable job that can perform background tasks.
      *
@@ -7829,7 +7998,7 @@ async function execute(_stack, params) {
                 jobId: this.model._id,
                 status: "PENDING",
                 triggerType,
-                startTime: now(),
+                startTime: now$1(),
                 runtimeArgs,
                 initialMetadata: this.model.metadata ? Object.assign({}, this.model.metadata) : undefined,
             };
@@ -7873,7 +8042,7 @@ async function execute(_stack, params) {
             if (!this.model.isEnabled) {
                 run.status = "SKIPPED";
                 run.errorMessage = `Job ${this.model._id} is disabled`;
-                run.endTime = now();
+                run.endTime = now$1();
                 run.durationMs = run.endTime - run.startTime;
                 await this.persistRun(run);
                 throw new Error(run.errorMessage);
@@ -7881,14 +8050,14 @@ async function execute(_stack, params) {
             if (await this.hasRunningInstance()) {
                 run.status = "SKIPPED";
                 run.errorMessage = `Job ${this.model._id} already has a running instance`;
-                run.endTime = now();
+                run.endTime = now$1();
                 run.durationMs = run.endTime - run.startTime;
                 await this.persistRun(run);
                 throw new Error(run.errorMessage);
             }
             try {
                 run.status = "RUNNING";
-                run.startTime = now();
+                run.startTime = now$1();
                 run = await this.persistRun(run);
                 const executor = this.hydrate();
                 const params = Object.assign(Object.assign({}, (this.model.defaultParams || {})), (runtimeArgs || {}));
@@ -7900,7 +8069,7 @@ async function execute(_stack, params) {
                     await this.persistJobMetadata(finalMetadata);
                 }
                 run.status = "SUCCESS";
-                run.endTime = now();
+                run.endTime = now$1();
                 run.durationMs = run.endTime - run.startTime;
                 return await this.persistRun(run);
             }
@@ -7908,7 +8077,7 @@ async function execute(_stack, params) {
                 run.status = "FAILURE";
                 run.errorMessage = (error === null || error === void 0 ? void 0 : error.message) || String(error);
                 run.errorStack = error === null || error === void 0 ? void 0 : error.stack;
-                run.endTime = now();
+                run.endTime = now$1();
                 run.durationMs = run.endTime - run.startTime;
                 return await this.persistRun(run);
             }
@@ -8171,7 +8340,7 @@ async function execute(_stack, params) {
      *
      * @module
      */
-    const logger$1 = createLogger().child({ module: "job-scheduler" });
+    const logger$2 = createLogger().child({ module: "job-scheduler" });
     /** The `_local/` document holding this device's schedule state. Never replicates. */
     const JOB_SCHEDULE_DOC_ID = "_local/docstack-job-schedule";
     const DEFAULTS = {
@@ -8321,7 +8490,7 @@ async function execute(_stack, params) {
                     if (pinned && pinned !== job.hash) {
                         // Fail closed. The content behind an unexpected hash is exactly the case
                         // the allow-list exists for.
-                        logger$1.warn("tick - job hash does not match the pinned value; not running", { jobId });
+                        logger$2.warn("tick - job hash does not match the pinned value; not running", { jobId });
                         report.skipped.push({ jobId, reason: "hash-mismatch" });
                         continue;
                     }
@@ -8331,7 +8500,7 @@ async function execute(_stack, params) {
                     }
                     const schedule = parseSchedule(job.schedule);
                     if (!schedule) {
-                        logger$1.warn("tick - job carries a schedule this client cannot read", {
+                        logger$2.warn("tick - job carries a schedule this client cannot read", {
                             jobId,
                             schedule: job.schedule,
                         });
@@ -8354,7 +8523,7 @@ async function execute(_stack, params) {
                         continue;
                     }
                     if (isImplausible(state.nextRunAt, schedule, at)) {
-                        logger$1.warn("tick - stored nextRunAt is further out than the schedule allows; recomputing", {
+                        logger$2.warn("tick - stored nextRunAt is further out than the schedule allows; recomputing", {
                             jobId,
                             nextRunAt: state.nextRunAt,
                         });
@@ -8402,7 +8571,7 @@ async function execute(_stack, params) {
                 // rejects if the content hash no longer matches. All three are outcomes, not
                 // crashes; the backoff is what keeps a permanently broken job from becoming
                 // a write per minute.
-                logger$1.warn("dispatch - scheduled job did not run", { jobId, error: (error === null || error === void 0 ? void 0 : error.message) || String(error) });
+                logger$2.warn("dispatch - scheduled job did not run", { jobId, error: (error === null || error === void 0 ? void 0 : error.message) || String(error) });
                 await this.recordOutcome(jobId, "FAILURE", options);
             }
             finally {
@@ -8449,11 +8618,11 @@ async function execute(_stack, params) {
                 if (!stale.length)
                     return 0;
                 await this.host.db.bulkDocs(stale.map((run) => (Object.assign(Object.assign({}, run), { status: "CANCELED", endTime: at, durationMs: at - run.startTime, errorMessage: "Run abandoned — the client stopped before it finished." }))));
-                logger$1.info("sweepAbandonedRuns - reaped abandoned runs", { count: stale.length });
+                logger$2.info("sweepAbandonedRuns - reaped abandoned runs", { count: stale.length });
                 return stale.length;
             }
             catch (error) {
-                logger$1.warn("sweepAbandonedRuns - could not sweep", { error: (error === null || error === void 0 ? void 0 : error.message) || String(error) });
+                logger$2.warn("sweepAbandonedRuns - could not sweep", { error: (error === null || error === void 0 ? void 0 : error.message) || String(error) });
                 return 0;
             }
         }
@@ -8478,7 +8647,7 @@ async function execute(_stack, params) {
             catch (error) {
                 // A 409 means another tick wrote first; its state is as good as this one's,
                 // and the next tick reads the winner.
-                logger$1.warn("writeState - could not persist schedule state", {
+                logger$2.warn("writeState - could not persist schedule state", {
                     error: (error === null || error === void 0 ? void 0 : error.message) || String(error),
                 });
             }
@@ -9267,115 +9436,3191 @@ async function execute(_stack, params) {
     }
 
     /**
-     * Moving a stack's *content* between databases, without its datamodel.
-     *
-     * `stack.dump()` is the other kind of export: every document exactly as stored, which
-     * means class models, patches, users, sessions, policies, design documents - and
-     * encrypted attributes as unreadable {@link EncryptedPayload} blobs. That is a debugging
-     * tool and a backup of one database.
-     *
-     * This is the portable one. It carries the documents an application put in, in the clear,
-     * so that {@link ClientStack.importContent} can place them into a *different* stack -
-     * different device, different key, schema built by that stack's own patches.
+     * The write journal of one transaction: authored documents keyed by id, in memory.
      *
-     * @module
+     * Also partitioned by class (`~class`, or `~domain` for relations) so a read can ask
+     * "could this stage affect a query over class X" in O(1) - the overlay only pays the
+     * merge for queries whose class the transaction actually touched (ADR-0039).
      */
-    /** The envelope format identifier, so an importer can refuse what it does not understand. */
-    const CONTENT_EXPORT_FORMAT = "docstack/content-export@1";
+    class TransactionStage {
+        constructor() {
+            this.entries = new Map();
+            this.partitions = new Map();
+        }
+        partitionKeys(doc) {
+            const keys = [];
+            const className = doc["~class"];
+            const domainName = doc["~domain"];
+            if (typeof className === "string")
+                keys.push(className);
+            if (typeof domainName === "string")
+                keys.push(domainName);
+            return keys;
+        }
+        /**
+         * Stages an entry. Re-staging an id replaces the document but keeps the original
+         * `baseRev` and `isNew` - the conflict check is against the world as it was when
+         * the transaction first touched the id, not against its own previous draft.
+         */
+        set(id, entry) {
+            var _a;
+            const existing = this.entries.get(id);
+            if (existing) {
+                for (const key of this.partitionKeys(existing.doc)) {
+                    (_a = this.partitions.get(key)) === null || _a === void 0 ? void 0 : _a.delete(id);
+                }
+                entry = Object.assign(Object.assign({}, entry), { baseRev: existing.baseRev, isNew: existing.isNew });
+            }
+            this.entries.set(id, entry);
+            for (const key of this.partitionKeys(entry.doc)) {
+                let ids = this.partitions.get(key);
+                if (!ids)
+                    this.partitions.set(key, (ids = new Set()));
+                ids.add(id);
+            }
+        }
+        get(id) {
+            return this.entries.get(id);
+        }
+        has(id) {
+            return this.entries.has(id);
+        }
+        get size() {
+            return this.entries.size;
+        }
+        ids() {
+            return [...this.entries.keys()];
+        }
+        /** Entries in stage order (insertion order of first staging). */
+        values() {
+            return [...this.entries.values()];
+        }
+        hasPartition(name) {
+            var _a, _b;
+            return ((_b = (_a = this.partitions.get(name)) === null || _a === void 0 ? void 0 : _a.size) !== null && _b !== void 0 ? _b : 0) > 0;
+        }
+        /** Keeps only the given ids - what a partial commit leaves behind. */
+        retain(ids) {
+            for (const id of [...this.entries.keys()]) {
+                if (!ids.has(id))
+                    this.remove(id);
+            }
+        }
+        /**
+         * A point-in-time copy of the journal, for {@link restore}. Used by the patch
+         * chain (ADR-0044) to unwind exactly one patch's staging - a pre-apply job's
+         * writes included - when a locked refusal converts that patch to a deferral
+         * while the already-staged prefix goes on to commit.
+         */
+        snapshot() {
+            return new Map(this.entries);
+        }
+        restore(snapshot) {
+            this.clear();
+            for (const [id, entry] of snapshot) {
+                this.set(id, entry);
+            }
+        }
+        remove(id) {
+            var _a;
+            const entry = this.entries.get(id);
+            if (!entry)
+                return;
+            for (const key of this.partitionKeys(entry.doc)) {
+                (_a = this.partitions.get(key)) === null || _a === void 0 ? void 0 : _a.delete(id);
+            }
+            this.entries.delete(id);
+        }
+        clear() {
+            this.entries.clear();
+            this.partitions.clear();
+        }
+    }
+
     /**
-     * `~class` values that describe the stack rather than hold its content.
+     * Errors of the transaction engine (ADR-0039).
      *
-     * `~self` is the bootstrap class-of-classes; `class` and `superclass` are class models;
-     * `domain` is a relation definition; `patch` is the local ledger of applied patches.
+     * Every one of them leaves the database untouched: a transaction failure is a refusal,
+     * never a partial application. The one exception is named where it happens -
+     * a commit on a non-atomic adapter can land a subset, and that outcome is reported as
+     * a `partial` status on the handle, not thrown as one of these.
+     *
+     * @module
      */
-    const META_CLASSES = ["~self", "class", "superclass", "domain", "patch"];
+    /** Raised by `beginTransaction()` on a stack opened without `transactions: true`. */
+    class TransactionsDisabledError extends Error {
+        constructor(stackName) {
+            super(`Stack '${stackName}' was opened without 'transactions: true'. ` +
+                `Transactions are enabled per stack through its configuration, like encryption.`);
+            this.name = "TransactionsDisabledError";
+        }
+    }
+    /** Raised when a handle is used in a state that cannot accept the operation. */
+    class TransactionStateError extends Error {
+        constructor(transactionId, status, operation) {
+            super(`Transaction '${transactionId}' is '${status}' and cannot ${operation}.`);
+            this.name = "TransactionStateError";
+        }
+    }
     /**
-     * Reports whether a class name belongs to application content.
-     *
-     * DocStack names everything it owns with a leading `~` - `~User`, `~Group`, `~Policy`,
-     * `~Job`, `~JobRun`, `~UserSession`, `~AuthModule`, `~lock` - and reserves the handful of
-     * unprefixed names in {@link META_CLASSES} for the datamodel itself. Everything else was
-     * created by an application.
-     *
-     * @param className - A `~class` value or class-model id.
-     *
-     * @example
-     * ```typescript
-     * isContentClassName("Task");   // true
-     * isContentClassName("~User");  // false - DocStack's own
-     * isContentClassName("class");  // false - a class model
-     * ```
+     * Raised when the validation sweep refuses a document - at stage time (the write is
+     * not staged) or at commit time (nothing is written, the transaction stays open).
      */
-    const isContentClassName = (className) => {
-        if (typeof className !== "string" || !className.length)
-            return false;
-        if (className.startsWith("~"))
-            return false;
-        return !META_CLASSES.includes(className);
-    };
+    class TransactionValidationError extends Error {
+        constructor(message, docId) {
+            super(message);
+            this.name = "TransactionValidationError";
+            this.docId = docId;
+        }
+    }
     /**
-     * Reports whether a document is application content rather than part of the stack.
-     *
-     * @param doc - Any stored document.
+     * Raised by commit when a staged document's base revision no longer matches the
+     * stored winner - a direct write, another transaction's commit, or replication moved
+     * it. Nothing is written; the transaction stays open for re-staging or discard.
      */
-    const isContentDocument = (doc) => {
-        if (!doc || typeof doc._id !== "string")
-            return false;
-        // A design document has no `~class` and would fall through the class test.
-        if (doc._id.startsWith("_"))
-            return false;
-        return isContentClassName(doc["~class"]);
-    };
+    class TransactionConflictError extends Error {
+        constructor(conflicts) {
+            super(`Commit refused: ${conflicts.length} staged document(s) changed underneath the transaction: ` +
+                conflicts.map(conflict => conflict.id).join(", "));
+            this.name = "TransactionConflictError";
+            this.conflicts = conflicts;
+        }
+    }
     /**
-     * Reports whether a document is an application relation.
-     *
-     * Relations carry `~domain` and no `~class` (see `isRelation` in `@docstack/shared`), so
-     * they need their own test rather than falling out of {@link isContentDocument}.
-     *
-     * @param doc - Any stored document.
+     * Raised at stage time for documents transactions cannot carry: class models (their
+     * write propagates to other documents mid-pipeline and cannot be staged or rolled
+     * back - ADR-0039), `_local/` device state, and design documents.
      */
-    const isContentRelation = (doc) => {
-        if (!doc || typeof doc._id !== "string")
-            return false;
-        if (doc["~class"] !== undefined)
-            return false;
-        return isContentClassName(doc["~domain"]);
-    };
-    /** Fields PouchDB owns, or that describe one database's copy of a document. */
-    const TRANSIENT_FIELDS = ["_rev", "_revisions", "_revs_info", "_conflicts", "_deleted"];
+    class TransactionUnsupportedDocError extends Error {
+        constructor(docId, reason) {
+            super(`Document '${docId}' cannot be staged: ${reason}`);
+            this.name = "TransactionUnsupportedDocError";
+        }
+    }
+
     /**
-     * Strips the fields that belong to the source database rather than to the document.
-     *
-     * `_rev` above all: a revision from one database means nothing in another, and carrying
-     * it into an import turns every write into a conflict.
-     *
-     * @param doc - The document to clean.
-     * @returns A copy without the transient fields.
+     * Resolves a class from the transaction's own stage: the ADR-0043 rule
+     * (the batch outranks the store - it is what is about to be committed) applied to
+     * staging. A patch chain's job can create documents of a class an earlier patch
+     * staged (ADR-0044), and the sweep must judge them by that staged model, not by a
+     * committed predecessor or a not-found. Built DETACHED - `Class.get` + `setModel`,
+     * never `buildFromModel`, which writes rev-less models (ADR-0043).
      */
-    const stripTransientFields = (doc) => {
-        const clone = Object.assign({}, doc);
-        for (const field of TRANSIENT_FIELDS)
-            delete clone[field];
-        return clone;
+    const classFromStage = (stack, stage, className) => {
+        for (const entry of stage.values()) {
+            const doc = entry.doc;
+            if (entry.op !== "delete" && isClassModel(doc) && (doc._id === className || doc.name === className)) {
+                const built = Class.get(stack, doc._id, doc.name, doc["~class"], doc.description, doc.schema, { subscribe: false });
+                built.setModel(doc);
+                return built;
+            }
+        }
+        return null;
     };
     /**
-     * Validates an import payload's envelope before anything is written.
+     * The validation sweep - the transaction's atomicity boundary in practice.
      *
-     * A plain validator rather than an `asserts` signature: the caller already types its
-     * parameter, so there is nothing to narrow, and an assertion function reached through an
-     * import needs a declaration TypeScript can see (TS2775).
-     *
-     * @param payload - The value handed to {@link ClientStack.importContent}.
-     * @throws Error when it is not a content export this version understands.
+     * Runs read-only checks against public stack APIs: it decides whether a document
+     * *could* be written, and touches nothing. Stage time runs it so a bad write fails at
+     * the call site with zero consequences; commit re-runs it so the batch is judged
+     * against the world as it stands at commit. The commit-time pipeline (the plugin's
+     * `bulkDocs`) remains the sole authority - this sweep is a deliberate subset, and a
+     * document it passes can still be refused there, atomically for the whole batch.
      */
-    const assertContentExport = (payload) => {
-        const value = payload;
-        if (!value || typeof value !== "object") {
-            throw new Error("importContent - payload is not a content export.");
+    const sweepEntry = async (stack, stage, entry, options) => {
+        var _a;
+        const doc = entry.doc;
+        const docId = doc._id;
+        if (typeof docId === "string") {
+            if (docId.startsWith("_local/")) {
+                throw new TransactionUnsupportedDocError(docId, "'_local/' documents are device state, not transactional content.");
+            }
+            if (docId.startsWith("_design/")) {
+                throw new TransactionUnsupportedDocError(docId, "design documents are index machinery, not transactional content.");
+            }
         }
-        if (value.format !== CONTENT_EXPORT_FORMAT) {
-            throw new Error(`importContent - unsupported format '${String(value.format)}'. ` +
-                `This build reads '${CONTENT_EXPORT_FORMAT}'.`);
+        if (isClassModel(doc)) {
+            // Public transactions refuse class models: a class commit's propagation is a
+            // side effect beyond the batch, and a public handle promises none (ADR-0039).
+            // An INTERNAL handle - patch application, ADR-0042 - claims only staged
+            // validation and a single class-write batch, so it stages them; the parent
+            // validation the pipeline would run at commit runs here instead, where a
+            // refusal still costs nothing.
+            if (!(options === null || options === void 0 ? void 0 : options.allowClassModels)) {
+                throw new TransactionUnsupportedDocError(docId, "a class-model write propagates to the class's documents mid-pipeline and cannot be staged or rolled back (ADR-0039).");
+            }
+            const parentName = doc["~class"];
+            if (parentName !== "~self") {
+                const parentClass = await stack.getClass(parentName);
+                if (!parentClass) {
+                    throw new TransactionValidationError(`Parent class '${parentName}' not found for class model '${docId}'.`, docId);
+                }
+                const valid = await parentClass.validate(doc);
+                if (!valid) {
+                    throw new TransactionValidationError(`Class model '${docId}' is not valid for its parent class '${parentName}'.`, docId);
+                }
+            }
+            return;
+        }
+        if (isPatch(doc)) {
+            throw new TransactionUnsupportedDocError(docId, "patches carry class models and apply through 'applyPatch'.");
+        }
+        // A hard delete carries no content to validate; write access is still the
+        // author's to prove - unless this is DocStack's own machinery (an internal
+        // handle: patch application runs before any session exists, and the patch
+        // path's direct writes never pass through policy either - ADR-0044).
+        if (entry.op === "delete") {
+            const type = doc["~class"];
+            if (typeof type === "string" && !(options === null || options === void 0 ? void 0 : options.skipPolicy)) {
+                await stack.policyEngine.ensureWriteAllowed(type, doc);
+            }
+            return;
+        }
+        if (isRelation(doc)) {
+            const domain = await stack.getDomain(doc["~domain"]);
+            if (!domain) {
+                throw new TransactionValidationError(`Domain not found: ${doc["~domain"]}`, docId);
+            }
+            // An endpoint is resolvable if it is committed, or staged in this same
+            // transaction - the batch commits together (the plugin resolves batch-mates
+            // since ADR-0039).
+            for (const endpoint of [doc.sourceId, doc.targetId]) {
+                if (stage.has(endpoint) && stage.get(endpoint).op !== "delete")
+                    continue;
+                const stored = await stack.db.get(endpoint).catch(() => null);
+                if (!stored) {
+                    throw new TransactionValidationError(`Relation endpoint '${endpoint}' does not exist, committed or staged, for domain '${domain.name}'.`, docId);
+                }
+            }
+            return;
+        }
+        const type = doc["~class"];
+        if (typeof type !== "string" || !type) {
+            throw new TransactionValidationError(`Document '${docId}' carries no '~class'.`, docId);
+        }
+        if (stack.isSimpleClass(type))
+            return;
+        const classObj = (_a = classFromStage(stack, stage, type)) !== null && _a !== void 0 ? _a : await stack.getClassSnapshot(type).catch(() => null);
+        if (!classObj) {
+            throw new TransactionValidationError(`Class '${type}' not found for document '${docId}'.`, docId);
+        }
+        // Same refusal the plugin makes (ADR-0018): a locked stack cannot encrypt, and
+        // committing later while still locked would land the fields in the clear.
+        if (classObj.getEncryptedAttributes().length && stack.isLocked()) {
+            throw new StackLockedError(type);
+        }
+        const valid = await classObj.validate(doc);
+        if (!valid) {
+            throw new TransactionValidationError(`Document '${docId}' does not validate against class '${type}'.`, docId);
+        }
+        if (!(options === null || options === void 0 ? void 0 : options.skipPolicy)) {
+            await stack.policyEngine.ensureWriteAllowed(type, doc);
+        }
+    };
+
+    class PouchError extends Error {
+      constructor(status, error, reason) {
+        super();
+        this.status = status;
+        this.name = error;
+        this.message = reason;
+        this.error = true;
+      }
+
+      toString() {
+        return JSON.stringify({
+          status: this.status,
+          name: this.name,
+          message: this.message,
+          reason: this.reason
+        });
+      }
+    }
+
+    new PouchError(401, 'unauthorized', "Name or password is incorrect.");
+    new PouchError(400, 'bad_request', "Missing JSON list of 'docs'");
+    new PouchError(404, 'not_found', 'missing');
+    new PouchError(409, 'conflict', 'Document update conflict');
+    new PouchError(400, 'bad_request', '_id field must contain a string');
+    new PouchError(412, 'missing_id', '_id is required for puts');
+    new PouchError(400, 'bad_request', 'Only reserved document ids may start with underscore.');
+    new PouchError(412, 'precondition_failed', 'Database not open');
+    new PouchError(500, 'unknown_error', 'Database encountered an unknown error');
+    new PouchError(500, 'badarg', 'Some query argument is invalid');
+    new PouchError(400, 'invalid_request', 'Request was invalid');
+    new PouchError(400, 'query_parse_error', 'Some query parameter is invalid');
+    new PouchError(500, 'doc_validation', 'Bad special document member');
+    new PouchError(400, 'bad_request', 'Something wrong with the request');
+    new PouchError(400, 'bad_request', 'Document must be a JSON object');
+    new PouchError(404, 'not_found', 'Database not found');
+    new PouchError(500, 'indexed_db_went_bad', 'unknown');
+    new PouchError(500, 'web_sql_went_bad', 'unknown');
+    new PouchError(500, 'levelDB_went_went_bad', 'unknown');
+    new PouchError(403, 'forbidden', 'Forbidden by design doc validate_doc_update function');
+    new PouchError(400, 'bad_request', 'Invalid rev format');
+    new PouchError(412, 'file_exists', 'The database could not be created, the file already exists.');
+    new PouchError(412, 'missing_stub', 'A pre-existing attachment stub wasn\'t found');
+    new PouchError(413, 'invalid_url', 'Provided URL is invalid');
+
+    var events = {exports: {}};
+
+    var R = typeof Reflect === 'object' ? Reflect : null;
+    var ReflectApply = R && typeof R.apply === 'function'
+      ? R.apply
+      : function ReflectApply(target, receiver, args) {
+        return Function.prototype.apply.call(target, receiver, args);
+      };
+
+    var ReflectOwnKeys;
+    if (R && typeof R.ownKeys === 'function') {
+      ReflectOwnKeys = R.ownKeys;
+    } else if (Object.getOwnPropertySymbols) {
+      ReflectOwnKeys = function ReflectOwnKeys(target) {
+        return Object.getOwnPropertyNames(target)
+          .concat(Object.getOwnPropertySymbols(target));
+      };
+    } else {
+      ReflectOwnKeys = function ReflectOwnKeys(target) {
+        return Object.getOwnPropertyNames(target);
+      };
+    }
+
+    function ProcessEmitWarning(warning) {
+      if (console && console.warn) console.warn(warning);
+    }
+
+    var NumberIsNaN = Number.isNaN || function NumberIsNaN(value) {
+      return value !== value;
+    };
+
+    function EventEmitter() {
+      EventEmitter.init.call(this);
+    }
+    events.exports = EventEmitter;
+    events.exports.once = once;
+
+    // Backwards-compat with node 0.10.x
+    EventEmitter.EventEmitter = EventEmitter;
+
+    EventEmitter.prototype._events = undefined;
+    EventEmitter.prototype._eventsCount = 0;
+    EventEmitter.prototype._maxListeners = undefined;
+
+    // By default EventEmitters will print a warning if more than 10 listeners are
+    // added to it. This is a useful default which helps finding memory leaks.
+    var defaultMaxListeners = 10;
+
+    function checkListener(listener) {
+      if (typeof listener !== 'function') {
+        throw new TypeError('The "listener" argument must be of type Function. Received type ' + typeof listener);
+      }
+    }
+
+    Object.defineProperty(EventEmitter, 'defaultMaxListeners', {
+      enumerable: true,
+      get: function() {
+        return defaultMaxListeners;
+      },
+      set: function(arg) {
+        if (typeof arg !== 'number' || arg < 0 || NumberIsNaN(arg)) {
+          throw new RangeError('The value of "defaultMaxListeners" is out of range. It must be a non-negative number. Received ' + arg + '.');
+        }
+        defaultMaxListeners = arg;
+      }
+    });
+
+    EventEmitter.init = function() {
+
+      if (this._events === undefined ||
+          this._events === Object.getPrototypeOf(this)._events) {
+        this._events = Object.create(null);
+        this._eventsCount = 0;
+      }
+
+      this._maxListeners = this._maxListeners || undefined;
+    };
+
+    // Obviously not all Emitters should be limited to 10. This function allows
+    // that to be increased. Set to zero for unlimited.
+    EventEmitter.prototype.setMaxListeners = function setMaxListeners(n) {
+      if (typeof n !== 'number' || n < 0 || NumberIsNaN(n)) {
+        throw new RangeError('The value of "n" is out of range. It must be a non-negative number. Received ' + n + '.');
+      }
+      this._maxListeners = n;
+      return this;
+    };
+
+    function _getMaxListeners(that) {
+      if (that._maxListeners === undefined)
+        return EventEmitter.defaultMaxListeners;
+      return that._maxListeners;
+    }
+
+    EventEmitter.prototype.getMaxListeners = function getMaxListeners() {
+      return _getMaxListeners(this);
+    };
+
+    EventEmitter.prototype.emit = function emit(type) {
+      var args = [];
+      for (var i = 1; i < arguments.length; i++) args.push(arguments[i]);
+      var doError = (type === 'error');
+
+      var events = this._events;
+      if (events !== undefined)
+        doError = (doError && events.error === undefined);
+      else if (!doError)
+        return false;
+
+      // If there is no 'error' event listener then throw.
+      if (doError) {
+        var er;
+        if (args.length > 0)
+          er = args[0];
+        if (er instanceof Error) {
+          // Note: The comments on the `throw` lines are intentional, they show
+          // up in Node's output if this results in an unhandled exception.
+          throw er; // Unhandled 'error' event
+        }
+        // At least give some kind of context to the user
+        var err = new Error('Unhandled error.' + (er ? ' (' + er.message + ')' : ''));
+        err.context = er;
+        throw err; // Unhandled 'error' event
+      }
+
+      var handler = events[type];
+
+      if (handler === undefined)
+        return false;
+
+      if (typeof handler === 'function') {
+        ReflectApply(handler, this, args);
+      } else {
+        var len = handler.length;
+        var listeners = arrayClone(handler, len);
+        for (var i = 0; i < len; ++i)
+          ReflectApply(listeners[i], this, args);
+      }
+
+      return true;
+    };
+
+    function _addListener(target, type, listener, prepend) {
+      var m;
+      var events;
+      var existing;
+
+      checkListener(listener);
+
+      events = target._events;
+      if (events === undefined) {
+        events = target._events = Object.create(null);
+        target._eventsCount = 0;
+      } else {
+        // To avoid recursion in the case that type === "newListener"! Before
+        // adding it to the listeners, first emit "newListener".
+        if (events.newListener !== undefined) {
+          target.emit('newListener', type,
+                      listener.listener ? listener.listener : listener);
+
+          // Re-assign `events` because a newListener handler could have caused the
+          // this._events to be assigned to a new object
+          events = target._events;
+        }
+        existing = events[type];
+      }
+
+      if (existing === undefined) {
+        // Optimize the case of one listener. Don't need the extra array object.
+        existing = events[type] = listener;
+        ++target._eventsCount;
+      } else {
+        if (typeof existing === 'function') {
+          // Adding the second element, need to change to array.
+          existing = events[type] =
+            prepend ? [listener, existing] : [existing, listener];
+          // If we've already got an array, just append.
+        } else if (prepend) {
+          existing.unshift(listener);
+        } else {
+          existing.push(listener);
+        }
+
+        // Check for listener leak
+        m = _getMaxListeners(target);
+        if (m > 0 && existing.length > m && !existing.warned) {
+          existing.warned = true;
+          // No error code for this since it is a Warning
+          // eslint-disable-next-line no-restricted-syntax
+          var w = new Error('Possible EventEmitter memory leak detected. ' +
+                              existing.length + ' ' + String(type) + ' listeners ' +
+                              'added. Use emitter.setMaxListeners() to ' +
+                              'increase limit');
+          w.name = 'MaxListenersExceededWarning';
+          w.emitter = target;
+          w.type = type;
+          w.count = existing.length;
+          ProcessEmitWarning(w);
+        }
+      }
+
+      return target;
+    }
+
+    EventEmitter.prototype.addListener = function addListener(type, listener) {
+      return _addListener(this, type, listener, false);
+    };
+
+    EventEmitter.prototype.on = EventEmitter.prototype.addListener;
+
+    EventEmitter.prototype.prependListener =
+        function prependListener(type, listener) {
+          return _addListener(this, type, listener, true);
+        };
+
+    function onceWrapper() {
+      if (!this.fired) {
+        this.target.removeListener(this.type, this.wrapFn);
+        this.fired = true;
+        if (arguments.length === 0)
+          return this.listener.call(this.target);
+        return this.listener.apply(this.target, arguments);
+      }
+    }
+
+    function _onceWrap(target, type, listener) {
+      var state = { fired: false, wrapFn: undefined, target: target, type: type, listener: listener };
+      var wrapped = onceWrapper.bind(state);
+      wrapped.listener = listener;
+      state.wrapFn = wrapped;
+      return wrapped;
+    }
+
+    EventEmitter.prototype.once = function once(type, listener) {
+      checkListener(listener);
+      this.on(type, _onceWrap(this, type, listener));
+      return this;
+    };
+
+    EventEmitter.prototype.prependOnceListener =
+        function prependOnceListener(type, listener) {
+          checkListener(listener);
+          this.prependListener(type, _onceWrap(this, type, listener));
+          return this;
+        };
+
+    // Emits a 'removeListener' event if and only if the listener was removed.
+    EventEmitter.prototype.removeListener =
+        function removeListener(type, listener) {
+          var list, events, position, i, originalListener;
+
+          checkListener(listener);
+
+          events = this._events;
+          if (events === undefined)
+            return this;
+
+          list = events[type];
+          if (list === undefined)
+            return this;
+
+          if (list === listener || list.listener === listener) {
+            if (--this._eventsCount === 0)
+              this._events = Object.create(null);
+            else {
+              delete events[type];
+              if (events.removeListener)
+                this.emit('removeListener', type, list.listener || listener);
+            }
+          } else if (typeof list !== 'function') {
+            position = -1;
+
+            for (i = list.length - 1; i >= 0; i--) {
+              if (list[i] === listener || list[i].listener === listener) {
+                originalListener = list[i].listener;
+                position = i;
+                break;
+              }
+            }
+
+            if (position < 0)
+              return this;
+
+            if (position === 0)
+              list.shift();
+            else {
+              spliceOne(list, position);
+            }
+
+            if (list.length === 1)
+              events[type] = list[0];
+
+            if (events.removeListener !== undefined)
+              this.emit('removeListener', type, originalListener || listener);
+          }
+
+          return this;
+        };
+
+    EventEmitter.prototype.off = EventEmitter.prototype.removeListener;
+
+    EventEmitter.prototype.removeAllListeners =
+        function removeAllListeners(type) {
+          var listeners, events, i;
+
+          events = this._events;
+          if (events === undefined)
+            return this;
+
+          // not listening for removeListener, no need to emit
+          if (events.removeListener === undefined) {
+            if (arguments.length === 0) {
+              this._events = Object.create(null);
+              this._eventsCount = 0;
+            } else if (events[type] !== undefined) {
+              if (--this._eventsCount === 0)
+                this._events = Object.create(null);
+              else
+                delete events[type];
+            }
+            return this;
+          }
+
+          // emit removeListener for all listeners on all events
+          if (arguments.length === 0) {
+            var keys = Object.keys(events);
+            var key;
+            for (i = 0; i < keys.length; ++i) {
+              key = keys[i];
+              if (key === 'removeListener') continue;
+              this.removeAllListeners(key);
+            }
+            this.removeAllListeners('removeListener');
+            this._events = Object.create(null);
+            this._eventsCount = 0;
+            return this;
+          }
+
+          listeners = events[type];
+
+          if (typeof listeners === 'function') {
+            this.removeListener(type, listeners);
+          } else if (listeners !== undefined) {
+            // LIFO order
+            for (i = listeners.length - 1; i >= 0; i--) {
+              this.removeListener(type, listeners[i]);
+            }
+          }
+
+          return this;
+        };
+
+    function _listeners(target, type, unwrap) {
+      var events = target._events;
+
+      if (events === undefined)
+        return [];
+
+      var evlistener = events[type];
+      if (evlistener === undefined)
+        return [];
+
+      if (typeof evlistener === 'function')
+        return unwrap ? [evlistener.listener || evlistener] : [evlistener];
+
+      return unwrap ?
+        unwrapListeners(evlistener) : arrayClone(evlistener, evlistener.length);
+    }
+
+    EventEmitter.prototype.listeners = function listeners(type) {
+      return _listeners(this, type, true);
+    };
+
+    EventEmitter.prototype.rawListeners = function rawListeners(type) {
+      return _listeners(this, type, false);
+    };
+
+    EventEmitter.listenerCount = function(emitter, type) {
+      if (typeof emitter.listenerCount === 'function') {
+        return emitter.listenerCount(type);
+      } else {
+        return listenerCount.call(emitter, type);
+      }
+    };
+
+    EventEmitter.prototype.listenerCount = listenerCount;
+    function listenerCount(type) {
+      var events = this._events;
+
+      if (events !== undefined) {
+        var evlistener = events[type];
+
+        if (typeof evlistener === 'function') {
+          return 1;
+        } else if (evlistener !== undefined) {
+          return evlistener.length;
+        }
+      }
+
+      return 0;
+    }
+
+    EventEmitter.prototype.eventNames = function eventNames() {
+      return this._eventsCount > 0 ? ReflectOwnKeys(this._events) : [];
+    };
+
+    function arrayClone(arr, n) {
+      var copy = new Array(n);
+      for (var i = 0; i < n; ++i)
+        copy[i] = arr[i];
+      return copy;
+    }
+
+    function spliceOne(list, index) {
+      for (; index + 1 < list.length; index++)
+        list[index] = list[index + 1];
+      list.pop();
+    }
+
+    function unwrapListeners(arr) {
+      var ret = new Array(arr.length);
+      for (var i = 0; i < ret.length; ++i) {
+        ret[i] = arr[i].listener || arr[i];
+      }
+      return ret;
+    }
+
+    function once(emitter, name) {
+      return new Promise(function (resolve, reject) {
+        function errorListener(err) {
+          emitter.removeListener(name, resolver);
+          reject(err);
+        }
+
+        function resolver() {
+          if (typeof emitter.removeListener === 'function') {
+            emitter.removeListener('error', errorListener);
+          }
+          resolve([].slice.call(arguments));
+        }
+        eventTargetAgnosticAddListener(emitter, name, resolver, { once: true });
+        if (name !== 'error') {
+          addErrorHandlerIfEventEmitter(emitter, errorListener, { once: true });
+        }
+      });
+    }
+
+    function addErrorHandlerIfEventEmitter(emitter, handler, flags) {
+      if (typeof emitter.on === 'function') {
+        eventTargetAgnosticAddListener(emitter, 'error', handler, flags);
+      }
+    }
+
+    function eventTargetAgnosticAddListener(emitter, name, listener, flags) {
+      if (typeof emitter.on === 'function') {
+        if (flags.once) {
+          emitter.once(name, listener);
+        } else {
+          emitter.on(name, listener);
+        }
+      } else if (typeof emitter.addEventListener === 'function') {
+        // EventTarget does not have `error` event semantics like Node
+        // EventEmitters, we do not listen for `error` events here.
+        emitter.addEventListener(name, function wrapListener(arg) {
+          // IE does not have builtin `{ once: true }` support so we
+          // have to do it manually.
+          if (flags.once) {
+            emitter.removeEventListener(name, wrapListener);
+          }
+          listener(arg);
+        });
+      } else {
+        throw new TypeError('The "emitter" argument must be of type EventEmitter. Received type ' + typeof emitter);
+      }
+    }
+
+    var sparkMd5 = {exports: {}};
+
+    (function (module, exports$1) {
+    	(function (factory) {
+    	    {
+    	        // Node/CommonJS
+    	        module.exports = factory();
+    	    }
+    	}(function (undefined$1) {
+
+    	    /*
+    	     * Fastest md5 implementation around (JKM md5).
+    	     * Credits: Joseph Myers
+    	     *
+    	     * @see http://www.myersdaily.org/joseph/javascript/md5-text.html
+    	     * @see http://jsperf.com/md5-shootout/7
+    	     */
+
+    	    /* this function is much faster,
+    	      so if possible we use it. Some IEs
+    	      are the only ones I know of that
+    	      need the idiotic second function,
+    	      generated by an if clause.  */
+    	    var hex_chr = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'];
+
+    	    function md5cycle(x, k) {
+    	        var a = x[0],
+    	            b = x[1],
+    	            c = x[2],
+    	            d = x[3];
+
+    	        a += (b & c | ~b & d) + k[0] - 680876936 | 0;
+    	        a  = (a << 7 | a >>> 25) + b | 0;
+    	        d += (a & b | ~a & c) + k[1] - 389564586 | 0;
+    	        d  = (d << 12 | d >>> 20) + a | 0;
+    	        c += (d & a | ~d & b) + k[2] + 606105819 | 0;
+    	        c  = (c << 17 | c >>> 15) + d | 0;
+    	        b += (c & d | ~c & a) + k[3] - 1044525330 | 0;
+    	        b  = (b << 22 | b >>> 10) + c | 0;
+    	        a += (b & c | ~b & d) + k[4] - 176418897 | 0;
+    	        a  = (a << 7 | a >>> 25) + b | 0;
+    	        d += (a & b | ~a & c) + k[5] + 1200080426 | 0;
+    	        d  = (d << 12 | d >>> 20) + a | 0;
+    	        c += (d & a | ~d & b) + k[6] - 1473231341 | 0;
+    	        c  = (c << 17 | c >>> 15) + d | 0;
+    	        b += (c & d | ~c & a) + k[7] - 45705983 | 0;
+    	        b  = (b << 22 | b >>> 10) + c | 0;
+    	        a += (b & c | ~b & d) + k[8] + 1770035416 | 0;
+    	        a  = (a << 7 | a >>> 25) + b | 0;
+    	        d += (a & b | ~a & c) + k[9] - 1958414417 | 0;
+    	        d  = (d << 12 | d >>> 20) + a | 0;
+    	        c += (d & a | ~d & b) + k[10] - 42063 | 0;
+    	        c  = (c << 17 | c >>> 15) + d | 0;
+    	        b += (c & d | ~c & a) + k[11] - 1990404162 | 0;
+    	        b  = (b << 22 | b >>> 10) + c | 0;
+    	        a += (b & c | ~b & d) + k[12] + 1804603682 | 0;
+    	        a  = (a << 7 | a >>> 25) + b | 0;
+    	        d += (a & b | ~a & c) + k[13] - 40341101 | 0;
+    	        d  = (d << 12 | d >>> 20) + a | 0;
+    	        c += (d & a | ~d & b) + k[14] - 1502002290 | 0;
+    	        c  = (c << 17 | c >>> 15) + d | 0;
+    	        b += (c & d | ~c & a) + k[15] + 1236535329 | 0;
+    	        b  = (b << 22 | b >>> 10) + c | 0;
+
+    	        a += (b & d | c & ~d) + k[1] - 165796510 | 0;
+    	        a  = (a << 5 | a >>> 27) + b | 0;
+    	        d += (a & c | b & ~c) + k[6] - 1069501632 | 0;
+    	        d  = (d << 9 | d >>> 23) + a | 0;
+    	        c += (d & b | a & ~b) + k[11] + 643717713 | 0;
+    	        c  = (c << 14 | c >>> 18) + d | 0;
+    	        b += (c & a | d & ~a) + k[0] - 373897302 | 0;
+    	        b  = (b << 20 | b >>> 12) + c | 0;
+    	        a += (b & d | c & ~d) + k[5] - 701558691 | 0;
+    	        a  = (a << 5 | a >>> 27) + b | 0;
+    	        d += (a & c | b & ~c) + k[10] + 38016083 | 0;
+    	        d  = (d << 9 | d >>> 23) + a | 0;
+    	        c += (d & b | a & ~b) + k[15] - 660478335 | 0;
+    	        c  = (c << 14 | c >>> 18) + d | 0;
+    	        b += (c & a | d & ~a) + k[4] - 405537848 | 0;
+    	        b  = (b << 20 | b >>> 12) + c | 0;
+    	        a += (b & d | c & ~d) + k[9] + 568446438 | 0;
+    	        a  = (a << 5 | a >>> 27) + b | 0;
+    	        d += (a & c | b & ~c) + k[14] - 1019803690 | 0;
+    	        d  = (d << 9 | d >>> 23) + a | 0;
+    	        c += (d & b | a & ~b) + k[3] - 187363961 | 0;
+    	        c  = (c << 14 | c >>> 18) + d | 0;
+    	        b += (c & a | d & ~a) + k[8] + 1163531501 | 0;
+    	        b  = (b << 20 | b >>> 12) + c | 0;
+    	        a += (b & d | c & ~d) + k[13] - 1444681467 | 0;
+    	        a  = (a << 5 | a >>> 27) + b | 0;
+    	        d += (a & c | b & ~c) + k[2] - 51403784 | 0;
+    	        d  = (d << 9 | d >>> 23) + a | 0;
+    	        c += (d & b | a & ~b) + k[7] + 1735328473 | 0;
+    	        c  = (c << 14 | c >>> 18) + d | 0;
+    	        b += (c & a | d & ~a) + k[12] - 1926607734 | 0;
+    	        b  = (b << 20 | b >>> 12) + c | 0;
+
+    	        a += (b ^ c ^ d) + k[5] - 378558 | 0;
+    	        a  = (a << 4 | a >>> 28) + b | 0;
+    	        d += (a ^ b ^ c) + k[8] - 2022574463 | 0;
+    	        d  = (d << 11 | d >>> 21) + a | 0;
+    	        c += (d ^ a ^ b) + k[11] + 1839030562 | 0;
+    	        c  = (c << 16 | c >>> 16) + d | 0;
+    	        b += (c ^ d ^ a) + k[14] - 35309556 | 0;
+    	        b  = (b << 23 | b >>> 9) + c | 0;
+    	        a += (b ^ c ^ d) + k[1] - 1530992060 | 0;
+    	        a  = (a << 4 | a >>> 28) + b | 0;
+    	        d += (a ^ b ^ c) + k[4] + 1272893353 | 0;
+    	        d  = (d << 11 | d >>> 21) + a | 0;
+    	        c += (d ^ a ^ b) + k[7] - 155497632 | 0;
+    	        c  = (c << 16 | c >>> 16) + d | 0;
+    	        b += (c ^ d ^ a) + k[10] - 1094730640 | 0;
+    	        b  = (b << 23 | b >>> 9) + c | 0;
+    	        a += (b ^ c ^ d) + k[13] + 681279174 | 0;
+    	        a  = (a << 4 | a >>> 28) + b | 0;
+    	        d += (a ^ b ^ c) + k[0] - 358537222 | 0;
+    	        d  = (d << 11 | d >>> 21) + a | 0;
+    	        c += (d ^ a ^ b) + k[3] - 722521979 | 0;
+    	        c  = (c << 16 | c >>> 16) + d | 0;
+    	        b += (c ^ d ^ a) + k[6] + 76029189 | 0;
+    	        b  = (b << 23 | b >>> 9) + c | 0;
+    	        a += (b ^ c ^ d) + k[9] - 640364487 | 0;
+    	        a  = (a << 4 | a >>> 28) + b | 0;
+    	        d += (a ^ b ^ c) + k[12] - 421815835 | 0;
+    	        d  = (d << 11 | d >>> 21) + a | 0;
+    	        c += (d ^ a ^ b) + k[15] + 530742520 | 0;
+    	        c  = (c << 16 | c >>> 16) + d | 0;
+    	        b += (c ^ d ^ a) + k[2] - 995338651 | 0;
+    	        b  = (b << 23 | b >>> 9) + c | 0;
+
+    	        a += (c ^ (b | ~d)) + k[0] - 198630844 | 0;
+    	        a  = (a << 6 | a >>> 26) + b | 0;
+    	        d += (b ^ (a | ~c)) + k[7] + 1126891415 | 0;
+    	        d  = (d << 10 | d >>> 22) + a | 0;
+    	        c += (a ^ (d | ~b)) + k[14] - 1416354905 | 0;
+    	        c  = (c << 15 | c >>> 17) + d | 0;
+    	        b += (d ^ (c | ~a)) + k[5] - 57434055 | 0;
+    	        b  = (b << 21 |b >>> 11) + c | 0;
+    	        a += (c ^ (b | ~d)) + k[12] + 1700485571 | 0;
+    	        a  = (a << 6 | a >>> 26) + b | 0;
+    	        d += (b ^ (a | ~c)) + k[3] - 1894986606 | 0;
+    	        d  = (d << 10 | d >>> 22) + a | 0;
+    	        c += (a ^ (d | ~b)) + k[10] - 1051523 | 0;
+    	        c  = (c << 15 | c >>> 17) + d | 0;
+    	        b += (d ^ (c | ~a)) + k[1] - 2054922799 | 0;
+    	        b  = (b << 21 |b >>> 11) + c | 0;
+    	        a += (c ^ (b | ~d)) + k[8] + 1873313359 | 0;
+    	        a  = (a << 6 | a >>> 26) + b | 0;
+    	        d += (b ^ (a | ~c)) + k[15] - 30611744 | 0;
+    	        d  = (d << 10 | d >>> 22) + a | 0;
+    	        c += (a ^ (d | ~b)) + k[6] - 1560198380 | 0;
+    	        c  = (c << 15 | c >>> 17) + d | 0;
+    	        b += (d ^ (c | ~a)) + k[13] + 1309151649 | 0;
+    	        b  = (b << 21 |b >>> 11) + c | 0;
+    	        a += (c ^ (b | ~d)) + k[4] - 145523070 | 0;
+    	        a  = (a << 6 | a >>> 26) + b | 0;
+    	        d += (b ^ (a | ~c)) + k[11] - 1120210379 | 0;
+    	        d  = (d << 10 | d >>> 22) + a | 0;
+    	        c += (a ^ (d | ~b)) + k[2] + 718787259 | 0;
+    	        c  = (c << 15 | c >>> 17) + d | 0;
+    	        b += (d ^ (c | ~a)) + k[9] - 343485551 | 0;
+    	        b  = (b << 21 | b >>> 11) + c | 0;
+
+    	        x[0] = a + x[0] | 0;
+    	        x[1] = b + x[1] | 0;
+    	        x[2] = c + x[2] | 0;
+    	        x[3] = d + x[3] | 0;
+    	    }
+
+    	    function md5blk(s) {
+    	        var md5blks = [],
+    	            i; /* Andy King said do it this way. */
+
+    	        for (i = 0; i < 64; i += 4) {
+    	            md5blks[i >> 2] = s.charCodeAt(i) + (s.charCodeAt(i + 1) << 8) + (s.charCodeAt(i + 2) << 16) + (s.charCodeAt(i + 3) << 24);
+    	        }
+    	        return md5blks;
+    	    }
+
+    	    function md5blk_array(a) {
+    	        var md5blks = [],
+    	            i; /* Andy King said do it this way. */
+
+    	        for (i = 0; i < 64; i += 4) {
+    	            md5blks[i >> 2] = a[i] + (a[i + 1] << 8) + (a[i + 2] << 16) + (a[i + 3] << 24);
+    	        }
+    	        return md5blks;
+    	    }
+
+    	    function md51(s) {
+    	        var n = s.length,
+    	            state = [1732584193, -271733879, -1732584194, 271733878],
+    	            i,
+    	            length,
+    	            tail,
+    	            tmp,
+    	            lo,
+    	            hi;
+
+    	        for (i = 64; i <= n; i += 64) {
+    	            md5cycle(state, md5blk(s.substring(i - 64, i)));
+    	        }
+    	        s = s.substring(i - 64);
+    	        length = s.length;
+    	        tail = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+    	        for (i = 0; i < length; i += 1) {
+    	            tail[i >> 2] |= s.charCodeAt(i) << ((i % 4) << 3);
+    	        }
+    	        tail[i >> 2] |= 0x80 << ((i % 4) << 3);
+    	        if (i > 55) {
+    	            md5cycle(state, tail);
+    	            for (i = 0; i < 16; i += 1) {
+    	                tail[i] = 0;
+    	            }
+    	        }
+
+    	        // Beware that the final length might not fit in 32 bits so we take care of that
+    	        tmp = n * 8;
+    	        tmp = tmp.toString(16).match(/(.*?)(.{0,8})$/);
+    	        lo = parseInt(tmp[2], 16);
+    	        hi = parseInt(tmp[1], 16) || 0;
+
+    	        tail[14] = lo;
+    	        tail[15] = hi;
+
+    	        md5cycle(state, tail);
+    	        return state;
+    	    }
+
+    	    function md51_array(a) {
+    	        var n = a.length,
+    	            state = [1732584193, -271733879, -1732584194, 271733878],
+    	            i,
+    	            length,
+    	            tail,
+    	            tmp,
+    	            lo,
+    	            hi;
+
+    	        for (i = 64; i <= n; i += 64) {
+    	            md5cycle(state, md5blk_array(a.subarray(i - 64, i)));
+    	        }
+
+    	        // Not sure if it is a bug, however IE10 will always produce a sub array of length 1
+    	        // containing the last element of the parent array if the sub array specified starts
+    	        // beyond the length of the parent array - weird.
+    	        // https://connect.microsoft.com/IE/feedback/details/771452/typed-array-subarray-issue
+    	        a = (i - 64) < n ? a.subarray(i - 64) : new Uint8Array(0);
+
+    	        length = a.length;
+    	        tail = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+    	        for (i = 0; i < length; i += 1) {
+    	            tail[i >> 2] |= a[i] << ((i % 4) << 3);
+    	        }
+
+    	        tail[i >> 2] |= 0x80 << ((i % 4) << 3);
+    	        if (i > 55) {
+    	            md5cycle(state, tail);
+    	            for (i = 0; i < 16; i += 1) {
+    	                tail[i] = 0;
+    	            }
+    	        }
+
+    	        // Beware that the final length might not fit in 32 bits so we take care of that
+    	        tmp = n * 8;
+    	        tmp = tmp.toString(16).match(/(.*?)(.{0,8})$/);
+    	        lo = parseInt(tmp[2], 16);
+    	        hi = parseInt(tmp[1], 16) || 0;
+
+    	        tail[14] = lo;
+    	        tail[15] = hi;
+
+    	        md5cycle(state, tail);
+
+    	        return state;
+    	    }
+
+    	    function rhex(n) {
+    	        var s = '',
+    	            j;
+    	        for (j = 0; j < 4; j += 1) {
+    	            s += hex_chr[(n >> (j * 8 + 4)) & 0x0F] + hex_chr[(n >> (j * 8)) & 0x0F];
+    	        }
+    	        return s;
+    	    }
+
+    	    function hex(x) {
+    	        var i;
+    	        for (i = 0; i < x.length; i += 1) {
+    	            x[i] = rhex(x[i]);
+    	        }
+    	        return x.join('');
+    	    }
+
+    	    // In some cases the fast add32 function cannot be used..
+    	    if (hex(md51('hello')) !== '5d41402abc4b2a76b9719d911017c592') ;
+
+    	    // ---------------------------------------------------
+
+    	    /**
+    	     * ArrayBuffer slice polyfill.
+    	     *
+    	     * @see https://github.com/ttaubert/node-arraybuffer-slice
+    	     */
+
+    	    if (typeof ArrayBuffer !== 'undefined' && !ArrayBuffer.prototype.slice) {
+    	        (function () {
+    	            function clamp(val, length) {
+    	                val = (val | 0) || 0;
+
+    	                if (val < 0) {
+    	                    return Math.max(val + length, 0);
+    	                }
+
+    	                return Math.min(val, length);
+    	            }
+
+    	            ArrayBuffer.prototype.slice = function (from, to) {
+    	                var length = this.byteLength,
+    	                    begin = clamp(from, length),
+    	                    end = length,
+    	                    num,
+    	                    target,
+    	                    targetArray,
+    	                    sourceArray;
+
+    	                if (to !== undefined$1) {
+    	                    end = clamp(to, length);
+    	                }
+
+    	                if (begin > end) {
+    	                    return new ArrayBuffer(0);
+    	                }
+
+    	                num = end - begin;
+    	                target = new ArrayBuffer(num);
+    	                targetArray = new Uint8Array(target);
+
+    	                sourceArray = new Uint8Array(this, begin, num);
+    	                targetArray.set(sourceArray);
+
+    	                return target;
+    	            };
+    	        })();
+    	    }
+
+    	    // ---------------------------------------------------
+
+    	    /**
+    	     * Helpers.
+    	     */
+
+    	    function toUtf8(str) {
+    	        if (/[\u0080-\uFFFF]/.test(str)) {
+    	            str = unescape(encodeURIComponent(str));
+    	        }
+
+    	        return str;
+    	    }
+
+    	    function utf8Str2ArrayBuffer(str, returnUInt8Array) {
+    	        var length = str.length,
+    	           buff = new ArrayBuffer(length),
+    	           arr = new Uint8Array(buff),
+    	           i;
+
+    	        for (i = 0; i < length; i += 1) {
+    	            arr[i] = str.charCodeAt(i);
+    	        }
+
+    	        return returnUInt8Array ? arr : buff;
+    	    }
+
+    	    function arrayBuffer2Utf8Str(buff) {
+    	        return String.fromCharCode.apply(null, new Uint8Array(buff));
+    	    }
+
+    	    function concatenateArrayBuffers(first, second, returnUInt8Array) {
+    	        var result = new Uint8Array(first.byteLength + second.byteLength);
+
+    	        result.set(new Uint8Array(first));
+    	        result.set(new Uint8Array(second), first.byteLength);
+
+    	        return result ;
+    	    }
+
+    	    function hexToBinaryString(hex) {
+    	        var bytes = [],
+    	            length = hex.length,
+    	            x;
+
+    	        for (x = 0; x < length - 1; x += 2) {
+    	            bytes.push(parseInt(hex.substr(x, 2), 16));
+    	        }
+
+    	        return String.fromCharCode.apply(String, bytes);
+    	    }
+
+    	    // ---------------------------------------------------
+
+    	    /**
+    	     * SparkMD5 OOP implementation.
+    	     *
+    	     * Use this class to perform an incremental md5, otherwise use the
+    	     * static methods instead.
+    	     */
+
+    	    function SparkMD5() {
+    	        // call reset to init the instance
+    	        this.reset();
+    	    }
+
+    	    /**
+    	     * Appends a string.
+    	     * A conversion will be applied if an utf8 string is detected.
+    	     *
+    	     * @param {String} str The string to be appended
+    	     *
+    	     * @return {SparkMD5} The instance itself
+    	     */
+    	    SparkMD5.prototype.append = function (str) {
+    	        // Converts the string to utf8 bytes if necessary
+    	        // Then append as binary
+    	        this.appendBinary(toUtf8(str));
+
+    	        return this;
+    	    };
+
+    	    /**
+    	     * Appends a binary string.
+    	     *
+    	     * @param {String} contents The binary string to be appended
+    	     *
+    	     * @return {SparkMD5} The instance itself
+    	     */
+    	    SparkMD5.prototype.appendBinary = function (contents) {
+    	        this._buff += contents;
+    	        this._length += contents.length;
+
+    	        var length = this._buff.length,
+    	            i;
+
+    	        for (i = 64; i <= length; i += 64) {
+    	            md5cycle(this._hash, md5blk(this._buff.substring(i - 64, i)));
+    	        }
+
+    	        this._buff = this._buff.substring(i - 64);
+
+    	        return this;
+    	    };
+
+    	    /**
+    	     * Finishes the incremental computation, reseting the internal state and
+    	     * returning the result.
+    	     *
+    	     * @param {Boolean} raw True to get the raw string, false to get the hex string
+    	     *
+    	     * @return {String} The result
+    	     */
+    	    SparkMD5.prototype.end = function (raw) {
+    	        var buff = this._buff,
+    	            length = buff.length,
+    	            i,
+    	            tail = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    	            ret;
+
+    	        for (i = 0; i < length; i += 1) {
+    	            tail[i >> 2] |= buff.charCodeAt(i) << ((i % 4) << 3);
+    	        }
+
+    	        this._finish(tail, length);
+    	        ret = hex(this._hash);
+
+    	        if (raw) {
+    	            ret = hexToBinaryString(ret);
+    	        }
+
+    	        this.reset();
+
+    	        return ret;
+    	    };
+
+    	    /**
+    	     * Resets the internal state of the computation.
+    	     *
+    	     * @return {SparkMD5} The instance itself
+    	     */
+    	    SparkMD5.prototype.reset = function () {
+    	        this._buff = '';
+    	        this._length = 0;
+    	        this._hash = [1732584193, -271733879, -1732584194, 271733878];
+
+    	        return this;
+    	    };
+
+    	    /**
+    	     * Gets the internal state of the computation.
+    	     *
+    	     * @return {Object} The state
+    	     */
+    	    SparkMD5.prototype.getState = function () {
+    	        return {
+    	            buff: this._buff,
+    	            length: this._length,
+    	            hash: this._hash.slice()
+    	        };
+    	    };
+
+    	    /**
+    	     * Gets the internal state of the computation.
+    	     *
+    	     * @param {Object} state The state
+    	     *
+    	     * @return {SparkMD5} The instance itself
+    	     */
+    	    SparkMD5.prototype.setState = function (state) {
+    	        this._buff = state.buff;
+    	        this._length = state.length;
+    	        this._hash = state.hash;
+
+    	        return this;
+    	    };
+
+    	    /**
+    	     * Releases memory used by the incremental buffer and other additional
+    	     * resources. If you plan to use the instance again, use reset instead.
+    	     */
+    	    SparkMD5.prototype.destroy = function () {
+    	        delete this._hash;
+    	        delete this._buff;
+    	        delete this._length;
+    	    };
+
+    	    /**
+    	     * Finish the final calculation based on the tail.
+    	     *
+    	     * @param {Array}  tail   The tail (will be modified)
+    	     * @param {Number} length The length of the remaining buffer
+    	     */
+    	    SparkMD5.prototype._finish = function (tail, length) {
+    	        var i = length,
+    	            tmp,
+    	            lo,
+    	            hi;
+
+    	        tail[i >> 2] |= 0x80 << ((i % 4) << 3);
+    	        if (i > 55) {
+    	            md5cycle(this._hash, tail);
+    	            for (i = 0; i < 16; i += 1) {
+    	                tail[i] = 0;
+    	            }
+    	        }
+
+    	        // Do the final computation based on the tail and length
+    	        // Beware that the final length may not fit in 32 bits so we take care of that
+    	        tmp = this._length * 8;
+    	        tmp = tmp.toString(16).match(/(.*?)(.{0,8})$/);
+    	        lo = parseInt(tmp[2], 16);
+    	        hi = parseInt(tmp[1], 16) || 0;
+
+    	        tail[14] = lo;
+    	        tail[15] = hi;
+    	        md5cycle(this._hash, tail);
+    	    };
+
+    	    /**
+    	     * Performs the md5 hash on a string.
+    	     * A conversion will be applied if utf8 string is detected.
+    	     *
+    	     * @param {String}  str The string
+    	     * @param {Boolean} [raw] True to get the raw string, false to get the hex string
+    	     *
+    	     * @return {String} The result
+    	     */
+    	    SparkMD5.hash = function (str, raw) {
+    	        // Converts the string to utf8 bytes if necessary
+    	        // Then compute it using the binary function
+    	        return SparkMD5.hashBinary(toUtf8(str), raw);
+    	    };
+
+    	    /**
+    	     * Performs the md5 hash on a binary string.
+    	     *
+    	     * @param {String}  content The binary string
+    	     * @param {Boolean} [raw]     True to get the raw string, false to get the hex string
+    	     *
+    	     * @return {String} The result
+    	     */
+    	    SparkMD5.hashBinary = function (content, raw) {
+    	        var hash = md51(content),
+    	            ret = hex(hash);
+
+    	        return raw ? hexToBinaryString(ret) : ret;
+    	    };
+
+    	    // ---------------------------------------------------
+
+    	    /**
+    	     * SparkMD5 OOP implementation for array buffers.
+    	     *
+    	     * Use this class to perform an incremental md5 ONLY for array buffers.
+    	     */
+    	    SparkMD5.ArrayBuffer = function () {
+    	        // call reset to init the instance
+    	        this.reset();
+    	    };
+
+    	    /**
+    	     * Appends an array buffer.
+    	     *
+    	     * @param {ArrayBuffer} arr The array to be appended
+    	     *
+    	     * @return {SparkMD5.ArrayBuffer} The instance itself
+    	     */
+    	    SparkMD5.ArrayBuffer.prototype.append = function (arr) {
+    	        var buff = concatenateArrayBuffers(this._buff.buffer, arr),
+    	            length = buff.length,
+    	            i;
+
+    	        this._length += arr.byteLength;
+
+    	        for (i = 64; i <= length; i += 64) {
+    	            md5cycle(this._hash, md5blk_array(buff.subarray(i - 64, i)));
+    	        }
+
+    	        this._buff = (i - 64) < length ? new Uint8Array(buff.buffer.slice(i - 64)) : new Uint8Array(0);
+
+    	        return this;
+    	    };
+
+    	    /**
+    	     * Finishes the incremental computation, reseting the internal state and
+    	     * returning the result.
+    	     *
+    	     * @param {Boolean} raw True to get the raw string, false to get the hex string
+    	     *
+    	     * @return {String} The result
+    	     */
+    	    SparkMD5.ArrayBuffer.prototype.end = function (raw) {
+    	        var buff = this._buff,
+    	            length = buff.length,
+    	            tail = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+    	            i,
+    	            ret;
+
+    	        for (i = 0; i < length; i += 1) {
+    	            tail[i >> 2] |= buff[i] << ((i % 4) << 3);
+    	        }
+
+    	        this._finish(tail, length);
+    	        ret = hex(this._hash);
+
+    	        if (raw) {
+    	            ret = hexToBinaryString(ret);
+    	        }
+
+    	        this.reset();
+
+    	        return ret;
+    	    };
+
+    	    /**
+    	     * Resets the internal state of the computation.
+    	     *
+    	     * @return {SparkMD5.ArrayBuffer} The instance itself
+    	     */
+    	    SparkMD5.ArrayBuffer.prototype.reset = function () {
+    	        this._buff = new Uint8Array(0);
+    	        this._length = 0;
+    	        this._hash = [1732584193, -271733879, -1732584194, 271733878];
+
+    	        return this;
+    	    };
+
+    	    /**
+    	     * Gets the internal state of the computation.
+    	     *
+    	     * @return {Object} The state
+    	     */
+    	    SparkMD5.ArrayBuffer.prototype.getState = function () {
+    	        var state = SparkMD5.prototype.getState.call(this);
+
+    	        // Convert buffer to a string
+    	        state.buff = arrayBuffer2Utf8Str(state.buff);
+
+    	        return state;
+    	    };
+
+    	    /**
+    	     * Gets the internal state of the computation.
+    	     *
+    	     * @param {Object} state The state
+    	     *
+    	     * @return {SparkMD5.ArrayBuffer} The instance itself
+    	     */
+    	    SparkMD5.ArrayBuffer.prototype.setState = function (state) {
+    	        // Convert string to buffer
+    	        state.buff = utf8Str2ArrayBuffer(state.buff, true);
+
+    	        return SparkMD5.prototype.setState.call(this, state);
+    	    };
+
+    	    SparkMD5.ArrayBuffer.prototype.destroy = SparkMD5.prototype.destroy;
+
+    	    SparkMD5.ArrayBuffer.prototype._finish = SparkMD5.prototype._finish;
+
+    	    /**
+    	     * Performs the md5 hash on an array buffer.
+    	     *
+    	     * @param {ArrayBuffer} arr The array buffer
+    	     * @param {Boolean}     [raw] True to get the raw string, false to get the hex one
+    	     *
+    	     * @return {String} The result
+    	     */
+    	    SparkMD5.ArrayBuffer.hash = function (arr, raw) {
+    	        var hash = md51_array(new Uint8Array(arr)),
+    	            ret = hex(hash);
+
+    	        return raw ? hexToBinaryString(ret) : ret;
+    	    };
+
+    	    return SparkMD5;
+    	})); 
+    } (sparkMd5));
+
+    function isBinaryObject(object) {
+      return (typeof ArrayBuffer !== 'undefined' && object instanceof ArrayBuffer) ||
+        (typeof Blob !== 'undefined' && object instanceof Blob);
+    }
+
+    /**
+     * @template {ArrayBuffer | Blob} T
+     * @param {T} object
+     * @returns {T}
+     */
+    function cloneBinaryObject(object) {
+      return object instanceof ArrayBuffer
+        ? object.slice(0)
+        : object.slice(0, object.size, object.type);
+    }
+
+    // most of this is borrowed from lodash.isPlainObject:
+    // https://github.com/fis-components/lodash.isplainobject/
+    // blob/29c358140a74f252aeb08c9eb28bef86f2217d4a/index.js
+
+    var funcToString = Function.prototype.toString;
+    var objectCtorString = funcToString.call(Object);
+
+    function isPlainObject(value) {
+      var proto = Object.getPrototypeOf(value);
+      /* istanbul ignore if */
+      if (proto === null) { // not sure when this happens, but I guess it can
+        return true;
+      }
+      var Ctor = proto.constructor;
+      return (typeof Ctor == 'function' &&
+        Ctor instanceof Ctor && funcToString.call(Ctor) == objectCtorString);
+    }
+
+    function clone(object) {
+      var newObject;
+      var i;
+      var len;
+
+      if (!object || typeof object !== 'object') {
+        return object;
+      }
+
+      if (Array.isArray(object)) {
+        newObject = [];
+        for (i = 0, len = object.length; i < len; i++) {
+          newObject[i] = clone(object[i]);
+        }
+        return newObject;
+      }
+
+      // special case: to avoid inconsistencies between IndexedDB
+      // and other backends, we automatically stringify Dates
+      if (object instanceof Date && isFinite(object)) {
+        return object.toISOString();
+      }
+
+      if (isBinaryObject(object)) {
+        return cloneBinaryObject(object);
+      }
+
+      if (!isPlainObject(object)) {
+        return object; // don't clone objects like Workers
+      }
+
+      newObject = {};
+      for (i in object) {
+        /* istanbul ignore else */
+        if (Object.prototype.hasOwnProperty.call(object, i)) {
+          var value = clone(object[i]);
+          if (typeof value !== 'undefined') {
+            newObject[i] = value;
+          }
+        }
+      }
+      return newObject;
+    }
+
+    var hasLocal;
+
+    try {
+      localStorage.setItem('_pouch_check_localstorage', 1);
+      hasLocal = !!localStorage.getItem('_pouch_check_localstorage');
+    } catch (e) {
+      hasLocal = false;
+    }
+
+    function collate(a, b) {
+
+      if (a === b) {
+        return 0;
+      }
+
+      a = normalizeKey(a);
+      b = normalizeKey(b);
+
+      var ai = collationIndex(a);
+      var bi = collationIndex(b);
+      if ((ai - bi) !== 0) {
+        return ai - bi;
+      }
+      switch (typeof a) {
+        case 'number':
+          return a - b;
+        case 'boolean':
+          return a < b ? -1 : 1;
+        case 'string':
+          return stringCollate(a, b);
+      }
+      return Array.isArray(a) ? arrayCollate(a, b) : objectCollate(a, b);
+    }
+
+    // couch considers null/NaN/Infinity/-Infinity === undefined,
+    // for the purposes of mapreduce indexes. also, dates get stringified.
+    function normalizeKey(key) {
+      switch (typeof key) {
+        case 'undefined':
+          return null;
+        case 'number':
+          if (key === Infinity || key === -Infinity || isNaN(key)) {
+            return null;
+          }
+          return key;
+        case 'object':
+          var origKey = key;
+          if (Array.isArray(key)) {
+            var len = key.length;
+            key = new Array(len);
+            for (var i = 0; i < len; i++) {
+              key[i] = normalizeKey(origKey[i]);
+            }
+          /* istanbul ignore next */
+          } else if (key instanceof Date) {
+            return key.toJSON();
+          } else if (key !== null) { // generic object
+            key = {};
+            for (var k in origKey) {
+              if (Object.prototype.hasOwnProperty.call(origKey, k)) {
+                var val = origKey[k];
+                if (typeof val !== 'undefined') {
+                  key[k] = normalizeKey(val);
+                }
+              }
+            }
+          }
+      }
+      return key;
+    }
+
+    function arrayCollate(a, b) {
+      var len = Math.min(a.length, b.length);
+      for (var i = 0; i < len; i++) {
+        var sort = collate(a[i], b[i]);
+        if (sort !== 0) {
+          return sort;
+        }
+      }
+      return (a.length === b.length) ? 0 :
+        (a.length > b.length) ? 1 : -1;
+    }
+    function stringCollate(a, b) {
+      // See: https://github.com/daleharvey/pouchdb/issues/40
+      // This is incompatible with the CouchDB implementation, but its the
+      // best we can do for now
+      return (a === b) ? 0 : ((a > b) ? 1 : -1);
+    }
+    function objectCollate(a, b) {
+      var ak = Object.keys(a), bk = Object.keys(b);
+      var len = Math.min(ak.length, bk.length);
+      for (var i = 0; i < len; i++) {
+        // First sort the keys
+        var sort = collate(ak[i], bk[i]);
+        if (sort !== 0) {
+          return sort;
+        }
+        // if the keys are equal sort the values
+        sort = collate(a[ak[i]], b[bk[i]]);
+        if (sort !== 0) {
+          return sort;
+        }
+
+      }
+      return (ak.length === bk.length) ? 0 :
+        (ak.length > bk.length) ? 1 : -1;
+    }
+    // The collation is defined by erlangs ordered terms
+    // the atoms null, true, false come first, then numbers, strings,
+    // arrays, then objects
+    // null/undefined/NaN/Infinity/-Infinity are all considered null
+    function collationIndex(x) {
+      var id = ['boolean', 'number', 'string', 'object'];
+      var idx = id.indexOf(typeof x);
+      //false if -1 otherwise true, but fast!!!!1
+      if (~idx) {
+        if (x === null) {
+          return 1;
+        }
+        if (Array.isArray(x)) {
+          return 5;
+        }
+        return idx < 3 ? (idx + 2) : (idx + 3);
+      }
+      /* istanbul ignore next */
+      if (Array.isArray(x)) {
+        return 5;
+      }
+    }
+
+    // this would just be "return doc[field]", but fields
+    // can be "deep" due to dot notation
+    function getFieldFromDoc(doc, parsedField) {
+      var value = doc;
+      for (var i = 0, len = parsedField.length; i < len; i++) {
+        var key = parsedField[i];
+        value = value[key];
+        if (!value) {
+          break;
+        }
+      }
+      return value;
+    }
+
+    function compare(left, right) {
+      return left < right ? -1 : left > right ? 1 : 0;
+    }
+
+    // Converts a string in dot notation to an array of its components, with backslash escaping
+    function parseField(fieldName) {
+      // fields may be deep (e.g. "foo.bar.baz"), so parse
+      var fields = [];
+      var current = '';
+      for (var i = 0, len = fieldName.length; i < len; i++) {
+        var ch = fieldName[i];
+        if (i > 0 && fieldName[i - 1] === '\\' && (ch === '$' || ch === '.')) {
+          // escaped delimiter
+          current = current.substring(0, current.length - 1) + ch;
+        } else if (ch === '.') {
+          // When `.` is not escaped (above), it is a field delimiter
+          fields.push(current);
+          current = '';
+        } else { // normal character
+          current += ch;
+        }
+      }
+      fields.push(current);
+      return fields;
+    }
+
+    var combinationFields = ['$or', '$nor', '$not'];
+    function isCombinationalField(field) {
+      return combinationFields.indexOf(field) > -1;
+    }
+
+    function getKey(obj) {
+      return Object.keys(obj)[0];
+    }
+
+    function getValue(obj) {
+      return obj[getKey(obj)];
+    }
+
+
+    // flatten an array of selectors joined by an $and operator
+    function mergeAndedSelectors(selectors) {
+
+      // sort to ensure that e.g. if the user specified
+      // $and: [{$gt: 'a'}, {$gt: 'b'}], then it's collapsed into
+      // just {$gt: 'b'}
+      var res = {};
+      var first = {$or: true, $nor: true};
+
+      selectors.forEach(function (selector) {
+        Object.keys(selector).forEach(function (field) {
+          var matcher = selector[field];
+          if (typeof matcher !== 'object') {
+            matcher = {$eq: matcher};
+          }
+
+          if (isCombinationalField(field)) {
+            // or, nor
+            if (matcher instanceof Array) {
+              if (first[field]) {
+                first[field] = false;
+                res[field] = matcher;
+                return;
+              }
+
+              var entries = [];
+              res[field].forEach(function (existing) {
+                Object.keys(matcher).forEach(function (key) {
+                  var m = matcher[key];
+                  var longest = Math.max(Object.keys(existing).length, Object.keys(m).length);
+                  var merged = mergeAndedSelectors([existing, m]);
+                  if (Object.keys(merged).length <= longest) {
+                    // we have a situation like: (a :{$eq :1} || ...) && (a {$eq: 2} || ...)
+                    // merging would produce a $eq 2 when actually we shouldn't ever match against these merged conditions
+                    // merged should always contain more values to be valid
+                    return;
+                  }
+                  entries.push(merged);
+                });
+              });
+              res[field] = entries;
+            } else {
+              // not
+              res[field] = mergeAndedSelectors([matcher]);
+            }
+          } else {
+            var fieldMatchers = res[field] = res[field] || {};
+            Object.keys(matcher).forEach(function (operator) {
+              var value = matcher[operator];
+
+              if (operator === '$gt' || operator === '$gte') {
+                return mergeGtGte(operator, value, fieldMatchers);
+              } else if (operator === '$lt' || operator === '$lte') {
+                return mergeLtLte(operator, value, fieldMatchers);
+              } else if (operator === '$ne') {
+                return mergeNe(value, fieldMatchers);
+              } else if (operator === '$eq') {
+                return mergeEq(value, fieldMatchers);
+              } else if (operator === "$regex") {
+                return mergeRegex(value, fieldMatchers);
+              }
+              fieldMatchers[operator] = value;
+            });
+          }
+        });
+      });
+
+      return res;
+    }
+
+
+
+    // collapse logically equivalent gt/gte values
+    function mergeGtGte(operator, value, fieldMatchers) {
+      if (typeof fieldMatchers.$eq !== 'undefined') {
+        return; // do nothing
+      }
+      if (typeof fieldMatchers.$gte !== 'undefined') {
+        if (operator === '$gte') {
+          if (value > fieldMatchers.$gte) { // more specificity
+            fieldMatchers.$gte = value;
+          }
+        } else { // operator === '$gt'
+          if (value >= fieldMatchers.$gte) { // more specificity
+            delete fieldMatchers.$gte;
+            fieldMatchers.$gt = value;
+          }
+        }
+      } else if (typeof fieldMatchers.$gt !== 'undefined') {
+        if (operator === '$gte') {
+          if (value > fieldMatchers.$gt) { // more specificity
+            delete fieldMatchers.$gt;
+            fieldMatchers.$gte = value;
+          }
+        } else { // operator === '$gt'
+          if (value > fieldMatchers.$gt) { // more specificity
+            fieldMatchers.$gt = value;
+          }
+        }
+      } else {
+        fieldMatchers[operator] = value;
+      }
+    }
+
+    // collapse logically equivalent lt/lte values
+    function mergeLtLte(operator, value, fieldMatchers) {
+      if (typeof fieldMatchers.$eq !== 'undefined') {
+        return; // do nothing
+      }
+      if (typeof fieldMatchers.$lte !== 'undefined') {
+        if (operator === '$lte') {
+          if (value < fieldMatchers.$lte) { // more specificity
+            fieldMatchers.$lte = value;
+          }
+        } else { // operator === '$gt'
+          if (value <= fieldMatchers.$lte) { // more specificity
+            delete fieldMatchers.$lte;
+            fieldMatchers.$lt = value;
+          }
+        }
+      } else if (typeof fieldMatchers.$lt !== 'undefined') {
+        if (operator === '$lte') {
+          if (value < fieldMatchers.$lt) { // more specificity
+            delete fieldMatchers.$lt;
+            fieldMatchers.$lte = value;
+          }
+        } else { // operator === '$gt'
+          if (value < fieldMatchers.$lt) { // more specificity
+            fieldMatchers.$lt = value;
+          }
+        }
+      } else {
+        fieldMatchers[operator] = value;
+      }
+    }
+
+    // combine $ne values into one array
+    function mergeNe(value, fieldMatchers) {
+      if ('$ne' in fieldMatchers) {
+        // there are many things this could "not" be
+        fieldMatchers.$ne.push(value);
+      } else { // doesn't exist yet
+        fieldMatchers.$ne = [value];
+      }
+    }
+
+    // add $eq into the mix
+    function mergeEq(value, fieldMatchers) {
+      // these all have less specificity than the $eq
+      // TODO: check for user errors here
+      delete fieldMatchers.$gt;
+      delete fieldMatchers.$gte;
+      delete fieldMatchers.$lt;
+      delete fieldMatchers.$lte;
+      delete fieldMatchers.$ne;
+      fieldMatchers.$eq = value;
+    }
+
+    // combine $regex values into one array
+    function mergeRegex(value, fieldMatchers) {
+      if ('$regex' in fieldMatchers) {
+        // a value could match multiple regexes
+        fieldMatchers.$regex.push(value);
+      } else { // doesn't exist yet
+        fieldMatchers.$regex = [value];
+      }
+    }
+
+    //#7458: execute function mergeAndedSelectors on nested $and
+    function mergeAndedSelectorsNested(obj) {
+        for (var prop in obj) {
+            if (Array.isArray(obj)) {
+                for (var i in obj) {
+                    if (obj[i]['$and']) {
+                        obj[i] = mergeAndedSelectors(obj[i]['$and']);
+                    }
+                }
+            }
+            var value = obj[prop];
+            if (typeof value === 'object') {
+                mergeAndedSelectorsNested(value); // <- recursive call
+            }
+        }
+        return obj;
+    }
+
+    //#7458: determine id $and is present in selector (at any level)
+    function isAndInSelector(obj, isAnd) {
+        for (var prop in obj) {
+            if (prop === '$and') {
+                isAnd = true;
+            }
+            var value = obj[prop];
+            if (typeof value === 'object') {
+                isAnd = isAndInSelector(value, isAnd); // <- recursive call
+            }
+        }
+        return isAnd;
+    }
+
+    //
+    // normalize the selector
+    //
+    function massageSelector(input) {
+      var result = clone(input);
+
+      //#7458: if $and is present in selector (at any level) merge nested $and
+      if (isAndInSelector(result, false)) {
+        result = mergeAndedSelectorsNested(result);
+        if ('$and' in result) {
+          result = mergeAndedSelectors(result['$and']);
+        }
+      }
+
+      ['$or', '$nor'].forEach(function (orOrNor) {
+        if (orOrNor in result) {
+          // message each individual selector
+          // e.g. {foo: 'bar'} becomes {foo: {$eq: 'bar'}}
+          result[orOrNor].forEach(function (subSelector) {
+            var fields = Object.keys(subSelector);
+            for (var i = 0; i < fields.length; i++) {
+              var field = fields[i];
+              var matcher = subSelector[field];
+              if (typeof matcher !== 'object' || matcher === null) {
+                subSelector[field] = {$eq: matcher};
+              }
+            }
+          });
+        }
+      });
+
+      if ('$not' in result) {
+        //This feels a little like forcing, but it will work for now,
+        //I would like to come back to this and make the merging of selectors a little more generic
+        result['$not'] = mergeAndedSelectors([result['$not']]);
+      }
+
+      var fields = Object.keys(result);
+
+      for (var i = 0; i < fields.length; i++) {
+        var field = fields[i];
+        var matcher = result[field];
+
+        if (typeof matcher !== 'object' || matcher === null) {
+          matcher = {$eq: matcher};
+        }
+        result[field] = matcher;
+      }
+
+      normalizeArrayOperators(result);
+
+      return result;
+    }
+
+    //
+    // The $ne and $regex values must be placed in an array because these operators can be used multiple times on the same field.
+    // When $and is used, mergeAndedSelectors takes care of putting some of them into arrays, otherwise it's done here.
+    //
+    function normalizeArrayOperators(selector) {
+      Object.keys(selector).forEach(function (field) {
+        var matcher = selector[field];
+
+        if (Array.isArray(matcher)) {
+          matcher.forEach(function (matcherItem) {
+            if (matcherItem && typeof matcherItem === 'object') {
+              normalizeArrayOperators(matcherItem);
+            }
+          });
+        } else if (field === '$ne') {
+          selector.$ne = [matcher];
+        } else if (field === '$regex') {
+          selector.$regex = [matcher];
+        } else if (matcher && typeof matcher === 'object') {
+          normalizeArrayOperators(matcher);
+        }
+      });
+    }
+
+    // create a comparator based on the sort object
+    function createFieldSorter(sort) {
+
+      function getFieldValuesAsArray(doc) {
+        return sort.map(function (sorting) {
+          var fieldName = getKey(sorting);
+          var parsedField = parseField(fieldName);
+          var docFieldValue = getFieldFromDoc(doc, parsedField);
+          return docFieldValue;
+        });
+      }
+
+      return function (aRow, bRow) {
+        var aFieldValues = getFieldValuesAsArray(aRow.doc);
+        var bFieldValues = getFieldValuesAsArray(bRow.doc);
+        var collation = collate(aFieldValues, bFieldValues);
+        if (collation !== 0) {
+          return collation;
+        }
+        // this is what mango seems to do
+        return compare(aRow.doc._id, bRow.doc._id);
+      };
+    }
+
+    function filterInMemoryFields(rows, requestDef, inMemoryFields) {
+      rows = rows.filter(function (row) {
+        return rowFilter(row.doc, requestDef.selector, inMemoryFields);
+      });
+
+      if (requestDef.sort) {
+        // in-memory sort
+        var fieldSorter = createFieldSorter(requestDef.sort);
+        rows = rows.sort(fieldSorter);
+        if (typeof requestDef.sort[0] !== 'string' &&
+            getValue(requestDef.sort[0]) === 'desc') {
+          rows = rows.reverse();
+        }
+      }
+
+      if ('limit' in requestDef || 'skip' in requestDef) {
+        // have to do the limit in-memory
+        var skip = requestDef.skip || 0;
+        var limit = ('limit' in requestDef ? requestDef.limit : rows.length) + skip;
+        rows = rows.slice(skip, limit);
+      }
+      return rows;
+    }
+
+    function rowFilter(doc, selector, inMemoryFields) {
+      return inMemoryFields.every(function (field) {
+        var matcher = selector[field];
+        var parsedField = parseField(field);
+        var docFieldValue = getFieldFromDoc(doc, parsedField);
+        if (isCombinationalField(field)) {
+          return matchCominationalSelector(field, matcher, doc);
+        }
+
+        return matchSelector(matcher, doc, parsedField, docFieldValue);
+      });
+    }
+
+    function matchSelector(matcher, doc, parsedField, docFieldValue) {
+      if (!matcher) {
+        // no filtering necessary; this field is just needed for sorting
+        return true;
+      }
+
+      // is matcher an object, if so continue recursion
+      if (typeof matcher === 'object') {
+        return Object.keys(matcher).every(function (maybeUserOperator) {
+          var userValue = matcher[ maybeUserOperator ];
+          // explicit operator
+          if (maybeUserOperator.indexOf("$") === 0) {
+            return match(maybeUserOperator, doc, userValue, parsedField, docFieldValue);
+          } else {
+            var subParsedField = parseField(maybeUserOperator);
+
+            if (
+              docFieldValue === undefined &&
+              typeof userValue !== "object" &&
+              subParsedField.length > 0
+            ) {
+              // the field does not exist, return or getFieldFromDoc will throw
+              return false;
+            }
+
+            var subDocFieldValue = getFieldFromDoc(docFieldValue, subParsedField);
+
+            if (typeof userValue === "object") {
+              // field value is an object that might contain more operators
+              return matchSelector(userValue, doc, parsedField, subDocFieldValue);
+            }
+
+            // implicit operator
+            return match("$eq", doc, userValue, subParsedField, subDocFieldValue);
+          }
+        });
+      }
+
+      // no more depth, No need to recurse further
+      return matcher === docFieldValue;
+    }
+
+    function matchCominationalSelector(field, matcher, doc) {
+
+      if (field === '$or') {
+        return matcher.some(function (orMatchers) {
+          return rowFilter(doc, orMatchers, Object.keys(orMatchers));
+        });
+      }
+
+      if (field === '$not') {
+        return !rowFilter(doc, matcher, Object.keys(matcher));
+      }
+
+      //`$nor`
+      return !matcher.find(function (orMatchers) {
+        return rowFilter(doc, orMatchers, Object.keys(orMatchers));
+      });
+
+    }
+
+    function match(userOperator, doc, userValue, parsedField, docFieldValue) {
+      if (!matchers[userOperator]) {
+        /* istanbul ignore next */
+        throw new Error('unknown operator "' + userOperator +
+          '" - should be one of $eq, $lte, $lt, $gt, $gte, $exists, $ne, $in, ' +
+          '$nin, $size, $mod, $regex, $elemMatch, $type, $allMatch or $all');
+      }
+      return matchers[userOperator](doc, userValue, parsedField, docFieldValue);
+    }
+
+    function fieldExists(docFieldValue) {
+      return typeof docFieldValue !== 'undefined' && docFieldValue !== null;
+    }
+
+    function fieldIsNotUndefined(docFieldValue) {
+      return typeof docFieldValue !== 'undefined';
+    }
+
+    function modField(docFieldValue, userValue) {
+      if (typeof docFieldValue !== "number" ||
+        parseInt(docFieldValue, 10) !== docFieldValue) {
+        return false;
+      }
+
+      var divisor = userValue[0];
+      var mod = userValue[1];
+
+      return docFieldValue % divisor === mod;
+    }
+
+    function arrayContainsValue(docFieldValue, userValue) {
+      return userValue.some(function (val) {
+        if (docFieldValue instanceof Array) {
+          return docFieldValue.some(function (docFieldValueItem) {
+            return collate(val, docFieldValueItem) === 0;
+          });
+        }
+
+        return collate(val, docFieldValue) === 0;
+      });
+    }
+
+    function arrayContainsAllValues(docFieldValue, userValue) {
+      return userValue.every(function (val) {
+        return docFieldValue.some(function (docFieldValueItem) {
+          return collate(val, docFieldValueItem) === 0;
+        });
+      });
+    }
+
+    function arraySize(docFieldValue, userValue) {
+      return docFieldValue.length === userValue;
+    }
+
+    function regexMatch(docFieldValue, userValue) {
+      var re = new RegExp(userValue);
+
+      return re.test(docFieldValue);
+    }
+
+    function typeMatch(docFieldValue, userValue) {
+
+      switch (userValue) {
+        case 'null':
+          return docFieldValue === null;
+        case 'boolean':
+          return typeof (docFieldValue) === 'boolean';
+        case 'number':
+          return typeof (docFieldValue) === 'number';
+        case 'string':
+          return typeof (docFieldValue) === 'string';
+        case 'array':
+          return docFieldValue instanceof Array;
+        case 'object':
+          return ({}).toString.call(docFieldValue) === '[object Object]';
+      }
+    }
+
+    var matchers = {
+
+      '$elemMatch': function (doc, userValue, parsedField, docFieldValue) {
+        if (!Array.isArray(docFieldValue)) {
+          return false;
+        }
+
+        if (docFieldValue.length === 0) {
+          return false;
+        }
+
+        if (typeof docFieldValue[0] === 'object' &&  docFieldValue[0] !== null) {
+          return docFieldValue.some(function (val) {
+            return rowFilter(val, userValue, Object.keys(userValue));
+          });
+        }
+
+        return docFieldValue.some(function (val) {
+          return matchSelector(userValue, doc, parsedField, val);
+        });
+      },
+
+      '$allMatch': function (doc, userValue, parsedField, docFieldValue) {
+        if (!Array.isArray(docFieldValue)) {
+          return false;
+        }
+
+        /* istanbul ignore next */
+        if (docFieldValue.length === 0) {
+          return false;
+        }
+
+        if (typeof docFieldValue[0] === 'object' &&  docFieldValue[0] !== null) {
+          return docFieldValue.every(function (val) {
+            return rowFilter(val, userValue, Object.keys(userValue));
+          });
+        }
+
+        return docFieldValue.every(function (val) {
+          return matchSelector(userValue, doc, parsedField, val);
+        });
+      },
+
+      '$eq': function (doc, userValue, parsedField, docFieldValue) {
+        return fieldIsNotUndefined(docFieldValue) && collate(docFieldValue, userValue) === 0;
+      },
+
+      '$gte': function (doc, userValue, parsedField, docFieldValue) {
+        return fieldIsNotUndefined(docFieldValue) && collate(docFieldValue, userValue) >= 0;
+      },
+
+      '$gt': function (doc, userValue, parsedField, docFieldValue) {
+        return fieldIsNotUndefined(docFieldValue) && collate(docFieldValue, userValue) > 0;
+      },
+
+      '$lte': function (doc, userValue, parsedField, docFieldValue) {
+        return fieldIsNotUndefined(docFieldValue) && collate(docFieldValue, userValue) <= 0;
+      },
+
+      '$lt': function (doc, userValue, parsedField, docFieldValue) {
+        return fieldIsNotUndefined(docFieldValue) && collate(docFieldValue, userValue) < 0;
+      },
+
+      '$exists': function (doc, userValue, parsedField, docFieldValue) {
+        //a field that is null is still considered to exist
+        if (userValue) {
+          return fieldIsNotUndefined(docFieldValue);
+        }
+
+        return !fieldIsNotUndefined(docFieldValue);
+      },
+
+      '$mod': function (doc, userValue, parsedField, docFieldValue) {
+        return fieldExists(docFieldValue) && modField(docFieldValue, userValue);
+      },
+
+      '$ne': function (doc, userValue, parsedField, docFieldValue) {
+        return userValue.every(function (neValue) {
+          return collate(docFieldValue, neValue) !== 0;
+        });
+      },
+      '$in': function (doc, userValue, parsedField, docFieldValue) {
+        return fieldExists(docFieldValue) && arrayContainsValue(docFieldValue, userValue);
+      },
+
+      '$nin': function (doc, userValue, parsedField, docFieldValue) {
+        return fieldExists(docFieldValue) && !arrayContainsValue(docFieldValue, userValue);
+      },
+
+      '$size': function (doc, userValue, parsedField, docFieldValue) {
+        return fieldExists(docFieldValue) &&
+          Array.isArray(docFieldValue) &&
+          arraySize(docFieldValue, userValue);
+      },
+
+      '$all': function (doc, userValue, parsedField, docFieldValue) {
+        return Array.isArray(docFieldValue) && arrayContainsAllValues(docFieldValue, userValue);
+      },
+
+      '$regex': function (doc, userValue, parsedField, docFieldValue) {
+        return fieldExists(docFieldValue) &&
+          typeof docFieldValue == "string" &&
+          userValue.every(function (regexValue) {
+            return regexMatch(docFieldValue, regexValue);
+          });
+      },
+
+      '$type': function (doc, userValue, parsedField, docFieldValue) {
+        return typeMatch(docFieldValue, userValue);
+      }
+    };
+
+    // return true if the given doc matches the supplied selector
+    function matchesSelector(doc, selector) {
+      /* istanbul ignore if */
+      if (typeof selector !== 'object') {
+        // match the CouchDB error message
+        throw new Error('Selector error: expected a JSON object');
+      }
+
+      selector = massageSelector(selector);
+      var row = {
+        doc
+      };
+
+      var rowsMatched = filterInMemoryFields([row], { selector }, Object.keys(selector));
+      return rowsMatched && rowsMatched.length === 1;
+    }
+
+    // pouchdb-find's own matcher and collation - using anything else would let overlay
+    // semantics drift from what the same selector means against the database.
+    /**
+     * True when a query with this selector could see documents this stage holds.
+     *
+     * Derived from the selector's `~class` / `~domain` constraint against the stage's
+     * partitions; a selector naming no class is answered conservatively. This is the
+     * per-query fast path: a find over a class the transaction never touched runs
+     * exactly as it would outside the transaction.
+     */
+    const stageCoversSelector = (stage, selector) => {
+        if (stage.size === 0)
+            return false;
+        const names = [
+            ...constraintNames(selector["~class"]),
+            ...constraintNames(selector["~domain"]),
+        ];
+        if (!names.length)
+            return true;
+        return names.some(name => stage.hasPartition(name));
+    };
+    const constraintNames = (constraint) => {
+        if (typeof constraint === "string")
+            return [constraint];
+        if (constraint && typeof constraint === "object") {
+            const eq = constraint.$eq;
+            if (typeof eq === "string")
+                return [eq];
+            const within = constraint.$in;
+            if (Array.isArray(within))
+                return within.filter((name) => typeof name === "string");
+        }
+        return [];
+    };
+    /**
+     * Fields the widened committed query (and the staged docs) must carry beyond the
+     * caller's projection, so masking, sorting and the read pipeline can work; the
+     * extras are stripped again after the merge.
+     */
+    const widenProjection = (fields, sort) => {
+        if (!fields || !fields.length)
+            return { queryFields: undefined, extras: [] };
+        const needed = new Set(["_id", "~class"]);
+        for (const entry of sort !== null && sort !== void 0 ? sort : []) {
+            needed.add(typeof entry === "string" ? entry : Object.keys(entry)[0]);
+        }
+        const extras = [...needed].filter(field => !fields.includes(field));
+        return { queryFields: [...fields, ...extras], extras };
+    };
+    const projectDoc = (doc, fields) => {
+        const projected = {};
+        for (const field of fields) {
+            const value = getFieldFromDoc(doc, parseField(field));
+            if (value !== undefined)
+                projected[field] = value;
+        }
+        return projected;
+    };
+    const sortComparator = (sort) => {
+        const parts = sort.map(entry => {
+            const field = typeof entry === "string" ? entry : Object.keys(entry)[0];
+            const direction = typeof entry === "string" ? "asc" : entry[field];
+            return { parsed: parseField(field), factor: direction === "desc" ? -1 : 1 };
+        });
+        return (a, b) => {
+            for (const { parsed, factor } of parts) {
+                const result = compare(getFieldFromDoc(a, parsed), getFieldFromDoc(b, parsed)) * factor;
+                if (result !== 0)
+                    return result;
+            }
+            return 0;
+        };
+    };
+    /**
+     * Merges a stage into a committed query result: every staged id masks its committed
+     * row (superseded and deleted alike), staged writes matching the selector join the
+     * set, then sort, window and projection apply in memory - the database's index can
+     * never see a staged document, so the window has to be computed after the union.
+     *
+     * `committedDocs` must come from a query WITHOUT skip/limit (the mask changes what
+     * the window contains) and carrying `widenProjection`'s fields.
+     */
+    const mergeStageIntoResults = (stage, selector, committedDocs, options = {}) => {
+        var _a, _b, _c, _d, _e, _f, _g, _h;
+        const survivors = committedDocs.filter(doc => !stage.has(doc._id));
+        for (const entry of stage.values()) {
+            if (entry.op !== "write")
+                continue;
+            if (!matchesSelector(entry.doc, selector))
+                continue;
+            const overlaid = Object.assign({}, structuredClone(entry.doc));
+            if (entry.baseRev)
+                overlaid._rev = (_a = overlaid._rev) !== null && _a !== void 0 ? _a : entry.baseRev;
+            survivors.push(((_b = options.fields) === null || _b === void 0 ? void 0 : _b.length)
+                ? projectDoc(overlaid, [...options.fields, ...((_c = options.extras) !== null && _c !== void 0 ? _c : [])])
+                : overlaid);
+        }
+        if ((_d = options.sort) === null || _d === void 0 ? void 0 : _d.length)
+            survivors.sort(sortComparator(options.sort));
+        const skip = (_e = options.skip) !== null && _e !== void 0 ? _e : 0;
+        const limit = (_f = options.limit) !== null && _f !== void 0 ? _f : survivors.length;
+        const windowed = survivors.slice(skip, skip + limit);
+        if (((_g = options.fields) === null || _g === void 0 ? void 0 : _g.length) && ((_h = options.extras) === null || _h === void 0 ? void 0 : _h.length)) {
+            return windowed.map(doc => projectDoc(doc, options.fields));
+        }
+        return windowed;
+    };
+    /** A PouchDB-shaped `not_found`, so overlay reads refuse like the database does. */
+    const notFoundError = (id) => {
+        const error = new Error("missing");
+        error.status = 404;
+        error.name = "not_found";
+        error.error = true;
+        error.reason = "deleted";
+        error.docId = id;
+        return error;
+    };
+    /**
+     * Read-your-writes for a point read: a staged delete is a 404, a staged write is the
+     * authored plaintext (its `_rev` is the base revision - the revision the commit will
+     * replace), anything else is the stack's ordinary decrypting read.
+     */
+    const overlayGet = async (stack, stage, id, options) => {
+        const entry = stage.get(id);
+        if (entry) {
+            if (entry.op === "delete")
+                throw notFoundError(id);
+            const doc = structuredClone(entry.doc);
+            if (entry.baseRev && doc._rev === undefined)
+                doc._rev = entry.baseRev;
+            return doc;
+        }
+        return stack.db.get(id, options !== null && options !== void 0 ? options : {});
+    };
+    /** `bulkGet` counterpart of {@link overlayGet}, preserving request order. */
+    const overlayBulkGet = async (stack, stage, request) => {
+        var _a, _b, _c, _d;
+        const passthrough = ((_a = request.docs) !== null && _a !== void 0 ? _a : []).filter(item => !stage.has(item.id));
+        const fetched = passthrough.length
+            ? await stack.db.bulkGet(Object.assign(Object.assign({}, request), { docs: passthrough }))
+            : { results: [] };
+        const byId = new Map();
+        for (const result of (_b = fetched.results) !== null && _b !== void 0 ? _b : []) {
+            const list = (_c = byId.get(result.id)) !== null && _c !== void 0 ? _c : [];
+            list.push(result);
+            byId.set(result.id, list);
+        }
+        const results = ((_d = request.docs) !== null && _d !== void 0 ? _d : []).map(item => {
+            var _a, _b;
+            const entry = stage.get(item.id);
+            if (!entry)
+                return (_b = (_a = byId.get(item.id)) === null || _a === void 0 ? void 0 : _a.shift()) !== null && _b !== void 0 ? _b : { id: item.id, docs: [{ error: notFoundError(item.id) }] };
+            if (entry.op === "delete")
+                return { id: item.id, docs: [{ error: notFoundError(item.id) }] };
+            const doc = structuredClone(entry.doc);
+            if (entry.baseRev && doc._rev === undefined)
+                doc._rev = entry.baseRev;
+            return { id: item.id, docs: [{ ok: doc }] };
+        });
+        return { results };
+    };
+
+    const conflictError = (id) => {
+        const error = new Error("Document update conflict");
+        error.status = 409;
+        error.name = "conflict";
+        error.error = true;
+        error.docId = id;
+        return error;
+    };
+    /**
+     * One transaction: a private write journal plus a read view that overlays it on
+     * committed state (ADR-0039).
+     *
+     * Writes through the handle are validated at the call site (the sweep - failing
+     * stages nothing) and stage in memory; nothing reaches the database until
+     * {@link commit}, which flushes the journal as one batch through the stack's full
+     * authoring pipeline. Reads through the handle see the journal; `stack.db`, other
+     * handles, replication and live subscriptions see only committed state.
+     *
+     * @example
+     * ```typescript
+     * const t = stack.beginTransaction();
+     * await t.createDoc(null, "Task", { title: "write-up" });
+     * await t.db.put({ ...(await t.db.get("Task-77")), done: true });
+     * const drafted = await t.findDocuments({ "~class": { $eq: "Task" } });
+     * const report = await t.commit();   // or stack.commit(t)
+     * ```
+     */
+    class TransactionHandle {
+        /** @internal */
+        constructor(stack, engine, id, internal = false) {
+            /** @internal */
+            this.stage = new TransactionStage();
+            /** @internal - ids this handle minted, counted into the id counter after commit. */
+            this.mintedIds = new Set();
+            this.statusValue = "open";
+            this.stack = stack;
+            this.engine = engine;
+            this.id = id;
+            this.internal = internal;
+            this.db = new TransactionDb(stack, this);
+        }
+        get status() {
+            return this.statusValue;
+        }
+        /** @internal */
+        setStatus(status) {
+            this.statusValue = status;
+        }
+        stagedCount() {
+            return this.stage.size;
+        }
+        /** @internal */
+        assertWritable(operation) {
+            if (this.statusValue !== "open" && this.statusValue !== "partial") {
+                throw new TransactionStateError(this.id, this.statusValue, operation);
+            }
+        }
+        /**
+         * Stages a write. The sweep runs first: a document that fails validation, policy,
+         * or the locked-stack check is not staged and the journal is untouched.
+         * @internal
+         */
+        async stageWrite(doc, op = "write") {
+            this.assertWritable("accept writes");
+            const docId = doc._id;
+            if (typeof docId !== "string" || !docId) {
+                throw new Error("A staged document needs an '_id' - transactions do not mint ids implicitly; use createDoc(null, ...).");
+            }
+            const already = this.stage.get(docId);
+            let baseRev;
+            let isNew;
+            if (already) {
+                baseRev = already.baseRev;
+                isNew = already.isNew;
+            }
+            else {
+                baseRev = await this.stack.getDocRevision(docId).catch(() => undefined) || undefined;
+                isNew = baseRev === undefined;
+            }
+            // PouchDB's optimistic-concurrency contract, kept: updating requires stating
+            // the revision being replaced - here, the overlay-visible one.
+            const statedRev = doc._rev;
+            if (!isNew && statedRev !== baseRev)
+                throw conflictError(docId);
+            if (isNew && statedRev !== undefined)
+                throw conflictError(docId);
+            const entry = {
+                doc: structuredClone(Object.assign(Object.assign({}, doc), { _rev: undefined })),
+                baseRev,
+                op,
+                isNew,
+                stagedAt: Date.now(),
+            };
+            delete entry.doc._rev;
+            await sweepEntry(this.stack, this.stage, entry, { allowClassModels: this.internal, skipPolicy: this.internal });
+            this.stage.set(docId, entry);
+            return this.stage.get(docId);
+        }
+        /**
+         * Creates or updates a document in the transaction - `stack.createDoc`'s UX with
+         * a staged destination: `docId: null` mints an id, an existing id merges params
+         * over the overlay-visible document.
+         */
+        async createDoc(docId, type, params) {
+            this.assertWritable("create documents");
+            let base = null;
+            if (docId) {
+                base = await overlayGet(this.stack, this.stage, docId).catch(() => null);
+                if (base && base["~class"] !== type) {
+                    throw new Error(`Existing document '${docId}' is a '${base["~class"]}', not a '${type}'.`);
+                }
+            }
+            else {
+                docId = this.stack.generateDocId(type);
+                this.mintedIds.add(docId);
+            }
+            const draft = base
+                ? Object.assign(Object.assign(Object.assign({}, base), params), { _id: docId, "~updateTimestamp": new Date().getTime() }) : Object.assign(Object.assign(Object.assign({}, this.stack.prepareDoc(docId, type, params, "~class")), params), { _id: docId });
+            const entry = await this.stageWrite(draft, "write").catch(error => {
+                // An id minted for a write that never staged is simply dropped - the
+                // counter only ever advances for committed documents.
+                if (!base && docId)
+                    this.mintedIds.delete(docId);
+                throw error;
+            });
+            return structuredClone(entry.doc);
+        }
+        /** Batch counterpart of {@link createDoc}; validated sequentially, fail-fast. */
+        async createDocs(docs, type) {
+            const created = [];
+            for (const draft of docs) {
+                created.push(await this.createDoc(draft.docId, type, draft.params));
+            }
+            return created;
+        }
+        /** Soft-deletes in the transaction: the overlay stops showing the document under the default `active: true`. */
+        async deleteDocument(docId) {
+            var _a, _b;
+            this.assertWritable("delete documents");
+            const doc = await overlayGet(this.stack, this.stage, docId).catch(() => null);
+            if (!doc)
+                return false;
+            await this.stageWrite(Object.assign(Object.assign({}, doc), { active: false, _rev: (_b = (_a = this.stage.get(docId)) === null || _a === void 0 ? void 0 : _a.baseRev) !== null && _b !== void 0 ? _b : doc._rev }), "write");
+            return true;
+        }
+        /** The stack's polished read, against this transaction's view. */
+        async findDocuments(selector, fields, skip, limit, sort) {
+            this.assertWritable("read");
+            return this.stack.findDocumentsForView(this.stage, selector, fields, skip, limit, sort);
+        }
+        /**
+         * SQL against this transaction's view. The executor reaches data only through
+         * stack APIs, so a facade routes them at the overlay; LIMIT/OFFSET pushdown and
+         * sort indexes are disabled while staged - staged documents exist in no index,
+         * so windows and orderings must be computed after the merge.
+         */
+        async query(sql, ...params) {
+            this.assertWritable("query");
+            const stack = this.stack;
+            const stage = this.stage;
+            const facade = Object.create(stack);
+            facade.findDocuments = (selector, fields, skip, limit, sort) => stack.findDocumentsForView(stage, selector, fields, skip, limit, sort);
+            facade.findDocumentsIterator = function (selector_1) {
+                return __asyncGenerator(this, arguments, function* (selector, options = {}) {
+                    const result = yield __await(facade.findDocuments(selector, options.fields));
+                    for (const doc of result.docs)
+                        yield yield __await(doc);
+                });
+            };
+            facade.canApplyQueryLimitEarly = async () => false;
+            facade.ensureSortIndex = async () => false;
+            facade.getClass = async (name, ...rest) => {
+                const real = await stack.getClass(name, ...rest);
+                if (!real)
+                    return real;
+                const wrapped = Object.create(real);
+                // `getCards` is an own arrow property bound to the real stack; shadowed so
+                // the executor's fetches route through the overlay.
+                wrapped.getCards = (selector, fields, skip, limit, sort) => facade.findDocuments(Object.assign(Object.assign({}, (selector || {})), { "~class": { $eq: real.name } }), fields, skip, limit, sort)
+                    .then((result) => result.docs);
+                return wrapped;
+            };
+            return stack.runQuery(sql, params, facade);
+        }
+        /** Flushes the journal - sugar for `stack.commit(t)`. */
+        commit() {
+            return this.engine.commit(this);
+        }
+        /** Drops the journal - sugar for `stack.discardTransaction(t)`. */
+        discard() {
+            this.engine.discard(this);
+        }
+    }
+    /**
+     * The handle's db-like surface. Writes stage; reads overlay. Not a Proxy over the
+     * guarded db on purpose: this object *has no* adapter methods or escape hatches to
+     * forward, so staging cannot become a fourth door around the authoring path.
+     */
+    class TransactionDb {
+        /** @internal */
+        constructor(stack, handle) {
+            this.stack = stack;
+            this.handle = handle;
+        }
+        async get(docId, options) {
+            this.handle.assertWritable("read");
+            return overlayGet(this.stack, this.handle.stage, docId, options);
+        }
+        async bulkGet(request) {
+            this.handle.assertWritable("read");
+            return overlayBulkGet(this.stack, this.handle.stage, request);
+        }
+        /**
+         * Raw-style Mango find over the transaction's view. Like `stack.db.find`, this
+         * skips the read pipeline (no policy filter, no decryption of committed rows);
+         * `findDocuments` on the handle is the polished read.
+         */
+        async find(query) {
+            this.handle.assertWritable("read");
+            const stage = this.handle.stage;
+            const { selector, fields, skip, limit, sort } = query;
+            const { queryFields, extras } = widenProjection(fields, sort);
+            const committed = await this.stack.db.find(Object.assign(Object.assign({ selector }, (queryFields ? { fields: queryFields } : {})), { limit: 2 ** 31 - 1 }));
+            const docs = mergeStageIntoResults(stage, selector, committed.docs, { sort, skip, limit, fields, extras });
+            return { docs };
+        }
+        async put(doc, options) {
+            if (options && (options.new_edits === false || options.force)) {
+                throw new Error("Writing with 'new_edits: false' or 'force' is reserved for DocStack's sync layer, in and out of transactions.");
+            }
+            const entry = await this.handle.stageWrite(doc, "write");
+            return { ok: true, id: doc._id, rev: entry.baseRev, staged: true };
+        }
+        async post(doc) {
+            var _a;
+            const type = (_a = doc["~class"]) !== null && _a !== void 0 ? _a : doc["~domain"];
+            if (typeof type !== "string" || !type) {
+                throw new Error("post needs '~class' (or '~domain') to mint an id for the document.");
+            }
+            const id = this.stack.generateDocId(type);
+            this.handle.mintedIds.add(id);
+            const entry = await this.handle.stageWrite(Object.assign(Object.assign({}, doc), { _id: id }), "write").catch(error => {
+                this.handle.mintedIds.delete(id);
+                throw error;
+            });
+            return { ok: true, id, rev: entry.baseRev, staged: true };
+        }
+        /** Hard removal, staged: the commit writes `_deleted: true`. Soft deletion is `handle.deleteDocument`. */
+        async remove(doc, rev) {
+            const id = typeof doc === "string" ? doc : doc._id;
+            const statedRev = typeof doc === "string" ? rev : doc._rev;
+            const current = await overlayGet(this.stack, this.handle.stage, id).catch(() => { throw notFoundError(id); });
+            await this.handle.stageWrite(Object.assign(Object.assign({}, current), { _id: id, _rev: statedRev !== null && statedRev !== void 0 ? statedRev : current._rev }), "delete");
+            return { ok: true, id, staged: true };
+        }
+        /**
+         * Stages a batch. Validated sequentially - the first refusal unwinds every entry
+         * this call staged, so a failing batch stages nothing. Documents stage before
+         * relations, mirroring the commit batch, so a relation and its endpoint can
+         * arrive in one array in any order.
+         */
+        async bulkDocs(docs, options) {
+            const list = Array.isArray(docs) ? docs : docs === null || docs === void 0 ? void 0 : docs.docs;
+            if (!Array.isArray(list))
+                throw new Error("bulkDocs expects an array of documents or { docs: [...] }.");
+            if (readNewEdits(docs, options !== null && options !== void 0 ? options : null) === false || (options === null || options === void 0 ? void 0 : options.force)) {
+                throw new Error("Writing with 'new_edits: false' or 'force' is reserved for DocStack's sync layer, in and out of transactions.");
+            }
+            this.handle.assertWritable("accept writes");
+            const stage = this.handle.stage;
+            const before = new Map();
+            const ordered = [
+                ...list.filter(doc => typeof doc["~domain"] !== "string"),
+                ...list.filter(doc => typeof doc["~domain"] === "string"),
+            ];
+            try {
+                const results = [];
+                for (const doc of ordered) {
+                    const id = doc._id;
+                    if (typeof id === "string" && !before.has(id))
+                        before.set(id, stage.get(id));
+                    await this.handle.stageWrite(doc, "write");
+                    results.push({ ok: true, id, staged: true });
+                }
+                return results;
+            }
+            catch (error) {
+                // Unwind this call's staging so a failed batch has no consequences at all.
+                for (const [id, previous] of before) {
+                    if (previous)
+                        stage.set(id, previous);
+                    else
+                        stage.remove(id);
+                }
+                throw error;
+            }
+        }
+    }
+
+    const logger$1 = createLogger().child({ module: "TransactionEngine" });
+    /**
+     * Which adapters commit one `bulkDocs` batch as a single storage transaction.
+     * tauri-sqlite composes the whole batch into one `BEGIN IMMEDIATE … COMMIT`;
+     * IndexedDB and the bridge/channel adapters report per document. Reported to
+     * consumers on every commit rather than silently assumed (ADR-0039).
+     */
+    const ADAPTER_ATOMICITY = {
+        "tauri-sqlite": true,
+    };
+    const now = () => { var _a, _b; return ((_b = (_a = globalThis.performance) === null || _a === void 0 ? void 0 : _a.now()) !== null && _b !== void 0 ? _b : Date.now()); };
+    /**
+     * Named write transactions for one stack (ADR-0039).
+     *
+     * Enabled per stack by `transactions: true` in its configuration - the flag only
+     * unlocks {@link begin}; direct writes stay immediate, and the framework's own
+     * writers (scheduler, jobs, sync) always write directly. The stage lives above the
+     * plugin: nothing a transaction does touches the database until commit, and commit
+     * is exactly one `stack.db.bulkDocs` through the full authoring pipeline.
+     */
+    class TransactionEngine {
+        constructor(stack, enabled) {
+            this.handles = new Map();
+            /** Commits serialize here so one commit's rev pre-flight cannot be invalidated by another's write. */
+            this.commitChain = Promise.resolve();
+            this.stack = stack;
+            this.enabled = enabled;
+        }
+        isEnabled() {
+            return this.enabled;
+        }
+        /** How many transactions are currently open (or partial). */
+        openCount() {
+            return this.handles.size;
+        }
+        begin() {
+            var _a;
+            if (!this.enabled)
+                throw new TransactionsDisabledError((_a = this.stack.name) !== null && _a !== void 0 ? _a : "");
+            const id = `tx-${this.stack.cryptoEngine.generateRandomString(8)}`;
+            const handle = new TransactionHandle(this.stack, this, id);
+            this.handles.set(id, handle);
+            return handle;
+        }
+        /**
+         * Opens a transaction for DocStack's own machinery - patch application
+         * (ADR-0042). Independent of the `transactions: true` config gate (the flag
+         * governs the consumer feature, not the framework's internals) and permitted to
+         * stage class models: an internal handle claims staged validation and a single
+         * class-write batch, never propagation atomicity.
+         * @internal
+         */
+        beginInternal() {
+            const id = `tx-internal-${this.stack.cryptoEngine.generateRandomString(8)}`;
+            const handle = new TransactionHandle(this.stack, this, id, true);
+            this.handles.set(id, handle);
+            return handle;
+        }
+        resolve(t, operation) {
+            const handle = typeof t === "string" ? this.handles.get(t) : t;
+            if (!handle)
+                throw new TransactionStateError(typeof t === "string" ? t : "(unknown)", "unknown", operation);
+            return handle;
+        }
+        /**
+         * Drops a transaction's journal. Idempotent, and a no-op on a handle already in
+         * a terminal state - discarding what is already gone is not an error.
+         */
+        discard(t) {
+            const handle = this.resolve(t, "be discarded");
+            if (handle.status === "discarded" || handle.status === "committed")
+                return;
+            handle.stage.clear();
+            handle.setStatus("discarded");
+            this.handles.delete(handle.id);
+            this.stack.dispatchEvent(new CustomEvent("transactionDiscard", { detail: { transactionId: handle.id } }));
+        }
+        /** Discards every open transaction - what `close()` and `reset()` do. */
+        discardAll() {
+            for (const handle of [...this.handles.values()])
+                this.discard(handle);
+        }
+        /**
+         * Flushes a transaction's journal as one batch through the stack's authoring
+         * pipeline. Refusals - validation, or a staged document whose base revision
+         * moved - throw with nothing persisted and the transaction still open.
+         */
+        commit(t) {
+            const handle = this.resolve(t, "commit");
+            const run = () => this.commitNow(handle);
+            const chained = this.commitChain.then(run, run);
+            // The chain must survive a refused commit; the caller still sees the rejection.
+            this.commitChain = chained.catch(() => undefined);
+            return chained;
+        }
+        async commitNow(handle) {
+            var _a, _b, _c, _d, _e, _f;
+            const started = now();
+            if (handle.status !== "open" && handle.status !== "partial") {
+                throw new TransactionStateError(handle.id, handle.status, "commit");
+            }
+            const stage = handle.stage;
+            const entries = stage.values();
+            const stagedCount = entries.length;
+            const report = {
+                transactionId: handle.id,
+                written: [],
+                failed: [],
+                stagedCount,
+                durationMs: 0,
+                adapter: this.adapterInfo(),
+            };
+            if (!stagedCount) {
+                handle.setStatus("committed");
+                this.handles.delete(handle.id);
+                report.durationMs = now() - started;
+                return report;
+            }
+            // 1. The sweep again, against the world as it stands now - stage-time answers
+            //    can be stale (a policy changed, a class tightened). Zero consequences on
+            //    refusal.
+            for (const entry of entries) {
+                await sweepEntry(this.stack, stage, entry, { allowClassModels: handle.internal, skipPolicy: handle.internal });
+            }
+            // 2. Rev pre-flight: every staged id's stored winner must still be the
+            //    revision it was staged against. `allDocs` is below the plugin - revs
+            //    only, no decrypt cost.
+            const ids = stage.ids();
+            const stored = await this.stack.db.allDocs({ keys: ids });
+            const currentRevs = new Map();
+            for (const row of (_a = stored.rows) !== null && _a !== void 0 ? _a : []) {
+                const id = (_b = row.key) !== null && _b !== void 0 ? _b : row.id;
+                currentRevs.set(id, row.value && !row.value.deleted ? row.value.rev : undefined);
+            }
+            const conflicts = [];
+            for (const id of ids) {
+                const entry = stage.get(id);
+                const current = currentRevs.get(id);
+                const expected = entry.isNew ? undefined : entry.baseRev;
+                if (current !== expected)
+                    conflicts.push({ id, baseRev: entry.baseRev, currentRev: current });
+            }
+            if (conflicts.length)
+                throw new TransactionConflictError(conflicts);
+            // 3. One batch: stage order, documents before relations so endpoint checks
+            //    can resolve batch-mates.
+            const toBatchDoc = (id) => {
+                const entry = stage.get(id);
+                const doc = structuredClone(entry.doc);
+                if (entry.baseRev)
+                    doc._rev = entry.baseRev;
+                else
+                    delete doc._rev;
+                if (entry.op === "delete")
+                    doc._deleted = true;
+                return doc;
+            };
+            const batchIds = [
+                ...ids.filter(id => typeof stage.get(id).doc["~domain"] !== "string"),
+                ...ids.filter(id => typeof stage.get(id).doc["~domain"] === "string"),
+            ];
+            const batch = batchIds.map(toBatchDoc);
+            // 4. The full authoring pipeline, unchanged: triggers, relation checks,
+            //    encryption, and the single adapter write. A pipeline refusal rejects the
+            //    whole call before anything is written.
+            const response = await this.stack.db.bulkDocs(batch);
+            const failedIds = new Set();
+            for (let index = 0; index < response.length; index++) {
+                const result = response[index];
+                const id = (_c = result === null || result === void 0 ? void 0 : result.id) !== null && _c !== void 0 ? _c : batchIds[index];
+                if (result && result.ok) {
+                    report.written.push({ id, rev: result.rev });
+                }
+                else {
+                    failedIds.add(id);
+                    report.failed.push({
+                        id,
+                        error: (_e = (_d = result === null || result === void 0 ? void 0 : result.message) !== null && _d !== void 0 ? _d : result === null || result === void 0 ? void 0 : result.reason) !== null && _e !== void 0 ? _e : String((_f = result === null || result === void 0 ? void 0 : result.name) !== null && _f !== void 0 ? _f : "write failed"),
+                        name: result === null || result === void 0 ? void 0 : result.name,
+                    });
+                }
+            }
+            // 5. The id counter advances only for minted ids that actually landed -
+            //    uniqueness is the promise, not density (as in createDocs).
+            const mintedWritten = report.written.filter(entry => handle.mintedIds.has(entry.id)).length;
+            if (mintedWritten > 0) {
+                await this.stack.advanceLastDocId(mintedWritten);
+            }
+            if (failedIds.size === 0) {
+                stage.clear();
+                handle.setStatus("committed");
+                this.handles.delete(handle.id);
+            }
+            else {
+                // Possible only on adapters without an atomic batch (or a write racing
+                // the pre-flight window). Failed entries keep their base revisions: a
+                // straggler that simply didn't land retries cleanly, and one that was
+                // raced surfaces as a conflict on the next commit instead of being
+                // silently overwritten.
+                stage.retain(failedIds);
+                handle.setStatus("partial");
+                logger$1.warn("Transaction committed partially", { transactionId: handle.id, failed: report.failed });
+            }
+            report.durationMs = now() - started;
+            this.stack.dispatchEvent(new CustomEvent("transactionCommit", { detail: report }));
+            return report;
+        }
+        adapterInfo() {
+            var _a, _b;
+            const name = String((_b = (_a = this.stack.rawDb) === null || _a === void 0 ? void 0 : _a.adapter) !== null && _b !== void 0 ? _b : "unknown");
+            const atomicBatch = ADAPTER_ATOMICITY[name] === true;
+            if (!(name in ADAPTER_ATOMICITY) && name !== "idb" && name !== "indexeddb") {
+                logger$1.warn("Unknown adapter for transaction atomicity - reporting atomicBatch: false", { adapter: name });
+            }
+            return { name, atomicBatch };
+        }
+    }
+
+    /**
+     * Moving a stack's *content* between databases, without its datamodel.
+     *
+     * `stack.dump()` is the other kind of export: every document exactly as stored, which
+     * means class models, patches, users, sessions, policies, design documents - and
+     * encrypted attributes as unreadable {@link EncryptedPayload} blobs. That is a debugging
+     * tool and a backup of one database.
+     *
+     * This is the portable one. It carries the documents an application put in, in the clear,
+     * so that {@link ClientStack.importContent} can place them into a *different* stack -
+     * different device, different key, schema built by that stack's own patches.
+     *
+     * @module
+     */
+    /** The envelope format identifier, so an importer can refuse what it does not understand. */
+    const CONTENT_EXPORT_FORMAT = "docstack/content-export@1";
+    /**
+     * `~class` values that describe the stack rather than hold its content.
+     *
+     * `~self` is the bootstrap class-of-classes; `class` and `superclass` are class models;
+     * `domain` is a relation definition; `patch` is the local ledger of applied patches.
+     */
+    const META_CLASSES = ["~self", "class", "superclass", "domain", "patch"];
+    /**
+     * Reports whether a class name belongs to application content.
+     *
+     * DocStack names everything it owns with a leading `~` - `~User`, `~Group`, `~Policy`,
+     * `~Job`, `~JobRun`, `~UserSession`, `~AuthModule`, `~lock` - and reserves the handful of
+     * unprefixed names in {@link META_CLASSES} for the datamodel itself. Everything else was
+     * created by an application.
+     *
+     * @param className - A `~class` value or class-model id.
+     *
+     * @example
+     * ```typescript
+     * isContentClassName("Task");   // true
+     * isContentClassName("~User");  // false - DocStack's own
+     * isContentClassName("class");  // false - a class model
+     * ```
+     */
+    const isContentClassName = (className) => {
+        if (typeof className !== "string" || !className.length)
+            return false;
+        if (className.startsWith("~"))
+            return false;
+        return !META_CLASSES.includes(className);
+    };
+    /**
+     * Reports whether a document is application content rather than part of the stack.
+     *
+     * @param doc - Any stored document.
+     */
+    const isContentDocument = (doc) => {
+        if (!doc || typeof doc._id !== "string")
+            return false;
+        // A design document has no `~class` and would fall through the class test.
+        if (doc._id.startsWith("_"))
+            return false;
+        return isContentClassName(doc["~class"]);
+    };
+    /**
+     * Reports whether a document is an application relation.
+     *
+     * Relations carry `~domain` and no `~class` (see `isRelation` in `@docstack/shared`), so
+     * they need their own test rather than falling out of {@link isContentDocument}.
+     *
+     * @param doc - Any stored document.
+     */
+    const isContentRelation = (doc) => {
+        if (!doc || typeof doc._id !== "string")
+            return false;
+        if (doc["~class"] !== undefined)
+            return false;
+        return isContentClassName(doc["~domain"]);
+    };
+    /** Fields PouchDB owns, or that describe one database's copy of a document. */
+    const TRANSIENT_FIELDS = ["_rev", "_revisions", "_revs_info", "_conflicts", "_deleted"];
+    /**
+     * Strips the fields that belong to the source database rather than to the document.
+     *
+     * `_rev` above all: a revision from one database means nothing in another, and carrying
+     * it into an import turns every write into a conflict.
+     *
+     * @param doc - The document to clean.
+     * @returns A copy without the transient fields.
+     */
+    const stripTransientFields = (doc) => {
+        const clone = Object.assign({}, doc);
+        for (const field of TRANSIENT_FIELDS)
+            delete clone[field];
+        return clone;
+    };
+    /**
+     * Validates an import payload's envelope before anything is written.
+     *
+     * A plain validator rather than an `asserts` signature: the caller already types its
+     * parameter, so there is nothing to narrow, and an assertion function reached through an
+     * import needs a declaration TypeScript can see (TS2775).
+     *
+     * @param payload - The value handed to {@link ClientStack.importContent}.
+     * @throws Error when it is not a content export this version understands.
+     */
+    const assertContentExport = (payload) => {
+        const value = payload;
+        if (!value || typeof value !== "object") {
+            throw new Error("importContent - payload is not a content export.");
+        }
+        if (value.format !== CONTENT_EXPORT_FORMAT) {
+            throw new Error(`importContent - unsupported format '${String(value.format)}'. ` +
+                `This build reads '${CONTENT_EXPORT_FORMAT}'.`);
         }
         if (!Array.isArray(value.documents) || !Array.isArray(value.relations)) {
             throw new Error("importContent - payload is missing its 'documents' or 'relations' array.");
@@ -9397,6 +12642,8 @@ async function execute(_stack, params) {
         "credentials",
         "disableCryptoEngine",
         "documentKey",
+        "transactions",
+        "logLevel",
     ];
     /**
      * Extracts the PouchDB half of a {@link StackOptions} object.
@@ -9947,45 +13194,52 @@ async function execute(_stack, params) {
             };
             this.applyPatch = async (patch) => {
                 const fnLogger = logger.child({ method: "applyPatch", args: { patch } });
-                return new Promise(async (resolve, reject) => {
-                    try {
-                        fnLogger.info("Attempting to apply patch", { patch });
-                        fnLogger.info("applyPatch - starting to hydrate patch docs", { docCount: patch.docs.length });
-                        const hydratedDocs = await Promise.all(patch.docs.map(async (sourceDoc) => {
-                            // Work on a copy: the patch definition must survive intact. System
-                            // patches are module-level objects shared by every stack in the
-                            // process, so deleting `_rev` from one would strip the "auto" marker
-                            // permanently — the next ClientStack created in the same context
-                            // would then rewrite those documents as fresh inserts, hit a 409,
-                            // and end up without its `class` class model.
-                            let doc = Object.assign({}, sourceDoc);
-                            if (doc._rev === "auto") {
-                                delete doc._rev;
-                                const existingDoc = await this.db.get(doc._id);
-                                if (existingDoc) {
-                                    doc = Object.assign(Object.assign({}, existingDoc), doc);
-                                }
-                            }
-                            return doc;
-                        }));
-                        fnLogger.info("applyPatch - hydration complete, calling bulkDocs", { docCount: hydratedDocs.length });
-                        await this.db.bulkDocs(hydratedDocs, { isPatch: true }).then((result) => {
-                            fnLogger.warn("applyPatch - bulkDocs completed with result", { result });
-                            fnLogger.warn("Successfully processed patch", { version: patch.version });
-                        }).catch((error) => {
-                            fnLogger.error("applyPatch - bulkDocs error", { error });
-                            reject(error);
-                        });
-                        // Store patch itself
-                        await this.db.post(Object.assign({ createTimestamp: (new Date()).valueOf() }, patch));
-                        fnLogger.info("Successfully stored patch", { version: patch.version, target: patch.target });
-                        resolve(patch.version);
-                    }
-                    catch (e) {
-                        fnLogger.error("Failed to apply patch", e);
-                        reject(new Error(e));
+                if (patch.preApply || patch.postApply) {
+                    // Jobs stage through the chain transaction; this path has none, and
+                    // silently ignoring them would apply the model without its migration.
+                    throw new Error(`applyPatch - patch '${patch.version}' carries one-shot jobs; ` +
+                        `job-carrying patches apply through the configured patch chain (ADR-0044).`);
+                }
+                fnLogger.info("Attempting to apply patch", { patch });
+                fnLogger.info("applyPatch - starting to hydrate patch docs", { docCount: patch.docs.length });
+                const hydratedDocs = await Promise.all(patch.docs.map(async (sourceDoc) => {
+                    // Work on a copy: the patch definition must survive intact. System
+                    // patches are module-level objects shared by every stack in the
+                    // process, so deleting `_rev` from one would strip the "auto" marker
+                    // permanently — the next ClientStack created in the same context
+                    // would then rewrite those documents as fresh inserts, hit a 409,
+                    // and end up without its `class` class model.
+                    let doc = Object.assign({}, sourceDoc);
+                    if (doc._rev === "auto") {
+                        delete doc._rev;
+                        const existingDoc = await this.db.get(doc._id);
+                        if (existingDoc) {
+                            doc = Object.assign(Object.assign({}, existingDoc), doc);
+                            ClientStack.mergePatchSchema(sourceDoc, existingDoc, doc);
+                        }
                     }
-                });
+                    return doc;
+                }));
+                fnLogger.info("applyPatch - hydration complete, calling bulkDocs", { docCount: hydratedDocs.length });
+                // A failing batch throws here and nothing below runs: the ledger records the
+                // moment of SUCCESSFUL application, never the attempt. The old flow rejected
+                // on failure but kept executing, so a failed patch was recorded as applied
+                // and never retried - a device whose schema trailed forever (ADR-0041).
+                const result = await this.db.bulkDocs(hydratedDocs, { isPatch: true });
+                // Per-document failures arrive in the RESOLVED array (the ADR-0038 discipline):
+                // a patch whose batch half-landed must not arm its ledger entry, or the next
+                // open would skip it and apply its dependents against a schema it never
+                // finished installing. The retry converges - hydration re-merges over whatever
+                // did land.
+                const failures = result.filter(entry => entry && entry.error);
+                if (failures.length) {
+                    throw new Error(`applyPatch - patch '${patch.version}' failed for ${failures.length} document(s): ` +
+                        failures.map((f) => { var _a; return `${f.id}: ${(_a = f.message) !== null && _a !== void 0 ? _a : f.name}`; }).join("; "));
+                }
+                fnLogger.info("applyPatch - bulkDocs completed", { result });
+                await this.recordPatchApplication(patch);
+                fnLogger.info("Successfully applied and recorded patch", { version: patch.version, target: patch.target });
+                return patch.version;
             };
             this.setListeners = () => {
                 const fnLogger = logger.child({ method: "setListeners" });
@@ -10469,15 +13723,46 @@ async function execute(_stack, params) {
              * Removes event listeners and terminates background workers.
              */
             this.close = () => {
-                var _a;
+                var _a, _b;
+                // First, and before the listeners go, so the discard events can still be
+                // observed: an uncommitted transaction is not real, and close drops it -
+                // database-transaction semantics, by decision (ADR-0039).
+                (_a = this.transactionEngine) === null || _a === void 0 ? void 0 : _a.discardAll();
                 this.cancelSync();
                 // Before the listeners go: a surviving interval would tick against a database
                 // this stack no longer serves.
-                (_a = this.jobScheduler) === null || _a === void 0 ? void 0 : _a.stop();
+                (_b = this.jobScheduler) === null || _b === void 0 ? void 0 : _b.stop();
                 this.removeAllListeners();
                 if (this.modelWorker)
                     this.modelWorker.terminate();
             };
+            /**
+             * Opens a named write transaction (ADR-0039). Requires the stack to have been
+             * opened with `transactions: true`.
+             *
+             * Writes through the handle validate at the call site and stage in memory;
+             * reads through it see the staged state overlaid on committed state. Nothing
+             * reaches the database - or replication, or any other reader - until
+             * {@link commit}. `stack.db` stays live and unchanged next to open transactions:
+             * direct writes land immediately, and only touch a transaction by making its
+             * commit refuse when they advance a staged document's revision.
+             */
+            this.beginTransaction = () => {
+                return this.transactionEngine.begin();
+            };
+            /**
+             * Flushes a transaction's staged writes as one batch through the authoring
+             * pipeline. On refusal - validation, or a document changed underneath - nothing
+             * is persisted and the transaction stays open. The report says what landed and
+             * on what storage guarantee (`adapter.atomicBatch`).
+             */
+            this.commit = (t) => {
+                return this.transactionEngine.commit(t);
+            };
+            /** Drops a transaction's staged writes. Idempotent. */
+            this.discardTransaction = (t) => {
+                this.transactionEngine.discard(t);
+            };
             /**
              * Retrieves a Class instance by name.
              * Results are cached for 15 minutes to improve performance.
@@ -10598,11 +13883,33 @@ async function execute(_stack, params) {
              * ```
              */
             this.findDocuments = async (selector, fields, skip, limit, sort) => {
+                return this.findDocumentsForView(undefined, selector, fields, skip, limit, sort);
+            };
+            /**
+             * {@link findDocuments} with an optional transaction stage overlaid - the shared
+             * implementation, so a transaction's reads and ordinary reads run the identical
+             * pipeline (policy, decryption, field visibility) and cannot drift (ADR-0039).
+             *
+             * With a stage: the database's index cannot see staged documents, so the
+             * committed query runs unwindowed, staged ids mask their committed rows, staged
+             * matches join the set, and sort/skip/limit apply after the merge. A selector
+             * over a class the stage never touched skips all of that.
+             *
+             * @internal
+             */
+            this.findDocumentsForView = async (stage, selector, fields, skip, limit, sort) => {
                 const fnLogger = logger.child({ method: "findDocuments", args: { selector, fields, skip, limit, sort } });
                 // By default request for only active documents
                 if (!selector.hasOwnProperty("active")) {
                     selector["active"] = true;
                 }
+                if (stage && stageCoversSelector(stage, selector)) {
+                    const { queryFields, extras } = widenProjection(fields, sort);
+                    const found = await this.db.find(Object.assign(Object.assign({ selector }, (queryFields ? { fields: queryFields } : {})), { limit: 2 ** 31 - 1 }));
+                    const merged = mergeStageIntoResults(stage, selector, found.docs, { sort, skip, limit, fields, extras });
+                    const readableDocs = await this.processFoundDocuments(merged, fields);
+                    return { docs: readableDocs, selector, skip, limit };
+                }
                 let indexFields = Object.keys(selector);
                 fnLogger.info("Produced index fields from selector", { indexFields });
                 let result = {
@@ -11486,6 +14793,17 @@ async function execute(_stack, params) {
                 }
             };
             this.query = async (sql, ...params) => {
+                return this.runQuery(sql, params, this);
+            };
+            /**
+             * {@link query}'s implementation, with the executor's data source as a
+             * parameter: the executor reaches documents only through stack APIs, so a
+             * transaction hands in a facade that routes them at its overlay while everything
+             * else - parsing, binding, planning - stays exactly this code (ADR-0039).
+             *
+             * @internal
+             */
+            this.runQuery = async (sql, params, execStack) => {
                 const fnLogger = logger.child({ method: "query", args: { sql, params } });
                 fnLogger.info("Executing query");
                 let astList = [];
@@ -11502,7 +14820,7 @@ async function execute(_stack, params) {
                 if (astList.length > 0) {
                     try {
                         const plan = createPlan(astList);
-                        const rows = await executePlan(this, plan, params);
+                        const rows = await executePlan(execStack, plan, params);
                         // The AST for the whole query (including unions) is the list
                         fnLogger.info("Query executed successfully", { rows, astList });
                         return { rows, ast: astList };
@@ -11605,6 +14923,9 @@ async function execute(_stack, params) {
             this.jobScheduler = new JobScheduler(this);
             this.policyEngine = new PolicyEngine(this);
             this.cryptoEngine = new CryptoEngine(this);
+            // Re-created, never carried over: `reset()` re-runs initialize, and a stage
+            // surviving a reset would resurrect uncommitted writes (ADR-0039).
+            this.transactionEngine = new TransactionEngine(this, Boolean(options === null || options === void 0 ? void 0 : options.transactions));
             if (options === null || options === void 0 ? void 0 : options.documentKey) {
                 await this.cryptoEngine.setDocumentKey(options.documentKey);
             }
@@ -11942,11 +15263,18 @@ async function execute(_stack, params) {
             await stack.initialize(conn, options);
             await stack.initdb();
             if ((options === null || options === void 0 ? void 0 : options.patches) && options.patches.length) {
-                const patches = await stack.findDocuments({
-                    "~class": { $eq: "patch" }
+                // Raw find, not findDocuments: `active` carries the ledger's own meaning
+                // (ADR-0041) - `true` is applied, `false` is deferred and must be
+                // re-attempted, absent is a legacy entry from before the flag, treated as
+                // applied. Read through the visibility filter, the dedupe saw nothing at
+                // all and every open re-applied every consumer patch (ADR-0040).
+                const ledger = await stack.db.find({
+                    selector: { "~class": "patch" },
+                    limit: 2 ** 31 - 1,
                 });
-                await stack.applyConsumerPatches(options.patches.filter(p => !patches.docs.find(existing => existing.version === p.version
-                    && existing.target === p.target)));
+                await stack.applyConsumerPatches(options.patches.filter(p => !ledger.docs.find(existing => existing.version === p.version
+                    && existing.target === p.target
+                    && existing.active !== false)));
             }
             if (options === null || options === void 0 ? void 0 : options.credentials) {
                 await stack.authenticate(options.credentials);
@@ -11967,21 +15295,419 @@ async function execute(_stack, params) {
          *
          * @param patches - Patches not yet present in this stack.
          */
+        /**
+         * The highest consumer patch version this device has applied, from the patch
+         * ledger - `null` when no consumer patch has ever applied (or they are all
+         * deferred, which for the schema gate is the same thing: the schema those
+         * patches install is not here yet). The sync layer folds this into what it
+         * publishes and compares, so consumer-schema skew between devices refuses at
+         * the gate instead of pulling documents this device's schema cannot describe
+         * (ADR-0040).
+         */
+        async getConsumerSchemaVersion() {
+            // Raw find: ledger documents carry no `active` flag (see the dedupe in
+            // {@link create}).
+            const ledger = await this.db.find({
+                selector: { "~class": "patch" },
+                limit: 2 ** 31 - 1,
+            }).catch(() => ({ docs: [] }));
+            let highest = null;
+            for (const doc of ledger.docs) {
+                if (doc.target === "system")
+                    continue;
+                // A dormant entry is a deferral (ADR-0041): the patch is known, its
+                // schema is not here - counting it would tell the sync gate this device
+                // is current and let it pull documents it cannot describe.
+                if (doc.active === false)
+                    continue;
+                const version = doc.version;
+                if (typeof version !== "string" || !semver.valid(version))
+                    continue;
+                if (!highest || semver.gt(version, highest))
+                    highest = version;
+            }
+            return highest;
+        }
         async applyConsumerPatches(patches) {
-            const fnLogger = logger.child({ method: "applyConsumerPatches" });
-            for (let index = 0; index < patches.length; index++) {
-                const patch = patches[index];
-                if (this.isLocked() && await this.patchNeedsDocumentKey(patch)) {
-                    this.deferredPatches = patches.slice(index);
-                    fnLogger.warn("Deferred patches that write encrypted attributes until the stack is unlocked", {
-                        from: patch.version,
-                        count: this.deferredPatches.length,
-                    });
+            if (!patches.length) {
+                this.deferredPatches = [];
+                return;
+            }
+            // EVERY consumer chain - class models, data documents, jobs, mixed - stages
+            // through the one internal transaction (ADR-0042). The original protocol
+            // scoped itself to class-only chains and kept a sequential fallback for the
+            // rest; the mixed extension it recorded turned out to be already built (the
+            // sweep judges data docs by staged models since ADR-0044, and the pipeline
+            // resolves batch-mates regardless of order since ADR-0043), so the fork was
+            // deleted rather than extended. A data-only chain gains the same contract:
+            // all-or-nothing, nothing armed unless the whole chain lands.
+            return this.applyConsumerPatchChain(patches);
+        }
+        /**
+         * The stack a patch job executes against (ADR-0044): reads see the chain
+         * transaction's overlay, writes stage into it - so a migration's data
+         * transformation lands in the same commit as the model it prepares, or not at
+         * all. While the stack is locked, class-aware reads of an encrypting class
+         * THROW instead of serving the null convention: a migration wants the refusal
+         * (a `requiresKey: false` job that was declared wrongly must fail loudly, and
+         * the chain converts that failure to a deferral). Raw reads (`db.find`) bypass
+         * the class-aware path by design and stay the author's responsibility.
+         */
+        createPatchJobStack(t) {
+            const stack = this;
+            const resolveClass = async (className) => {
+                var _a;
+                return (_a = classFromStage(stack, t.stage, className)) !== null && _a !== void 0 ? _a : await stack.getClassSnapshot(className).catch(() => null);
+            };
+            const assertReadableWhileLocked = async (className) => {
+                if (!stack.isLocked() || typeof className !== "string" || !className)
                     return;
+                const classObj = await resolveClass(className);
+                if (classObj && classObj.getEncryptedAttributes().length) {
+                    throw new StackLockedError(className);
+                }
+            };
+            const selectorClassNames = (selector) => {
+                const constraint = selector === null || selector === void 0 ? void 0 : selector["~class"];
+                if (typeof constraint === "string")
+                    return [constraint];
+                if (constraint && typeof constraint === "object") {
+                    if (typeof constraint.$eq === "string")
+                        return [constraint.$eq];
+                    if (Array.isArray(constraint.$in))
+                        return constraint.$in.filter((name) => typeof name === "string");
                 }
-                await this.applyPatch(patch);
+                return [];
+            };
+            // Reads are SYSTEM-LEVEL: raw overlay plus decrypt-when-keyed, never the
+            // policy-filtered pipeline. A migration runs before any session exists,
+            // and a policy-filtered massage would silently transform only the subset
+            // an absent session could see - the patch path's own direct writes never
+            // pass through policy either.
+            const openWhenKeyed = async (doc) => {
+                var _a;
+                if (!doc || !((_a = stack.cryptoEngine) === null || _a === void 0 ? void 0 : _a.isEnabled()) || !stack.cryptoEngine.getDocumentKey())
+                    return doc;
+                if (!stack.cryptoEngine.identifyEncryptedKeys(doc).length)
+                    return doc;
+                const classObj = await stack.getClassSnapshot(doc["~class"]).catch(() => null);
+                if (classObj)
+                    await stack.cryptoEngine.decryptDocument(doc, classObj);
+                return doc;
+            };
+            const facade = Object.create(stack);
+            facade.findDocuments = async (selector, fields, skip, limit, sort) => {
+                for (const name of selectorClassNames(selector))
+                    await assertReadableWhileLocked(name);
+                const withDefault = (selector === null || selector === void 0 ? void 0 : selector.hasOwnProperty("active")) ? selector : Object.assign(Object.assign({}, selector), { active: true });
+                const { docs } = await t.db.find({ selector: withDefault, fields, skip, limit, sort });
+                for (const doc of docs)
+                    await openWhenKeyed(doc);
+                return { docs, selector: withDefault, skip, limit };
+            };
+            facade.findDocumentsIterator = function (selector_1) {
+                return __asyncGenerator(this, arguments, function* (selector, options = {}) {
+                    const result = yield __await(facade.findDocuments(selector, options.fields));
+                    for (const doc of result.docs)
+                        yield yield __await(doc);
+                });
+            };
+            facade.canApplyQueryLimitEarly = async () => false;
+            facade.ensureSortIndex = async () => false;
+            facade.query = (sql, ...params) => stack.runQuery(sql, params, facade);
+            facade.getDocument = async (docId) => {
+                const doc = await t.db.get(docId);
+                await assertReadableWhileLocked(doc === null || doc === void 0 ? void 0 : doc["~class"]);
+                return openWhenKeyed(doc);
+            };
+            facade.createDoc = (docId, type, _classObj, params) => t.createDoc(docId, type, params);
+            facade.createDocs = (docs, type) => t.createDocs(docs, type);
+            facade.deleteDocument = (docId) => t.deleteDocument(docId);
+            facade.getClass = async (name, ...rest) => {
+                var _a;
+                // A class an earlier patch staged exists for this job even though it is
+                // not committed yet - the ADR-0043 rule, applied to the chain.
+                const real = (_a = classFromStage(stack, t.stage, name)) !== null && _a !== void 0 ? _a : await stack.getClass(name, ...rest);
+                if (!real)
+                    return real;
+                const wrapped = Object.create(real);
+                wrapped.getCards = (selector, fields, skip, limit, sort) => facade.findDocuments(Object.assign(Object.assign({}, (selector || {})), { "~class": { $eq: real.name } }), fields, skip, limit, sort)
+                    .then((result) => result.docs);
+                wrapped.addCard = (params) => t.createDoc(null, real.name, params);
+                wrapped.addCards = (cards) => t.createDocs(cards.map((params) => ({ docId: null, params })), real.name);
+                wrapped.deleteCard = (cardId) => t.deleteDocument(cardId);
+                return wrapped;
+            };
+            facade.db = {
+                get: async (docId, options) => {
+                    const doc = await t.db.get(docId, options);
+                    await assertReadableWhileLocked(doc === null || doc === void 0 ? void 0 : doc["~class"]);
+                    return openWhenKeyed(doc);
+                },
+                bulkGet: (request) => t.db.bulkGet(request),
+                find: (query) => t.db.find(query),
+                put: (doc, options) => t.db.put(doc, options),
+                post: (doc) => t.db.post(doc),
+                remove: (doc, rev) => t.db.remove(doc, rev),
+                bulkDocs: (docs, options) => t.db.bulkDocs(docs, options),
+            };
+            return facade;
+        }
+        /**
+         * Runs one of a patch's one-shot jobs against the transaction facade. The run
+         * receipt is a `~JobRun` with NO `jobId` - patch jobs are deliberately never
+         * persisted as `~Job` documents, so there is no row to point at (`~sys-0.0.17`
+         * made the foreign key optional for exactly this) - carrying the patch
+         * identity in `runtimeArgs`. It writes DIRECTLY, win or lose: a failed
+         * migration's receipt is the troubleshooting trail and must survive the
+         * discard that protects everything else (ADR-0044).
+         */
+        async runPatchJob(t, patch, phase) {
+            var _a, _b, _c;
+            const job = patch[phase];
+            const shortPhase = phase === "preApply" ? "pre" : "post";
+            const startTime = Date.now();
+            const receipt = {
+                _id: `JobRun-${this.cryptoEngine.generateRandomString(12)}`,
+                "~class": "~JobRun",
+                status: "FAILURE",
+                triggerType: "event",
+                startTime,
+                runtimeArgs: {
+                    patchVersion: patch.version,
+                    patchTarget: (_a = patch.target) !== null && _a !== void 0 ? _a : "app",
+                    phase: shortPhase,
+                    jobName: job.name,
+                },
+            };
+            try {
+                const facade = this.createPatchJobStack(t);
+                // The ~Job convention, verbatim: content defines execute(stack, params, job).
+                const fn = new Function("stack", "params", "job", `"use strict"; ${job.content}; return execute(stack, params, job);`);
+                await fn(facade, (_b = job.params) !== null && _b !== void 0 ? _b : {}, { name: job.name, phase: shortPhase, version: patch.version });
+                receipt.status = "SUCCESS";
+            }
+            catch (error) {
+                receipt.errorMessage = String((_c = error === null || error === void 0 ? void 0 : error.message) !== null && _c !== void 0 ? _c : error);
+                throw error;
+            }
+            finally {
+                receipt.endTime = Date.now();
+                receipt.durationMs = receipt.endTime - startTime;
+                await this.db.bulkDocs([receipt]).catch(() => undefined);
             }
+        }
+        /**
+         * The ADR-0042 protocol: the whole pending chain stages through one internal
+         * transaction - patch N+1 hydrates against the classes patch N staged, so the
+         * ADR-0038 merge composes in memory before anything is real - propagation is
+         * validated dry with nothing kept, and one commit lands every staged doc (class
+         * models and data documents alike, since the mixed extension) as one batch
+         * through the unchanged pipeline, where real propagation runs. The ledger
+         * (ADR-0041) arms only after that commit; any refusal beforehand persists
+         * nothing and names the patch at fault.
+         */
+        async applyConsumerPatchChain(patches) {
+            var _a, _b, _c;
+            const fnLogger = logger.child({ method: "applyConsumerPatchChain" });
             this.deferredPatches = [];
+            const t = this.transactionEngine.beginInternal();
+            // How the deferral barrier sees the chain: a class staged by an earlier
+            // patch counts as existing, so patch N+1 defers exactly as it would have
+            // when patch N had already committed - "unchanged" (ADR-0042 §2) means
+            // unchanged decisions, not unchanged lookups.
+            const stagedClassSchema = (className) => {
+                var _a;
+                for (const entry of t.stage.values()) {
+                    const doc = entry.doc;
+                    if (isClassModel(doc) && (doc._id === className || doc.name === className)) {
+                        return (_a = doc.schema) !== null && _a !== void 0 ? _a : null;
+                    }
+                }
+                return null;
+            };
+            // For the dry-run's error report: which patch last touched a class.
+            const patchByClassId = new Map();
+            const deferFrom = async (index) => {
+                this.deferredPatches = patches.slice(index);
+                fnLogger.warn("Deferred patches until the stack is unlocked", {
+                    from: patches[index].version,
+                    count: this.deferredPatches.length,
+                });
+                for (const deferred of this.deferredPatches) {
+                    await this.recordPatchDeferral(deferred);
+                }
+            };
+            const stagedPatches = [];
+            try {
+                for (let index = 0; index < patches.length; index++) {
+                    const patch = patches[index];
+                    if (this.isLocked() && await this.patchNeedsDocumentKey(patch, stagedClassSchema)) {
+                        await deferFrom(index);
+                        break;
+                    }
+                    // One patch's whole staging - pre-apply job writes included - can be
+                    // unwound alone: a locked refusal converts this patch to a deferral
+                    // while the already-staged prefix goes on to commit.
+                    const before = t.stage.snapshot();
+                    try {
+                        if (patch.preApply) {
+                            await this.runPatchJob(t, patch, "preApply");
+                        }
+                        await this.stagePatch(t, patch);
+                    }
+                    catch (error) {
+                        if (this.isLocked() && (error === null || error === void 0 ? void 0 : error.name) === "StackLockedError") {
+                            // A `requiresKey: false` claimed wrongly (ADR-0044): degrade
+                            // to what a correct declaration would have done, instead of
+                            // failing the open.
+                            t.stage.restore(before);
+                            await deferFrom(index);
+                            break;
+                        }
+                        // Patch fault or init-state fault (ADR-0042): zero persisted.
+                        throw new Error(`Patch '${patch.version}' refused while ${patch.preApply ? "preparing" : "staging"}: ${(_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : error}`);
+                    }
+                    for (const doc of (_b = patch.docs) !== null && _b !== void 0 ? _b : []) {
+                        if (isClassModel(doc))
+                            patchByClassId.set(doc._id, patch.version);
+                    }
+                    stagedPatches.push(patch);
+                }
+                if (!stagedPatches.length) {
+                    this.transactionEngine.discard(t);
+                    return;
+                }
+                await this.validateChainPropagation(t, patchByClassId);
+                // Environment faults from here - a concurrent write between dry-run and
+                // commit, a per-document conflict - reject as they are: nothing recorded,
+                // the chain retries next open.
+                await this.transactionEngine.commit(t);
+            }
+            catch (error) {
+                this.transactionEngine.discard(t);
+                throw error;
+            }
+            // Post-apply phase (ADR-0044): the models have landed; backfills run in a
+            // second staged transaction, one commit of their own, and the ledger arms
+            // only after. A post failure leaves the chain unarmed: the next open
+            // re-stages to an empty diff and re-runs post - which is why jobs must be
+            // idempotent.
+            if (stagedPatches.some(patch => patch.postApply)) {
+                const post = this.transactionEngine.beginInternal();
+                try {
+                    for (const patch of stagedPatches) {
+                        if (!patch.postApply)
+                            continue;
+                        await this.runPatchJob(post, patch, "postApply");
+                    }
+                    await this.transactionEngine.commit(post);
+                }
+                catch (error) {
+                    this.transactionEngine.discard(post);
+                    if (this.isLocked() && (error === null || error === void 0 ? void 0 : error.name) === "StackLockedError") {
+                        // Models landed, backfill needs the key: hold the arming behind
+                        // it. Dormant entries keep the sync gate honest, and the unlock
+                        // replay re-runs the (idempotent) chain and arms.
+                        for (const patch of stagedPatches) {
+                            await this.recordPatchDeferral(patch);
+                        }
+                        this.deferredPatches = [...stagedPatches, ...this.deferredPatches];
+                        return;
+                    }
+                    throw new Error(`Patch chain post-apply failed: ${(_c = error === null || error === void 0 ? void 0 : error.message) !== null && _c !== void 0 ? _c : error}`);
+                }
+            }
+            for (const patch of stagedPatches) {
+                await this.recordPatchApplication(patch);
+            }
+            fnLogger.info("Applied patch chain", { count: stagedPatches.length });
+        }
+        /**
+         * Stages one patch's documents into the chain transaction. Hydration reads
+         * through the transaction's overlay, so an `_rev: "auto"` document merges onto
+         * what an earlier patch staged - or onto committed state when the chain has not
+         * touched it.
+         */
+        async stagePatch(t, patch) {
+            var _a;
+            for (const sourceDoc of (_a = patch.docs) !== null && _a !== void 0 ? _a : []) {
+                let doc = Object.assign({}, sourceDoc);
+                if (doc._rev === "auto") {
+                    delete doc._rev;
+                    const existingDoc = await t.db.get(doc._id);
+                    doc = Object.assign(Object.assign({}, existingDoc), doc);
+                    ClientStack.mergePatchSchema(sourceDoc, existingDoc, doc);
+                    // The overlay hands staged docs back without a revision until one
+                    // exists; the stated revision must match what the write replaces.
+                    if (existingDoc._rev !== undefined)
+                        doc._rev = existingDoc._rev;
+                    else
+                        delete doc._rev;
+                }
+                await t.db.put(doc);
+            }
+        }
+        /**
+         * ADR-0042 §3 - propagation, validated dry: for every class the chain staged
+         * over a committed predecessor, run the schema delta across the class's
+         * committed documents and keep nothing. The point is the refusal - a document
+         * that cannot satisfy the new model fails here, before the first write, naming
+         * the patch, the document and the attribute.
+         */
+        async validateChainPropagation(t, patchByClassId) {
+            var _a, _b;
+            for (const entry of t.stage.values()) {
+                const staged = entry.doc;
+                if (!isClassModel(staged))
+                    continue;
+                const previous = await this.db.get(staged._id).catch((error) => {
+                    if ((error === null || error === void 0 ? void 0 : error.name) === "not_found" || (error === null || error === void 0 ? void 0 : error.status) === 404)
+                        return null;
+                    throw error;
+                });
+                // A class the chain creates propagates to nothing.
+                if (!previous)
+                    continue;
+                const schemaDelta = jsondiffpatch.diff(previous.schema, staged.schema);
+                if (!schemaDelta)
+                    continue;
+                const classObj = await Class.buildFromModel(this, previous, { subscribe: false });
+                // Raw read, not getCards: patches apply during `create()`, before any
+                // session exists, and the policy-checked read path refuses without one.
+                // The dry-run wants the stored documents; encrypted attributes are
+                // opened explicitly when a key is present (a keyless encrypting class
+                // never reaches here - the deferral barrier held its patch back).
+                const found = await this.db.find({
+                    selector: { "~class": classObj.name, active: true },
+                    limit: 2 ** 31 - 1,
+                });
+                const decrypts = ((_a = this.cryptoEngine) === null || _a === void 0 ? void 0 : _a.isEnabled())
+                    && this.cryptoEngine.getDocumentKey()
+                    && classObj.getEncryptedAttributes().length > 0;
+                for (let document of found.docs) {
+                    // A committed document superseded in the stage - a pre-apply job's
+                    // massage (ADR-0044) - is judged as its staged version: that is what
+                    // the commit will actually write. A staged delete leaves nothing to
+                    // propagate onto.
+                    const supersededBy = t.stage.get(document._id);
+                    if (supersededBy) {
+                        if (supersededBy.op === "delete")
+                            continue;
+                        document = structuredClone(supersededBy.doc);
+                    }
+                    else if (decrypts) {
+                        await this.cryptoEngine.decryptDocument(document, classObj);
+                    }
+                    try {
+                        await applySchemaDelta(document, schemaDelta, classObj, staged.schema);
+                    }
+                    catch (error) {
+                        const version = patchByClassId.get(staged._id);
+                        throw new Error(`Patch '${version !== null && version !== void 0 ? version : "?"}' cannot apply to class '${classObj.name}': ${(_b = error === null || error === void 0 ? void 0 : error.message) !== null && _b !== void 0 ? _b : error}`);
+                    }
+                }
+            }
         }
         /**
          * Decides whether applying a patch would write an encrypted attribute.
@@ -11993,26 +15719,54 @@ async function execute(_stack, params) {
          * simulate schema evolution ahead of time.
          *
          * @param patch - The patch about to be applied.
+         * @param stagedSchema - Chain staging only (ADR-0042): resolves a class the
+         * current transaction already staged, so patch N+1 defers exactly as it would
+         * have when patch N had committed.
          * @returns `true` if any document in it belongs to a class with encrypted attributes.
          */
-        async patchNeedsDocumentKey(patch) {
+        async patchNeedsDocumentKey(patch, stagedSchema) {
+            var _a;
+            // A one-shot job's touch-set cannot be inspected, so the author answers the
+            // barrier's question: unstated defaults to "needs the key" - forgetting the
+            // flag costs latency (the job runs at unlock), never correctness. An
+            // explicit `requiresKey: false` opts into locked execution (ADR-0044).
+            const jobs = [patch.preApply, patch.postApply].filter(Boolean);
+            if (jobs.some(job => job.requiresKey !== false))
+                return true;
             const hasEncryptedAttribute = (schema) => !!schema && Object.values(schema).some((attribute) => { var _a; return ((_a = attribute === null || attribute === void 0 ? void 0 : attribute.config) === null || _a === void 0 ? void 0 : _a.encrypted) === true; });
+            const knownSchema = async (className) => {
+                const staged = stagedSchema === null || stagedSchema === void 0 ? void 0 : stagedSchema(className);
+                if (staged)
+                    return staged;
+                const stored = await this.getClassModel(className).catch(() => null);
+                return stored === null || stored === void 0 ? void 0 : stored.schema;
+            };
             const schemasInPatch = new Map();
             for (const doc of patch.docs) {
                 if (isClassModel(doc) && doc.schema)
                     schemasInPatch.set(doc._id, doc.schema);
             }
             for (const doc of patch.docs) {
-                // Class models describe encryption; they never carry an encrypted value.
-                if (isClassModel(doc))
+                // A class model carries no encrypted value itself - but *updating* one
+                // triggers propagation over the class's existing documents (ADR-0038),
+                // and when the class encrypts, that propagation both decrypts (getCards)
+                // and re-encrypts (the rewrite): key work on both sides. A locked stack
+                // must defer it or the replay fails on the first document (ADR-0040).
+                // A class that does not exist yet propagates to nothing and stays safe
+                // to apply locked - that is how the schema itself can arrive pre-unlock.
+                if (isClassModel(doc)) {
+                    const predecessor = await knownSchema((_a = doc.name) !== null && _a !== void 0 ? _a : doc._id);
+                    if (predecessor && (hasEncryptedAttribute(predecessor) || hasEncryptedAttribute(doc.schema))) {
+                        return true;
+                    }
                     continue;
+                }
                 const className = doc["~class"];
                 if (!className)
                     continue;
                 if (hasEncryptedAttribute(schemasInPatch.get(className)))
                     return true;
-                const stored = await this.getClassModel(className).catch(() => null);
-                if (hasEncryptedAttribute(stored === null || stored === void 0 ? void 0 : stored.schema))
+                if (hasEncryptedAttribute(await knownSchema(className)))
                     return true;
             }
             return false;
@@ -12197,6 +15951,68 @@ async function execute(_stack, params) {
                 throw new Error(e);
             }
         }
+        /**
+         * Finds a patch's ledger entry, raw - ledger documents are read outside the
+         * `active: true` visibility convention because `active` carries the ledger's own
+         * meaning here: `true` is applied, `false` is deferred, absent is a legacy entry
+         * from before the flag (treated as applied). See ADR-0041.
+         */
+        async findPatchLedgerEntry(patch) {
+            var _a;
+            const selector = { "~class": "patch", version: patch.version };
+            // A targetless patch is legal; `undefined` in a Mango selector is not.
+            if (patch.target !== undefined)
+                selector.target = patch.target;
+            const found = await this.db.find({ selector, limit: 10 }).catch(() => ({ docs: [] }));
+            return (_a = found.docs[0]) !== null && _a !== void 0 ? _a : null;
+        }
+        /**
+         * Records a successful application: the ledger entry arms with `active: true` -
+         * flipping the deferral entry in place when one exists, so a replayed patch does
+         * not duplicate its record.
+         */
+        async recordPatchApplication(patch) {
+            const existing = await this.findPatchLedgerEntry(patch);
+            if (existing) {
+                if (existing.active === true)
+                    return;
+                await this.db.put(Object.assign(Object.assign({}, existing), { active: true, appliedTimestamp: Date.now() }));
+                return;
+            }
+            await this.db.post(Object.assign(Object.assign({ createTimestamp: Date.now() }, patch), { active: true }));
+        }
+        /**
+         * Records a deferral: the patch is known but dormant (`active: false`), waiting
+         * on the document key. The entry is what makes a deferred device honest at the
+         * sync gate - {@link getConsumerSchemaVersion} does not count it.
+         */
+        async recordPatchDeferral(patch) {
+            const existing = await this.findPatchLedgerEntry(patch);
+            if (existing)
+                return;
+            await this.db.post(Object.assign(Object.assign({ createTimestamp: Date.now() }, patch), { active: false }));
+        }
+        /**
+         * The ADR-0038 half of patch hydration: `schema` does not ride the shallow
+         * merge, which would replace it wholesale - it merges attribute by attribute.
+         * A patch states only the attributes it changes, an absent attribute stays as
+         * stored, and an explicit `null` entry drops the attribute - from the model
+         * here, and from the documents when the write propagates. Shared by
+         * {@link applyPatch} and the chain staging of ADR-0042 so the two cannot drift.
+         */
+        static mergePatchSchema(sourceDoc, existingDoc, doc) {
+            const incoming = sourceDoc === null || sourceDoc === void 0 ? void 0 : sourceDoc.schema;
+            const stored = existingDoc === null || existingDoc === void 0 ? void 0 : existingDoc.schema;
+            if (incoming && typeof incoming === "object" && !Array.isArray(incoming)
+                && stored && typeof stored === "object" && !Array.isArray(stored)) {
+                const merged = Object.assign(Object.assign({}, stored), incoming);
+                for (const name of Object.keys(incoming)) {
+                    if (incoming[name] === null)
+                        delete merged[name];
+                }
+                doc.schema = merged;
+            }
+        }
         async applyPatches(schemaVersion) {
             const fnLogger = logger.child({ method: "applyPatches", args: { schemaVersion } });
             let _schemaVersion = schemaVersion;
@@ -13537,6 +17353,14 @@ async function execute(_stack, params) {
     exports.StackSyncHandle = StackSyncHandle;
     exports.StackWriteGuardError = StackWriteGuardError;
     exports.SyncSchemaMismatchError = SyncSchemaMismatchError;
+    exports.TransactionConflictError = TransactionConflictError;
+    exports.TransactionDb = TransactionDb;
+    exports.TransactionEngine = TransactionEngine;
+    exports.TransactionHandle = TransactionHandle;
+    exports.TransactionStateError = TransactionStateError;
+    exports.TransactionUnsupportedDocError = TransactionUnsupportedDocError;
+    exports.TransactionValidationError = TransactionValidationError;
+    exports.TransactionsDisabledError = TransactionsDisabledError;
     exports.Trigger = Trigger;
     exports.classTenants = classTenants;
     exports.collectQueryClasses = collectQueryClasses;
@@ -13555,6 +17379,7 @@ async function execute(_stack, params) {
     exports.nextOccurrence = nextOccurrence;
     exports.parseSchedule = parseSchedule;
     exports.publishSchemaVersion = publishSchemaVersion;
+    exports.readRemoteConsumerSchemaVersion = readRemoteConsumerSchemaVersion;
     exports.readRemoteSchemaVersion = readRemoteSchemaVersion;
     exports.resolveInternalClasses = resolveInternalClasses;
     exports.withFilterIdentity = withFilterIdentity;