@panphora/clayjs 1.24.0 → 1.24.1

package/src/core/unsaved-warning.js

@@ -16,7 +16,7 @@
  */
 
 import { isEditMode, isDraftMode } from "./is-edit-mode.js";
-import { draftStoreFailed, flushDraft } from "./draft-mode.js";
+import { draftStoreFailed, draftUnconfirmed, flushDraft } from "./draft-mode.js";
 import { captureForDirtyCheck } from "./snapshot.js";
 import { getLastSavedDirty, sessionParked, styleAdoptionPending } from "./save.js";
 import { logUnloadDiffSync, preloadIfEnabled } from "../lib/autosave-debug-gate.js";
@@ -57,7 +57,7 @@ export function hasUnsavedChanges() {
   // Work outside the DOM first: it needs no capture, and a capture that throws
   // must not hide it. The demo plugin does not save it either, so it warns there too.
   if (hasUnsavedState()) return true;
-  if (isDraftMode) return draftStoreFailed();
+  if (isDraftMode) return draftStoreFailed() || draftUnconfirmed();
 
   // The demo plugin saves the page's bytes into this browser's own storage, so
   // leaving loses none of them.

package/src/lib/idb-error-code.js

@@ -0,0 +1,20 @@
+/**
+ * The failure code a thrown IndexedDB error means to a caller.
+ *
+ * Only one of these is about this device being full (`quota`); the rest are about
+ * the database being unreachable, refused, or mid-upgrade somewhere else. None of
+ * them is a save result, and none of them is durable.
+ *
+ * @param {*} error
+ * @returns {string}
+ */
+export function codeFor(error) {
+  const name = error?.name || "";
+  if (name === "QuotaExceededError" || name === "NS_ERROR_DOM_QUOTA_REACHED") return "quota";
+  if (name === "VersionError") return "unknown-schema";
+  if (name === "DataCloneError") return "uncloneable";
+  if (name === "AbortError") return "aborted";
+  if (name === "TransactionInactiveError" || name === "InvalidStateError") return "aborted";
+  if (name === "SecurityError" || name === "UnknownError" || name === "NotSupportedError") return "unavailable";
+  return "error";
+}

package/src/loader.js

@@ -174,6 +174,8 @@ export async function boot(base, params, readyResolve, manifest = null, suppleme
       continue;
     }
     loaded[path] = mod;
+    // A draft held only in the database goes onto the page before a plugin that reads the page loads.
+    if (path === "plugins/visitor-drafts.js") await mod.restoring;
     if (path === "plugins/page-view.js") mod.start(readerOptions);
     attachPluginMember(path, mod, loaded); // immediately, not after the loop: hypercms's ?cms=true
                                      // auto-open runs as a microtask queued during ITS evaluation

package/src/plugins/page.js

@@ -1,6 +1,7 @@
 import { FEATURES, featureForNode, featureForType } from "../page/features/registry.js";
 import { mergeEngine } from "../sync/merge-engine.js";
 import { registerUnsavedState } from "../lib/unsaved-state.js";
+import Mutation from "../lib/mutation.js";
 import { hostMeta } from "../core/host-meta.js";
 import { savePageForce, holdAllSaves, releaseAllSaves, suspendAutosave, resumeAutosave, getLastSavedBytes, savesAdmitted, claimFailure } from "../core/save.js";
 import { setSaveHeader, onSaveAccepted } from "../core/save-core.js";
@@ -1250,9 +1251,16 @@ function mountAndAttach(inst, source, loaded) {
     if (shell) shell.inert = true;
     if (loaded.featureIds.length && shell) shell.style.visibility = "hidden";
     // One synchronous move: the finished shell replaces the saved surface as a
-    // single change, and the article element itself stays where it is.
-    if (!loaded.featureIds.length) for (const node of savedContent) node.remove();
-    if (shell) article.appendChild(shell);
+    // single change, and the article element itself stays where it is. The editor
+    // chunk can land after the boot settle, so the move is paused: it is the editor
+    // presenting the saved surface, never an edit to save.
+    Mutation.pause();
+    try {
+      if (!loaded.featureIds.length) for (const node of savedContent) node.remove();
+      if (shell) article.appendChild(shell);
+    } finally {
+      Mutation.resume();
+    }
     loaded.refreshView?.(view);
     binding.attach(view);
     // The page's history tells whoever presents it once it exists (a menu opened before the
@@ -1462,9 +1470,15 @@ function mountAndAttach(inst, source, loaded) {
   // the commit that enters edit cannot fail here.
   function openInput(inst, mounted) {
     const shell = mounted.view.dom.closest(".blockeditor-shell");
+    // Like the boot move, revealing the editor over the saved surface is presentation, not an edit.
     const showEditor = () => {
-      for (const node of savedContent) node.remove();
-      if (shell) shell.style.visibility = "";
+      Mutation.pause();
+      try {
+        for (const node of savedContent) node.remove();
+        if (shell) shell.style.visibility = "";
+      } finally {
+        Mutation.resume();
+      }
     };
     // A replacement that landed during the feature wait keeps the editor read-only,
     // exactly as one that landed before it does.

package/src/plugins/sortable.js

@@ -188,6 +188,13 @@ function makeSortable(sortableElem, Sortable, record = loose) {
   let options = {};
   options.draggable = draggableSelector(sortableElem);
 
+  // A reorder is not a text drag. SortableJS writes the item's text onto the drag by
+  // default, and a rich text field under the drop pastes it in, duplicating the text.
+  options.setData = (dataTransfer) => {
+    dataTransfer.clearData();
+    dataTransfer.setData('application/x-clay-sortable', '');
+  };
+
   // Check if Sortable instance already exists
   if (Sortable.get(sortableElem)) return;
 

package/src/plugins/visitor-drafts/commit.js

@@ -0,0 +1,303 @@
+/**
+ * The one change a visitor draft's stored state ever takes.
+ *
+ * IndexedDB holds one record per draft key K, and only `transact()` changes it: one
+ * readwrite transaction reads what is stored, runs `commit()` over it, and writes the
+ * result. IndexedDB runs readwrite transactions on a store one after another across every
+ * tab of the origin, so this is the single writer, with no lock and no leader tab.
+ *
+ * What it applies:
+ *
+ *   - operations: for each top-level key a tab changed, the value before (`b`) and after
+ *     (`m`), a missing one meaning the key was absent. Each carries its own merge base, so
+ *     the store's `merge3` lays it over whatever is stored. A tab's operations are a
+ *     chain `{tab, reset, acked, ops: [{seq, savedAt, keys, unit?}]}`, where `reset` is
+ *     the Start over marker of the generation the tab shows (a tab knows that before its
+ *     first transaction; it does not know the number). An operation applies only when
+ *     its chain's `reset` is the stored one and its `seq` is the next for its tab, so
+ *     each applies exactly once and in order, whichever tab delivers it;
+ *   - Start over: "end generation g", given explicitly or as a marker `<g+1>~<random>`
+ *     in `localStorage`; an unverified marker starts empty and keeps recovery copies;
+ *   - the move: the full version 1 record in `localStorage`, taken in as the first record
+ *     when nothing is stored yet;
+ *   - another writer's record: a version 1 record in `localStorage` without the cache's
+ *     `w` field, written by a tab on a released ClayJS or by a page load of this one that
+ *     had no database. It is taken in once: merged when the copy it was built on is held
+ *     here, kept whole as a recovery copy when it is not. Nothing is merged on a guess.
+ *
+ * Stored rows (JSON text): K (the record, today's format), `K:meta`
+ * `{gen, rev, reset, ended?, tabs: {tab: {seq, at}}, foreign, unit, recovery?}`, `K:v1base` (the
+ * last record of another writer that was merged), `K:op:<tab>` (a chain a tab left at a
+ * hide), `K:conflict:<id>` with `K:conflict` naming the latest, and `K:recovery:<mark>`.
+ * `meta.unit` is the mark of the Block editor page the record holds (`unitMark`). A record
+ * id or ancestry identifies another writer's held base or the reset its copy follows.
+ * Operations of this ClayJS never read one. Recovery rows can also hold exact ended chains.
+ *
+ * This module imports nothing: the page fetches it with the database, after the boot, and
+ * the store that is already on the page hands it `merge3` and `unitMark`.
+ */
+
+export const LINEAGE = 32;
+// Recovery copies kept per draft, newest first.
+export const RECOVERY_KEEP = 8;
+// A tab not heard from in this long is forgotten; a chain it still sends carries `acked`.
+export const TAB_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+
+const clone = (value) => (value === undefined ? undefined : JSON.parse(JSON.stringify(value)));
+const isPlain = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+
+export const metaKey = (key) => key + ":meta";
+export const rowKey = (key, tab) => `${key}:op:${tab}`;
+export const conflictKey = (key, id) => (id === undefined ? key + ":conflict" : `${key}:conflict:${id}`);
+export const recoveryKey = (key, mark) => `${key}:recovery:${mark}`;
+
+// A version 1 record without the cache's `w` field is another writer's.
+export const isForeign = (value) => isPlain(value) && value.v === 1 && value.w === undefined && isPlain(value.data);
+// What names one: its id, or its time for a record from before ids (ClayJS 1.22.0 and earlier).
+export const foreignMark = (record) => (typeof record.id === "string" ? record.id : "at:" + record.savedAt);
+
+export const markerFor = (gen, nonce) => `${gen}~${nonce}`;
+export function markerGen(marker) {
+  const match = /^(\d+)~/.exec(marker ?? "");
+  return match ? Number(match[1]) : null;
+}
+
+// One operation's keys laid over `data` with the store's three-way merge.
+export function applyKeys(data, keys, merge3) {
+  const base = { ...data };
+  const mine = { ...data };
+  for (const [name, pair] of Object.entries(keys)) {
+    if ("b" in pair) base[name] = pair.b; else delete base[name];
+    if ("m" in pair) mine[name] = pair.m; else delete mine[name];
+  }
+  return merge3(base, mine, data);
+}
+
+export const isChain = (value) => isPlain(value) && typeof value.tab === "string" && typeof value.reset === "string" && Array.isArray(value.ops);
+export const recoveryMark = (copy) => isChain(copy) ? `op:${copy.tab}:${copy.ops.at(-1)?.seq ?? copy.acked ?? 0}` : foreignMark(copy);
+
+// Cleanup needs proof for this exact chain, even when its generation has ended.
+export function settled(chain, meta) {
+  if (isPlain(chain) && meta.recovery?.includes(recoveryMark(chain))) return true;
+  if (!isChain(chain)) return false;
+  const at = Math.max(chain.acked ?? 0, chain.reset === meta.reset ? meta.tabs[chain.tab]?.seq ?? 0 : 0);
+  return chain.ops.every((op) => op.seq <= at);
+}
+
+export function emptyMeta(marker = null) {
+  return { gen: markerGen(marker) ?? 1, rev: 0, reset: marker ?? "", tabs: {}, foreign: null, unit: null };
+}
+
+const unitOf = (record) => (record && record.blockeditor ? { live: record.live, blockeditor: record.blockeditor } : null);
+
+// The ids a record built on `record` descends from, nearest first.
+function lineage(first, record, meta) {
+  const line = [...first, record?.id, ...(record?.ancestry ?? [])].filter((id) => typeof id === "string");
+  return line.length ? line.slice(0, LINEAGE) : ["root:" + meta.reset];
+}
+
+// The copy another writer's record was built on, when this side holds it and what it held
+// is in the stored record: the stored record itself, a cache copy of this generation, or
+// the last record of another writer that was merged. A record that descends from one of
+// them (its ancestry names it, or a storage event says it replaced that cache copy)
+// carries every change made since as its difference; the nearest one is the base.
+function foreignBase(line, { record, seen, direct, v1base, meta }) {
+  const cache = isPlain(seen) && seen.v === 1 && isPlain(seen.data) && seen.w?.reset === meta.reset ? seen : null;
+  const at = (held) => (held && typeof held.id === "string" ? line.indexOf(held.id) : -1);
+  const held = [[record, at(record)], [cache, cache && direct ? 0 : at(cache)], [v1base, at(v1base)]].filter(([, index]) => index >= 0);
+  return held.length ? held.reduce((nearest, next) => (next[1] < nearest[1] ? next : nearest))[0] : null;
+}
+
+/**
+ * @param {{meta: ?Object, record: ?Object, v1base: ?Object}} stored
+ * @param {Object} input
+ * @param {Object} input.seed - the data a generation starts from (the served page's)
+ * @param {() => string} input.newId
+ * @param {number} input.now - milliseconds
+ * @param {Function} input.merge3 - the store's three-way merge
+ * @param {Function} input.unitMark - the store's mark of a Block editor page
+ * @param {?string} [input.marker] - the Start over marker `localStorage` holds now
+ * @param {Array<{ends: number, marker: string}>} [input.resets]
+ * @param {Array<Object>} [input.chains] - oldest carriers first, the caller's own last
+ * @param {?Object} [input.local] - what `localStorage` holds at the draft's key now, parsed
+ * @param {?Object} [input.seen] - the latest cache copy the caller saw at the draft's key
+ * @param {boolean} [input.direct] - a storage event says `local` replaced exactly that copy
+ */
+export function commit(stored, { seed, newId, now, merge3, unitMark, marker = null, resets = [], chains = [], local = null, seen = null, direct = false }) {
+  const meta = stored.meta ? clone(stored.meta) : emptyMeta(marker);
+  // A database the browser cleared counts on from this ClayJS's cache, so the cache never
+  // reads as newer than the record.
+  if (!stored.meta && Number.isInteger(local?.w?.rev)) meta.rev = local.w.rev;
+  let record = stored.record ? clone(stored.record) : null;
+  let v1base = stored.v1base ? clone(stored.v1base) : null;
+  const out = { conflicts: [], recovered: [], released: [], dropped: [], stale: [], applied: {}, changed: !stored.meta };
+
+  function recover(copy, supersedes = []) {
+    const mark = recoveryMark(copy);
+    if (meta.recovery?.includes(mark)) return;
+    out.recovered.push(clone(copy));
+    const kept = [mark, ...(meta.recovery ?? []).filter((held) => held !== mark && !supersedes.includes(held))].slice(0, RECOVERY_KEEP);
+    out.dropped = [...new Set([...out.dropped, ...(meta.recovery ?? [])])].filter((held) => !kept.includes(held));
+    meta.recovery = kept;
+    out.changed = true;
+    return true;
+  }
+
+  const ends = [...resets];
+  if (marker && marker !== meta.reset) ends.push({ ends: markerGen(marker) === null ? null : markerGen(marker) - 1, marker });
+  for (const reset of ends) {
+    if (reset.marker === meta.reset || meta.ended?.includes(reset.marker) || (reset.ends !== null && reset.ends < meta.gen)) continue;
+    if (reset.ends !== meta.gen) {
+      if (record) recover(record);
+    }
+    const follows = typeof local?.reset === "string" ? local.reset === reset.marker
+      : reset.ends === null || (Array.isArray(local?.ancestry) && local.ancestry.includes("root:" + reset.marker));
+    if (isForeign(local) && foreignMark(local) !== meta.foreign && !follows) {
+      recover(local);
+      meta.foreign = foreignMark(local);
+    }
+    meta.ended = [...(meta.ended ?? []), meta.reset].slice(-LINEAGE);
+    Object.assign(meta, { gen: meta.gen + 1, reset: reset.marker, tabs: {}, unit: null });
+    meta.rev++;
+    record = null;
+    v1base = null;
+    out.changed = true;
+  }
+
+  // Nothing stored yet: the full copy in `localStorage` is the first record, whether a
+  // 1.23.0 tab wrote it (the move) or it is this ClayJS's cache, of this generation, of a
+  // database the browser has since cleared.
+  if (!stored.meta && !record && isPlain(local) && local.v === 1 && isPlain(local.data) && (local.w === undefined || local.w.reset === meta.reset)) {
+    const { w, ...copy } = local;
+    record = clone(copy);
+    if (w === undefined) {
+      v1base = clone(copy);
+      meta.foreign = foreignMark(local);
+      meta.rev++;
+    }
+  }
+  if (!stored.meta) meta.unit = unitMark(unitOf(record));
+
+  // Another writer's record met after the move, taken in once and before any chain.
+  if (stored.meta && isForeign(local) && foreignMark(local) !== meta.foreign) {
+    const mark = foreignMark(local);
+    const line = Array.isArray(local.ancestry) ? local.ancestry : [];
+    const base = record ? foreignBase(line, { record, seen, direct, v1base, meta }) : null;
+    if (typeof local.reset === "string" && meta.ended?.includes(local.reset)) {
+      if (recover(local, line)) out.released.push(clone(local));
+    } else if (!record) {
+      // Nothing is stored in this generation: its page is the draft, as it is between two
+      // tabs of that ClayJS.
+      record = clone(local);
+      v1base = clone(local);
+      meta.unit = unitMark(unitOf(record));
+      meta.rev++;
+    } else if (base) {
+      const merged = merge3(base.data, local.data, record.data);
+      // A page it carries counts as changed only when it differs from its base's.
+      const page = unitOf(local);
+      const paged = Boolean(page) && unitMark(page) !== unitMark(unitOf(base));
+      const pageMoved = paged && unitOf(record) && unitMark(unitOf(base)) !== meta.unit;
+      if (merged.conflict || pageMoved) out.conflicts.push(clone(record));
+      const unit = paged ? page : unitOf(record);
+      record = {
+        v: 1,
+        savedAt: local.savedAt ?? new Date(now).toISOString(),
+        id: newId(),
+        ancestry: lineage(typeof local.id === "string" ? [local.id] : [], record, meta),
+        data: merged.value,
+        ...(unit && { live: unit.live, blockeditor: unit.blockeditor }),
+      };
+      if (paged) meta.unit = unitMark(unit);
+      v1base = clone(local);
+      meta.rev++;
+    } else {
+      // The copy it was built on is not held here: it is kept whole, beside the draft. A
+      // later copy of the same line replaces the one it descends from.
+      if (recover(local, line)) out.released.push(clone(local));
+    }
+    meta.foreign = mark;
+    out.changed = true;
+  }
+
+  for (const chain of chains) {
+    if (!isChain(chain)) continue;
+    if (chain.reset !== meta.reset) {
+      const acked = chain.reset === stored.meta?.reset ? stored.meta.tabs[chain.tab]?.seq ?? 0 : 0;
+      if (chain.ops.some((op) => op.seq > Math.max(acked, chain.acked ?? 0))) {
+        recover(chain);
+      }
+      if (!out.stale.includes(chain.tab)) out.stale.push(chain.tab);
+      continue;
+    }
+    const before = meta.tabs[chain.tab]?.seq ?? 0;
+    let at = Math.max(before, Number.isInteger(chain.acked) ? chain.acked : 0);
+    for (const op of chain.ops) {
+      if (op.seq <= at) continue;
+      if (op.seq !== at + 1) break;
+      const merged = applyKeys(record ? record.data : seed, op.keys ?? {}, merge3);
+      const unitMoved = op.unit !== undefined && record && unitOf(record) && op.unit.seen !== meta.unit;
+      if (record && (merged.conflict || unitMoved)) out.conflicts.push(clone(record));
+      const unit = op.unit !== undefined ? op.unit.to : unitOf(record);
+      const id = newId();
+      record = {
+        v: 1,
+        savedAt: op.savedAt ?? new Date(now).toISOString(),
+        id,
+        ancestry: lineage([], record, meta),
+        data: merged.value,
+        ...(unit && { live: unit.live, blockeditor: unit.blockeditor }),
+      };
+      if (op.unit !== undefined) meta.unit = unitMark(unit);
+      meta.rev++;
+      at = op.seq;
+      out.changed = true;
+    }
+    if (at !== before || meta.tabs[chain.tab]) {
+      meta.tabs[chain.tab] = { seq: at, at: now };
+      out.changed = true;
+    }
+    out.applied[chain.tab] = at;
+  }
+
+  for (const [tab, entry] of Object.entries(meta.tabs)) {
+    if (now - (entry.at ?? 0) > TAB_TTL_MS) {
+      delete meta.tabs[tab];
+      out.changed = true;
+    }
+  }
+  return { meta, record, v1base, ...out };
+}
+
+const parse = (text) => {
+  if (text == null) return null;
+  try { return JSON.parse(text); } catch { return null; }
+};
+
+/**
+ * Run `commit()` in one readwrite transaction and write what it returns. `input` is a
+ * function, called inside the transaction once its reads are in, so what it reads from
+ * `localStorage` (journal slots, the marker, the cache) is read at that moment.
+ * Resolves on the transaction's `complete` event with `commit()`'s result.
+ */
+export function transact(drafts, key, input, options) {
+  return drafts.change(key, (raw) => {
+    const stored = { meta: parse(raw.meta), record: parse(raw.record), v1base: parse(raw.v1base) };
+    const rows = raw.rows.map(([name, text]) => [name, parse(text)]);
+    const given = input(stored);
+    const result = commit(stored, { ...given, chains: [...rows.map(([, chain]) => chain), ...(given.chains ?? [])] });
+    const puts = [];
+    const deletes = [];
+    if (result.changed) {
+      puts.push([metaKey(key), JSON.stringify(result.meta)]);
+      if (result.record) puts.push([key, JSON.stringify(result.record)]); else if (stored.record) deletes.push(key);
+      if (result.v1base) puts.push([key + ":v1base", JSON.stringify(result.v1base)]); else if (stored.v1base) deletes.push(key + ":v1base");
+    }
+    for (const copy of result.conflicts) puts.push([conflictKey(key, foreignMark(copy)), JSON.stringify(copy)]);
+    if (result.conflicts.length) puts.push([conflictKey(key), JSON.stringify(result.conflicts[result.conflicts.length - 1])]);
+    for (const copy of result.recovered) puts.push([recoveryKey(key, recoveryMark(copy)), JSON.stringify(copy)]);
+    for (const mark of result.dropped) deletes.push(recoveryKey(key, mark));
+    for (const [name, chain] of rows) if (settled(chain, result.meta)) deletes.push(name);
+    return { puts, deletes, result };
+  }, options);
+}

package/src/plugins/visitor-drafts/idb.js

@@ -0,0 +1,221 @@
+/**
+ * The IndexedDB half of the visitor draft store.
+ *
+ * One database per origin (`clay-visitor-drafts`), two stores:
+ *
+ *   records  key: the draft's text key (`clay:visitor-drafts:<slot>@<path>`) and its
+ *            siblings `<key>:<name>`; value: JSON text
+ *   parts    key: `[recordKey, regionKey, partId]`; value: `{ rev, text }`
+ *
+ * Every change to a draft goes through `change()`, one readwrite transaction that reads,
+ * merges (the caller's `build`) and writes; see `commit.js`. The only other write is
+ * `putRow()`, a tab's own chain left blind at a hide. A transaction resolves only once it
+ * completes. Every failure rejects with an Error whose `code` says what happened
+ * (`unavailable`, `blocked`, `quota`, `aborted`, `unknown-schema`, `closed`, `bad-op`,
+ * `error`).
+ */
+
+import { codeFor } from "../../lib/idb-error-code.js";
+
+export const DB_NAME = "clay-visitor-drafts";
+export const DB_VERSION = 1;
+export const RECORDS = "records";
+export const PARTS = "parts";
+const OPEN_TIMEOUT_MS = 2000;
+
+function failure(code, cause) {
+  const error = new Error(`visitor-drafts: the draft database failed (${code})`);
+  error.code = code;
+  if (cause !== undefined) error.cause = cause;
+  return error;
+}
+
+function cursorEntries(source, range) {
+  return new Promise((resolve, reject) => {
+    const out = [];
+    const req = source.openCursor(range);
+    req.onerror = () => reject(req.error);
+    req.onsuccess = () => {
+      const cursor = req.result;
+      if (!cursor) return resolve(out);
+      out.push([cursor.key, cursor.value]);
+      cursor.continue();
+    };
+  });
+}
+
+/**
+ * Open (and, the first time, create) the draft database.
+ *
+ * A database that does not open within `timeout` milliseconds (another tab holds an
+ * upgrade, or the browser never answers) rejects with `blocked`, so the caller can
+ * refuse to write over a draft it could not read rather than wait forever.
+ *
+ * @param {Object} [options]
+ * @param {?IDBFactory} [options.factory]
+ * @param {?typeof IDBKeyRange} [options.keyRange]
+ * @returns {Promise<{readAll: Function, readParts: Function, change: Function, putRow: Function, close: Function}>}
+ */
+export function openDrafts({ factory = globalThis.indexedDB, keyRange = globalThis.IDBKeyRange, name = DB_NAME, timeout = OPEN_TIMEOUT_MS } = {}) {
+  return new Promise((resolve, reject) => {
+    if (!factory || typeof factory.open !== "function" || !keyRange) return reject(failure("unavailable"));
+    let req;
+    try {
+      req = factory.open(name, DB_VERSION);
+    } catch (error) {
+      return reject(failure(codeFor(error), error));
+    }
+    let settled = false;
+    const finish = (fn, value) => {
+      if (settled) return false;
+      settled = true;
+      clearTimeout(timer);
+      fn(value);
+      return true;
+    };
+    const timer = setTimeout(() => finish(reject, failure("blocked")), timeout);
+    req.onupgradeneeded = () => {
+      const db = req.result;
+      if (!db.objectStoreNames.contains(RECORDS)) db.createObjectStore(RECORDS);
+      if (!db.objectStoreNames.contains(PARTS)) db.createObjectStore(PARTS);
+    };
+    req.onsuccess = () => {
+      const db = req.result;
+      // An open that answered after the timeout is closed again, or it would hold the
+      // database against another tab's upgrade for as long as this page stays open.
+      if (!finish(resolve, wrap(db, keyRange))) db.close();
+    };
+    req.onerror = () => finish(reject, failure(codeFor(req.error), req.error));
+    req.onblocked = () => finish(reject, failure("blocked"));
+  });
+}
+
+function wrap(db, keyRange) {
+  let closed = false;
+  // Another tab opening a newer version needs this connection to stand aside.
+  db.onversionchange = () => {
+    closed = true;
+    try { db.close(); } catch {}
+  };
+
+  function transaction(stores, mode) {
+    if (closed) throw failure("closed");
+    try {
+      return db.transaction(stores, mode);
+    } catch (error) {
+      throw failure(codeFor(error), error);
+    }
+  }
+
+  // The record named `recordKey` and its siblings (`<recordKey>:<anything>`), as a Map
+  // from key to stored text. A key that only starts with `recordKey`, such as another
+  // document whose path extends this one's, is not a sibling.
+  async function readAll(recordKey) {
+    const tx = transaction(RECORDS, "readonly");
+    const range = keyRange.bound(recordKey, recordKey + ":￿");
+    try {
+      const entries = await cursorEntries(tx.objectStore(RECORDS), range);
+      return new Map(entries.filter(([key]) => key === recordKey || key.startsWith(recordKey + ":")));
+    } catch (error) {
+      throw failure(codeFor(error), error);
+    }
+  }
+
+  // The parts of one region of one record, as a Map from part id to `{ rev, text }`.
+  // An array sorts after every string, so `[recordKey, regionKey, []]` bounds them all.
+  async function readParts(recordKey, regionKey) {
+    const tx = transaction(PARTS, "readonly");
+    const range = keyRange.bound([recordKey, regionKey], [recordKey, regionKey, []]);
+    try {
+      const entries = await cursorEntries(tx.objectStore(PARTS), range);
+      return new Map(entries.map(([key, value]) => [key[2], value]));
+    } catch (error) {
+      throw failure(codeFor(error), error);
+    }
+  }
+
+  // The one read-merge-write. Reads the record, `:meta`, `:v1base` and every `:op:` row of
+  // `key`, hands them to `build` inside the transaction, and writes the `puts` and
+  // `deletes` it returns before the transaction can complete. A `build` or a write that
+  // throws aborts it, so nothing lands. Resolves with `build`'s `result` on `complete`.
+  function change(key, build, { timeout = 0 } = {}) {
+    return new Promise((resolve, reject) => {
+      let tx;
+      try {
+        tx = transaction([RECORDS, PARTS], "readwrite");
+      } catch (error) {
+        return reject(error);
+      }
+      let thrown = null;
+      let result;
+      let settled = false;
+      let timer;
+      const finish = (fn, value) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        fn(value);
+      };
+      if (timeout > 0) timer = setTimeout(() => {
+        thrown = failure("blocked");
+        try { tx.abort(); } catch {}
+        finish(reject, thrown);
+      }, timeout);
+      tx.oncomplete = () => finish(resolve, result);
+      tx.onabort = () => finish(reject, thrown || failure(tx.error ? codeFor(tx.error) : "aborted", tx.error));
+      try {
+        const store = tx.objectStore(RECORDS);
+        const rows = keyRange.bound(key + ":op:", key + ":op:\uffff");
+        const reads = { record: store.get(key), meta: store.get(key + ":meta"), v1base: store.get(key + ":v1base"), names: store.getAllKeys(rows), values: store.getAll(rows) };
+        // Requests in one transaction answer in the order they were made: the last one in
+        // means every read is.
+        reads.values.onsuccess = () => {
+          if (settled) return;
+          try {
+            const raw = {
+              record: reads.record.result ?? null,
+              meta: reads.meta.result ?? null,
+              v1base: reads.v1base.result ?? null,
+              rows: reads.names.result.map((name, i) => [name, reads.values.result[i]]),
+            };
+            const planned = build(raw);
+            for (const [name, value] of planned.puts) store.put(value, name);
+            for (const name of planned.deletes) store.delete(name);
+            result = planned.result;
+          } catch (error) {
+            thrown = failure(codeFor(error), error);
+            try { tx.abort(); } catch {}
+          }
+        };
+      } catch (error) {
+        thrown = failure(codeFor(error), error);
+        try { tx.abort(); } catch {}
+      }
+    });
+  }
+
+  // A tab's own unconfirmed chain, written blind (no read) at a hide, with an explicit
+  // commit so it needs no callback in a page about to go away. `change()` applies it later.
+  function putRow(name, value) {
+    return new Promise((resolve, reject) => {
+      if (!/:op:[^:]+$/.test(name)) return reject(failure("bad-op"));
+      let tx;
+      try {
+        tx = transaction(RECORDS, "readwrite");
+        tx.objectStore(RECORDS).put(value, name);
+        tx.commit?.();
+      } catch (error) {
+        return reject(error instanceof Error && error.code ? error : failure(codeFor(error), error));
+      }
+      tx.oncomplete = () => resolve();
+      tx.onabort = () => reject(failure(tx.error ? codeFor(tx.error) : "aborted", tx.error));
+    });
+  }
+
+  function close() {
+    closed = true;
+    try { db.close(); } catch {}
+  }
+
+  return { readAll, readParts, change, putRow, close };
+}