@tinycloud/replica 0.2.4-beta.3 → 0.3.0-beta.10

package/dist/kv-storage-testing.js

@@ -0,0 +1,1145 @@
+// src/errors.ts
+var ReplicaErrorCode = {
+  /** Another process holds the sync lease. */
+  BUSY: "REPLICA_BUSY",
+  /** No replica with this name exists. */
+  NOT_FOUND: "REPLICA_NOT_FOUND",
+  /** The replica exists but its stored configuration differs from the request. */
+  CONFIG_MISMATCH: "REPLICA_CONFIG_MISMATCH",
+  /** The runtime has no supported durable store (e.g. Node < 22.13). */
+  RUNTIME_UNSUPPORTED: "RUNTIME_UNSUPPORTED",
+  /** A required open() argument is missing or malformed (e.g. `principal`). */
+  INVALID_ARGUMENT: "REPLICA_INVALID_ARGUMENT",
+  /** The local store failed (I/O, corruption, schema). */
+  STORAGE_ERROR: "STORAGE_ERROR",
+  /** The local disk is full. */
+  STORAGE_FULL: "STORAGE_FULL",
+  /** The key is outside the replica's prefix. */
+  NOT_COVERED: "NOT_COVERED",
+  /** Syncing the secrets space or the vault namespace needs an explicit opt-in. */
+  SECRETS_OPT_IN_REQUIRED: "SECRETS_OPT_IN_REQUIRED",
+  /** No grant is installed, or none covers the requested scope. */
+  GRANT_MISSING: "GRANT_MISSING",
+  /** The grant bytes are not a verifiable UCAN, or its signature is wrong. */
+  GRANT_INVALID: "GRANT_INVALID",
+  /** SIWE/CACAO and other non-UCAN grants cannot be used for a replica. */
+  GRANT_FORMAT_UNSUPPORTED: "GRANT_FORMAT_UNSUPPORTED",
+  /** The grant was issued to a different device. */
+  GRANT_AUDIENCE_MISMATCH: "GRANT_AUDIENCE_MISMATCH",
+  /** The grant lacks `tinycloud.kv/sync` or `tinycloud.kv/get` on the prefix. */
+  GRANT_NOT_COVERING: "GRANT_NOT_COVERING",
+  GRANT_NOT_YET_VALID: "GRANT_NOT_YET_VALID",
+  GRANT_EXPIRED: "GRANT_EXPIRED",
+  /** The configured node does not advertise whole-space KV sync support. */
+  REPLICATION_ROOT_UNSUPPORTED: "REPLICATION_ROOT_UNSUPPORTED",
+  GRANT_REVOKED: "GRANT_REVOKED",
+  /** The node refused the invocation for a reason other than revocation. */
+  GRANT_UNAUTHORIZED: "GRANT_UNAUTHORIZED",
+  /** The node refused the retention grant. */
+  RETENTION_GRANT_REFUSED: "RETENTION_GRANT_REFUSED",
+  /** The node could not be reached. */
+  NETWORK_ERROR: "NETWORK_ERROR",
+  /** The node answered with an unexpected status. */
+  NODE_ERROR: "NODE_ERROR",
+  /** The node's answer violates the wire contract. */
+  PROTOCOL_ERROR: "PROTOCOL_ERROR",
+  /** The node asked for a fresh bootstrap (410). Handled inside sync. */
+  RESET_REQUIRED: "RESET_REQUIRED",
+  /** The feed now comes from a different node than the one pinned. */
+  SOURCE_CHANGED: "SOURCE_CHANGED",
+  /** The feed delivered a key outside the replica's prefix. */
+  SCOPE_VIOLATION: "SCOPE_VIOLATION",
+  /** Fetched bytes do not hash to the ETag the node attested for them. */
+  CONTENT_MISMATCH: "CONTENT_MISMATCH",
+  /** A stored blob no longer hashes to its name. */
+  INTEGRITY_ERROR: "INTEGRITY_ERROR",
+  /** The replica handle was closed; in-flight calls settle with this code. */
+  CLOSED: "REPLICA_CLOSED",
+  /** The lifecycle gate refused the operation (shared contract `REPLICA_GATED`); `detail.gate` says why. */
+  GATED: "REPLICA_GATED",
+  /** Quota admission refused a page (`maxBytes` or the free-space floor); nothing committed. */
+  STORAGE_BUDGET: "STORAGE_BUDGET",
+  /** The consent deadline passed: the grant is not served until the user consents again. */
+  CONSENT_EXPIRED: "CONSENT_EXPIRED"
+};
+var REPLICA_ERROR = /* @__PURE__ */ Symbol.for("tinycloud.replica.error");
+var ReplicaError = class extends Error {
+  [REPLICA_ERROR] = true;
+  code;
+  detail;
+  constructor(code, message, detail, options) {
+    super(message, options);
+    this.name = "ReplicaError";
+    this.code = code;
+    if (detail !== void 0) this.detail = detail;
+  }
+};
+function gatedError(gate, message) {
+  return Object.assign(new ReplicaError(ReplicaErrorCode.GATED, message, { gate }), { gate });
+}
+
+// ../sdk-services/dist/kv/replication/contractConstants.js
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var DEFAULT_MIN_FREE_BYTES = 64 * 1024 * 1024;
+var REPLICA_KV_DATABASE = "tinycloud-replica-kv";
+var REPLICA_KV_STORES = {
+  /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */
+  meta: "meta",
+  /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */
+  entries: "entries",
+  /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */
+  blobs: "blobs",
+  /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */
+  pending: "pending",
+  /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */
+  device: "device",
+  /** Control: the account gate, singleton key `"account"`, value `ReplicaAccountGate`. */
+  gate: "gate",
+  /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */
+  partitions: "partitions",
+  /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */
+  purgeIntents: "purgeIntents",
+  /** Control: quota ledger, keys owned by the ledger (S5). */
+  quota: "quota"
+};
+var REPLICA_LOGOUT_MARKER = "tinycloud-replica:logout-pending";
+var REPLICA_DENY_TOMBSTONE = "tinycloud-replica:deny-tombstone";
+
+// src/browser/idb.ts
+function requestAsPromise(request) {
+  const { promise, resolve, reject } = Promise.withResolvers();
+  request.onsuccess = () => resolve(request.result);
+  request.onerror = () => reject(request.error ?? new DOMException("IndexedDB request failed", "UnknownError"));
+  return promise;
+}
+function transactionDone(tx) {
+  const { promise, resolve, reject } = Promise.withResolvers();
+  tx.addEventListener("complete", () => resolve(), { once: true });
+  tx.addEventListener("abort", () => reject(tx.error ?? new DOMException("Transaction aborted", "AbortError")), { once: true });
+  tx.addEventListener("error", () => reject(tx.error ?? new DOMException("Transaction failed", "UnknownError")), { once: true });
+  return promise;
+}
+var byteEncoder = new TextEncoder();
+
+// src/kv-storage/gateKeys.ts
+var GATE_HMAC_KEY = "gateHmac";
+var ACCOUNT_KEY = "accountKey";
+var HEX = "0123456789abcdef";
+var ENCODER = new TextEncoder();
+function hex(bytes) {
+  let value = "";
+  for (const byte of bytes) value += HEX.charAt(byte >>> 4) + HEX.charAt(byte & 15);
+  return value;
+}
+function keyId() {
+  return hex(crypto.getRandomValues(new Uint8Array(16)));
+}
+async function newGateHmac(incarnation) {
+  const hmac = await crypto.subtle.generateKey({ name: "HMAC", hash: "SHA-256", length: 256 }, false, ["sign", "verify"]);
+  return { v: 1, incarnation, keyId: keyId(), hmac };
+}
+async function newAccountKey(incarnation, lifecycleEpoch, principalHash) {
+  const [aesGcm, hmac] = await Promise.all([
+    crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]),
+    crypto.subtle.generateKey({ name: "HMAC", hash: "SHA-256", length: 256 }, false, ["sign", "verify"])
+  ]);
+  return { v: 1, incarnation, lifecycleEpoch, principalHash, keyId: keyId(), aesGcm, hmac };
+}
+async function gateHash(key, domain, material) {
+  const bytes = ENCODER.encode(`${domain}\0${material}`);
+  return hex(new Uint8Array(await crypto.subtle.sign("HMAC", key, bytes)));
+}
+function isHmac(key) {
+  if (!(key instanceof CryptoKey) || key.extractable || key.algorithm.name !== "HMAC") return false;
+  const algorithm = key.algorithm;
+  return "hash" in algorithm && algorithm.hash !== null && typeof algorithm.hash === "object" && "name" in algorithm.hash && algorithm.hash.name === "SHA-256" && key.usages.length === 2 && key.usages.includes("sign") && key.usages.includes("verify");
+}
+function isAesGcm(key) {
+  if (!(key instanceof CryptoKey) || key.extractable || key.algorithm.name !== "AES-GCM") return false;
+  return "length" in key.algorithm && key.algorithm.length === 256 && key.usages.length === 2 && key.usages.includes("encrypt") && key.usages.includes("decrypt");
+}
+function validGateHmac(record, gate) {
+  return record?.v === 1 && record.incarnation === gate.incarnation && record.keyId === gate.keyId && /^[0-9a-f]{32}$/.test(record.keyId) && isHmac(record.hmac);
+}
+function validAccountKey(record, gate) {
+  return record?.v === 1 && record.incarnation === gate.incarnation && record.lifecycleEpoch === gate.lifecycleEpoch && record.principalHash === gate.principalHash && record.keyId === gate.accountKeyId && /^[0-9a-f]{32}$/.test(record.keyId) && isAesGcm(record.aesGcm) && isHmac(record.hmac);
+}
+
+// src/kv-storage/sealed.ts
+import { bytesToHex } from "@noble/hashes/utils";
+var encoder = new TextEncoder();
+function utf8Length(value) {
+  let bytes = 0;
+  for (let i = 0; i < value.length; i += 1) {
+    const code = value.charCodeAt(i);
+    if (code < 128) bytes += 1;
+    else if (code < 2048) bytes += 2;
+    else if (code >= 55296 && code <= 56319 && i + 1 < value.length && value.charCodeAt(i + 1) >= 56320 && value.charCodeAt(i + 1) <= 57343) {
+      bytes += 4;
+      i += 1;
+    } else bytes += 3;
+  }
+  return bytes;
+}
+function measureSealedRow(key, row) {
+  if (row.purged === true ? row.v !== void 0 || row.iv !== void 0 || row.bytes !== void 0 : row.v !== 1 || !(row.iv instanceof Uint8Array) || !(row.bytes instanceof Uint8Array)) {
+    throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has an invalid sealed envelope.");
+  }
+  const primaryKey = JSON.stringify(key);
+  if (typeof primaryKey !== "string") {
+    throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has an invalid primary key.");
+  }
+  let total = 2 + 4 + utf8Length(primaryKey);
+  let hasSize = false;
+  for (const name in row) {
+    if (!Object.hasOwn(row, name)) continue;
+    const value = Reflect.get(row, name);
+    total += 1 + name.length;
+    switch (name) {
+      case "pid":
+      case "hashId":
+        if (typeof value !== "string") throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has an invalid identifier.");
+        total += 4 + utf8Length(value);
+        break;
+      case "v":
+        if (value !== 1) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has an unknown version.");
+        total += 1;
+        break;
+      case "coverageCode":
+        if (value !== 0 && value !== 1 && value !== 2) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has invalid coverage.");
+        total += 1;
+        break;
+      case "purged":
+        if (typeof value !== "boolean") throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has invalid purge state.");
+        total += 1;
+        break;
+      case "revision":
+      case "generation":
+      case "syncedThroughEpoch":
+      case "keys":
+      case "contentMissing":
+      case "tombstones":
+      case "contentBytes":
+      case "size":
+        if (typeof value !== "number" || !Number.isFinite(value)) {
+          throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has an invalid numeric field.");
+        }
+        if (name === "size") hasSize = true;
+        total += 8;
+        break;
+      case "iv":
+      case "bytes":
+        if (!(value instanceof Uint8Array)) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has invalid ciphertext.");
+        total += 4 + value.byteLength;
+        break;
+      default:
+        throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has an unknown persisted field.");
+    }
+  }
+  if (!hasSize) total += 1 + "size".length + 8;
+  return total;
+}
+
+// src/kv-storage/schema.ts
+var KV_DATABASE = REPLICA_KV_DATABASE;
+var KV_DATABASE_VERSION = 2;
+var KV_STORE = REPLICA_KV_STORES;
+var FIRST_INSTALL_KEY_PREFIX = "firstInstall:";
+var ERASE_STORES = [KV_STORE.meta, KV_STORE.entries, KV_STORE.blobs, KV_STORE.pending];
+var READ_SCOPE = [KV_STORE.gate, KV_STORE.purgeIntents];
+var WRITE_SCOPE = [KV_STORE.gate, KV_STORE.partitions, KV_STORE.purgeIntents, KV_STORE.quota, KV_STORE.device];
+function createStores(db) {
+  db.createObjectStore(KV_STORE.meta);
+  const entries = db.createObjectStore(KV_STORE.entries);
+  entries.createIndex("byHash", ["pid", "hash"], { unique: false });
+  const blobs = db.createObjectStore(KV_STORE.blobs);
+  blobs.createIndex("bySize", ["pid", "size"], { unique: false });
+  const partitions = db.createObjectStore(KV_STORE.partitions);
+  partitions.createIndex("byLookupId", "lookupId", { unique: false });
+  for (const name of [KV_STORE.pending, KV_STORE.device, KV_STORE.gate, KV_STORE.purgeIntents, KV_STORE.quota]) {
+    db.createObjectStore(name);
+  }
+}
+function openKvDatabase(options) {
+  if (typeof indexedDB === "undefined") {
+    return Promise.reject(
+      new ReplicaError(
+        ReplicaErrorCode.RUNTIME_UNSUPPORTED,
+        "IndexedDB is unavailable (private browsing or a non-browser runtime); the replica cannot persist."
+      )
+    );
+  }
+  const { promise, resolve, reject } = Promise.withResolvers();
+  const request = options.create ? indexedDB.open(KV_DATABASE, KV_DATABASE_VERSION) : indexedDB.open(KV_DATABASE);
+  let refused = false;
+  request.onupgradeneeded = (event) => {
+    if (!options.create && event.oldVersion === 0) {
+      refused = true;
+      request.transaction?.abort();
+      return;
+    }
+    if (event.oldVersion > 0) {
+      for (const name of Array.from(request.result.objectStoreNames)) request.result.deleteObjectStore(name);
+    }
+    createStores(request.result);
+  };
+  request.onsuccess = () => {
+    const db = request.result;
+    if (db.version !== KV_DATABASE_VERSION) {
+      db.close();
+      resolve(null);
+      return;
+    }
+    db.onversionchange = () => db.close();
+    resolve(db);
+  };
+  request.onerror = (event) => {
+    if (refused) {
+      event.preventDefault();
+      resolve(null);
+      return;
+    }
+    reject(request.error ?? new DOMException(`Opening ${KV_DATABASE} failed`, "UnknownError"));
+  };
+  request.onblocked = () => reject(new ReplicaError(ReplicaErrorCode.BUSY, `Opening ${KV_DATABASE} is blocked by an older connection in another tab.`));
+  return promise;
+}
+function eraseSealedRows(tx, name, partitionId) {
+  const { promise, resolve, reject } = Promise.withResolvers();
+  const range = IDBKeyRange.bound([partitionId], [partitionId, []]);
+  const request = tx.objectStore(name).openCursor(range);
+  let removed = 0;
+  request.onsuccess = () => {
+    const cursor = request.result;
+    if (cursor === null) return resolve(removed);
+    try {
+      const row = cursor.value;
+      if (row === null || typeof row !== "object" || !("pid" in row) || row.pid !== partitionId || !("size" in row) || typeof row.size !== "number") {
+        throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The encrypted replica row has an invalid partition or byte measure.");
+      }
+      const measured = measureSealedRow(cursor.primaryKey, row);
+      if (row.size !== measured || !Number.isSafeInteger(removed + measured)) {
+        throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The encrypted replica row has an invalid byte measure.");
+      }
+      removed += measured;
+      cursor.delete();
+      cursor.continue();
+    } catch (error) {
+      reject(error);
+    }
+  };
+  request.onerror = () => reject(request.error);
+  return promise;
+}
+var kvPartitionEraser = {
+  async erasePartition(tx, partitionId) {
+    const meta = tx.objectStore(KV_STORE.meta);
+    const old = await requestAsPromise(meta.get(partitionId));
+    if (old !== void 0 && (old === null || typeof old !== "object" || !("pid" in old) || old.pid !== partitionId || !("revision" in old) || typeof old.revision !== "number" || !Number.isSafeInteger(old.revision) || old.revision < 0 || !("generation" in old) || typeof old.generation !== "number" || !Number.isSafeInteger(old.generation) || old.generation < 0 || !("size" in old) || typeof old.size !== "number" || old.size !== measureSealedRow(partitionId, old))) {
+      throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The encrypted replica metadata is invalid.");
+    }
+    const [entries, blobs] = await Promise.all([
+      eraseSealedRows(tx, KV_STORE.entries, partitionId),
+      eraseSealedRows(tx, KV_STORE.blobs, partitionId)
+    ]);
+    if (old === void 0) return { bytes: entries + blobs };
+    const current = old;
+    if (current.purged === true) {
+      if (entries !== 0 || blobs !== 0) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "An erased replica still owns ciphertext rows.");
+      return { bytes: 0 };
+    }
+    const tombstone = {
+      pid: partitionId,
+      revision: current.revision + 1,
+      generation: current.generation + 1,
+      coverageCode: 0,
+      syncedThroughEpoch: 0,
+      keys: 0,
+      contentMissing: 0,
+      tombstones: 0,
+      contentBytes: 0,
+      purged: true,
+      size: 0
+    };
+    tombstone.size = measureSealedRow(partitionId, tombstone);
+    const bytes = current.size + entries + blobs - tombstone.size;
+    if (!Number.isSafeInteger(bytes) || bytes < 0) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The erased replica has an invalid byte delta.");
+    meta.put(tombstone, partitionId);
+    return { bytes };
+  },
+  async eraseIdentityPending(tx, identityKeyHash) {
+    tx.objectStore(KV_STORE.pending).delete(identityKeyHash);
+  }
+};
+
+// src/kv-storage/gateTx.ts
+var ACCOUNT = "account";
+var CONTROL = [KV_STORE.gate, KV_STORE.partitions, KV_STORE.purgeIntents, KV_STORE.quota, KV_STORE.device];
+function refusal(reason) {
+  return gatedError(reason, `The replica gate refused: ${reason}.`);
+}
+async function withDatabase(open, create, use) {
+  const db = await open(create);
+  if (db === null) return null;
+  try {
+    return await use(db);
+  } finally {
+    db.close();
+  }
+}
+function createIndexedDbGateTx(open, options) {
+  if (typeof options?.onConsentExpired !== "function") throw refusal("gate_unavailable");
+  const now = options.now ?? Date.now;
+  function checkedNow() {
+    const at = now();
+    if (!Number.isSafeInteger(at) || at < 0) throw refusal("gate_unavailable");
+    return at;
+  }
+  let expiryFlight;
+  async function snapshot() {
+    return withDatabase(open, false, async (db) => {
+      const tx = db.transaction([KV_STORE.gate, KV_STORE.device]);
+      const gate = await requestAsPromise(tx.objectStore(KV_STORE.gate).get(ACCOUNT));
+      if (gate === void 0 || gate.principalHash === null) return null;
+      if (typeof gate.consentDeadline !== "number" || !Number.isSafeInteger(gate.consentDeadline) || gate.consentDeadline < 0) throw refusal("gate_unavailable");
+      const hash = await requestAsPromise(tx.objectStore(KV_STORE.device).get(GATE_HMAC_KEY));
+      if (!validGateHmac(hash, gate)) throw refusal("gate_unavailable");
+      return { incarnation: gate.incarnation, salt: gate.salt, lifecycleEpoch: gate.lifecycleEpoch, keyId: hash.keyId, accountKeyId: gate.accountKeyId, gateHmac: hash.hmac };
+    });
+  }
+  async function expire(access) {
+    let flight;
+    try {
+      flight = expiryFlight ?? options.onConsentExpired();
+      expiryFlight = flight;
+      const outcome = await flight;
+      if (outcome.status !== "denied" && outcome.status !== "deleted" && outcome.status !== "stale") throw refusal("gate_unavailable");
+      const gate = await withDatabase(
+        open,
+        false,
+        (db) => requestAsPromise(db.transaction(KV_STORE.gate).objectStore(KV_STORE.gate).get(ACCOUNT))
+      );
+      if (gate !== null && (gate === void 0 || gate.incarnation === access.incarnation && (gate.lifecycleEpoch <= access.stamp.lifecycleEpoch || gate.principalHash !== null))) {
+        throw refusal("gate_unavailable");
+      }
+    } catch {
+      throw refusal("gate_unavailable");
+    } finally {
+      if (flight !== void 0 && expiryFlight === flight) expiryFlight = void 0;
+    }
+  }
+  async function runChecked(scope, access, fn) {
+    if (access === null || typeof access !== "object" || access.stamp === null || typeof access.stamp !== "object") {
+      throw refusal("not_established");
+    }
+    if (!("principalHash" in access) || typeof access.principalHash !== "string" || !("keyId" in access) || typeof access.keyId !== "string" || !("accountKeyId" in access) || typeof access.accountKeyId !== "string") throw refusal("gate_unavailable");
+    try {
+      const result = await withDatabase(open, false, async (db) => {
+        const tx = db.transaction([...scope.stores, ...CONTROL], scope.mode, { durability: "strict" });
+        const done = transactionDone(tx);
+        try {
+          const gate = await requestAsPromise(tx.objectStore(KV_STORE.gate).get(ACCOUNT));
+          if (gate === void 0) throw refusal("not_established");
+          if (gate.incarnation !== access.incarnation || gate.incarnation !== access.stamp.incarnation || gate.lifecycleEpoch !== access.stamp.lifecycleEpoch || gate.principalHash === null) throw refusal("stamp_stale");
+          if (gate.keyId !== access.keyId || gate.accountKeyId !== access.accountKeyId) throw refusal("stamp_stale");
+          if (gate.principalHash !== access.principalHash) throw refusal("principal_mismatch");
+          if (typeof gate.consentDeadline !== "number" || !Number.isSafeInteger(gate.consentDeadline) || gate.consentDeadline < 0) throw refusal("gate_unavailable");
+          const device = tx.objectStore(KV_STORE.device);
+          const hash = await requestAsPromise(device.get(GATE_HMAC_KEY));
+          const account = await requestAsPromise(device.get(ACCOUNT_KEY));
+          if (!validGateHmac(hash, gate) || !validAccountKey(account, gate)) throw refusal("gate_unavailable");
+          const intents = tx.objectStore(KV_STORE.purgeIntents);
+          if (access.partitionId !== void 0 && await requestAsPromise(intents.count(access.partitionId)) > 0) throw refusal("purge_pending");
+          if (access.identityKeyHash !== void 0 && await requestAsPromise(intents.count(`pending:${access.identityKeyHash}`)) > 0) throw refusal("purge_pending");
+          if (checkedNow() >= gate.consentDeadline) throw new ReplicaError(ReplicaErrorCode.CONSENT_EXPIRED, "The account consent has expired.");
+          const value = await fn(tx, account);
+          await done;
+          return { value };
+        } catch (error) {
+          try {
+            tx.abort();
+          } catch {
+          }
+          await done.catch(() => void 0);
+          throw error;
+        }
+      });
+      if (result === null) throw refusal("gate_unavailable");
+      return result.value;
+    } catch (error) {
+      if (error !== null && typeof error === "object" && "code" in error && error.code === ReplicaErrorCode.CONSENT_EXPIRED) {
+        await expire(access);
+      }
+      throw error;
+    }
+  }
+  return {
+    snapshot,
+    run: (scope, access, fn) => runChecked(scope, access, (tx) => fn(tx)),
+    readAccountKey: (access) => runChecked({ stores: [KV_STORE.device], mode: "readonly" }, access, async (_tx, account) => account),
+    async indexPartition(tx, entry) {
+      tx.objectStore(KV_STORE.partitions).put(entry, entry.partitionId);
+    },
+    async unindexPartition(tx, partitionId) {
+      tx.objectStore(KV_STORE.partitions).delete(partitionId);
+    },
+    async clearIntent(tx, id) {
+      tx.objectStore(KV_STORE.purgeIntents).delete(id);
+    }
+  };
+}
+
+// src/kv-storage/lifecycle.ts
+var ACCOUNT2 = "account";
+var DEVICE_KEY = "device";
+var GRANT_INSTALL_KEY_PREFIX = "grantInstall:";
+var GATE_LOCK = "tinycloud-replica-kv:gate";
+var DELETE_BLOCKED = "DELETE_BLOCKED";
+var denyFaults = {};
+function takeFault(point) {
+  const fault = denyFaults[point];
+  if (fault === void 0) return false;
+  if (fault.once) delete denyFaults[point];
+  return true;
+}
+function billedDeviceBytes(row) {
+  if (row === void 0 || typeof row === "number" && Number.isSafeInteger(row) && row >= 0) return 0;
+  if (row !== null && typeof row === "object" && "size" in row && typeof row.size === "number" && Number.isSafeInteger(row.size) && row.size >= 0) {
+    return row.size;
+  }
+  throw gatedError("gate_unavailable", "A device quota row has no valid encoded size.");
+}
+function openKvStore(create) {
+  return openKvDatabase({ create });
+}
+async function readLegacyGateFloor() {
+  const { promise, resolve, reject } = Promise.withResolvers();
+  const request = indexedDB.open(KV_DATABASE);
+  let absent = false;
+  request.onupgradeneeded = () => {
+    absent = true;
+    request.transaction?.abort();
+  };
+  request.onsuccess = async () => {
+    const db = request.result;
+    try {
+      if (db.version !== 1) return resolve(null);
+      if (!db.objectStoreNames.contains(KV_STORE.gate)) return resolve({ epoch: 0, deniedAt: null });
+      const value = await requestAsPromise(db.transaction(KV_STORE.gate).objectStore(KV_STORE.gate).get(ACCOUNT2));
+      if (value === void 0) return resolve({ epoch: 0, deniedAt: null });
+      if (value === null || typeof value !== "object" || !("lifecycleEpoch" in value) || !("deniedAt" in value) || typeof value.lifecycleEpoch !== "number" || !Number.isSafeInteger(value.lifecycleEpoch) || value.lifecycleEpoch < 0 || value.deniedAt !== null && (typeof value.deniedAt !== "number" || !Number.isSafeInteger(value.deniedAt) || value.deniedAt < 0) || value.lifecycleEpoch === 0 !== (value.deniedAt === null)) {
+        throw gatedError("gate_unavailable", "The legacy gate deny floor is invalid.");
+      }
+      resolve({ epoch: value.lifecycleEpoch, deniedAt: value.deniedAt });
+    } catch (error) {
+      reject(error);
+    } finally {
+      db.close();
+    }
+  };
+  request.onerror = (event) => {
+    if (absent) {
+      event.preventDefault();
+      resolve(null);
+    } else {
+      reject(gatedError("gate_unavailable", "The legacy gate deny floor cannot be read."));
+    }
+  };
+  request.onblocked = () => reject(gatedError("gate_unavailable", "The legacy gate read is blocked."));
+  return promise;
+}
+function preserveLegacyFloor(legacy, tombstone) {
+  if (legacy?.deniedAt === null || legacy === null) return { tombstone, advanced: false };
+  const floor = {
+    epoch: Math.max(legacy.epoch, tombstone?.epoch ?? 0),
+    deniedAt: Math.max(legacy.deniedAt, tombstone?.deniedAt ?? 0)
+  };
+  if (tombstone !== null && tombstone.epoch >= floor.epoch && tombstone.deniedAt >= floor.deniedAt) {
+    return { tombstone, advanced: false };
+  }
+  writeTombstone(floor);
+  return { tombstone: floor, advanced: true };
+}
+function codeOf(error) {
+  if (error !== null && typeof error === "object" && "code" in error && error.code === "REPLICA_GATED" && "gate" in error && typeof error.gate === "string") return error.gate;
+  return error !== null && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : "STORAGE_ERROR";
+}
+function logoutMarkerSet() {
+  try {
+    return localStorage.getItem(REPLICA_LOGOUT_MARKER) !== null;
+  } catch {
+    return true;
+  }
+}
+function readTombstone() {
+  try {
+    const stored = localStorage.getItem(REPLICA_DENY_TOMBSTONE);
+    if (stored === null) return null;
+    const value = JSON.parse(stored);
+    if (value === null || typeof value !== "object" || !("epoch" in value) || typeof value.epoch !== "number" || !Number.isSafeInteger(value.epoch) || value.epoch < 1 || !("deniedAt" in value) || typeof value.deniedAt !== "number" || !Number.isSafeInteger(value.deniedAt) || value.deniedAt < 0 || Object.keys(value).length !== 2) throw new Error("Invalid deny tombstone.");
+    return value;
+  } catch {
+    throw gatedError("gate_unavailable", "The origin deny tombstone cannot be read.");
+  }
+}
+function writeTombstone(value) {
+  try {
+    const serialized = JSON.stringify(value);
+    localStorage.setItem(REPLICA_DENY_TOMBSTONE, serialized);
+    if (localStorage.getItem(REPLICA_DENY_TOMBSTONE) !== serialized) throw new Error("The deny tombstone was not persisted.");
+  } catch {
+    throw gatedError("gate_unavailable", "The origin deny tombstone cannot be written.");
+  }
+}
+function assertTombstoneWritable() {
+  try {
+    const stored = localStorage.getItem(REPLICA_DENY_TOMBSTONE);
+    if (stored === null) {
+      const probe = `${REPLICA_DENY_TOMBSTONE}:probe`;
+      localStorage.setItem(probe, "1");
+      if (localStorage.getItem(probe) !== "1") throw new Error("The deny tombstone probe was not persisted.");
+      localStorage.removeItem(probe);
+    } else {
+      localStorage.setItem(REPLICA_DENY_TOMBSTONE, stored);
+      if (localStorage.getItem(REPLICA_DENY_TOMBSTONE) !== stored) throw new Error("The deny tombstone was not persisted.");
+    }
+  } catch {
+    throw gatedError("gate_unavailable", "The origin deny tombstone cannot be written.");
+  }
+}
+function denyFloor(gate, tombstone) {
+  if (gate !== void 0 && tombstone === null && (gate.lifecycleEpoch > 0 || gate.deniedAt !== null)) {
+    throw gatedError("gate_unavailable", "A denied gate has no origin deny tombstone.");
+  }
+  if (gate !== void 0 && tombstone !== null && gate.lifecycleEpoch < tombstone.epoch) {
+    throw gatedError("gate_unavailable", "The gate is behind the origin deny tombstone.");
+  }
+  return {
+    epoch: Math.max(gate?.lifecycleEpoch ?? 0, tombstone?.epoch ?? 0),
+    deniedAt: gate?.deniedAt === null || gate?.deniedAt === void 0 ? tombstone?.deniedAt ?? null : Math.max(gate.deniedAt, tombstone?.deniedAt ?? 0)
+  };
+}
+function exclusive(name, section, signal) {
+  if (typeof navigator === "undefined" || typeof navigator.locks?.request !== "function") {
+    return Promise.reject(gatedError("gate_unavailable", "The origin Web Lock is unavailable."));
+  }
+  return signal === void 0 ? navigator.locks.request(name, section) : navigator.locks.request(name, { signal }, section);
+}
+function deleteKvDatabase() {
+  const { promise, resolve } = Promise.withResolvers();
+  if (takeFault("delete_database")) {
+    resolve({ status: "failed", code: "STORAGE_ERROR" });
+    return promise;
+  }
+  const request = indexedDB.deleteDatabase(KV_DATABASE);
+  request.onsuccess = () => resolve({ status: "deleted" });
+  request.onerror = () => resolve({ status: "failed", code: "STORAGE_ERROR" });
+  request.onblocked = () => resolve({ status: "failed", code: DELETE_BLOCKED });
+  return promise;
+}
+function setLogoutMarker() {
+  try {
+    const marker = String(Date.now());
+    localStorage.setItem(REPLICA_LOGOUT_MARKER, marker);
+    return localStorage.getItem(REPLICA_LOGOUT_MARKER) === marker;
+  } catch {
+    return false;
+  }
+}
+async function transact(db, stores, mode, use) {
+  const tx = db.transaction(stores, mode, { durability: "strict" });
+  const done = transactionDone(tx);
+  let value;
+  try {
+    value = await use(tx);
+  } catch (error) {
+    try {
+      tx.abort();
+    } catch {
+    }
+    await done.catch(() => void 0);
+    throw error;
+  }
+  await done;
+  return value;
+}
+function createIndexedDbLifecycle(options = {}) {
+  const eraser = options.eraser ?? kvPartitionEraser;
+  const ledger = options.ledger;
+  const now = options.now ?? Date.now;
+  function checkedNow() {
+    const at = now();
+    if (!Number.isSafeInteger(at) || at < 0) throw gatedError("gate_unavailable", "The replica clock is unavailable.");
+    return at;
+  }
+  function deadlineOf(gate) {
+    const deadline = gate.consentDeadline;
+    if (typeof deadline !== "number" || !Number.isSafeInteger(deadline) || deadline < 0) {
+      throw gatedError("gate_unavailable", "The account gate has no valid consent deadline.");
+    }
+    return deadline;
+  }
+  const gateTx = createIndexedDbGateTx(openKvStore, { now, onConsentExpired: expireConsent });
+  let view;
+  let expiryTimer;
+  const expiryObservers = /* @__PURE__ */ new Set();
+  function adopt(gate, principal) {
+    const stamp = { incarnation: gate.incarnation, lifecycleEpoch: gate.lifecycleEpoch };
+    view = { ...stamp, consentDeadline: deadlineOf(gate), principal: principal.toLowerCase() };
+    clearTimeout(expiryTimer);
+    armExpiryTimer();
+    return stamp;
+  }
+  function armExpiryTimer() {
+    if (view === void 0) return;
+    const delay = Math.max(0, Math.min(view.consentDeadline - checkedNow(), 2147483647));
+    expiryTimer = setTimeout(() => {
+      expiryTimer = void 0;
+      if (view === void 0) return;
+      try {
+        if (checkedNow() < view.consentDeadline) armExpiryTimer();
+        else void expireConsent();
+      } catch {
+        view = void 0;
+      }
+    }, delay);
+  }
+  async function readGate() {
+    const found = await withDatabase(
+      openKvStore,
+      false,
+      (db) => requestAsPromise(db.transaction(KV_STORE.gate).objectStore(KV_STORE.gate).get(ACCOUNT2))
+    );
+    return found ?? void 0;
+  }
+  async function activeKeys(gate) {
+    const records = await withDatabase(openKvStore, false, async (db) => {
+      const device = db.transaction(KV_STORE.device).objectStore(KV_STORE.device);
+      const hash = await requestAsPromise(device.get(GATE_HMAC_KEY));
+      const account = await requestAsPromise(device.get(ACCOUNT_KEY));
+      return { hash, account };
+    });
+    if (records === null || !validGateHmac(records.hash, gate) || !validAccountKey(records.account, gate)) {
+      throw gatedError("gate_unavailable", "The account gate encryption keys are missing or mismatched.");
+    }
+    return { hash: records.hash, account: records.account };
+  }
+  async function readIntents() {
+    const found = await withDatabase(
+      openKvStore,
+      false,
+      (db) => requestAsPromise(db.transaction(KV_STORE.purgeIntents).objectStore(KV_STORE.purgeIntents).getAll())
+    );
+    return found ?? [];
+  }
+  async function writeGate(gate, previous, keys) {
+    const db = await openKvStore(true);
+    if (db === null) throw gatedError("gate_unavailable", "The origin database could not be created.");
+    try {
+      await transact(db, [KV_STORE.gate, KV_STORE.device], "readwrite", async (tx) => {
+        const current = await requestAsPromise(tx.objectStore(KV_STORE.gate).get(ACCOUNT2));
+        if (current?.incarnation !== previous?.incarnation || current?.lifecycleEpoch !== previous?.lifecycleEpoch || current?.principalHash !== previous?.principalHash) {
+          throw gatedError("stamp_stale", "The origin gate changed during establishment.");
+        }
+        const device = tx.objectStore(KV_STORE.device);
+        device.put(keys.hash, GATE_HMAC_KEY);
+        device.put(keys.account, ACCOUNT_KEY);
+        tx.objectStore(KV_STORE.gate).put(gate, ACCOUNT2);
+      });
+    } finally {
+      db.close();
+    }
+  }
+  async function establishSessionStamp(principal, o) {
+    return exclusive(GATE_LOCK, async () => {
+      const tombstone = readTombstone();
+      if (logoutMarkerSet()) throw gatedError("logout_pending", "A logout is still pending on this origin.");
+      const anchor = o.consentAnchor;
+      if (anchor === void 0 || anchor.source !== "siwe" && anchor.source !== "delegation_iat" && anchor.source !== "delegation_nbf" || !Number.isSafeInteger(anchor.at) || anchor.at < 0) {
+        throw gatedError("not_established", "A verified finite consent anchor is required.");
+      }
+      const issuedAt = Math.min(anchor.at, checkedNow());
+      if ((await readIntents()).length > 0) throw gatedError("purge_pending", "A purge is still pending on this origin.");
+      const current = await readGate();
+      const legacy = current === void 0 ? await readLegacyGateFloor() : null;
+      const preserved = preserveLegacyFloor(legacy, tombstone);
+      const floor = denyFloor(current, preserved.tombstone);
+      if (preserved.advanced) throw gatedError("stamp_stale", "The legacy deny floor was preserved; a new consent proof is required.");
+      if (floor.deniedAt !== null && issuedAt <= floor.deniedAt) {
+        throw gatedError("stamp_stale", "This sign-in predates the last sign-out.");
+      }
+      assertTombstoneWritable();
+      if (current === void 0 || current.principalHash === null) {
+        const incarnation = crypto.randomUUID();
+        const hash = await newGateHmac(incarnation);
+        const principalHash2 = await gateHash(hash.hmac, "principal", principal.toLowerCase());
+        const account = await newAccountKey(incarnation, floor.epoch, principalHash2);
+        const created = {
+          incarnation,
+          salt: crypto.randomUUID(),
+          principalHash: principalHash2,
+          lifecycleEpoch: floor.epoch,
+          deniedAt: floor.deniedAt,
+          keyId: hash.keyId,
+          accountKeyId: account.keyId,
+          consentDeadline: issuedAt + CONSENT_WINDOW_MS
+        };
+        if (!Number.isSafeInteger(created.consentDeadline)) throw gatedError("not_established", "The consent deadline is invalid.");
+        await writeGate(created, current, { hash, account });
+        return adopt(created, principal);
+      }
+      const keys = await activeKeys(current);
+      const principalHash = await gateHash(keys.hash.hmac, "principal", principal.toLowerCase());
+      if (current.principalHash !== principalHash) throw gatedError("principal_mismatch", "The origin is bound to another account.");
+      if (checkedNow() >= deadlineOf(current)) {
+        await expireConsentLocked();
+        throw new ReplicaError(ReplicaErrorCode.CONSENT_EXPIRED, "The account consent has expired.");
+      }
+      return adopt(current, principal);
+    });
+  }
+  async function restoreSessionStamp(principal, persisted) {
+    const gate = await readGate();
+    denyFloor(gate, readTombstone());
+    if (gate === void 0 || persisted === void 0) throw gatedError("not_established", "No session stamp is established for this origin.");
+    if (typeof persisted !== "object" || persisted === null || Array.isArray(persisted) || Object.keys(persisted).length !== 2 || !Object.prototype.hasOwnProperty.call(persisted, "incarnation") || !Object.prototype.hasOwnProperty.call(persisted, "lifecycleEpoch") || typeof persisted.incarnation !== "string" || persisted.incarnation.length === 0 || !Number.isSafeInteger(persisted.lifecycleEpoch) || persisted.lifecycleEpoch < 0) {
+      throw gatedError("stamp_stale", "The persisted replica stamp is malformed.");
+    }
+    if (persisted.incarnation !== gate.incarnation || persisted.lifecycleEpoch !== gate.lifecycleEpoch) {
+      throw gatedError("stamp_stale", "The persisted session stamp is stale.");
+    }
+    if (gate.principalHash === null) throw gatedError("principal_mismatch", "The origin has no active account.");
+    const keys = await activeKeys(gate);
+    const hash = await gateHash(keys.hash.hmac, "principal", principal.toLowerCase());
+    if (hash !== gate.principalHash) throw gatedError("principal_mismatch", "The origin is bound to another account.");
+    if (logoutMarkerSet()) throw gatedError("logout_pending", "A logout is still pending on this origin.");
+    if ((await readIntents()).length > 0) throw gatedError("purge_pending", "A purge is still pending on this origin.");
+    assertTombstoneWritable();
+    if (checkedNow() >= deadlineOf(gate)) {
+      await expireConsent();
+      throw new ReplicaError(ReplicaErrorCode.CONSENT_EXPIRED, "The account consent has expired.");
+    }
+    return adopt(gate, principal);
+  }
+  async function activationAllowed(next) {
+    try {
+      if (logoutMarkerSet()) return false;
+      const gate = await readGate();
+      denyFloor(gate, readTombstone());
+      if (gate === void 0 || gate.principalHash === null) return false;
+      if (checkedNow() >= deadlineOf(gate)) {
+        await expireConsent();
+        return false;
+      }
+      const keys = await activeKeys(gate);
+      const hash = await gateHash(keys.hash.hmac, "principal", next.toLowerCase());
+      if (hash !== gate.principalHash) return false;
+      return (await readIntents()).every((intent) => intent.principalHash === hash);
+    } catch {
+      return false;
+    }
+  }
+  function checkDelivery(stamp) {
+    if (stamp === void 0) return { status: "gated", gate: "not_established" };
+    if (view === void 0) return { status: "gated", gate: "stamp_stale" };
+    if (view.incarnation !== stamp.incarnation || view.lifecycleEpoch !== stamp.lifecycleEpoch) {
+      return { status: "gated", gate: "stamp_stale" };
+    }
+    try {
+      const tombstone = readTombstone();
+      if (logoutMarkerSet()) return { status: "gated", gate: "logout_pending" };
+      if (tombstone === null && stamp.lifecycleEpoch !== 0) return { status: "gated", gate: "gate_unavailable" };
+      if (tombstone !== null && stamp.lifecycleEpoch < tombstone.epoch) return { status: "gated", gate: "stamp_stale" };
+      if (checkedNow() >= view.consentDeadline) return { status: "consent_expired", code: "CONSENT_EXPIRED" };
+      return { status: "allow" };
+    } catch {
+      return { status: "gated", gate: "gate_unavailable" };
+    }
+  }
+  function consentDeadline(stamp) {
+    return view !== void 0 && checkDelivery(stamp).status === "allow" ? view.consentDeadline : null;
+  }
+  function deliverable(stamp) {
+    return checkDelivery(stamp).status === "allow";
+  }
+  async function commitDeny(plan) {
+    if (takeFault("deny_tx")) throw new Error("injected deny_tx failure");
+    const db = await openKvStore(false);
+    if (db === null) return { status: "stale" };
+    try {
+      return await transact(
+        db,
+        [KV_STORE.gate, KV_STORE.partitions, KV_STORE.purgeIntents, KV_STORE.device, KV_STORE.pending, KV_STORE.quota],
+        "readwrite",
+        async (tx) => {
+          const current = await requestAsPromise(tx.objectStore(KV_STORE.gate).get(ACCOUNT2));
+          if (current === void 0 || current.incarnation !== plan.gate.incarnation || current.principalHash !== plan.callerHash || current.lifecycleEpoch !== plan.gate.lifecycleEpoch || current.keyId !== plan.gate.keyId || current.accountKeyId !== plan.gate.accountKeyId) {
+            return { status: "stale" };
+          }
+          const now2 = plan.tombstone.deniedAt;
+          const partitions = await requestAsPromise(tx.objectStore(KV_STORE.partitions).getAll());
+          const pendingKeys = await requestAsPromise(tx.objectStore(KV_STORE.pending).getAllKeys());
+          const intents = [];
+          const identities = /* @__PURE__ */ new Set();
+          for (const entry of partitions) {
+            if (entry.principalHash !== plan.callerHash) continue;
+            intents.push({ id: entry.partitionId, kind: "partition", partitionId: entry.partitionId, principalHash: plan.callerHash, recordedAt: now2 });
+            identities.add(entry.identityKeyHash);
+          }
+          for (const key of pendingKeys) {
+            if (typeof key === "string") identities.add(key);
+          }
+          for (const identityKeyHash of identities) {
+            intents.push({ id: `pending:${identityKeyHash}`, kind: "pending", identityKeyHash, principalHash: plan.callerHash, recordedAt: now2 });
+          }
+          const purge = tx.objectStore(KV_STORE.purgeIntents);
+          for (const intent of intents) purge.put(intent, intent.id);
+          const device = tx.objectStore(KV_STORE.device);
+          let deviceBytes = billedDeviceBytes(await requestAsPromise(device.get(DEVICE_KEY)));
+          device.delete(DEVICE_KEY);
+          device.delete(ACCOUNT_KEY);
+          device.delete(GATE_HMAC_KEY);
+          for (const prefix of [FIRST_INSTALL_KEY_PREFIX, GRANT_INSTALL_KEY_PREFIX]) {
+            const keys = await requestAsPromise(device.getAllKeys(IDBKeyRange.bound(prefix, `${prefix}\uFFFF`)));
+            for (const key of keys) {
+              deviceBytes += billedDeviceBytes(await requestAsPromise(device.get(key)));
+              if (!Number.isSafeInteger(deviceBytes)) throw gatedError("gate_unavailable", "Device quota bytes overflow.");
+              device.delete(key);
+            }
+          }
+          await ledger?.accountErase(tx, { partitionId: "device", bytes: deviceBytes });
+          const next = {
+            ...current,
+            principalHash: null,
+            consentDeadline: null,
+            lifecycleEpoch: plan.tombstone.epoch,
+            deniedAt: plan.tombstone.deniedAt
+          };
+          tx.objectStore(KV_STORE.gate).put(next, ACCOUNT2);
+          return { status: "denied", lifecycleEpoch: next.lifecycleEpoch, intents: intents.length };
+        }
+      );
+    } finally {
+      db.close();
+    }
+  }
+  async function wipe() {
+    const deleted = await deleteKvDatabase();
+    if (deleted.status === "deleted") return { status: "deleted" };
+    return setLogoutMarker() ? { status: "marker", code: deleted.code } : { status: "unguarded", code: deleted.code };
+  }
+  async function advanceDeny(gate, floor) {
+    const callerHash = gate.principalHash;
+    if (callerHash === null) return { status: "stale" };
+    const tombstone = { epoch: floor.epoch + 1, deniedAt: Math.max(checkedNow(), (floor.deniedAt ?? -1) + 1) };
+    if (!Number.isSafeInteger(tombstone.epoch) || !Number.isSafeInteger(tombstone.deniedAt)) {
+      throw gatedError("gate_unavailable", "The origin deny tombstone cannot advance.");
+    }
+    writeTombstone(tombstone);
+    try {
+      return await commitDeny({ gate, callerHash, tombstone });
+    } catch {
+      return wipe();
+    }
+  }
+  async function denyLocked(input) {
+    const gate = await readGate();
+    const floor = denyFloor(gate, readTombstone());
+    if (gate === void 0 || gate.principalHash === null) return { status: "stale" };
+    const keys = await activeKeys(gate);
+    const callerHash = await gateHash(keys.hash.hmac, "principal", input.principal.toLowerCase());
+    if (callerHash !== gate.principalHash) return { status: "stale" };
+    if (input.reason === "account_switch" && input.next === void 0) {
+      throw new Error("account_switch requires the next principal");
+    }
+    return advanceDeny(gate, floor);
+  }
+  async function expireConsentLocked() {
+    const gate = await readGate();
+    const floor = denyFloor(gate, readTombstone());
+    if (gate === void 0 || gate.principalHash === null) return { status: "stale" };
+    if (checkedNow() < deadlineOf(gate)) return { status: "stale" };
+    const stamp = { incarnation: gate.incarnation, lifecycleEpoch: gate.lifecycleEpoch };
+    view = void 0;
+    clearTimeout(expiryTimer);
+    const result = await advanceDeny(gate, floor);
+    if (result.status === "denied" || result.status === "deleted") {
+      try {
+        options.onConsentExpired?.(stamp);
+      } catch {
+      }
+      for (const observer of expiryObservers) {
+        try {
+          observer(stamp);
+        } catch {
+        }
+      }
+    }
+    return result;
+  }
+  async function expireConsent() {
+    try {
+      return await exclusive(GATE_LOCK, expireConsentLocked);
+    } catch (error) {
+      return { status: "unguarded", code: codeOf(error) };
+    }
+  }
+  async function deny(input) {
+    if (view?.principal === input.principal.toLowerCase()) {
+      view = void 0;
+      clearTimeout(expiryTimer);
+    }
+    try {
+      return await exclusive(GATE_LOCK, () => denyLocked(input));
+    } catch (error) {
+      return { status: "unguarded", code: codeOf(error) };
+    }
+  }
+  async function eraseIntent(intent) {
+    const db = await openKvStore(false);
+    if (db === null) return;
+    try {
+      await transact(db, [...ERASE_STORES, KV_STORE.partitions, KV_STORE.purgeIntents, KV_STORE.quota], "readwrite", async (tx) => {
+        if (intent.kind === "partition") {
+          const { bytes } = await eraser.erasePartition(tx, intent.partitionId);
+          await gateTx.unindexPartition(tx, intent.partitionId);
+          await ledger?.accountErase(tx, { partitionId: intent.partitionId, bytes });
+        } else {
+          await eraser.eraseIdentityPending(tx, intent.identityKeyHash);
+        }
+        await gateTx.clearIntent(tx, intent.id);
+      });
+    } finally {
+      db.close();
+    }
+  }
+  async function erasePendingLocked({ signal }) {
+    const erased = [];
+    const failed = [];
+    for (const intent of await readIntents()) {
+      if (signal.aborted) break;
+      try {
+        await eraseIntent(intent);
+        erased.push(intent.id);
+      } catch (error) {
+        failed.push({ id: intent.id, code: codeOf(error) });
+      }
+    }
+    return { erased, failed, remaining: (await readIntents()).length };
+  }
+  function erasePending(o) {
+    return exclusive(GATE_LOCK, () => erasePendingLocked(o));
+  }
+  async function recover({ signal }) {
+    try {
+      return await exclusive(GATE_LOCK, async () => {
+        const failed = [];
+        if (logoutMarkerSet()) {
+          if (readTombstone() === null) throw gatedError("gate_unavailable", "The pending logout has no deny tombstone.");
+          const deleted = await deleteKvDatabase();
+          if (deleted.status === "deleted") {
+            try {
+              localStorage.removeItem(REPLICA_LOGOUT_MARKER);
+              if (localStorage.getItem(REPLICA_LOGOUT_MARKER) !== null) throw new Error("The logout marker was not cleared.");
+            } catch {
+              failed.push({ id: "marker", code: "STORAGE_ERROR" });
+            }
+          } else {
+            failed.push({ id: "database", code: deleted.code });
+          }
+        }
+        if (failed.length > 0) return { erased: [], failed, remaining: 1 };
+        const gate = await readGate();
+        const tombstone = readTombstone();
+        if (gate !== void 0 && tombstone !== null && gate.lifecycleEpoch < tombstone.epoch) {
+          const wiped = await wipe();
+          if (wiped.status !== "deleted") {
+            return { erased: [], failed: [{ id: "database", code: wiped.code }], remaining: 1 };
+          }
+        }
+        const legacy = await readLegacyGateFloor();
+        if (legacy !== null) {
+          const tombstone2 = readTombstone();
+          preserveLegacyFloor(legacy, tombstone2);
+          assertTombstoneWritable();
+          const db = await openKvStore(true);
+          if (db === null) throw gatedError("gate_unavailable", "The legacy origin could not be migrated.");
+          db.close();
+        }
+        const expiry = await expireConsentLocked();
+        if (expiry.status === "marker" || expiry.status === "unguarded") {
+          return { erased: [], failed: [{ id: "expiry", code: expiry.code }], remaining: 1 };
+        }
+        const pass = await erasePendingLocked({ signal });
+        return { erased: pass.erased, failed: [...failed, ...pass.failed], remaining: pass.remaining, consentExpired: expiry.status === "denied" || expiry.status === "deleted" };
+      }, signal);
+    } catch (error) {
+      return { erased: [], failed: [{ id: "recover", code: codeOf(error) }], remaining: 1 };
+    }
+  }
+  function subscribeConsentExpired(listener) {
+    expiryObservers.add(listener);
+    return () => {
+      expiryObservers.delete(listener);
+    };
+  }
+  return {
+    kind: "indexeddb",
+    recover,
+    expireConsent,
+    checkDelivery,
+    consentDeadline,
+    subscribeConsentExpired,
+    establishSessionStamp,
+    restoreSessionStamp,
+    activationAllowed,
+    deliverable,
+    deny,
+    erasePending,
+    pendingPurge: readIntents
+  };
+}
+
+// src/kv-storage/testing.ts
+function killReplicaWorker(storage) {
+  const connection = Reflect.get(storage, "connection");
+  if (typeof connection !== "function") throw new TypeError("killReplicaWorker needs a storage from indexedDbReplicaStorage().");
+  const active = connection.call(storage, true);
+  if (active === void 0) return;
+  if (typeof active !== "object" || active === null) throw new TypeError("killReplicaWorker needs a storage from indexedDbReplicaStorage().");
+  const kill = Reflect.get(active, "kill");
+  if (typeof kill !== "function") throw new TypeError("killReplicaWorker needs a storage from indexedDbReplicaStorage().");
+  kill.call(active, new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica worker was terminated."));
+}
+function injectEraseFailure(options = {}) {
+  const base = options.base ?? kvPartitionEraser;
+  let remaining = options.times ?? Number.POSITIVE_INFINITY;
+  return {
+    remaining: () => remaining,
+    async erasePartition(tx, partitionId) {
+      if (remaining > 0 && (options.partitionIds === void 0 || options.partitionIds.includes(partitionId))) {
+        remaining -= 1;
+        throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, `Injected erase failure for ${partitionId}.`);
+      }
+      return base.erasePartition(tx, partitionId);
+    },
+    eraseIdentityPending: (tx, identityKeyHash) => base.eraseIdentityPending(tx, identityKeyHash)
+  };
+}
+function injectDenyFailure(point, options = {}) {
+  denyFaults[point] = { once: options.once ?? true };
+  return () => {
+    delete denyFaults[point];
+  };
+}
+export {
+  createIndexedDbLifecycle,
+  injectDenyFailure,
+  injectEraseFailure,
+  killReplicaWorker,
+  measureSealedRow
+};
+//# sourceMappingURL=kv-storage-testing.js.map