@tinycloud/replica 0.2.4-beta.3 → 0.3.0-beta.5

package/dist/kv-storage.js

@@ -0,0 +1,2587 @@
+// ../bootstrap/dist/index.js
+var CAPABILITIES = [
+  { urn: "tinycloud.kv/get", service: "tinycloud.kv", status: "active" },
+  { urn: "tinycloud.kv/list", service: "tinycloud.kv", status: "active" },
+  { urn: "tinycloud.kv/metadata", service: "tinycloud.kv", status: "active" },
+  { urn: "tinycloud.kv/put", service: "tinycloud.kv", status: "active" },
+  { urn: "tinycloud.kv/del", service: "tinycloud.kv", status: "active" },
+  { urn: "tinycloud.kv/delete", service: "tinycloud.kv", status: "deprecated-alias", aliasOf: "tinycloud.kv/del" },
+  { urn: "tinycloud.kv/sync", service: "tinycloud.kv", status: "active" },
+  { urn: "tinycloud.kv/retain", service: "tinycloud.kv", status: "active" },
+  { urn: "tinycloud.sql/read", service: "tinycloud.sql", status: "active" },
+  { urn: "tinycloud.sql/select", service: "tinycloud.sql", status: "deprecated-alias", aliasOf: "tinycloud.sql/read" },
+  { urn: "tinycloud.sql/write", service: "tinycloud.sql", status: "active" },
+  { urn: "tinycloud.sql/schema", service: "tinycloud.sql", status: "active" },
+  { urn: "tinycloud.sql/admin", service: "tinycloud.sql", status: "active", implies: ["tinycloud.sql/schema"] },
+  { urn: "tinycloud.sql/*", service: "tinycloud.sql", status: "active", implies: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/schema", "tinycloud.sql/admin"] },
+  { urn: "tinycloud.duckdb/read", service: "tinycloud.duckdb", status: "active" },
+  { urn: "tinycloud.duckdb/write", service: "tinycloud.duckdb", status: "active" },
+  { urn: "tinycloud.duckdb/admin", service: "tinycloud.duckdb", status: "active" },
+  { urn: "tinycloud.duckdb/import", service: "tinycloud.duckdb", status: "active" },
+  { urn: "tinycloud.duckdb/export", service: "tinycloud.duckdb", status: "active" },
+  { urn: "tinycloud.duckdb/select", service: "tinycloud.duckdb", status: "deprecated-alias", aliasOf: "tinycloud.duckdb/read" },
+  { urn: "tinycloud.duckdb/*", service: "tinycloud.duckdb", status: "active", implies: ["tinycloud.duckdb/read", "tinycloud.duckdb/write", "tinycloud.duckdb/admin", "tinycloud.duckdb/import", "tinycloud.duckdb/export"] },
+  { urn: "tinycloud.capabilities/read", service: "tinycloud.capabilities", status: "active" },
+  { urn: "tinycloud.delegation/status", service: "tinycloud.delegation", status: "active" },
+  { urn: "tinycloud.delegation/list", service: "tinycloud.delegation", status: "active" },
+  { urn: "tinycloud.hooks/subscribe", service: "tinycloud.hooks", status: "active" },
+  { urn: "tinycloud.hooks/register", service: "tinycloud.hooks", status: "active" },
+  { urn: "tinycloud.hooks/list", service: "tinycloud.hooks", status: "active" },
+  { urn: "tinycloud.hooks/unregister", service: "tinycloud.hooks", status: "active" },
+  { urn: "tinycloud.encryption/decrypt", service: "tinycloud.encryption", status: "active" },
+  { urn: "tinycloud.encryption/network.create", service: "tinycloud.encryption", status: "active" },
+  { urn: "tinycloud.encryption/network.revoke", service: "tinycloud.encryption", status: "active" },
+  { urn: "tinycloud.space/host", service: "tinycloud.space", status: "active" },
+  { urn: "tinycloud.space/create", service: "tinycloud.space", status: "active" },
+  { urn: "tinycloud.space/list", service: "tinycloud.space", status: "active" },
+  { urn: "tinycloud.space/info", service: "tinycloud.space", status: "active" },
+  { urn: "tinycloud.vfs/get", service: "tinycloud.vfs", status: "reserved" },
+  { urn: "tinycloud.vfs/list", service: "tinycloud.vfs", status: "reserved" },
+  { urn: "tinycloud.vfs/metadata", service: "tinycloud.vfs", status: "reserved" },
+  { urn: "tinycloud.vfs/put", service: "tinycloud.vfs", status: "reserved" },
+  { urn: "tinycloud.vfs/delete", service: "tinycloud.vfs", status: "reserved" }
+];
+function actionKey(action) {
+  if (action === "*") return "ALL";
+  return action.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+}
+function serviceOf(urn) {
+  return urn.slice("tinycloud.".length, urn.indexOf("/"));
+}
+function actionOf(urn) {
+  return urn.slice(urn.indexOf("/") + 1);
+}
+function deriveServiceConstants(service) {
+  const out = {};
+  for (const entry of CAPABILITIES) {
+    if (serviceOf(entry.urn) !== service) continue;
+    out[actionKey(actionOf(entry.urn))] = entry.urn;
+  }
+  return out;
+}
+var KV = deriveServiceConstants("kv");
+var SQL = {
+  ...deriveServiceConstants("sql"),
+  EXECUTE: "tinycloud.sql/execute",
+  EXPORT: "tinycloud.sql/export"
+};
+var DUCKDB = {
+  ...deriveServiceConstants("duckdb"),
+  DESCRIBE: "tinycloud.duckdb/describe",
+  EXECUTE: "tinycloud.duckdb/execute"
+};
+var CAPABILITIES2 = deriveServiceConstants("capabilities");
+var HOOKS = deriveServiceConstants("hooks");
+var ENCRYPTION = deriveServiceConstants("encryption");
+var SPACE = deriveServiceConstants("space");
+var CAPABILITY_REGISTRY = CAPABILITIES;
+var DEFAULT_MANIFEST_SPACE = "applications";
+var ACCOUNT_REGISTRY_SPACE = "account";
+var ACCOUNT_REGISTRY_PATH = "applications/";
+var SECRETS_SPACE = "secrets";
+var BOOTSTRAP_DEFAULT_SPACE = "default";
+var BOOTSTRAP_PUBLIC_SPACE = "public";
+var AGENTS_SPACE = "agents";
+var BOOTSTRAP_ENCRYPTION_NETWORK_NAME = "default";
+var BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE = `urn:tinycloud:encryption:{ownerDid}:${BOOTSTRAP_ENCRYPTION_NETWORK_NAME}`;
+var DEFAULT_EXPIRY_MS = 30 * 24 * 60 * 60 * 1e3;
+var VAULT_PERMISSION_SERVICE = "tinycloud.vault";
+var ENCRYPTION_PERMISSION_SERVICE = "tinycloud.encryption";
+var ENCRYPTION_MANIFEST_SPACE = "encryption";
+var NETWORK_CREATE_ACTION = ENCRYPTION.NETWORK_CREATE;
+var BOOTSTRAP_SPACE_NAMES = [
+  BOOTSTRAP_DEFAULT_SPACE,
+  DEFAULT_MANIFEST_SPACE,
+  ACCOUNT_REGISTRY_SPACE,
+  SECRETS_SPACE,
+  BOOTSTRAP_PUBLIC_SPACE,
+  AGENTS_SPACE
+];
+var TINYCLOUD_DEFAULT_SPACE_MANIFEST = {
+  app_id: "xyz.tinycloud.default",
+  name: "TinyCloud Default Space",
+  space: BOOTSTRAP_DEFAULT_SPACE,
+  prefix: "",
+  defaults: false,
+  includePublicSpace: false,
+  permissions: [
+    {
+      service: "tinycloud.kv",
+      space: BOOTSTRAP_DEFAULT_SPACE,
+      // Empty path = whole service on this space. Do NOT use "/": the recap
+      // encoder joins it as `<space>/<service>//`, which the node's byte-prefix
+      // resource matching can never extend (real paths start `<service>/x…`).
+      path: "",
+      actions: ["get", "put", "del", "list", "metadata"]
+    },
+    {
+      service: "tinycloud.sql",
+      space: BOOTSTRAP_DEFAULT_SPACE,
+      path: "",
+      actions: ["read", "write"]
+    }
+  ]
+};
+var TINYCLOUD_APPLICATIONS_SPACE_MANIFEST = {
+  app_id: "xyz.tinycloud.applications",
+  name: "TinyCloud Applications Space",
+  space: DEFAULT_MANIFEST_SPACE,
+  prefix: "",
+  defaults: false,
+  includePublicSpace: false,
+  permissions: [
+    {
+      service: "tinycloud.kv",
+      space: DEFAULT_MANIFEST_SPACE,
+      // Empty path = whole service on this space. Do NOT use "/": the recap
+      // encoder joins it as `<space>/<service>//`, which the node's byte-prefix
+      // resource matching can never extend (real paths start `<service>/x…`).
+      path: "",
+      actions: ["get", "put", "del", "list", "metadata"]
+    },
+    {
+      service: "tinycloud.sql",
+      space: DEFAULT_MANIFEST_SPACE,
+      path: "",
+      actions: ["read", "write"]
+    }
+  ]
+};
+var TINYCLOUD_ACCOUNT_SPACE_MANIFEST = {
+  app_id: "xyz.tinycloud.account",
+  name: "TinyCloud Account Registry",
+  space: ACCOUNT_REGISTRY_SPACE,
+  prefix: "",
+  defaults: false,
+  includePublicSpace: false,
+  permissions: [
+    {
+      service: "tinycloud.kv",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path: "applications/",
+      actions: ["get", "put", "list"]
+    },
+    {
+      service: "tinycloud.kv",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path: "spaces/",
+      actions: ["get", "put", "list"]
+    },
+    {
+      service: "tinycloud.sql",
+      space: ACCOUNT_REGISTRY_SPACE,
+      path: "account",
+      actions: ["read", "write", "schema"]
+    }
+  ]
+};
+var TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST = {
+  app_id: "xyz.tinycloud.secrets",
+  name: "TinyCloud Secrets",
+  space: SECRETS_SPACE,
+  prefix: "",
+  defaults: false,
+  includePublicSpace: false,
+  permissions: [
+    {
+      service: "tinycloud.vault",
+      space: SECRETS_SPACE,
+      path: "secrets/",
+      actions: ["read"],
+      skipPrefix: true
+    },
+    {
+      service: "tinycloud.kv",
+      space: SECRETS_SPACE,
+      path: "variables",
+      actions: ["list", "metadata"],
+      skipPrefix: true
+    },
+    {
+      service: "tinycloud.kv",
+      space: SECRETS_SPACE,
+      path: "variables/",
+      actions: ["get", "put", "del", "list", "metadata"],
+      skipPrefix: true
+    },
+    {
+      service: "tinycloud.sql",
+      space: SECRETS_SPACE,
+      path: "default",
+      actions: ["read", "write", "schema"],
+      skipPrefix: true
+    },
+    {
+      service: "tinycloud.capabilities",
+      space: SECRETS_SPACE,
+      path: "",
+      actions: ["read"],
+      skipPrefix: true
+    }
+  ]
+};
+var TINYCLOUD_PUBLIC_SPACE_MANIFEST = {
+  app_id: "xyz.tinycloud.public",
+  name: "TinyCloud Public Space",
+  space: BOOTSTRAP_PUBLIC_SPACE,
+  prefix: "",
+  defaults: false,
+  includePublicSpace: false,
+  permissions: [
+    {
+      service: "tinycloud.kv",
+      space: BOOTSTRAP_PUBLIC_SPACE,
+      path: "",
+      actions: ["get", "list", "metadata"]
+    }
+  ]
+};
+var TINYCLOUD_AGENTS_SPACE_MANIFEST = {
+  app_id: "xyz.tinycloud.agents",
+  name: "TinyCloud Agents Space",
+  space: AGENTS_SPACE,
+  prefix: "",
+  defaults: false,
+  includePublicSpace: false,
+  permissions: [
+    {
+      service: "tinycloud.kv",
+      space: AGENTS_SPACE,
+      path: "",
+      actions: ["get", "put", "del", "list", "metadata"]
+    }
+  ]
+};
+var BOOTSTRAP_SPACE_MANIFESTS = {
+  [BOOTSTRAP_DEFAULT_SPACE]: TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  [DEFAULT_MANIFEST_SPACE]: TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  [ACCOUNT_REGISTRY_SPACE]: TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  [SECRETS_SPACE]: TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
+  [BOOTSTRAP_PUBLIC_SPACE]: TINYCLOUD_PUBLIC_SPACE_MANIFEST,
+  [AGENTS_SPACE]: TINYCLOUD_AGENTS_SPACE_MANIFEST
+};
+var BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS = [
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST
+];
+var ACCOUNT_INDEX_SCHEMA = [
+  `CREATE TABLE IF NOT EXISTS applications (
+    app_id TEXT PRIMARY KEY,
+    name TEXT,
+    description TEXT,
+    updated_at TEXT,
+    manifest_json TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS application_state (
+    app_id TEXT PRIMARY KEY,
+    manifest_hash TEXT NOT NULL,
+    indexed_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS spaces (
+    space_id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    owner_did TEXT NOT NULL,
+    type TEXT NOT NULL,
+    permissions_json TEXT NOT NULL,
+    status TEXT NOT NULL,
+    registered_at TEXT,
+    updated_at TEXT NOT NULL,
+    expires_at TEXT
+  )`,
+  `CREATE TABLE IF NOT EXISTS delegations (
+    cid TEXT PRIMARY KEY,
+    direction TEXT NOT NULL,
+    space_id TEXT NOT NULL,
+    space_name TEXT,
+    counterparty_did TEXT NOT NULL,
+    delegate_did TEXT NOT NULL,
+    delegator_did TEXT,
+    path TEXT NOT NULL,
+    actions_json TEXT NOT NULL,
+    expiry TEXT NOT NULL,
+    status TEXT NOT NULL,
+    created_at TEXT,
+    updated_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS sync_state (
+    source TEXT PRIMARY KEY,
+    synced_at TEXT NOT NULL,
+    count INTEGER NOT NULL
+  )`,
+  "CREATE INDEX IF NOT EXISTS idx_delegations_direction ON delegations(direction)",
+  "CREATE INDEX IF NOT EXISTS idx_delegations_space ON delegations(space_id)",
+  "CREATE INDEX IF NOT EXISTS idx_delegations_counterparty ON delegations(counterparty_did)",
+  "CREATE INDEX IF NOT EXISTS idx_spaces_owner ON spaces(owner_did)",
+  "CREATE INDEX IF NOT EXISTS idx_spaces_type ON spaces(type)"
+];
+var SECRET_RECORDS_SCHEMA = [
+  `CREATE TABLE IF NOT EXISTS secret_records (
+    scope TEXT NOT NULL,
+    name TEXT NOT NULL,
+    provider_id TEXT,
+    custom_note TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    last_tested TEXT,
+    test_status TEXT,
+    test_message TEXT,
+    PRIMARY KEY(scope, name)
+  )`
+];
+var BOOTSTRAP_MANIFEST = {
+  spaces: BOOTSTRAP_SPACE_NAMES.map((name) => ({
+    name,
+    manifest: BOOTSTRAP_SPACE_MANIFESTS[name],
+    persistedAsApplication: name === SECRETS_SPACE
+  })),
+  applications: BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  accountIndexSchema: ACCOUNT_INDEX_SCHEMA,
+  secretRecordsSchema: SECRET_RECORDS_SCHEMA,
+  encryptionNetwork: {
+    name: BOOTSTRAP_ENCRYPTION_NETWORK_NAME
+  }
+};
+function cloneManifest(manifest) {
+  return {
+    ...manifest,
+    permissions: manifest.permissions?.map((permission) => ({
+      ...permission,
+      actions: [...permission.actions]
+    }))
+  };
+}
+function actionUrn(service, action) {
+  return action.includes("/") ? action : `${service}/${action}`;
+}
+function applyPrefix(prefix, path, skipPrefix) {
+  if (skipPrefix === true || prefix === "" || path === "") {
+    return path;
+  }
+  if (path === "/") {
+    return `${prefix}/`;
+  }
+  const trimmedPrefix = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
+  const trimmedPath = path.startsWith("/") ? path.slice(1) : path;
+  return `${trimmedPrefix}/${trimmedPath}`;
+}
+function expandVaultPermission(entry) {
+  return entry.actions.map((action) => {
+    const normalized = action.startsWith("tinycloud.vault/") ? action.slice("tinycloud.vault/".length) : action.startsWith("tinycloud.kv/") ? action.slice("tinycloud.kv/".length) : action;
+    const mapped = normalized === "read" || normalized === "get" ? KV.GET : normalized === "write" || normalized === "put" ? KV.PUT : normalized === "delete" || normalized === "del" ? KV.DEL : normalized === "list" ? KV.LIST : normalized === "metadata" ? KV.METADATA : void 0;
+    if (mapped === void 0) {
+      throw new Error(`unknown vault action ${JSON.stringify(action)}`);
+    }
+    const normalizedPath = entry.path.startsWith("/") ? entry.path.slice(1) : entry.path;
+    return {
+      ...entry,
+      service: "tinycloud.kv",
+      path: `vault/${normalizedPath}`,
+      actions: [mapped],
+      skipPrefix: true
+    };
+  });
+}
+function expandPermissionEntry(entry, prefix, inheritedSpace) {
+  if (entry.service === VAULT_PERMISSION_SERVICE) {
+    return expandVaultPermission(entry).flatMap(
+      (expanded) => expandPermissionEntry(expanded, prefix, inheritedSpace)
+    );
+  }
+  const skipPrefix = entry.skipPrefix === true || entry.service === ENCRYPTION_PERMISSION_SERVICE;
+  return [
+    {
+      service: entry.service,
+      space: entry.service === ENCRYPTION_PERMISSION_SERVICE ? ENCRYPTION_MANIFEST_SPACE : entry.space ?? inheritedSpace,
+      path: applyPrefix(prefix, entry.path, skipPrefix),
+      actions: entry.actions.map((action) => actionUrn(entry.service, action)),
+      ...entry.description !== void 0 ? { description: entry.description } : {}
+    }
+  ];
+}
+function dedupeResources(resources) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const resource of resources) {
+    const key = `${resource.service}\0${resource.space}\0${resource.path}`;
+    const existing = byKey.get(key);
+    if (!existing) {
+      byKey.set(key, { ...resource, actions: [...resource.actions] });
+      continue;
+    }
+    for (const action of resource.actions) {
+      if (!existing.actions.includes(action)) {
+        existing.actions.push(action);
+      }
+    }
+  }
+  return [...byKey.values()];
+}
+function withCapabilitiesReadForSpaces(resources) {
+  const spaces = new Set(
+    resources.filter((resource) => resource.service !== ENCRYPTION_PERMISSION_SERVICE).map((resource) => resource.space)
+  );
+  return dedupeResources([
+    ...resources,
+    ...[...spaces].map((space) => ({
+      service: "tinycloud.capabilities",
+      space,
+      path: "",
+      actions: [CAPABILITIES2.READ]
+    }))
+  ]);
+}
+function composeManifestRequest(inputs, options = {}) {
+  if (!Array.isArray(inputs) || inputs.length === 0) {
+    throw new Error("composeManifestRequest requires at least one manifest");
+  }
+  const includeAccountRegistryPermissions = options.includeAccountRegistryPermissions ?? true;
+  const manifests = inputs.map(cloneManifest);
+  const resources = manifests.flatMap((manifest) => {
+    const prefix = manifest.prefix ?? manifest.app_id;
+    const space = manifest.space ?? DEFAULT_MANIFEST_SPACE;
+    const explicit = manifest.permissions ?? [];
+    return explicit.flatMap((entry) => expandPermissionEntry(entry, prefix, space));
+  });
+  if (includeAccountRegistryPermissions) {
+    resources.push(
+      ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
+        ...resource,
+        actions: [...resource.actions]
+      }))
+    );
+  }
+  const manifestsByAppId = /* @__PURE__ */ new Map();
+  for (const manifest of manifests) {
+    const current = manifestsByAppId.get(manifest.app_id) ?? [];
+    current.push(cloneManifest(manifest));
+    manifestsByAppId.set(manifest.app_id, current);
+  }
+  return {
+    manifests,
+    resources: withCapabilitiesReadForSpaces(resources),
+    delegationTargets: [],
+    registryRecords: includeAccountRegistryPermissions ? [...manifestsByAppId.entries()].map(([app_id, appManifests]) => ({
+      key: `${ACCOUNT_REGISTRY_PATH}${app_id}`,
+      app_id,
+      manifests: appManifests
+    })) : [],
+    expiryMs: DEFAULT_EXPIRY_MS,
+    includePublicSpace: manifests.some(
+      (manifest) => manifest.includePublicSpace ?? true
+    )
+  };
+}
+function composeBootstrapSpaceManifest(space) {
+  return composeManifestRequest([BOOTSTRAP_SPACE_MANIFESTS[space]], {
+    includeAccountRegistryPermissions: false
+  });
+}
+var ACCOUNT_MANIFEST_PERMISSIONS = Object.freeze([
+  {
+    service: "tinycloud.kv",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: ACCOUNT_REGISTRY_PATH,
+    actions: [KV.GET, KV.PUT, KV.LIST]
+  },
+  {
+    service: "tinycloud.kv",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "spaces/",
+    actions: [KV.GET, KV.PUT, KV.LIST]
+  },
+  {
+    service: "tinycloud.kv",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "system/bootstrap/complete",
+    actions: [KV.GET, KV.PUT]
+  },
+  {
+    service: "tinycloud.delegation",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "",
+    actions: ["tinycloud.delegation/list"]
+  },
+  {
+    service: "tinycloud.sql",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "account",
+    actions: [SQL.READ, SQL.WRITE, SQL.SCHEMA]
+  },
+  {
+    service: "tinycloud.capabilities",
+    space: ACCOUNT_REGISTRY_SPACE,
+    path: "",
+    actions: [CAPABILITIES2.READ]
+  }
+]);
+var BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST = composeBootstrapSpaceManifest(BOOTSTRAP_DEFAULT_SPACE);
+var BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST = {
+  ...BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST,
+  resources: [
+    ...BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST.resources,
+    ...ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
+      ...resource,
+      actions: [...resource.actions]
+    }))
+  ]
+};
+var BOOTSTRAP_SESSION_REQUESTS = Object.freeze(
+  Object.fromEntries(
+    BOOTSTRAP_SPACE_NAMES.map((space) => [
+      space,
+      space === BOOTSTRAP_DEFAULT_SPACE ? BOOTSTRAP_WIDENED_DEFAULT_SESSION_REQUEST : composeBootstrapSpaceManifest(space)
+    ])
+  )
+);
+var ACCOUNT_SESSION_RAW_ALLOWLIST = Object.freeze([
+  {
+    service: "tinycloud.encryption",
+    resource: BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+    actions: [NETWORK_CREATE_ACTION]
+  }
+]);
+var BOOTSTRAP_ALLOWLIST = Object.freeze(
+  BOOTSTRAP_SPACE_NAMES.flatMap((space) => [
+    {
+      kind: "session",
+      service: "tinycloud.session",
+      space,
+      actions: ["siwe"],
+      resources: BOOTSTRAP_SESSION_REQUESTS[space].resources,
+      ...space === ACCOUNT_REGISTRY_SPACE ? { rawAbilities: ACCOUNT_SESSION_RAW_ALLOWLIST } : {}
+    },
+    {
+      kind: "space/host",
+      service: "tinycloud.space",
+      space,
+      actions: [SPACE.HOST]
+    }
+  ])
+);
+
+// ../sdk-services/dist/kv/replication/index.js
+var SPACE_ID = /^(tinycloud:pkh:eip155:\d+:)([^:]+)(:.+)$/;
+var PRINCIPAL_DID = /^(did:pkh:eip155:\d+:)([^:]+)$/;
+function canonicalReplicationIdentity(raw) {
+  if (!raw || typeof raw.host !== "string" || typeof raw.space !== "string" || typeof raw.principal !== "string") {
+    throw new TypeError(
+      "Replication identity host, space, and principal must be strings"
+    );
+  }
+  const authority = /^https?:\/\/([^/?#]*)/i.exec(raw.host)?.[1];
+  let url;
+  try {
+    url = new URL(raw.host);
+  } catch {
+    throw new TypeError(
+      "Replication identity host must be an absolute HTTP(S) URL"
+    );
+  }
+  if (!authority || authority.includes("@") || raw.host.includes("?") || raw.host.includes("#") || url.username || url.password) {
+    throw new TypeError(
+      "Replication identity host must be HTTP(S) without credentials, query, or fragment"
+    );
+  }
+  const space = SPACE_ID.exec(raw.space);
+  const principal = PRINCIPAL_DID.exec(raw.principal);
+  if (!space || !principal) {
+    throw new TypeError(
+      "Replication identity requires a full TinyCloud space id and a pkh principal DID"
+    );
+  }
+  return {
+    host: `${url.origin}${url.pathname.replace(/\/+$/, "")}`,
+    space: `${space[1]}${space[2].toLowerCase()}${space[3]}`,
+    principal: `${principal[1]}${principal[2].toLowerCase()}`
+  };
+}
+function replicationIdentityKey(id) {
+  const canonical = canonicalReplicationIdentity(id);
+  return `tc-replication/v1
+${canonical.host}
+${canonical.space}
+${canonical.principal}`;
+}
+var ErrorCodes = {
+  // Common errors
+  NOT_FOUND: "NOT_FOUND",
+  AUTH_EXPIRED: "AUTH_EXPIRED",
+  AUTH_REQUIRED: "AUTH_REQUIRED",
+  AUTH_UNAUTHORIZED: "AUTH_UNAUTHORIZED",
+  /** HTTP 401: the delegation the invocation cites was revoked. */
+  AUTH_DELEGATION_REVOKED: "AUTH_DELEGATION_REVOKED",
+  /** HTTP 401: a delegation the cited one rests on was revoked. */
+  AUTH_DELEGATION_ANCESTOR_REVOKED: "AUTH_DELEGATION_ANCESTOR_REVOKED",
+  NETWORK_ERROR: "NETWORK_ERROR",
+  TIMEOUT: "TIMEOUT",
+  ABORTED: "ABORTED",
+  INVALID_INPUT: "INVALID_INPUT",
+  PERMISSION_DENIED: "PERMISSION_DENIED",
+  // Node retry signals (tinycloud-node #347). `meta.retryable` says whether a
+  // retry is safe; `meta.retryAfterMs` carries the node's Retry-After.
+  /** HTTP 503 `sql_busy:<stage>` / `unavailable_retryable`: nothing was applied; retry after `meta.retryAfterMs`. */
+  NODE_BUSY: "NODE_BUSY",
+  /** HTTP 503 `request_timeout`: the node's deadline passed before any write began; nothing was applied. */
+  REQUEST_TIMEOUT: "REQUEST_TIMEOUT",
+  /** HTTP 500 `outcome_unknown`: a write may have been applied; read back before retrying a non-idempotent operation. */
+  OUTCOME_UNKNOWN: "OUTCOME_UNKNOWN",
+  // KV-specific errors
+  KV_NOT_FOUND: "KV_NOT_FOUND",
+  KV_WRITE_FAILED: "KV_WRITE_FAILED",
+  KV_PRECONDITION_FAILED: "KV_PRECONDITION_FAILED",
+  KV_CONFLICT: "KV_CONFLICT",
+  KV_RESPONSE_TOO_LARGE: "KV_RESPONSE_TOO_LARGE",
+  /** HTTP 410 from the change feed: discard sync state and restart without a cursor; `meta.reason` says why. */
+  KV_SYNC_RESET_REQUIRED: "KV_SYNC_RESET_REQUIRED",
+  /** HTTP 403 from the change feed: the retention grant was refused; `meta.reason` says why. */
+  KV_RETENTION_GRANT_REFUSED: "KV_RETENTION_GRANT_REFUSED",
+  // SQL-specific errors
+  SQL_ERROR: "SQL_ERROR",
+  SQL_PERMISSION_DENIED: "SQL_PERMISSION_DENIED",
+  SQL_DATABASE_NOT_FOUND: "SQL_DATABASE_NOT_FOUND",
+  SQL_RESPONSE_TOO_LARGE: "SQL_RESPONSE_TOO_LARGE",
+  SQL_QUOTA_EXCEEDED: "SQL_QUOTA_EXCEEDED",
+  SQL_INVALID_STATEMENT: "SQL_INVALID_STATEMENT",
+  SQL_SCHEMA_ERROR: "SQL_SCHEMA_ERROR",
+  SQL_READONLY_VIOLATION: "SQL_READONLY_VIOLATION",
+  // Storage quota errors
+  STORAGE_QUOTA_EXCEEDED: "STORAGE_QUOTA_EXCEEDED",
+  STORAGE_LIMIT_REACHED: "STORAGE_LIMIT_REACHED",
+  /** The node answered the usage read without usage numbers (it predates the read). */
+  STORAGE_STATUS_UNAVAILABLE: "STORAGE_STATUS_UNAVAILABLE",
+  // DuckDB-specific errors
+  DUCKDB_ERROR: "DUCKDB_ERROR",
+  DUCKDB_PERMISSION_DENIED: "DUCKDB_PERMISSION_DENIED",
+  DUCKDB_DATABASE_NOT_FOUND: "DUCKDB_DATABASE_NOT_FOUND",
+  DUCKDB_RESPONSE_TOO_LARGE: "DUCKDB_RESPONSE_TOO_LARGE",
+  DUCKDB_QUOTA_EXCEEDED: "DUCKDB_QUOTA_EXCEEDED",
+  DUCKDB_INVALID_STATEMENT: "DUCKDB_INVALID_STATEMENT",
+  DUCKDB_SCHEMA_ERROR: "DUCKDB_SCHEMA_ERROR",
+  DUCKDB_READONLY_VIOLATION: "DUCKDB_READONLY_VIOLATION"
+};
+var defaultRetryPolicy = {
+  maxAttempts: 3,
+  backoff: "exponential",
+  baseDelayMs: 1e3,
+  maxDelayMs: 1e4,
+  retryableErrors: [ErrorCodes.NETWORK_ERROR, ErrorCodes.TIMEOUT]
+};
+var grantableActions = new Set(
+  CAPABILITY_REGISTRY.map(({ urn }) => urn).filter((urn) => !urn.endsWith("/*"))
+);
+var capabilityServices = new Set(
+  CAPABILITY_REGISTRY.map(({ service }) => service.slice("tinycloud.".length))
+);
+var DEFINITIVE_FAILURES = /* @__PURE__ */ new Set([
+  ErrorCodes.AUTH_REQUIRED,
+  ErrorCodes.INVALID_INPUT,
+  ErrorCodes.AUTH_UNAUTHORIZED,
+  ErrorCodes.KV_PRECONDITION_FAILED,
+  ErrorCodes.STORAGE_QUOTA_EXCEEDED,
+  ErrorCodes.STORAGE_LIMIT_REACHED
+]);
+var encoder = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
+var HOUR_MS = 60 * 60 * 1e3;
+var DAY_MS = 24 * HOUR_MS;
+var MAX_GRANT_TTL_MS = 7 * DAY_MS;
+var CONSENT_WINDOW_MS = 7 * DAY_MS;
+var EXPIRED = Number.NEGATIVE_INFINITY;
+
+// src/errors.ts
+var ReplicaErrorCode = {
+  /** Another process holds the sync lease. */
+  BUSY: "REPLICA_BUSY",
+  /** No replica with this name exists. */
+  NOT_FOUND: "REPLICA_NOT_FOUND",
+  /** The replica exists but its stored configuration differs from the request. */
+  CONFIG_MISMATCH: "REPLICA_CONFIG_MISMATCH",
+  /** The runtime has no supported durable store (e.g. Node < 22.13). */
+  RUNTIME_UNSUPPORTED: "RUNTIME_UNSUPPORTED",
+  /** A required open() argument is missing or malformed (e.g. `principal`). */
+  INVALID_ARGUMENT: "REPLICA_INVALID_ARGUMENT",
+  /** The local store failed (I/O, corruption, schema). */
+  STORAGE_ERROR: "STORAGE_ERROR",
+  /** The local disk is full. */
+  STORAGE_FULL: "STORAGE_FULL",
+  /** The key is outside the replica's prefix. */
+  NOT_COVERED: "NOT_COVERED",
+  /** Syncing the secrets space or the vault namespace needs an explicit opt-in. */
+  SECRETS_OPT_IN_REQUIRED: "SECRETS_OPT_IN_REQUIRED",
+  /** No grant is installed, or none covers the requested scope. */
+  GRANT_MISSING: "GRANT_MISSING",
+  /** The grant bytes are not a verifiable UCAN, or its signature is wrong. */
+  GRANT_INVALID: "GRANT_INVALID",
+  /** SIWE/CACAO and other non-UCAN grants cannot be used for a replica. */
+  GRANT_FORMAT_UNSUPPORTED: "GRANT_FORMAT_UNSUPPORTED",
+  /** The grant was issued to a different device. */
+  GRANT_AUDIENCE_MISMATCH: "GRANT_AUDIENCE_MISMATCH",
+  /** The grant lacks `tinycloud.kv/sync` or `tinycloud.kv/get` on the prefix. */
+  GRANT_NOT_COVERING: "GRANT_NOT_COVERING",
+  GRANT_NOT_YET_VALID: "GRANT_NOT_YET_VALID",
+  GRANT_EXPIRED: "GRANT_EXPIRED",
+  /** The configured node does not advertise whole-space KV sync support. */
+  REPLICATION_ROOT_UNSUPPORTED: "REPLICATION_ROOT_UNSUPPORTED",
+  GRANT_REVOKED: "GRANT_REVOKED",
+  /** The node refused the invocation for a reason other than revocation. */
+  GRANT_UNAUTHORIZED: "GRANT_UNAUTHORIZED",
+  /** The node refused the retention grant. */
+  RETENTION_GRANT_REFUSED: "RETENTION_GRANT_REFUSED",
+  /** The node could not be reached. */
+  NETWORK_ERROR: "NETWORK_ERROR",
+  /** The node answered with an unexpected status. */
+  NODE_ERROR: "NODE_ERROR",
+  /** The node's answer violates the wire contract. */
+  PROTOCOL_ERROR: "PROTOCOL_ERROR",
+  /** The node asked for a fresh bootstrap (410). Handled inside sync. */
+  RESET_REQUIRED: "RESET_REQUIRED",
+  /** The feed now comes from a different node than the one pinned. */
+  SOURCE_CHANGED: "SOURCE_CHANGED",
+  /** The feed delivered a key outside the replica's prefix. */
+  SCOPE_VIOLATION: "SCOPE_VIOLATION",
+  /** Fetched bytes do not hash to the ETag the node attested for them. */
+  CONTENT_MISMATCH: "CONTENT_MISMATCH",
+  /** A stored blob no longer hashes to its name. */
+  INTEGRITY_ERROR: "INTEGRITY_ERROR",
+  /** The replica handle was closed; in-flight calls settle with this code. */
+  CLOSED: "REPLICA_CLOSED",
+  /** The lifecycle gate refused the operation (shared contract `REPLICA_GATED`); `detail.gate` says why. */
+  GATED: "REPLICA_GATED",
+  /** Quota admission refused a page (`maxBytes` or the free-space floor); nothing committed. */
+  STORAGE_BUDGET: "STORAGE_BUDGET",
+  /** The consent deadline passed: the grant is not served until the user consents again. */
+  CONSENT_EXPIRED: "CONSENT_EXPIRED"
+};
+var REPLICA_ERROR = /* @__PURE__ */ Symbol.for("tinycloud.replica.error");
+var ReplicaError = class extends Error {
+  [REPLICA_ERROR] = true;
+  code;
+  detail;
+  constructor(code, message, detail, options) {
+    super(message, options);
+    this.name = "ReplicaError";
+    this.code = code;
+    if (detail !== void 0) this.detail = detail;
+  }
+};
+function isReplicaError(error, code) {
+  return typeof error === "object" && error !== null && error[REPLICA_ERROR] === true && (code === void 0 || error.code === code);
+}
+function gatedError(gate, message) {
+  return Object.assign(new ReplicaError(ReplicaErrorCode.GATED, message, { gate }), { gate });
+}
+
+// ../sdk-services/dist/kv/replication/prefix.js
+function assertFolderPrefix(prefix) {
+  const validFolder = typeof prefix === "string" && prefix.length > 0 && !prefix.startsWith("/") && !prefix.includes("//") && prefix.endsWith("/");
+  if (prefix !== "/" && !validFolder) {
+    const folderHint = typeof prefix === "string" ? prefix.replace(/^\/+/, "").replace(/\/+$/, "") : "";
+    const suggestion = folderHint.length > 0 && !folderHint.includes("//") ? ` Use ${JSON.stringify(`${folderHint}/`)}.` : ' Use "/" or a slash-terminated folder path such as "notes/".';
+    throw new TypeError(`Replication prefix must be "/" or a non-empty slash-terminated folder path without empty segments.${suggestion}`);
+  }
+}
+
+// src/scope.ts
+function assertFolderPrefix2(prefix) {
+  try {
+    assertFolderPrefix(prefix);
+  } catch {
+    const folderHint = typeof prefix === "string" ? prefix.replace(/^\/+/, "").replace(/\/+$/, "") : "";
+    const suggestion = prefix === "" ? 'use "/" for the whole space' : folderHint.length > 0 && !folderHint.includes("//") ? `use ${JSON.stringify(`${folderHint}/`)}` : 'use "/" for the whole space or a folder path such as "notes/"';
+    throw new ReplicaError(
+      ReplicaErrorCode.INVALID_ARGUMENT,
+      `Replication prefix ${JSON.stringify(prefix)} must be "/" or a non-empty folder path ending in / without empty segments; ${suggestion}. Run \`tc replica reset --replica <name> --purge\` and recreate it with the folder prefix.`
+    );
+  }
+}
+
+// src/browser/idb.ts
+function requestAsPromise(request) {
+  const { promise, resolve, reject } = Promise.withResolvers();
+  request.onsuccess = () => resolve(request.result);
+  request.onerror = () => reject(request.error ?? new DOMException("IndexedDB request failed", "UnknownError"));
+  return promise;
+}
+function transactionDone(tx) {
+  const { promise, resolve, reject } = Promise.withResolvers();
+  tx.addEventListener("complete", () => resolve(), { once: true });
+  tx.addEventListener("abort", () => reject(tx.error ?? new DOMException("Transaction aborted", "AbortError")), { once: true });
+  tx.addEventListener("error", () => reject(tx.error ?? new DOMException("Transaction failed", "UnknownError")), { once: true });
+  return promise;
+}
+var byteEncoder = new TextEncoder();
+function hasName(error) {
+  return typeof error === "object" && error !== null && "name" in error && typeof error.name === "string";
+}
+function idbError(error, action) {
+  if (error instanceof ReplicaError) return error;
+  const message = error instanceof Error ? error.message : String(error);
+  if (hasName(error) && error.name === "QuotaExceededError") {
+    return new ReplicaError(ReplicaErrorCode.STORAGE_FULL, `${action}: the browser's storage quota is exceeded.`, void 0, {
+      cause: error
+    });
+  }
+  return new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, `${action}: ${message}`, void 0, { cause: error });
+}
+
+// src/kv-storage/gateKeys.ts
+var GATE_HMAC_KEY = "gateHmac";
+var ACCOUNT_KEY = "accountKey";
+var HEX = "0123456789abcdef";
+var ENCODER = new TextEncoder();
+function hex(bytes) {
+  let value = "";
+  for (const byte of bytes) value += HEX.charAt(byte >>> 4) + HEX.charAt(byte & 15);
+  return value;
+}
+function keyId() {
+  return hex(crypto.getRandomValues(new Uint8Array(16)));
+}
+async function newGateHmac(incarnation) {
+  const hmac = await crypto.subtle.generateKey({ name: "HMAC", hash: "SHA-256", length: 256 }, false, ["sign", "verify"]);
+  return { v: 1, incarnation, keyId: keyId(), hmac };
+}
+async function newAccountKey(incarnation, lifecycleEpoch, principalHash) {
+  const [aesGcm, hmac] = await Promise.all([
+    crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]),
+    crypto.subtle.generateKey({ name: "HMAC", hash: "SHA-256", length: 256 }, false, ["sign", "verify"])
+  ]);
+  return { v: 1, incarnation, lifecycleEpoch, principalHash, keyId: keyId(), aesGcm, hmac };
+}
+async function gateHash(key, domain, material) {
+  const bytes = ENCODER.encode(`${domain}\0${material}`);
+  return hex(new Uint8Array(await crypto.subtle.sign("HMAC", key, bytes)));
+}
+function isHmac(key) {
+  if (!(key instanceof CryptoKey) || key.extractable || key.algorithm.name !== "HMAC") return false;
+  const algorithm = key.algorithm;
+  return "hash" in algorithm && algorithm.hash !== null && typeof algorithm.hash === "object" && "name" in algorithm.hash && algorithm.hash.name === "SHA-256" && key.usages.length === 2 && key.usages.includes("sign") && key.usages.includes("verify");
+}
+function isAesGcm(key) {
+  if (!(key instanceof CryptoKey) || key.extractable || key.algorithm.name !== "AES-GCM") return false;
+  return "length" in key.algorithm && key.algorithm.length === 256 && key.usages.length === 2 && key.usages.includes("encrypt") && key.usages.includes("decrypt");
+}
+function validGateHmac(record, gate) {
+  return record?.v === 1 && record.incarnation === gate.incarnation && record.keyId === gate.keyId && /^[0-9a-f]{32}$/.test(record.keyId) && isHmac(record.hmac);
+}
+function validAccountKey(record, gate) {
+  return record?.v === 1 && record.incarnation === gate.incarnation && record.lifecycleEpoch === gate.lifecycleEpoch && record.principalHash === gate.principalHash && record.keyId === gate.accountKeyId && /^[0-9a-f]{32}$/.test(record.keyId) && isAesGcm(record.aesGcm) && isHmac(record.hmac);
+}
+
+// ../sdk-services/dist/kv/replication/contractConstants.js
+var HOUR_MS2 = 60 * 60 * 1e3;
+var DAY_MS2 = 24 * HOUR_MS2;
+var MAX_GRANT_TTL_MS2 = 7 * DAY_MS2;
+var CONSENT_WINDOW_MS2 = 7 * DAY_MS2;
+var DEFAULT_MIN_FREE_BYTES = 64 * 1024 * 1024;
+var REPLICA_KV_DATABASE = "tinycloud-replica-kv";
+var REPLICA_KV_STORES = {
+  /** Data: partition meta (opaque fences, sealed config/grants), private gate-HMAC partition id. */
+  meta: "meta",
+  /** Data: sealed KV entries, key `[privatePartitionId, accountHmac(path)]`. */
+  entries: "entries",
+  /** Data: AES-GCM content blobs, key `[privatePartitionId, accountHmac(hash)]`. */
+  blobs: "blobs",
+  /** Data: AES-sealed pending state, key private gate-HMAC `identityKeyHash`. */
+  pending: "pending",
+  /** Data: sealed owner device, private nonextractable key records and opaque install anchors. */
+  device: "device",
+  /** Control: the account gate, singleton key `"account"`, value `ReplicaAccountGate`. */
+  gate: "gate",
+  /** Control: partition index keyed by private `partitionId`; nonunique `byLookupId` index. */
+  partitions: "partitions",
+  /** Control: purge intents, key `ReplicaPurgeIntent.id`, value `ReplicaPurgeIntent`. */
+  purgeIntents: "purgeIntents",
+  /** Control: quota ledger, keys owned by the ledger (S5). */
+  quota: "quota"
+};
+var REPLICA_LOGOUT_MARKER = "tinycloud-replica:logout-pending";
+var REPLICA_DENY_TOMBSTONE = "tinycloud-replica:deny-tombstone";
+var REPLICA_PENDING_LOCK_PREFIX = "tinycloud-replica-kv:pending:";
+
+// src/did.ts
+function principalOf(did) {
+  return did.split("#", 1)[0];
+}
+
+// src/kv-storage/sealed.ts
+import { bytesToHex } from "@noble/hashes/utils";
+var encoder2 = new TextEncoder();
+var NONCE_LENGTH = 12;
+var TAG_LENGTH = 16;
+function aad(context) {
+  return encoder2.encode(`tinycloud-replica-kv:v1\0${context}`);
+}
+async function seal(key, plaintext, context) {
+  const iv = crypto.getRandomValues(new Uint8Array(NONCE_LENGTH));
+  const bytes = new Uint8Array(await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv, additionalData: aad(context) },
+    key,
+    plaintext
+  ));
+  return { v: 1, iv, bytes };
+}
+async function openSealed(key, record, context) {
+  if (record === null || typeof record !== "object" || !("v" in record) || record.v !== 1 || !("iv" in record) || !(record.iv instanceof Uint8Array) || record.iv.length !== NONCE_LENGTH || !("bytes" in record) || !(record.bytes instanceof Uint8Array) || record.bytes.length < TAG_LENGTH) {
+    throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica record is unsealed or has an unknown ciphertext version.");
+  }
+  try {
+    return new Uint8Array(await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: record.iv, additionalData: aad(context) },
+      key,
+      record.bytes
+    ));
+  } catch (cause) {
+    throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica record failed authentication.", void 0, { cause });
+  }
+}
+function utf8Length(value) {
+  let bytes = 0;
+  for (let i = 0; i < value.length; i += 1) {
+    const code = value.charCodeAt(i);
+    if (code < 128) bytes += 1;
+    else if (code < 2048) bytes += 2;
+    else if (code >= 55296 && code <= 56319 && i + 1 < value.length && value.charCodeAt(i + 1) >= 56320 && value.charCodeAt(i + 1) <= 57343) {
+      bytes += 4;
+      i += 1;
+    } else bytes += 3;
+  }
+  return bytes;
+}
+function measureSealedRow(key, row) {
+  if (row.purged === true ? row.v !== void 0 || row.iv !== void 0 || row.bytes !== void 0 : row.v !== 1 || !(row.iv instanceof Uint8Array) || !(row.bytes instanceof Uint8Array)) {
+    throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has an invalid sealed envelope.");
+  }
+  const primaryKey = JSON.stringify(key);
+  if (typeof primaryKey !== "string") {
+    throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has an invalid primary key.");
+  }
+  let total = 2 + 4 + utf8Length(primaryKey);
+  let hasSize = false;
+  for (const name in row) {
+    if (!Object.hasOwn(row, name)) continue;
+    const value = Reflect.get(row, name);
+    total += 1 + name.length;
+    switch (name) {
+      case "pid":
+      case "hashId":
+        if (typeof value !== "string") throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has an invalid identifier.");
+        total += 4 + utf8Length(value);
+        break;
+      case "v":
+        if (value !== 1) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has an unknown version.");
+        total += 1;
+        break;
+      case "coverageCode":
+        if (value !== 0 && value !== 1 && value !== 2) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has invalid coverage.");
+        total += 1;
+        break;
+      case "purged":
+        if (typeof value !== "boolean") throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has invalid purge state.");
+        total += 1;
+        break;
+      case "revision":
+      case "generation":
+      case "syncedThroughEpoch":
+      case "keys":
+      case "contentMissing":
+      case "tombstones":
+      case "contentBytes":
+      case "size":
+        if (typeof value !== "number" || !Number.isFinite(value)) {
+          throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has an invalid numeric field.");
+        }
+        if (name === "size") hasSize = true;
+        total += 8;
+        break;
+      case "iv":
+      case "bytes":
+        if (!(value instanceof Uint8Array)) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has invalid ciphertext.");
+        total += 4 + value.byteLength;
+        break;
+      default:
+        throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica row has an unknown persisted field.");
+    }
+  }
+  if (!hasSize) total += 1 + "size".length + 8;
+  return total;
+}
+
+// src/kv-storage/schema.ts
+var KV_DATABASE = REPLICA_KV_DATABASE;
+var KV_DATABASE_VERSION = 2;
+var KV_STORE = REPLICA_KV_STORES;
+var FIRST_INSTALL_KEY_PREFIX = "firstInstall:";
+var ERASE_STORES = [KV_STORE.meta, KV_STORE.entries, KV_STORE.blobs, KV_STORE.pending];
+var READ_SCOPE = [KV_STORE.gate, KV_STORE.purgeIntents];
+var WRITE_SCOPE = [KV_STORE.gate, KV_STORE.partitions, KV_STORE.purgeIntents, KV_STORE.quota, KV_STORE.device];
+function createStores(db) {
+  db.createObjectStore(KV_STORE.meta);
+  const entries = db.createObjectStore(KV_STORE.entries);
+  entries.createIndex("byHash", ["pid", "hash"], { unique: false });
+  const blobs = db.createObjectStore(KV_STORE.blobs);
+  blobs.createIndex("bySize", ["pid", "size"], { unique: false });
+  const partitions = db.createObjectStore(KV_STORE.partitions);
+  partitions.createIndex("byLookupId", "lookupId", { unique: false });
+  for (const name of [KV_STORE.pending, KV_STORE.device, KV_STORE.gate, KV_STORE.purgeIntents, KV_STORE.quota]) {
+    db.createObjectStore(name);
+  }
+}
+function openKvDatabase(options) {
+  if (typeof indexedDB === "undefined") {
+    return Promise.reject(
+      new ReplicaError(
+        ReplicaErrorCode.RUNTIME_UNSUPPORTED,
+        "IndexedDB is unavailable (private browsing or a non-browser runtime); the replica cannot persist."
+      )
+    );
+  }
+  const { promise, resolve, reject } = Promise.withResolvers();
+  const request = options.create ? indexedDB.open(KV_DATABASE, KV_DATABASE_VERSION) : indexedDB.open(KV_DATABASE);
+  let refused = false;
+  request.onupgradeneeded = (event) => {
+    if (!options.create && event.oldVersion === 0) {
+      refused = true;
+      request.transaction?.abort();
+      return;
+    }
+    if (event.oldVersion > 0) {
+      for (const name of Array.from(request.result.objectStoreNames)) request.result.deleteObjectStore(name);
+    }
+    createStores(request.result);
+  };
+  request.onsuccess = () => {
+    const db = request.result;
+    if (db.version !== KV_DATABASE_VERSION) {
+      db.close();
+      resolve(null);
+      return;
+    }
+    db.onversionchange = () => db.close();
+    resolve(db);
+  };
+  request.onerror = (event) => {
+    if (refused) {
+      event.preventDefault();
+      resolve(null);
+      return;
+    }
+    reject(request.error ?? new DOMException(`Opening ${KV_DATABASE} failed`, "UnknownError"));
+  };
+  request.onblocked = () => reject(new ReplicaError(ReplicaErrorCode.BUSY, `Opening ${KV_DATABASE} is blocked by an older connection in another tab.`));
+  return promise;
+}
+function partitionIdOf(input, gateHmac) {
+  return gateHash(gateHmac, "partition", `${replicationIdentityKey(input.identity)}
+${input.prefix}
+${principalOf(input.deviceDid)}`);
+}
+function eraseSealedRows(tx, name, partitionId) {
+  const { promise, resolve, reject } = Promise.withResolvers();
+  const range = IDBKeyRange.bound([partitionId], [partitionId, []]);
+  const request = tx.objectStore(name).openCursor(range);
+  let removed = 0;
+  request.onsuccess = () => {
+    const cursor = request.result;
+    if (cursor === null) return resolve(removed);
+    try {
+      const row = cursor.value;
+      if (row === null || typeof row !== "object" || !("pid" in row) || row.pid !== partitionId || !("size" in row) || typeof row.size !== "number") {
+        throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The encrypted replica row has an invalid partition or byte measure.");
+      }
+      const measured2 = measureSealedRow(cursor.primaryKey, row);
+      if (row.size !== measured2 || !Number.isSafeInteger(removed + measured2)) {
+        throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The encrypted replica row has an invalid byte measure.");
+      }
+      removed += measured2;
+      cursor.delete();
+      cursor.continue();
+    } catch (error) {
+      reject(error);
+    }
+  };
+  request.onerror = () => reject(request.error);
+  return promise;
+}
+var kvPartitionEraser = {
+  async erasePartition(tx, partitionId) {
+    const meta = tx.objectStore(KV_STORE.meta);
+    const old = await requestAsPromise(meta.get(partitionId));
+    if (old !== void 0 && (old === null || typeof old !== "object" || !("pid" in old) || old.pid !== partitionId || !("revision" in old) || typeof old.revision !== "number" || !Number.isSafeInteger(old.revision) || old.revision < 0 || !("generation" in old) || typeof old.generation !== "number" || !Number.isSafeInteger(old.generation) || old.generation < 0 || !("size" in old) || typeof old.size !== "number" || old.size !== measureSealedRow(partitionId, old))) {
+      throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The encrypted replica metadata is invalid.");
+    }
+    const [entries, blobs] = await Promise.all([
+      eraseSealedRows(tx, KV_STORE.entries, partitionId),
+      eraseSealedRows(tx, KV_STORE.blobs, partitionId)
+    ]);
+    if (old === void 0) return { bytes: entries + blobs };
+    const current = old;
+    if (current.purged === true) {
+      if (entries !== 0 || blobs !== 0) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "An erased replica still owns ciphertext rows.");
+      return { bytes: 0 };
+    }
+    const tombstone = {
+      pid: partitionId,
+      revision: current.revision + 1,
+      generation: current.generation + 1,
+      coverageCode: 0,
+      syncedThroughEpoch: 0,
+      keys: 0,
+      contentMissing: 0,
+      tombstones: 0,
+      contentBytes: 0,
+      purged: true,
+      size: 0
+    };
+    tombstone.size = measureSealedRow(partitionId, tombstone);
+    const bytes = current.size + entries + blobs - tombstone.size;
+    if (!Number.isSafeInteger(bytes) || bytes < 0) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The erased replica has an invalid byte delta.");
+    meta.put(tombstone, partitionId);
+    return { bytes };
+  },
+  async eraseIdentityPending(tx, identityKeyHash) {
+    tx.objectStore(KV_STORE.pending).delete(identityKeyHash);
+  }
+};
+
+// src/kv-storage/ledger.ts
+var TOTAL = "total";
+var DEVICE_QUOTA_PARTITION_ID = "device";
+function partitionKey(partitionId) {
+  return `partition:${partitionId}`;
+}
+function measured(row) {
+  const bytes = row?.bytes ?? 0;
+  if (!Number.isSafeInteger(bytes) || bytes < 0) {
+    throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica quota ledger has invalid byte accounting.");
+  }
+  return bytes;
+}
+function checkedDelta(delta) {
+  if (!Number.isSafeInteger(delta)) {
+    throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica quota delta is not a safe integer.");
+  }
+  return delta;
+}
+function ledgerFor(quota) {
+  const maxBytes = quota?.maxBytes;
+  const minFreeBytes = quota?.minFreeBytes ?? DEFAULT_MIN_FREE_BYTES;
+  async function admit(tx, delta, freeBytes) {
+    if (delta <= 0) return;
+    const total = measured(await requestAsPromise(tx.objectStore(KV_STORE.quota).get(TOTAL)));
+    if (maxBytes !== void 0 && total + delta > maxBytes) {
+      throw new ReplicaError(ReplicaErrorCode.STORAGE_BUDGET, "The replica page exceeds the origin's byte budget.");
+    }
+    if (freeBytes !== null && freeBytes - delta < minFreeBytes) {
+      throw new ReplicaError(ReplicaErrorCode.STORAGE_BUDGET, "The replica page would cross the browser's free-space floor.");
+    }
+  }
+  const ledger = {
+    async freeBytes() {
+      if (typeof navigator === "undefined" || navigator.storage?.estimate === void 0) return null;
+      const { quota: capacity, usage } = await navigator.storage.estimate();
+      return typeof capacity === "number" && typeof usage === "number" && Number.isFinite(capacity) && Number.isFinite(usage) ? Math.max(0, capacity - usage) : null;
+    },
+    async admitPage(tx, page) {
+      await admit(tx, checkedDelta(page.deltaBytes), page.freeBytes);
+    },
+    async admitRows(tx, { partitionDeltaBytes, deviceDeltaBytes, freeBytes }) {
+      const delta = checkedDelta(checkedDelta(partitionDeltaBytes) + checkedDelta(deviceDeltaBytes));
+      await admit(tx, delta, freeBytes);
+    },
+    async accountCommit(tx, { partitionId, deltaBytes }) {
+      await ledger.accountRows(tx, { partitionId, partitionDeltaBytes: deltaBytes, deviceDeltaBytes: 0 });
+    },
+    async accountRows(tx, { partitionId, partitionDeltaBytes, deviceDeltaBytes }) {
+      const partitionDelta = checkedDelta(partitionDeltaBytes);
+      const deviceDelta = checkedDelta(deviceDeltaBytes);
+      if (partitionDelta === 0 && deviceDelta === 0) return;
+      if (partitionDelta !== 0 && partitionId === DEVICE_QUOTA_PARTITION_ID) {
+        throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The device quota bucket cannot contain partition rows.");
+      }
+      const combined = checkedDelta(partitionDelta + deviceDelta);
+      const store = tx.objectStore(KV_STORE.quota);
+      const totalRequest = combined === 0 ? void 0 : requestAsPromise(store.get(TOTAL));
+      const partitionRequest = partitionDelta === 0 ? void 0 : requestAsPromise(store.get(partitionKey(partitionId)));
+      const deviceRequest = deviceDelta === 0 ? void 0 : requestAsPromise(store.get(partitionKey(DEVICE_QUOTA_PARTITION_ID)));
+      const total = totalRequest === void 0 ? 0 : measured(await totalRequest) + combined;
+      const partition = partitionRequest === void 0 ? 0 : measured(await partitionRequest) + partitionDelta;
+      const device = deviceRequest === void 0 ? 0 : measured(await deviceRequest) + deviceDelta;
+      if (totalRequest !== void 0 && (!Number.isSafeInteger(total) || total < 0) || partitionRequest !== void 0 && (!Number.isSafeInteger(partition) || partition < 0) || deviceRequest !== void 0 && (!Number.isSafeInteger(device) || device < 0)) {
+        throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica quota ledger would become negative or imprecise.");
+      }
+      if (totalRequest !== void 0) store.put({ bytes: total }, TOTAL);
+      if (partitionRequest !== void 0) {
+        if (partition === 0) store.delete(partitionKey(partitionId));
+        else store.put({ bytes: partition }, partitionKey(partitionId));
+      }
+      if (deviceRequest !== void 0) {
+        if (device === 0) store.delete(partitionKey(DEVICE_QUOTA_PARTITION_ID));
+        else store.put({ bytes: device }, partitionKey(DEVICE_QUOTA_PARTITION_ID));
+      }
+    },
+    async accountErase(tx, { partitionId, bytes }) {
+      const removed = checkedDelta(bytes);
+      if (removed < 0) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica erase has negative bytes.");
+      const store = tx.objectStore(KV_STORE.quota);
+      const partition = await requestAsPromise(store.get(partitionKey(partitionId)));
+      if (partition === void 0) return;
+      const remaining = measured(partition) - removed;
+      if (remaining < 0) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica erase exceeds its accounted bytes.");
+      const total = measured(await requestAsPromise(store.get(TOTAL))) - removed;
+      if (total < 0) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica erase exceeds origin usage.");
+      store.put({ bytes: total }, TOTAL);
+      if (remaining === 0) store.delete(partitionKey(partitionId));
+      else store.put({ bytes: remaining }, partitionKey(partitionId));
+    }
+  };
+  return ledger;
+}
+
+// src/kv-storage/gateTx.ts
+var ACCOUNT = "account";
+var CONTROL = [KV_STORE.gate, KV_STORE.partitions, KV_STORE.purgeIntents, KV_STORE.quota, KV_STORE.device];
+function refusal(reason) {
+  return gatedError(reason, `The replica gate refused: ${reason}.`);
+}
+async function withDatabase(open, create, use) {
+  const db = await open(create);
+  if (db === null) return null;
+  try {
+    return await use(db);
+  } finally {
+    db.close();
+  }
+}
+function createIndexedDbGateTx(open, options) {
+  if (typeof options?.onConsentExpired !== "function") throw refusal("gate_unavailable");
+  const now = options.now ?? Date.now;
+  function checkedNow() {
+    const at = now();
+    if (!Number.isSafeInteger(at) || at < 0) throw refusal("gate_unavailable");
+    return at;
+  }
+  let expiryFlight;
+  async function snapshot() {
+    return withDatabase(open, false, async (db) => {
+      const tx = db.transaction([KV_STORE.gate, KV_STORE.device]);
+      const gate = await requestAsPromise(tx.objectStore(KV_STORE.gate).get(ACCOUNT));
+      if (gate === void 0 || gate.principalHash === null) return null;
+      if (typeof gate.consentDeadline !== "number" || !Number.isSafeInteger(gate.consentDeadline) || gate.consentDeadline < 0) throw refusal("gate_unavailable");
+      const hash = await requestAsPromise(tx.objectStore(KV_STORE.device).get(GATE_HMAC_KEY));
+      if (!validGateHmac(hash, gate)) throw refusal("gate_unavailable");
+      return { incarnation: gate.incarnation, salt: gate.salt, lifecycleEpoch: gate.lifecycleEpoch, keyId: hash.keyId, accountKeyId: gate.accountKeyId, gateHmac: hash.hmac };
+    });
+  }
+  async function expire(access) {
+    let flight;
+    try {
+      flight = expiryFlight ?? options.onConsentExpired();
+      expiryFlight = flight;
+      const outcome = await flight;
+      if (outcome.status !== "denied" && outcome.status !== "deleted" && outcome.status !== "stale") throw refusal("gate_unavailable");
+      const gate = await withDatabase(
+        open,
+        false,
+        (db) => requestAsPromise(db.transaction(KV_STORE.gate).objectStore(KV_STORE.gate).get(ACCOUNT))
+      );
+      if (gate !== null && (gate === void 0 || gate.incarnation === access.incarnation && (gate.lifecycleEpoch <= access.stamp.lifecycleEpoch || gate.principalHash !== null))) {
+        throw refusal("gate_unavailable");
+      }
+    } catch {
+      throw refusal("gate_unavailable");
+    } finally {
+      if (flight !== void 0 && expiryFlight === flight) expiryFlight = void 0;
+    }
+  }
+  async function runChecked(scope, access, fn) {
+    if (access === null || typeof access !== "object" || access.stamp === null || typeof access.stamp !== "object") {
+      throw refusal("not_established");
+    }
+    if (!("principalHash" in access) || typeof access.principalHash !== "string" || !("keyId" in access) || typeof access.keyId !== "string" || !("accountKeyId" in access) || typeof access.accountKeyId !== "string") throw refusal("gate_unavailable");
+    try {
+      const result = await withDatabase(open, false, async (db) => {
+        const tx = db.transaction([...scope.stores, ...CONTROL], scope.mode, { durability: "strict" });
+        const done = transactionDone(tx);
+        try {
+          const gate = await requestAsPromise(tx.objectStore(KV_STORE.gate).get(ACCOUNT));
+          if (gate === void 0) throw refusal("not_established");
+          if (gate.incarnation !== access.incarnation || gate.incarnation !== access.stamp.incarnation || gate.lifecycleEpoch !== access.stamp.lifecycleEpoch || gate.principalHash === null) throw refusal("stamp_stale");
+          if (gate.keyId !== access.keyId || gate.accountKeyId !== access.accountKeyId) throw refusal("stamp_stale");
+          if (gate.principalHash !== access.principalHash) throw refusal("principal_mismatch");
+          if (typeof gate.consentDeadline !== "number" || !Number.isSafeInteger(gate.consentDeadline) || gate.consentDeadline < 0) throw refusal("gate_unavailable");
+          const device = tx.objectStore(KV_STORE.device);
+          const hash = await requestAsPromise(device.get(GATE_HMAC_KEY));
+          const account = await requestAsPromise(device.get(ACCOUNT_KEY));
+          if (!validGateHmac(hash, gate) || !validAccountKey(account, gate)) throw refusal("gate_unavailable");
+          const intents = tx.objectStore(KV_STORE.purgeIntents);
+          if (access.partitionId !== void 0 && await requestAsPromise(intents.count(access.partitionId)) > 0) throw refusal("purge_pending");
+          if (access.identityKeyHash !== void 0 && await requestAsPromise(intents.count(`pending:${access.identityKeyHash}`)) > 0) throw refusal("purge_pending");
+          if (checkedNow() >= gate.consentDeadline) throw new ReplicaError(ReplicaErrorCode.CONSENT_EXPIRED, "The account consent has expired.");
+          const value = await fn(tx, account);
+          await done;
+          return { value };
+        } catch (error) {
+          try {
+            tx.abort();
+          } catch {
+          }
+          await done.catch(() => void 0);
+          throw error;
+        }
+      });
+      if (result === null) throw refusal("gate_unavailable");
+      return result.value;
+    } catch (error) {
+      if (error !== null && typeof error === "object" && "code" in error && error.code === ReplicaErrorCode.CONSENT_EXPIRED) {
+        await expire(access);
+      }
+      throw error;
+    }
+  }
+  return {
+    snapshot,
+    run: (scope, access, fn) => runChecked(scope, access, (tx) => fn(tx)),
+    readAccountKey: (access) => runChecked({ stores: [KV_STORE.device], mode: "readonly" }, access, async (_tx, account) => account),
+    async indexPartition(tx, entry) {
+      tx.objectStore(KV_STORE.partitions).put(entry, entry.partitionId);
+    },
+    async unindexPartition(tx, partitionId) {
+      tx.objectStore(KV_STORE.partitions).delete(partitionId);
+    },
+    async clearIntent(tx, id) {
+      tx.objectStore(KV_STORE.purgeIntents).delete(id);
+    }
+  };
+}
+
+// src/kv-storage/lifecycle.ts
+var ACCOUNT2 = "account";
+var DEVICE_KEY = "device";
+var GRANT_INSTALL_KEY_PREFIX = "grantInstall:";
+var GATE_LOCK = "tinycloud-replica-kv:gate";
+var DELETE_BLOCKED = "DELETE_BLOCKED";
+var denyFaults = {};
+function takeFault(point) {
+  const fault = denyFaults[point];
+  if (fault === void 0) return false;
+  if (fault.once) delete denyFaults[point];
+  return true;
+}
+function billedDeviceBytes(row) {
+  if (row === void 0 || typeof row === "number" && Number.isSafeInteger(row) && row >= 0) return 0;
+  if (row !== null && typeof row === "object" && "size" in row && typeof row.size === "number" && Number.isSafeInteger(row.size) && row.size >= 0) {
+    return row.size;
+  }
+  throw gatedError("gate_unavailable", "A device quota row has no valid encoded size.");
+}
+function openKvStore(create) {
+  return openKvDatabase({ create });
+}
+async function readLegacyGateFloor() {
+  const { promise, resolve, reject } = Promise.withResolvers();
+  const request = indexedDB.open(KV_DATABASE);
+  let absent = false;
+  request.onupgradeneeded = () => {
+    absent = true;
+    request.transaction?.abort();
+  };
+  request.onsuccess = async () => {
+    const db = request.result;
+    try {
+      if (db.version !== 1) return resolve(null);
+      if (!db.objectStoreNames.contains(KV_STORE.gate)) return resolve({ epoch: 0, deniedAt: null });
+      const value = await requestAsPromise(db.transaction(KV_STORE.gate).objectStore(KV_STORE.gate).get(ACCOUNT2));
+      if (value === void 0) return resolve({ epoch: 0, deniedAt: null });
+      if (value === null || typeof value !== "object" || !("lifecycleEpoch" in value) || !("deniedAt" in value) || typeof value.lifecycleEpoch !== "number" || !Number.isSafeInteger(value.lifecycleEpoch) || value.lifecycleEpoch < 0 || value.deniedAt !== null && (typeof value.deniedAt !== "number" || !Number.isSafeInteger(value.deniedAt) || value.deniedAt < 0) || value.lifecycleEpoch === 0 !== (value.deniedAt === null)) {
+        throw gatedError("gate_unavailable", "The legacy gate deny floor is invalid.");
+      }
+      resolve({ epoch: value.lifecycleEpoch, deniedAt: value.deniedAt });
+    } catch (error) {
+      reject(error);
+    } finally {
+      db.close();
+    }
+  };
+  request.onerror = (event) => {
+    if (absent) {
+      event.preventDefault();
+      resolve(null);
+    } else {
+      reject(gatedError("gate_unavailable", "The legacy gate deny floor cannot be read."));
+    }
+  };
+  request.onblocked = () => reject(gatedError("gate_unavailable", "The legacy gate read is blocked."));
+  return promise;
+}
+function preserveLegacyFloor(legacy, tombstone) {
+  if (legacy?.deniedAt === null || legacy === null) return { tombstone, advanced: false };
+  const floor = {
+    epoch: Math.max(legacy.epoch, tombstone?.epoch ?? 0),
+    deniedAt: Math.max(legacy.deniedAt, tombstone?.deniedAt ?? 0)
+  };
+  if (tombstone !== null && tombstone.epoch >= floor.epoch && tombstone.deniedAt >= floor.deniedAt) {
+    return { tombstone, advanced: false };
+  }
+  writeTombstone(floor);
+  return { tombstone: floor, advanced: true };
+}
+function codeOf(error) {
+  if (error !== null && typeof error === "object" && "code" in error && error.code === "REPLICA_GATED" && "gate" in error && typeof error.gate === "string") return error.gate;
+  return error !== null && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : "STORAGE_ERROR";
+}
+function logoutMarkerSet() {
+  try {
+    return localStorage.getItem(REPLICA_LOGOUT_MARKER) !== null;
+  } catch {
+    return true;
+  }
+}
+function readTombstone() {
+  try {
+    const stored = localStorage.getItem(REPLICA_DENY_TOMBSTONE);
+    if (stored === null) return null;
+    const value = JSON.parse(stored);
+    if (value === null || typeof value !== "object" || !("epoch" in value) || typeof value.epoch !== "number" || !Number.isSafeInteger(value.epoch) || value.epoch < 1 || !("deniedAt" in value) || typeof value.deniedAt !== "number" || !Number.isSafeInteger(value.deniedAt) || value.deniedAt < 0 || Object.keys(value).length !== 2) throw new Error("Invalid deny tombstone.");
+    return value;
+  } catch {
+    throw gatedError("gate_unavailable", "The origin deny tombstone cannot be read.");
+  }
+}
+function writeTombstone(value) {
+  try {
+    const serialized = JSON.stringify(value);
+    localStorage.setItem(REPLICA_DENY_TOMBSTONE, serialized);
+    if (localStorage.getItem(REPLICA_DENY_TOMBSTONE) !== serialized) throw new Error("The deny tombstone was not persisted.");
+  } catch {
+    throw gatedError("gate_unavailable", "The origin deny tombstone cannot be written.");
+  }
+}
+function assertTombstoneWritable() {
+  try {
+    const stored = localStorage.getItem(REPLICA_DENY_TOMBSTONE);
+    if (stored === null) {
+      const probe = `${REPLICA_DENY_TOMBSTONE}:probe`;
+      localStorage.setItem(probe, "1");
+      if (localStorage.getItem(probe) !== "1") throw new Error("The deny tombstone probe was not persisted.");
+      localStorage.removeItem(probe);
+    } else {
+      localStorage.setItem(REPLICA_DENY_TOMBSTONE, stored);
+      if (localStorage.getItem(REPLICA_DENY_TOMBSTONE) !== stored) throw new Error("The deny tombstone was not persisted.");
+    }
+  } catch {
+    throw gatedError("gate_unavailable", "The origin deny tombstone cannot be written.");
+  }
+}
+function denyFloor(gate, tombstone) {
+  if (gate !== void 0 && tombstone === null && (gate.lifecycleEpoch > 0 || gate.deniedAt !== null)) {
+    throw gatedError("gate_unavailable", "A denied gate has no origin deny tombstone.");
+  }
+  if (gate !== void 0 && tombstone !== null && gate.lifecycleEpoch < tombstone.epoch) {
+    throw gatedError("gate_unavailable", "The gate is behind the origin deny tombstone.");
+  }
+  return {
+    epoch: Math.max(gate?.lifecycleEpoch ?? 0, tombstone?.epoch ?? 0),
+    deniedAt: gate?.deniedAt === null || gate?.deniedAt === void 0 ? tombstone?.deniedAt ?? null : Math.max(gate.deniedAt, tombstone?.deniedAt ?? 0)
+  };
+}
+function exclusive(name, section, signal) {
+  if (typeof navigator === "undefined" || typeof navigator.locks?.request !== "function") {
+    return Promise.reject(gatedError("gate_unavailable", "The origin Web Lock is unavailable."));
+  }
+  return signal === void 0 ? navigator.locks.request(name, section) : navigator.locks.request(name, { signal }, section);
+}
+function deleteKvDatabase() {
+  const { promise, resolve } = Promise.withResolvers();
+  if (takeFault("delete_database")) {
+    resolve({ status: "failed", code: "STORAGE_ERROR" });
+    return promise;
+  }
+  const request = indexedDB.deleteDatabase(KV_DATABASE);
+  request.onsuccess = () => resolve({ status: "deleted" });
+  request.onerror = () => resolve({ status: "failed", code: "STORAGE_ERROR" });
+  request.onblocked = () => resolve({ status: "failed", code: DELETE_BLOCKED });
+  return promise;
+}
+function setLogoutMarker() {
+  try {
+    const marker = String(Date.now());
+    localStorage.setItem(REPLICA_LOGOUT_MARKER, marker);
+    return localStorage.getItem(REPLICA_LOGOUT_MARKER) === marker;
+  } catch {
+    return false;
+  }
+}
+async function transact(db, stores, mode, use) {
+  const tx = db.transaction(stores, mode, { durability: "strict" });
+  const done = transactionDone(tx);
+  let value;
+  try {
+    value = await use(tx);
+  } catch (error) {
+    try {
+      tx.abort();
+    } catch {
+    }
+    await done.catch(() => void 0);
+    throw error;
+  }
+  await done;
+  return value;
+}
+function createIndexedDbLifecycle(options = {}) {
+  const eraser = options.eraser ?? kvPartitionEraser;
+  const ledger = options.ledger;
+  const now = options.now ?? Date.now;
+  function checkedNow() {
+    const at = now();
+    if (!Number.isSafeInteger(at) || at < 0) throw gatedError("gate_unavailable", "The replica clock is unavailable.");
+    return at;
+  }
+  function deadlineOf(gate) {
+    const deadline = gate.consentDeadline;
+    if (typeof deadline !== "number" || !Number.isSafeInteger(deadline) || deadline < 0) {
+      throw gatedError("gate_unavailable", "The account gate has no valid consent deadline.");
+    }
+    return deadline;
+  }
+  const gateTx = createIndexedDbGateTx(openKvStore, { now, onConsentExpired: expireConsent });
+  let view;
+  let expiryTimer;
+  const expiryObservers = /* @__PURE__ */ new Set();
+  function adopt(gate, principal) {
+    const stamp = { incarnation: gate.incarnation, lifecycleEpoch: gate.lifecycleEpoch };
+    view = { ...stamp, consentDeadline: deadlineOf(gate), principal: principal.toLowerCase() };
+    clearTimeout(expiryTimer);
+    armExpiryTimer();
+    return stamp;
+  }
+  function armExpiryTimer() {
+    if (view === void 0) return;
+    const delay = Math.max(0, Math.min(view.consentDeadline - checkedNow(), 2147483647));
+    expiryTimer = setTimeout(() => {
+      expiryTimer = void 0;
+      if (view === void 0) return;
+      try {
+        if (checkedNow() < view.consentDeadline) armExpiryTimer();
+        else void expireConsent();
+      } catch {
+        view = void 0;
+      }
+    }, delay);
+  }
+  async function readGate() {
+    const found = await withDatabase(
+      openKvStore,
+      false,
+      (db) => requestAsPromise(db.transaction(KV_STORE.gate).objectStore(KV_STORE.gate).get(ACCOUNT2))
+    );
+    return found ?? void 0;
+  }
+  async function activeKeys(gate) {
+    const records = await withDatabase(openKvStore, false, async (db) => {
+      const device = db.transaction(KV_STORE.device).objectStore(KV_STORE.device);
+      const hash = await requestAsPromise(device.get(GATE_HMAC_KEY));
+      const account = await requestAsPromise(device.get(ACCOUNT_KEY));
+      return { hash, account };
+    });
+    if (records === null || !validGateHmac(records.hash, gate) || !validAccountKey(records.account, gate)) {
+      throw gatedError("gate_unavailable", "The account gate encryption keys are missing or mismatched.");
+    }
+    return { hash: records.hash, account: records.account };
+  }
+  async function readIntents() {
+    const found = await withDatabase(
+      openKvStore,
+      false,
+      (db) => requestAsPromise(db.transaction(KV_STORE.purgeIntents).objectStore(KV_STORE.purgeIntents).getAll())
+    );
+    return found ?? [];
+  }
+  async function writeGate(gate, previous, keys) {
+    const db = await openKvStore(true);
+    if (db === null) throw gatedError("gate_unavailable", "The origin database could not be created.");
+    try {
+      await transact(db, [KV_STORE.gate, KV_STORE.device], "readwrite", async (tx) => {
+        const current = await requestAsPromise(tx.objectStore(KV_STORE.gate).get(ACCOUNT2));
+        if (current?.incarnation !== previous?.incarnation || current?.lifecycleEpoch !== previous?.lifecycleEpoch || current?.principalHash !== previous?.principalHash) {
+          throw gatedError("stamp_stale", "The origin gate changed during establishment.");
+        }
+        const device = tx.objectStore(KV_STORE.device);
+        device.put(keys.hash, GATE_HMAC_KEY);
+        device.put(keys.account, ACCOUNT_KEY);
+        tx.objectStore(KV_STORE.gate).put(gate, ACCOUNT2);
+      });
+    } finally {
+      db.close();
+    }
+  }
+  async function establishSessionStamp(principal, o) {
+    return exclusive(GATE_LOCK, async () => {
+      const tombstone = readTombstone();
+      if (logoutMarkerSet()) throw gatedError("logout_pending", "A logout is still pending on this origin.");
+      const anchor = o.consentAnchor;
+      if (anchor === void 0 || anchor.source !== "siwe" && anchor.source !== "delegation_iat" && anchor.source !== "delegation_nbf" || !Number.isSafeInteger(anchor.at) || anchor.at < 0) {
+        throw gatedError("not_established", "A verified finite consent anchor is required.");
+      }
+      const issuedAt = Math.min(anchor.at, checkedNow());
+      if ((await readIntents()).length > 0) throw gatedError("purge_pending", "A purge is still pending on this origin.");
+      const current = await readGate();
+      const legacy = current === void 0 ? await readLegacyGateFloor() : null;
+      const preserved = preserveLegacyFloor(legacy, tombstone);
+      const floor = denyFloor(current, preserved.tombstone);
+      if (preserved.advanced) throw gatedError("stamp_stale", "The legacy deny floor was preserved; a new consent proof is required.");
+      if (floor.deniedAt !== null && issuedAt <= floor.deniedAt) {
+        throw gatedError("stamp_stale", "This sign-in predates the last sign-out.");
+      }
+      assertTombstoneWritable();
+      if (current === void 0 || current.principalHash === null) {
+        const incarnation = crypto.randomUUID();
+        const hash = await newGateHmac(incarnation);
+        const principalHash2 = await gateHash(hash.hmac, "principal", principal.toLowerCase());
+        const account = await newAccountKey(incarnation, floor.epoch, principalHash2);
+        const created = {
+          incarnation,
+          salt: crypto.randomUUID(),
+          principalHash: principalHash2,
+          lifecycleEpoch: floor.epoch,
+          deniedAt: floor.deniedAt,
+          keyId: hash.keyId,
+          accountKeyId: account.keyId,
+          consentDeadline: issuedAt + CONSENT_WINDOW_MS2
+        };
+        if (!Number.isSafeInteger(created.consentDeadline)) throw gatedError("not_established", "The consent deadline is invalid.");
+        await writeGate(created, current, { hash, account });
+        return adopt(created, principal);
+      }
+      const keys = await activeKeys(current);
+      const principalHash = await gateHash(keys.hash.hmac, "principal", principal.toLowerCase());
+      if (current.principalHash !== principalHash) throw gatedError("principal_mismatch", "The origin is bound to another account.");
+      if (checkedNow() >= deadlineOf(current)) {
+        await expireConsentLocked();
+        throw new ReplicaError(ReplicaErrorCode.CONSENT_EXPIRED, "The account consent has expired.");
+      }
+      return adopt(current, principal);
+    });
+  }
+  async function restoreSessionStamp(principal, persisted) {
+    const gate = await readGate();
+    denyFloor(gate, readTombstone());
+    if (gate === void 0 || persisted === void 0) throw gatedError("not_established", "No session stamp is established for this origin.");
+    if (typeof persisted !== "object" || persisted === null || Array.isArray(persisted) || Object.keys(persisted).length !== 2 || !Object.prototype.hasOwnProperty.call(persisted, "incarnation") || !Object.prototype.hasOwnProperty.call(persisted, "lifecycleEpoch") || typeof persisted.incarnation !== "string" || persisted.incarnation.length === 0 || !Number.isSafeInteger(persisted.lifecycleEpoch) || persisted.lifecycleEpoch < 0) {
+      throw gatedError("stamp_stale", "The persisted replica stamp is malformed.");
+    }
+    if (persisted.incarnation !== gate.incarnation || persisted.lifecycleEpoch !== gate.lifecycleEpoch) {
+      throw gatedError("stamp_stale", "The persisted session stamp is stale.");
+    }
+    if (gate.principalHash === null) throw gatedError("principal_mismatch", "The origin has no active account.");
+    const keys = await activeKeys(gate);
+    const hash = await gateHash(keys.hash.hmac, "principal", principal.toLowerCase());
+    if (hash !== gate.principalHash) throw gatedError("principal_mismatch", "The origin is bound to another account.");
+    if (logoutMarkerSet()) throw gatedError("logout_pending", "A logout is still pending on this origin.");
+    if ((await readIntents()).length > 0) throw gatedError("purge_pending", "A purge is still pending on this origin.");
+    assertTombstoneWritable();
+    if (checkedNow() >= deadlineOf(gate)) {
+      await expireConsent();
+      throw new ReplicaError(ReplicaErrorCode.CONSENT_EXPIRED, "The account consent has expired.");
+    }
+    return adopt(gate, principal);
+  }
+  async function activationAllowed(next) {
+    try {
+      if (logoutMarkerSet()) return false;
+      const gate = await readGate();
+      denyFloor(gate, readTombstone());
+      if (gate === void 0 || gate.principalHash === null) return false;
+      if (checkedNow() >= deadlineOf(gate)) {
+        await expireConsent();
+        return false;
+      }
+      const keys = await activeKeys(gate);
+      const hash = await gateHash(keys.hash.hmac, "principal", next.toLowerCase());
+      if (hash !== gate.principalHash) return false;
+      return (await readIntents()).every((intent) => intent.principalHash === hash);
+    } catch {
+      return false;
+    }
+  }
+  function checkDelivery(stamp) {
+    if (stamp === void 0) return { status: "gated", gate: "not_established" };
+    if (view === void 0) return { status: "gated", gate: "stamp_stale" };
+    if (view.incarnation !== stamp.incarnation || view.lifecycleEpoch !== stamp.lifecycleEpoch) {
+      return { status: "gated", gate: "stamp_stale" };
+    }
+    try {
+      const tombstone = readTombstone();
+      if (logoutMarkerSet()) return { status: "gated", gate: "logout_pending" };
+      if (tombstone === null && stamp.lifecycleEpoch !== 0) return { status: "gated", gate: "gate_unavailable" };
+      if (tombstone !== null && stamp.lifecycleEpoch < tombstone.epoch) return { status: "gated", gate: "stamp_stale" };
+      if (checkedNow() >= view.consentDeadline) return { status: "consent_expired", code: "CONSENT_EXPIRED" };
+      return { status: "allow" };
+    } catch {
+      return { status: "gated", gate: "gate_unavailable" };
+    }
+  }
+  function consentDeadline(stamp) {
+    return view !== void 0 && checkDelivery(stamp).status === "allow" ? view.consentDeadline : null;
+  }
+  function deliverable(stamp) {
+    return checkDelivery(stamp).status === "allow";
+  }
+  async function commitDeny(plan) {
+    if (takeFault("deny_tx")) throw new Error("injected deny_tx failure");
+    const db = await openKvStore(false);
+    if (db === null) return { status: "stale" };
+    try {
+      return await transact(
+        db,
+        [KV_STORE.gate, KV_STORE.partitions, KV_STORE.purgeIntents, KV_STORE.device, KV_STORE.pending, KV_STORE.quota],
+        "readwrite",
+        async (tx) => {
+          const current = await requestAsPromise(tx.objectStore(KV_STORE.gate).get(ACCOUNT2));
+          if (current === void 0 || current.incarnation !== plan.gate.incarnation || current.principalHash !== plan.callerHash || current.lifecycleEpoch !== plan.gate.lifecycleEpoch || current.keyId !== plan.gate.keyId || current.accountKeyId !== plan.gate.accountKeyId) {
+            return { status: "stale" };
+          }
+          const now2 = plan.tombstone.deniedAt;
+          const partitions = await requestAsPromise(tx.objectStore(KV_STORE.partitions).getAll());
+          const pendingKeys = await requestAsPromise(tx.objectStore(KV_STORE.pending).getAllKeys());
+          const intents = [];
+          const identities = /* @__PURE__ */ new Set();
+          for (const entry of partitions) {
+            if (entry.principalHash !== plan.callerHash) continue;
+            intents.push({ id: entry.partitionId, kind: "partition", partitionId: entry.partitionId, principalHash: plan.callerHash, recordedAt: now2 });
+            identities.add(entry.identityKeyHash);
+          }
+          for (const key of pendingKeys) {
+            if (typeof key === "string") identities.add(key);
+          }
+          for (const identityKeyHash of identities) {
+            intents.push({ id: `pending:${identityKeyHash}`, kind: "pending", identityKeyHash, principalHash: plan.callerHash, recordedAt: now2 });
+          }
+          const purge = tx.objectStore(KV_STORE.purgeIntents);
+          for (const intent of intents) purge.put(intent, intent.id);
+          const device = tx.objectStore(KV_STORE.device);
+          let deviceBytes = billedDeviceBytes(await requestAsPromise(device.get(DEVICE_KEY)));
+          device.delete(DEVICE_KEY);
+          device.delete(ACCOUNT_KEY);
+          device.delete(GATE_HMAC_KEY);
+          for (const prefix of [FIRST_INSTALL_KEY_PREFIX, GRANT_INSTALL_KEY_PREFIX]) {
+            const keys = await requestAsPromise(device.getAllKeys(IDBKeyRange.bound(prefix, `${prefix}\uFFFF`)));
+            for (const key of keys) {
+              deviceBytes += billedDeviceBytes(await requestAsPromise(device.get(key)));
+              if (!Number.isSafeInteger(deviceBytes)) throw gatedError("gate_unavailable", "Device quota bytes overflow.");
+              device.delete(key);
+            }
+          }
+          await ledger?.accountErase(tx, { partitionId: "device", bytes: deviceBytes });
+          const next = {
+            ...current,
+            principalHash: null,
+            consentDeadline: null,
+            lifecycleEpoch: plan.tombstone.epoch,
+            deniedAt: plan.tombstone.deniedAt
+          };
+          tx.objectStore(KV_STORE.gate).put(next, ACCOUNT2);
+          return { status: "denied", lifecycleEpoch: next.lifecycleEpoch, intents: intents.length };
+        }
+      );
+    } finally {
+      db.close();
+    }
+  }
+  async function wipe() {
+    const deleted = await deleteKvDatabase();
+    if (deleted.status === "deleted") return { status: "deleted" };
+    return setLogoutMarker() ? { status: "marker", code: deleted.code } : { status: "unguarded", code: deleted.code };
+  }
+  async function advanceDeny(gate, floor) {
+    const callerHash = gate.principalHash;
+    if (callerHash === null) return { status: "stale" };
+    const tombstone = { epoch: floor.epoch + 1, deniedAt: Math.max(checkedNow(), (floor.deniedAt ?? -1) + 1) };
+    if (!Number.isSafeInteger(tombstone.epoch) || !Number.isSafeInteger(tombstone.deniedAt)) {
+      throw gatedError("gate_unavailable", "The origin deny tombstone cannot advance.");
+    }
+    writeTombstone(tombstone);
+    try {
+      return await commitDeny({ gate, callerHash, tombstone });
+    } catch {
+      return wipe();
+    }
+  }
+  async function denyLocked(input) {
+    const gate = await readGate();
+    const floor = denyFloor(gate, readTombstone());
+    if (gate === void 0 || gate.principalHash === null) return { status: "stale" };
+    const keys = await activeKeys(gate);
+    const callerHash = await gateHash(keys.hash.hmac, "principal", input.principal.toLowerCase());
+    if (callerHash !== gate.principalHash) return { status: "stale" };
+    if (input.reason === "account_switch" && input.next === void 0) {
+      throw new Error("account_switch requires the next principal");
+    }
+    return advanceDeny(gate, floor);
+  }
+  async function expireConsentLocked() {
+    const gate = await readGate();
+    const floor = denyFloor(gate, readTombstone());
+    if (gate === void 0 || gate.principalHash === null) return { status: "stale" };
+    if (checkedNow() < deadlineOf(gate)) return { status: "stale" };
+    const stamp = { incarnation: gate.incarnation, lifecycleEpoch: gate.lifecycleEpoch };
+    view = void 0;
+    clearTimeout(expiryTimer);
+    const result = await advanceDeny(gate, floor);
+    if (result.status === "denied" || result.status === "deleted") {
+      try {
+        options.onConsentExpired?.(stamp);
+      } catch {
+      }
+      for (const observer of expiryObservers) {
+        try {
+          observer(stamp);
+        } catch {
+        }
+      }
+    }
+    return result;
+  }
+  async function expireConsent() {
+    try {
+      return await exclusive(GATE_LOCK, expireConsentLocked);
+    } catch (error) {
+      return { status: "unguarded", code: codeOf(error) };
+    }
+  }
+  async function deny(input) {
+    if (view?.principal === input.principal.toLowerCase()) {
+      view = void 0;
+      clearTimeout(expiryTimer);
+    }
+    try {
+      return await exclusive(GATE_LOCK, () => denyLocked(input));
+    } catch (error) {
+      return { status: "unguarded", code: codeOf(error) };
+    }
+  }
+  async function eraseIntent(intent) {
+    const db = await openKvStore(false);
+    if (db === null) return;
+    try {
+      await transact(db, [...ERASE_STORES, KV_STORE.partitions, KV_STORE.purgeIntents, KV_STORE.quota], "readwrite", async (tx) => {
+        if (intent.kind === "partition") {
+          const { bytes } = await eraser.erasePartition(tx, intent.partitionId);
+          await gateTx.unindexPartition(tx, intent.partitionId);
+          await ledger?.accountErase(tx, { partitionId: intent.partitionId, bytes });
+        } else {
+          await eraser.eraseIdentityPending(tx, intent.identityKeyHash);
+        }
+        await gateTx.clearIntent(tx, intent.id);
+      });
+    } finally {
+      db.close();
+    }
+  }
+  async function erasePendingLocked({ signal }) {
+    const erased = [];
+    const failed = [];
+    for (const intent of await readIntents()) {
+      if (signal.aborted) break;
+      try {
+        await eraseIntent(intent);
+        erased.push(intent.id);
+      } catch (error) {
+        failed.push({ id: intent.id, code: codeOf(error) });
+      }
+    }
+    return { erased, failed, remaining: (await readIntents()).length };
+  }
+  function erasePending(o) {
+    return exclusive(GATE_LOCK, () => erasePendingLocked(o));
+  }
+  async function recover({ signal }) {
+    try {
+      return await exclusive(GATE_LOCK, async () => {
+        const failed = [];
+        if (logoutMarkerSet()) {
+          if (readTombstone() === null) throw gatedError("gate_unavailable", "The pending logout has no deny tombstone.");
+          const deleted = await deleteKvDatabase();
+          if (deleted.status === "deleted") {
+            try {
+              localStorage.removeItem(REPLICA_LOGOUT_MARKER);
+              if (localStorage.getItem(REPLICA_LOGOUT_MARKER) !== null) throw new Error("The logout marker was not cleared.");
+            } catch {
+              failed.push({ id: "marker", code: "STORAGE_ERROR" });
+            }
+          } else {
+            failed.push({ id: "database", code: deleted.code });
+          }
+        }
+        if (failed.length > 0) return { erased: [], failed, remaining: 1 };
+        const gate = await readGate();
+        const tombstone = readTombstone();
+        if (gate !== void 0 && tombstone !== null && gate.lifecycleEpoch < tombstone.epoch) {
+          const wiped = await wipe();
+          if (wiped.status !== "deleted") {
+            return { erased: [], failed: [{ id: "database", code: wiped.code }], remaining: 1 };
+          }
+        }
+        const legacy = await readLegacyGateFloor();
+        if (legacy !== null) {
+          const tombstone2 = readTombstone();
+          preserveLegacyFloor(legacy, tombstone2);
+          assertTombstoneWritable();
+          const db = await openKvStore(true);
+          if (db === null) throw gatedError("gate_unavailable", "The legacy origin could not be migrated.");
+          db.close();
+        }
+        const expiry = await expireConsentLocked();
+        if (expiry.status === "marker" || expiry.status === "unguarded") {
+          return { erased: [], failed: [{ id: "expiry", code: expiry.code }], remaining: 1 };
+        }
+        const pass = await erasePendingLocked({ signal });
+        return { erased: pass.erased, failed: [...failed, ...pass.failed], remaining: pass.remaining, consentExpired: expiry.status === "denied" || expiry.status === "deleted" };
+      }, signal);
+    } catch (error) {
+      return { erased: [], failed: [{ id: "recover", code: codeOf(error) }], remaining: 1 };
+    }
+  }
+  function subscribeConsentExpired(listener) {
+    expiryObservers.add(listener);
+    return () => {
+      expiryObservers.delete(listener);
+    };
+  }
+  return {
+    kind: "indexeddb",
+    recover,
+    expireConsent,
+    checkDelivery,
+    consentDeadline,
+    subscribeConsentExpired,
+    establishSessionStamp,
+    restoreSessionStamp,
+    activationAllowed,
+    deliverable,
+    deny,
+    erasePending,
+    pendingPurge: readIntents
+  };
+}
+
+// src/kv-storage/codec.ts
+import { bytesToHex as bytesToHex2, hexToBytes } from "@noble/hashes/utils";
+var encoder3 = new TextEncoder();
+var decoder2 = new TextDecoder("utf-8", { fatal: true });
+function encodeValue(value) {
+  if (value === void 0) return ["undefined"];
+  if (value instanceof Uint8Array) return ["bytes", bytesToHex2(value)];
+  if (Array.isArray(value)) return ["array", value.map(encodeValue)];
+  if (value !== null && typeof value === "object") {
+    return ["object", Object.entries(value).map(([key, item]) => [key, encodeValue(item)])];
+  }
+  if (typeof value === "number" && !Number.isFinite(value)) {
+    throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "A replica record contains a non-finite number.");
+  }
+  if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value;
+  throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "A replica record contains an unsupported value.");
+}
+function decodeValue(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return value;
+  if (!Array.isArray(value) || typeof value[0] !== "string") throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica record has an invalid payload variant.");
+  if (value[0] === "undefined" && value.length === 1) return void 0;
+  if (value[0] === "bytes" && value.length === 2 && typeof value[1] === "string" && /^(?:[0-9a-f]{2})*$/.test(value[1])) return hexToBytes(value[1]);
+  if (value[0] === "array" && value.length === 2 && Array.isArray(value[1])) return value[1].map(decodeValue);
+  if (value[0] === "object" && value.length === 2 && Array.isArray(value[1])) {
+    const seen = /* @__PURE__ */ new Set();
+    const fields = [];
+    for (const pair of value[1]) {
+      if (!Array.isArray(pair) || pair.length !== 2 || typeof pair[0] !== "string" || seen.has(pair[0])) {
+        throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica record has an invalid object field.");
+      }
+      seen.add(pair[0]);
+      fields.push([pair[0], decodeValue(pair[1])]);
+    }
+    return Object.fromEntries(fields);
+  }
+  throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica record has an invalid payload variant.");
+}
+function encodeJson(value) {
+  return encoder3.encode(JSON.stringify(["tinycloud-replica-kv", 1, encodeValue(value)]));
+}
+function decodeJson(bytes) {
+  try {
+    const value = JSON.parse(decoder2.decode(bytes));
+    if (!Array.isArray(value) || value.length !== 3 || value[0] !== "tinycloud-replica-kv" || value[1] !== 1) {
+      throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica record has an unknown payload version.");
+    }
+    return decodeValue(value[2]);
+  } catch (cause) {
+    if (cause instanceof ReplicaError) throw cause;
+    throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica record payload is corrupt.", void 0, { cause });
+  }
+}
+
+// src/kv-storage/pending.ts
+function corrupt(message) {
+  return new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, message);
+}
+var IndexedDbPendingWriteStore = class {
+  durable = true;
+  identity;
+  #identityKey;
+  #gateTx;
+  #stamp;
+  #locks;
+  constructor(identity, options = {}) {
+    this.identity = canonicalReplicationIdentity(identity);
+    this.#identityKey = replicationIdentityKey(this.identity);
+    this.#gateTx = options.gateTx;
+    this.#stamp = options.stamp;
+    this.#locks = options.locks ?? (typeof navigator === "undefined" ? void 0 : navigator.locks);
+  }
+  #empty() {
+    return { v: 2, identity: this.identity, committedEpoch: 0, seq: 0, records: [] };
+  }
+  /** Validate a stored record: the v2 shape, and this store's identity (never another's). */
+  #parse(value) {
+    if (value === null || typeof value !== "object" || !("v" in value) || value.v !== 2 || !("identity" in value) || !("committedEpoch" in value) || typeof value.committedEpoch !== "number" || !("seq" in value) || typeof value.seq !== "number" || !("records" in value) || !Array.isArray(value.records)) {
+      throw corrupt("The pending-write state is corrupt.");
+    }
+    let storedKey;
+    try {
+      storedKey = replicationIdentityKey(value.identity);
+    } catch {
+      storedKey = void 0;
+    }
+    if (storedKey !== this.#identityKey) throw corrupt("The pending-write state belongs to a different identity.");
+    return value;
+  }
+  async #access() {
+    const gateTx = this.#gateTx;
+    if (gateTx === void 0) throw gatedError("gate_unavailable", "No lifecycle gate is wired into the pending-write store.");
+    const stamp = this.#stamp;
+    if (stamp === void 0) throw gatedError("not_established", "The pending-write store has no session stamp.");
+    const snapshot = await gateTx.snapshot();
+    if (snapshot === null) throw gatedError("not_established", "No replica gate exists on this origin yet.");
+    const identityKeyHash = await gateHash(snapshot.gateHmac, "identity", this.#identityKey);
+    const principalHash = await gateHash(snapshot.gateHmac, "principal", this.identity.principal.toLowerCase());
+    return {
+      gateTx,
+      id: identityKeyHash,
+      access: {
+        stamp,
+        incarnation: snapshot.incarnation,
+        keyId: snapshot.keyId,
+        accountKeyId: snapshot.accountKeyId,
+        principalHash,
+        identityKeyHash
+      }
+    };
+  }
+  async #stored() {
+    const gated = await this.#access();
+    const { gateTx, access, id } = gated;
+    const row = await gateTx.run({ stores: [KV_STORE.pending], mode: "readonly" }, access, (tx) => requestAsPromise(tx.objectStore(KV_STORE.pending).get(id)));
+    if (row === void 0) return void 0;
+    const account = await gateTx.readAccountKey(access);
+    return this.#parse(decodeJson(await openSealed(account.aesGcm, row, `pending\0${id}`)));
+  }
+  async read() {
+    return await this.#stored() ?? this.#empty();
+  }
+  async readExisting() {
+    return this.#stored();
+  }
+  async update(mutate) {
+    const gated = await this.#access();
+    const { gateTx, access, id } = gated;
+    if (this.#locks === void 0) throw gatedError("gate_unavailable", "Web Locks are required for pending-write mutations.");
+    const section = async () => {
+      const old = await gateTx.run({ stores: [KV_STORE.pending], mode: "readonly" }, access, (tx) => requestAsPromise(tx.objectStore(KV_STORE.pending).get(id)));
+      const account = await gateTx.readAccountKey(access);
+      const state = old === void 0 ? this.#empty() : this.#parse(decodeJson(await openSealed(account.aesGcm, old, `pending\0${id}`)));
+      const result = mutate(state);
+      const sealed = await seal(account.aesGcm, encodeJson(state), `pending\0${id}`);
+      const row = { ...sealed, size: 0 };
+      row.size = measureSealedRow(id, row);
+      await gateTx.run({ stores: [KV_STORE.pending], mode: "readwrite" }, access, async (tx) => {
+        const pending = tx.objectStore(KV_STORE.pending);
+        const current = await requestAsPromise(pending.get(id));
+        if (old === void 0 !== (current === void 0) || old !== void 0 && current !== void 0 && (old.iv.length !== current.iv.length || old.iv.some((byte, index) => byte !== current.iv[index]))) {
+          throw new ReplicaError(ReplicaErrorCode.BUSY, "The pending-write state changed during its sealed mutation.");
+        }
+        pending.put(row, id);
+      });
+      return result;
+    };
+    return this.#locks.request(`${REPLICA_PENDING_LOCK_PREFIX}${id}`, section);
+  }
+};
+
+// src/kv-storage/client.ts
+function replyError(err) {
+  const error = new ReplicaError(err.code, err.message, err.detail);
+  if (err.code === ReplicaErrorCode.GATED && typeof err.detail?.gate === "string")
+    error.gate = err.detail.gate;
+  return error;
+}
+function sameStamp(a, b) {
+  return a !== void 0 && a.incarnation === b.incarnation && a.lifecycleEpoch === b.lifecycleEpoch;
+}
+function spawn(source) {
+  if (source !== void 0) {
+    if (typeof Worker !== "undefined" && source instanceof Worker) return source;
+    if (source instanceof URL || typeof source === "string") return new Worker(source, { type: "module" });
+    if (typeof source === "function") return source();
+  }
+  return new Worker(new URL("./kv-storage.worker.67e46cebbda277040312a770449123633491901d6cceacea95754a843e01e9c9.js", import.meta.url), { type: "module" });
+}
+var WorkerConnection = class {
+  ready;
+  dead = false;
+  #worker;
+  #pending = /* @__PURE__ */ new Map();
+  #onEvent;
+  #nextId = 1;
+  #readyResolve;
+  #readyReject;
+  constructor(worker, onEvent) {
+    this.#worker = worker;
+    this.#onEvent = onEvent;
+    const ready = Promise.withResolvers();
+    this.ready = ready.promise;
+    ready.promise.catch(() => void 0);
+    this.#readyResolve = ready.resolve;
+    this.#readyReject = ready.reject;
+    worker.onmessage = (message) => this.#receive(message.data);
+    worker.onerror = (event) => this.kill(new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, event.message || "The replica worker failed."));
+  }
+  #receive(data) {
+    if ("event" in data) {
+      if (data.event.event === "ready") this.#readyResolve();
+      else this.#onEvent(data.event);
+      return;
+    }
+    const pending = this.#pending.get(data.id);
+    if (pending === void 0) return;
+    this.#pending.delete(data.id);
+    if (data.ok) pending.resolve({ result: data.result, stamp: data.stamp });
+    else pending.reject(replyError(data.err));
+  }
+  /** Post `request`; `onId` learns the request id before the reply (cancel needs it). */
+  async call(request, onId) {
+    await this.ready;
+    if (this.dead) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica worker stopped.");
+    const id = this.#nextId++;
+    const { promise, resolve, reject } = Promise.withResolvers();
+    this.#pending.set(id, { resolve, reject });
+    onId?.(id);
+    this.#worker.postMessage({ id, ...request });
+    return promise;
+  }
+  /** Fire-and-forget control message: cancel or the durable expiry result. */
+  notify(request) {
+    if (this.dead) return;
+    this.#worker.postMessage({ id: this.#nextId++, ...request });
+  }
+  kill(error) {
+    if (this.dead) return;
+    this.dead = true;
+    this.#worker.terminate();
+    this.#readyReject(error);
+    for (const pending of this.#pending.values()) pending.reject(error);
+    this.#pending.clear();
+  }
+};
+var IndexedDbReplicaHandle = class {
+  spec;
+  deviceDid;
+  replicaId;
+  #storage;
+  #lifecycle;
+  #stamp;
+  #wire;
+  #connection;
+  #remote;
+  #closed = false;
+  #syncs = /* @__PURE__ */ new Set();
+  constructor(storage, gate, spec, wire, connection, opened) {
+    this.#storage = storage;
+    this.#lifecycle = gate.lifecycle;
+    this.#stamp = gate.stamp;
+    this.spec = spec;
+    this.#wire = wire;
+    this.#connection = connection;
+    this.#remote = opened.handle;
+    this.deviceDid = opened.deviceDid;
+    this.replicaId = opened.partitionId;
+  }
+  acceptsPeerCommit(connection, handle) {
+    return !this.#closed && this.#connection === connection && this.#remote === handle && this.#lifecycle.deliverable(this.#stamp);
+  }
+  /** Before every request that reaches the worker (and every delivery): the gate must still honour the stamp. */
+  #assertDeliverable() {
+    if (!this.#lifecycle.deliverable(this.#stamp)) throw gatedError("stamp_stale", "The replica session ended.");
+  }
+  /** The live worker-side handle; after a worker restart the spec is reopened on the new worker. */
+  async #live() {
+    if (this.#closed) throw new ReplicaError(ReplicaErrorCode.CLOSED, "The replica handle is closed.");
+    this.#assertDeliverable();
+    if (this.#connection.dead) {
+      const connection = this.#storage.connection();
+      const reply = await connection.call({ op: "open", spec: this.#wire });
+      if (this.#closed) {
+        await connection.call({ op: "close", handle: reply.result.handle }).catch(() => void 0);
+        throw new ReplicaError(ReplicaErrorCode.CLOSED, "The replica handle is closed.");
+      }
+      const opened = this.#deliver(reply);
+      this.#connection = connection;
+      this.#remote = opened.handle;
+    }
+    return { connection: this.#connection, handle: this.#remote };
+  }
+  /** Delivery check (CONTRACT §2): drop a reply that ran under another (or no) stamp, or that the gate no longer honours. */
+  #deliver(reply) {
+    if (this.#closed) throw new ReplicaError(ReplicaErrorCode.CLOSED, "The replica handle is closed.");
+    if (!sameStamp(reply.stamp, this.#stamp)) throw gatedError("stamp_stale", "The replica reply ran under another session; it was not delivered.");
+    this.#assertDeliverable();
+    return reply.result;
+  }
+  async get(key) {
+    const { connection, handle } = await this.#live();
+    const result = this.#deliver(await connection.call({ op: "get", handle, key }));
+    return result.status === "present" ? { ...result, value: new Uint8Array(result.value) } : result;
+  }
+  async list(options) {
+    const { connection, handle } = await this.#live();
+    return this.#deliver(await connection.call({ op: "list", handle, ...options }));
+  }
+  async grant() {
+    const { connection, handle } = await this.#live();
+    return this.#deliver(await connection.call({ op: "grant", handle }));
+  }
+  async installGrant(ucan) {
+    const { connection, handle } = await this.#live();
+    return this.#deliver(await connection.call({ op: "installGrant", handle, ucan }));
+  }
+  sync(options) {
+    const running = this.#sync(options);
+    const settled = running.then(() => void 0, () => void 0);
+    this.#syncs.add(settled);
+    void settled.then(() => this.#syncs.delete(settled));
+    return running;
+  }
+  async #sync(options) {
+    options.signal.throwIfAborted();
+    const { connection, handle } = await this.#live();
+    if (this.#closed) throw new ReplicaError(ReplicaErrorCode.CLOSED, "The replica handle is closed.");
+    let requestId;
+    const cancel = () => {
+      if (requestId !== void 0) connection.notify({ op: "cancel", target: requestId });
+    };
+    options.signal.addEventListener("abort", cancel, { once: true });
+    try {
+      const running = connection.call({ op: "sync", handle, syncStartEpoch: options.syncStartEpoch }, (id) => {
+        requestId = id;
+        if (options.signal.aborted) cancel();
+      });
+      return this.#deliver(await running);
+    } finally {
+      options.signal.removeEventListener("abort", cancel);
+    }
+  }
+  async status() {
+    const { connection, handle } = await this.#live();
+    const status = this.#deliver(await connection.call({ op: "status", handle }));
+    return { ...status, persisted: await this.#storage.persisted(), purgePending: await purgePendingFor(this.#lifecycle, this.replicaId, null) };
+  }
+  async close() {
+    if (this.#closed) return;
+    this.#closed = true;
+    this.#storage.forget(this);
+    if (!this.#connection.dead) await this.#connection.call({ op: "close", handle: this.#remote }).catch(() => void 0);
+    await Promise.allSettled([...this.#syncs]);
+  }
+};
+async function purgePendingFor(lifecycle, partitionId, identityKeyHash) {
+  return (await lifecycle.pendingPurge()).some(
+    (intent) => intent.kind === "partition" ? intent.partitionId === partitionId : intent.identityKeyHash === identityKeyHash
+  );
+}
+var IndexedDbReplicaStorage = class {
+  kind = "indexeddb";
+  lifecycle;
+  #options;
+  #handles = /* @__PURE__ */ new Set();
+  #connection;
+  #persisted;
+  #recovery;
+  constructor(options) {
+    this.#options = { ...options, ledger: options.ledger ?? ledgerFor() };
+    this.lifecycle = options.lifecycle;
+  }
+  connection(peek) {
+    if (peek) return this.#connection;
+    if (this.#connection === void 0 || this.#connection.dead) {
+      const connection = new WorkerConnection(spawn(this.#options.worker), (event) => this.#event(event, connection));
+      this.#connection = connection;
+    }
+    return this.#connection;
+  }
+  #event(event, connection) {
+    if (event.event === "consentExpiry") {
+      const lifecycle = this.lifecycle;
+      void Promise.resolve().then(() => {
+        if (typeof lifecycle?.expireConsent !== "function") throw gatedError("gate_unavailable", "The lifecycle cannot expire account consent.");
+        return lifecycle.expireConsent();
+      }).then(
+        (outcome) => connection.notify({ op: "consentExpiryAck", requestId: event.requestId, ok: true, outcome }),
+        () => connection.notify({ op: "consentExpiryAck", requestId: event.requestId, ok: false, message: "Consent expiry failed." })
+      );
+      return;
+    }
+    if (event.event !== "peerCommit") return;
+    for (const handle of this.#handles) {
+      if (!handle.acceptsPeerCommit(connection, event.handle)) continue;
+      try {
+        handle.spec.onPeerCommit?.(event.info);
+      } catch {
+      }
+    }
+  }
+  forget(handle) {
+    this.#handles.delete(handle);
+  }
+  /** `navigator.storage.persist()`, asked once per storage instance. */
+  persisted() {
+    this.#persisted ??= typeof navigator !== "undefined" && typeof navigator.storage?.persist === "function" ? navigator.storage.persist().catch(() => null) : Promise.resolve(null);
+    return this.#persisted;
+  }
+  #gateTx() {
+    const gateTx = this.#options.gateTx;
+    if (gateTx === void 0) throw gatedError("gate_unavailable", "No lifecycle gate is wired into the replica storage.");
+    return gateTx;
+  }
+  async #recoverBeforeOpen(lifecycle) {
+    this.#recovery ??= (async () => {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 3e3);
+      const timedOut = new Promise((_resolve, reject) => controller.signal.addEventListener("abort", () => reject(gatedError("gate_unavailable", "Replica startup recovery timed out; local reads remain unavailable.")), { once: true }));
+      try {
+        const report = await Promise.race([lifecycle.recover({ signal: controller.signal }), timedOut]);
+        if (report.failed.length > 0 || report.remaining > 0) {
+          throw gatedError("purge_pending", "Replica startup recovery did not finish; local reads remain unavailable.");
+        }
+      } finally {
+        clearTimeout(timer);
+      }
+    })().catch((error) => {
+      this.#recovery = void 0;
+      throw error;
+    });
+    return this.#recovery;
+  }
+  async open(spec) {
+    assertFolderPrefix2(spec.prefix);
+    const identity = canonicalReplicationIdentity(spec.identity);
+    const lifecycle = this.lifecycle;
+    const stamp = spec.stamp;
+    if (stamp === void 0) throw gatedError("not_established", "The session has no replica stamp.");
+    await this.#recoverBeforeOpen(lifecycle);
+    if (!lifecycle.deliverable(stamp)) throw gatedError("stamp_stale", "The replica session ended.");
+    void this.persisted();
+    const wire = {
+      identity,
+      space: spec.space,
+      prefix: spec.prefix,
+      allowSecrets: spec.allowSecrets,
+      stamp: { incarnation: stamp.incarnation, lifecycleEpoch: stamp.lifecycleEpoch },
+      ...spec.device === void 0 ? {} : { device: { did: spec.device.did, jwk: spec.device.jwk } },
+      grantPolicy: structuredClone(spec.grantPolicy),
+      ...spec.quota === void 0 ? {} : { quota: { ...spec.quota } }
+    };
+    const connection = this.connection();
+    const reply = await connection.call({ op: "open", spec: wire });
+    if (!sameStamp(reply.stamp, stamp) || !lifecycle.deliverable(stamp)) {
+      await connection.call({ op: "close", handle: reply.result.handle }).catch(() => void 0);
+      throw gatedError("stamp_stale", "The replica session ended while the replica opened.");
+    }
+    const handle = new IndexedDbReplicaHandle(this, { lifecycle, stamp }, spec, wire, connection, reply.result);
+    this.#handles.add(handle);
+    return handle;
+  }
+  /** The private lookup index names the stored owner partition without decrypting its device. */
+  async #partitions(db, snapshot, identity, prefix, sessionDeviceDid) {
+    const lookupId = await gateHash(snapshot.gateHmac, "lookup", `${replicationIdentityKey(identity)}
+${prefix}`);
+    const indexed = await requestAsPromise(
+      db.transaction(KV_STORE.partitions).objectStore(KV_STORE.partitions).index("byLookupId").getAll(lookupId)
+    );
+    const owners = indexed.filter((item) => item.lookupId === lookupId && item.ownerDevice === true);
+    if (owners.length > 1) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica has multiple owner partitions.");
+    const sessionId = sessionDeviceDid === void 0 ? void 0 : await partitionIdOf({ identity, prefix, deviceDid: sessionDeviceDid }, snapshot.gateHmac);
+    return [...new Set([owners[0]?.partitionId, sessionId].filter((id) => id !== void 0))];
+  }
+  async inspectStatus(spec, { signal }) {
+    signal.throwIfAborted();
+    const controller = new AbortController();
+    const onAbort = () => controller.abort(signal.reason);
+    signal.addEventListener("abort", onAbort, { once: true });
+    const timer = setTimeout(() => controller.abort(new DOMException("Replica status inspection timed out.", "TimeoutError")), 3e3);
+    const aborted = new Promise((_resolve, reject) => {
+      controller.signal.addEventListener("abort", () => reject(controller.signal.reason), { once: true });
+    });
+    try {
+      if (signal.aborted) onAbort();
+      return await Promise.race([this.#inspectRedacted(spec, controller.signal), aborted]);
+    } finally {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", onAbort);
+    }
+  }
+  async #inspectRedacted(spec, signal) {
+    signal.throwIfAborted();
+    const identity = canonicalReplicationIdentity(spec.identity);
+    const snapshot = await this.#gateTx().snapshot();
+    if (snapshot === null) return void 0;
+    const identityKey = replicationIdentityKey(identity);
+    const lookupId = await gateHash(snapshot.gateHmac, "lookup", `${identityKey}
+${spec.prefix}`);
+    const principalHash = await gateHash(snapshot.gateHmac, "principal", identity.principal.toLowerCase());
+    const identityKeyHash = await gateHash(snapshot.gateHmac, "identity", identityKey);
+    const injectedId = spec.device === void 0 ? void 0 : await partitionIdOf({ identity, prefix: spec.prefix, deviceDid: spec.device.did }, snapshot.gateHmac);
+    signal.throwIfAborted();
+    const db = await openKvDatabase({ create: false });
+    if (db === null) return void 0;
+    try {
+      const tx = db.transaction([KV_STORE.gate, KV_STORE.device, KV_STORE.partitions, KV_STORE.meta, KV_STORE.purgeIntents], "readonly");
+      const gate = await requestAsPromise(tx.objectStore(KV_STORE.gate).get("account"));
+      if (gate === void 0 || gate.incarnation !== snapshot.incarnation || gate.lifecycleEpoch !== snapshot.lifecycleEpoch || gate.keyId !== snapshot.keyId || gate.accountKeyId !== snapshot.accountKeyId || gate.principalHash !== principalHash) return void 0;
+      const hmac = await requestAsPromise(tx.objectStore(KV_STORE.device).get(GATE_HMAC_KEY));
+      if (!validGateHmac(hmac, gate)) return void 0;
+      signal.throwIfAborted();
+      let partitionId = injectedId;
+      if (partitionId === void 0) {
+        const matches = await requestAsPromise(
+          tx.objectStore(KV_STORE.partitions).index("byLookupId").getAll(lookupId, 64)
+        );
+        const owners = matches.filter((item) => item.ownerDevice === true && item.lookupId === lookupId);
+        if (owners.length > 1) throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The replica has multiple owner partitions.");
+        if (matches.length === 64) {
+          throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The bounded replica owner lookup is inconclusive.");
+        }
+        partitionId = owners[0]?.partitionId;
+      }
+      if (partitionId === void 0) return void 0;
+      const row = await requestAsPromise(tx.objectStore(KV_STORE.meta).get(partitionId));
+      if (row === void 0 || row.purged) return void 0;
+      if (row.pid !== partitionId || ![0, 1, 2].includes(row.coverageCode) || ![row.syncedThroughEpoch, row.keys, row.contentMissing, row.tombstones, row.contentBytes].every((value) => Number.isSafeInteger(value) && value >= 0)) {
+        throw new ReplicaError(ReplicaErrorCode.STORAGE_ERROR, "The redacted replica status controls are invalid.");
+      }
+      const intents = tx.objectStore(KV_STORE.purgeIntents);
+      const [partitionIntent, identityIntent] = await Promise.all([
+        requestAsPromise(intents.count(partitionId)),
+        requestAsPromise(intents.count(`pending:${identityKeyHash}`))
+      ]);
+      signal.throwIfAborted();
+      const persisted = typeof navigator.storage?.persisted === "function" ? await navigator.storage.persisted().catch(() => null) : null;
+      signal.throwIfAborted();
+      return {
+        redacted: true,
+        coverage: row.coverageCode === 0 ? "empty" : row.coverageCode === 1 ? "bootstrapping" : "complete",
+        syncedThroughEpoch: row.syncedThroughEpoch,
+        counts: { keys: row.keys, contentMissing: row.contentMissing, tombstones: row.tombstones },
+        bytes: row.contentBytes,
+        persisted,
+        purgePending: partitionIntent > 0 || identityIntent > 0
+      };
+    } finally {
+      db.close();
+    }
+  }
+  #assertPurgeGate(gate, snapshot, principalHash) {
+    if (gate === void 0 || gate.principalHash === null || gate.incarnation !== snapshot.incarnation || gate.lifecycleEpoch !== snapshot.lifecycleEpoch || gate.keyId !== snapshot.keyId || gate.accountKeyId !== snapshot.accountKeyId) {
+      throw gatedError("stamp_stale", "The replica gate moved before purge.");
+    }
+    if (gate.principalHash !== principalHash) throw gatedError("principal_mismatch", "Purge belongs to another account.");
+  }
+  /**
+   * Erase the identity's replica of `target.prefix` under the stored device
+   * and the session device (deduplicated by principal), each in its own
+   * exempt erase transaction that also unindexes the partition and releases
+   * its quota. Never opens, mints or syncs, and never creates the database.
+   * Handles opened earlier fail RESET_REQUIRED on their next call. With no
+   * gate on the origin it rejects REPLICA_GATED `not_established` rather than
+   * reporting an erase it could not address.
+   */
+  async purge(target) {
+    const gateTx = this.#gateTx();
+    const identity = canonicalReplicationIdentity(target.identity);
+    const snapshot = await gateTx.snapshot();
+    if (snapshot === null) throw gatedError("not_established", "No replica gate exists on this origin; there is nothing purge can address.");
+    const principalHash = await gateHash(snapshot.gateHmac, "principal", identity.principal.toLowerCase());
+    let db;
+    try {
+      db = await openKvDatabase({ create: false });
+    } catch (error) {
+      throw idbError(error, "Opening the replica database");
+    }
+    if (db === null) throw gatedError("gate_unavailable", "The replica database disappeared before purge.");
+    try {
+      this.#assertPurgeGate(await requestAsPromise(
+        db.transaction(KV_STORE.gate).objectStore(KV_STORE.gate).get("account")
+      ), snapshot, principalHash);
+      const partitions = await this.#partitions(db, snapshot, identity, target.prefix, target.sessionDeviceDid);
+      let firstError;
+      for (const partitionId of partitions) {
+        try {
+          const tx = db.transaction([...ERASE_STORES, KV_STORE.gate, KV_STORE.partitions, KV_STORE.quota], "readwrite", { durability: "strict" });
+          const done = transactionDone(tx);
+          try {
+            this.#assertPurgeGate(await requestAsPromise(
+              tx.objectStore(KV_STORE.gate).get("account")
+            ), snapshot, principalHash);
+            const { bytes } = await kvPartitionEraser.erasePartition(tx, partitionId);
+            await gateTx.unindexPartition(tx, partitionId);
+            await this.#options.ledger?.accountErase(tx, { partitionId, bytes });
+            await done;
+          } catch (error) {
+            try {
+              tx.abort();
+            } catch {
+            }
+            await done.catch(() => void 0);
+            throw error;
+          }
+        } catch (error) {
+          firstError ??= idbError(error, "Purging the replica");
+        }
+      }
+      if (firstError !== void 0) throw firstError;
+    } finally {
+      db.close();
+    }
+  }
+  pendingWrites(identity, options = {}) {
+    return new IndexedDbPendingWriteStore(identity, {
+      ...this.#options.gateTx === void 0 ? {} : { gateTx: this.#options.gateTx },
+      ...options.stamp === void 0 ? {} : { stamp: options.stamp }
+    });
+  }
+};
+function indexedDbReplicaStorage(options = {}) {
+  const ledger = options.ledger ?? ledgerFor();
+  const lifecycle = options.lifecycle ?? createIndexedDbLifecycle({ ledger });
+  const gateTx = options.gateTx ?? createIndexedDbGateTx((create) => openKvDatabase({ create }), {
+    onConsentExpired: () => {
+      if (!("expireConsent" in lifecycle) || typeof lifecycle.expireConsent !== "function") {
+        throw gatedError("gate_unavailable", "The lifecycle cannot expire account consent.");
+      }
+      return lifecycle.expireConsent();
+    }
+  });
+  return new IndexedDbReplicaStorage({ ...options, ledger, gateTx, lifecycle });
+}
+export {
+  ReplicaError,
+  ReplicaErrorCode,
+  indexedDbReplicaStorage,
+  isReplicaError
+};
+//# sourceMappingURL=kv-storage.js.map