slopkit 0.1.1 → 0.2.0

package/DEPS.md

@@ -29,7 +29,8 @@ seeded network's PRNG and scheduler.
 ## Budgets
 
 - **Kit client core**, gated by `pack:check` on the packed package: `schema`, `contract`, `sync`, `client`, `machine`,
-  `money`, `digest`, `states` and `web/replica`, minified and gzipped together, ≤ 10,730 bytes (10,668 measured).
+  `money`, `digest`, `states` and `web/replica`, minified and gzipped together, ≤ 12,196 bytes (12,196 measured; the
+  paged first copy added 1,470).
   `cron` is browser-safe but outside the core; an app that ships it counts it in its own budget. The budget grows only
   with a new entry or guarantee, by its measured size.
 - **Hello app** (preact, signals, and `sync`, `client`, `web/replica`, `schema`, `contract`, `states`): ≤ 17 KB gzip

package/README.md

@@ -94,6 +94,47 @@ export default defineConfig({
 });
 ```
 
+### sync in pages
+
+a device with no copy draws its newest rows after one round trip, whatever the history's size, then pulls older pages
+back to back until it holds everything. the server half is `slopkit/server/pull`: one history table paged newest
+first by a keyset order, the other tables whole, receipts with the rows they name, all in one read transaction and
+within your caps.
+
+```ts
+import { createPull } from "slopkit/server/pull";
+
+const pulls = createPull({
+  db, dataset: () => store.dataset(), revision: () => store.revision(),
+  // newest first by (date, id), descending; id is unique. bump version when the order changes
+  paged: { table: "transactions", order: ["date", "id"], version: 1, live: "deleted = 0", read: toTransaction,
+    through: ([date]) => String(date) },
+  unpaged: (since) => ({ accounts: store.accounts(since) }), // whole on every reset
+  // the commands the page names (any of its pages'), or an old page's own receipts since `since`
+  receipts: { read: ({ since, commands }, viewer: Viewer) => commands === undefined
+      ? ledger.receipts(viewer.principal, viewer.client, since).map((each) => ({ ...each, client: viewer.client }))
+      : ledger.receiptsOf(viewer.principal, commands),
+    names: (each) => [each.receipt.transaction] },
+  limits: { firstRows: 200, pageRows: 2000, maxRows: 5000, maxBytes: 2_000_000 },
+  // your endpoint's reply: the caps measure its json
+  respond: ({ rows, unpaged, receipts, ...rest }) => ({ ...rest, transactions: rows, ...unpaged, commands: receipts }),
+});
+
+route(pull, (request, caller) => pulls.pull(request, viewerOf(request, caller)).reply);
+```
+
+the page's pull request carries `page` (the engine fills it in; a request without it gets the old whole reply), and
+the copy's history is its own subject: place `deriveHistoryState(model)` (loading, none, partial, complete) and
+`deriveDurabilityState(model)` (the storage states) in two tables and compose both. partial is a claim beside the
+numbers, "history from <through>, loading older · held of total", and totals cover only `through` and above. run the
+pull contract against your own pull in your tests:
+
+```ts
+import { pullConformance } from "slopkit/conformance/pull";
+
+pullConformance({ name: "my app", create: async (limits) => fixtureOverMyRealStore(limits) });
+```
+
 the shared lint rules go on top of ultracite's presets (`oxlint.config.ts`):
 
 ```ts

package/dist/client.d.ts

@@ -19,10 +19,14 @@ export type StoragePort<T, S, C, O> = {
         commands: Pending<C, O>[];
         unreadable: number;
     }>;
-    /** Commit a patch, decided against the disk inside its transaction; returns what the disk now holds. */
+    /**
+     * Commit a patch, decided against the disk inside its transaction; returns what the disk now holds, and `whole:
+     * false` when it took the patch as a delta under its own history (so it lacks rows of this page's copy).
+     */
     commit: (commit: Commit<T, S>) => Promise<{
         dataset: string;
         revision: number;
+        whole?: boolean;
     }>;
     /** Write one command (an intent, or its outcome) under its key. */
     keep: (pending: Pending<C, O>) => Promise<void>;
@@ -37,6 +41,16 @@ export type NetworkPort<P, S, C, O> = {
         dataset: string | null;
         since: number;
         verify: boolean;
+        /**
+         * The older page wanted: null for none (a paged reset is understood), the copy's `next` while partial. Absent asks
+         * for an old server's whole reply.
+         */
+        page?: string | null;
+        /** Commands waiting on an outcome or on their effects, any page's: their receipts come with the rows they name. */
+        commands?: {
+            client: string;
+            id: number;
+        }[];
     }) => Promise<Result<{
         patch: Patch<P, S>;
         receipts: Receipt<O>[];

package/dist/client.js

@@ -37,6 +37,10 @@ export function createClient(options) {
                     dataset: effect.dataset,
                     since,
                     verify: effect.verify,
+                    // An old server's whole copy is asked as an old client asks it: with neither.
+                    ...(effect.page === undefined
+                        ? {}
+                        : { page: effect.page, commands: effect.commands }),
                 })
                     .then((result) => result.ok
                     ? { type: "pulled", since, ...result.value, now: now() }

package/dist/conformance/fixtures.d.ts

@@ -1,7 +1,7 @@
 import type { NetworkPort } from "../client.ts";
 import type { Infer, Schema } from "../schema.ts";
 import type { Key, Pending, Replica } from "../sync.ts";
-declare const rowSchema: Schema<{
+export declare const rowSchema: Schema<{
     deleted: boolean;
     id: string;
     revision: number;
@@ -14,7 +14,7 @@ export type Tables = {
 export type PatchRows = {
     rows: Row[];
 };
-declare const serverSchema: Schema<{
+export declare const serverSchema: Schema<{
     build: string;
 }>;
 export type Server = Infer<typeof serverSchema>;
@@ -40,6 +40,57 @@ export declare const outcomeSchema: Schema<({
     kind: "unknown";
 })>;
 export type Outcome = Infer<typeof outcomeSchema>;
+export declare const pendingSchema: Schema<{
+    at: number;
+    client: string;
+    command: {
+        name: "put";
+        value: number;
+    };
+    dataset: string | null;
+    id: number;
+    since?: number;
+    state: ({
+        kind: "saving";
+    } & {
+        kind: "saving";
+    }) | ({
+        kind: "queued";
+    } & {
+        kind: "queued";
+    }) | ({
+        kind: "sending";
+    } & {
+        kind: "sending";
+    }) | ({
+        failure: string;
+        kind: "unknown";
+    } & {
+        kind: "unknown";
+    }) | ({
+        kind: "done";
+        outcome: ({
+            kind: "ok";
+            resource: string;
+        } & {
+            kind: "ok";
+        }) | ({
+            kind: "failed";
+            reason: string;
+        } & {
+            kind: "failed";
+        }) | ({
+            kind: "unknown";
+            reason: string;
+        } & {
+            kind: "unknown";
+        });
+        revision: number;
+    } & {
+        kind: "done";
+    });
+}>;
+export declare const rowsLens: import("../sync.ts").Lens<Tables, PatchRows>;
 export declare const sync: {
     initial: (client: string, now: number) => import("../sync.ts").Model<Tables, {
         build: string;
@@ -147,7 +198,7 @@ export declare const sync: {
         build: string;
     }>, patch: import("../sync.ts").Patch<PatchRows, {
         build: string;
-    }>) => {
+    }>, since: number) => "gap" | {
         replica: Replica<Tables, {
             build: string;
         }>;

package/dist/conformance/fixtures.js

@@ -3,20 +3,20 @@ import { IDBFactory } from "fake-indexeddb";
 import { boolean, literal, nullable, number, object, optional, string, variant, } from "../schema.js";
 import { createSync, table } from "../sync.js";
 import { indexedReplica } from "../web/replica.js";
-const rowSchema = object({
+export const rowSchema = object({
     id: string(),
     value: number({ integer: true }),
     deleted: boolean(),
     revision: number({ integer: true, min: 0 }),
 }, { strict: true });
-const serverSchema = object({ build: string() }, { strict: true });
+export const serverSchema = object({ build: string() }, { strict: true });
 const commandSchema = object({ name: literal("put"), value: number({ integer: true }) }, { strict: true });
 export const outcomeSchema = variant("kind", {
     ok: object({ kind: literal("ok"), resource: string() }, { strict: true }),
     failed: object({ kind: literal("failed"), reason: string() }, { strict: true }),
     unknown: object({ kind: literal("unknown"), reason: string() }, { strict: true }),
 });
-const pendingSchema = object({
+export const pendingSchema = object({
     client: string(),
     id: number({ integer: true, min: 1 }),
     dataset: nullable(string()),
@@ -36,7 +36,7 @@ const pendingSchema = object({
     }),
 });
 const empty = { rows: new Map() };
-const rowsLens = table({
+export const rowsLens = table({
     name: "rows",
     schema: rowSchema,
     rows: (patch) => patch.rows,

package/dist/conformance/legacy/replica-012.d.ts

@@ -0,0 +1,52 @@
+import type { Schema } from "../../schema.ts";
+import type { Lens, Op, Pending } from "../../sync.ts";
+type Replica<T, S> = {
+    dataset: string | null;
+    revision: number;
+    tables: T;
+    server: S | null;
+};
+type StoragePort<T, S, C, O> = {
+    load: () => Promise<{
+        replica: Replica<T, S>;
+        commands: Pending<C, O>[];
+        unreadable: number;
+    }>;
+    commit: (commit: {
+        replica: Replica<T, S>;
+        ops: Op[];
+        reset: boolean;
+        base: number;
+        replaces: string | null;
+    }) => Promise<{
+        dataset: string;
+        revision: number;
+    }>;
+    keep: (pending: Pending<C, O>) => Promise<void>;
+    drop: (keys: {
+        client: string;
+        id: number;
+    }[]) => Promise<void>;
+};
+export declare function indexedReplica<T, P, S, C, O>(options: {
+    factory: IDBFactory;
+    name: string;
+    /** The object stores' layout: bump when a table is added or renamed. Row shapes are checked on their own. */
+    version: number;
+    tables: readonly Lens<T, P>[];
+    empty: T;
+    server: Schema<S>;
+    pending: Schema<Pending<C, O>>;
+    interfere?: (what: "commit" | "keep" | "drop", transaction: IDBTransaction) => void;
+    /**
+     * An outbox an earlier release kept in another store: on upgrade each record is moved into the outbox, converted to
+     * a command (or kept as it was, under its own key, to be counted unreadable). Never dropped.
+     */
+    legacy?: {
+        store: string;
+        convert: (value: unknown) => Pending<C, O> | undefined;
+    };
+}): StoragePort<T, S, C, O> & {
+    forget: () => Promise<void>;
+};
+export {};

package/dist/conformance/legacy/replica-012.js

@@ -0,0 +1,403 @@
+/* oxlint-disable anti-slop/no-unknown-parameters, anti-slop/no-runtime-typeof, anti-slop/no-reflect-get -- frozen released storage boundary, not a new decoder */
+// Released 0.1.2 adapter and commit decision, kept unchanged for cross-release read/write checks.
+/**
+ * The sync engine's storage port over IndexedDB: the replica (one store per table, out-of-line keys, and a checkpoint)
+ * and the outbox (one record per command, keyed by client and number), in one database shared by every tab.
+ *
+ * - A commit is decided inside its own read-write transaction from the checkpoint the disk holds (`commitPlan`): a
+ *   stale tab can't make the disk go back, and a patch whose base the disk never reached is written as the whole
+ *   replica instead, so the checkpoint never covers rows the disk doesn't have.
+ * - Every write checks the database's generation, read at load: after a forget in another tab this page's writes
+ *   fail as `Replaced` instead of bringing the forgotten copy back.
+ * - The outbox is written per command, never replaced whole, so tabs can't overwrite each other's intents.
+ * - Rows are read back only under the row shapes that wrote them (each table's name and schema `shape`, kept with the
+ *   checkpoint): any change to a table or its schema starts the rows over, with no number to bump by hand. The next
+ *   commit then writes the whole replica, so the disk is repaired, not just the memory. Rows that don't parse are
+ *   treated the same. The server's facts are not rows: facts an older page kept that no longer fit load as null and
+ *   never cost the copy; facts that change at the same revision are written too.
+ * - A version upgrade starts the replica over (it comes back from the server) but keeps the outbox and the generation:
+ *   an intent on disk is never erased by an upgrade. One this version can't read stays on disk and is counted.
+ * - A newer version opening in another tab closes this page's connection; its writes then fail as `Replaced`.
+ *
+ * `factory` is the browser's `indexedDB`, or any implementation of the same API (the headless simulation passes an
+ * in-memory one). `interfere` is for tests: it sees each write transaction before it commits and may abort it.
+ */
+import { Replaced } from "../../client.js";
+import { check } from "../../schema.js";
+import { committed, openDatabase, request } from "../../web/idb.js";
+function commitPlan(stored, commit) {
+    const same = stored.dataset === commit.dataset;
+    if (!same && stored.dataset !== null && stored.dataset !== commit.replaces) {
+        return "stale";
+    }
+    if (same && stored.revision >= commit.revision) {
+        return "skip";
+    }
+    if (!commit.reset && same && stored.revision >= commit.base) {
+        return "delta";
+    }
+    return "whole";
+}
+export function indexedReplica(options) {
+    const names = options.tables.map((lens) => lens.name);
+    const shapes = options.tables.map((lens) => lens.shape).join("\n");
+    /** The checkpoint a load found whose rows didn't parse: the next commit at it rewrites the whole replica. */
+    let damaged;
+    /** The dataset of a copy this page loaded but couldn't read (other row shapes, rows that don't parse): its own to replace. */
+    let discarded = null;
+    /**
+     * The checkpoint this page loaded, as written: a copy under other row shapes is this page's to replace only while it
+     * is still that one. Once another release's tab writes its own, that release owns the copy on this device.
+     */
+    let loaded;
+    let opened;
+    /** The generation this page loaded; undefined until it has. */
+    let generation;
+    /** A newer version took the database over: this page must reload. */
+    let superseded = false;
+    /**
+     * The version to open: `version`, or past what the browser has when that lacks a store these tables need (a table
+     * added without a bump) or is already newer (another release's tab moved it): the layout follows the tables, so a
+     * forgotten bump can't leave the copy unopenable.
+     */
+    const layout = async () => {
+        const probe = await new Promise((resolve, reject) => {
+            const opening = options.factory.open(options.name);
+            opening.onsuccess = () => resolve(opening.result);
+            opening.onerror = () => reject(opening.error ?? new Error(`can't open ${options.name}`));
+        });
+        const missing = [...names, "meta", "outbox"].some((name) => !probe.objectStoreNames.contains(name));
+        const current = probe.version;
+        probe.close();
+        if (current >= options.version && !missing) {
+            return current;
+        }
+        return Math.max(current + (missing ? 1 : 0), options.version);
+    };
+    const open = () => {
+        opened ??= layout()
+            .then((version) => openDatabase(options.factory, options.name, version, (database, _from, upgrade) => {
+            // Replica tables start over (the server has them); every other store an earlier version kept may hold work
+            // nobody else has, so its records move into the outbox: converted by `legacy`, else kept as they were under
+            // their own key, counted unreadable. Nothing is dropped unseen.
+            const legacy = options.legacy;
+            const own = new Set(["meta", "outbox"]);
+            if (!database.objectStoreNames.contains("outbox")) {
+                database.createObjectStore("outbox");
+            }
+            if (database.objectStoreNames.contains("meta")) {
+                upgrade.objectStore("meta").delete("checkpoint");
+            }
+            else {
+                database.createObjectStore("meta");
+            }
+            const outbox = upgrade.objectStore("outbox");
+            // A snapshot: deleting a store changes the live list being walked.
+            const existing = [...database.objectStoreNames];
+            for (const name of existing) {
+                if (own.has(name)) {
+                    continue;
+                }
+                if (names.includes(name)) {
+                    database.deleteObjectStore(name);
+                    continue;
+                }
+                const cursor = upgrade.objectStore(name).openCursor();
+                let at = 0;
+                cursor.onsuccess = () => {
+                    const current = cursor.result;
+                    if (current === null) {
+                        database.deleteObjectStore(name);
+                        return;
+                    }
+                    const value = current.value;
+                    const command = legacy?.store === name ? legacy.convert(value) : undefined;
+                    if (command === undefined) {
+                        outbox.put(value, ["legacy", name, at++]);
+                    }
+                    else {
+                        outbox.put(command, [command.client, command.id]);
+                    }
+                    current.continue();
+                };
+            }
+            for (const name of names) {
+                database.createObjectStore(name);
+            }
+        }))
+            .then((database) => {
+            // The browser closed it under us (iOS Safari, cleared site data): the next call opens it again.
+            database.onclose = () => {
+                opened = undefined;
+            };
+            database.onversionchange = () => {
+                superseded = true;
+                database.close();
+            };
+            return database;
+        });
+        // A failed open may succeed later (a blocked upgrade): try again next time.
+        opened.catch(() => (opened = undefined));
+        return opened;
+    };
+    const db = async () => {
+        if (superseded) {
+            throw new Replaced();
+        }
+        return await open();
+    };
+    /** Inside a write transaction: refuse if the database was forgotten since this page loaded. */
+    async function guard(transaction) {
+        const stored = await request(transaction.objectStore("meta").get("generation"));
+        if ((typeof stored === "number" ? stored : 0) !== (generation ?? 0)) {
+            transaction.abort();
+            throw new Replaced();
+        }
+    }
+    /** The checkpoint on disk as this version may trust it: one of other row shapes (or none) holds nothing. */
+    const checkpointOf = (value) => {
+        if (typeof value !== "object" || value === null) {
+            return { dataset: null, revision: 0 };
+        }
+        const dataset = Reflect.get(value, "dataset");
+        const revision = Reflect.get(value, "revision");
+        if (Reflect.get(value, "shapes") !== shapes) {
+            return { dataset: null, revision: 0 };
+        }
+        const at = {
+            dataset: typeof dataset === "string" ? dataset : null,
+            revision: typeof revision === "number" ? revision : 0,
+        };
+        if (damaged !== undefined &&
+            damaged.dataset === at.dataset &&
+            damaged.revision === at.revision) {
+            return { dataset: null, revision: 0 };
+        }
+        return at;
+    };
+    return {
+        async load() {
+            const database = await db();
+            const transaction = database.transaction([...names, "meta", "outbox"], "readonly");
+            const entries = (name) => Promise.all([
+                request(transaction.objectStore(name).getAllKeys()),
+                request(transaction.objectStore(name).getAll()),
+            ]).then(([keys, rows]) => keys.flatMap((key, at) => typeof key === "string" || typeof key === "number" ? [{ key, row: rows[at] }] : []));
+            const [stored, point, outbox, ...tables] = await Promise.all([
+                request(transaction.objectStore("meta").get("generation")),
+                request(transaction.objectStore("meta").get("checkpoint")),
+                request(transaction.objectStore("outbox").getAll()),
+                ...names.map(entries),
+            ]);
+            generation = typeof stored === "number" ? stored : 0;
+            // A tap kept before taps recorded their copy's revision was made on the copy beside it on the disk: it takes
+            // that checkpoint's revision now, before the rows can be discarded (other row shapes, rows that don't parse),
+            // so a copy started over never makes it look like it was made on nothing.
+            const disk = typeof point === "object" && point !== null ? Reflect.get(point, "revision") : 0;
+            const commands = outbox.flatMap((each) => {
+                const parsed = check(options.pending, each);
+                if (!parsed.ok) {
+                    return [];
+                }
+                return [
+                    parsed.value.since === undefined && typeof disk === "number" && disk > 0
+                        ? { ...parsed.value, since: disk }
+                        : parsed.value,
+                ];
+            });
+            const unreadable = outbox.length - commands.length;
+            const empty = {
+                dataset: null,
+                revision: 0,
+                tables: options.empty,
+                server: null,
+            };
+            const at = checkpointOf(point);
+            const raw = typeof point === "object" && point !== null ? Reflect.get(point, "dataset") : null;
+            discarded = typeof raw === "string" && raw !== at.dataset ? raw : null;
+            loaded =
+                typeof point === "object" && point !== null
+                    ? {
+                        dataset: raw,
+                        revision: disk,
+                        shapes: Reflect.get(point, "shapes"),
+                    }
+                    : undefined;
+            const server = typeof point === "object" && point !== null
+                ? check(options.server, Reflect.get(point, "server"))
+                : undefined;
+            let restored = options.empty;
+            for (const [index, lens] of options.tables.entries()) {
+                restored = restored === undefined ? undefined : lens.restore(restored, tables[index] ?? []);
+            }
+            // Rows written under other shapes, or that no longer fit: start over rather than show wrong data, and let the
+            // next commit rewrite the disk. The server's facts are not rows (every pull brings them again), so facts an
+            // older page kept that no longer fit wait for the next pull instead of costing the copy.
+            if (restored === undefined && at.dataset !== null) {
+                damaged = at;
+                discarded = at.dataset;
+            }
+            if (restored === undefined || at.dataset === null) {
+                return { replica: empty, commands, unreadable };
+            }
+            return {
+                replica: {
+                    dataset: at.dataset,
+                    revision: at.revision,
+                    tables: restored,
+                    server: server?.ok === true ? server.value : null,
+                },
+                commands,
+                unreadable,
+            };
+        },
+        async commit(commit) {
+            const database = await db();
+            const transaction = database.transaction([...names, "meta"], "readwrite");
+            const done = committed(transaction);
+            const meta = transaction.objectStore("meta");
+            const target = {
+                dataset: commit.replica.dataset,
+                revision: commit.replica.revision,
+                server: commit.replica.server,
+                shapes,
+            };
+            try {
+                await guard(transaction);
+                const point = await request(meta.get("checkpoint"));
+                // The disk holds another dataset this page never saw (the server replaced the one it is on): refused,
+                // whatever row shapes wrote it, so a tab of another release can't write a replaced dataset back.
+                const held = typeof point === "object" && point !== null ? Reflect.get(point, "dataset") : null;
+                if (typeof held === "string" &&
+                    held !== commit.replica.dataset &&
+                    held !== commit.replaces &&
+                    held !== discarded) {
+                    transaction.abort();
+                    throw new Replaced();
+                }
+                const stored = checkpointOf(point);
+                const plan = commitPlan(stored, {
+                    ...target,
+                    reset: commit.reset,
+                    base: commit.base,
+                    replaces: commit.replaces,
+                });
+                // The disk holds a dataset this page never saw: the server replaced the one this page is on.
+                if (plan === "stale") {
+                    transaction.abort();
+                    throw new Replaced();
+                }
+                const revision = typeof point === "object" && point !== null ? Reflect.get(point, "revision") : 0;
+                const written = typeof point === "object" && point !== null ? Reflect.get(point, "shapes") : undefined;
+                // Another release's tab wrote this dataset under its own row shapes since this page loaded: that release owns
+                // the copy now, at any revision, and this page stops writing until it reloads.
+                if (held === commit.replica.dataset &&
+                    written !== shapes &&
+                    (loaded === undefined ||
+                        loaded.dataset !== held ||
+                        loaded.revision !== revision ||
+                        loaded.shapes !== written)) {
+                    transaction.abort();
+                    throw new Replaced();
+                }
+                // The copy this page loaded and couldn't read (other row shapes, rows that don't parse) still fences it: never
+                // rewritten below its revision. The page catches up from the server and writes it then.
+                if (plan === "whole" &&
+                    held === commit.replica.dataset &&
+                    typeof revision === "number" &&
+                    revision > commit.replica.revision) {
+                    transaction.abort();
+                    throw new Error("this device holds a newer copy than this page");
+                }
+                const write = (ops) => {
+                    for (const op of ops) {
+                        if ("drop" in op) {
+                            transaction.objectStore(op.table).delete(op.key);
+                        }
+                        else {
+                            transaction.objectStore(op.table).put(op.row, op.key);
+                        }
+                    }
+                };
+                if (plan === "delta") {
+                    write(commit.ops);
+                }
+                if (plan === "whole") {
+                    for (const name of names) {
+                        transaction.objectStore(name).clear();
+                    }
+                    for (const lens of options.tables) {
+                        write(lens.snapshot(commit.replica.tables));
+                    }
+                }
+                // At the same revision the rows are already there, but the server's facts may have moved: they are kept too.
+                const facts = plan === "skip" && stored.revision === target.revision;
+                if (plan !== "skip" || facts) {
+                    meta.put(target, "checkpoint");
+                }
+                options.interfere?.("commit", transaction);
+                await done;
+                if (plan === "whole") {
+                    damaged = undefined;
+                    discarded = null;
+                    loaded = undefined;
+                }
+                const now = plan === "skip" ? stored : target;
+                if (now.dataset === null) {
+                    throw new Error("the replica has no dataset");
+                }
+                return { dataset: now.dataset, revision: now.revision };
+            }
+            catch (error) {
+                await done.catch(() => undefined);
+                throw error;
+            }
+        },
+        async keep(pending) {
+            const database = await db();
+            const transaction = database.transaction(["meta", "outbox"], "readwrite");
+            const done = committed(transaction);
+            try {
+                await guard(transaction);
+                transaction.objectStore("outbox").put(pending, [pending.client, pending.id]);
+                options.interfere?.("keep", transaction);
+                await done;
+            }
+            catch (error) {
+                await done.catch(() => undefined);
+                throw error;
+            }
+        },
+        async drop(keys) {
+            const database = await db();
+            const transaction = database.transaction(["meta", "outbox"], "readwrite");
+            const done = committed(transaction);
+            try {
+                await guard(transaction);
+                for (const key of keys) {
+                    transaction.objectStore("outbox").delete([key.client, key.id]);
+                }
+                options.interfere?.("drop", transaction);
+                await done;
+            }
+            catch (error) {
+                await done.catch(() => undefined);
+                throw error;
+            }
+        },
+        /** Drop this device's copy and its outbox, and move to a new generation so no open tab writes it back. */
+        async forget() {
+            const database = await db();
+            const transaction = database.transaction([...names, "meta", "outbox"], "readwrite");
+            const done = committed(transaction);
+            const meta = transaction.objectStore("meta");
+            const stored = await request(meta.get("generation"));
+            for (const name of [...names, "outbox"]) {
+                transaction.objectStore(name).clear();
+            }
+            meta.delete("checkpoint");
+            meta.put((typeof stored === "number" ? stored : 0) + 1, "generation");
+            await done;
+        },
+    };
+}