Plain operations: last write wins, hash-keyed events, simpler composite

- KV: one write primitive, write(changes) with { key, value? }; writeIfAbsent removed.
  The server executes exactly what clients send and never reads values, so they can be
  encrypted end to end. Adds setFields/getFields on the base class.
- HTTP: no server history or event ids; SSE relays every change (own writes included) and
  the client emits resync when a dropped stream reconnects.
- Composite: writes apply locally, then go to the source (undone locally if refused);
  pushed changes are applied and announced only where they differ from local values;
  offline writes go to a queue store (any KV storage); sync() = replay, diff, replay.
  Removes KVReplicaSet, KVOutbox, KeyCounter, SerialQueue and RetryTimer.
- Events: id = <time>_<sha256(time + canonical data)>, so concurrent appends never
  collide and retries can't duplicate; no versions or ConcurrencyError.
- Event-sourced documents: read, resolve, append, apply; catchUp folds in foreign events;
  getAt takes an event id.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Qxbkp4tA7G5SCWjzWuxmE

test/kv-storage/kv-storage-http-auth.test.ts

@@ -1,6 +1,7 @@
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import type { KVChangeEvent } from '../../src/kv-storage/base-kv-storage.js'
 import { KVStorageComposite } from '../../src/kv-storage/kv-storage-composite.js'
+import { KVStorageHttpServer } from '../../src/kv-storage/kv-storage-http-server.js'
 import { KVStorageInMemory } from '../../src/kv-storage/kv-storage-in-memory.js'
 import { AuthError } from '../../src/utils/errors.js'
 import { Ed25519Signer, Ed25519Verifier } from '../../src/utils/request-auth.js'
@@ -16,9 +17,9 @@ beforeEach(async () => {
   alice = await Ed25519Signer.generate()
   bob = await Ed25519Signer.generate()
   await network.store.writeMany([
-    [`${alice.publicKey}/profile`, { name: 'Alice' }],
-    [`${bob.publicKey}/profile`, { name: 'Bob' }],
-    [`${bob.publicKey}/posts/1`, { title: 'secret' }],
+    { key: `${alice.publicKey}/profile`, value: { name: 'Alice' } },
+    { key: `${bob.publicKey}/profile`, value: { name: 'Bob' } },
+    { key: `${bob.publicKey}/posts/1`, value: { title: 'secret' } },
   ])
 })
 afterEach(() => network.close())
@@ -67,22 +68,9 @@ describe('authenticated KVStorageHttpServer', () => {
     await expect(network.client(alice).subscribe('')).rejects.toMatchObject({ status: 403 })
   })
 
-  it('replays only matching changes when resuming', async () => {
-    const watcher = network.client(alice)
-    const mine = watcher.child(alice.publicKey)
-    await mine.subscribe()
-    await mine.unsubscribe()
-    await network.client(bob).child(bob.publicKey).set('x', 1)
-    await network.client(alice).child(alice.publicKey).set('y', 2)
-    const replayed: KVChangeEvent[] = []
-    watcher.on('change', (e) => replayed.push(e))
-    await mine.subscribe()
-    expect(replayed.flatMap((e) => e.changes)).toEqual([{ key: `${alice.publicKey}/y`, value: 2 }])
-  })
-
   it('a composite scoped to the user syncs only their data', async () => {
     const db = new KVStorageComposite({ source: network.client(alice), prefix: alice.publicKey, replicas: [new KVStorageInMemory()] })
-    await db.synced()
+    await db.sync()
     expect(await collect(db.scan({ values: true }))).toEqual([[`${alice.publicKey}/profile`, { name: 'Alice' }]])
     expect(await collect(db.keys())).toEqual([alice.publicKey])
     await expect(db.child(bob.publicKey).get('profile')).rejects.toBeInstanceOf(RangeError)
@@ -92,4 +80,15 @@ describe('authenticated KVStorageHttpServer', () => {
     expect((await pushed).changes).toEqual([{ key: `${alice.publicKey}/fromElsewhere`, value: 1 }])
     await db.close()
   })
+
+  it('a composite undoes a local write the server refuses', async () => {
+    const replica = new KVStorageInMemory()
+    const db = new KVStorageComposite({ source: network.client(alice), prefix: alice.publicKey, replicas: [replica] })
+    await db.sync()
+    await db.child(alice.publicKey).set('x', 'before')
+    network.server = new KVStorageHttpServer(network.store, { auth: { verifiers: [{ algorithm: 'ed25519', verify: async () => false }] } }) // now rejects every signature
+    await expect(db.child(alice.publicKey).set('x', 'after')).rejects.toMatchObject({ status: 401 })
+    expect(await db.child(alice.publicKey).get('x')).toBe('before')
+    await db.close()
+  })
 })