@chipmobilesdk/rn-local-db 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog
+
+All notable changes to `@chipmobilesdk/rn-local-db` are recorded here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this package follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0] — 2026-08-01
+
+First release. New package, no existing consumers, no migration burden.
+
+### Added
+
+- **Scope-isolated storage.** One SQLite database file per scope. Scope is bound to a handle at open and immutable for its lifetime; no read, write, or query operation accepts a scope argument, and there is no `switchScope`. Scope components are hashed — only the SHA-256 digest reaches disk, a log, or an error.
+- **Records.** `insert`, `update`, `upsert` (reporting created versus updated), `get`, `find`, `delete`, `softDelete`, `restore`. Payloads round-trip with zero coercions, and the four value conditions — record absent, field null, field absent, record soft-deleted — stay distinguishable.
+- **Queries.** Twelve operators plus `and`/`or`/`not`, multi-key sorting with a deterministic `id` tiebreaker, keyset pagination, and `count` that always agrees with the corresponding list. An invalid query is an error rather than an empty or complete result. Development-mode index-coverage reporting via `explain`.
+- **Transactions and batches.** Real ACID transactions with read-your-own-writes, explicit abort, and terminal-state rejection. Batches of up to 1,000 operations applied as one unit.
+- **Migrations.** Ascending, at most once per scope, one transaction each, with a per-scope ledger. A failing chain returns no handle and alters nothing; a downgrade is refused rather than truncating. `resetScope` is the separately named recovery path.
+- **Deletion lifecycle.** `deleteScopeData`, `deleteDatabase`, and `resetScope` as module-level functions that work with or without an open handle. Nothing is ever deleted unasked — no expiry, no eviction, no sweep on close or upgrade. Every deletion reports what it removed and what it could not.
+- **Attachments.** Package-owned artifacts with availability checks that never open the file, owner-scoped listing, opt-in cascade on record deletion, and app-triggered reconciliation for orphaned files and dangling references. Every filesystem operation is confined to the managed storage area.
+- **Encryption at rest.** Opt-in under an app-supplied key. SQLCipher for records; chunked AES-256-GCM with HKDF-derived per-artifact subkeys for files, one 256 KB chunk in flight so memory is flat in artifact size. The package never generates, persists, caches beyond the handle, returns, or logs key material, and depends on no keychain library.
+- **Backup posture.** Excluded by default. Enforced on iOS via `NSURLIsExcludedFromBackupKey`; verified and reported on Android, where participation is manifest-owned and unreachable from a library that authors no native code.
+- **Typed diagnostics.** Twenty-nine stable `DiagnosticCode` values with `isCode` so no consumer parses a message. Disk-full, filesystem-access, and corruption stay distinct. Redaction happens at construction, so no error carries a payload, query parameter, scope component, or key material in any build.
+- **`./testing` entrypoint.** In-memory adapter, the conformance suite both adapters must pass identically, deterministic reset, seeding through production write paths, and fault injection for every diagnostic code.
+
+### Documented
+
+- Six knowing divergences between the in-memory and on-device adapters, in the README.
+- The full diagnostic table with recommended recovery per condition.
+- The FR-088 budgets, and which four are hard limits.
+- The consumer data-behaviour note: what is stored, where, what leaves the device (nothing), the at-rest and backup postures, and what scope deletion does and does not guarantee.
+
+### Semver impact
+
+New package at `0.1.0`. Nothing to migrate from.
+
+| Surface | Status | Notes |
+|---|---|---|
+| Lifecycle, records, query, transaction, batch | **Stable** | Breaking changes need a major |
+| Scope deletion and reset | **Stable** | |
+| Attachments including reconciliation | **Stable** | |
+| Diagnostic codes | **Stable, additive** | A new code is a minor; renaming one is breaking |
+| Encryption and key provider | **Experimental** | Field-level encryption and posture conversion may extend it |
+| Backup posture reporting | **Experimental** | The Android `observed` / `enforcedBy` shape may change as verification improves |
+| `StorageAdapter` interface | **Experimental** | Exported so the conformance suite is usable; not yet a stable extension point |
+| Testing entrypoint | **Experimental** | |
+
+Reserved as additive minors: reactive query subscriptions, field-level encryption, in-place encryption-posture conversion, further filter operators, and further diagnostic codes. Any change to the physical layout, the artifact format, or the encryption format ships with an internal migration or is breaking.
+
+### Known limitations
+
+- **Android backup exclusion cannot be enforced by this package.** It ships the exact configuration, verifies coverage at runtime, and reports the observed posture; the manifest entry is the app's.
+- **Encryption posture cannot be converted in place.** Export, delete the scope, re-import.
+- **A transaction never spans two scopes.** One database file per scope makes this a type error rather than a runtime one.
+- **No reactive subscriptions.** Queries are pull-based in this version.