@chipmobilesdk/rn-local-db 0.3.0 → 0.5.0

package/lib/typescript/module/contract/transaction.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Transactions and batches.
+ *
+ * A transaction never spans two scopes (FR-038): with one database file per
+ * scope, a cross-scope transaction is not expressible rather than merely
+ * discouraged.
+ */
+import type { FilterNode, Query, ResultPage } from './query.js';
+import type { RecordInput, StorableRecordData, StoredRecord, WriteOutcome } from './record.js';
+import type { Attachments } from './adapter.js';
+/** Collection operations, available on a handle and inside a transaction. */
+export type CollectionOps<T extends StorableRecordData = StorableRecordData> = {
+    insert(record: RecordInput<T>): Promise<WriteOutcome>;
+    update(id: string, record: Partial<RecordInput<T>> & {
+        data: T;
+    }): Promise<WriteOutcome>;
+    upsert(record: RecordInput<T>): Promise<WriteOutcome>;
+    /** Rejects with RECORD_NOT_FOUND when absent (FR-027). */
+    get(id: string): Promise<StoredRecord<T>>;
+    /** Null-returning variant, so absence stays distinguishable at the call site. */
+    find(id: string): Promise<StoredRecord<T> | null>;
+    delete(id: string): Promise<WriteOutcome>;
+    softDelete(id: string): Promise<WriteOutcome>;
+    restore(id: string): Promise<WriteOutcome>;
+    list(query?: Query): Promise<ResultPage<T>>;
+    count(filter?: FilterNode): Promise<number>;
+};
+export type Transaction = {
+    collection<T extends StorableRecordData = StorableRecordData>(name: string): CollectionOps<T>;
+    /**
+     * Attachments whose references join this transaction (FR-072): they roll
+     * back with it, and cascaded files are removed only once it commits. Added
+     * in 0.2.0 — the handle's own `attachments()` no longer reaches into an
+     * in-flight transaction.
+     */
+    attachments(): Attachments;
+    /** Discards every write in this transaction (FR-041). */
+    abort(): Promise<void>;
+};
+export type BatchOperation = {
+    type: 'insert';
+    collection: string;
+    record: RecordInput;
+} | {
+    type: 'update';
+    collection: string;
+    id: string;
+    data: StorableRecordData;
+} | {
+    type: 'upsert';
+    collection: string;
+    record: RecordInput;
+} | {
+    type: 'delete';
+    collection: string;
+    id: string;
+} | {
+    type: 'softDelete';
+    collection: string;
+    id: string;
+};
+export type BatchOutcome = {
+    applied: number;
+    outcomes: WriteOutcome[];
+};
+//# sourceMappingURL=transaction.d.ts.map

package/lib/typescript/module/contract/transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction.d.ts","sourceRoot":"","sources":["../../../../src/contract/transaction.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,YAAS,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAU,CAAC;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAW,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,kBAAkB,GAAG,kBAAkB,IAAI;IAC9E,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG;QAAE,IAAI,EAAE,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzF,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACtD,0DAA0D;IAC1D,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,iFAAiF;IACjF,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAClD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9C,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACzB,UAAU,CAAC,CAAC,SAAS,kBAAkB,GAAG,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC9F;;;;;OAKG;IACH,WAAW,IAAI,WAAW,CAAC;IAC3B,yDAAyD;IACzD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GACvB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,MAAM,YAAY,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,EAAE,CAAC;CACzB,CAAC"}

package/lib/typescript/module/crypto/chunked-cipher.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The chunked AES-256-GCM artifact format.
+ *
+ * Whole-file encryption was rejected because a 100 MB artifact would have to
+ * be held in memory twice — plaintext and ciphertext — which breaks FR-107a's
+ * flat memory bound and every PERF-001 budget along with it (research.md R4).
+ * Chunking keeps exactly one 256 KB chunk in flight regardless of artifact
+ * size.
+ *
+ * ```text
+ * [ header 22 bytes ] magic | format version | chunk size | chunk count | plaintext size
+ * [ chunk 0 ] ciphertext(≤ chunkSize) | auth tag (16)
+ * [ chunk 1 ] …
+ * ```
+ *
+ * The auth tag follows each chunk rather than sitting in the header, which is
+ * a deliberate departure from the sketch in storage-layout.md. A tag is only
+ * known after its chunk has been encrypted, and the filesystem peer appends —
+ * it cannot seek back to patch a header. Collecting every tag before writing
+ * anything would mean buffering the whole ciphertext, which is the thing this
+ * format exists to avoid. Inline tags keep the write append-only and leave
+ * every chunk at a computable offset.
+ *
+ * A failing tag on read is `ATTACHMENT_UNDECRYPTABLE`, deliberately distinct
+ * from `ATTACHMENT_MISSING` (FR-107c): one is a wrong key or a tampered file
+ * and may be recoverable, the other is data that is simply gone.
+ */
+export declare const MAGIC = "LDB1";
+export declare const FORMAT_VERSION = 1;
+export declare const HEADER_BYTES = 22;
+export declare const TAG_BYTES = 16;
+export declare const ALGORITHM = "aes-256-gcm";
+export type ArtifactHeader = {
+    formatVersion: number;
+    chunkSize: number;
+    chunkCount: number;
+    plaintextSize: number;
+};
+export declare function chunkCountFor(plaintextSize: number, chunkSize: number): number;
+export declare function encodeHeader(header: ArtifactHeader): Uint8Array;
+export declare function decodeHeader(bytes: Uint8Array): ArtifactHeader;
+/** Plaintext length of chunk `index`; the last one is usually short. */
+export declare function chunkPlaintextLength(header: ArtifactHeader, index: number): number;
+/**
+ * Byte offset of chunk `index` in the file.
+ *
+ * Every chunk but the last is full, so the offset is arithmetic rather than a
+ * table lookup — which is what lets a range read seek straight to the chunk
+ * it needs instead of walking the file.
+ */
+export declare function chunkOffset(header: ArtifactHeader, index: number): number;
+export declare function encryptedLength(header: ArtifactHeader): number;
+/** One chunk in, ciphertext with its tag appended out. */
+export declare function encryptChunk(key: Uint8Array, index: number, plaintext: Uint8Array): Uint8Array;
+export declare function decryptChunk(key: Uint8Array, index: number, stored: Uint8Array): Uint8Array;
+export declare function headerFor(plaintextSize: number, chunkSize?: number): ArtifactHeader;
+//# sourceMappingURL=chunked-cipher.d.ts.map

package/lib/typescript/module/crypto/chunked-cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunked-cipher.d.ts","sourceRoot":"","sources":["../../../../src/crypto/chunked-cipher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AASH,eAAO,MAAM,KAAK,SAAS,CAAC;AAC5B,eAAO,MAAM,cAAc,IAAI,CAAC;AAChC,eAAO,MAAM,YAAY,KAAK,CAAC;AAC/B,eAAO,MAAM,SAAS,KAAK,CAAC;AAC5B,eAAO,MAAM,SAAS,gBAAgB,CAAC;AAEvC,MAAM,MAAM,cAAc,GAAG;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,cAAc,GAAG,UAAU,CAe/D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,CAa9D;AAED,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGlF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAM9D;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAO9F;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAqB3F;AAED,wBAAgB,SAAS,CACxB,aAAa,EAAE,MAAM,EACrB,SAAS,SAA+B,GACtC,cAAc,CAOhB"}

package/lib/typescript/module/crypto/derive.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Per-artifact key derivation.
+ *
+ * The database key is handed straight to SQLCipher. Using that same material
+ * as the AES-GCM key for artifacts would mean the two keystreams share a
+ * secret, so a weakness in either one — a nonce collision in the artifact
+ * format, a padding oracle in the database format — becomes a weakness in
+ * both. HKDF costs one hash and removes the coupling entirely (research.md
+ * R4).
+ *
+ * The artifact id is the HKDF `info`, so two artifacts under the same
+ * database key derive different subkeys. That is what makes the deterministic
+ * nonce scheme safe: a nonce is only ever reused with a different key.
+ */
+/** 32 bytes, one artifact, one database key. */
+export declare function deriveArtifactKey(databaseKey: string, scopeKey: string, attachmentId: string): Uint8Array;
+/**
+ * Deterministic 12-byte nonce from the chunk index.
+ *
+ * Deterministic rather than random because a random nonce would have to be
+ * stored per chunk, and because uniqueness is already guaranteed one level
+ * up: the key is unique per artifact, so an index that is unique within the
+ * artifact is unique under that key. The remaining four bytes are a fixed
+ * domain tag rather than padding, so a nonce from this scheme can never
+ * collide with one from a future scheme that uses the same counter space.
+ */
+export declare function nonceForChunk(index: number): Uint8Array;
+//# sourceMappingURL=derive.d.ts.map

package/lib/typescript/module/crypto/derive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.d.ts","sourceRoot":"","sources":["../../../../src/crypto/derive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAaH,gDAAgD;AAChD,wBAAgB,iBAAiB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAClB,UAAU,CAWZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CASvD"}

package/lib/typescript/module/crypto/key-provider.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Key acquisition, scoped to one handle's lifetime.
+ *
+ * The package never generates, derives from its own material, persists,
+ * caches beyond the handle, transmits, or returns a key (FR-098). What it
+ * does is ask the app for one at open and hold it exactly as long as the
+ * connection that needs it — which is also why no keychain library appears in
+ * this package's dependencies (LIB-004).
+ *
+ * The provider receives the resolved scope, so an app can key per identity.
+ * That is not a convenience: it is what makes destroying one identity's key a
+ * meaningful answer to a deletion request, rather than a gesture that leaves
+ * the data readable under a shared key (FR-104).
+ */
+import type { EncryptionConfig } from '../contract/encryption.js';
+import type { ResolvedScope } from '../contract/scope.js';
+/**
+ * A key with an explicit end of life.
+ *
+ * Handing the string around directly would leave copies wherever it was
+ * passed. A handle that can be released gives the connection one place to
+ * drop it, and gives `key-hygiene.test.ts` something to assert against.
+ */
+export type KeyHandle = {
+    value(): string;
+    release(): void;
+    readonly released: boolean;
+};
+export declare function acquireKey(encryption: EncryptionConfig, scope: ResolvedScope): Promise<KeyHandle>;
+//# sourceMappingURL=key-provider.d.ts.map

package/lib/typescript/module/crypto/key-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-provider.d.ts","sourceRoot":"","sources":["../../../../src/crypto/key-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAmB,CAAC;AAIvD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG;IACvB,KAAK,IAAI,MAAM,CAAC;IAChB,OAAO,IAAI,IAAI,CAAC;IAChB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,wBAAsB,UAAU,CAC/B,UAAU,EAAE,gBAAgB,EAC5B,KAAK,EAAE,aAAa,GAClB,OAAO,CAAC,SAAS,CAAC,CAwCpB"}

package/lib/typescript/module/crypto/provider.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The cipher peer, behind one lazy accessor.
+ *
+ * Marked optional in `peerDependenciesMeta`: an app that never enables
+ * encryption should not have to install a native crypto module. That makes
+ * "the peer is absent" a supported state rather than a broken install, so it
+ * reports `ENCRYPTION_UNAVAILABLE` — the same code as a missing SQLCipher
+ * build flag, because from the app's side it is the same problem: encryption
+ * was asked for and cannot be delivered (research.md R1a).
+ */
+/**
+ * The two things this package asks of a cipher: AES-256-GCM for artifacts, and
+ * HKDF to derive each artifact's subkey. Hashing is not among them — the scope
+ * digest is SHA-256 in plain TypeScript (`scope/hash.ts`), because it runs on
+ * every scope resolution including the ones that never open an encrypted
+ * database, where a native module may not be installed at all (WS4-08).
+ */
+export type CipherModule = {
+    createCipheriv(algorithm: string, key: Uint8Array, iv: Uint8Array): {
+        update(data: Uint8Array): Uint8Array;
+        final(): Uint8Array;
+        getAuthTag(): Uint8Array;
+    };
+    createDecipheriv(algorithm: string, key: Uint8Array, iv: Uint8Array): {
+        update(data: Uint8Array): Uint8Array;
+        final(): Uint8Array;
+        setAuthTag(tag: Uint8Array): void;
+    };
+    hkdfSync(digest: string, key: Uint8Array, salt: Uint8Array, info: Uint8Array, length: number): ArrayBuffer;
+};
+/** Swap the module. Tests only; `null` goes back to the real one. */
+export declare function setCipherModule(module: CipherModule | null): void;
+export declare function isCipherAvailable(): boolean;
+export declare function cipherModule(): CipherModule;
+//# sourceMappingURL=provider.d.ts.map

package/lib/typescript/module/crypto/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../../src/crypto/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG;IAC1B,cAAc,CACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,GACZ;QACF,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;QACrC,KAAK,IAAI,UAAU,CAAC;QACpB,UAAU,IAAI,UAAU,CAAC;KACzB,CAAC;IACF,gBAAgB,CACf,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,GACZ;QACF,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;QACrC,KAAK,IAAI,UAAU,CAAC;QACpB,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CACP,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,MAAM,GACZ,WAAW,CAAC;CACf,CAAC;AAYF,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAEjE;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,wBAAgB,YAAY,IAAI,YAAY,CAQ3C"}

package/lib/typescript/module/diagnostics/dev-log.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Development-only diagnostics.
+ *
+ * Operation names, durations, and counts are safe to report. Record payloads,
+ * field values, and query parameters are not — in any build, including this
+ * one (FR-080, FR-081). There is deliberately no path here that accepts a
+ * payload, so a future caller cannot pass one by accident.
+ */
+export type DiagnosticEvent = {
+    operation: string;
+    durationMs?: number;
+    count?: number | undefined;
+    collection?: string;
+    adapter?: 'sqlite' | 'memory';
+    /** A diagnostic code when the operation failed. Never a message. */
+    outcome?: string;
+};
+export type DiagnosticLogger = (event: DiagnosticEvent) => void;
+/** Passing null removes the logger. */
+export declare function setDiagnosticLogger(next: DiagnosticLogger | null): void;
+export declare function logDiagnostic(event: DiagnosticEvent): void;
+export declare function isLogging(): boolean;
+/**
+ * Wrap a collection so every operation reports its name, duration, and result
+ * count — and nothing else.
+ *
+ * Wrapping once here rather than instrumenting each operation in the adapters
+ * is what keeps the guarantee checkable: there is one place that decides what
+ * a log line may contain, and it has no access to a payload to leak even if a
+ * future change wanted one. The wrapper is applied only when a logger is
+ * installed and the build is a development build, so a production bundle pays
+ * nothing and emits nothing (FR-081).
+ */
+export declare function instrument<T extends object>(collection: string, adapter: 'sqlite' | 'memory', operations: T): T;
+//# sourceMappingURL=dev-log.d.ts.map

package/lib/typescript/module/diagnostics/dev-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-log.d.ts","sourceRoot":"","sources":["../../../../src/diagnostics/dev-log.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,MAAM,eAAe,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC9B,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;AAIhE,uCAAuC;AACvC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAEvE;AAkBD,wBAAgB,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAY1D;AAED,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,EAC1C,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,QAAQ,GAAG,QAAQ,EAC5B,UAAU,EAAE,CAAC,GACX,CAAC,CAuCH"}

package/lib/typescript/module/diagnostics/errors.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The single error type the package raises.
+ *
+ * Everything is redacted on the way in (see redact.ts), so there is no path
+ * by which a field value, query parameter, scope component, or key reaches an
+ * error object at all.
+ */
+import { SdkError } from '@chipmobilesdk/rn-core';
+import { DiagnosticCodes, type DiagnosticCode } from '../contract/errors.js';
+import type { MigrationFailureDetail } from '../contract/migration.js';
+export type StorageErrorInit = {
+    /**
+     * A message this package authored. Never foreign text — a native or
+     * consumer-thrown message goes in `cause`, which reduces it to an
+     * identifier. `authored-messages.test.ts` checks every call site.
+     */
+    message?: string;
+    detail?: Record<string, unknown> | undefined;
+    migration?: MigrationFailureDetail | undefined;
+    cause?: unknown;
+};
+/** The package's error; an `SdkError` (`@chipmobilesdk/rn-core`) with `pkg: 'rn-local-db'`. */
+export declare class StorageError extends SdkError<DiagnosticCode> {
+    readonly detail?: Record<string, string | number | boolean> | undefined;
+    readonly migration?: MigrationFailureDetail | undefined;
+    constructor(code: DiagnosticCode, init?: StorageErrorInit);
+}
+export declare function isStorageError(value: unknown): value is StorageError;
+/** So no consumer ever has to parse a message string (FR-082). */
+export declare function isCode(value: unknown, code: DiagnosticCode): boolean;
+export declare function raise(code: DiagnosticCode, init?: StorageErrorInit): never;
+export { DiagnosticCodes };
+export type { DiagnosticCode };
+//# sourceMappingURL=errors.d.ts.map

package/lib/typescript/module/diagnostics/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/diagnostics/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAmB,KAAK,cAAc,EAAE,MAAM,uBAAoB,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAAuB,CAAC;AAGpE,MAAM,MAAM,gBAAgB,GAAG;IAC9B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC7C,SAAS,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,+FAA+F;AAC/F,qBAAa,YAAa,SAAQ,QAAQ,CAAC,cAAc,CAAC;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;gBAE5C,IAAI,EAAE,cAAc,EAAE,IAAI,GAAE,gBAAqB;CAe7D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED,kEAAkE;AAClE,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAEpE;AAED,wBAAgB,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAE1E;AAED,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,YAAY,EAAE,cAAc,EAAE,CAAC"}

package/lib/typescript/module/diagnostics/faults.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The fault registry.
+ *
+ * It lives here rather than under `testing/` because FR-095 wants every
+ * documented failure reachable from a real app running the real adapter — the
+ * demo's fault-injection panel exercises the on-device path, not a simulation
+ * of it. So the check has to exist in production code.
+ *
+ * What does *not* exist in production code is a way to inject: `injectFault`
+ * and `clearFaults` are exported only from the `./testing` entrypoint. With
+ * nothing injected this is one lookup in an empty map, which is the price of
+ * being able to prove a recovery path works before a user finds it broken.
+ */
+import type { DiagnosticCode } from '../contract/errors.js';
+export type FaultPoint = 'open' | 'read' | 'write' | 'commit' | 'migration' | 'attachmentWrite' | 'keyProvider';
+export type FaultSpec = {
+    at: FaultPoint;
+    code: DiagnosticCode;
+    /** Fire this many times, then stop. Omit for "until cleared". */
+    times?: number;
+};
+export declare function injectFault(spec: FaultSpec): void;
+export declare function clearFaults(): void;
+export declare function activeFaults(): FaultPoint[];
+export declare function throwIfFaulted(point: FaultPoint): void;
+//# sourceMappingURL=faults.d.ts.map

package/lib/typescript/module/diagnostics/faults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"faults.d.ts","sourceRoot":"","sources":["../../../../src/diagnostics/faults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAoB,CAAC;AAGzD,MAAM,MAAM,UAAU,GACrB,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,aAAa,CAAC;AAExF,MAAM,MAAM,SAAS,GAAG;IACvB,EAAE,EAAE,UAAU,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IACrB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAIF,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAKjD;AAED,wBAAgB,WAAW,IAAI,IAAI,CAElC;AAED,wBAAgB,YAAY,IAAI,UAAU,EAAE,CAE3C;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAatD"}

package/lib/typescript/module/diagnostics/map-native.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Native error to diagnostic code.
+ *
+ * The three failures FR-076 insists stay apart — a full disk, a filesystem
+ * the app cannot reach, and a corrupt database — arrive from SQLite and from
+ * the filesystem peer as ordinary errors with a string on them. Collapsing
+ * them into one write failure would be the easy thing and the wrong one: an
+ * app frees space for the first, retries after unlock for the second, and has
+ * to offer a reset for the third.
+ *
+ * Only the code is derived here. The message never travels — it is redacted
+ * at construction by `StorageError` (FR-079).
+ */
+import { type DiagnosticCode } from '../contract/errors.js';
+export type NativeContext = {
+    /** Where the failure happened, so ambiguous signatures resolve correctly. */
+    operation: 'open' | 'read' | 'write' | 'transaction' | 'attachment' | 'delete';
+    /**
+     * Whether the database was opened with a key. "File is not a database" is
+     * SQLCipher's answer to a wrong key and SQLite's answer to a corrupt file;
+     * the only thing that separates them is whether a key was in play.
+     */
+    encrypted?: boolean;
+};
+export declare function mapNativeError(error: unknown, context: NativeContext): DiagnosticCode;
+/**
+ * Re-raise a native failure as a typed one, preserving an error the package
+ * already classified rather than reclassifying it as a generic write failure.
+ */
+export declare function raiseNative(error: unknown, context: NativeContext): never;
+//# sourceMappingURL=map-native.d.ts.map

package/lib/typescript/module/diagnostics/map-native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"map-native.d.ts","sourceRoot":"","sources":["../../../../src/diagnostics/map-native.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,uBAAoB,CAAC;AAG1E,MAAM,MAAM,aAAa,GAAG;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC/E;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAqBF,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,GAAG,cAAc,CA0CrF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,GAAG,KAAK,CAYzE"}

package/lib/typescript/module/diagnostics/redact.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Redaction, applied at construction rather than at logging time.
+ *
+ * The distinction matters: an error object that never held a payload cannot
+ * leak one through a consumer's crash reporter, which is where these leaks
+ * actually happen in practice. Redacting on the way out of a logger would
+ * still leave the values sitting on the object for anything else to pick up
+ * (FR-079, FR-099).
+ */
+/**
+ * The allowlist IS the mechanism. Every key here has been reviewed as
+ * incapable of carrying user data: identifiers the app already knows, sizes,
+ * counts, and version numbers.
+ *
+ * A denylist was tried and removed. It rejected `recordId` because the name
+ * contains "record", which is the failure mode denylists always have — they
+ * guess from names. A closed allowlist cannot guess, and adding to it is a
+ * deliberate act with a reviewer attached.
+ */
+export declare const SAFE_DETAIL_KEYS: Set<string>;
+/**
+ * Reduce foreign text to an identifier, or to nothing.
+ *
+ * "Foreign" means text this package did not author: a SQLite message, a
+ * filesystem error, an `Error` a consumer's own migration threw. Any of them
+ * can contain anything — SQLite quotes bound parameters back, and a migration
+ * that fails on a constraint routinely names the value that violated it.
+ *
+ * An earlier version of this tried to keep the readable part: the text before
+ * the first colon, if it "looked like a class of failure". That heuristic
+ * fails on the case that matters. `Patient reported chest pain` looks exactly
+ * like a class of failure — short, no punctuation, no digits — and is a
+ * medical record. There is no shape test that separates prose describing a
+ * failure from prose describing a person, so there is no version of the
+ * heuristic worth keeping.
+ *
+ * What survives is a leading `SQLITE_*` / `ENOENT`-style identifier, which is
+ * a closed vocabulary of engine and libc constants and cannot be a value.
+ * Everything else becomes `[redacted]`. A developer who needs more can
+ * reproduce with the development logger; a crash report cannot.
+ */
+export declare function redactForeignText(text: string): string;
+/**
+ * A message this package wrote itself.
+ *
+ * Every `raise()` call site passes a string literal, and the handful that
+ * interpolate do so with a value from a closed set — an operator name, a
+ * fault point, a sanitized identifier. `authored-messages.test.ts` enforces
+ * that mechanically against the source, so this is a checked property rather
+ * than a convention someone has to remember.
+ *
+ * So no filtering happens here: filtering a message the package wrote would
+ * destroy the only readable part of the error for no gain. Foreign text never
+ * reaches this function — it goes through `redactForeignText` above.
+ */
+export declare function sanitizeAuthoredMessage(message: string): string;
+/**
+ * Reduce a consumer-supplied identifier to a bounded, punctuation-free token.
+ *
+ * A field name is worth naming — FR-034 exists so a typo is distinguishable
+ * from a deliberate choice, and "which field?" is the whole answer. But the
+ * name arrives from the consumer, so it is capped and stripped rather than
+ * trusted verbatim.
+ */
+export declare function sanitizeIdentifier(identifier: string): string;
+/** Keep only keys on the allowlist, and only primitive values. */
+export declare function redactDetail(detail: Record<string, unknown> | undefined): Record<string, string | number | boolean> | undefined;
+/** Reduce an unknown thrown value to a message-shaped string, redacted. */
+export declare function redactCause(cause: unknown): string | undefined;
+//# sourceMappingURL=redact.d.ts.map

package/lib/typescript/module/diagnostics/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../../../src/diagnostics/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,aAiB3B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED,kEAAkE;AAClE,wBAAgB,YAAY,CAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACzC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,SAAS,CAGvD;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAW9D"}

package/lib/typescript/module/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `@chipmobilesdk/rn-local-db`
+ *
+ * Offline-first, scope-isolated local storage for ChipMobileSdk apps.
+ *
+ * What is deliberately absent is part of the contract: there is no
+ * `switchScope`, and no read, write, or query operation accepts a scope
+ * argument. Scope is bound to a handle at open time and immutable, so a
+ * cross-scope leak is not expressible rather than merely prevented.
+ *
+ * The underlying engine, the physical layout, key material, and the query
+ * translation are private and unreachable by deep import.
+ */
+export { deleteDatabase, deleteScopeData, openDatabase, resetScope } from './adapter/index.js';
+export { DiagnosticCodes, StorageError, isCode, isStorageError } from './diagnostics/errors.js';
+export { setDiagnosticLogger, type DiagnosticLogger } from './diagnostics/dev-log.js';
+export { Budgets } from './contract/config.js';
+export type { DatabaseConfig, DatabaseTargetConfig, ScopeTargetConfig } from './contract/config.js';
+export type { ResolvedScope, ScopeDescriptor, ScopeKind } from './contract/scope.js';
+export type { CollectionSchema, FieldDeclaration, FieldType, IndexDeclaration, } from './contract/schema.js';
+export type { RecordInput, StorableRecordData, StorableValue, StoredRecord, WriteOperation, WriteOutcome, } from './contract/record.js';
+export type { ComparisonNode, FilterNode, FilterValue, IndexCoverageReport, LogicalNode, PageRequest, Query, ResultPage, SortDirection, SortKey, } from './contract/query.js';
+export type { BatchOperation, BatchOutcome, CollectionOps, Transaction, } from './contract/transaction.js';
+export type { Migration, MigrationContext, MigrationFailureDetail, MigrationLedgerEntry, MigrationOutcome, } from './contract/migration.js';
+export type { AttachmentAvailability, AttachmentAvailabilityState, AttachmentInput, AttachmentOwner, AttachmentReference, ByteRange, DeletionOutcome, ReconciliationReport, } from './contract/attachment.js';
+export type { EncryptionConfig, EncryptionPosture, KeyProvider } from './contract/encryption.js';
+export type { BackupConfig, BackupPostureValue, EffectivePosture } from './contract/backup.js';
+export type { DiagnosticCode } from './contract/errors.js';
+export type { Attachments, DatabaseHandle, StorageAdapter } from './contract/adapter.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAW,CAAC;AAGtF,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,yBAAsB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,MAAM,0BAAuB,CAAC;AAGnF,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAmB,CAAC;AAG5C,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,sBAAmB,CAAC;AACjG,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,qBAAkB,CAAC;AAClF,YAAY,EACX,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,gBAAgB,GAChB,MAAM,sBAAmB,CAAC;AAC3B,YAAY,EACX,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,YAAY,GACZ,MAAM,sBAAmB,CAAC;AAC3B,YAAY,EACX,cAAc,EACd,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,KAAK,EACL,UAAU,EACV,aAAa,EACb,OAAO,GACP,MAAM,qBAAkB,CAAC;AAC1B,YAAY,EACX,cAAc,EACd,YAAY,EACZ,aAAa,EACb,WAAW,GACX,MAAM,2BAAwB,CAAC;AAChC,YAAY,EACX,SAAS,EACT,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,GAChB,MAAM,yBAAsB,CAAC;AAC9B,YAAY,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,oBAAoB,GACpB,MAAM,0BAAuB,CAAC;AAC/B,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,0BAAuB,CAAC;AAC9F,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,sBAAmB,CAAC;AAC5F,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAmB,CAAC;AACxD,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAoB,CAAC"}

package/lib/typescript/module/migration/executor.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The migration executor.
+ *
+ * Four rules, each of which exists because the alternative loses data:
+ *
+ * - **Ascending, and pending only.** A migration whose version is at or below
+ *   the recorded one has already run against this scope (FR-047, FR-049).
+ * - **One transaction per migration.** A failure unwinds that migration and
+ *   nothing else, so the recorded version and the data always agree.
+ * - **The recorded version moves only on success**, inside the same
+ *   transaction as the migration's own writes. Writing it separately would
+ *   leave a window where a crash records a migration that did not happen.
+ * - **A failure returns no handle** (FR-050). Half-migrated data behind a
+ *   working handle is the failure this whole design exists to prevent, and it
+ *   is worse than being unable to open at all: the app writes to it.
+ *
+ * A retry starts from the same version rather than skipping ahead (FR-051),
+ * which is what makes a transient failure — a locked keychain, a full disk
+ * mid-migration — recoverable on the next launch instead of permanent.
+ */
+import type { DatabaseConfig } from '../contract/config.js';
+import type { CollectionSchema } from '../contract/schema.js';
+import type { Connection } from '../sqlite/connection.js';
+export type MigrationRunContext = {
+    connection: Connection;
+    config: DatabaseConfig;
+    schemaFor(name: string): CollectionSchema;
+    now(): number;
+    /**
+     * Called before a migration failure is raised. The executor does not own
+     * the connection, so it asks rather than closing directly — but the close
+     * has to happen before the error escapes, or a caller catching it could
+     * still be holding something usable (FR-050).
+     */
+    closeOnFailure(): Promise<void>;
+    /** The bookkeeping tables are known to exist, so creating them is skipped (LDB-07). */
+    ledgerReady?: boolean;
+};
+export declare function runMigrations(context: MigrationRunContext): Promise<number>;
+//# sourceMappingURL=executor.d.ts.map

package/lib/typescript/module/migration/executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../../../src/migration/executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAoB,CAAC;AAIzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAoB,CAAC;AAK3D,OAAO,KAAK,EAAE,UAAU,EAAY,MAAM,yBAAsB,CAAC;AAUjE,MAAM,MAAM,mBAAmB,GAAG;IACjC,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC1C,GAAG,IAAI,MAAM,CAAC;IACd;;;;;OAKG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,uFAAuF;IACvF,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AA4BF,wBAAsB,aAAa,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsEjF"}

package/lib/typescript/module/migration/ledger.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The per-scope migration ledger.
+ *
+ * Per scope, not per database, and that is the whole reason FR-054 works: a
+ * scope created after a migration shipped starts at version 0 and is migrated
+ * on first open, rather than being assumed current because some other scope
+ * already ran the chain.
+ *
+ * The ledger records a **code**, never a message (FR-079). A migration that
+ * failed because a domain constraint was violated could otherwise write the
+ * offending value into a table that outlives the failure — a payload leak
+ * with a long half-life, sitting in a file the next crash report might carry.
+ */
+import type { MigrationOutcome } from '../contract/migration.js';
+import type { Executor } from '../sqlite/connection.js';
+/** Physical layout version, independent of the app's schema version. */
+export declare const FORMAT_VERSION = 1;
+export declare function ensureLedger(executor: Executor): Promise<void>;
+export type RecordedVersions = {
+    /** The app's schema version this scope has been migrated to. */
+    schema: number;
+    /** The physical layout this package wrote the file with. */
+    format: number;
+};
+/** Both versions in one read: every open asks for them. */
+export declare function readVersions(executor: Executor): Promise<RecordedVersions>;
+export declare function writeSchemaVersion(executor: Executor, version: number): Promise<void>;
+export declare function recordAttempt(executor: Executor, entry: {
+    version: number;
+    attemptedAt: number;
+    outcome: MigrationOutcome;
+    failureCode?: string;
+}): Promise<void>;
+//# sourceMappingURL=ledger.d.ts.map

package/lib/typescript/module/migration/ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../../src/migration/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAsB,CAAC;AAGrD,wEAAwE;AACxE,eAAO,MAAM,cAAc,IAAI,CAAC;AAchC,wBAAsB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAWpE;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC9B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,2DAA2D;AAC3D,wBAAsB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAShF;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3F;AAED,wBAAsB,aAAa,CAClC,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9F,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/lib/typescript/module/migration/validate-chain.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Migration chain validation, run before any migration executes (FR-053).
+ *
+ * Validating first is what stops a half-run chain from being the thing that
+ * discovers the problem. A duplicate version, a gap, or a chain that does not
+ * reach the declared `schemaVersion` are all configuration errors the
+ * developer can fix; discovering them after migration 3 of 5 has already
+ * rewritten a user's data is not.
+ *
+ * A gap is refused rather than skipped over deliberately. A user upgrading
+ * from the version inside the gap has no path across it, and opening anyway
+ * would hand them a database the code believes is current and is not.
+ */
+import type { DatabaseConfig } from '../contract/config.js';
+import type { Migration } from '../contract/migration.js';
+export declare function validateMigrationChain(config: DatabaseConfig): void;
+/** Ascending, because the order a consumer declared them in is not a contract. */
+export declare function orderedMigrations(config: DatabaseConfig): Migration[];
+export declare function pendingMigrations(config: DatabaseConfig, recordedVersion: number): Migration[];
+//# sourceMappingURL=validate-chain.d.ts.map

package/lib/typescript/module/migration/validate-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-chain.d.ts","sourceRoot":"","sources":["../../../../src/migration/validate-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAAuB,CAAC;AAOvD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAgCnE;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,EAAE,CAErE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,EAAE,CAE9F"}

package/lib/typescript/module/package.json

@@ -0,0 +1 @@
+{"type":"module"}