@chipmobilesdk/rn-local-db 0.3.0 → 0.5.0

package/lib/commonjs/adapter/schema-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_store","require","_rowCodec","_values","DDL_VERSION","FINGERPRINT_KEY","fingerprintOf","config","JSON","stringify","collections","appliedFingerprint","connection","result","execute","row","rows","text","value","definitionOf","sql","unique","test","columns","slice","lastIndexOf","replace","syncIndexes","schema","table","name","existing","current","Map","map","wanted","createIndexSql","statement","exec","index","indexes","has","physicalIndexName","get","ours","startsWith","undefined","values","ensureCollection","createTableSql","info","present","Set","field","fields","column","addColumnSql","path","syncSchema","fingerprint","unchanged","record","ensureAttachmentTable"],"sourceRoot":"../../../src","sources":["adapter/schema-sync.ts"],"mappings":";;;;;;AAWA,IAAAA,MAAA,GAAAC,OAAA;AAEA,IAAAC,SAAA,GAAAD,OAAA;AAMA,IAAAE,OAAA,GAAAF,OAAA;AAnBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAaA;AACA,MAAMG,WAAW,GAAG,CAAC;AACrB,MAAMC,eAAe,GAAG,oBAAoB;;AAE5C;AACA,SAASC,aAAaA,CAACC,MAAsB,EAAU;EACtD,OAAOC,IAAI,CAACC,SAAS,CAAC,CAACL,WAAW,EAAEG,MAAM,CAACG,WAAW,CAAC,CAAC;AACzD;AAEA,eAAeC,kBAAkBA,CAACC,UAAsB,EAA0B;EACjF,IAAI;IACH,MAAMC,MAAM,GAAG,MAAMD,UAAU,CAACE,OAAO,CAAC,uCAAuC,EAAE,CAChFT,eAAe,CACf,CAAC;IACF,MAAMU,GAAG,GAAGF,MAAM,CAACG,IAAI,CAAC,CAAC,CAAC;IAC1B,OAAOD,GAAG,GAAG,IAAAE,YAAI,EAACF,GAAG,CAACG,KAAK,CAAC,GAAG,IAAI;EACpC,CAAC,CAAC,MAAM;IACP;IACA,OAAO,IAAI;EACZ;AACD;;AAEA;AACA,SAASC,YAAYA,CAACC,GAAW,EAAU;EAC1C,MAAMC,MAAM,GAAG,wBAAwB,CAACC,IAAI,CAACF,GAAG,CAAC;EACjD,MAAMG,OAAO,GAAGH,GAAG,CAACI,KAAK,CAACJ,GAAG,CAACK,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAEL,GAAG,CAACK,WAAW,CAAC,GAAG,CAAC,CAAC,CAACC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;EAC/F,OAAO,GAAGL,MAAM,GAAG,QAAQ,GAAG,OAAO,IAAIE,OAAO,EAAE;AACnD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeI,WAAWA,CAACf,UAAsB,EAAEgB,MAAwB,EAAiB;EAC3F,MAAMC,KAAK,GAAG,KAAKD,MAAM,CAACE,IAAI,EAAE;EAChC,MAAMC,QAAQ,GAAG,MAAMnB,UAAU,CAACE,OAAO,CACxC,+FAA+F,EAC/F,CAACe,KAAK,CACP,CAAC;EACD,MAAMG,OAAO,GAAG,IAAIC,GAAG,CAACF,QAAQ,CAACf,IAAI,CAACkB,GAAG,CAACnB,GAAG,IAAI,CAAC,IAAAE,YAAI,EAACF,GAAG,CAACe,IAAI,CAAC,EAAE,IAAAb,YAAI,EAACF,GAAG,CAACK,GAAG,CAAC,CAAC,CAAC,CAAC;EAClF,MAAMe,MAAM,GAAG,IAAIF,GAAG,CACrB,IAAAG,wBAAc,EAACR,MAAM,CAAC,CAACM,GAAG,CAACG,SAAS,IAAI;IACvC,MAAMP,IAAI,GAAG,+BAA+B,CAACQ,IAAI,CAACD,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;IACvE,OAAO,CAACP,IAAI,EAAEO,SAAS,CAAC;EACzB,CAAC,CACF,CAAC;EAED,KAAK,MAAME,KAAK,IAAIX,MAAM,CAACY,OAAO,IAAI,EAAE,EAAE;IACzC;IACA;IACA,IAAIR,OAAO,CAACS,GAAG,CAACF,KAAK,CAACT,IAAI,CAAC,IAAIS,KAAK,CAACT,IAAI,KAAK,IAAAY,2BAAiB,EAACd,MAAM,EAAEW,KAAK,CAACT,IAAI,CAAC,EAAE;MACpF,MAAMlB,UAAU,CAACE,OAAO,CAAC,yBAAyByB,KAAK,CAACT,IAAI,GAAG,CAAC;IACjE;EACD;EACA,KAAK,MAAM,CAACA,IAAI,EAAEV,GAAG,CAAC,IAAIY,OAAO,EAAE;IAClC,MAAMK,SAAS,GAAGF,MAAM,CAACQ,GAAG,CAACb,IAAI,CAAC;IAClC,MAAMc,IAAI,GAAGd,IAAI,CAACe,UAAU,CAAC,GAAGhB,KAAK,IAAI,CAAC;IAC1C,IACEQ,SAAS,KAAKS,SAAS,IAAIF,IAAI,IAC/BP,SAAS,IAAIlB,YAAY,CAACkB,SAAS,CAAC,KAAKlB,YAAY,CAACC,GAAG,CAAE,EAC3D;MACD,MAAMR,UAAU,CAACE,OAAO,CAAC,yBAAyBgB,IAAI,GAAG,CAAC;IAC3D;EACD;EACA,KAAK,MAAMO,SAAS,IAAIF,MAAM,CAACY,MAAM,CAAC,CAAC,EAAE;IACxC,MAAMnC,UAAU,CAACE,OAAO,CAACuB,SAAS,CAAC;EACpC;AACD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,eAAeW,gBAAgBA,CAACpC,UAAsB,EAAEgB,MAAwB,EAAiB;EAChG,MAAMhB,UAAU,CAACE,OAAO,CAAC,IAAAmC,wBAAc,EAACrB,MAAM,CAAC,CAAC;EAEhD,MAAMsB,IAAI,GAAG,MAAMtC,UAAU,CAACE,OAAO,CAAC,wBAAwBc,MAAM,CAACE,IAAI,IAAI,CAAC;EAC9E,MAAMqB,OAAO,GAAG,IAAIC,GAAG,CAACF,IAAI,CAAClC,IAAI,CAACkB,GAAG,CAACnB,GAAG,IAAI,IAAAE,YAAI,EAACF,GAAG,CAACe,IAAI,CAAC,CAAC,CAAC;EAE7D,KAAK,MAAMuB,KAAK,IAAIzB,MAAM,CAAC0B,MAAM,IAAI,EAAE,EAAE;IACxC,MAAMC,MAAM,GAAG,KAAKF,KAAK,CAACvB,IAAI,EAAE;IAChC,IAAIqB,OAAO,CAACV,GAAG,CAACc,MAAM,CAAC,EAAE;MACxB;IACD;IACA,MAAM3C,UAAU,CAACE,OAAO,CAAC,IAAA0C,sBAAY,EAAC5B,MAAM,EAAEyB,KAAK,CAAC,CAAC;IACrD;IACA;IACA;IACA,MAAMI,IAAI,GAAG,OAAOJ,KAAK,CAACvB,IAAI,IAAI;IAClC,MAAMlB,UAAU,CAACE,OAAO,CACvB,aAAac,MAAM,CAACE,IAAI,UAAUyB,MAAM,oCAAoCE,IAAI,iEAAiEA,IAAI,OACtJ,CAAC;EACF;EAEA,MAAM9B,WAAW,CAACf,UAAU,EAAEgB,MAAM,CAAC;AACtC;AASO,eAAe8B,UAAUA,CAC/B9C,UAAsB,EACtBL,MAAsB,EACA;EACtB,MAAMoD,WAAW,GAAGrD,aAAa,CAACC,MAAM,CAAC;EACzC,IAAI,CAAC,MAAMI,kBAAkB,CAACC,UAAU,CAAC,MAAM+C,WAAW,EAAE;IAC3D,OAAO;MAAEC,SAAS,EAAE,IAAI;MAAEC,MAAM,EAAE,MAAAA,CAAA,KAAYf;IAAU,CAAC;EAC1D;EAEA,KAAK,MAAMlB,MAAM,IAAIrB,MAAM,CAACG,WAAW,EAAE;IACxC,MAAMsC,gBAAgB,CAACpC,UAAU,EAAEgB,MAAM,CAAC;EAC3C;EACA,MAAM,IAAAkC,4BAAqB,EAAClD,UAAU,CAAC;EAEvC,OAAO;IACNgD,SAAS,EAAE,KAAK;IAChB,MAAMC,MAAMA,CAAA,EAAG;MACd,MAAMjD,UAAU,CAACE,OAAO,CACvB,oGAAoG,EACpG,CAACT,eAAe,EAAEsD,WAAW,CAC9B,CAAC;IACF;EACD,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/adapter/transaction.js

@@ -0,0 +1,58 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createTransaction = createTransaction;
+var _errors = require("../contract/errors.js");
+var _errors2 = require("../diagnostics/errors.js");
+/**
+ * The `Transaction` a consumer actually holds.
+ *
+ * Two rules live here rather than in either adapter, so both are held to the
+ * same standard:
+ *
+ * **Read-your-own-writes** (FR-043). Every collection reached through `tx`
+ * runs against the transaction's executor, so a read inside sees the writes
+ * made inside. A collection reached through the handle during a transaction
+ * would not, and handing one out would be a quiet correctness trap.
+ *
+ * **Terminal state is terminal** (FR-044). After a commit or an abort, using
+ * the transaction raises rather than silently writing outside it — the
+ * failure mode where a caller's cleanup code lands in the database after the
+ * rollback it was supposed to be part of.
+ */
+
+function createTransaction(host) {
+  let settled = false;
+  const assertLive = () => {
+    if (settled) {
+      (0, _errors2.raise)(_errors.DiagnosticCodes.TRANSACTION_STATE, {
+        message: 'transaction already settled'
+      });
+    }
+  };
+  const transaction = {
+    collection(name) {
+      assertLive();
+      return host.collection(name);
+    },
+    attachments() {
+      assertLive();
+      return host.attachments();
+    },
+    async abort() {
+      assertLive();
+      settled = true;
+      await host.rollback();
+    }
+  };
+  return {
+    transaction,
+    isSettled: () => settled,
+    settle: () => {
+      settled = true;
+    }
+  };
+}
+//# sourceMappingURL=transaction.js.map

package/lib/commonjs/adapter/transaction.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_errors","require","_errors2","createTransaction","host","settled","assertLive","raise","DiagnosticCodes","TRANSACTION_STATE","message","transaction","collection","name","attachments","abort","rollback","isSettled","settle"],"sourceRoot":"../../../src","sources":["adapter/transaction.ts"],"mappings":";;;;;;AAiBA,IAAAA,OAAA,GAAAC,OAAA;AAIA,IAAAC,QAAA,GAAAD,OAAA;AArBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAqBO,SAASE,iBAAiBA,CAACC,IAAqB,EAAsB;EAC5E,IAAIC,OAAO,GAAG,KAAK;EAEnB,MAAMC,UAAU,GAAGA,CAAA,KAAY;IAC9B,IAAID,OAAO,EAAE;MACZ,IAAAE,cAAK,EAACC,uBAAe,CAACC,iBAAiB,EAAE;QACxCC,OAAO,EAAE;MACV,CAAC,CAAC;IACH;EACD,CAAC;EAED,MAAMC,WAAwB,GAAG;IAChCC,UAAUA,CAA+BC,IAAY,EAAoB;MACxEP,UAAU,CAAC,CAAC;MACZ,OAAOF,IAAI,CAACQ,UAAU,CAAIC,IAAI,CAAC;IAChC,CAAC;IACDC,WAAWA,CAAA,EAAgB;MAC1BR,UAAU,CAAC,CAAC;MACZ,OAAOF,IAAI,CAACU,WAAW,CAAC,CAAC;IAC1B,CAAC;IACD,MAAMC,KAAKA,CAAA,EAAkB;MAC5BT,UAAU,CAAC,CAAC;MACZD,OAAO,GAAG,IAAI;MACd,MAAMD,IAAI,CAACY,QAAQ,CAAC,CAAC;IACtB;EACD,CAAC;EAED,OAAO;IACNL,WAAW;IACXM,SAAS,EAAEA,CAAA,KAAMZ,OAAO;IACxBa,MAAM,EAAEA,CAAA,KAAM;MACbb,OAAO,GAAG,IAAI;IACf;EACD,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/artifacts/availability.js

@@ -0,0 +1,90 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.artifactAvailability = artifactAvailability;
+var _fs = require("../platform/fs.js");
+var _bytes = require("../platform/bytes.js");
+var _chunkedCipher = require("../crypto/chunked-cipher.js");
+var _paths = require("./paths.js");
+var _store = require("./store.js");
+/**
+ * "Is this artifact still there?", answered without opening it.
+ *
+ * `stat()` and, for an encrypted artifact, the 22-byte header. Never a
+ * content byte and never a decryption (FR-073e, FR-107b). An availability
+ * check that decrypted would make a gallery screen showing fifty thumbnails
+ * decrypt fifty artifacts to answer a question none of them asked, and would
+ * put key material in play for an operation that does not need it.
+ *
+ * The four states are deliberately four rather than two. `missing` is data
+ * that is gone; `undecryptable` is data that exists under a key that does not
+ * open it, which is often recoverable and always a different conversation to
+ * have with the user (FR-107c).
+ */
+
+async function artifactAvailability(context, executor, id) {
+  const reference = await (0, _store.readReference)(executor, id);
+  if (!reference) {
+    // No reference is "missing" rather than an error: the caller asked
+    // about an artifact this scope does not claim to have.
+    return {
+      id,
+      state: 'missing'
+    };
+  }
+  const path = (0, _paths.artifactPath)(context.layout, context.scopeKey, id);
+  let size;
+  try {
+    const stat = await (0, _fs.fileSystem)().stat(path);
+    if (!stat.isFile()) {
+      return {
+        id,
+        state: 'inaccessible'
+      };
+    }
+    size = stat.size;
+  } catch {
+    return {
+      id,
+      state: 'missing'
+    };
+  }
+  if (context.artifactKey(id) === null) {
+    return {
+      id,
+      state: 'available',
+      size: reference.size
+    };
+  }
+  if (size < _chunkedCipher.HEADER_BYTES) {
+    return {
+      id,
+      state: 'undecryptable',
+      size: reference.size
+    };
+  }
+  try {
+    const header = (0, _bytes.base64ToBytes)(await (0, _fs.fileSystem)().read(path, _chunkedCipher.HEADER_BYTES, 0, 'base64'));
+    if ((0, _bytes.asciiAt)(header, 0, 4) !== _chunkedCipher.MAGIC) {
+      return {
+        id,
+        state: 'undecryptable',
+        size: reference.size
+      };
+    }
+  } catch {
+    return {
+      id,
+      state: 'inaccessible',
+      size: reference.size
+    };
+  }
+  return {
+    id,
+    state: 'available',
+    size: reference.size
+  };
+}
+//# sourceMappingURL=availability.js.map

package/lib/commonjs/artifacts/availability.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_fs","require","_bytes","_chunkedCipher","_paths","_store","artifactAvailability","context","executor","id","reference","readReference","state","path","artifactPath","layout","scopeKey","size","stat","fileSystem","isFile","artifactKey","HEADER_BYTES","header","base64ToBytes","read","asciiAt","MAGIC"],"sourceRoot":"../../../src","sources":["artifacts/availability.ts"],"mappings":";;;;;;AAgBA,IAAAA,GAAA,GAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AACA,IAAAE,cAAA,GAAAF,OAAA;AAEA,IAAAG,MAAA,GAAAH,OAAA;AACA,IAAAI,MAAA,GAAAJ,OAAA;AArBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAUO,eAAeK,oBAAoBA,CACzCC,OAAwB,EACxBC,QAAkB,EAClBC,EAAU,EACwB;EAClC,MAAMC,SAAS,GAAG,MAAM,IAAAC,oBAAa,EAACH,QAAQ,EAAEC,EAAE,CAAC;EACnD,IAAI,CAACC,SAAS,EAAE;IACf;IACA;IACA,OAAO;MAAED,EAAE;MAAEG,KAAK,EAAE;IAAU,CAAC;EAChC;EAEA,MAAMC,IAAI,GAAG,IAAAC,mBAAY,EAACP,OAAO,CAACQ,MAAM,EAAER,OAAO,CAACS,QAAQ,EAAEP,EAAE,CAAC;EAE/D,IAAIQ,IAAY;EAChB,IAAI;IACH,MAAMC,IAAI,GAAG,MAAM,IAAAC,cAAU,EAAC,CAAC,CAACD,IAAI,CAACL,IAAI,CAAC;IAC1C,IAAI,CAACK,IAAI,CAACE,MAAM,CAAC,CAAC,EAAE;MACnB,OAAO;QAAEX,EAAE;QAAEG,KAAK,EAAE;MAAe,CAAC;IACrC;IACAK,IAAI,GAAGC,IAAI,CAACD,IAAI;EACjB,CAAC,CAAC,MAAM;IACP,OAAO;MAAER,EAAE;MAAEG,KAAK,EAAE;IAAU,CAAC;EAChC;EAEA,IAAIL,OAAO,CAACc,WAAW,CAACZ,EAAE,CAAC,KAAK,IAAI,EAAE;IACrC,OAAO;MAAEA,EAAE;MAAEG,KAAK,EAAE,WAAW;MAAEK,IAAI,EAAEP,SAAS,CAACO;IAAK,CAAC;EACxD;EAEA,IAAIA,IAAI,GAAGK,2BAAY,EAAE;IACxB,OAAO;MAAEb,EAAE;MAAEG,KAAK,EAAE,eAAe;MAAEK,IAAI,EAAEP,SAAS,CAACO;IAAK,CAAC;EAC5D;EAEA,IAAI;IACH,MAAMM,MAAM,GAAG,IAAAC,oBAAa,EAAC,MAAM,IAAAL,cAAU,EAAC,CAAC,CAACM,IAAI,CAACZ,IAAI,EAAES,2BAAY,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtF,IAAI,IAAAI,cAAO,EAACH,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,KAAKI,oBAAK,EAAE;MACpC,OAAO;QAAElB,EAAE;QAAEG,KAAK,EAAE,eAAe;QAAEK,IAAI,EAAEP,SAAS,CAACO;MAAK,CAAC;IAC5D;EACD,CAAC,CAAC,MAAM;IACP,OAAO;MAAER,EAAE;MAAEG,KAAK,EAAE,cAAc;MAAEK,IAAI,EAAEP,SAAS,CAACO;IAAK,CAAC;EAC3D;EAEA,OAAO;IAAER,EAAE;IAAEG,KAAK,EAAE,WAAW;IAAEK,IAAI,EAAEP,SAAS,CAACO;EAAK,CAAC;AACxD","ignoreList":[]}

package/lib/commonjs/artifacts/cascade.js

@@ -0,0 +1,80 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.cascadeForOwner = cascadeForOwner;
+exports.unlinkArtifact = unlinkArtifact;
+var _fs = require("../platform/fs.js");
+var _paths = require("./paths.js");
+var _store = require("./store.js");
+/**
+ * Cascading artifact removal.
+ *
+ * The package deletes the files, because the Q2 clarification made it the
+ * owner of them (FR-073c). That is the single riskiest thing this package
+ * does — POL-011(b)'s media-and-files row exists for it — so two rules hold
+ * without exception: every path goes through the boundary guard in
+ * `paths.ts`, and the outcome reports what was removed **and what could not
+ * be**, never a bare success (FR-071).
+ *
+ * A failed removal is reported rather than retried or swallowed. A file the
+ * package could not delete is still on disk holding the user's data, and an
+ * app that told them "deleted" would have said something untrue.
+ */
+
+/** Unlinks one artifact file. True when the file is gone afterwards, whoever removed it. */
+async function unlinkArtifact(path) {
+  if (await (0, _fs.removeIfPresent)(path)) {
+    return true;
+  }
+  // `removeIfPresent` cannot tell "already gone" from "could not remove". A
+  // file that was already gone counts as removed: the end state the caller
+  // asked for is the end state they got.
+  try {
+    return !(await (0, _fs.fileSystem)().exists(path));
+  } catch {
+    return false;
+  }
+}
+async function removeAll(context, executor, ids, deferred) {
+  const removedArtifacts = [];
+  const failedRemovals = [];
+  for (const id of ids) {
+    // The reference first. A reference left pointing at a deleted file is
+    // the unrecoverable state; a file left without its reference is an
+    // orphan reconciliation finds.
+    if (!(await (0, _store.deleteReference)(executor, id))) {
+      failedRemovals.push(id);
+      continue;
+    }
+    const path = (0, _paths.artifactPath)(context.layout, context.scopeKey, id);
+    if (deferred) {
+      deferred.add(path);
+      removedArtifacts.push(id);
+      continue;
+    }
+    if (await unlinkArtifact(path)) {
+      removedArtifacts.push(id);
+    } else {
+      // Still on disk holding the user's data: reported, never claimed removed.
+      failedRemovals.push(id);
+    }
+  }
+  return {
+    removedRecords: 0,
+    removedArtifacts,
+    orphanedReferences: [],
+    failedRemovals
+  };
+}
+
+/**
+ * Everything belonging to one record, for the FR-070 cascade. Inside a
+ * transaction pass `deferred`: the files are removed only once it commits.
+ */
+async function cascadeForOwner(context, executor, owner, deferred) {
+  const references = await (0, _store.listReferencesFor)(executor, owner);
+  return removeAll(context, executor, references.map(reference => reference.id), deferred);
+}
+//# sourceMappingURL=cascade.js.map

package/lib/commonjs/artifacts/cascade.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_fs","require","_paths","_store","unlinkArtifact","path","removeIfPresent","fileSystem","exists","removeAll","context","executor","ids","deferred","removedArtifacts","failedRemovals","id","deleteReference","push","artifactPath","layout","scopeKey","add","removedRecords","orphanedReferences","cascadeForOwner","owner","references","listReferencesFor","map","reference"],"sourceRoot":"../../../src","sources":["artifacts/cascade.ts"],"mappings":";;;;;;;AAgBA,IAAAA,GAAA,GAAAC,OAAA;AAEA,IAAAC,MAAA,GAAAD,OAAA;AACA,IAAAE,MAAA,GAAAF,OAAA;AAnBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAeA;AACO,eAAeG,cAAcA,CAACC,IAAY,EAAoB;EACpE,IAAI,MAAM,IAAAC,mBAAe,EAACD,IAAI,CAAC,EAAE;IAChC,OAAO,IAAI;EACZ;EACA;EACA;EACA;EACA,IAAI;IACH,OAAO,EAAE,MAAM,IAAAE,cAAU,EAAC,CAAC,CAACC,MAAM,CAACH,IAAI,CAAC,CAAC;EAC1C,CAAC,CAAC,MAAM;IACP,OAAO,KAAK;EACb;AACD;AAEA,eAAeI,SAASA,CACvBC,OAAwB,EACxBC,QAAkB,EAClBC,GAAa,EACbC,QAA0B,EACC;EAC3B,MAAMC,gBAA0B,GAAG,EAAE;EACrC,MAAMC,cAAwB,GAAG,EAAE;EAEnC,KAAK,MAAMC,EAAE,IAAIJ,GAAG,EAAE;IACrB;IACA;IACA;IACA,IAAI,EAAE,MAAM,IAAAK,sBAAe,EAACN,QAAQ,EAAEK,EAAE,CAAC,CAAC,EAAE;MAC3CD,cAAc,CAACG,IAAI,CAACF,EAAE,CAAC;MACvB;IACD;IACA,MAAMX,IAAI,GAAG,IAAAc,mBAAY,EAACT,OAAO,CAACU,MAAM,EAAEV,OAAO,CAACW,QAAQ,EAAEL,EAAE,CAAC;IAC/D,IAAIH,QAAQ,EAAE;MACbA,QAAQ,CAACS,GAAG,CAACjB,IAAI,CAAC;MAClBS,gBAAgB,CAACI,IAAI,CAACF,EAAE,CAAC;MACzB;IACD;IACA,IAAI,MAAMZ,cAAc,CAACC,IAAI,CAAC,EAAE;MAC/BS,gBAAgB,CAACI,IAAI,CAACF,EAAE,CAAC;IAC1B,CAAC,MAAM;MACN;MACAD,cAAc,CAACG,IAAI,CAACF,EAAE,CAAC;IACxB;EACD;EAEA,OAAO;IACNO,cAAc,EAAE,CAAC;IACjBT,gBAAgB;IAChBU,kBAAkB,EAAE,EAAE;IACtBT;EACD,CAAC;AACF;;AAEA;AACA;AACA;AACA;AACO,eAAeU,eAAeA,CACpCf,OAAwB,EACxBC,QAAkB,EAClBe,KAAsB,EACtBb,QAA0B,EACC;EAC3B,MAAMc,UAAU,GAAG,MAAM,IAAAC,wBAAiB,EAACjB,QAAQ,EAAEe,KAAK,CAAC;EAC3D,OAAOjB,SAAS,CACfC,OAAO,EACPC,QAAQ,EACRgB,UAAU,CAACE,GAAG,CAACC,SAAS,IAAIA,SAAS,CAACd,EAAE,CAAC,EACzCH,QACD,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/artifacts/paths.js

@@ -0,0 +1,31 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.artifactPath = artifactPath;
+exports.artifactsDirectory = artifactsDirectory;
+var _location = require("../platform/location.js");
+/**
+ * Every artifact path, resolved through one guard.
+ *
+ * POL-011(b) flags media-and-files as a risk precisely because this package
+ * deletes files from disk on cascade. The mitigation is structural rather
+ * than procedural: no code in `artifacts/` builds a path by string
+ * concatenation, and the one function that turns an attachment id into a path
+ * refuses anything escaping the managed root (FR-073, FR-073f).
+ *
+ * That is what makes SC-013a's filesystem tracing pass reliably rather than
+ * usually — there is no second path to audit.
+ */
+
+function artifactsDirectory(layout, scopeKey) {
+  return (0, _location.assertWithinManagedArea)(layout, layout.scopeArtifactsPath(scopeKey));
+}
+function artifactPath(layout, scopeKey, attachmentId) {
+  // `layout.artifactPath` already rejects an id that is not a safe single
+  // path segment; the guard then re-checks the assembled result, so a change
+  // to either one alone cannot open a hole.
+  return (0, _location.assertWithinManagedArea)(layout, layout.artifactPath(scopeKey, attachmentId));
+}
+//# sourceMappingURL=paths.js.map

package/lib/commonjs/artifacts/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_location","require","artifactsDirectory","layout","scopeKey","assertWithinManagedArea","scopeArtifactsPath","artifactPath","attachmentId"],"sourceRoot":"../../../src","sources":["artifacts/paths.ts"],"mappings":";;;;;;;AAaA,IAAAA,SAAA,GAAAC,OAAA;AAbA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIO,SAASC,kBAAkBA,CAACC,MAAqB,EAAEC,QAAgB,EAAU;EACnF,OAAO,IAAAC,iCAAuB,EAACF,MAAM,EAAEA,MAAM,CAACG,kBAAkB,CAACF,QAAQ,CAAC,CAAC;AAC5E;AAEO,SAASG,YAAYA,CAC3BJ,MAAqB,EACrBC,QAAgB,EAChBI,YAAoB,EACX;EACT;EACA;EACA;EACA,OAAO,IAAAH,iCAAuB,EAACF,MAAM,EAAEA,MAAM,CAACI,YAAY,CAACH,QAAQ,EAAEI,YAAY,CAAC,CAAC;AACpF","ignoreList":[]}

package/lib/commonjs/artifacts/reconcile.js

@@ -0,0 +1,55 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.reconcileArtifacts = reconcileArtifacts;
+var _fs = require("../platform/fs.js");
+var _compare = require("../query/compare.js");
+var _paths = require("./paths.js");
+var _store = require("./store.js");
+/**
+ * Reconciliation: the two ways the database and the disk can disagree.
+ *
+ * An **orphaned artifact** is a file with no reference — left by a rolled-back
+ * transaction, or by a crash between the write and the insert. A **dangling
+ * reference** is the reverse: a row pointing at a file the operating system
+ * reclaimed, or the user deleted through a file manager.
+ *
+ * App-triggered only (FR-073d). A background sweep would run during a user's
+ * session without their knowledge, delete files it believes are orphans, and
+ * have no way to distinguish "orphan" from "written by a transaction that has
+ * not committed yet". Handing the trigger to the app makes that an explicit
+ * decision at a moment the app knows is quiet.
+ */
+
+async function filesOnDisk(context) {
+  try {
+    return await (0, _fs.fileSystem)().readdir((0, _paths.artifactsDirectory)(context.layout, context.scopeKey));
+  } catch {
+    // No directory means no artifacts, which is a valid answer rather than
+    // a failure — a scope that never wrote one never created it.
+    return [];
+  }
+}
+async function reconcileArtifacts(context, executor, options = {}) {
+  const references = await (0, _store.listReferences)(executor);
+  const referenced = new Set(references.map(reference => reference.id));
+  const present = new Set(await filesOnDisk(context));
+  const orphanedArtifacts = [...present].filter(id => !referenced.has(id)).sort(_compare.byteOrder);
+  const danglingReferences = references.filter(reference => !present.has(reference.id)).map(reference => reference.id).sort(_compare.byteOrder);
+  const removedArtifacts = [];
+  if (options.removeOrphans) {
+    for (const id of orphanedArtifacts) {
+      if (await (0, _fs.removeIfPresent)((0, _paths.artifactPath)(context.layout, context.scopeKey, id))) {
+        removedArtifacts.push(id);
+      }
+    }
+  }
+  return {
+    orphanedArtifacts,
+    danglingReferences,
+    removedArtifacts
+  };
+}
+//# sourceMappingURL=reconcile.js.map

package/lib/commonjs/artifacts/reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_fs","require","_compare","_paths","_store","filesOnDisk","context","fileSystem","readdir","artifactsDirectory","layout","scopeKey","reconcileArtifacts","executor","options","references","listReferences","referenced","Set","map","reference","id","present","orphanedArtifacts","filter","has","sort","byteOrder","danglingReferences","removedArtifacts","removeOrphans","removeIfPresent","artifactPath","push"],"sourceRoot":"../../../src","sources":["artifacts/reconcile.ts"],"mappings":";;;;;;AAgBA,IAAAA,GAAA,GAAAC,OAAA;AACA,IAAAC,QAAA,GAAAD,OAAA;AAEA,IAAAE,MAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AApBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAcA,eAAeI,WAAWA,CAACC,OAAwB,EAAqB;EACvE,IAAI;IACH,OAAO,MAAM,IAAAC,cAAU,EAAC,CAAC,CAACC,OAAO,CAAC,IAAAC,yBAAkB,EAACH,OAAO,CAACI,MAAM,EAAEJ,OAAO,CAACK,QAAQ,CAAC,CAAC;EACxF,CAAC,CAAC,MAAM;IACP;IACA;IACA,OAAO,EAAE;EACV;AACD;AAEO,eAAeC,kBAAkBA,CACvCN,OAAwB,EACxBO,QAAkB,EAClBC,OAAyB,GAAG,CAAC,CAAC,EACE;EAChC,MAAMC,UAAU,GAAG,MAAM,IAAAC,qBAAc,EAACH,QAAQ,CAAC;EACjD,MAAMI,UAAU,GAAG,IAAIC,GAAG,CAACH,UAAU,CAACI,GAAG,CAACC,SAAS,IAAIA,SAAS,CAACC,EAAE,CAAC,CAAC;EACrE,MAAMC,OAAO,GAAG,IAAIJ,GAAG,CAAC,MAAMb,WAAW,CAACC,OAAO,CAAC,CAAC;EAEnD,MAAMiB,iBAAiB,GAAG,CAAC,GAAGD,OAAO,CAAC,CAACE,MAAM,CAACH,EAAE,IAAI,CAACJ,UAAU,CAACQ,GAAG,CAACJ,EAAE,CAAC,CAAC,CAACK,IAAI,CAACC,kBAAS,CAAC;EACxF,MAAMC,kBAAkB,GAAGb,UAAU,CACnCS,MAAM,CAACJ,SAAS,IAAI,CAACE,OAAO,CAACG,GAAG,CAACL,SAAS,CAACC,EAAE,CAAC,CAAC,CAC/CF,GAAG,CAACC,SAAS,IAAIA,SAAS,CAACC,EAAE,CAAC,CAC9BK,IAAI,CAACC,kBAAS,CAAC;EAEjB,MAAME,gBAA0B,GAAG,EAAE;EACrC,IAAIf,OAAO,CAACgB,aAAa,EAAE;IAC1B,KAAK,MAAMT,EAAE,IAAIE,iBAAiB,EAAE;MACnC,IAAI,MAAM,IAAAQ,mBAAe,EAAC,IAAAC,mBAAY,EAAC1B,OAAO,CAACI,MAAM,EAAEJ,OAAO,CAACK,QAAQ,EAAEU,EAAE,CAAC,CAAC,EAAE;QAC9EQ,gBAAgB,CAACI,IAAI,CAACZ,EAAE,CAAC;MAC1B;IACD;EACD;EAEA,OAAO;IAAEE,iBAAiB;IAAEK,kBAAkB;IAAEC;EAAiB,CAAC;AACnE","ignoreList":[]}

package/lib/commonjs/artifacts/store.js

@@ -0,0 +1,300 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.deleteReference = deleteReference;
+exports.ensureAttachmentTable = ensureAttachmentTable;
+exports.listReferences = listReferences;
+exports.listReferencesFor = listReferencesFor;
+exports.readArtifact = readArtifact;
+exports.readReference = readReference;
+exports.removeArtifact = removeArtifact;
+exports.writeArtifact = writeArtifact;
+var _config = require("../contract/config.js");
+var _errors = require("../contract/errors.js");
+var _errors2 = require("../diagnostics/errors.js");
+var _faults = require("../diagnostics/faults.js");
+var _mapNative = require("../diagnostics/map-native.js");
+var _fs = require("../platform/fs.js");
+var _bytes = require("../platform/bytes.js");
+var _budgets = require("../query/budgets.js");
+var _chunkedCipher = require("../crypto/chunked-cipher.js");
+var _values = require("../sqlite/values.js");
+var _paths = require("./paths.js");
+/**
+ * Artifacts: the file on disk and the reference to it.
+ *
+ * The reference lives in the scope's own database, so a reference created
+ * inside a transaction rolls back with it (FR-072) — no bookkeeping required,
+ * because the connection routes through the transaction in flight.
+ *
+ * The file does not roll back. A filesystem write is not part of a SQL
+ * transaction and cannot be made part of one, so a rolled-back transaction
+ * leaves an artifact on disk with nothing pointing at it. That is not a bug
+ * to be engineered away; it is why reconciliation exists (FR-073d), and why
+ * the write order is deliberate: **the file completes first, then the
+ * reference**. The reverse order would produce a reference to a file that
+ * does not exist, which is the failure a consumer cannot recover from — it
+ * looks like data the app has and does not.
+ */
+
+const CREATE_ATTACHMENTS = `CREATE TABLE IF NOT EXISTS _attachments (
+  id               TEXT PRIMARY KEY,
+  owner_collection TEXT,
+  owner_id         TEXT,
+  content_type     TEXT NOT NULL,
+  size             INTEGER NOT NULL,
+  chunk_size       INTEGER,
+  chunk_count      INTEGER,
+  created_at       INTEGER NOT NULL
+)`;
+const CREATE_OWNER_INDEX = 'CREATE INDEX IF NOT EXISTS _attachments_owner ON _attachments (owner_collection, owner_id)';
+async function ensureAttachmentTable(executor) {
+  await executor.execute(CREATE_ATTACHMENTS);
+  await executor.execute(CREATE_OWNER_INDEX);
+}
+function toReference(row) {
+  const reference = {
+    id: (0, _values.text)(row.id),
+    contentType: (0, _values.text)(row.content_type),
+    size: (0, _values.num)(row.size),
+    createdAt: (0, _values.num)(row.created_at)
+  };
+  if (row.owner_collection != null && row.owner_id != null) {
+    reference.owner = {
+      collection: (0, _values.text)(row.owner_collection),
+      id: (0, _values.text)(row.owner_id)
+    };
+  }
+  const chunkSize = (0, _values.maybeNum)(row.chunk_size);
+  if (chunkSize !== null) {
+    reference.chunkSize = chunkSize;
+    reference.chunkCount = (0, _values.num)(row.chunk_count);
+  }
+  return reference;
+}
+async function readReference(executor, id) {
+  const result = await executor.execute('SELECT * FROM _attachments WHERE id = ?', [id]);
+  const row = result.rows[0];
+  return row ? toReference(row) : null;
+}
+async function listReferences(executor) {
+  const result = await executor.execute('SELECT * FROM _attachments ORDER BY id ASC');
+  return result.rows.map(toReference);
+}
+async function listReferencesFor(executor, owner) {
+  const result = await executor.execute('SELECT * FROM _attachments WHERE owner_collection = ? AND owner_id = ? ORDER BY id ASC', [owner.collection, owner.id]);
+  return result.rows.map(toReference);
+}
+async function insertReference(executor, reference) {
+  await executor.execute(`INSERT INTO _attachments
+		 (id, owner_collection, owner_id, content_type, size, chunk_size, chunk_count, created_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(id) DO UPDATE SET
+		   owner_collection = excluded.owner_collection,
+		   owner_id = excluded.owner_id,
+		   content_type = excluded.content_type,
+		   size = excluded.size,
+		   chunk_size = excluded.chunk_size,
+		   chunk_count = excluded.chunk_count,
+		   created_at = excluded.created_at`, [reference.id, reference.owner?.collection ?? null, reference.owner?.id ?? null, reference.contentType, reference.size, reference.chunkSize ?? null, reference.chunkCount ?? null, reference.createdAt]);
+}
+async function deleteReference(executor, id) {
+  const result = await executor.execute('DELETE FROM _attachments WHERE id = ?', [id]);
+  return result.rowsAffected > 0;
+}
+async function writePlaintext(path, content) {
+  await (0, _fs.fileSystem)().writeFile(path, content, 'base64');
+}
+
+/** Where an artifact's bytes come from: how many, and any one chunk of them. */
+
+/**
+ * Encrypted write, one chunk in flight.
+ *
+ * The header goes down first because its contents — chunk size, chunk count,
+ * plaintext length — are all known from the input length before any
+ * encryption happens. Only the tags depend on the ciphertext, and they follow
+ * their own chunk, so the whole write is append-only and peak memory is one
+ * chunk regardless of artifact size when the source is a file (FR-107a).
+ */
+async function writeEncrypted(path, key, source) {
+  const header = (0, _chunkedCipher.headerFor)(source.size, _config.Budgets.ARTIFACT_CHUNK_BYTES);
+  await (0, _fs.fileSystem)().writeFile(path, (0, _bytes.bytesToBase64)((0, _chunkedCipher.encodeHeader)(header)), 'base64');
+  for (let index = 0; index < header.chunkCount; index += 1) {
+    const chunk = await source.chunk(index * header.chunkSize, (0, _chunkedCipher.chunkPlaintextLength)(header, index));
+    await (0, _fs.fileSystem)().appendFile(path, (0, _bytes.bytesToBase64)((0, _chunkedCipher.encryptChunk)(key, index, chunk)), 'base64');
+  }
+  return {
+    chunkSize: header.chunkSize,
+    chunkCount: header.chunkCount
+  };
+}
+function sourceFileOf(input) {
+  if (typeof input.sourcePath !== 'string') {
+    return null;
+  }
+  return input.sourcePath.startsWith('file://') ? input.sourcePath.slice('file://'.length) : input.sourcePath;
+}
+
+/**
+ * The input as something to read from. A base64 `content` is decoded whole,
+ * which is the cost of that form; a `sourcePath` is only measured here and
+ * read a chunk at a time, or not read by JS at all (LDB-09).
+ */
+async function byteSourceFor(input) {
+  const file = sourceFileOf(input);
+  if (file === null) {
+    if (typeof input.content !== 'string') {
+      (0, _errors2.raise)(_errors.DiagnosticCodes.CONFIG_INVALID, {
+        message: 'an attachment needs content or sourcePath',
+        detail: {
+          attachmentId: input.id
+        }
+      });
+    }
+    const plaintext = (0, _bytes.base64ToBytes)(input.content);
+    return {
+      size: plaintext.length,
+      chunk: async (offset, length) => plaintext.subarray(offset, offset + length)
+    };
+  }
+  let size;
+  try {
+    size = (await (0, _fs.fileSystem)().stat(file)).size;
+  } catch (error) {
+    (0, _mapNative.raiseNative)(error, {
+      operation: 'attachment'
+    });
+  }
+  return {
+    size,
+    chunk: async (offset, length) => (0, _bytes.base64ToBytes)(await (0, _fs.fileSystem)().read(file, length, offset, 'base64'))
+  };
+}
+async function writeArtifact(context, input) {
+  (0, _faults.throwIfFaulted)('attachmentWrite');
+  const source = await byteSourceFor(input);
+  (0, _budgets.assertArtifactWithinBudget)(input.id, source.size);
+  const path = (0, _paths.artifactPath)(context.layout, context.scopeKey, input.id);
+  const key = context.artifactKey(input.id);
+  const file = sourceFileOf(input);
+  let chunking;
+  try {
+    await (0, _fs.fileSystem)().mkdir((0, _paths.artifactsDirectory)(context.layout, context.scopeKey));
+    if (key) {
+      chunking = await writeEncrypted(path, key, source);
+    } else if (file !== null) {
+      await (0, _fs.fileSystem)().copyFile(file, path);
+    } else {
+      await writePlaintext(path, input.content);
+    }
+  } catch (error) {
+    // A partial file with no reference is an orphan reconciliation can
+    // find; a reference to a partial file is data the app believes it has.
+    await (0, _fs.removeIfPresent)(path);
+    (0, _mapNative.raiseNative)(error, {
+      operation: 'attachment'
+    });
+  }
+  const reference = {
+    id: input.id,
+    contentType: input.contentType,
+    size: source.size,
+    createdAt: context.now()
+  };
+  if (input.owner) {
+    reference.owner = input.owner;
+  }
+  if (chunking) {
+    reference.chunkSize = chunking.chunkSize;
+    reference.chunkCount = chunking.chunkCount;
+  }
+
+  // Only now. See the note at the top of this file.
+  await insertReference(context.executor(), reference);
+  return reference;
+}
+async function readPlaintext(path, range) {
+  if (!range) {
+    return (0, _fs.fileSystem)().readFile(path, 'base64');
+  }
+  return (0, _fs.fileSystem)().read(path, range.length, range.offset, 'base64');
+}
+async function readEncrypted(path, key, range) {
+  const headerBytes = (0, _bytes.base64ToBytes)(await (0, _fs.fileSystem)().read(path, _chunkedCipher.HEADER_BYTES, 0, 'base64'));
+  const header = (0, _chunkedCipher.decodeHeader)(headerBytes);
+  const from = range?.offset ?? 0;
+  const to = range ? Math.min(header.plaintextSize, from + range.length) : header.plaintextSize;
+  if (to <= from) {
+    return '';
+  }
+  const first = Math.floor(from / header.chunkSize);
+  const last = Math.floor((to - 1) / header.chunkSize);
+  const pieces = [];
+  for (let index = first; index <= last; index += 1) {
+    const stored = (0, _bytes.base64ToBytes)(await (0, _fs.fileSystem)().read(path, (0, _chunkedCipher.chunkPlaintextLength)(header, index) + _chunkedCipher.TAG_BYTES, (0, _chunkedCipher.chunkOffset)(header, index), 'base64'));
+    const decrypted = (0, _chunkedCipher.decryptChunk)(key, index, stored);
+    const chunkStart = index * header.chunkSize;
+    pieces.push(decrypted.subarray(Math.max(0, from - chunkStart), Math.min(decrypted.length, to - chunkStart)));
+  }
+  return (0, _bytes.bytesToBase64)((0, _bytes.concatBytes)(pieces));
+}
+async function readArtifact(context, id, range) {
+  const path = (0, _paths.artifactPath)(context.layout, context.scopeKey, id);
+  const key = context.artifactKey(id);
+  try {
+    return key ? await readEncrypted(path, key, range) : await readPlaintext(path, range);
+  } catch (error) {
+    // A typed error the package already classified — an unreadable header,
+    // a failing tag — says something more specific than "missing" and must
+    // survive. Anything else reaching here is the file not being there.
+    if ((0, _errors2.isStorageError)(error)) {
+      throw error;
+    }
+    (0, _errors2.raise)(_errors.DiagnosticCodes.ATTACHMENT_MISSING, {
+      message: 'artifact is missing',
+      detail: {
+        attachmentId: id
+      },
+      cause: error
+    });
+  }
+}
+
+/**
+ * Collects file removals until the transaction that deleted their references
+ * commits. A file unlinked inside the transaction is gone even if the
+ * transaction then rolls back and the reference returns — a dangling
+ * reference to data nobody can recover.
+ */
+
+async function removeArtifact(context, id, deferred) {
+  const path = (0, _paths.artifactPath)(context.layout, context.scopeKey, id);
+  if (deferred) {
+    // Inside a transaction: the reference goes now and rolls back with it;
+    // the file goes once the transaction commits.
+    const hadReference = await deleteReference(context.executor(), id);
+    if (hadReference) {
+      deferred.add(path);
+    }
+    return {
+      removedRecords: 0,
+      removedArtifacts: hadReference ? [id] : [],
+      orphanedReferences: [],
+      failedRemovals: []
+    };
+  }
+  const removed = await (0, _fs.removeIfPresent)(path);
+  const hadReference = await deleteReference(context.executor(), id);
+  return {
+    removedRecords: 0,
+    removedArtifacts: removed ? [id] : [],
+    // A reference with no file left behind is worth reporting rather than
+    // rounding up to success (FR-071).
+    orphanedReferences: !removed && hadReference ? [id] : [],
+    failedRemovals: []
+  };
+}
+//# sourceMappingURL=store.js.map