@chipmobilesdk/rn-local-db 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,142 @@
 # @chipmobilesdk/rn-local-db
 
+## 0.5.0
+
+### Minor Changes
+
+- Every peer range has an upper bound, and no package declares a peer it does not use. ([#21](https://github.com/operationd8979/chip-mobile-sdk/pull/21))
+
+  A peer range is now a caret, a tilde or an explicit `<`, except for `react` and
+  `react-native`: an app brings exactly one of each, so a floor is the only useful thing
+  to say about them. Every other peer is a library the app installs beside us, and an
+  open `>=` was a promise about versions nobody had run — mmkv 3→4 lost entitlements and
+  pending purchases exactly that way.
+
+  **Four of the new ceilings exclude a version that is already published**, so an app
+  that took the open range at its word may now see a peer warning. The new bound is the
+  major this release is tested against, which is the thing the old range failed to say:
+
+  | Peer | Was | Now | Published above the ceiling |
+  |---|---|---|---|
+  | `react-native-app-auth` (rn-auth) | `>=8` | `^8.0.0` | 9.0.0 |
+  | `react-native-keychain` (rn-auth) | `>=10` | `^10.0.0` | 11.0.0 |
+  | `@op-engineering/op-sqlite` (rn-local-db) | `>=17.1.0` | `^17.1.0` | 18.x, 19.x |
+  | `@react-native-firebase/messaging` (rn-notification) | `>=26.0.0` | `^26.0.0` | 27.x |
+
+  The others — `react-native-vision-camera` `^5.1.1`, `react-native-svg` `^15.15.0`,
+  `react-native-unistyles` `^3.2.0`, `@dr.pogodin/react-native-fs` `^2.39.2`,
+  `react-native-quick-crypto` `^1.0.0`, `react-native-notify-kit` `^10.5.0`,
+  `react-native-localize` `^3.7.0`, `react-native-mmkv` `^4.0.0` — exclude nothing that
+  exists today. rn-payment's mmkv range was already bounded (`>=4.0.0 <5`) and is now
+  written as the caret that means the same thing.
+
+  Peers nothing imports are gone. `rn-theme`, `rn-local-db` and `rn-notification` asked
+  for `react` without having a component or a hook between them; `rn-auth`, `rn-ai` and
+  `rn-i18n` asked for `react-native` without touching a React Native API (rn-auth reaches
+  both native modules through `lazyPeer`, rn-i18n formats on `Intl`); `rn-notification`
+  asked for `@react-native-firebase/app`, which messaging declares itself. `rn-ai` no
+  longer peers on `@chipmobilesdk/rn-auth` at all — it asks for a `TokenProvider`, a
+  two-method interface rn-auth's `auth` satisfies, so an app with its own token source
+  installs nothing extra. An app that enables push or signs in through rn-auth installs
+  the same packages as before; it is the manifest that stopped overstating.
+
+  `react-native-localize` is declared optional, which is what the code already did: the
+  time-zone reader goes through `lazyPeer` and falls back to `Intl` without it. The
+  `peerDependenciesMeta` entries that said `optional: false` are gone — that is npm's
+  default, and writing it down only invited the question of which peers were undecided.
+
+  `npm run check:manifests` now fails on an unbounded peer range, a peer nothing in
+  `src/` imports, and a `peerDependenciesMeta` entry for either, so the policy holds
+  without anyone remembering it.
+
+- Every package now ships built JavaScript with declaration files, instead of asking the
+  app to compile its TypeScript. ([#22](https://github.com/operationd8979/chip-mobile-sdk/pull/22))
+
+  Each tarball carries `lib/commonjs`, `lib/module` and `lib/typescript` (built with
+  `react-native-builder-bob`), and `src/` alongside them. What that changes for a
+  consumer:
+
+  - **Nothing to add to `transformIgnorePatterns`.** `require` resolves to the CommonJS
+    build, so an app's Jest loads this package without being told to transform it. That
+    was the one thing every consuming app had to know about us (DEP-04).
+  - **Typechecking reads our `.d.ts`** rather than compiling our source under our
+    `tsconfig`. A consumer's stricter — or looser — settings no longer meet our code.
+  - **`import` resolves to ESM**, so a bundler can tree-shake what it does not use.
+
+  No exported name changed, and no subpath moved: `.`, `./testing`, `./push`,
+  `./advanced`, `./app-auth`, `./keychain` and rn-core's twelve subpaths resolve exactly
+  as before, each now with its own declarations for both module systems. publint and
+  `attw --profile node16` pass on all twelve packages, which they could not before.
+
+  Inside the monorepo nothing changed either, and that is deliberate: every subpath also
+  declares a private `chipmobilesdk-source` condition pointing at its TypeScript, and
+  Metro, Jest and `tsc` here ask for that condition first. The demo app bundles 371
+  modules straight from `packages/*/src`, so editing a package still changes the app with
+  no build step, and coverage is still measured on the source. The condition is named for
+  this organization rather than using the conventional `source` because third-party
+  packages declare that one too — `@dr.pogodin/react-native-fs` does — and asking for it
+  pulled their sources into our stricter compile.
+
+  `npm run build:packages` builds everything, `prepack` rebuilds before any `npm pack`,
+  and `lib/` is git-ignored: the published bytes are produced by the release, never
+  committed. `npm run check:manifests` now fails a package whose `main`, `module`,
+  `types`, `source` condition, `files`, build script or `prepack` do not match this shape.
+
+### Patch Changes
+
+- Each package's public API and its weight are now recorded in the repository, so a change
+  to either is reviewed rather than discovered. ([#23](https://github.com/operationd8979/chip-mobile-sdk/pull/23))
+
+  `packages/<pkg>/etc/*.api.md` is an api-extractor report per entrypoint — twenty-seven
+  of them, generated from the declarations the package publishes and committed. A renamed
+  type, a widened union, one more optional field: all of it shows up in a pull request's
+  diff. `npm run check:api` fails when a report is out of date and `npm run api:update`
+  rewrites them.
+
+  A report that moves now needs a **minor or major** changeset for that package.
+  `check:changesets` enforces it, because the report is generated from what the package
+  publishes, and a patch release that moves the public surface is how a consumer's build
+  breaks on `npm update`. A report added for the first time is a baseline, not a change.
+  `./testing` deliberately has no report: test doubles are not a surface a release is
+  gated on.
+
+  `npm run check:size` holds every entrypoint to a budget in `.size-limit.json`, measured
+  on the ESM build with peers and rn-core treated as external — they are what an app
+  installs beside us, not our weight. Each budget started at today's measurement plus five
+  per cent, so growth becomes a decision someone makes instead of a drift nobody sees. The
+  current figures run from 500 B (`rn-core/lazy`) to 19 kB (rn-notification).
+
+  No behaviour or API changed in this release; the entry is here so the changelog records
+  when the reports and the budgets began.
+
+- The crypto footprint is written down, and the device gate for encryption is a checklist
+  someone can run. ([#21](https://github.com/operationd8979/chip-mobile-sdk/pull/21))
+
+  `@noble/hashes` was considered for HKDF and SHA, and declined (DEP-10). It removes no
+  dependency — `react-native-quick-crypto` stays for AES-GCM either way, so moving HKDF
+  out of it buys nothing at install time — while adding it would give this package a
+  second runtime dependency, against the rule that rn-core is the only one. The hashing
+  that genuinely had to work without a native module, the scope digest, is already plain
+  TypeScript. The README now states which primitive lives where and why, and when to
+  revisit.
+
+  `CipherModule` no longer declares `createHash`. Nothing called it: the scope digest is
+  computed in TypeScript precisely so a scope can be resolved by an app that never
+  enables encryption and may have no crypto module installed. The port now asks for the
+  two things the package actually uses, AES-256-GCM and `hkdfSync`.
+
+  The README's "Demo and validation" section gained **Device checks for the encrypted
+  database**: the steps to run after every op-sqlite or quick-crypto upgrade, with the
+  diagnostic each one must produce. It also stops claiming the LocalDB demo screens run
+  on the memory adapter — nothing overrides the adapter, so they exercise op-sqlite on
+  the device, which is what makes them evidence. Every step was run on a Pixel 3a
+  emulator (API 36, release build) before being written down: the four key-provider modes
+  answer `opened successfully`, `KEY_INVALID`, `KEY_PROVIDER_FAILED` and `KEY_INVALID`,
+  the wrong posture answers `ENCRYPTION_MISMATCH` with the data still readable, and a
+  32 MB artifact writes in 128 chunks.
+- Updated dependencies ([#22](https://github.com/operationd8979/chip-mobile-sdk/pull/22), [#23](https://github.com/operationd8979/chip-mobile-sdk/pull/23)):
+  - @chipmobilesdk/rn-core@0.2.0
+
 ## 0.4.0
 
 ### Minor Changes

package/README.md

@@ -463,6 +463,25 @@ tag per chunk. Encryption and range decryption operate by chunk. A write from
 `sourcePath` holds one chunk at a time; a write from base64 `content` first
 decodes the complete input, so its memory grows with the artifact.
 
+### Crypto footprint: what is native and what is not
+
+| Primitive | Where | Why |
+|---|---|---|
+| SQLCipher (records) | `@op-engineering/op-sqlite`, built with the SQLCipher flag | Page-level encryption of the database file; nothing in JavaScript can do this |
+| AES-256-GCM (artifacts) | `react-native-quick-crypto` | 256 KB chunks of a photo or recording; this is where native speed is the whole point |
+| HKDF-SHA256 (per-artifact subkey) | `react-native-quick-crypto` | One hash per artifact write, in the module AES-GCM already requires |
+| SHA-256 (scope digest) | plain TypeScript, `src/scope/hash.ts` | Runs on **every** scope resolution, including apps that never enable encryption and so may not have a crypto module installed at all |
+
+**`@noble/hashes` was considered for HKDF and SHA, and declined** (DEP-10, WS4-08).
+It would not remove a dependency: `react-native-quick-crypto` stays for AES-GCM
+either way, so moving HKDF out of it buys nothing at install time, while adding
+`@noble/hashes` would give this package a second runtime dependency — against the rule
+that rn-core is the only one (`npm run check:manifests` enforces it) — or a vendored
+copy to maintain. The hashing that genuinely had to work without a native module, the
+scope digest, is already plain TypeScript and byte-for-byte equal to Node's
+`createHash('sha256')` under test. Revisit only if quick-crypto stops shipping an
+`hkdfSync`, or if AES-GCM moves out of it.
+
 A key-provider failure while the device is locked is an **expected condition**, not a bug:
 
 | Code | Means | Retryable |
@@ -699,9 +718,9 @@ Four are **hard limits** with a typed error. The rest are soft: exceeding them i
 | Node (tooling) | 22.11+ |
 | Android | `minSdkVersion` 24, `targetSdkVersion` 36 |
 | iOS | 15.1+ |
-| `@op-engineering/op-sqlite` | >= 17.1.0 |
-| `@dr.pogodin/react-native-fs` | >= 2.39.2 |
-| `react-native-quick-crypto` | >= 1.0.0 — **optional**, only for encryption. Its own peer `react-native-quick-base64` must also be in the **app's** `dependencies`: autolinking compiles only what the app declares, and without it the first encrypted attachment fails with `'QuickBase64' could not be found` |
+| `@op-engineering/op-sqlite` | `^17.1.0` |
+| `@dr.pogodin/react-native-fs` | `^2.39.2` |
+| `react-native-quick-crypto` | `^1.0.0` — **optional**, only for encryption. Its own peer `react-native-quick-base64` must also be in the **app's** `dependencies`: autolinking compiles only what the app declares, and without it the first encrypted attachment fails with `'QuickBase64' could not be found` |
 
 **Storage location**: app-private documents directory, under `chipmobilesdk-localdb/`.
 **Backup mechanism**: `NSURLIsExcludedFromBackupKey` on iOS; `dataExtractionRules` / `fullBackupContent` on Android.
@@ -733,9 +752,13 @@ Written for the privacy disclosure a consuming app has to make.
 
 ## Demo and validation
 
-The demo app exposes ten `src/screens/LocalDb*Screen.tsx` scenarios and uses
-the testing entrypoint's memory adapter so the UI can run without native
-database setup. Run from the repository root:
+The demo app exposes ten `src/screens/LocalDb*Screen.tsx` scenarios. They run on the
+**real** adapter — op-sqlite on the device — because nothing overrides it; only
+`LocalDbDiagnosticsScreen` reaches for the testing entrypoint, and only for fault
+injection. So the screens are evidence about native behaviour, which is the point of
+the checklist below.
+
+Node-side gates, from the repository root:
 
 ```bash
 npm run typecheck --workspace @chipmobilesdk/rn-local-db
@@ -743,5 +766,43 @@ npm run pack:check --workspace @chipmobilesdk/rn-local-db
 npm run validate
 ```
 
-Physical-device SQLCipher, backup, corruption, and large-artifact evidence are
-separate release gates; the memory demo does not prove those native behaviors.
+### Device checks for the encrypted database
+
+SQLCipher and AES-GCM live in two native modules this package does not control
+(`@op-engineering/op-sqlite`, `react-native-quick-crypto`), and neither is exercised by
+a Jest run. **Run this after every upgrade of either one, and before a release that
+touches encryption** (WS4-08). It takes a few minutes on one device.
+
+```bash
+# A release build: a debug bundle's timings say nothing about chunked AES-GCM.
+npx react-native run-android --mode release   # or: adb install -r <apk>
+```
+
+Then, in the app's sidebar:
+
+1. **LocalDB · Encryption** → *Write to both*. The two scopes must disagree: `Guest
+   scope encrypted: false` reading back `Stored in the clear`, `Tenant scope encrypted:
+   true` reading back `Stored under a key`. If both report `false`, the app is missing
+   the SQLCipher build flag — the package answers `ENCRYPTION_UNAVAILABLE` rather than
+   writing plaintext, so check the flag before suspecting this package.
+2. **Key provider** → each of the four modes, each followed by *Open with this key*.
+   The expected diagnostics are `opened successfully`, then `KEY_INVALID` (wrong key,
+   not retryable), `KEY_PROVIDER_FAILED` (device locked, **retryable**) and
+   `KEY_INVALID` again (no key returned — an empty key is an invalid one, not a
+   different condition). Then *Open with the wrong posture* → `ENCRYPTION_MISMATCH`,
+   and `Data still readable with the correct key: yes`. That last line is the one that
+   matters: none of these paths opens, truncates or recreates the database.
+3. **Large artifacts** → *Write 1 MB*, *8 MB*, *32 MB*. All three must complete. The
+   32 MB run reports `128 chunk(s)`, which is the 256 KB chunking doing its job
+   (FR-107a), followed by a 256 KB range read and a reconcile with `0 orphans, 0
+   dangling`. The panel reports durations, not memory: watch the device's memory graph
+   while it runs, and it must not scale with the file.
+4. **LocalDB · Attachments** → *Attach a file* (inventory shows `available · 16384
+   bytes`), *Read a byte range*, *Escape the managed area* (must be refused, not
+   served), then *Reconcile and reclaim* and read the counts.
+
+Record the device, the OS version and the two native module versions with the result.
+As of 2026-11, on a Pixel 3a emulator (API 36, release build, op-sqlite 17.1.3,
+quick-crypto 1.1.6): every expectation above held, with the 32 MB write at 4,200 ms and
+the 256 KB range read at 33 ms. Backup/restore and corruption recovery are not covered
+here — corruption needs a deliberately damaged file — and remain separate gates.

package/lib/commonjs/adapter/budgets.js

@@ -0,0 +1,79 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.acquireHandleSlot = acquireHandleSlot;
+Object.defineProperty(exports, "assertArtifactWithinBudget", {
+  enumerable: true,
+  get: function () {
+    return _budgets.assertArtifactWithinBudget;
+  }
+});
+Object.defineProperty(exports, "assertBatchWithinBudget", {
+  enumerable: true,
+  get: function () {
+    return _budgets.assertBatchWithinBudget;
+  }
+});
+Object.defineProperty(exports, "assertRecordWithinBudget", {
+  enumerable: true,
+  get: function () {
+    return _budgets.assertRecordWithinBudget;
+  }
+});
+exports.releaseHandleSlot = releaseHandleSlot;
+exports.resetHandleSlots = resetHandleSlots;
+Object.defineProperty(exports, "serializedSize", {
+  enumerable: true,
+  get: function () {
+    return _budgets.serializedSize;
+  }
+});
+var _config = require("../contract/config.js");
+var _errors = require("../contract/errors.js");
+var _errors2 = require("../diagnostics/errors.js");
+var _budgets = require("../query/budgets.js");
+/**
+ * Where the FR-088 budgets are actually enforced.
+ *
+ * The checks live in `query/budgets.ts` so both adapters share them; this
+ * module is the adapter-layer entry point, and exists so there is one place
+ * to answer "which budgets are hard?" — per-record size, batch size, page
+ * size, and artifact size, each with a typed error (FR-088a).
+ *
+ * The rest are soft by design. Exceeding 100,000 records in a collection is
+ * slow, not an error, and refusing the 100,001st write would destroy data an
+ * app already holds. Degraded behavior is documented in the README instead.
+ */
+
+/**
+ * Concurrently open handles.
+ *
+ * Each one holds a native connection and its write-ahead log, so an app that
+ * leaks handles runs out of file descriptors rather than slowing down. Eight
+ * is generous for the multi-identity case FR-008b describes and low enough
+ * that a leak surfaces during development instead of in the field.
+ */
+let openHandles = 0;
+function acquireHandleSlot() {
+  if (openHandles >= _config.Budgets.MAX_OPEN_HANDLES) {
+    (0, _errors2.raise)(_errors.DiagnosticCodes.OPEN_FAILED, {
+      message: 'too many database handles are open',
+      detail: {
+        count: openHandles,
+        limit: _config.Budgets.MAX_OPEN_HANDLES
+      }
+    });
+  }
+  openHandles += 1;
+}
+function releaseHandleSlot() {
+  openHandles = Math.max(0, openHandles - 1);
+}
+
+/** Between tests. */
+function resetHandleSlots() {
+  openHandles = 0;
+}
+//# sourceMappingURL=budgets.js.map

package/lib/commonjs/adapter/budgets.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_config","require","_errors","_errors2","_budgets","openHandles","acquireHandleSlot","Budgets","MAX_OPEN_HANDLES","raise","DiagnosticCodes","OPEN_FAILED","message","detail","count","limit","releaseHandleSlot","Math","max","resetHandleSlots"],"sourceRoot":"../../../src","sources":["adapter/budgets.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,QAAA,GAAAF,OAAA;AACA,IAAAG,QAAA,GAAAH,OAAA;AAhBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAmBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAII,WAAW,GAAG,CAAC;AAEZ,SAASC,iBAAiBA,CAAA,EAAS;EACzC,IAAID,WAAW,IAAIE,eAAO,CAACC,gBAAgB,EAAE;IAC5C,IAAAC,cAAK,EAACC,uBAAe,CAACC,WAAW,EAAE;MAClCC,OAAO,EAAE,oCAAoC;MAC7CC,MAAM,EAAE;QAAEC,KAAK,EAAET,WAAW;QAAEU,KAAK,EAAER,eAAO,CAACC;MAAiB;IAC/D,CAAC,CAAC;EACH;EACAH,WAAW,IAAI,CAAC;AACjB;AAEO,SAASW,iBAAiBA,CAAA,EAAS;EACzCX,WAAW,GAAGY,IAAI,CAACC,GAAG,CAAC,CAAC,EAAEb,WAAW,GAAG,CAAC,CAAC;AAC3C;;AAEA;AACO,SAASc,gBAAgBA,CAAA,EAAS;EACxCd,WAAW,GAAG,CAAC;AAChB","ignoreList":[]}

package/lib/commonjs/adapter/collection.js

@@ -0,0 +1,236 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createSqlCollection = createSqlCollection;
+var _errors = require("../contract/errors.js");
+var _errors2 = require("../diagnostics/errors.js");
+var _faults = require("../diagnostics/faults.js");
+var _cursor = require("../query/cursor.js");
+var _paginate = require("../query/paginate.js");
+var _sort = require("../query/sort.js");
+var _validate = require("../query/validate.js");
+var _declare = require("../schema/declare.js");
+var _rowCodec = require("../sqlite/row-codec.js");
+var _sqlBuilder = require("../sqlite/sql-builder.js");
+var _statements = require("../sqlite/statements.js");
+var _budgets = require("./budgets.js");
+/**
+ * Collection operations against a SQLite executor.
+ *
+ * The executor is either the connection or the transaction in flight on it,
+ * which is what gives read-your-own-writes for free (FR-043): a read inside a
+ * transaction runs on the same handle that made the writes, so it sees them,
+ * and a reader outside does not.
+ *
+ * Every semantic decision that could differ between the two adapters —
+ * which operators mean what, how nulls sort, what a cursor points at — is
+ * delegated to `query/`. This file decides only how to say it in SQL.
+ */
+
+const LIVE = 'deleted_at IS NULL';
+function notFound(collection, id) {
+  (0, _errors2.raise)(_errors.DiagnosticCodes.RECORD_NOT_FOUND, {
+    message: 'record not found',
+    detail: {
+      collection,
+      recordId: id
+    }
+  });
+}
+function createSqlCollection(context) {
+  const {
+    schema
+  } = context;
+  const table = `"${(0, _declare.collectionTable)(schema.name)}"`;
+  const selectColumns = ['id', 'payload', 'created_at', 'updated_at', 'deleted_at'].join(', ');
+  async function rowById(id, includeDeleted = false) {
+    const result = await context.executor().execute(`SELECT ${selectColumns} FROM ${table} WHERE id = ?${includeDeleted ? '' : ` AND ${LIVE}`}`, [id]);
+    return result.rows[0];
+  }
+  return {
+    async insert(record) {
+      context.assertUsable();
+      (0, _faults.throwIfFaulted)('write');
+      const payload = (0, _budgets.assertRecordWithinBudget)(schema.name, record.data);
+
+      // One statement: a row that is already there is left untouched and
+      // reported, instead of a SELECT first and an INSERT after (LDB-08). The
+      // failure stays boring — nothing was written, and no engine error
+      // surfaces from inside a transaction.
+      const result = await context.executor().execute(...(0, _statements.insertStatement)(schema, record.id, record.data, context.now(), payload, 'ignore'));
+      if (result.rowsAffected === 0) {
+        (0, _errors2.raise)(_errors.DiagnosticCodes.RECORD_CONFLICT, {
+          message: 'record already exists',
+          detail: {
+            collection: schema.name,
+            recordId: record.id
+          }
+        });
+      }
+      return {
+        operation: 'created',
+        id: record.id
+      };
+    },
+    async update(id, record) {
+      context.assertUsable();
+      (0, _faults.throwIfFaulted)('write');
+      const payload = (0, _budgets.assertRecordWithinBudget)(schema.name, record.data);
+      const result = await context.executor().execute(...(0, _statements.updateStatement)(schema, id, record.data, context.now(), payload, {
+        liveOnly: true
+      }));
+      if (result.rowsAffected === 0) {
+        // Creating the record instead would be a silent write to an id
+        // the caller believed already existed.
+        notFound(schema.name, id);
+      }
+      return {
+        operation: 'updated',
+        id
+      };
+    },
+    async upsert(record) {
+      context.assertUsable();
+      (0, _faults.throwIfFaulted)('write');
+      const payload = (0, _budgets.assertRecordWithinBudget)(schema.name, record.data);
+      const now = context.now();
+
+      // An upsert over a soft-deleted record brings it back: the caller
+      // asked for this id to hold this data.
+      const update = async () => {
+        const result = await context.executor().execute(...(0, _statements.updateStatement)(schema, record.id, record.data, now, payload, {
+          restore: true
+        }));
+        return result.rowsAffected > 0;
+      };
+
+      // The update is tried first: one round-trip for a record that exists,
+      // with no SELECT before it (LDB-08).
+      if (await update()) {
+        return {
+          operation: 'updated',
+          id: record.id
+        };
+      }
+      const inserted = await context.executor().execute(...(0, _statements.insertStatement)(schema, record.id, record.data, now, payload, 'ignore'));
+      if (inserted.rowsAffected > 0) {
+        return {
+          operation: 'created',
+          id: record.id
+        };
+      }
+      // Another write created the row between the two statements.
+      await update();
+      return {
+        operation: 'updated',
+        id: record.id
+      };
+    },
+    async get(id) {
+      context.assertUsable();
+      (0, _faults.throwIfFaulted)('read');
+      const row = await rowById(id);
+      if (!row) {
+        notFound(schema.name, id);
+      }
+      return (0, _rowCodec.decodeRow)(schema, row);
+    },
+    async find(id) {
+      context.assertUsable();
+      (0, _faults.throwIfFaulted)('read');
+      const row = await rowById(id);
+      return row ? (0, _rowCodec.decodeRow)(schema, row) : null;
+    },
+    async delete(id) {
+      context.assertUsable();
+      (0, _faults.throwIfFaulted)('write');
+      const result = await context.executor().execute(`DELETE FROM ${table} WHERE id = ?`, [id]);
+      if (result.rowsAffected === 0) {
+        notFound(schema.name, id);
+      }
+      return {
+        operation: 'deleted',
+        id
+      };
+    },
+    async softDelete(id) {
+      context.assertUsable();
+      (0, _faults.throwIfFaulted)('write');
+      if (!(0, _declare.hasSoftDelete)(schema)) {
+        (0, _errors2.raise)(_errors.DiagnosticCodes.CONFIG_INVALID, {
+          message: 'collection does not declare soft delete',
+          detail: {
+            collection: schema.name
+          }
+        });
+      }
+      const result = await context.executor().execute(`UPDATE ${table} SET deleted_at = ? WHERE id = ? AND ${LIVE}`, [context.now(), id]);
+      if (result.rowsAffected === 0) {
+        notFound(schema.name, id);
+      }
+      return {
+        operation: 'deleted',
+        id
+      };
+    },
+    async restore(id) {
+      context.assertUsable();
+      (0, _faults.throwIfFaulted)('write');
+      if (!(0, _declare.hasSoftDelete)(schema)) {
+        (0, _errors2.raise)(_errors.DiagnosticCodes.CONFIG_INVALID, {
+          message: 'collection does not declare soft delete',
+          detail: {
+            collection: schema.name
+          }
+        });
+      }
+      const result = await context.executor().execute(`UPDATE ${table} SET deleted_at = NULL WHERE id = ? AND deleted_at IS NOT NULL`, [id]);
+      if (result.rowsAffected === 0) {
+        notFound(schema.name, id);
+      }
+      return {
+        operation: 'restored',
+        id
+      };
+    },
+    async list(query) {
+      context.assertUsable();
+      (0, _faults.throwIfFaulted)('read');
+      (0, _validate.validateQuery)(schema, query);
+      const sort = (0, _sort.withStableTiebreaker)(query?.sort);
+      const size = (0, _paginate.resolvePageSize)(query?.page);
+      const filter = (0, _sqlBuilder.buildFilter)(query?.filter);
+      const clauses = [filter.sql];
+      const params = [...filter.params];
+      if (query?.includeSoftDeleted !== true) {
+        clauses.push(LIVE);
+      }
+      if (query?.page?.cursor) {
+        const keyset = (0, _sqlBuilder.buildKeysetPredicate)(sort, (0, _cursor.decodeCursor)(query.page.cursor, sort));
+        clauses.push(keyset.sql);
+        params.push(...keyset.params);
+      }
+
+      // One row past the page, so `hasMore` is answered without a second
+      // query that could disagree with the first under a concurrent write.
+      const limit = (0, _paginate.fetchLimitFor)(size);
+      const result = await context.executor().execute(`SELECT ${selectColumns} FROM ${table} WHERE ${clauses.join(' AND ')} ORDER BY ${(0, _sqlBuilder.buildOrderBy)(sort)} LIMIT ?`, [...params, limit]);
+      return (0, _paginate.buildPage)(result.rows.map(row => (0, _rowCodec.decodeRow)(schema, row)), sort, size);
+    },
+    async count(filter) {
+      context.assertUsable();
+      (0, _faults.throwIfFaulted)('read');
+      if (filter) {
+        (0, _validate.validateQuery)(schema, {
+          filter
+        });
+      }
+      const built = (0, _sqlBuilder.buildFilter)(filter);
+      const result = await context.executor().execute(`SELECT count(*) AS total FROM ${table} WHERE ${built.sql} AND ${LIVE}`, built.params);
+      return Number(result.rows[0]?.total ?? 0);
+    }
+  };
+}
+//# sourceMappingURL=collection.js.map

package/lib/commonjs/adapter/collection.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_errors","require","_errors2","_faults","_cursor","_paginate","_sort","_validate","_declare","_rowCodec","_sqlBuilder","_statements","_budgets","LIVE","notFound","collection","id","raise","DiagnosticCodes","RECORD_NOT_FOUND","message","detail","recordId","createSqlCollection","context","schema","table","collectionTable","name","selectColumns","join","rowById","includeDeleted","result","executor","execute","rows","insert","record","assertUsable","throwIfFaulted","payload","assertRecordWithinBudget","data","insertStatement","now","rowsAffected","RECORD_CONFLICT","operation","update","updateStatement","liveOnly","upsert","restore","inserted","get","row","decodeRow","find","delete","softDelete","hasSoftDelete","CONFIG_INVALID","list","query","validateQuery","sort","withStableTiebreaker","size","resolvePageSize","page","filter","buildFilter","clauses","sql","params","includeSoftDeleted","push","cursor","keyset","buildKeysetPredicate","decodeCursor","limit","fetchLimitFor","buildOrderBy","buildPage","map","count","built","Number","total"],"sourceRoot":"../../../src","sources":["adapter/collection.ts"],"mappings":";;;;;;AAaA,IAAAA,OAAA,GAAAC,OAAA;AAUA,IAAAC,QAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,SAAA,GAAAJ,OAAA;AACA,IAAAK,KAAA,GAAAL,OAAA;AACA,IAAAM,SAAA,GAAAN,OAAA;AACA,IAAAO,QAAA,GAAAP,OAAA;AAGA,IAAAQ,SAAA,GAAAR,OAAA;AACA,IAAAS,WAAA,GAAAT,OAAA;AACA,IAAAU,WAAA,GAAAV,OAAA;AACA,IAAAW,QAAA,GAAAX,OAAA;AAnCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAkCA,MAAMY,IAAI,GAAG,oBAAoB;AAEjC,SAASC,QAAQA,CAACC,UAAkB,EAAEC,EAAU,EAAS;EACxD,IAAAC,cAAK,EAACC,uBAAe,CAACC,gBAAgB,EAAE;IACvCC,OAAO,EAAE,kBAAkB;IAC3BC,MAAM,EAAE;MAAEN,UAAU;MAAEO,QAAQ,EAAEN;IAAG;EACpC,CAAC,CAAC;AACH;AAEO,SAASO,mBAAmBA,CAClCC,OAA6B,EACV;EACnB,MAAM;IAAEC;EAAO,CAAC,GAAGD,OAAO;EAC1B,MAAME,KAAK,GAAG,IAAI,IAAAC,wBAAe,EAACF,MAAM,CAACG,IAAI,CAAC,GAAG;EAEjD,MAAMC,aAAa,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAACC,IAAI,CAAC,IAAI,CAAC;EAE5F,eAAeC,OAAOA,CACrBf,EAAU,EACVgB,cAAc,GAAG,KAAK,EACyB;IAC/C,MAAMC,MAAM,GAAG,MAAMT,OAAO,CAC1BU,QAAQ,CAAC,CAAC,CACVC,OAAO,CACP,UAAUN,aAAa,SAASH,KAAK,gBAAgBM,cAAc,GAAG,EAAE,GAAG,QAAQnB,IAAI,EAAE,EAAE,EAC3F,CAACG,EAAE,CACJ,CAAC;IACF,OAAOiB,MAAM,CAACG,IAAI,CAAC,CAAC,CAAC;EACtB;EAEA,OAAO;IACN,MAAMC,MAAMA,CAACC,MAAsB,EAAyB;MAC3Dd,OAAO,CAACe,YAAY,CAAC,CAAC;MACtB,IAAAC,sBAAc,EAAC,OAAO,CAAC;MACvB,MAAMC,OAAO,GAAG,IAAAC,iCAAwB,EAACjB,MAAM,CAACG,IAAI,EAAEU,MAAM,CAACK,IAAI,CAAC;;MAElE;MACA;MACA;MACA;MACA,MAAMV,MAAM,GAAG,MAAMT,OAAO,CAC1BU,QAAQ,CAAC,CAAC,CACVC,OAAO,CACP,GAAG,IAAAS,2BAAe,EAACnB,MAAM,EAAEa,MAAM,CAACtB,EAAE,EAAEsB,MAAM,CAACK,IAAI,EAAEnB,OAAO,CAACqB,GAAG,CAAC,CAAC,EAAEJ,OAAO,EAAE,QAAQ,CACpF,CAAC;MACF,IAAIR,MAAM,CAACa,YAAY,KAAK,CAAC,EAAE;QAC9B,IAAA7B,cAAK,EAACC,uBAAe,CAAC6B,eAAe,EAAE;UACtC3B,OAAO,EAAE,uBAAuB;UAChCC,MAAM,EAAE;YAAEN,UAAU,EAAEU,MAAM,CAACG,IAAI;YAAEN,QAAQ,EAAEgB,MAAM,CAACtB;UAAG;QACxD,CAAC,CAAC;MACH;MACA,OAAO;QAAEgC,SAAS,EAAE,SAAS;QAAEhC,EAAE,EAAEsB,MAAM,CAACtB;MAAG,CAAC;IAC/C,CAAC;IAED,MAAMiC,MAAMA,CAACjC,EAAE,EAAEsB,MAAM,EAAyB;MAC/Cd,OAAO,CAACe,YAAY,CAAC,CAAC;MACtB,IAAAC,sBAAc,EAAC,OAAO,CAAC;MACvB,MAAMC,OAAO,GAAG,IAAAC,iCAAwB,EAACjB,MAAM,CAACG,IAAI,EAAEU,MAAM,CAACK,IAAI,CAAC;MAElE,MAAMV,MAAM,GAAG,MAAMT,OAAO,CAC1BU,QAAQ,CAAC,CAAC,CACVC,OAAO,CACP,GAAG,IAAAe,2BAAe,EAACzB,MAAM,EAAET,EAAE,EAAEsB,MAAM,CAACK,IAAI,EAAEnB,OAAO,CAACqB,GAAG,CAAC,CAAC,EAAEJ,OAAO,EAAE;QAAEU,QAAQ,EAAE;MAAK,CAAC,CACvF,CAAC;MACF,IAAIlB,MAAM,CAACa,YAAY,KAAK,CAAC,EAAE;QAC9B;QACA;QACAhC,QAAQ,CAACW,MAAM,CAACG,IAAI,EAAEZ,EAAE,CAAC;MAC1B;MACA,OAAO;QAAEgC,SAAS,EAAE,SAAS;QAAEhC;MAAG,CAAC;IACpC,CAAC;IAED,MAAMoC,MAAMA,CAACd,MAAsB,EAAyB;MAC3Dd,OAAO,CAACe,YAAY,CAAC,CAAC;MACtB,IAAAC,sBAAc,EAAC,OAAO,CAAC;MACvB,MAAMC,OAAO,GAAG,IAAAC,iCAAwB,EAACjB,MAAM,CAACG,IAAI,EAAEU,MAAM,CAACK,IAAI,CAAC;MAClE,MAAME,GAAG,GAAGrB,OAAO,CAACqB,GAAG,CAAC,CAAC;;MAEzB;MACA;MACA,MAAMI,MAAM,GAAG,MAAAA,CAAA,KAA8B;QAC5C,MAAMhB,MAAM,GAAG,MAAMT,OAAO,CAC1BU,QAAQ,CAAC,CAAC,CACVC,OAAO,CACP,GAAG,IAAAe,2BAAe,EAACzB,MAAM,EAAEa,MAAM,CAACtB,EAAE,EAAEsB,MAAM,CAACK,IAAI,EAAEE,GAAG,EAAEJ,OAAO,EAAE;UAAEY,OAAO,EAAE;QAAK,CAAC,CACnF,CAAC;QACF,OAAOpB,MAAM,CAACa,YAAY,GAAG,CAAC;MAC/B,CAAC;;MAED;MACA;MACA,IAAI,MAAMG,MAAM,CAAC,CAAC,EAAE;QACnB,OAAO;UAAED,SAAS,EAAE,SAAS;UAAEhC,EAAE,EAAEsB,MAAM,CAACtB;QAAG,CAAC;MAC/C;MACA,MAAMsC,QAAQ,GAAG,MAAM9B,OAAO,CAC5BU,QAAQ,CAAC,CAAC,CACVC,OAAO,CAAC,GAAG,IAAAS,2BAAe,EAACnB,MAAM,EAAEa,MAAM,CAACtB,EAAE,EAAEsB,MAAM,CAACK,IAAI,EAAEE,GAAG,EAAEJ,OAAO,EAAE,QAAQ,CAAC,CAAC;MACrF,IAAIa,QAAQ,CAACR,YAAY,GAAG,CAAC,EAAE;QAC9B,OAAO;UAAEE,SAAS,EAAE,SAAS;UAAEhC,EAAE,EAAEsB,MAAM,CAACtB;QAAG,CAAC;MAC/C;MACA;MACA,MAAMiC,MAAM,CAAC,CAAC;MACd,OAAO;QAAED,SAAS,EAAE,SAAS;QAAEhC,EAAE,EAAEsB,MAAM,CAACtB;MAAG,CAAC;IAC/C,CAAC;IAED,MAAMuC,GAAGA,CAACvC,EAAU,EAA4B;MAC/CQ,OAAO,CAACe,YAAY,CAAC,CAAC;MACtB,IAAAC,sBAAc,EAAC,MAAM,CAAC;MACtB,MAAMgB,GAAG,GAAG,MAAMzB,OAAO,CAACf,EAAE,CAAC;MAC7B,IAAI,CAACwC,GAAG,EAAE;QACT1C,QAAQ,CAACW,MAAM,CAACG,IAAI,EAAEZ,EAAE,CAAC;MAC1B;MACA,OAAO,IAAAyC,mBAAS,EAAIhC,MAAM,EAAE+B,GAAG,CAAC;IACjC,CAAC;IAED,MAAME,IAAIA,CAAC1C,EAAU,EAAmC;MACvDQ,OAAO,CAACe,YAAY,CAAC,CAAC;MACtB,IAAAC,sBAAc,EAAC,MAAM,CAAC;MACtB,MAAMgB,GAAG,GAAG,MAAMzB,OAAO,CAACf,EAAE,CAAC;MAC7B,OAAOwC,GAAG,GAAG,IAAAC,mBAAS,EAAIhC,MAAM,EAAE+B,GAAG,CAAC,GAAG,IAAI;IAC9C,CAAC;IAED,MAAMG,MAAMA,CAAC3C,EAAU,EAAyB;MAC/CQ,OAAO,CAACe,YAAY,CAAC,CAAC;MACtB,IAAAC,sBAAc,EAAC,OAAO,CAAC;MACvB,MAAMP,MAAM,GAAG,MAAMT,OAAO,CAACU,QAAQ,CAAC,CAAC,CAACC,OAAO,CAAC,eAAeT,KAAK,eAAe,EAAE,CAACV,EAAE,CAAC,CAAC;MAC1F,IAAIiB,MAAM,CAACa,YAAY,KAAK,CAAC,EAAE;QAC9BhC,QAAQ,CAACW,MAAM,CAACG,IAAI,EAAEZ,EAAE,CAAC;MAC1B;MACA,OAAO;QAAEgC,SAAS,EAAE,SAAS;QAAEhC;MAAG,CAAC;IACpC,CAAC;IAED,MAAM4C,UAAUA,CAAC5C,EAAU,EAAyB;MACnDQ,OAAO,CAACe,YAAY,CAAC,CAAC;MACtB,IAAAC,sBAAc,EAAC,OAAO,CAAC;MACvB,IAAI,CAAC,IAAAqB,sBAAa,EAACpC,MAAM,CAAC,EAAE;QAC3B,IAAAR,cAAK,EAACC,uBAAe,CAAC4C,cAAc,EAAE;UACrC1C,OAAO,EAAE,yCAAyC;UAClDC,MAAM,EAAE;YAAEN,UAAU,EAAEU,MAAM,CAACG;UAAK;QACnC,CAAC,CAAC;MACH;MACA,MAAMK,MAAM,GAAG,MAAMT,OAAO,CAC1BU,QAAQ,CAAC,CAAC,CACVC,OAAO,CAAC,UAAUT,KAAK,wCAAwCb,IAAI,EAAE,EAAE,CACvEW,OAAO,CAACqB,GAAG,CAAC,CAAC,EACb7B,EAAE,CACF,CAAC;MACH,IAAIiB,MAAM,CAACa,YAAY,KAAK,CAAC,EAAE;QAC9BhC,QAAQ,CAACW,MAAM,CAACG,IAAI,EAAEZ,EAAE,CAAC;MAC1B;MACA,OAAO;QAAEgC,SAAS,EAAE,SAAS;QAAEhC;MAAG,CAAC;IACpC,CAAC;IAED,MAAMqC,OAAOA,CAACrC,EAAU,EAAyB;MAChDQ,OAAO,CAACe,YAAY,CAAC,CAAC;MACtB,IAAAC,sBAAc,EAAC,OAAO,CAAC;MACvB,IAAI,CAAC,IAAAqB,sBAAa,EAACpC,MAAM,CAAC,EAAE;QAC3B,IAAAR,cAAK,EAACC,uBAAe,CAAC4C,cAAc,EAAE;UACrC1C,OAAO,EAAE,yCAAyC;UAClDC,MAAM,EAAE;YAAEN,UAAU,EAAEU,MAAM,CAACG;UAAK;QACnC,CAAC,CAAC;MACH;MACA,MAAMK,MAAM,GAAG,MAAMT,OAAO,CAC1BU,QAAQ,CAAC,CAAC,CACVC,OAAO,CAAC,UAAUT,KAAK,gEAAgE,EAAE,CACzFV,EAAE,CACF,CAAC;MACH,IAAIiB,MAAM,CAACa,YAAY,KAAK,CAAC,EAAE;QAC9BhC,QAAQ,CAACW,MAAM,CAACG,IAAI,EAAEZ,EAAE,CAAC;MAC1B;MACA,OAAO;QAAEgC,SAAS,EAAE,UAAU;QAAEhC;MAAG,CAAC;IACrC,CAAC;IAED,MAAM+C,IAAIA,CAACC,KAAa,EAA0B;MACjDxC,OAAO,CAACe,YAAY,CAAC,CAAC;MACtB,IAAAC,sBAAc,EAAC,MAAM,CAAC;MACtB,IAAAyB,uBAAa,EAACxC,MAAM,EAAEuC,KAAK,CAAC;MAE5B,MAAME,IAAI,GAAG,IAAAC,0BAAoB,EAACH,KAAK,EAAEE,IAAI,CAAC;MAC9C,MAAME,IAAI,GAAG,IAAAC,yBAAe,EAACL,KAAK,EAAEM,IAAI,CAAC;MACzC,MAAMC,MAAM,GAAG,IAAAC,uBAAW,EAACR,KAAK,EAAEO,MAAM,CAAC;MAEzC,MAAME,OAAO,GAAG,CAACF,MAAM,CAACG,GAAG,CAAC;MAC5B,MAAMC,MAAkB,GAAG,CAAC,GAAGJ,MAAM,CAACI,MAAM,CAAC;MAE7C,IAAIX,KAAK,EAAEY,kBAAkB,KAAK,IAAI,EAAE;QACvCH,OAAO,CAACI,IAAI,CAAChE,IAAI,CAAC;MACnB;MACA,IAAImD,KAAK,EAAEM,IAAI,EAAEQ,MAAM,EAAE;QACxB,MAAMC,MAAM,GAAG,IAAAC,gCAAoB,EAACd,IAAI,EAAE,IAAAe,oBAAY,EAACjB,KAAK,CAACM,IAAI,CAACQ,MAAM,EAAEZ,IAAI,CAAC,CAAC;QAChFO,OAAO,CAACI,IAAI,CAACE,MAAM,CAACL,GAAG,CAAC;QACxBC,MAAM,CAACE,IAAI,CAAC,GAAGE,MAAM,CAACJ,MAAM,CAAC;MAC9B;;MAEA;MACA;MACA,MAAMO,KAAK,GAAG,IAAAC,uBAAa,EAACf,IAAI,CAAC;MACjC,MAAMnC,MAAM,GAAG,MAAMT,OAAO,CAC1BU,QAAQ,CAAC,CAAC,CACVC,OAAO,CACP,UAAUN,aAAa,SAASH,KAAK,UAAU+C,OAAO,CAAC3C,IAAI,CAC1D,OACD,CAAC,aAAa,IAAAsD,wBAAY,EAAClB,IAAI,CAAC,UAAU,EAC1C,CAAC,GAAGS,MAAM,EAAEO,KAAK,CAClB,CAAC;MAEF,OAAO,IAAAG,mBAAS,EACfpD,MAAM,CAACG,IAAI,CAACkD,GAAG,CAAC9B,GAAG,IAAI,IAAAC,mBAAS,EAAIhC,MAAM,EAAE+B,GAAG,CAAC,CAAC,EACjDU,IAAI,EACJE,IACD,CAAC;IACF,CAAC;IAED,MAAMmB,KAAKA,CAAChB,MAAmB,EAAmB;MACjD/C,OAAO,CAACe,YAAY,CAAC,CAAC;MACtB,IAAAC,sBAAc,EAAC,MAAM,CAAC;MACtB,IAAI+B,MAAM,EAAE;QACX,IAAAN,uBAAa,EAACxC,MAAM,EAAE;UAAE8C;QAAO,CAAC,CAAC;MAClC;MACA,MAAMiB,KAAK,GAAG,IAAAhB,uBAAW,EAACD,MAAM,CAAC;MACjC,MAAMtC,MAAM,GAAG,MAAMT,OAAO,CAC1BU,QAAQ,CAAC,CAAC,CACVC,OAAO,CACP,iCAAiCT,KAAK,UAAU8D,KAAK,CAACd,GAAG,QAAQ7D,IAAI,EAAE,EACvE2E,KAAK,CAACb,MACP,CAAC;MACF,OAAOc,MAAM,CAACxD,MAAM,CAACG,IAAI,CAAC,CAAC,CAAC,EAAEsD,KAAK,IAAI,CAAC,CAAC;IAC1C;EACD,CAAC;AACF","ignoreList":[]}