@chipmobilesdk/rn-local-db 0.4.0 → 0.5.0

package/lib/module/crypto/derive.js

@@ -0,0 +1,56 @@
+"use strict";
+
+/**
+ * Per-artifact key derivation.
+ *
+ * The database key is handed straight to SQLCipher. Using that same material
+ * as the AES-GCM key for artifacts would mean the two keystreams share a
+ * secret, so a weakness in either one — a nonce collision in the artifact
+ * format, a padding oracle in the database format — becomes a weakness in
+ * both. HKDF costs one hash and removes the coupling entirely (research.md
+ * R4).
+ *
+ * The artifact id is the HKDF `info`, so two artifacts under the same
+ * database key derive different subkeys. That is what makes the deterministic
+ * nonce scheme safe: a nonce is only ever reused with a different key.
+ */
+
+import { cipherModule } from "./provider.js";
+import { utf8Bytes } from "../platform/bytes.js";
+const HKDF_DIGEST = 'sha256';
+const KEY_BYTES = 32;
+const NONCE_BYTES = 12;
+function bytesOf(value) {
+  return utf8Bytes(value);
+}
+
+/** 32 bytes, one artifact, one database key. */
+export function deriveArtifactKey(databaseKey, scopeKey, attachmentId) {
+  const derived = cipherModule().hkdfSync(HKDF_DIGEST, bytesOf(databaseKey),
+  // The scope digest as salt keeps two scopes holding an artifact under
+  // the same id from deriving the same subkey.
+  bytesOf(scopeKey), bytesOf(`chipmobilesdk-localdb/artifact/${attachmentId}`), KEY_BYTES);
+  return new Uint8Array(derived);
+}
+
+/**
+ * Deterministic 12-byte nonce from the chunk index.
+ *
+ * Deterministic rather than random because a random nonce would have to be
+ * stored per chunk, and because uniqueness is already guaranteed one level
+ * up: the key is unique per artifact, so an index that is unique within the
+ * artifact is unique under that key. The remaining four bytes are a fixed
+ * domain tag rather than padding, so a nonce from this scheme can never
+ * collide with one from a future scheme that uses the same counter space.
+ */
+export function nonceForChunk(index) {
+  const nonce = new Uint8Array(NONCE_BYTES);
+  const view = new DataView(nonce.buffer);
+  view.setUint32(0, 0x4c444231, false); // "LDB1"
+  // Split across two 32-bit writes rather than a BigInt: chunk indexes stay
+  // far inside the safe integer range, and Hermes is happier without one.
+  view.setUint32(4, Math.floor(index / 0x100000000), false);
+  view.setUint32(8, index % 0x100000000, false);
+  return nonce;
+}
+//# sourceMappingURL=derive.js.map

package/lib/module/crypto/derive.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["cipherModule","utf8Bytes","HKDF_DIGEST","KEY_BYTES","NONCE_BYTES","bytesOf","value","deriveArtifactKey","databaseKey","scopeKey","attachmentId","derived","hkdfSync","Uint8Array","nonceForChunk","index","nonce","view","DataView","buffer","setUint32","Math","floor"],"sourceRoot":"../../../src","sources":["crypto/derive.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,YAAY,QAAQ,eAAY;AACzC,SAASC,SAAS,QAAQ,sBAAmB;AAE7C,MAAMC,WAAW,GAAG,QAAQ;AAC5B,MAAMC,SAAS,GAAG,EAAE;AACpB,MAAMC,WAAW,GAAG,EAAE;AAEtB,SAASC,OAAOA,CAACC,KAAa,EAAc;EAC3C,OAAOL,SAAS,CAACK,KAAK,CAAC;AACxB;;AAEA;AACA,OAAO,SAASC,iBAAiBA,CAChCC,WAAmB,EACnBC,QAAgB,EAChBC,YAAoB,EACP;EACb,MAAMC,OAAO,GAAGX,YAAY,CAAC,CAAC,CAACY,QAAQ,CACtCV,WAAW,EACXG,OAAO,CAACG,WAAW,CAAC;EACpB;EACA;EACAH,OAAO,CAACI,QAAQ,CAAC,EACjBJ,OAAO,CAAC,kCAAkCK,YAAY,EAAE,CAAC,EACzDP,SACD,CAAC;EACD,OAAO,IAAIU,UAAU,CAACF,OAAO,CAAC;AAC/B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASG,aAAaA,CAACC,KAAa,EAAc;EACxD,MAAMC,KAAK,GAAG,IAAIH,UAAU,CAACT,WAAW,CAAC;EACzC,MAAMa,IAAI,GAAG,IAAIC,QAAQ,CAACF,KAAK,CAACG,MAAM,CAAC;EACvCF,IAAI,CAACG,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;EACtC;EACA;EACAH,IAAI,CAACG,SAAS,CAAC,CAAC,EAAEC,IAAI,CAACC,KAAK,CAACP,KAAK,GAAG,WAAW,CAAC,EAAE,KAAK,CAAC;EACzDE,IAAI,CAACG,SAAS,CAAC,CAAC,EAAEL,KAAK,GAAG,WAAW,EAAE,KAAK,CAAC;EAC7C,OAAOC,KAAK;AACb","ignoreList":[]}

package/lib/module/crypto/key-provider.js

@@ -0,0 +1,67 @@
+"use strict";
+
+/**
+ * Key acquisition, scoped to one handle's lifetime.
+ *
+ * The package never generates, derives from its own material, persists,
+ * caches beyond the handle, transmits, or returns a key (FR-098). What it
+ * does is ask the app for one at open and hold it exactly as long as the
+ * connection that needs it — which is also why no keychain library appears in
+ * this package's dependencies (LIB-004).
+ *
+ * The provider receives the resolved scope, so an app can key per identity.
+ * That is not a convenience: it is what makes destroying one identity's key a
+ * meaningful answer to a deletion request, rather than a gesture that leaves
+ * the data readable under a shared key (FR-104).
+ */
+
+import { DiagnosticCodes } from "../contract/errors.js";
+import { raise } from "../diagnostics/errors.js";
+import { throwIfFaulted } from "../diagnostics/faults.js";
+
+/**
+ * A key with an explicit end of life.
+ *
+ * Handing the string around directly would leave copies wherever it was
+ * passed. A handle that can be released gives the connection one place to
+ * drop it, and gives `key-hygiene.test.ts` something to assert against.
+ */
+
+export async function acquireKey(encryption, scope) {
+  let key;
+  throwIfFaulted('keyProvider');
+  try {
+    key = await encryption.keyProvider.getKey(scope);
+  } catch (error) {
+    // A locked device is an expected condition, not a bug (FR-102), which
+    // is why this code is retryable and distinct from an invalid key.
+    raise(DiagnosticCodes.KEY_PROVIDER_FAILED, {
+      message: 'key provider failed',
+      cause: error
+    });
+  }
+  if (typeof key !== 'string' || key.length === 0) {
+    raise(DiagnosticCodes.KEY_INVALID, {
+      message: 'key provider returned no usable key'
+    });
+  }
+  let released = false;
+  return {
+    value() {
+      if (released || key === null) {
+        raise(DiagnosticCodes.KEY_INVALID, {
+          message: 'key material has already been released'
+        });
+      }
+      return key;
+    },
+    release() {
+      released = true;
+      key = null;
+    },
+    get released() {
+      return released;
+    }
+  };
+}
+//# sourceMappingURL=key-provider.js.map

package/lib/module/crypto/key-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["DiagnosticCodes","raise","throwIfFaulted","acquireKey","encryption","scope","key","keyProvider","getKey","error","KEY_PROVIDER_FAILED","message","cause","length","KEY_INVALID","released","value","release"],"sourceRoot":"../../../src","sources":["crypto/key-provider.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA,SAASA,eAAe,QAAQ,uBAAoB;AAEpD,SAASC,KAAK,QAAQ,0BAAuB;AAC7C,SAASC,cAAc,QAAQ,0BAAuB;;AAEtD;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA,OAAO,eAAeC,UAAUA,CAC/BC,UAA4B,EAC5BC,KAAoB,EACC;EACrB,IAAIC,GAAkB;EAEtBJ,cAAc,CAAC,aAAa,CAAC;EAE7B,IAAI;IACHI,GAAG,GAAG,MAAMF,UAAU,CAACG,WAAW,CAACC,MAAM,CAACH,KAAK,CAAC;EACjD,CAAC,CAAC,OAAOI,KAAK,EAAE;IACf;IACA;IACAR,KAAK,CAACD,eAAe,CAACU,mBAAmB,EAAE;MAC1CC,OAAO,EAAE,qBAAqB;MAC9BC,KAAK,EAAEH;IACR,CAAC,CAAC;EACH;EAEA,IAAI,OAAOH,GAAG,KAAK,QAAQ,IAAIA,GAAG,CAACO,MAAM,KAAK,CAAC,EAAE;IAChDZ,KAAK,CAACD,eAAe,CAACc,WAAW,EAAE;MAClCH,OAAO,EAAE;IACV,CAAC,CAAC;EACH;EAEA,IAAII,QAAQ,GAAG,KAAK;EACpB,OAAO;IACNC,KAAKA,CAAA,EAAW;MACf,IAAID,QAAQ,IAAIT,GAAG,KAAK,IAAI,EAAE;QAC7BL,KAAK,CAACD,eAAe,CAACc,WAAW,EAAE;UAClCH,OAAO,EAAE;QACV,CAAC,CAAC;MACH;MACA,OAAOL,GAAG;IACX,CAAC;IACDW,OAAOA,CAAA,EAAS;MACfF,QAAQ,GAAG,IAAI;MACfT,GAAG,GAAG,IAAI;IACX,CAAC;IACD,IAAIS,QAAQA,CAAA,EAAY;MACvB,OAAOA,QAAQ;IAChB;EACD,CAAC;AACF","ignoreList":[]}

package/lib/module/crypto/provider.js

@@ -0,0 +1,49 @@
+"use strict";
+
+/**
+ * The cipher peer, behind one lazy accessor.
+ *
+ * Marked optional in `peerDependenciesMeta`: an app that never enables
+ * encryption should not have to install a native crypto module. That makes
+ * "the peer is absent" a supported state rather than a broken install, so it
+ * reports `ENCRYPTION_UNAVAILABLE` — the same code as a missing SQLCipher
+ * build flag, because from the app's side it is the same problem: encryption
+ * was asked for and cannot be delivered (research.md R1a).
+ */
+
+import { lazyPeer } from '@chipmobilesdk/rn-core';
+import { DiagnosticCodes } from "../contract/errors.js";
+import { StorageError } from "../diagnostics/errors.js";
+
+/**
+ * The two things this package asks of a cipher: AES-256-GCM for artifacts, and
+ * HKDF to derive each artifact's subkey. Hashing is not among them — the scope
+ * digest is SHA-256 in plain TypeScript (`scope/hash.ts`), because it runs on
+ * every scope resolution including the ones that never open an encrypted
+ * database, where a native module may not be installed at all (WS4-08).
+ */
+
+/** Loaded on first use (rn-core's lazy peer); optional, so absence is a normal answer. */
+const cipher = lazyPeer('react-native-quick-crypto', () => {
+  // Inside `try`, so Metro bundles an app that leaves this optional peer out.
+  try {
+    return require('react-native-quick-crypto');
+  } catch (cause) {
+    throw cause;
+  }
+});
+
+/** Swap the module. Tests only; `null` goes back to the real one. */
+export function setCipherModule(module) {
+  cipher.override(module ?? undefined);
+}
+export function isCipherAvailable() {
+  return cipher.isAvailable();
+}
+export function cipherModule() {
+  return cipher.require((_peer, cause) => new StorageError(DiagnosticCodes.ENCRYPTION_UNAVAILABLE, {
+    message: 'cipher peer is not installed',
+    cause
+  }));
+}
+//# sourceMappingURL=provider.js.map

package/lib/module/crypto/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["lazyPeer","DiagnosticCodes","StorageError","cipher","require","cause","setCipherModule","module","override","undefined","isCipherAvailable","isAvailable","cipherModule","_peer","ENCRYPTION_UNAVAILABLE","message"],"sourceRoot":"../../../src","sources":["crypto/provider.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,QAAQ,QAAQ,wBAAwB;AAEjD,SAASC,eAAe,QAAQ,uBAAoB;AACpD,SAASC,YAAY,QAAQ,0BAAuB;;AAEpD;AACA;AACA;AACA;AACA;AACA;AACA;;AA6BA;AACA,MAAMC,MAAM,GAAGH,QAAQ,CAAC,2BAA2B,EAAE,MAAM;EAC1D;EACA,IAAI;IACH,OAAOI,OAAO,CAAC,2BAA2B,CAAC;EAC5C,CAAC,CAAC,OAAOC,KAAK,EAAE;IACf,MAAMA,KAAK;EACZ;AACD,CAAC,CAAC;;AAEF;AACA,OAAO,SAASC,eAAeA,CAACC,MAA2B,EAAQ;EAClEJ,MAAM,CAACK,QAAQ,CAACD,MAAM,IAAIE,SAAS,CAAC;AACrC;AAEA,OAAO,SAASC,iBAAiBA,CAAA,EAAY;EAC5C,OAAOP,MAAM,CAACQ,WAAW,CAAC,CAAC;AAC5B;AAEA,OAAO,SAASC,YAAYA,CAAA,EAAiB;EAC5C,OAAOT,MAAM,CAACC,OAAO,CACpB,CAACS,KAAK,EAAER,KAAK,KACZ,IAAIH,YAAY,CAACD,eAAe,CAACa,sBAAsB,EAAE;IACxDC,OAAO,EAAE,8BAA8B;IACvCV;EACD,CAAC,CACH,CAAC;AACF","ignoreList":[]}

package/lib/module/diagnostics/dev-log.js

@@ -0,0 +1,120 @@
+"use strict";
+
+/**
+ * Development-only diagnostics.
+ *
+ * Operation names, durations, and counts are safe to report. Record payloads,
+ * field values, and query parameters are not — in any build, including this
+ * one (FR-080, FR-081). There is deliberately no path here that accepts a
+ * payload, so a future caller cannot pass one by accident.
+ */
+
+import { createDiagnosticChannel, hasSdkSinks } from '@chipmobilesdk/rn-core';
+let logger = null;
+
+/** Passing null removes the logger. */
+export function setDiagnosticLogger(next) {
+  logger = next;
+}
+function isDevelopmentBuild() {
+  // __DEV__ is a React Native global; the typeof guard keeps this usable
+  // under plain Node when the package is exercised from Jest.
+  if (typeof __DEV__ !== 'undefined') return __DEV__ === true;
+  const {
+    process
+  } = globalThis;
+  return process?.env?.NODE_ENV !== 'production';
+}
+
+/**
+ * A failed operation also reaches the app's SDK sinks (`installSdkSink` from
+ * rn-core, CORE-08), in any build: its code, the operation and the collection,
+ * which are identifiers this package defines. Successes stay with the
+ * development logger.
+ */
+const channel = createDiagnosticChannel('rn-local-db');
+export function logDiagnostic(event) {
+  if (event.outcome !== undefined) {
+    channel.emit(event.outcome, 'warn', {
+      operation: event.operation,
+      ...(event.collection === undefined ? {} : {
+        collection: event.collection
+      }),
+      ...(event.adapter === undefined ? {} : {
+        adapter: event.adapter
+      })
+    });
+  }
+  if (!logger || !isDevelopmentBuild()) {
+    return;
+  }
+  logger(event);
+}
+export function isLogging() {
+  return logger !== null && isDevelopmentBuild();
+}
+
+/**
+ * Wrap a collection so every operation reports its name, duration, and result
+ * count — and nothing else.
+ *
+ * Wrapping once here rather than instrumenting each operation in the adapters
+ * is what keeps the guarantee checkable: there is one place that decides what
+ * a log line may contain, and it has no access to a payload to leak even if a
+ * future change wanted one. The wrapper is applied only when a logger is
+ * installed and the build is a development build, so a production bundle pays
+ * nothing and emits nothing (FR-081).
+ */
+export function instrument(collection, adapter, operations) {
+  // Unwrapped unless someone is listening: production pays nothing by default.
+  if (!isLogging() && !hasSdkSinks()) {
+    return operations;
+  }
+  const wrapped = {};
+  for (const [name, operation] of Object.entries(operations)) {
+    if (typeof operation !== 'function') {
+      wrapped[name] = operation;
+      continue;
+    }
+    wrapped[name] = async (...args) => {
+      const started = Date.now();
+      try {
+        const result = await operation(...args);
+        logDiagnostic({
+          operation: `${collection}.${name}`,
+          durationMs: Date.now() - started,
+          collection,
+          adapter,
+          ...(countOf(result) === undefined ? {} : {
+            count: countOf(result)
+          })
+        });
+        return result;
+      } catch (error) {
+        // The code, never the message: a failure log is exactly where a
+        // payload-bearing native message would otherwise end up.
+        logDiagnostic({
+          operation: `${collection}.${name}`,
+          durationMs: Date.now() - started,
+          collection,
+          adapter,
+          outcome: error.code ?? 'failed'
+        });
+        throw error;
+      }
+    };
+  }
+  return wrapped;
+}
+
+/** How many records an operation produced, when that is a meaningful answer. */
+function countOf(result) {
+  if (typeof result === 'number') {
+    return result;
+  }
+  if (result && typeof result === 'object' && Array.isArray(result.records)) {
+    return result.records.length;
+  }
+  return undefined;
+}
+//# sourceMappingURL=dev-log.js.map

package/lib/module/diagnostics/dev-log.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createDiagnosticChannel","hasSdkSinks","logger","setDiagnosticLogger","next","isDevelopmentBuild","__DEV__","process","globalThis","env","NODE_ENV","channel","logDiagnostic","event","outcome","undefined","emit","operation","collection","adapter","isLogging","instrument","operations","wrapped","name","Object","entries","args","started","Date","now","result","durationMs","countOf","count","error","code","Array","isArray","records","length"],"sourceRoot":"../../../src","sources":["diagnostics/dev-log.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,uBAAuB,EAAEC,WAAW,QAAQ,wBAAwB;AAc7E,IAAIC,MAA+B,GAAG,IAAI;;AAE1C;AACA,OAAO,SAASC,mBAAmBA,CAACC,IAA6B,EAAQ;EACxEF,MAAM,GAAGE,IAAI;AACd;AAEA,SAASC,kBAAkBA,CAAA,EAAY;EACtC;EACA;EACA,IAAI,OAAOC,OAAO,KAAK,WAAW,EAAE,OAAOA,OAAO,KAAK,IAAI;EAC3D,MAAM;IAAEC;EAAQ,CAAC,GAAGC,UAAwE;EAC5F,OAAOD,OAAO,EAAEE,GAAG,EAAEC,QAAQ,KAAK,YAAY;AAC/C;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,OAAO,GAAGX,uBAAuB,CAAC,aAAa,CAAC;AAEtD,OAAO,SAASY,aAAaA,CAACC,KAAsB,EAAQ;EAC3D,IAAIA,KAAK,CAACC,OAAO,KAAKC,SAAS,EAAE;IAChCJ,OAAO,CAACK,IAAI,CAACH,KAAK,CAACC,OAAO,EAAE,MAAM,EAAE;MACnCG,SAAS,EAAEJ,KAAK,CAACI,SAAS;MAC1B,IAAIJ,KAAK,CAACK,UAAU,KAAKH,SAAS,GAAG,CAAC,CAAC,GAAG;QAAEG,UAAU,EAAEL,KAAK,CAACK;MAAW,CAAC,CAAC;MAC3E,IAAIL,KAAK,CAACM,OAAO,KAAKJ,SAAS,GAAG,CAAC,CAAC,GAAG;QAAEI,OAAO,EAAEN,KAAK,CAACM;MAAQ,CAAC;IAClE,CAAC,CAAC;EACH;EACA,IAAI,CAACjB,MAAM,IAAI,CAACG,kBAAkB,CAAC,CAAC,EAAE;IACrC;EACD;EACAH,MAAM,CAACW,KAAK,CAAC;AACd;AAEA,OAAO,SAASO,SAASA,CAAA,EAAY;EACpC,OAAOlB,MAAM,KAAK,IAAI,IAAIG,kBAAkB,CAAC,CAAC;AAC/C;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASgB,UAAUA,CACzBH,UAAkB,EAClBC,OAA4B,EAC5BG,UAAa,EACT;EACJ;EACA,IAAI,CAACF,SAAS,CAAC,CAAC,IAAI,CAACnB,WAAW,CAAC,CAAC,EAAE;IACnC,OAAOqB,UAAU;EAClB;EAEA,MAAMC,OAAgC,GAAG,CAAC,CAAC;EAC3C,KAAK,MAAM,CAACC,IAAI,EAAEP,SAAS,CAAC,IAAIQ,MAAM,CAACC,OAAO,CAACJ,UAAU,CAAC,EAAE;IAC3D,IAAI,OAAOL,SAAS,KAAK,UAAU,EAAE;MACpCM,OAAO,CAACC,IAAI,CAAC,GAAGP,SAAS;MACzB;IACD;IACAM,OAAO,CAACC,IAAI,CAAC,GAAG,OAAO,GAAGG,IAAa,KAAuB;MAC7D,MAAMC,OAAO,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC;MAC1B,IAAI;QACH,MAAMC,MAAM,GAAG,MAAOd,SAAS,CAA6C,GAAGU,IAAI,CAAC;QACpFf,aAAa,CAAC;UACbK,SAAS,EAAE,GAAGC,UAAU,IAAIM,IAAI,EAAE;UAClCQ,UAAU,EAAEH,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGF,OAAO;UAChCV,UAAU;UACVC,OAAO;UACP,IAAIc,OAAO,CAACF,MAAM,CAAC,KAAKhB,SAAS,GAAG,CAAC,CAAC,GAAG;YAAEmB,KAAK,EAAED,OAAO,CAACF,MAAM;UAAE,CAAC;QACpE,CAAC,CAAC;QACF,OAAOA,MAAM;MACd,CAAC,CAAC,OAAOI,KAAK,EAAE;QACf;QACA;QACAvB,aAAa,CAAC;UACbK,SAAS,EAAE,GAAGC,UAAU,IAAIM,IAAI,EAAE;UAClCQ,UAAU,EAAEH,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGF,OAAO;UAChCV,UAAU;UACVC,OAAO;UACPL,OAAO,EAAGqB,KAAK,CAAuBC,IAAI,IAAI;QAC/C,CAAC,CAAC;QACF,MAAMD,KAAK;MACZ;IACD,CAAC;EACF;EACA,OAAOZ,OAAO;AACf;;AAEA;AACA,SAASU,OAAOA,CAACF,MAAe,EAAsB;EACrD,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE;IAC/B,OAAOA,MAAM;EACd;EACA,IACCA,MAAM,IACN,OAAOA,MAAM,KAAK,QAAQ,IAC1BM,KAAK,CAACC,OAAO,CAAEP,MAAM,CAA2BQ,OAAO,CAAC,EACvD;IACD,OAAQR,MAAM,CAA4BQ,OAAO,CAACC,MAAM;EACzD;EACA,OAAOzB,SAAS;AACjB","ignoreList":[]}

package/lib/module/diagnostics/errors.js

@@ -0,0 +1,44 @@
+"use strict";
+
+/**
+ * The single error type the package raises.
+ *
+ * Everything is redacted on the way in (see redact.ts), so there is no path
+ * by which a field value, query parameter, scope component, or key reaches an
+ * error object at all.
+ */
+
+import { SdkError } from '@chipmobilesdk/rn-core';
+import { DiagnosticCodes, RETRYABLE_CODES } from "../contract/errors.js";
+import { redactCause, redactDetail, sanitizeAuthoredMessage } from "./redact.js";
+/** The package's error; an `SdkError` (`@chipmobilesdk/rn-core`) with `pkg: 'rn-local-db'`. */
+export class StorageError extends SdkError {
+  constructor(code, init = {}) {
+    // Call sites pass only authored literals (authored-messages.test.ts).
+    const message = init.message ? sanitizeAuthoredMessage(init.message) : code;
+    // `cause` is deliberately NOT kept: the native error it came from may
+    // quote the offending value. Only its redacted identifier survives.
+    super('rn-local-db', code, {
+      message,
+      retryable: RETRYABLE_CODES.has(code),
+      redactedCause: redactCause(init.cause)
+    });
+    this.name = 'StorageError';
+    this.detail = redactDetail(init.detail);
+    // Version numbers and an outcome enum — no payload can hide in these.
+    this.migration = init.migration;
+  }
+}
+export function isStorageError(value) {
+  return value instanceof StorageError;
+}
+
+/** So no consumer ever has to parse a message string (FR-082). */
+export function isCode(value, code) {
+  return isStorageError(value) && value.code === code;
+}
+export function raise(code, init) {
+  throw new StorageError(code, init);
+}
+export { DiagnosticCodes };
+//# sourceMappingURL=errors.js.map

package/lib/module/diagnostics/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["SdkError","DiagnosticCodes","RETRYABLE_CODES","redactCause","redactDetail","sanitizeAuthoredMessage","StorageError","constructor","code","init","message","retryable","has","redactedCause","cause","name","detail","migration","isStorageError","value","isCode","raise"],"sourceRoot":"../../../src","sources":["diagnostics/errors.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,QAAQ,QAAQ,wBAAwB;AAEjD,SAASC,eAAe,EAAEC,eAAe,QAA6B,uBAAoB;AAE1F,SAASC,WAAW,EAAEC,YAAY,EAAEC,uBAAuB,QAAQ,aAAU;AAc7E;AACA,OAAO,MAAMC,YAAY,SAASN,QAAQ,CAAiB;EAI1DO,WAAWA,CAACC,IAAoB,EAAEC,IAAsB,GAAG,CAAC,CAAC,EAAE;IAC9D;IACA,MAAMC,OAAO,GAAGD,IAAI,CAACC,OAAO,GAAGL,uBAAuB,CAACI,IAAI,CAACC,OAAO,CAAC,GAAGF,IAAI;IAC3E;IACA;IACA,KAAK,CAAC,aAAa,EAAEA,IAAI,EAAE;MAC1BE,OAAO;MACPC,SAAS,EAAET,eAAe,CAACU,GAAG,CAACJ,IAAI,CAAC;MACpCK,aAAa,EAAEV,WAAW,CAACM,IAAI,CAACK,KAAK;IACtC,CAAC,CAAC;IACF,IAAI,CAACC,IAAI,GAAG,cAAc;IAC1B,IAAI,CAACC,MAAM,GAAGZ,YAAY,CAACK,IAAI,CAACO,MAAM,CAAC;IACvC;IACA,IAAI,CAACC,SAAS,GAAGR,IAAI,CAACQ,SAAS;EAChC;AACD;AAEA,OAAO,SAASC,cAAcA,CAACC,KAAc,EAAyB;EACrE,OAAOA,KAAK,YAAYb,YAAY;AACrC;;AAEA;AACA,OAAO,SAASc,MAAMA,CAACD,KAAc,EAAEX,IAAoB,EAAW;EACrE,OAAOU,cAAc,CAACC,KAAK,CAAC,IAAIA,KAAK,CAACX,IAAI,KAAKA,IAAI;AACpD;AAEA,OAAO,SAASa,KAAKA,CAACb,IAAoB,EAAEC,IAAuB,EAAS;EAC3E,MAAM,IAAIH,YAAY,CAACE,IAAI,EAAEC,IAAI,CAAC;AACnC;AAEA,SAASR,eAAe","ignoreList":[]}

package/lib/module/diagnostics/faults.js

@@ -0,0 +1,47 @@
+"use strict";
+
+/**
+ * The fault registry.
+ *
+ * It lives here rather than under `testing/` because FR-095 wants every
+ * documented failure reachable from a real app running the real adapter — the
+ * demo's fault-injection panel exercises the on-device path, not a simulation
+ * of it. So the check has to exist in production code.
+ *
+ * What does *not* exist in production code is a way to inject: `injectFault`
+ * and `clearFaults` are exported only from the `./testing` entrypoint. With
+ * nothing injected this is one lookup in an empty map, which is the price of
+ * being able to prove a recovery path works before a user finds it broken.
+ */
+
+import { StorageError } from "./errors.js";
+const faults = new Map();
+export function injectFault(spec) {
+  faults.set(spec.at, {
+    code: spec.code,
+    remaining: spec.times ?? Number.POSITIVE_INFINITY
+  });
+}
+export function clearFaults() {
+  faults.clear();
+}
+export function activeFaults() {
+  return [...faults.keys()];
+}
+export function throwIfFaulted(point) {
+  if (faults.size === 0) {
+    return;
+  }
+  const fault = faults.get(point);
+  if (!fault || fault.remaining <= 0) {
+    return;
+  }
+  fault.remaining -= 1;
+  if (fault.remaining <= 0) {
+    faults.delete(point);
+  }
+  throw new StorageError(fault.code, {
+    message: `injected fault at ${point}`
+  });
+}
+//# sourceMappingURL=faults.js.map

package/lib/module/diagnostics/faults.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["StorageError","faults","Map","injectFault","spec","set","at","code","remaining","times","Number","POSITIVE_INFINITY","clearFaults","clear","activeFaults","keys","throwIfFaulted","point","size","fault","get","delete","message"],"sourceRoot":"../../../src","sources":["diagnostics/faults.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA,SAASA,YAAY,QAAQ,aAAU;AAYvC,MAAMC,MAAM,GAAG,IAAIC,GAAG,CAA0D,CAAC;AAEjF,OAAO,SAASC,WAAWA,CAACC,IAAe,EAAQ;EAClDH,MAAM,CAACI,GAAG,CAACD,IAAI,CAACE,EAAE,EAAE;IACnBC,IAAI,EAAEH,IAAI,CAACG,IAAI;IACfC,SAAS,EAAEJ,IAAI,CAACK,KAAK,IAAIC,MAAM,CAACC;EACjC,CAAC,CAAC;AACH;AAEA,OAAO,SAASC,WAAWA,CAAA,EAAS;EACnCX,MAAM,CAACY,KAAK,CAAC,CAAC;AACf;AAEA,OAAO,SAASC,YAAYA,CAAA,EAAiB;EAC5C,OAAO,CAAC,GAAGb,MAAM,CAACc,IAAI,CAAC,CAAC,CAAC;AAC1B;AAEA,OAAO,SAASC,cAAcA,CAACC,KAAiB,EAAQ;EACvD,IAAIhB,MAAM,CAACiB,IAAI,KAAK,CAAC,EAAE;IACtB;EACD;EACA,MAAMC,KAAK,GAAGlB,MAAM,CAACmB,GAAG,CAACH,KAAK,CAAC;EAC/B,IAAI,CAACE,KAAK,IAAIA,KAAK,CAACX,SAAS,IAAI,CAAC,EAAE;IACnC;EACD;EACAW,KAAK,CAACX,SAAS,IAAI,CAAC;EACpB,IAAIW,KAAK,CAACX,SAAS,IAAI,CAAC,EAAE;IACzBP,MAAM,CAACoB,MAAM,CAACJ,KAAK,CAAC;EACrB;EACA,MAAM,IAAIjB,YAAY,CAACmB,KAAK,CAACZ,IAAI,EAAE;IAAEe,OAAO,EAAE,qBAAqBL,KAAK;EAAG,CAAC,CAAC;AAC9E","ignoreList":[]}

package/lib/module/diagnostics/map-native.js

@@ -0,0 +1,93 @@
+"use strict";
+
+/**
+ * Native error to diagnostic code.
+ *
+ * The three failures FR-076 insists stay apart — a full disk, a filesystem
+ * the app cannot reach, and a corrupt database — arrive from SQLite and from
+ * the filesystem peer as ordinary errors with a string on them. Collapsing
+ * them into one write failure would be the easy thing and the wrong one: an
+ * app frees space for the first, retries after unlock for the second, and has
+ * to offer a reset for the third.
+ *
+ * Only the code is derived here. The message never travels — it is redacted
+ * at construction by `StorageError` (FR-079).
+ */
+
+import { DiagnosticCodes } from "../contract/errors.js";
+import { isStorageError, raise } from "./errors.js";
+function textOf(error) {
+  if (error instanceof Error) {
+    return `${error.message} ${error.code ?? ''}`;
+  }
+  if (typeof error === 'string') {
+    return error;
+  }
+  return '';
+}
+const DISK_FULL = /SQLITE_FULL|database or disk is full|ENOSPC|no space left/i;
+const NOT_A_DATABASE = /SQLITE_NOTADB|file is not a database|encrypted or is not a database/i;
+const CORRUPT = /SQLITE_CORRUPT|database disk image is malformed|malformed database/i;
+const CONFLICT = /UNIQUE constraint failed|PRIMARY KEY must be unique|SQLITE_CONSTRAINT_PRIMARYKEY/i;
+const ACCESS = /SQLITE_CANTOPEN|SQLITE_READONLY|SQLITE_PERM|SQLITE_AUTH|EACCES|EPERM|EROFS|ENOENT|EISDIR/i;
+const BUSY = /SQLITE_BUSY|SQLITE_LOCKED|database is locked/i;
+export function mapNativeError(error, context) {
+  const text = textOf(error);
+  if (DISK_FULL.test(text)) {
+    return DiagnosticCodes.DISK_FULL;
+  }
+  if (NOT_A_DATABASE.test(text)) {
+    // A wrong key and a corrupt file are indistinguishable from the engine's
+    // answer alone. Reporting corruption for a wrong key would push an app
+    // towards destroying recoverable data, so the encrypted case wins.
+    return context.encrypted ? DiagnosticCodes.KEY_INVALID : DiagnosticCodes.CORRUPTION;
+  }
+  if (CORRUPT.test(text)) {
+    return DiagnosticCodes.CORRUPTION;
+  }
+  if (CONFLICT.test(text)) {
+    return DiagnosticCodes.RECORD_CONFLICT;
+  }
+  if (ACCESS.test(text)) {
+    return DiagnosticCodes.STORAGE_ACCESS;
+  }
+  if (BUSY.test(text)) {
+    // Retryable, and distinct from a permanent write failure.
+    return context.operation === 'transaction' ? DiagnosticCodes.TRANSACTION_FAILED : DiagnosticCodes.WRITE_FAILED;
+  }
+  switch (context.operation) {
+    case 'open':
+      return DiagnosticCodes.OPEN_FAILED;
+    case 'read':
+      return DiagnosticCodes.STORAGE_ACCESS;
+    case 'transaction':
+      return DiagnosticCodes.TRANSACTION_FAILED;
+    case 'attachment':
+      return DiagnosticCodes.ATTACHMENT_WRITE_FAILED;
+    case 'delete':
+    case 'write':
+    default:
+      return DiagnosticCodes.WRITE_FAILED;
+  }
+}
+
+/**
+ * Re-raise a native failure as a typed one, preserving an error the package
+ * already classified rather than reclassifying it as a generic write failure.
+ */
+export function raiseNative(error, context) {
+  if (isStorageError(error)) {
+    throw error;
+  }
+  raise(mapNativeError(error, context), {
+    // The native message is deliberately not the error's message. It goes
+    // through `cause`, which redacts it — passing it here as well would be
+    // two chances to leak the same string for no extra information.
+    message: `native ${context.operation} failed`,
+    detail: {
+      operation: context.operation
+    },
+    cause: error
+  });
+}
+//# sourceMappingURL=map-native.js.map

package/lib/module/diagnostics/map-native.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["DiagnosticCodes","isStorageError","raise","textOf","error","Error","message","code","DISK_FULL","NOT_A_DATABASE","CORRUPT","CONFLICT","ACCESS","BUSY","mapNativeError","context","text","test","encrypted","KEY_INVALID","CORRUPTION","RECORD_CONFLICT","STORAGE_ACCESS","operation","TRANSACTION_FAILED","WRITE_FAILED","OPEN_FAILED","ATTACHMENT_WRITE_FAILED","raiseNative","detail","cause"],"sourceRoot":"../../../src","sources":["diagnostics/map-native.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,eAAe,QAA6B,uBAAoB;AACzE,SAASC,cAAc,EAAEC,KAAK,QAAQ,aAAU;AAahD,SAASC,MAAMA,CAACC,KAAc,EAAU;EACvC,IAAIA,KAAK,YAAYC,KAAK,EAAE;IAC3B,OAAO,GAAGD,KAAK,CAACE,OAAO,IAAKF,KAAK,CAAuBG,IAAI,IAAI,EAAE,EAAE;EACrE;EACA,IAAI,OAAOH,KAAK,KAAK,QAAQ,EAAE;IAC9B,OAAOA,KAAK;EACb;EACA,OAAO,EAAE;AACV;AAEA,MAAMI,SAAS,GAAG,4DAA4D;AAC9E,MAAMC,cAAc,GAAG,sEAAsE;AAC7F,MAAMC,OAAO,GAAG,qEAAqE;AACrF,MAAMC,QAAQ,GACb,mFAAmF;AACpF,MAAMC,MAAM,GACX,2FAA2F;AAC5F,MAAMC,IAAI,GAAG,+CAA+C;AAE5D,OAAO,SAASC,cAAcA,CAACV,KAAc,EAAEW,OAAsB,EAAkB;EACtF,MAAMC,IAAI,GAAGb,MAAM,CAACC,KAAK,CAAC;EAE1B,IAAII,SAAS,CAACS,IAAI,CAACD,IAAI,CAAC,EAAE;IACzB,OAAOhB,eAAe,CAACQ,SAAS;EACjC;EACA,IAAIC,cAAc,CAACQ,IAAI,CAACD,IAAI,CAAC,EAAE;IAC9B;IACA;IACA;IACA,OAAOD,OAAO,CAACG,SAAS,GAAGlB,eAAe,CAACmB,WAAW,GAAGnB,eAAe,CAACoB,UAAU;EACpF;EACA,IAAIV,OAAO,CAACO,IAAI,CAACD,IAAI,CAAC,EAAE;IACvB,OAAOhB,eAAe,CAACoB,UAAU;EAClC;EACA,IAAIT,QAAQ,CAACM,IAAI,CAACD,IAAI,CAAC,EAAE;IACxB,OAAOhB,eAAe,CAACqB,eAAe;EACvC;EACA,IAAIT,MAAM,CAACK,IAAI,CAACD,IAAI,CAAC,EAAE;IACtB,OAAOhB,eAAe,CAACsB,cAAc;EACtC;EACA,IAAIT,IAAI,CAACI,IAAI,CAACD,IAAI,CAAC,EAAE;IACpB;IACA,OAAOD,OAAO,CAACQ,SAAS,KAAK,aAAa,GACvCvB,eAAe,CAACwB,kBAAkB,GAClCxB,eAAe,CAACyB,YAAY;EAChC;EAEA,QAAQV,OAAO,CAACQ,SAAS;IACxB,KAAK,MAAM;MACV,OAAOvB,eAAe,CAAC0B,WAAW;IACnC,KAAK,MAAM;MACV,OAAO1B,eAAe,CAACsB,cAAc;IACtC,KAAK,aAAa;MACjB,OAAOtB,eAAe,CAACwB,kBAAkB;IAC1C,KAAK,YAAY;MAChB,OAAOxB,eAAe,CAAC2B,uBAAuB;IAC/C,KAAK,QAAQ;IACb,KAAK,OAAO;IACZ;MACC,OAAO3B,eAAe,CAACyB,YAAY;EACrC;AACD;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASG,WAAWA,CAACxB,KAAc,EAAEW,OAAsB,EAAS;EAC1E,IAAId,cAAc,CAACG,KAAK,CAAC,EAAE;IAC1B,MAAMA,KAAK;EACZ;EACAF,KAAK,CAACY,cAAc,CAACV,KAAK,EAAEW,OAAO,CAAC,EAAE;IACrC;IACA;IACA;IACAT,OAAO,EAAE,UAAUS,OAAO,CAACQ,SAAS,SAAS;IAC7CM,MAAM,EAAE;MAAEN,SAAS,EAAER,OAAO,CAACQ;IAAU,CAAC;IACxCO,KAAK,EAAE1B;EACR,CAAC,CAAC;AACH","ignoreList":[]}

package/lib/module/diagnostics/redact.js

@@ -0,0 +1,102 @@
+"use strict";
+
+/**
+ * Redaction, applied at construction rather than at logging time.
+ *
+ * The distinction matters: an error object that never held a payload cannot
+ * leak one through a consumer's crash reporter, which is where these leaks
+ * actually happen in practice. Redacting on the way out of a logger would
+ * still leave the values sitting on the object for anything else to pick up
+ * (FR-079, FR-099).
+ */
+
+import { REDACTED, leadingIdentifier, pickAllowed } from '@chipmobilesdk/rn-core';
+
+/**
+ * The allowlist IS the mechanism. Every key here has been reviewed as
+ * incapable of carrying user data: identifiers the app already knows, sizes,
+ * counts, and version numbers.
+ *
+ * A denylist was tried and removed. It rejected `recordId` because the name
+ * contains "record", which is the failure mode denylists always have — they
+ * guess from names. A closed allowlist cannot guess, and adding to it is a
+ * deliberate act with a reviewer attached.
+ */
+export const SAFE_DETAIL_KEYS = new Set(['code', 'collection', 'recordId', 'attachmentId', 'scopeKey', 'version', 'recordedVersion', 'failingVersion', 'outcome', 'operation', 'adapter', 'platform', 'sizeBytes', 'limitBytes', 'count', 'limit']);
+
+/**
+ * Reduce foreign text to an identifier, or to nothing.
+ *
+ * "Foreign" means text this package did not author: a SQLite message, a
+ * filesystem error, an `Error` a consumer's own migration threw. Any of them
+ * can contain anything — SQLite quotes bound parameters back, and a migration
+ * that fails on a constraint routinely names the value that violated it.
+ *
+ * An earlier version of this tried to keep the readable part: the text before
+ * the first colon, if it "looked like a class of failure". That heuristic
+ * fails on the case that matters. `Patient reported chest pain` looks exactly
+ * like a class of failure — short, no punctuation, no digits — and is a
+ * medical record. There is no shape test that separates prose describing a
+ * failure from prose describing a person, so there is no version of the
+ * heuristic worth keeping.
+ *
+ * What survives is a leading `SQLITE_*` / `ENOENT`-style identifier, which is
+ * a closed vocabulary of engine and libc constants and cannot be a value.
+ * Everything else becomes `[redacted]`. A developer who needs more can
+ * reproduce with the development logger; a crash report cannot.
+ */
+export function redactForeignText(text) {
+  return leadingIdentifier(text);
+}
+const MAX_AUTHORED_MESSAGE = 160;
+
+/**
+ * A message this package wrote itself.
+ *
+ * Every `raise()` call site passes a string literal, and the handful that
+ * interpolate do so with a value from a closed set — an operator name, a
+ * fault point, a sanitized identifier. `authored-messages.test.ts` enforces
+ * that mechanically against the source, so this is a checked property rather
+ * than a convention someone has to remember.
+ *
+ * So no filtering happens here: filtering a message the package wrote would
+ * destroy the only readable part of the error for no gain. Foreign text never
+ * reaches this function — it goes through `redactForeignText` above.
+ */
+export function sanitizeAuthoredMessage(message) {
+  return message.split('\n')[0].trim().slice(0, MAX_AUTHORED_MESSAGE);
+}
+
+/**
+ * Reduce a consumer-supplied identifier to a bounded, punctuation-free token.
+ *
+ * A field name is worth naming — FR-034 exists so a typo is distinguishable
+ * from a deliberate choice, and "which field?" is the whole answer. But the
+ * name arrives from the consumer, so it is capped and stripped rather than
+ * trusted verbatim.
+ */
+export function sanitizeIdentifier(identifier) {
+  const cleaned = identifier.replace(/\W/g, '').slice(0, 64);
+  return cleaned.length > 0 ? cleaned : REDACTED;
+}
+
+/** Keep only keys on the allowlist, and only primitive values. */
+export function redactDetail(detail) {
+  const safe = pickAllowed(detail, SAFE_DETAIL_KEYS);
+  return safe && Object.keys(safe).length > 0 ? safe : undefined;
+}
+
+/** Reduce an unknown thrown value to a message-shaped string, redacted. */
+export function redactCause(cause) {
+  if (cause === undefined || cause === null) {
+    return undefined;
+  }
+  if (cause instanceof Error) {
+    return redactForeignText(cause.message);
+  }
+  if (typeof cause === 'string') {
+    return redactForeignText(cause);
+  }
+  return REDACTED;
+}
+//# sourceMappingURL=redact.js.map

package/lib/module/diagnostics/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["REDACTED","leadingIdentifier","pickAllowed","SAFE_DETAIL_KEYS","Set","redactForeignText","text","MAX_AUTHORED_MESSAGE","sanitizeAuthoredMessage","message","split","trim","slice","sanitizeIdentifier","identifier","cleaned","replace","length","redactDetail","detail","safe","Object","keys","undefined","redactCause","cause","Error"],"sourceRoot":"../../../src","sources":["diagnostics/redact.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,QAAQ,EAAEC,iBAAiB,EAAEC,WAAW,QAAQ,wBAAwB;;AAEjF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,gBAAgB,GAAG,IAAIC,GAAG,CAAC,CACvC,MAAM,EACN,YAAY,EACZ,UAAU,EACV,cAAc,EACd,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,SAAS,EACT,UAAU,EACV,WAAW,EACX,YAAY,EACZ,OAAO,EACP,OAAO,CACP,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,iBAAiBA,CAACC,IAAY,EAAU;EACvD,OAAOL,iBAAiB,CAACK,IAAI,CAAC;AAC/B;AAEA,MAAMC,oBAAoB,GAAG,GAAG;;AAEhC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,uBAAuBA,CAACC,OAAe,EAAU;EAChE,OAAOA,OAAO,CAACC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAEC,IAAI,CAAC,CAAC,CAACC,KAAK,CAAC,CAAC,EAAEL,oBAAoB,CAAC;AACrE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASM,kBAAkBA,CAACC,UAAkB,EAAU;EAC9D,MAAMC,OAAO,GAAGD,UAAU,CAACE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAACJ,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;EAC1D,OAAOG,OAAO,CAACE,MAAM,GAAG,CAAC,GAAGF,OAAO,GAAGf,QAAQ;AAC/C;;AAEA;AACA,OAAO,SAASkB,YAAYA,CAC3BC,MAA2C,EACa;EACxD,MAAMC,IAAI,GAAGlB,WAAW,CAACiB,MAAM,EAAEhB,gBAAgB,CAAC;EAClD,OAAOiB,IAAI,IAAIC,MAAM,CAACC,IAAI,CAACF,IAAI,CAAC,CAACH,MAAM,GAAG,CAAC,GAAGG,IAAI,GAAGG,SAAS;AAC/D;;AAEA;AACA,OAAO,SAASC,WAAWA,CAACC,KAAc,EAAsB;EAC/D,IAAIA,KAAK,KAAKF,SAAS,IAAIE,KAAK,KAAK,IAAI,EAAE;IAC1C,OAAOF,SAAS;EACjB;EACA,IAAIE,KAAK,YAAYC,KAAK,EAAE;IAC3B,OAAOrB,iBAAiB,CAACoB,KAAK,CAAChB,OAAO,CAAC;EACxC;EACA,IAAI,OAAOgB,KAAK,KAAK,QAAQ,EAAE;IAC9B,OAAOpB,iBAAiB,CAACoB,KAAK,CAAC;EAChC;EACA,OAAOzB,QAAQ;AAChB","ignoreList":[]}

package/lib/module/index.js

@@ -0,0 +1,28 @@
+"use strict";
+
+/**
+ * `@chipmobilesdk/rn-local-db`
+ *
+ * Offline-first, scope-isolated local storage for ChipMobileSdk apps.
+ *
+ * What is deliberately absent is part of the contract: there is no
+ * `switchScope`, and no read, write, or query operation accepts a scope
+ * argument. Scope is bound to a handle at open time and immutable, so a
+ * cross-scope leak is not expressible rather than merely prevented.
+ *
+ * The underlying engine, the physical layout, key material, and the query
+ * translation are private and unreachable by deep import.
+ */
+
+// Lifecycle
+export { deleteDatabase, deleteScopeData, openDatabase, resetScope } from "./adapter/index.js";
+
+// Diagnostics
+export { DiagnosticCodes, StorageError, isCode, isStorageError } from "./diagnostics/errors.js";
+export { setDiagnosticLogger } from "./diagnostics/dev-log.js";
+
+// Budgets, so a consumer can check before it writes rather than after
+export { Budgets } from "./contract/config.js";
+
+// Contract types
+//# sourceMappingURL=index.js.map