@chipmobilesdk/rn-local-db 0.4.0 → 0.5.0

package/lib/commonjs/crypto/chunked-cipher.js

@@ -0,0 +1,147 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.TAG_BYTES = exports.MAGIC = exports.HEADER_BYTES = exports.FORMAT_VERSION = exports.ALGORITHM = void 0;
+exports.chunkCountFor = chunkCountFor;
+exports.chunkOffset = chunkOffset;
+exports.chunkPlaintextLength = chunkPlaintextLength;
+exports.decodeHeader = decodeHeader;
+exports.decryptChunk = decryptChunk;
+exports.encodeHeader = encodeHeader;
+exports.encryptChunk = encryptChunk;
+exports.encryptedLength = encryptedLength;
+exports.headerFor = headerFor;
+var _config = require("../contract/config.js");
+var _errors = require("../contract/errors.js");
+var _errors2 = require("../diagnostics/errors.js");
+var _derive = require("./derive.js");
+var _provider = require("./provider.js");
+var _bytes = require("../platform/bytes.js");
+/**
+ * The chunked AES-256-GCM artifact format.
+ *
+ * Whole-file encryption was rejected because a 100 MB artifact would have to
+ * be held in memory twice — plaintext and ciphertext — which breaks FR-107a's
+ * flat memory bound and every PERF-001 budget along with it (research.md R4).
+ * Chunking keeps exactly one 256 KB chunk in flight regardless of artifact
+ * size.
+ *
+ * ```text
+ * [ header 22 bytes ] magic | format version | chunk size | chunk count | plaintext size
+ * [ chunk 0 ] ciphertext(≤ chunkSize) | auth tag (16)
+ * [ chunk 1 ] …
+ * ```
+ *
+ * The auth tag follows each chunk rather than sitting in the header, which is
+ * a deliberate departure from the sketch in storage-layout.md. A tag is only
+ * known after its chunk has been encrypted, and the filesystem peer appends —
+ * it cannot seek back to patch a header. Collecting every tag before writing
+ * anything would mean buffering the whole ciphertext, which is the thing this
+ * format exists to avoid. Inline tags keep the write append-only and leave
+ * every chunk at a computable offset.
+ *
+ * A failing tag on read is `ATTACHMENT_UNDECRYPTABLE`, deliberately distinct
+ * from `ATTACHMENT_MISSING` (FR-107c): one is a wrong key or a tampered file
+ * and may be recoverable, the other is data that is simply gone.
+ */
+
+const MAGIC = exports.MAGIC = 'LDB1';
+const FORMAT_VERSION = exports.FORMAT_VERSION = 1;
+const HEADER_BYTES = exports.HEADER_BYTES = 22;
+const TAG_BYTES = exports.TAG_BYTES = 16;
+const ALGORITHM = exports.ALGORITHM = 'aes-256-gcm';
+function chunkCountFor(plaintextSize, chunkSize) {
+  return plaintextSize === 0 ? 0 : Math.ceil(plaintextSize / chunkSize);
+}
+function encodeHeader(header) {
+  const bytes = new Uint8Array(HEADER_BYTES);
+  for (let index = 0; index < 4; index += 1) {
+    bytes[index] = MAGIC.charCodeAt(index);
+  }
+  // Big-endian, as DataView writes by default; the on-disk format is unchanged.
+  const view = new DataView(bytes.buffer);
+  view.setUint16(4, header.formatVersion);
+  view.setUint32(6, header.chunkSize);
+  view.setUint32(10, header.chunkCount);
+  // Split across two 32-bit writes: artifact sizes stay well inside the safe
+  // integer range, and this avoids depending on BigInt in Hermes.
+  view.setUint32(14, Math.floor(header.plaintextSize / 0x100000000));
+  view.setUint32(18, header.plaintextSize % 0x100000000);
+  return bytes;
+}
+function decodeHeader(bytes) {
+  if (bytes.length < HEADER_BYTES || (0, _bytes.asciiAt)(bytes, 0, 4) !== MAGIC) {
+    (0, _errors2.raise)(_errors.DiagnosticCodes.ATTACHMENT_UNDECRYPTABLE, {
+      message: 'artifact header is not a recognised encrypted artifact'
+    });
+  }
+  const view = new DataView(bytes.buffer, bytes.byteOffset, HEADER_BYTES);
+  return {
+    formatVersion: view.getUint16(4),
+    chunkSize: view.getUint32(6),
+    chunkCount: view.getUint32(10),
+    plaintextSize: view.getUint32(14) * 0x100000000 + view.getUint32(18)
+  };
+}
+
+/** Plaintext length of chunk `index`; the last one is usually short. */
+function chunkPlaintextLength(header, index) {
+  const start = index * header.chunkSize;
+  return Math.max(0, Math.min(header.chunkSize, header.plaintextSize - start));
+}
+
+/**
+ * Byte offset of chunk `index` in the file.
+ *
+ * Every chunk but the last is full, so the offset is arithmetic rather than a
+ * table lookup — which is what lets a range read seek straight to the chunk
+ * it needs instead of walking the file.
+ */
+function chunkOffset(header, index) {
+  return HEADER_BYTES + index * (header.chunkSize + TAG_BYTES);
+}
+function encryptedLength(header) {
+  if (header.chunkCount === 0) {
+    return HEADER_BYTES;
+  }
+  const lastIndex = header.chunkCount - 1;
+  return chunkOffset(header, lastIndex) + chunkPlaintextLength(header, lastIndex) + TAG_BYTES;
+}
+
+/** One chunk in, ciphertext with its tag appended out. */
+function encryptChunk(key, index, plaintext) {
+  const cipher = (0, _provider.cipherModule)().createCipheriv(ALGORITHM, key, (0, _derive.nonceForChunk)(index));
+  return (0, _bytes.concatBytes)([new Uint8Array(cipher.update(plaintext)), new Uint8Array(cipher.final()), new Uint8Array(cipher.getAuthTag())]);
+}
+function decryptChunk(key, index, stored) {
+  if (stored.length < TAG_BYTES) {
+    (0, _errors2.raise)(_errors.DiagnosticCodes.ATTACHMENT_UNDECRYPTABLE, {
+      message: 'artifact chunk is truncated'
+    });
+  }
+  const body = stored.subarray(0, stored.length - TAG_BYTES);
+  const tag = stored.subarray(stored.length - TAG_BYTES);
+  const decipher = (0, _provider.cipherModule)().createDecipheriv(ALGORITHM, key, (0, _derive.nonceForChunk)(index));
+  decipher.setAuthTag(tag);
+  try {
+    return (0, _bytes.concatBytes)([new Uint8Array(decipher.update(body)), new Uint8Array(decipher.final())]);
+  } catch (error) {
+    // A failing tag is the only signal that separates "exists but will not
+    // decrypt" from "missing", and an app responds to them differently.
+    (0, _errors2.raise)(_errors.DiagnosticCodes.ATTACHMENT_UNDECRYPTABLE, {
+      message: 'artifact chunk failed authentication',
+      cause: error
+    });
+  }
+}
+function headerFor(plaintextSize, chunkSize = _config.Budgets.ARTIFACT_CHUNK_BYTES) {
+  return {
+    formatVersion: FORMAT_VERSION,
+    chunkSize,
+    chunkCount: chunkCountFor(plaintextSize, chunkSize),
+    plaintextSize
+  };
+}
+//# sourceMappingURL=chunked-cipher.js.map

package/lib/commonjs/crypto/chunked-cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_config","require","_errors","_errors2","_derive","_provider","_bytes","MAGIC","exports","FORMAT_VERSION","HEADER_BYTES","TAG_BYTES","ALGORITHM","chunkCountFor","plaintextSize","chunkSize","Math","ceil","encodeHeader","header","bytes","Uint8Array","index","charCodeAt","view","DataView","buffer","setUint16","formatVersion","setUint32","chunkCount","floor","decodeHeader","length","asciiAt","raise","DiagnosticCodes","ATTACHMENT_UNDECRYPTABLE","message","byteOffset","getUint16","getUint32","chunkPlaintextLength","start","max","min","chunkOffset","encryptedLength","lastIndex","encryptChunk","key","plaintext","cipher","cipherModule","createCipheriv","nonceForChunk","concatBytes","update","final","getAuthTag","decryptChunk","stored","body","subarray","tag","decipher","createDecipheriv","setAuthTag","error","cause","headerFor","Budgets","ARTIFACT_CHUNK_BYTES"],"sourceRoot":"../../../src","sources":["crypto/chunked-cipher.ts"],"mappings":";;;;;;;;;;;;;;;AA4BA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,QAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,SAAA,GAAAJ,OAAA;AACA,IAAAK,MAAA,GAAAL,OAAA;AAjCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AASO,MAAMM,KAAK,GAAAC,OAAA,CAAAD,KAAA,GAAG,MAAM;AACpB,MAAME,cAAc,GAAAD,OAAA,CAAAC,cAAA,GAAG,CAAC;AACxB,MAAMC,YAAY,GAAAF,OAAA,CAAAE,YAAA,GAAG,EAAE;AACvB,MAAMC,SAAS,GAAAH,OAAA,CAAAG,SAAA,GAAG,EAAE;AACpB,MAAMC,SAAS,GAAAJ,OAAA,CAAAI,SAAA,GAAG,aAAa;AAS/B,SAASC,aAAaA,CAACC,aAAqB,EAAEC,SAAiB,EAAU;EAC/E,OAAOD,aAAa,KAAK,CAAC,GAAG,CAAC,GAAGE,IAAI,CAACC,IAAI,CAACH,aAAa,GAAGC,SAAS,CAAC;AACtE;AAEO,SAASG,YAAYA,CAACC,MAAsB,EAAc;EAChE,MAAMC,KAAK,GAAG,IAAIC,UAAU,CAACX,YAAY,CAAC;EAC1C,KAAK,IAAIY,KAAK,GAAG,CAAC,EAAEA,KAAK,GAAG,CAAC,EAAEA,KAAK,IAAI,CAAC,EAAE;IAC1CF,KAAK,CAACE,KAAK,CAAC,GAAGf,KAAK,CAACgB,UAAU,CAACD,KAAK,CAAC;EACvC;EACA;EACA,MAAME,IAAI,GAAG,IAAIC,QAAQ,CAACL,KAAK,CAACM,MAAM,CAAC;EACvCF,IAAI,CAACG,SAAS,CAAC,CAAC,EAAER,MAAM,CAACS,aAAa,CAAC;EACvCJ,IAAI,CAACK,SAAS,CAAC,CAAC,EAAEV,MAAM,CAACJ,SAAS,CAAC;EACnCS,IAAI,CAACK,SAAS,CAAC,EAAE,EAAEV,MAAM,CAACW,UAAU,CAAC;EACrC;EACA;EACAN,IAAI,CAACK,SAAS,CAAC,EAAE,EAAEb,IAAI,CAACe,KAAK,CAACZ,MAAM,CAACL,aAAa,GAAG,WAAW,CAAC,CAAC;EAClEU,IAAI,CAACK,SAAS,CAAC,EAAE,EAAEV,MAAM,CAACL,aAAa,GAAG,WAAW,CAAC;EACtD,OAAOM,KAAK;AACb;AAEO,SAASY,YAAYA,CAACZ,KAAiB,EAAkB;EAC/D,IAAIA,KAAK,CAACa,MAAM,GAAGvB,YAAY,IAAI,IAAAwB,cAAO,EAACd,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,KAAKb,KAAK,EAAE;IAClE,IAAA4B,cAAK,EAACC,uBAAe,CAACC,wBAAwB,EAAE;MAC/CC,OAAO,EAAE;IACV,CAAC,CAAC;EACH;EACA,MAAMd,IAAI,GAAG,IAAIC,QAAQ,CAACL,KAAK,CAACM,MAAM,EAAEN,KAAK,CAACmB,UAAU,EAAE7B,YAAY,CAAC;EACvE,OAAO;IACNkB,aAAa,EAAEJ,IAAI,CAACgB,SAAS,CAAC,CAAC,CAAC;IAChCzB,SAAS,EAAES,IAAI,CAACiB,SAAS,CAAC,CAAC,CAAC;IAC5BX,UAAU,EAAEN,IAAI,CAACiB,SAAS,CAAC,EAAE,CAAC;IAC9B3B,aAAa,EAAEU,IAAI,CAACiB,SAAS,CAAC,EAAE,CAAC,GAAG,WAAW,GAAGjB,IAAI,CAACiB,SAAS,CAAC,EAAE;EACpE,CAAC;AACF;;AAEA;AACO,SAASC,oBAAoBA,CAACvB,MAAsB,EAAEG,KAAa,EAAU;EACnF,MAAMqB,KAAK,GAAGrB,KAAK,GAAGH,MAAM,CAACJ,SAAS;EACtC,OAAOC,IAAI,CAAC4B,GAAG,CAAC,CAAC,EAAE5B,IAAI,CAAC6B,GAAG,CAAC1B,MAAM,CAACJ,SAAS,EAAEI,MAAM,CAACL,aAAa,GAAG6B,KAAK,CAAC,CAAC;AAC7E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,WAAWA,CAAC3B,MAAsB,EAAEG,KAAa,EAAU;EAC1E,OAAOZ,YAAY,GAAGY,KAAK,IAAIH,MAAM,CAACJ,SAAS,GAAGJ,SAAS,CAAC;AAC7D;AAEO,SAASoC,eAAeA,CAAC5B,MAAsB,EAAU;EAC/D,IAAIA,MAAM,CAACW,UAAU,KAAK,CAAC,EAAE;IAC5B,OAAOpB,YAAY;EACpB;EACA,MAAMsC,SAAS,GAAG7B,MAAM,CAACW,UAAU,GAAG,CAAC;EACvC,OAAOgB,WAAW,CAAC3B,MAAM,EAAE6B,SAAS,CAAC,GAAGN,oBAAoB,CAACvB,MAAM,EAAE6B,SAAS,CAAC,GAAGrC,SAAS;AAC5F;;AAEA;AACO,SAASsC,YAAYA,CAACC,GAAe,EAAE5B,KAAa,EAAE6B,SAAqB,EAAc;EAC/F,MAAMC,MAAM,GAAG,IAAAC,sBAAY,EAAC,CAAC,CAACC,cAAc,CAAC1C,SAAS,EAAEsC,GAAG,EAAE,IAAAK,qBAAa,EAACjC,KAAK,CAAC,CAAC;EAClF,OAAO,IAAAkC,kBAAW,EAAC,CAClB,IAAInC,UAAU,CAAC+B,MAAM,CAACK,MAAM,CAACN,SAAS,CAAC,CAAC,EACxC,IAAI9B,UAAU,CAAC+B,MAAM,CAACM,KAAK,CAAC,CAAC,CAAC,EAC9B,IAAIrC,UAAU,CAAC+B,MAAM,CAACO,UAAU,CAAC,CAAC,CAAC,CACnC,CAAC;AACH;AAEO,SAASC,YAAYA,CAACV,GAAe,EAAE5B,KAAa,EAAEuC,MAAkB,EAAc;EAC5F,IAAIA,MAAM,CAAC5B,MAAM,GAAGtB,SAAS,EAAE;IAC9B,IAAAwB,cAAK,EAACC,uBAAe,CAACC,wBAAwB,EAAE;MAC/CC,OAAO,EAAE;IACV,CAAC,CAAC;EACH;EACA,MAAMwB,IAAI,GAAGD,MAAM,CAACE,QAAQ,CAAC,CAAC,EAAEF,MAAM,CAAC5B,MAAM,GAAGtB,SAAS,CAAC;EAC1D,MAAMqD,GAAG,GAAGH,MAAM,CAACE,QAAQ,CAACF,MAAM,CAAC5B,MAAM,GAAGtB,SAAS,CAAC;EAEtD,MAAMsD,QAAQ,GAAG,IAAAZ,sBAAY,EAAC,CAAC,CAACa,gBAAgB,CAACtD,SAAS,EAAEsC,GAAG,EAAE,IAAAK,qBAAa,EAACjC,KAAK,CAAC,CAAC;EACtF2C,QAAQ,CAACE,UAAU,CAACH,GAAG,CAAC;EACxB,IAAI;IACH,OAAO,IAAAR,kBAAW,EAAC,CAAC,IAAInC,UAAU,CAAC4C,QAAQ,CAACR,MAAM,CAACK,IAAI,CAAC,CAAC,EAAE,IAAIzC,UAAU,CAAC4C,QAAQ,CAACP,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;EAC9F,CAAC,CAAC,OAAOU,KAAK,EAAE;IACf;IACA;IACA,IAAAjC,cAAK,EAACC,uBAAe,CAACC,wBAAwB,EAAE;MAC/CC,OAAO,EAAE,sCAAsC;MAC/C+B,KAAK,EAAED;IACR,CAAC,CAAC;EACH;AACD;AAEO,SAASE,SAASA,CACxBxD,aAAqB,EACrBC,SAAS,GAAGwD,eAAO,CAACC,oBAAoB,EACvB;EACjB,OAAO;IACN5C,aAAa,EAAEnB,cAAc;IAC7BM,SAAS;IACTe,UAAU,EAAEjB,aAAa,CAACC,aAAa,EAAEC,SAAS,CAAC;IACnDD;EACD,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/crypto/derive.js

@@ -0,0 +1,61 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.deriveArtifactKey = deriveArtifactKey;
+exports.nonceForChunk = nonceForChunk;
+var _provider = require("./provider.js");
+var _bytes = require("../platform/bytes.js");
+/**
+ * Per-artifact key derivation.
+ *
+ * The database key is handed straight to SQLCipher. Using that same material
+ * as the AES-GCM key for artifacts would mean the two keystreams share a
+ * secret, so a weakness in either one — a nonce collision in the artifact
+ * format, a padding oracle in the database format — becomes a weakness in
+ * both. HKDF costs one hash and removes the coupling entirely (research.md
+ * R4).
+ *
+ * The artifact id is the HKDF `info`, so two artifacts under the same
+ * database key derive different subkeys. That is what makes the deterministic
+ * nonce scheme safe: a nonce is only ever reused with a different key.
+ */
+
+const HKDF_DIGEST = 'sha256';
+const KEY_BYTES = 32;
+const NONCE_BYTES = 12;
+function bytesOf(value) {
+  return (0, _bytes.utf8Bytes)(value);
+}
+
+/** 32 bytes, one artifact, one database key. */
+function deriveArtifactKey(databaseKey, scopeKey, attachmentId) {
+  const derived = (0, _provider.cipherModule)().hkdfSync(HKDF_DIGEST, bytesOf(databaseKey),
+  // The scope digest as salt keeps two scopes holding an artifact under
+  // the same id from deriving the same subkey.
+  bytesOf(scopeKey), bytesOf(`chipmobilesdk-localdb/artifact/${attachmentId}`), KEY_BYTES);
+  return new Uint8Array(derived);
+}
+
+/**
+ * Deterministic 12-byte nonce from the chunk index.
+ *
+ * Deterministic rather than random because a random nonce would have to be
+ * stored per chunk, and because uniqueness is already guaranteed one level
+ * up: the key is unique per artifact, so an index that is unique within the
+ * artifact is unique under that key. The remaining four bytes are a fixed
+ * domain tag rather than padding, so a nonce from this scheme can never
+ * collide with one from a future scheme that uses the same counter space.
+ */
+function nonceForChunk(index) {
+  const nonce = new Uint8Array(NONCE_BYTES);
+  const view = new DataView(nonce.buffer);
+  view.setUint32(0, 0x4c444231, false); // "LDB1"
+  // Split across two 32-bit writes rather than a BigInt: chunk indexes stay
+  // far inside the safe integer range, and Hermes is happier without one.
+  view.setUint32(4, Math.floor(index / 0x100000000), false);
+  view.setUint32(8, index % 0x100000000, false);
+  return nonce;
+}
+//# sourceMappingURL=derive.js.map

package/lib/commonjs/crypto/derive.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_provider","require","_bytes","HKDF_DIGEST","KEY_BYTES","NONCE_BYTES","bytesOf","value","utf8Bytes","deriveArtifactKey","databaseKey","scopeKey","attachmentId","derived","cipherModule","hkdfSync","Uint8Array","nonceForChunk","index","nonce","view","DataView","buffer","setUint32","Math","floor"],"sourceRoot":"../../../src","sources":["crypto/derive.ts"],"mappings":";;;;;;;AAeA,IAAAA,SAAA,GAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AAhBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA,MAAME,WAAW,GAAG,QAAQ;AAC5B,MAAMC,SAAS,GAAG,EAAE;AACpB,MAAMC,WAAW,GAAG,EAAE;AAEtB,SAASC,OAAOA,CAACC,KAAa,EAAc;EAC3C,OAAO,IAAAC,gBAAS,EAACD,KAAK,CAAC;AACxB;;AAEA;AACO,SAASE,iBAAiBA,CAChCC,WAAmB,EACnBC,QAAgB,EAChBC,YAAoB,EACP;EACb,MAAMC,OAAO,GAAG,IAAAC,sBAAY,EAAC,CAAC,CAACC,QAAQ,CACtCZ,WAAW,EACXG,OAAO,CAACI,WAAW,CAAC;EACpB;EACA;EACAJ,OAAO,CAACK,QAAQ,CAAC,EACjBL,OAAO,CAAC,kCAAkCM,YAAY,EAAE,CAAC,EACzDR,SACD,CAAC;EACD,OAAO,IAAIY,UAAU,CAACH,OAAO,CAAC;AAC/B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,aAAaA,CAACC,KAAa,EAAc;EACxD,MAAMC,KAAK,GAAG,IAAIH,UAAU,CAACX,WAAW,CAAC;EACzC,MAAMe,IAAI,GAAG,IAAIC,QAAQ,CAACF,KAAK,CAACG,MAAM,CAAC;EACvCF,IAAI,CAACG,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;EACtC;EACA;EACAH,IAAI,CAACG,SAAS,CAAC,CAAC,EAAEC,IAAI,CAACC,KAAK,CAACP,KAAK,GAAG,WAAW,CAAC,EAAE,KAAK,CAAC;EACzDE,IAAI,CAACG,SAAS,CAAC,CAAC,EAAEL,KAAK,GAAG,WAAW,EAAE,KAAK,CAAC;EAC7C,OAAOC,KAAK;AACb","ignoreList":[]}

package/lib/commonjs/crypto/key-provider.js

@@ -0,0 +1,70 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.acquireKey = acquireKey;
+var _errors = require("../contract/errors.js");
+var _errors2 = require("../diagnostics/errors.js");
+var _faults = require("../diagnostics/faults.js");
+/**
+ * Key acquisition, scoped to one handle's lifetime.
+ *
+ * The package never generates, derives from its own material, persists,
+ * caches beyond the handle, transmits, or returns a key (FR-098). What it
+ * does is ask the app for one at open and hold it exactly as long as the
+ * connection that needs it — which is also why no keychain library appears in
+ * this package's dependencies (LIB-004).
+ *
+ * The provider receives the resolved scope, so an app can key per identity.
+ * That is not a convenience: it is what makes destroying one identity's key a
+ * meaningful answer to a deletion request, rather than a gesture that leaves
+ * the data readable under a shared key (FR-104).
+ */
+
+/**
+ * A key with an explicit end of life.
+ *
+ * Handing the string around directly would leave copies wherever it was
+ * passed. A handle that can be released gives the connection one place to
+ * drop it, and gives `key-hygiene.test.ts` something to assert against.
+ */
+
+async function acquireKey(encryption, scope) {
+  let key;
+  (0, _faults.throwIfFaulted)('keyProvider');
+  try {
+    key = await encryption.keyProvider.getKey(scope);
+  } catch (error) {
+    // A locked device is an expected condition, not a bug (FR-102), which
+    // is why this code is retryable and distinct from an invalid key.
+    (0, _errors2.raise)(_errors.DiagnosticCodes.KEY_PROVIDER_FAILED, {
+      message: 'key provider failed',
+      cause: error
+    });
+  }
+  if (typeof key !== 'string' || key.length === 0) {
+    (0, _errors2.raise)(_errors.DiagnosticCodes.KEY_INVALID, {
+      message: 'key provider returned no usable key'
+    });
+  }
+  let released = false;
+  return {
+    value() {
+      if (released || key === null) {
+        (0, _errors2.raise)(_errors.DiagnosticCodes.KEY_INVALID, {
+          message: 'key material has already been released'
+        });
+      }
+      return key;
+    },
+    release() {
+      released = true;
+      key = null;
+    },
+    get released() {
+      return released;
+    }
+  };
+}
+//# sourceMappingURL=key-provider.js.map

package/lib/commonjs/crypto/key-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_errors","require","_errors2","_faults","acquireKey","encryption","scope","key","throwIfFaulted","keyProvider","getKey","error","raise","DiagnosticCodes","KEY_PROVIDER_FAILED","message","cause","length","KEY_INVALID","released","value","release"],"sourceRoot":"../../../src","sources":["crypto/key-provider.ts"],"mappings":";;;;;;AAgBA,IAAAA,OAAA,GAAAC,OAAA;AAEA,IAAAC,QAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;AAnBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAQA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOO,eAAeG,UAAUA,CAC/BC,UAA4B,EAC5BC,KAAoB,EACC;EACrB,IAAIC,GAAkB;EAEtB,IAAAC,sBAAc,EAAC,aAAa,CAAC;EAE7B,IAAI;IACHD,GAAG,GAAG,MAAMF,UAAU,CAACI,WAAW,CAACC,MAAM,CAACJ,KAAK,CAAC;EACjD,CAAC,CAAC,OAAOK,KAAK,EAAE;IACf;IACA;IACA,IAAAC,cAAK,EAACC,uBAAe,CAACC,mBAAmB,EAAE;MAC1CC,OAAO,EAAE,qBAAqB;MAC9BC,KAAK,EAAEL;IACR,CAAC,CAAC;EACH;EAEA,IAAI,OAAOJ,GAAG,KAAK,QAAQ,IAAIA,GAAG,CAACU,MAAM,KAAK,CAAC,EAAE;IAChD,IAAAL,cAAK,EAACC,uBAAe,CAACK,WAAW,EAAE;MAClCH,OAAO,EAAE;IACV,CAAC,CAAC;EACH;EAEA,IAAII,QAAQ,GAAG,KAAK;EACpB,OAAO;IACNC,KAAKA,CAAA,EAAW;MACf,IAAID,QAAQ,IAAIZ,GAAG,KAAK,IAAI,EAAE;QAC7B,IAAAK,cAAK,EAACC,uBAAe,CAACK,WAAW,EAAE;UAClCH,OAAO,EAAE;QACV,CAAC,CAAC;MACH;MACA,OAAOR,GAAG;IACX,CAAC;IACDc,OAAOA,CAAA,EAAS;MACfF,QAAQ,GAAG,IAAI;MACfZ,GAAG,GAAG,IAAI;IACX,CAAC;IACD,IAAIY,QAAQA,CAAA,EAAY;MACvB,OAAOA,QAAQ;IAChB;EACD,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/crypto/provider.js

@@ -0,0 +1,54 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.cipherModule = cipherModule;
+exports.isCipherAvailable = isCipherAvailable;
+exports.setCipherModule = setCipherModule;
+var _rnCore = require("@chipmobilesdk/rn-core");
+var _errors = require("../contract/errors.js");
+var _errors2 = require("../diagnostics/errors.js");
+/**
+ * The cipher peer, behind one lazy accessor.
+ *
+ * Marked optional in `peerDependenciesMeta`: an app that never enables
+ * encryption should not have to install a native crypto module. That makes
+ * "the peer is absent" a supported state rather than a broken install, so it
+ * reports `ENCRYPTION_UNAVAILABLE` — the same code as a missing SQLCipher
+ * build flag, because from the app's side it is the same problem: encryption
+ * was asked for and cannot be delivered (research.md R1a).
+ */
+
+/**
+ * The two things this package asks of a cipher: AES-256-GCM for artifacts, and
+ * HKDF to derive each artifact's subkey. Hashing is not among them — the scope
+ * digest is SHA-256 in plain TypeScript (`scope/hash.ts`), because it runs on
+ * every scope resolution including the ones that never open an encrypted
+ * database, where a native module may not be installed at all (WS4-08).
+ */
+
+/** Loaded on first use (rn-core's lazy peer); optional, so absence is a normal answer. */
+const cipher = (0, _rnCore.lazyPeer)('react-native-quick-crypto', () => {
+  // Inside `try`, so Metro bundles an app that leaves this optional peer out.
+  try {
+    return require('react-native-quick-crypto');
+  } catch (cause) {
+    throw cause;
+  }
+});
+
+/** Swap the module. Tests only; `null` goes back to the real one. */
+function setCipherModule(module) {
+  cipher.override(module ?? undefined);
+}
+function isCipherAvailable() {
+  return cipher.isAvailable();
+}
+function cipherModule() {
+  return cipher.require((_peer, cause) => new _errors2.StorageError(_errors.DiagnosticCodes.ENCRYPTION_UNAVAILABLE, {
+    message: 'cipher peer is not installed',
+    cause
+  }));
+}
+//# sourceMappingURL=provider.js.map

package/lib/commonjs/crypto/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_rnCore","require","_errors","_errors2","cipher","lazyPeer","cause","setCipherModule","module","override","undefined","isCipherAvailable","isAvailable","cipherModule","_peer","StorageError","DiagnosticCodes","ENCRYPTION_UNAVAILABLE","message"],"sourceRoot":"../../../src","sources":["crypto/provider.ts"],"mappings":";;;;;;;;AAWA,IAAAA,OAAA,GAAAC,OAAA;AAEA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,QAAA,GAAAF,OAAA;AAdA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;;AA6BA;AACA,MAAMG,MAAM,GAAG,IAAAC,gBAAQ,EAAC,2BAA2B,EAAE,MAAM;EAC1D;EACA,IAAI;IACH,OAAOJ,OAAO,CAAC,2BAA2B,CAAC;EAC5C,CAAC,CAAC,OAAOK,KAAK,EAAE;IACf,MAAMA,KAAK;EACZ;AACD,CAAC,CAAC;;AAEF;AACO,SAASC,eAAeA,CAACC,MAA2B,EAAQ;EAClEJ,MAAM,CAACK,QAAQ,CAACD,MAAM,IAAIE,SAAS,CAAC;AACrC;AAEO,SAASC,iBAAiBA,CAAA,EAAY;EAC5C,OAAOP,MAAM,CAACQ,WAAW,CAAC,CAAC;AAC5B;AAEO,SAASC,YAAYA,CAAA,EAAiB;EAC5C,OAAOT,MAAM,CAACH,OAAO,CACpB,CAACa,KAAK,EAAER,KAAK,KACZ,IAAIS,qBAAY,CAACC,uBAAe,CAACC,sBAAsB,EAAE;IACxDC,OAAO,EAAE,8BAA8B;IACvCZ;EACD,CAAC,CACH,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/diagnostics/dev-log.js

@@ -0,0 +1,127 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.instrument = instrument;
+exports.isLogging = isLogging;
+exports.logDiagnostic = logDiagnostic;
+exports.setDiagnosticLogger = setDiagnosticLogger;
+var _rnCore = require("@chipmobilesdk/rn-core");
+/**
+ * Development-only diagnostics.
+ *
+ * Operation names, durations, and counts are safe to report. Record payloads,
+ * field values, and query parameters are not — in any build, including this
+ * one (FR-080, FR-081). There is deliberately no path here that accepts a
+ * payload, so a future caller cannot pass one by accident.
+ */
+
+let logger = null;
+
+/** Passing null removes the logger. */
+function setDiagnosticLogger(next) {
+  logger = next;
+}
+function isDevelopmentBuild() {
+  // __DEV__ is a React Native global; the typeof guard keeps this usable
+  // under plain Node when the package is exercised from Jest.
+  if (typeof __DEV__ !== 'undefined') return __DEV__ === true;
+  const {
+    process
+  } = globalThis;
+  return process?.env?.NODE_ENV !== 'production';
+}
+
+/**
+ * A failed operation also reaches the app's SDK sinks (`installSdkSink` from
+ * rn-core, CORE-08), in any build: its code, the operation and the collection,
+ * which are identifiers this package defines. Successes stay with the
+ * development logger.
+ */
+const channel = (0, _rnCore.createDiagnosticChannel)('rn-local-db');
+function logDiagnostic(event) {
+  if (event.outcome !== undefined) {
+    channel.emit(event.outcome, 'warn', {
+      operation: event.operation,
+      ...(event.collection === undefined ? {} : {
+        collection: event.collection
+      }),
+      ...(event.adapter === undefined ? {} : {
+        adapter: event.adapter
+      })
+    });
+  }
+  if (!logger || !isDevelopmentBuild()) {
+    return;
+  }
+  logger(event);
+}
+function isLogging() {
+  return logger !== null && isDevelopmentBuild();
+}
+
+/**
+ * Wrap a collection so every operation reports its name, duration, and result
+ * count — and nothing else.
+ *
+ * Wrapping once here rather than instrumenting each operation in the adapters
+ * is what keeps the guarantee checkable: there is one place that decides what
+ * a log line may contain, and it has no access to a payload to leak even if a
+ * future change wanted one. The wrapper is applied only when a logger is
+ * installed and the build is a development build, so a production bundle pays
+ * nothing and emits nothing (FR-081).
+ */
+function instrument(collection, adapter, operations) {
+  // Unwrapped unless someone is listening: production pays nothing by default.
+  if (!isLogging() && !(0, _rnCore.hasSdkSinks)()) {
+    return operations;
+  }
+  const wrapped = {};
+  for (const [name, operation] of Object.entries(operations)) {
+    if (typeof operation !== 'function') {
+      wrapped[name] = operation;
+      continue;
+    }
+    wrapped[name] = async (...args) => {
+      const started = Date.now();
+      try {
+        const result = await operation(...args);
+        logDiagnostic({
+          operation: `${collection}.${name}`,
+          durationMs: Date.now() - started,
+          collection,
+          adapter,
+          ...(countOf(result) === undefined ? {} : {
+            count: countOf(result)
+          })
+        });
+        return result;
+      } catch (error) {
+        // The code, never the message: a failure log is exactly where a
+        // payload-bearing native message would otherwise end up.
+        logDiagnostic({
+          operation: `${collection}.${name}`,
+          durationMs: Date.now() - started,
+          collection,
+          adapter,
+          outcome: error.code ?? 'failed'
+        });
+        throw error;
+      }
+    };
+  }
+  return wrapped;
+}
+
+/** How many records an operation produced, when that is a meaningful answer. */
+function countOf(result) {
+  if (typeof result === 'number') {
+    return result;
+  }
+  if (result && typeof result === 'object' && Array.isArray(result.records)) {
+    return result.records.length;
+  }
+  return undefined;
+}
+//# sourceMappingURL=dev-log.js.map

package/lib/commonjs/diagnostics/dev-log.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_rnCore","require","logger","setDiagnosticLogger","next","isDevelopmentBuild","__DEV__","process","globalThis","env","NODE_ENV","channel","createDiagnosticChannel","logDiagnostic","event","outcome","undefined","emit","operation","collection","adapter","isLogging","instrument","operations","hasSdkSinks","wrapped","name","Object","entries","args","started","Date","now","result","durationMs","countOf","count","error","code","Array","isArray","records","length"],"sourceRoot":"../../../src","sources":["diagnostics/dev-log.ts"],"mappings":";;;;;;;;;AASA,IAAAA,OAAA,GAAAC,OAAA;AATA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAgBA,IAAIC,MAA+B,GAAG,IAAI;;AAE1C;AACO,SAASC,mBAAmBA,CAACC,IAA6B,EAAQ;EACxEF,MAAM,GAAGE,IAAI;AACd;AAEA,SAASC,kBAAkBA,CAAA,EAAY;EACtC;EACA;EACA,IAAI,OAAOC,OAAO,KAAK,WAAW,EAAE,OAAOA,OAAO,KAAK,IAAI;EAC3D,MAAM;IAAEC;EAAQ,CAAC,GAAGC,UAAwE;EAC5F,OAAOD,OAAO,EAAEE,GAAG,EAAEC,QAAQ,KAAK,YAAY;AAC/C;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,OAAO,GAAG,IAAAC,+BAAuB,EAAC,aAAa,CAAC;AAE/C,SAASC,aAAaA,CAACC,KAAsB,EAAQ;EAC3D,IAAIA,KAAK,CAACC,OAAO,KAAKC,SAAS,EAAE;IAChCL,OAAO,CAACM,IAAI,CAACH,KAAK,CAACC,OAAO,EAAE,MAAM,EAAE;MACnCG,SAAS,EAAEJ,KAAK,CAACI,SAAS;MAC1B,IAAIJ,KAAK,CAACK,UAAU,KAAKH,SAAS,GAAG,CAAC,CAAC,GAAG;QAAEG,UAAU,EAAEL,KAAK,CAACK;MAAW,CAAC,CAAC;MAC3E,IAAIL,KAAK,CAACM,OAAO,KAAKJ,SAAS,GAAG,CAAC,CAAC,GAAG;QAAEI,OAAO,EAAEN,KAAK,CAACM;MAAQ,CAAC;IAClE,CAAC,CAAC;EACH;EACA,IAAI,CAAClB,MAAM,IAAI,CAACG,kBAAkB,CAAC,CAAC,EAAE;IACrC;EACD;EACAH,MAAM,CAACY,KAAK,CAAC;AACd;AAEO,SAASO,SAASA,CAAA,EAAY;EACpC,OAAOnB,MAAM,KAAK,IAAI,IAAIG,kBAAkB,CAAC,CAAC;AAC/C;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASiB,UAAUA,CACzBH,UAAkB,EAClBC,OAA4B,EAC5BG,UAAa,EACT;EACJ;EACA,IAAI,CAACF,SAAS,CAAC,CAAC,IAAI,CAAC,IAAAG,mBAAW,EAAC,CAAC,EAAE;IACnC,OAAOD,UAAU;EAClB;EAEA,MAAME,OAAgC,GAAG,CAAC,CAAC;EAC3C,KAAK,MAAM,CAACC,IAAI,EAAER,SAAS,CAAC,IAAIS,MAAM,CAACC,OAAO,CAACL,UAAU,CAAC,EAAE;IAC3D,IAAI,OAAOL,SAAS,KAAK,UAAU,EAAE;MACpCO,OAAO,CAACC,IAAI,CAAC,GAAGR,SAAS;MACzB;IACD;IACAO,OAAO,CAACC,IAAI,CAAC,GAAG,OAAO,GAAGG,IAAa,KAAuB;MAC7D,MAAMC,OAAO,GAAGC,IAAI,CAACC,GAAG,CAAC,CAAC;MAC1B,IAAI;QACH,MAAMC,MAAM,GAAG,MAAOf,SAAS,CAA6C,GAAGW,IAAI,CAAC;QACpFhB,aAAa,CAAC;UACbK,SAAS,EAAE,GAAGC,UAAU,IAAIO,IAAI,EAAE;UAClCQ,UAAU,EAAEH,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGF,OAAO;UAChCX,UAAU;UACVC,OAAO;UACP,IAAIe,OAAO,CAACF,MAAM,CAAC,KAAKjB,SAAS,GAAG,CAAC,CAAC,GAAG;YAAEoB,KAAK,EAAED,OAAO,CAACF,MAAM;UAAE,CAAC;QACpE,CAAC,CAAC;QACF,OAAOA,MAAM;MACd,CAAC,CAAC,OAAOI,KAAK,EAAE;QACf;QACA;QACAxB,aAAa,CAAC;UACbK,SAAS,EAAE,GAAGC,UAAU,IAAIO,IAAI,EAAE;UAClCQ,UAAU,EAAEH,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGF,OAAO;UAChCX,UAAU;UACVC,OAAO;UACPL,OAAO,EAAGsB,KAAK,CAAuBC,IAAI,IAAI;QAC/C,CAAC,CAAC;QACF,MAAMD,KAAK;MACZ;IACD,CAAC;EACF;EACA,OAAOZ,OAAO;AACf;;AAEA;AACA,SAASU,OAAOA,CAACF,MAAe,EAAsB;EACrD,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE;IAC/B,OAAOA,MAAM;EACd;EACA,IACCA,MAAM,IACN,OAAOA,MAAM,KAAK,QAAQ,IAC1BM,KAAK,CAACC,OAAO,CAAEP,MAAM,CAA2BQ,OAAO,CAAC,EACvD;IACD,OAAQR,MAAM,CAA4BQ,OAAO,CAACC,MAAM;EACzD;EACA,OAAO1B,SAAS;AACjB","ignoreList":[]}

package/lib/commonjs/diagnostics/errors.js

@@ -0,0 +1,57 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+Object.defineProperty(exports, "DiagnosticCodes", {
+  enumerable: true,
+  get: function () {
+    return _errors.DiagnosticCodes;
+  }
+});
+exports.StorageError = void 0;
+exports.isCode = isCode;
+exports.isStorageError = isStorageError;
+exports.raise = raise;
+var _rnCore = require("@chipmobilesdk/rn-core");
+var _errors = require("../contract/errors.js");
+var _redact = require("./redact.js");
+/**
+ * The single error type the package raises.
+ *
+ * Everything is redacted on the way in (see redact.ts), so there is no path
+ * by which a field value, query parameter, scope component, or key reaches an
+ * error object at all.
+ */
+
+/** The package's error; an `SdkError` (`@chipmobilesdk/rn-core`) with `pkg: 'rn-local-db'`. */
+class StorageError extends _rnCore.SdkError {
+  constructor(code, init = {}) {
+    // Call sites pass only authored literals (authored-messages.test.ts).
+    const message = init.message ? (0, _redact.sanitizeAuthoredMessage)(init.message) : code;
+    // `cause` is deliberately NOT kept: the native error it came from may
+    // quote the offending value. Only its redacted identifier survives.
+    super('rn-local-db', code, {
+      message,
+      retryable: _errors.RETRYABLE_CODES.has(code),
+      redactedCause: (0, _redact.redactCause)(init.cause)
+    });
+    this.name = 'StorageError';
+    this.detail = (0, _redact.redactDetail)(init.detail);
+    // Version numbers and an outcome enum — no payload can hide in these.
+    this.migration = init.migration;
+  }
+}
+exports.StorageError = StorageError;
+function isStorageError(value) {
+  return value instanceof StorageError;
+}
+
+/** So no consumer ever has to parse a message string (FR-082). */
+function isCode(value, code) {
+  return isStorageError(value) && value.code === code;
+}
+function raise(code, init) {
+  throw new StorageError(code, init);
+}
+//# sourceMappingURL=errors.js.map

package/lib/commonjs/diagnostics/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_rnCore","require","_errors","_redact","StorageError","SdkError","constructor","code","init","message","sanitizeAuthoredMessage","retryable","RETRYABLE_CODES","has","redactedCause","redactCause","cause","name","detail","redactDetail","migration","exports","isStorageError","value","isCode","raise"],"sourceRoot":"../../../src","sources":["diagnostics/errors.ts"],"mappings":";;;;;;;;;;;;;;;AAQA,IAAAA,OAAA,GAAAC,OAAA;AAEA,IAAAC,OAAA,GAAAD,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AAZA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoBA;AACO,MAAMG,YAAY,SAASC,gBAAQ,CAAiB;EAI1DC,WAAWA,CAACC,IAAoB,EAAEC,IAAsB,GAAG,CAAC,CAAC,EAAE;IAC9D;IACA,MAAMC,OAAO,GAAGD,IAAI,CAACC,OAAO,GAAG,IAAAC,+BAAuB,EAACF,IAAI,CAACC,OAAO,CAAC,GAAGF,IAAI;IAC3E;IACA;IACA,KAAK,CAAC,aAAa,EAAEA,IAAI,EAAE;MAC1BE,OAAO;MACPE,SAAS,EAAEC,uBAAe,CAACC,GAAG,CAACN,IAAI,CAAC;MACpCO,aAAa,EAAE,IAAAC,mBAAW,EAACP,IAAI,CAACQ,KAAK;IACtC,CAAC,CAAC;IACF,IAAI,CAACC,IAAI,GAAG,cAAc;IAC1B,IAAI,CAACC,MAAM,GAAG,IAAAC,oBAAY,EAACX,IAAI,CAACU,MAAM,CAAC;IACvC;IACA,IAAI,CAACE,SAAS,GAAGZ,IAAI,CAACY,SAAS;EAChC;AACD;AAACC,OAAA,CAAAjB,YAAA,GAAAA,YAAA;AAEM,SAASkB,cAAcA,CAACC,KAAc,EAAyB;EACrE,OAAOA,KAAK,YAAYnB,YAAY;AACrC;;AAEA;AACO,SAASoB,MAAMA,CAACD,KAAc,EAAEhB,IAAoB,EAAW;EACrE,OAAOe,cAAc,CAACC,KAAK,CAAC,IAAIA,KAAK,CAAChB,IAAI,KAAKA,IAAI;AACpD;AAEO,SAASkB,KAAKA,CAAClB,IAAoB,EAAEC,IAAuB,EAAS;EAC3E,MAAM,IAAIJ,YAAY,CAACG,IAAI,EAAEC,IAAI,CAAC;AACnC","ignoreList":[]}

package/lib/commonjs/diagnostics/faults.js

@@ -0,0 +1,54 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.activeFaults = activeFaults;
+exports.clearFaults = clearFaults;
+exports.injectFault = injectFault;
+exports.throwIfFaulted = throwIfFaulted;
+var _errors = require("./errors.js");
+/**
+ * The fault registry.
+ *
+ * It lives here rather than under `testing/` because FR-095 wants every
+ * documented failure reachable from a real app running the real adapter — the
+ * demo's fault-injection panel exercises the on-device path, not a simulation
+ * of it. So the check has to exist in production code.
+ *
+ * What does *not* exist in production code is a way to inject: `injectFault`
+ * and `clearFaults` are exported only from the `./testing` entrypoint. With
+ * nothing injected this is one lookup in an empty map, which is the price of
+ * being able to prove a recovery path works before a user finds it broken.
+ */
+
+const faults = new Map();
+function injectFault(spec) {
+  faults.set(spec.at, {
+    code: spec.code,
+    remaining: spec.times ?? Number.POSITIVE_INFINITY
+  });
+}
+function clearFaults() {
+  faults.clear();
+}
+function activeFaults() {
+  return [...faults.keys()];
+}
+function throwIfFaulted(point) {
+  if (faults.size === 0) {
+    return;
+  }
+  const fault = faults.get(point);
+  if (!fault || fault.remaining <= 0) {
+    return;
+  }
+  fault.remaining -= 1;
+  if (fault.remaining <= 0) {
+    faults.delete(point);
+  }
+  throw new _errors.StorageError(fault.code, {
+    message: `injected fault at ${point}`
+  });
+}
+//# sourceMappingURL=faults.js.map

package/lib/commonjs/diagnostics/faults.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_errors","require","faults","Map","injectFault","spec","set","at","code","remaining","times","Number","POSITIVE_INFINITY","clearFaults","clear","activeFaults","keys","throwIfFaulted","point","size","fault","get","delete","StorageError","message"],"sourceRoot":"../../../src","sources":["diagnostics/faults.ts"],"mappings":";;;;;;;;;AAeA,IAAAA,OAAA,GAAAC,OAAA;AAfA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAeA,MAAMC,MAAM,GAAG,IAAIC,GAAG,CAA0D,CAAC;AAE1E,SAASC,WAAWA,CAACC,IAAe,EAAQ;EAClDH,MAAM,CAACI,GAAG,CAACD,IAAI,CAACE,EAAE,EAAE;IACnBC,IAAI,EAAEH,IAAI,CAACG,IAAI;IACfC,SAAS,EAAEJ,IAAI,CAACK,KAAK,IAAIC,MAAM,CAACC;EACjC,CAAC,CAAC;AACH;AAEO,SAASC,WAAWA,CAAA,EAAS;EACnCX,MAAM,CAACY,KAAK,CAAC,CAAC;AACf;AAEO,SAASC,YAAYA,CAAA,EAAiB;EAC5C,OAAO,CAAC,GAAGb,MAAM,CAACc,IAAI,CAAC,CAAC,CAAC;AAC1B;AAEO,SAASC,cAAcA,CAACC,KAAiB,EAAQ;EACvD,IAAIhB,MAAM,CAACiB,IAAI,KAAK,CAAC,EAAE;IACtB;EACD;EACA,MAAMC,KAAK,GAAGlB,MAAM,CAACmB,GAAG,CAACH,KAAK,CAAC;EAC/B,IAAI,CAACE,KAAK,IAAIA,KAAK,CAACX,SAAS,IAAI,CAAC,EAAE;IACnC;EACD;EACAW,KAAK,CAACX,SAAS,IAAI,CAAC;EACpB,IAAIW,KAAK,CAACX,SAAS,IAAI,CAAC,EAAE;IACzBP,MAAM,CAACoB,MAAM,CAACJ,KAAK,CAAC;EACrB;EACA,MAAM,IAAIK,oBAAY,CAACH,KAAK,CAACZ,IAAI,EAAE;IAAEgB,OAAO,EAAE,qBAAqBN,KAAK;EAAG,CAAC,CAAC;AAC9E","ignoreList":[]}