@chipmobilesdk/rn-local-db 0.4.0 → 0.5.0

package/lib/commonjs/schema/validate-config.js

@@ -0,0 +1,115 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.validateConfig = validateConfig;
+var _config = require("../contract/config.js");
+var _errors = require("../contract/errors.js");
+var _errors2 = require("../diagnostics/errors.js");
+var _validateChain = require("../migration/validate-chain.js");
+var _validate = require("../scope/validate.js");
+/**
+ * Configuration validation.
+ *
+ * Runs to completion before any write and before any migration executes
+ * (FR-006, FR-053). Order matters: scope first, then collections, then the
+ * migration chain — so a consumer fixes the outermost problem first rather
+ * than chasing a downstream symptom.
+ */
+
+const IDENTIFIER = /^[A-Za-z][A-Za-z0-9_]{0,62}$/;
+function configInvalid(message, detail) {
+  (0, _errors2.raise)(_errors.DiagnosticCodes.CONFIG_INVALID, {
+    message,
+    detail
+  });
+}
+function validateCollection(collection, seen) {
+  if (!IDENTIFIER.test(collection.name)) {
+    configInvalid('collection name is not a valid identifier', {
+      collection: collection.name
+    });
+  }
+  if (seen.has(collection.name)) {
+    configInvalid('duplicate collection name', {
+      collection: collection.name
+    });
+  }
+  seen.add(collection.name);
+  const fieldNames = new Set();
+  for (const field of collection.fields ?? []) {
+    if (!IDENTIFIER.test(field.name)) {
+      configInvalid('field name is not a valid identifier', {
+        collection: collection.name
+      });
+    }
+    if (fieldNames.has(field.name)) {
+      configInvalid('duplicate field name', {
+        collection: collection.name
+      });
+    }
+    fieldNames.add(field.name);
+  }
+  const indexNames = new Set();
+  for (const index of collection.indexes ?? []) {
+    if (!IDENTIFIER.test(index.name)) {
+      configInvalid('index name is not a valid identifier', {
+        collection: collection.name
+      });
+    }
+    if (indexNames.has(index.name)) {
+      configInvalid('duplicate index name', {
+        collection: collection.name
+      });
+    }
+    indexNames.add(index.name);
+    if (!Array.isArray(index.fields) || index.fields.length === 0) {
+      configInvalid('index declares no fields', {
+        collection: collection.name
+      });
+    }
+    for (const field of index.fields) {
+      if (!fieldNames.has(field)) {
+        // The whole point of declaring fields is that the package can
+        // tell a typo from a deliberate choice. Silently creating an
+        // index over a column that will never exist would turn a config
+        // bug into a mysterious full scan at runtime.
+        configInvalid('index references an undeclared field', {
+          collection: collection.name
+        });
+      }
+    }
+  }
+}
+function validateConfig(config) {
+  if (!config || typeof config !== 'object') {
+    configInvalid('database config is required');
+  }
+  if (typeof config.name !== 'string' || !IDENTIFIER.test(config.name)) {
+    configInvalid('database name is not a valid identifier');
+  }
+  (0, _validate.validateDescriptor)(config.scope);
+  if (!Array.isArray(config.collections) || config.collections.length === 0) {
+    configInvalid('at least one collection must be declared');
+  }
+  if (config.collections.length > _config.Budgets.MAX_COLLECTIONS_PER_DATABASE) {
+    configInvalid('collection count exceeds the budget', {
+      count: config.collections.length,
+      limit: _config.Budgets.MAX_COLLECTIONS_PER_DATABASE
+    });
+  }
+  const seen = new Set();
+  for (const collection of config.collections) {
+    validateCollection(collection, seen);
+  }
+
+  // The one definition of a valid chain, shared with the executor (LDB-12).
+  (0, _validateChain.validateMigrationChain)(config);
+  if (config.encryption && config.encryption.enabled) {
+    if (typeof config.encryption.keyProvider?.getKey !== 'function') {
+      configInvalid('encryption is enabled but no key provider was supplied');
+    }
+  }
+}
+//# sourceMappingURL=validate-config.js.map

package/lib/commonjs/schema/validate-config.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_config","require","_errors","_errors2","_validateChain","_validate","IDENTIFIER","configInvalid","message","detail","raise","DiagnosticCodes","CONFIG_INVALID","validateCollection","collection","seen","test","name","has","add","fieldNames","Set","field","fields","indexNames","index","indexes","Array","isArray","length","validateConfig","config","validateDescriptor","scope","collections","Budgets","MAX_COLLECTIONS_PER_DATABASE","count","limit","validateMigrationChain","encryption","enabled","keyProvider","getKey"],"sourceRoot":"../../../src","sources":["schema/validate-config.ts"],"mappings":";;;;;;AASA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AAEA,IAAAE,QAAA,GAAAF,OAAA;AACA,IAAAG,cAAA,GAAAH,OAAA;AACA,IAAAI,SAAA,GAAAJ,OAAA;AAdA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AASA,MAAMK,UAAU,GAAG,8BAA8B;AAEjD,SAASC,aAAaA,CAACC,OAAe,EAAEC,MAAgC,EAAS;EAChF,IAAAC,cAAK,EAACC,uBAAe,CAACC,cAAc,EAAE;IAAEJ,OAAO;IAAEC;EAAO,CAAC,CAAC;AAC3D;AAEA,SAASI,kBAAkBA,CAACC,UAA4B,EAAEC,IAAiB,EAAQ;EAClF,IAAI,CAACT,UAAU,CAACU,IAAI,CAACF,UAAU,CAACG,IAAI,CAAC,EAAE;IACtCV,aAAa,CAAC,2CAA2C,EAAE;MAC1DO,UAAU,EAAEA,UAAU,CAACG;IACxB,CAAC,CAAC;EACH;EACA,IAAIF,IAAI,CAACG,GAAG,CAACJ,UAAU,CAACG,IAAI,CAAC,EAAE;IAC9BV,aAAa,CAAC,2BAA2B,EAAE;MAAEO,UAAU,EAAEA,UAAU,CAACG;IAAK,CAAC,CAAC;EAC5E;EACAF,IAAI,CAACI,GAAG,CAACL,UAAU,CAACG,IAAI,CAAC;EAEzB,MAAMG,UAAU,GAAG,IAAIC,GAAG,CAAS,CAAC;EACpC,KAAK,MAAMC,KAAK,IAAIR,UAAU,CAACS,MAAM,IAAI,EAAE,EAAE;IAC5C,IAAI,CAACjB,UAAU,CAACU,IAAI,CAACM,KAAK,CAACL,IAAI,CAAC,EAAE;MACjCV,aAAa,CAAC,sCAAsC,EAAE;QACrDO,UAAU,EAAEA,UAAU,CAACG;MACxB,CAAC,CAAC;IACH;IACA,IAAIG,UAAU,CAACF,GAAG,CAACI,KAAK,CAACL,IAAI,CAAC,EAAE;MAC/BV,aAAa,CAAC,sBAAsB,EAAE;QAAEO,UAAU,EAAEA,UAAU,CAACG;MAAK,CAAC,CAAC;IACvE;IACAG,UAAU,CAACD,GAAG,CAACG,KAAK,CAACL,IAAI,CAAC;EAC3B;EAEA,MAAMO,UAAU,GAAG,IAAIH,GAAG,CAAS,CAAC;EACpC,KAAK,MAAMI,KAAK,IAAIX,UAAU,CAACY,OAAO,IAAI,EAAE,EAAE;IAC7C,IAAI,CAACpB,UAAU,CAACU,IAAI,CAACS,KAAK,CAACR,IAAI,CAAC,EAAE;MACjCV,aAAa,CAAC,sCAAsC,EAAE;QACrDO,UAAU,EAAEA,UAAU,CAACG;MACxB,CAAC,CAAC;IACH;IACA,IAAIO,UAAU,CAACN,GAAG,CAACO,KAAK,CAACR,IAAI,CAAC,EAAE;MAC/BV,aAAa,CAAC,sBAAsB,EAAE;QAAEO,UAAU,EAAEA,UAAU,CAACG;MAAK,CAAC,CAAC;IACvE;IACAO,UAAU,CAACL,GAAG,CAACM,KAAK,CAACR,IAAI,CAAC;IAC1B,IAAI,CAACU,KAAK,CAACC,OAAO,CAACH,KAAK,CAACF,MAAM,CAAC,IAAIE,KAAK,CAACF,MAAM,CAACM,MAAM,KAAK,CAAC,EAAE;MAC9DtB,aAAa,CAAC,0BAA0B,EAAE;QAAEO,UAAU,EAAEA,UAAU,CAACG;MAAK,CAAC,CAAC;IAC3E;IACA,KAAK,MAAMK,KAAK,IAAIG,KAAK,CAACF,MAAM,EAAE;MACjC,IAAI,CAACH,UAAU,CAACF,GAAG,CAACI,KAAK,CAAC,EAAE;QAC3B;QACA;QACA;QACA;QACAf,aAAa,CAAC,sCAAsC,EAAE;UACrDO,UAAU,EAAEA,UAAU,CAACG;QACxB,CAAC,CAAC;MACH;IACD;EACD;AACD;AAEO,SAASa,cAAcA,CAACC,MAAsB,EAAQ;EAC5D,IAAI,CAACA,MAAM,IAAI,OAAOA,MAAM,KAAK,QAAQ,EAAE;IAC1CxB,aAAa,CAAC,6BAA6B,CAAC;EAC7C;EACA,IAAI,OAAOwB,MAAM,CAACd,IAAI,KAAK,QAAQ,IAAI,CAACX,UAAU,CAACU,IAAI,CAACe,MAAM,CAACd,IAAI,CAAC,EAAE;IACrEV,aAAa,CAAC,yCAAyC,CAAC;EACzD;EAEA,IAAAyB,4BAAkB,EAACD,MAAM,CAACE,KAAK,CAAC;EAEhC,IAAI,CAACN,KAAK,CAACC,OAAO,CAACG,MAAM,CAACG,WAAW,CAAC,IAAIH,MAAM,CAACG,WAAW,CAACL,MAAM,KAAK,CAAC,EAAE;IAC1EtB,aAAa,CAAC,0CAA0C,CAAC;EAC1D;EACA,IAAIwB,MAAM,CAACG,WAAW,CAACL,MAAM,GAAGM,eAAO,CAACC,4BAA4B,EAAE;IACrE7B,aAAa,CAAC,qCAAqC,EAAE;MACpD8B,KAAK,EAAEN,MAAM,CAACG,WAAW,CAACL,MAAM;MAChCS,KAAK,EAAEH,eAAO,CAACC;IAChB,CAAC,CAAC;EACH;EAEA,MAAMrB,IAAI,GAAG,IAAIM,GAAG,CAAS,CAAC;EAC9B,KAAK,MAAMP,UAAU,IAAIiB,MAAM,CAACG,WAAW,EAAE;IAC5CrB,kBAAkB,CAACC,UAAU,EAAEC,IAAI,CAAC;EACrC;;EAEA;EACA,IAAAwB,qCAAsB,EAACR,MAAM,CAAC;EAE9B,IAAIA,MAAM,CAACS,UAAU,IAAIT,MAAM,CAACS,UAAU,CAACC,OAAO,EAAE;IACnD,IAAI,OAAOV,MAAM,CAACS,UAAU,CAACE,WAAW,EAAEC,MAAM,KAAK,UAAU,EAAE;MAChEpC,aAAa,CAAC,wDAAwD,CAAC;IACxE;EACD;AACD","ignoreList":[]}

package/lib/commonjs/scope/hash.js

@@ -0,0 +1,107 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.sha256Hex = sha256Hex;
+exports.utf8ByteLength = utf8ByteLength;
+/**
+ * Scope key derivation.
+ *
+ * The directory a scope lives in is named by the SHA-256 digest of its
+ * canonical descriptor, never by the components themselves. FR-014 requires
+ * scope components be treated as sensitive, and a directory named after an
+ * email address puts that address in plaintext on disk — visible even when
+ * the database itself is encrypted, and carried into any crash report that
+ * includes a file path.
+ *
+ * Hashing also removes filesystem charset and length limits from the problem,
+ * which is what lets validation reject rather than sanitize (research.md R2).
+ *
+ * Implemented in pure TypeScript rather than over a native crypto peer so the
+ * scope layer stays importable from anywhere in the package, including the
+ * in-memory adapter running under Jest.
+ *
+ * Verified against Node's own SHA-256 in scope-resolution.test.ts — a wrong
+ * digest would silently merge or split scopes, so it is checked against a
+ * reference implementation rather than against a snapshot of this one.
+ */
+
+/* eslint-disable no-bitwise -- SHA-256 is defined in terms of bitwise operations. */
+
+const K = new Uint32Array([0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2]);
+function rotr(value, bits) {
+  return value >>> bits | value << 32 - bits;
+}
+function utf8Bytes(input) {
+  const out = [];
+  for (let i = 0; i < input.length; i += 1) {
+    let codePoint = input.codePointAt(i);
+    if (codePoint > 0xffff) {
+      i += 1;
+    }
+    if (codePoint < 0x80) {
+      out.push(codePoint);
+    } else if (codePoint < 0x800) {
+      out.push(0xc0 | codePoint >> 6, 0x80 | codePoint & 0x3f);
+    } else if (codePoint < 0x10000) {
+      out.push(0xe0 | codePoint >> 12, 0x80 | codePoint >> 6 & 0x3f, 0x80 | codePoint & 0x3f);
+    } else {
+      out.push(0xf0 | codePoint >> 18, 0x80 | codePoint >> 12 & 0x3f, 0x80 | codePoint >> 6 & 0x3f, 0x80 | codePoint & 0x3f);
+    }
+  }
+  return Uint8Array.from(out);
+}
+function utf8ByteLength(input) {
+  return utf8Bytes(input).length;
+}
+function sha256Hex(input) {
+  const bytes = utf8Bytes(input);
+  const bitLength = bytes.length * 8;
+  const paddedLength = (bytes.length + 9 >> 6) + 1 << 6;
+  const padded = new Uint8Array(paddedLength);
+  padded.set(bytes);
+  padded[bytes.length] = 0x80;
+  const view = new DataView(padded.buffer);
+  view.setUint32(paddedLength - 8, Math.floor(bitLength / 0x100000000), false);
+  view.setUint32(paddedLength - 4, bitLength >>> 0, false);
+  const h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
+  const w = new Uint32Array(64);
+  for (let offset = 0; offset < paddedLength; offset += 64) {
+    for (let i = 0; i < 16; i += 1) {
+      w[i] = view.getUint32(offset + i * 4, false);
+    }
+    for (let i = 16; i < 64; i += 1) {
+      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ w[i - 15] >>> 3;
+      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ w[i - 2] >>> 10;
+      w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
+    }
+    let [a, b, c, d, e, f, g, hh] = [h[0], h[1], h[2], h[3], h[4], h[5], h[6], h[7]];
+    for (let i = 0; i < 64; i += 1) {
+      const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = e & f ^ ~e & g;
+      const temp1 = hh + S1 + ch + K[i] + w[i] >>> 0;
+      const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = a & b ^ a & c ^ b & c;
+      const temp2 = S0 + maj >>> 0;
+      hh = g;
+      g = f;
+      f = e;
+      e = d + temp1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = temp1 + temp2 >>> 0;
+    }
+    h[0] = h[0] + a >>> 0;
+    h[1] = h[1] + b >>> 0;
+    h[2] = h[2] + c >>> 0;
+    h[3] = h[3] + d >>> 0;
+    h[4] = h[4] + e >>> 0;
+    h[5] = h[5] + f >>> 0;
+    h[6] = h[6] + g >>> 0;
+    h[7] = h[7] + hh >>> 0;
+  }
+  return Array.from(h, value => value.toString(16).padStart(8, '0')).join('');
+}
+//# sourceMappingURL=hash.js.map

package/lib/commonjs/scope/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["K","Uint32Array","rotr","value","bits","utf8Bytes","input","out","i","length","codePoint","codePointAt","push","Uint8Array","from","utf8ByteLength","sha256Hex","bytes","bitLength","paddedLength","padded","set","view","DataView","buffer","setUint32","Math","floor","h","w","offset","getUint32","s0","s1","a","b","c","d","e","f","g","hh","S1","ch","temp1","S0","maj","temp2","Array","toString","padStart","join"],"sourceRoot":"../../../src","sources":["scope/hash.ts"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;;AAEA,MAAMA,CAAC,GAAG,IAAIC,WAAW,CAAC,CACzB,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAC9F,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAC9F,CAAC;AAEF,SAASC,IAAIA,CAACC,KAAa,EAAEC,IAAY,EAAU;EAClD,OAAQD,KAAK,KAAKC,IAAI,GAAKD,KAAK,IAAK,EAAE,GAAGC,IAAM;AACjD;AAEA,SAASC,SAASA,CAACC,KAAa,EAAc;EAC7C,MAAMC,GAAa,GAAG,EAAE;EACxB,KAAK,IAAIC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGF,KAAK,CAACG,MAAM,EAAED,CAAC,IAAI,CAAC,EAAE;IACzC,IAAIE,SAAS,GAAGJ,KAAK,CAACK,WAAW,CAACH,CAAC,CAAE;IACrC,IAAIE,SAAS,GAAG,MAAM,EAAE;MACvBF,CAAC,IAAI,CAAC;IACP;IACA,IAAIE,SAAS,GAAG,IAAI,EAAE;MACrBH,GAAG,CAACK,IAAI,CAACF,SAAS,CAAC;IACpB,CAAC,MAAM,IAAIA,SAAS,GAAG,KAAK,EAAE;MAC7BH,GAAG,CAACK,IAAI,CAAC,IAAI,GAAIF,SAAS,IAAI,CAAE,EAAE,IAAI,GAAIA,SAAS,GAAG,IAAK,CAAC;IAC7D,CAAC,MAAM,IAAIA,SAAS,GAAG,OAAO,EAAE;MAC/BH,GAAG,CAACK,IAAI,CACP,IAAI,GAAIF,SAAS,IAAI,EAAG,EACxB,IAAI,GAAKA,SAAS,IAAI,CAAC,GAAI,IAAK,EAChC,IAAI,GAAIA,SAAS,GAAG,IACrB,CAAC;IACF,CAAC,MAAM;MACNH,GAAG,CAACK,IAAI,CACP,IAAI,GAAIF,SAAS,IAAI,EAAG,EACxB,IAAI,GAAKA,SAAS,IAAI,EAAE,GAAI,IAAK,EACjC,IAAI,GAAKA,SAAS,IAAI,CAAC,GAAI,IAAK,EAChC,IAAI,GAAIA,SAAS,GAAG,IACrB,CAAC;IACF;EACD;EACA,OAAOG,UAAU,CAACC,IAAI,CAACP,GAAG,CAAC;AAC5B;AAEO,SAASQ,cAAcA,CAACT,KAAa,EAAU;EACrD,OAAOD,SAAS,CAACC,KAAK,CAAC,CAACG,MAAM;AAC/B;AAEO,SAASO,SAASA,CAACV,KAAa,EAAU;EAChD,MAAMW,KAAK,GAAGZ,SAAS,CAACC,KAAK,CAAC;EAC9B,MAAMY,SAAS,GAAGD,KAAK,CAACR,MAAM,GAAG,CAAC;EAClC,MAAMU,YAAY,GAAI,CAAEF,KAAK,CAACR,MAAM,GAAG,CAAC,IAAK,CAAC,IAAI,CAAC,IAAK,CAAC;EACzD,MAAMW,MAAM,GAAG,IAAIP,UAAU,CAACM,YAAY,CAAC;EAC3CC,MAAM,CAACC,GAAG,CAACJ,KAAK,CAAC;EACjBG,MAAM,CAACH,KAAK,CAACR,MAAM,CAAC,GAAG,IAAI;EAE3B,MAAMa,IAAI,GAAG,IAAIC,QAAQ,CAACH,MAAM,CAACI,MAAM,CAAC;EACxCF,IAAI,CAACG,SAAS,CAACN,YAAY,GAAG,CAAC,EAAEO,IAAI,CAACC,KAAK,CAACT,SAAS,GAAG,WAAW,CAAC,EAAE,KAAK,CAAC;EAC5EI,IAAI,CAACG,SAAS,CAACN,YAAY,GAAG,CAAC,EAAED,SAAS,KAAK,CAAC,EAAE,KAAK,CAAC;EAExD,MAAMU,CAAC,GAAG,IAAI3B,WAAW,CAAC,CACzB,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAC9F,CAAC;EACF,MAAM4B,CAAC,GAAG,IAAI5B,WAAW,CAAC,EAAE,CAAC;EAE7B,KAAK,IAAI6B,MAAM,GAAG,CAAC,EAAEA,MAAM,GAAGX,YAAY,EAAEW,MAAM,IAAI,EAAE,EAAE;IACzD,KAAK,IAAItB,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAG,EAAE,EAAEA,CAAC,IAAI,CAAC,EAAE;MAC/BqB,CAAC,CAACrB,CAAC,CAAC,GAAGc,IAAI,CAACS,SAAS,CAACD,MAAM,GAAGtB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;IAC7C;IACA,KAAK,IAAIA,CAAC,GAAG,EAAE,EAAEA,CAAC,GAAG,EAAE,EAAEA,CAAC,IAAI,CAAC,EAAE;MAChC,MAAMwB,EAAE,GAAG9B,IAAI,CAAC2B,CAAC,CAACrB,CAAC,GAAG,EAAE,CAAC,EAAG,CAAC,CAAC,GAAGN,IAAI,CAAC2B,CAAC,CAACrB,CAAC,GAAG,EAAE,CAAC,EAAG,EAAE,CAAC,GAAIqB,CAAC,CAACrB,CAAC,GAAG,EAAE,CAAC,KAAM,CAAE;MAC1E,MAAMyB,EAAE,GAAG/B,IAAI,CAAC2B,CAAC,CAACrB,CAAC,GAAG,CAAC,CAAC,EAAG,EAAE,CAAC,GAAGN,IAAI,CAAC2B,CAAC,CAACrB,CAAC,GAAG,CAAC,CAAC,EAAG,EAAE,CAAC,GAAIqB,CAAC,CAACrB,CAAC,GAAG,CAAC,CAAC,KAAM,EAAG;MACzEqB,CAAC,CAACrB,CAAC,CAAC,GAAIqB,CAAC,CAACrB,CAAC,GAAG,EAAE,CAAC,GAAIwB,EAAE,GAAGH,CAAC,CAACrB,CAAC,GAAG,CAAC,CAAE,GAAGyB,EAAE,KAAM,CAAC;IAChD;IAEA,IAAI,CAACC,CAAC,EAAEC,CAAC,EAAEC,CAAC,EAAEC,CAAC,EAAEC,CAAC,EAAEC,CAAC,EAAEC,CAAC,EAAEC,EAAE,CAAC,GAAG,CAACb,CAAC,CAAC,CAAC,CAAC,EAAGA,CAAC,CAAC,CAAC,CAAC,EAAGA,CAAC,CAAC,CAAC,CAAC,EAAGA,CAAC,CAAC,CAAC,CAAC,EAAGA,CAAC,CAAC,CAAC,CAAC,EAAGA,CAAC,CAAC,CAAC,CAAC,EAAGA,CAAC,CAAC,CAAC,CAAC,EAAGA,CAAC,CAAC,CAAC,CAAC,CAAE;IAExF,KAAK,IAAIpB,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAG,EAAE,EAAEA,CAAC,IAAI,CAAC,EAAE;MAC/B,MAAMkC,EAAE,GAAGxC,IAAI,CAACoC,CAAC,EAAE,CAAC,CAAC,GAAGpC,IAAI,CAACoC,CAAC,EAAE,EAAE,CAAC,GAAGpC,IAAI,CAACoC,CAAC,EAAE,EAAE,CAAC;MACjD,MAAMK,EAAE,GAAIL,CAAC,GAAGC,CAAC,GAAK,CAACD,CAAC,GAAGE,CAAE;MAC7B,MAAMI,KAAK,GAAIH,EAAE,GAAGC,EAAE,GAAGC,EAAE,GAAG3C,CAAC,CAACQ,CAAC,CAAE,GAAGqB,CAAC,CAACrB,CAAC,CAAE,KAAM,CAAC;MAClD,MAAMqC,EAAE,GAAG3C,IAAI,CAACgC,CAAC,EAAE,CAAC,CAAC,GAAGhC,IAAI,CAACgC,CAAC,EAAE,EAAE,CAAC,GAAGhC,IAAI,CAACgC,CAAC,EAAE,EAAE,CAAC;MACjD,MAAMY,GAAG,GAAIZ,CAAC,GAAGC,CAAC,GAAKD,CAAC,GAAGE,CAAE,GAAID,CAAC,GAAGC,CAAE;MACvC,MAAMW,KAAK,GAAIF,EAAE,GAAGC,GAAG,KAAM,CAAC;MAE9BL,EAAE,GAAGD,CAAC;MACNA,CAAC,GAAGD,CAAC;MACLA,CAAC,GAAGD,CAAC;MACLA,CAAC,GAAID,CAAC,GAAGO,KAAK,KAAM,CAAC;MACrBP,CAAC,GAAGD,CAAC;MACLA,CAAC,GAAGD,CAAC;MACLA,CAAC,GAAGD,CAAC;MACLA,CAAC,GAAIU,KAAK,GAAGG,KAAK,KAAM,CAAC;IAC1B;IAEAnB,CAAC,CAAC,CAAC,CAAC,GAAIA,CAAC,CAAC,CAAC,CAAC,GAAIM,CAAC,KAAM,CAAC;IACxBN,CAAC,CAAC,CAAC,CAAC,GAAIA,CAAC,CAAC,CAAC,CAAC,GAAIO,CAAC,KAAM,CAAC;IACxBP,CAAC,CAAC,CAAC,CAAC,GAAIA,CAAC,CAAC,CAAC,CAAC,GAAIQ,CAAC,KAAM,CAAC;IACxBR,CAAC,CAAC,CAAC,CAAC,GAAIA,CAAC,CAAC,CAAC,CAAC,GAAIS,CAAC,KAAM,CAAC;IACxBT,CAAC,CAAC,CAAC,CAAC,GAAIA,CAAC,CAAC,CAAC,CAAC,GAAIU,CAAC,KAAM,CAAC;IACxBV,CAAC,CAAC,CAAC,CAAC,GAAIA,CAAC,CAAC,CAAC,CAAC,GAAIW,CAAC,KAAM,CAAC;IACxBX,CAAC,CAAC,CAAC,CAAC,GAAIA,CAAC,CAAC,CAAC,CAAC,GAAIY,CAAC,KAAM,CAAC;IACxBZ,CAAC,CAAC,CAAC,CAAC,GAAIA,CAAC,CAAC,CAAC,CAAC,GAAIa,EAAE,KAAM,CAAC;EAC1B;EAEA,OAAOO,KAAK,CAAClC,IAAI,CAACc,CAAC,EAAEzB,KAAK,IAAIA,KAAK,CAAC8C,QAAQ,CAAC,EAAE,CAAC,CAACC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAACC,IAAI,CAAC,EAAE,CAAC;AAC5E","ignoreList":[]}

package/lib/commonjs/scope/normalize.js

@@ -0,0 +1,73 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.SCOPE_KINDS = exports.MAX_COMPONENT_BYTES = exports.CONTROL_CHARACTER = exports.COMPONENT_SEPARATOR = exports.COMPONENT_ORDER = void 0;
+exports.normalizeComponent = normalizeComponent;
+exports.normalizeDescriptor = normalizeDescriptor;
+/**
+ * Scope descriptor normalization.
+ *
+ * The package normalizes and validates; it never repairs. A component it
+ * cannot represent safely is an error (FR-013), because silently sanitizing
+ * one is how two different descriptors end up sharing a directory — which
+ * would be a cross-scope leak dressed up as a convenience.
+ */
+
+/**
+ * Separates components in the canonical form.
+ *
+ * NUL rather than a printable character: a component containing the separator
+ * could forge another descriptor's canonical string, and every printable
+ * candidate occurs in legitimate identity data. Tenant names contain spaces,
+ * identifiers contain colons and slashes, emails contain "@" and ".". NUL
+ * occurs in none of them, so reserving it costs consumers nothing.
+ */
+const COMPONENT_SEPARATOR = exports.COMPONENT_SEPARATOR = '\u0000';
+
+/**
+ * Control characters are rejected wholesale rather than only the separator.
+ * They have no place in an identity component, and they would be trouble in a
+ * log line or a diagnostic even where they could not forge a canonical
+ * string.
+ */
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARACTER = exports.CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/;
+const MAX_COMPONENT_BYTES = exports.MAX_COMPONENT_BYTES = 512;
+
+/** Fixed order, so the canonical form is stable across callers. */
+const COMPONENT_ORDER = exports.COMPONENT_ORDER = ['kind', 'id', 'tenant', 'app', 'environment', 'namespace'];
+const SCOPE_KINDS = exports.SCOPE_KINDS = ['guest', 'identity', 'tenant', 'workspace', 'custom'];
+
+/**
+ * NFC, trimmed, case preserved.
+ *
+ * Case is preserved deliberately: the package does not know whether a
+ * consumer's identity system is case-sensitive, and folding case would merge
+ * two scopes the app considers distinct.
+ */
+function normalizeComponent(value) {
+  return value.normalize('NFC').trim();
+}
+/** Normalize without validating. Callers must validate first. */
+function normalizeDescriptor(descriptor) {
+  const components = {};
+  const parts = [];
+  for (const key of COMPONENT_ORDER) {
+    const raw = descriptor[key];
+    if (typeof raw !== 'string' || raw.length === 0) {
+      parts.push('');
+      continue;
+    }
+    const normalized = normalizeComponent(raw);
+    components[key] = normalized;
+    parts.push(normalized);
+  }
+  return {
+    kind: descriptor.kind,
+    components,
+    canonical: parts.join(COMPONENT_SEPARATOR)
+  };
+}
+//# sourceMappingURL=normalize.js.map

package/lib/commonjs/scope/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["COMPONENT_SEPARATOR","exports","CONTROL_CHARACTER","MAX_COMPONENT_BYTES","COMPONENT_ORDER","SCOPE_KINDS","normalizeComponent","value","normalize","trim","normalizeDescriptor","descriptor","components","parts","key","raw","length","push","normalized","kind","canonical","join"],"sourceRoot":"../../../src","sources":["scope/normalize.ts"],"mappings":";;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMA,mBAAmB,GAAAC,OAAA,CAAAD,mBAAA,GAAG,QAAQ;;AAE3C;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAME,iBAAiB,GAAAD,OAAA,CAAAC,iBAAA,GAAG,uBAAuB;AAEjD,MAAMC,mBAAmB,GAAAF,OAAA,CAAAE,mBAAA,GAAG,GAAG;;AAEtC;AACO,MAAMC,eAAe,GAAAH,OAAA,CAAAG,eAAA,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,CAAU;AAE5F,MAAMC,WAAiC,GAAAJ,OAAA,CAAAI,WAAA,GAAG,CAChD,OAAO,EACP,UAAU,EACV,QAAQ,EACR,WAAW,EACX,QAAQ,CACR;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,kBAAkBA,CAACC,KAAa,EAAU;EACzD,OAAOA,KAAK,CAACC,SAAS,CAAC,KAAK,CAAC,CAACC,IAAI,CAAC,CAAC;AACrC;AAQA;AACO,SAASC,mBAAmBA,CAACC,UAA2B,EAAmB;EACjF,MAAMC,UAAkC,GAAG,CAAC,CAAC;EAC7C,MAAMC,KAAe,GAAG,EAAE;EAE1B,KAAK,MAAMC,GAAG,IAAIV,eAAe,EAAE;IAClC,MAAMW,GAAG,GAAGJ,UAAU,CAACG,GAAG,CAA0B;IACpD,IAAI,OAAOC,GAAG,KAAK,QAAQ,IAAIA,GAAG,CAACC,MAAM,KAAK,CAAC,EAAE;MAChDH,KAAK,CAACI,IAAI,CAAC,EAAE,CAAC;MACd;IACD;IACA,MAAMC,UAAU,GAAGZ,kBAAkB,CAACS,GAAG,CAAC;IAC1CH,UAAU,CAACE,GAAG,CAAC,GAAGI,UAAU;IAC5BL,KAAK,CAACI,IAAI,CAACC,UAAU,CAAC;EACvB;EAEA,OAAO;IACNC,IAAI,EAAER,UAAU,CAACQ,IAAI;IACrBP,UAAU;IACVQ,SAAS,EAAEP,KAAK,CAACQ,IAAI,CAACrB,mBAAmB;EAC1C,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/scope/validate.js

@@ -0,0 +1,81 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.resolveScope = resolveScope;
+exports.validateDescriptor = validateDescriptor;
+var _errors = require("../contract/errors.js");
+var _errors2 = require("../diagnostics/errors.js");
+var _hash = require("./hash.js");
+var _normalize = require("./normalize.js");
+/**
+ * Scope validation and resolution.
+ *
+ * Validate, never repair (FR-013). The package never invents, derives, or
+ * defaults an identity of its own (FR-008).
+ */
+
+function invalid(reason) {
+  // The reason names the *component*, never its value — naming the value
+  // would put a scope component into an error, which FR-014 forbids.
+  (0, _errors2.raise)(_errors.DiagnosticCodes.INVALID_SCOPE, {
+    message: reason
+  });
+}
+function validateComponent(key, raw) {
+  if (raw === undefined || raw === null) {
+    return;
+  }
+  if (typeof raw !== 'string') {
+    invalid(`scope component ${key} must be a string`);
+  }
+  const normalized = (0, _normalize.normalizeComponent)(raw);
+  if (normalized.length === 0) {
+    invalid(`scope component ${key} is empty after normalization`);
+  }
+  if (_normalize.CONTROL_CHARACTER.test(normalized)) {
+    invalid(`scope component ${key} contains a control character`);
+  }
+  if ((0, _hash.utf8ByteLength)(normalized) > _normalize.MAX_COMPONENT_BYTES) {
+    invalid(`scope component ${key} exceeds the maximum length`);
+  }
+}
+function validateDescriptor(descriptor) {
+  if (!descriptor || typeof descriptor !== 'object') {
+    invalid('scope descriptor is required');
+  }
+  if (!_normalize.SCOPE_KINDS.includes(descriptor.kind)) {
+    invalid('scope kind is not recognised');
+  }
+
+  // Guest is the one kind with no identity, by design: an anonymous session
+  // still gets its own isolated scope rather than sharing a default.
+  if (descriptor.kind !== 'guest') {
+    const id = descriptor.id;
+    if (typeof id !== 'string' || (0, _normalize.normalizeComponent)(id).length === 0) {
+      invalid('scope id is required for this kind');
+    }
+  }
+  for (const key of _normalize.COMPONENT_ORDER) {
+    if (key === 'kind') {
+      continue;
+    }
+    validateComponent(key, descriptor[key]);
+  }
+}
+
+/**
+ * Deterministic: identical descriptors always resolve to the same scope, and
+ * descriptors differing in any component always resolve to different ones
+ * (FR-010).
+ */
+function resolveScope(descriptor) {
+  validateDescriptor(descriptor);
+  const normalized = (0, _normalize.normalizeDescriptor)(descriptor);
+  return {
+    key: (0, _hash.sha256Hex)(normalized.canonical),
+    kind: descriptor.kind
+  };
+}
+//# sourceMappingURL=validate.js.map

package/lib/commonjs/scope/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_errors","require","_errors2","_hash","_normalize","invalid","reason","raise","DiagnosticCodes","INVALID_SCOPE","message","validateComponent","key","raw","undefined","normalized","normalizeComponent","length","CONTROL_CHARACTER","test","utf8ByteLength","MAX_COMPONENT_BYTES","validateDescriptor","descriptor","SCOPE_KINDS","includes","kind","id","COMPONENT_ORDER","resolveScope","normalizeDescriptor","sha256Hex","canonical"],"sourceRoot":"../../../src","sources":["scope/validate.ts"],"mappings":";;;;;;;AAOA,IAAAA,OAAA,GAAAC,OAAA;AAEA,IAAAC,QAAA,GAAAD,OAAA;AACA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAH,OAAA;AAXA;AACA;AACA;AACA;AACA;AACA;;AAeA,SAASI,OAAOA,CAACC,MAAc,EAAS;EACvC;EACA;EACA,IAAAC,cAAK,EAACC,uBAAe,CAACC,aAAa,EAAE;IAAEC,OAAO,EAAEJ;EAAO,CAAC,CAAC;AAC1D;AAEA,SAASK,iBAAiBA,CAACC,GAAW,EAAEC,GAAY,EAAQ;EAC3D,IAAIA,GAAG,KAAKC,SAAS,IAAID,GAAG,KAAK,IAAI,EAAE;IACtC;EACD;EACA,IAAI,OAAOA,GAAG,KAAK,QAAQ,EAAE;IAC5BR,OAAO,CAAC,mBAAmBO,GAAG,mBAAmB,CAAC;EACnD;EACA,MAAMG,UAAU,GAAG,IAAAC,6BAAkB,EAACH,GAAG,CAAC;EAC1C,IAAIE,UAAU,CAACE,MAAM,KAAK,CAAC,EAAE;IAC5BZ,OAAO,CAAC,mBAAmBO,GAAG,+BAA+B,CAAC;EAC/D;EACA,IAAIM,4BAAiB,CAACC,IAAI,CAACJ,UAAU,CAAC,EAAE;IACvCV,OAAO,CAAC,mBAAmBO,GAAG,+BAA+B,CAAC;EAC/D;EACA,IAAI,IAAAQ,oBAAc,EAACL,UAAU,CAAC,GAAGM,8BAAmB,EAAE;IACrDhB,OAAO,CAAC,mBAAmBO,GAAG,6BAA6B,CAAC;EAC7D;AACD;AAEO,SAASU,kBAAkBA,CAACC,UAA8C,EAAQ;EACxF,IAAI,CAACA,UAAU,IAAI,OAAOA,UAAU,KAAK,QAAQ,EAAE;IAClDlB,OAAO,CAAC,8BAA8B,CAAC;EACxC;EACA,IAAI,CAACmB,sBAAW,CAACC,QAAQ,CAACF,UAAU,CAACG,IAAI,CAAC,EAAE;IAC3CrB,OAAO,CAAC,8BAA8B,CAAC;EACxC;;EAEA;EACA;EACA,IAAIkB,UAAU,CAACG,IAAI,KAAK,OAAO,EAAE;IAChC,MAAMC,EAAE,GAAGJ,UAAU,CAACI,EAAE;IACxB,IAAI,OAAOA,EAAE,KAAK,QAAQ,IAAI,IAAAX,6BAAkB,EAACW,EAAE,CAAC,CAACV,MAAM,KAAK,CAAC,EAAE;MAClEZ,OAAO,CAAC,oCAAoC,CAAC;IAC9C;EACD;EAEA,KAAK,MAAMO,GAAG,IAAIgB,0BAAe,EAAE;IAClC,IAAIhB,GAAG,KAAK,MAAM,EAAE;MACnB;IACD;IACAD,iBAAiB,CAACC,GAAG,EAAEW,UAAU,CAACX,GAAG,CAA0B,CAAC;EACjE;AACD;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASiB,YAAYA,CAACN,UAA2B,EAAiB;EACxED,kBAAkB,CAACC,UAAU,CAAC;EAC9B,MAAMR,UAAU,GAAG,IAAAe,8BAAmB,EAACP,UAAU,CAAC;EAClD,OAAO;IACNX,GAAG,EAAE,IAAAmB,eAAS,EAAChB,UAAU,CAACiB,SAAS,CAAC;IACpCN,IAAI,EAAEH,UAAU,CAACG;EAClB,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/sqlite/adapter.js

@@ -0,0 +1,31 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createSqliteAdapter = createSqliteAdapter;
+var _deletion = require("../adapter/deletion.js");
+var _lifecycle = require("../adapter/lifecycle.js");
+/**
+ * The on-device adapter.
+ *
+ * Deliberately a seam rather than an implementation. Everything it composes
+ * lives in `adapter/`, `migration/`, `artifacts/`, and this directory, so the
+ * in-memory adapter can be held to the same contract by the same conformance
+ * suite (FR-092) without either one being the "real" version the other
+ * approximates.
+ *
+ * Reached only through the lazy require in `adapter/index.ts`, so a consumer
+ * that runs the in-memory adapter in tests never loads the native peers.
+ */
+
+function createSqliteAdapter(options = {}) {
+  return {
+    name: 'sqlite',
+    open: config => (0, _lifecycle.openSqliteDatabase)(config, options),
+    deleteScopeData: _deletion.deleteScopeData,
+    deleteDatabase: _deletion.deleteDatabase,
+    resetScope: _deletion.resetScope
+  };
+}
+//# sourceMappingURL=adapter.js.map

package/lib/commonjs/sqlite/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_deletion","require","_lifecycle","createSqliteAdapter","options","name","open","config","openSqliteDatabase","deleteScopeData","deleteDatabase","resetScope"],"sourceRoot":"../../../src","sources":["sqlite/adapter.ts"],"mappings":";;;;;;AAcA,IAAAA,SAAA,GAAAC,OAAA;AACA,IAAAC,UAAA,GAAAD,OAAA;AAfA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMO,SAASE,mBAAmBA,CAACC,OAAoB,GAAG,CAAC,CAAC,EAAkB;EAC9E,OAAO;IACNC,IAAI,EAAE,QAAQ;IACdC,IAAI,EAAEC,MAAM,IAAI,IAAAC,6BAAkB,EAACD,MAAM,EAAEH,OAAO,CAAC;IACnDK,eAAe,EAAfA,yBAAe;IACfC,cAAc,EAAdA,wBAAc;IACdC,UAAU,EAAVA;EACD,CAAC;AACF","ignoreList":[]}

package/lib/commonjs/sqlite/batch.js

@@ -0,0 +1,218 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.runBatch = runBatch;
+var _errors = require("../contract/errors.js");
+var _errors2 = require("../diagnostics/errors.js");
+var _budgets = require("../query/budgets.js");
+var _declare = require("../schema/declare.js");
+var _statements = require("./statements.js");
+/**
+ * Batch writes: many operations, one atomic unit, one outcome (FR-028).
+ *
+ * Every statement is resolved before any of them runs. That ordering is the
+ * point: a conflict or a missing record is reported with the database still
+ * untouched, so "the batch failed" and "the batch was partly applied" are
+ * never the same event. The statements then go to the engine's own
+ * `executeBatch`, which wraps them in a single transaction — the batch is
+ * atomic because SQLite makes it atomic, not because this file is careful.
+ *
+ * Resolution keeps an overlay of what earlier operations in the same batch
+ * did, so `insert` followed by `update` on the same id resolves against the
+ * batch's own effect rather than against the database as it was before it.
+ */
+
+function quoted(schema) {
+  return `"${(0, _declare.collectionTable)(schema.name)}"`;
+}
+
+/**
+ * Where a record stands, as this batch has left it so far. Three states, not
+ * two: a soft-deleted row is invisible to reads but still holds its primary
+ * key, so an insert over it conflicts and an upsert over it restores it — the
+ * same rules the collection API applies. Treating it as absent made a batch
+ * upsert issue an INSERT and fail the whole batch on the primary key.
+ */
+
+function conflict(schema, id) {
+  (0, _errors2.raise)(_errors.DiagnosticCodes.RECORD_CONFLICT, {
+    message: 'record already exists',
+    detail: {
+      collection: schema.name,
+      recordId: id
+    }
+  });
+}
+function missing(schema, id) {
+  (0, _errors2.raise)(_errors.DiagnosticCodes.RECORD_NOT_FOUND, {
+    message: 'record not found',
+    detail: {
+      collection: schema.name,
+      recordId: id
+    }
+  });
+}
+async function resolveInsert(resolver, operation) {
+  const {
+    schema,
+    now
+  } = resolver;
+  const payload = (0, _budgets.assertRecordWithinBudget)(schema.name, operation.record.data);
+  if ((await resolver.state(operation.record.id)) !== 'absent') {
+    conflict(schema, operation.record.id);
+  }
+  resolver.stage(operation.record.id, 'live');
+  return {
+    command: (0, _statements.insertStatement)(schema, operation.record.id, operation.record.data, now, payload),
+    outcome: {
+      operation: 'created',
+      id: operation.record.id
+    }
+  };
+}
+async function resolveUpdate(resolver, operation) {
+  const {
+    schema,
+    now
+  } = resolver;
+  const payload = (0, _budgets.assertRecordWithinBudget)(schema.name, operation.data);
+  if ((await resolver.state(operation.id)) !== 'live') {
+    missing(schema, operation.id);
+  }
+  return {
+    command: (0, _statements.updateStatement)(schema, operation.id, operation.data, now, payload, {
+      restore: false
+    }),
+    outcome: {
+      operation: 'updated',
+      id: operation.id
+    }
+  };
+}
+async function resolveUpsert(resolver, operation) {
+  const {
+    schema,
+    now
+  } = resolver;
+  const payload = (0, _budgets.assertRecordWithinBudget)(schema.name, operation.record.data);
+  const present = (await resolver.state(operation.record.id)) !== 'absent';
+  resolver.stage(operation.record.id, 'live');
+  return {
+    command: present ? (0, _statements.updateStatement)(schema, operation.record.id, operation.record.data, now, payload, {
+      restore: true
+    }) : (0, _statements.insertStatement)(schema, operation.record.id, operation.record.data, now, payload),
+    outcome: {
+      operation: present ? 'updated' : 'created',
+      id: operation.record.id
+    }
+  };
+}
+async function resolveDelete(resolver, operation) {
+  const {
+    schema
+  } = resolver;
+  if ((await resolver.state(operation.id)) !== 'live') {
+    missing(schema, operation.id);
+  }
+  resolver.stage(operation.id, 'absent');
+  return {
+    command: [`DELETE FROM ${quoted(schema)} WHERE id = ?`, [operation.id]],
+    outcome: {
+      operation: 'deleted',
+      id: operation.id
+    }
+  };
+}
+async function resolveSoftDelete(resolver, operation) {
+  const {
+    schema,
+    now
+  } = resolver;
+  if (!(0, _declare.hasSoftDelete)(schema)) {
+    (0, _errors2.raise)(_errors.DiagnosticCodes.CONFIG_INVALID, {
+      message: 'collection does not declare soft delete',
+      detail: {
+        collection: schema.name
+      }
+    });
+  }
+  if ((await resolver.state(operation.id)) !== 'live') {
+    missing(schema, operation.id);
+  }
+  resolver.stage(operation.id, 'softDeleted');
+  return {
+    command: [`UPDATE ${quoted(schema)} SET deleted_at = ? WHERE id = ?`, [now, operation.id]],
+    outcome: {
+      operation: 'deleted',
+      id: operation.id
+    }
+  };
+}
+function resolveOperation(resolver, operation) {
+  switch (operation.type) {
+    case 'insert':
+      return resolveInsert(resolver, operation);
+    case 'update':
+      return resolveUpdate(resolver, operation);
+    case 'upsert':
+      return resolveUpsert(resolver, operation);
+    case 'delete':
+      return resolveDelete(resolver, operation);
+    case 'softDelete':
+      return resolveSoftDelete(resolver, operation);
+    default:
+      (0, _errors2.raise)(_errors.DiagnosticCodes.CONFIG_INVALID, {
+        message: 'unsupported batch operation'
+      });
+  }
+}
+async function runBatch(context, operations) {
+  (0, _budgets.assertBatchWithinBudget)(operations.length);
+  const commands = [];
+  const outcomes = [];
+  const overlay = new Map();
+
+  // What the batch will touch, read once per collection (LDB-08). A batch of a
+  // thousand operations used to make a thousand SELECTs before its one write.
+  // The ids travel as one JSON parameter, so no variable limit applies.
+  const known = new Map();
+  const idsByCollection = new Map();
+  for (const operation of operations) {
+    const id = 'record' in operation ? operation.record.id : operation.id;
+    const ids = idsByCollection.get(operation.collection) ?? new Set();
+    ids.add(id);
+    idsByCollection.set(operation.collection, ids);
+  }
+  for (const [collection, ids] of idsByCollection) {
+    const schema = context.schemaFor(collection);
+    const result = await context.connection.execute(`SELECT id, deleted_at FROM ${quoted(schema)} WHERE id IN (SELECT value FROM json_each(?))`, [JSON.stringify([...ids])]);
+    for (const row of result.rows) {
+      known.set(`${schema.name}:${String(row.id)}`, row.deleted_at === null || row.deleted_at === undefined ? 'live' : 'softDeleted');
+    }
+  }
+  for (const operation of operations) {
+    const schema = context.schemaFor(operation.collection);
+    const resolver = {
+      schema,
+      now: context.now(),
+      async state(id) {
+        const key = `${schema.name}:${id}`;
+        return overlay.get(key) ?? known.get(key) ?? 'absent';
+      },
+      stage(id, state) {
+        overlay.set(`${schema.name}:${id}`, state);
+      }
+    };
+    const resolved = await resolveOperation(resolver, operation);
+    commands.push(resolved.command);
+    outcomes.push(resolved.outcome);
+  }
+  await context.connection.executeBatch(commands);
+  return {
+    applied: outcomes.length,
+    outcomes
+  };
+}
+//# sourceMappingURL=batch.js.map