@jini-ai/core 0.4.1 → 0.4.2

package/dist/settings/ports.d.ts

@@ -0,0 +1,118 @@
+import type { UUID } from "../primitives/index.js";
+import type { SettingDefinitionRecord, SettingRevisionRecord, SettingValueRecord } from "./types.js";
+/**
+ * @file Port contract for the `settings` library.
+ *
+ * Purpose:
+ * Dependency-inversion seam (port/adapter rule-of-two) for the 5 settings tables.
+ * Persistence deliberately has no principal-lookup method: target-principal checks use
+ * the separate host-owned SettingsPrincipalLookupPort, keeping membership/status policy
+ * outside the settings persistence contract.
+ *
+ * `transaction` gives `write-service.ts`/`purge-service.ts` the same-tx
+ * guarantee depend on (value/definition row + its revision row
+ * must commit together, or not at all).
+ *
+ * Interfaces and types only — no feature logic.
+ * See docs/decisions/DR-003-settings-ledger-invariants.md.
+ */
+export interface SettingsRepoPort {
+    findActiveDefinition(required: {
+        namespace: string;
+        key: string;
+        workspaceId: UUID | null;
+    }): Promise<SettingDefinitionRecord | null>;
+    findDefinitionBySettingId(required: {
+        settingId: UUID;
+        version?: number;
+    }): Promise<SettingDefinitionRecord | null>;
+    listActiveDefinitions(required: {
+        workspaceId: UUID | null;
+    }): Promise<SettingDefinitionRecord[]>;
+    saveDefinition(record: SettingDefinitionRecord): Promise<void>;
+    getGlobalValue(settingId: UUID): Promise<SettingValueRecord | null>;
+    getWorkspaceValue(required: {
+        workspaceId: UUID;
+        settingId: UUID;
+    }): Promise<SettingValueRecord | null>;
+    getUserValue(required: {
+        workspaceId: UUID;
+        principalId: UUID;
+        settingId: UUID;
+    }): Promise<SettingValueRecord | null>;
+    saveGlobalValue(record: SettingValueRecord): Promise<void>;
+    saveWorkspaceValue(record: SettingValueRecord): Promise<void>;
+    saveUserValue(record: SettingValueRecord): Promise<void>;
+    listWorkspaceValues(required: {
+        workspaceId: UUID;
+    }): Promise<SettingValueRecord[]>;
+    listUserValues(required: {
+        workspaceId: UUID;
+        principalId: UUID;
+    }): Promise<SettingValueRecord[]>;
+    /**
+     * Every `setting_values_user` row for a workspace, across ALL principals
+     * (not just one) — needed by `purge-service.ts`'s full-tenant teardown path,
+     * which must clear the FK-blocking `setting_values_user` rows
+     * for every principal in the workspace, not just one caller-known id.
+     */
+    listUserValuesByWorkspace(required: {
+        workspaceId: UUID;
+    }): Promise<SettingValueRecord[]>;
+    deleteWorkspaceValue(required: {
+        workspaceId: UUID;
+        settingId: UUID;
+    }): Promise<void>;
+    deleteUserValue(required: {
+        workspaceId: UUID;
+        principalId: UUID;
+        settingId: UUID;
+    }): Promise<void>;
+    /** Appends a revision and returns its assigned `seq` (used to stamp the paired value row). */
+    appendRevision(record: Omit<SettingRevisionRecord, "seq">): Promise<number>;
+    listRevisions(required: {
+        settingId: UUID;
+    }): Promise<SettingRevisionRecord[]>;
+    /**
+     * Revisions with `seq` strictly greater than `sinceSeq`, oldest first, capped at `limit`, and
+     * restricted to those `workspaceId` could possibly care about.
+     *
+     * Exists for change detection across PROCESSES. `seq` is a monotonic autoincrement in the shared
+     * database, so a poller in one process observes writes made by another process (e.g. an agent
+     * daemon) — a separate OS process with its own connection — without any IPC between them.
+     *
+     * `limit` bounds a client that reconnects after a long absence: it drains in pages rather than
+     * loading an unbounded backlog into memory.
+     *
+     * **`workspaceId` is a page-sizing predicate, not the disclosure boundary.** The ledger is global
+     * — one store holds every workspace's revisions — so without it a `limit`-sized page is filled by
+     * whichever tenant writes fastest, and a quiet workspace's own change waits behind a busy
+     * neighbour's backlog. That is an observable cross-tenant timing channel and, at sustained write
+     * rates above `limit` per poll interval, a feed that never catches up at all. Implementations must
+     * match rows whose `workspaceId` is either `null` (platform definitions and `global`-scope values,
+     * which every workspace resolves through) or equal to the argument — deliberately a SUPERSET of
+     * what `change-feed.ts#isRevisionVisibleTo` permits, which stays the sole authority on disclosure.
+     */
+    listRevisionsSince(required: {
+        sinceSeq: number;
+        limit: number;
+        workspaceId: UUID;
+    }): Promise<SettingRevisionRecord[]>;
+    /** The newest assigned `seq`, or 0 when the ledger is empty — a subscriber's starting cursor. */
+    maxRevisionSeq(): Promise<number>;
+    /**
+     * Runs `fn` with the guarantee that all repo calls inside it commit or roll
+     * back together. Every adapter must honour this — it is what makes a
+     * composite write like `resetNamespace` all-or-nothing, and the contract
+     * suite asserts it against all of them rather than only the durable one.
+     *
+     * **Not reentrant.** Calling this while another `transaction` on the same
+     * repo is open must fail loudly, never silently join. An adapter cannot tell
+     * a genuine nested call from an unrelated concurrent one, and joining a
+     * stranger's transaction makes it inherit that transaction's rollback. A
+     * caller that needs several writes to commit together opens ONE transaction
+     * and passes `skipTransaction` to the inner writes.
+     */
+    transaction<T>(fn: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/settings/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/settings/principal-lookup.d.ts

@@ -0,0 +1,9 @@
+import type { Principal } from "../principal.js";
+/** Resolve only an active principal in the requested workspace. The host owns status and membership policy. */
+export interface SettingsPrincipalLookupPort {
+    findActiveById(required: {
+        workspaceId: string;
+        id: string;
+    }): Promise<Principal | null>;
+}
+//# sourceMappingURL=principal-lookup.d.ts.map

package/dist/settings/principal-lookup.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=principal-lookup.js.map

package/dist/settings/purge-service.d.ts

@@ -0,0 +1,54 @@
+import type { Clock, UUID } from "../primitives/index.js";
+import type { SettingsRepoPort } from "./ports.js";
+import type { AuthorizeFn } from "./write-service.js";
+/**
+ * @file `purgeTenantSettings` — the ledgered tenant/principal purge chokepoint.
+ *
+ * Purpose:
+ * A host's value-table FKs (`setting_values_workspace`/`_user` -> `workspaces`)
+ * are typically `ON DELETE RESTRICT`, not `CASCADE` — a raw workspace delete
+ * cannot silently drop value rows without a ledgered revision. This module is
+ * the explicit, ledgered alternative that requires: `authorize` once
+ * -> enumerate every affected row -> append a redacted `op='purge'` revision
+ * per row -> delete the row, all in ONE transaction. The `setting_revisions`
+ * ledger itself is NEVER touched by a purge — only value rows are removed,
+ * with their purge revision left behind. Repo write methods stay
+ * package-private to this file and `write-service.ts`.
+ *
+ * Deviation from the outline's `SettingsWriteServiceDeps`: purge needs
+ * neither `ids` (no new definition/value rows are created) nor `principals`
+ * ( target-principal check is a write-time guard; purge only removes
+ * pre-existing rows, it never writes a new user-scope row for an unverified
+ * principal) — so it declares its own smaller `PurgeServiceDeps`.
+ * See docs/decisions/DR-003-settings-ledger-invariants.md.
+ */
+export interface PurgeServiceDeps {
+    repo: SettingsRepoPort;
+    clock: Clock;
+    authorize: AuthorizeFn;
+}
+export interface PurgeTenantSettingsRequired {
+    deps: PurgeServiceDeps;
+    input: {
+        workspaceId: UUID;
+        /**
+         * Omitted -> full tenant teardown: every `setting_values_workspace` row
+         * for the workspace AND every `setting_values_user` row for every
+         * principal in the workspace.
+         * Present -> scope the purge to one principal's `setting_values_user`
+         * rows only (GDPR single-subject erasure) — workspace-scope values and
+         * every other principal's rows are left untouched.
+         */
+        principalId?: UUID;
+        callerPrincipalId: UUID;
+    };
+}
+/**
+ * The purge chokepoint: authorize `settings.definitions.manage` once ->
+ * enumerate the affected rows -> append a redacted `op='purge'` revision +
+ * delete, per row, all in one transaction.
+ */
+export declare function purgeTenantSettings(required: PurgeTenantSettingsRequired): Promise<{
+    purgedCount: number;
+}>;
+//# sourceMappingURL=purge-service.d.ts.map

package/dist/settings/purge-service.js

@@ -0,0 +1,106 @@
+import { nowIso as kernelNowIso } from "../primitives/index.js";
+import { ForbiddenError } from "./errors.js";
+import { invalidateWorkspaceSettingsCache } from "./settings.js";
+/**
+ * The purge chokepoint: authorize `settings.definitions.manage` once ->
+ * enumerate the affected rows -> append a redacted `op='purge'` revision +
+ * delete, per row, all in one transaction.
+ */
+export async function purgeTenantSettings(required) {
+    const { deps, input } = required;
+    const authResult = await deps.authorize({
+        principalId: input.callerPrincipalId,
+        permission: "settings.definitions.manage",
+        workspaceId: input.workspaceId,
+        entityType: "setting-workspace",
+        entityId: input.workspaceId,
+    });
+    if (!authResult.allowed) {
+        throw new ForbiddenError(`principal '${input.callerPrincipalId}' is not authorized for 'settings.definitions.manage' (${authResult.reason})`);
+    }
+    const result = await deps.repo.transaction(async () => {
+        const now = kernelNowIso({ clock: deps.clock });
+        let purgedCount = 0;
+        if (input.principalId) {
+            const userValues = await deps.repo.listUserValues({
+                workspaceId: input.workspaceId,
+                principalId: input.principalId,
+            });
+            for (const value of userValues) {
+                await deps.repo.appendRevision({
+                    entityKind: "value",
+                    settingId: value.settingId,
+                    scope: "user",
+                    workspaceId: input.workspaceId,
+                    principalId: input.principalId,
+                    op: "purge",
+                    beforeJson: null,
+                    afterJson: null,
+                    defVersion: value.defVersion,
+                    actor: input.callerPrincipalId,
+                    originPluginId: null,
+                    changeSetId: null,
+                    createdAt: now,
+                });
+                await deps.repo.deleteUserValue({
+                    workspaceId: input.workspaceId,
+                    principalId: input.principalId,
+                    settingId: value.settingId,
+                });
+                purgedCount++;
+            }
+            return { purgedCount };
+        }
+        const workspaceValues = await deps.repo.listWorkspaceValues({ workspaceId: input.workspaceId });
+        for (const value of workspaceValues) {
+            await deps.repo.appendRevision({
+                entityKind: "value",
+                settingId: value.settingId,
+                scope: "workspace",
+                workspaceId: input.workspaceId,
+                principalId: null,
+                op: "purge",
+                beforeJson: null,
+                afterJson: null,
+                defVersion: value.defVersion,
+                actor: input.callerPrincipalId,
+                originPluginId: null,
+                changeSetId: null,
+                createdAt: now,
+            });
+            await deps.repo.deleteWorkspaceValue({ workspaceId: input.workspaceId, settingId: value.settingId });
+            purgedCount++;
+        }
+        const userValues = await deps.repo.listUserValuesByWorkspace({ workspaceId: input.workspaceId });
+        for (const value of userValues) {
+            const targetPrincipalId = value.principalId;
+            if (!targetPrincipalId)
+                continue; // defensive: every setting_values_user row carries a principal_id
+            await deps.repo.appendRevision({
+                entityKind: "value",
+                settingId: value.settingId,
+                scope: "user",
+                workspaceId: input.workspaceId,
+                principalId: targetPrincipalId,
+                op: "purge",
+                beforeJson: null,
+                afterJson: null,
+                defVersion: value.defVersion,
+                actor: input.callerPrincipalId,
+                originPluginId: null,
+                changeSetId: null,
+                createdAt: now,
+            });
+            await deps.repo.deleteUserValue({
+                workspaceId: input.workspaceId,
+                principalId: targetPrincipalId,
+                settingId: value.settingId,
+            });
+            purgedCount++;
+        }
+        return { purgedCount };
+    });
+    invalidateWorkspaceSettingsCache({ repo: deps.repo, workspaceId: input.workspaceId }, { principalId: input.principalId });
+    return result;
+}
+//# sourceMappingURL=purge-service.js.map

package/dist/settings/repo.memory.d.ts

@@ -0,0 +1,119 @@
+import type { SettingsRepoPort } from "./ports.js";
+import type { SettingDefinitionRecord, SettingRevisionRecord, SettingValueRecord } from "./types.js";
+/**
+ * @file In-memory adapter for `SettingsRepoPort` (the rule-of-two: in-memory + production adapters).
+ *
+ * Purpose:
+ * Test/dev implementation. Mirrors the exact style of `identity/repo.memory.ts`:
+ * constructor takes seed rows, methods filter/mutate internal arrays.
+ *
+ * `transaction` is a real snapshot/restore journal, not a no-op wrapper. It
+ * used to be `async (fn) => fn()` on the reasoning that each individual
+ * mutation is already synchronous and atomic in-process — true, but the
+ * guarantee `SettingsRepoPort.transaction` actually sells is that a COMPOSITE
+ * of several mutations is all-or-nothing. `resetNamespace` clears a whole
+ * namespace inside one transaction; under a no-op wrapper a failure partway
+ * through left the namespace half reset while the caller saw an error. This
+ * adapter is a common wired default for dev/test composition, so that was
+ * live in dev, and the contract suite could not see it because the rollback
+ * assertion only ran against the SQLite adapter.
+ */
+export declare class InMemorySettingsRepo implements SettingsRepoPort {
+    private definitions;
+    private globalValues;
+    private workspaceValues;
+    private userValues;
+    private revisions;
+    private nextSeq;
+    /** True while `transaction` is open — see its doc for why this refuses
+     *  rather than nests. */
+    private inTransaction;
+    constructor(seed?: {
+        definitions?: SettingDefinitionRecord[];
+        globalValues?: SettingValueRecord[];
+        workspaceValues?: SettingValueRecord[];
+        userValues?: SettingValueRecord[];
+        revisions?: SettingRevisionRecord[];
+    });
+    findActiveDefinition(required: {
+        namespace: string;
+        key: string;
+        workspaceId: string | null;
+    }): Promise<SettingDefinitionRecord | null>;
+    findDefinitionBySettingId(required: {
+        settingId: string;
+        version?: number;
+    }): Promise<SettingDefinitionRecord | null>;
+    listActiveDefinitions(required: {
+        workspaceId: string | null;
+    }): Promise<SettingDefinitionRecord[]>;
+    saveDefinition(record: SettingDefinitionRecord): Promise<void>;
+    getGlobalValue(settingId: string): Promise<SettingValueRecord | null>;
+    getWorkspaceValue(required: {
+        workspaceId: string;
+        settingId: string;
+    }): Promise<SettingValueRecord | null>;
+    getUserValue(required: {
+        workspaceId: string;
+        principalId: string;
+        settingId: string;
+    }): Promise<SettingValueRecord | null>;
+    saveGlobalValue(record: SettingValueRecord): Promise<void>;
+    saveWorkspaceValue(record: SettingValueRecord): Promise<void>;
+    saveUserValue(record: SettingValueRecord): Promise<void>;
+    listWorkspaceValues(required: {
+        workspaceId: string;
+    }): Promise<SettingValueRecord[]>;
+    listUserValues(required: {
+        workspaceId: string;
+        principalId: string;
+    }): Promise<SettingValueRecord[]>;
+    listUserValuesByWorkspace(required: {
+        workspaceId: string;
+    }): Promise<SettingValueRecord[]>;
+    deleteWorkspaceValue(required: {
+        workspaceId: string;
+        settingId: string;
+    }): Promise<void>;
+    deleteUserValue(required: {
+        workspaceId: string;
+        principalId: string;
+        settingId: string;
+    }): Promise<void>;
+    appendRevision(record: Omit<SettingRevisionRecord, "seq">): Promise<number>;
+    listRevisions(required: {
+        settingId: string;
+    }): Promise<SettingRevisionRecord[]>;
+    listRevisionsSince(required: {
+        sinceSeq: number;
+        limit: number;
+        workspaceId: string;
+    }): Promise<SettingRevisionRecord[]>;
+    maxRevisionSeq(): Promise<number>;
+    /**
+     * Runs `fn` atomically: every mutation it makes is discarded if it throws.
+     *
+     * A shallow copy of each array is enough because no method here mutates a
+     * record in place — `save*` REPLACES the element at its index, `delete*`
+     * reassigns a filtered array, `appendRevision` pushes. Restoring the arrays
+     * therefore restores the rows too. If a future method starts editing a
+     * record object in place, this must deep-copy instead.
+     *
+     * `nextSeq` is rolled back with the rest, matching SQLite: `sqlite_sequence`
+     * is an ordinary table, so an AUTOINCREMENT counter bumped inside a
+     * transaction is undone by its ROLLBACK. A seq handed out by a failed
+     * transaction is safe to reuse precisely because that revision no longer
+     * exists.
+     *
+     * **Deliberately NOT reentrant**, matching a SQLite adapter's `transaction`,
+     * where `BEGIN IMMEDIATE` inside an open transaction is an error. Refusing
+     * loudly is the point: an instance-level flag cannot tell "nested inside my
+     * caller's transaction" from "an unrelated transaction that started while
+     * mine was awaiting". Silently joining a stranger's transaction — and
+     * inheriting its rollback — is a worse defect than refusing. A caller that
+     * needs several writes to commit together opens ONE transaction and passes
+     * `skipTransaction` to the inner writes, as `resetNamespace` does.
+     */
+    transaction<T>(fn: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=repo.memory.d.ts.map

package/dist/settings/repo.memory.js

@@ -0,0 +1,199 @@
+/**
+ * @file In-memory adapter for `SettingsRepoPort` (the rule-of-two: in-memory + production adapters).
+ *
+ * Purpose:
+ * Test/dev implementation. Mirrors the exact style of `identity/repo.memory.ts`:
+ * constructor takes seed rows, methods filter/mutate internal arrays.
+ *
+ * `transaction` is a real snapshot/restore journal, not a no-op wrapper. It
+ * used to be `async (fn) => fn()` on the reasoning that each individual
+ * mutation is already synchronous and atomic in-process — true, but the
+ * guarantee `SettingsRepoPort.transaction` actually sells is that a COMPOSITE
+ * of several mutations is all-or-nothing. `resetNamespace` clears a whole
+ * namespace inside one transaction; under a no-op wrapper a failure partway
+ * through left the namespace half reset while the caller saw an error. This
+ * adapter is a common wired default for dev/test composition, so that was
+ * live in dev, and the contract suite could not see it because the rollback
+ * assertion only ran against the SQLite adapter.
+ */
+export class InMemorySettingsRepo {
+    definitions;
+    globalValues;
+    workspaceValues;
+    userValues;
+    revisions;
+    nextSeq;
+    /** True while `transaction` is open — see its doc for why this refuses
+     *  rather than nests. */
+    inTransaction = false;
+    constructor(seed = {}) {
+        this.definitions = [...(seed.definitions ?? [])];
+        this.globalValues = [...(seed.globalValues ?? [])];
+        this.workspaceValues = [...(seed.workspaceValues ?? [])];
+        this.userValues = [...(seed.userValues ?? [])];
+        this.revisions = [...(seed.revisions ?? [])];
+        this.nextSeq = (seed.revisions?.reduce((max, r) => Math.max(max, r.seq), 0) ?? 0) + 1;
+    }
+    async findActiveDefinition(required) {
+        // Matches active/alias/tombstone (the "current" row for this (ns,key,ws)
+        // slot — callers decide how to react to each status, e.g. settings.ts
+        // treats tombstone as read-absent but write-service.ts reports it
+        // distinctly as DEFINITION_TOMBSTONED). Deliberately excludes
+        // `deprecated`: those are stale prior-version rows superseded by a newer
+        // active row at the same (ns,key,ws) slot (the retype mechanism), so
+        // including them would make this lookup ambiguous.
+        return (this.definitions.find((d) => d.namespace === required.namespace &&
+            d.key === required.key &&
+            d.workspaceId === required.workspaceId &&
+            (d.status === "active" || d.status === "alias" || d.status === "tombstone")) ?? null);
+    }
+    async findDefinitionBySettingId(required) {
+        const candidates = this.definitions.filter((d) => d.settingId === required.settingId);
+        if (required.version != null) {
+            return candidates.find((d) => d.version === required.version) ?? null;
+        }
+        return (candidates.find((d) => d.status === "active") ??
+            candidates.sort((a, b) => b.version - a.version)[0] ??
+            null);
+    }
+    async listActiveDefinitions(required) {
+        return this.definitions.filter((d) => d.workspaceId === required.workspaceId && (d.status === "active" || d.status === "alias"));
+    }
+    async saveDefinition(record) {
+        const index = this.definitions.findIndex((d) => d.settingId === record.settingId && d.version === record.version);
+        if (index === -1) {
+            this.definitions.push(record);
+            return;
+        }
+        this.definitions[index] = record;
+    }
+    async getGlobalValue(settingId) {
+        return this.globalValues.find((v) => v.settingId === settingId) ?? null;
+    }
+    async getWorkspaceValue(required) {
+        return (this.workspaceValues.find((v) => v.workspaceId === required.workspaceId && v.settingId === required.settingId) ?? null);
+    }
+    async getUserValue(required) {
+        return (this.userValues.find((v) => v.workspaceId === required.workspaceId &&
+            v.principalId === required.principalId &&
+            v.settingId === required.settingId) ?? null);
+    }
+    async saveGlobalValue(record) {
+        const index = this.globalValues.findIndex((v) => v.settingId === record.settingId);
+        if (index === -1) {
+            this.globalValues.push(record);
+            return;
+        }
+        this.globalValues[index] = record;
+    }
+    async saveWorkspaceValue(record) {
+        const index = this.workspaceValues.findIndex((v) => v.workspaceId === record.workspaceId && v.settingId === record.settingId);
+        if (index === -1) {
+            this.workspaceValues.push(record);
+            return;
+        }
+        this.workspaceValues[index] = record;
+    }
+    async saveUserValue(record) {
+        const index = this.userValues.findIndex((v) => v.workspaceId === record.workspaceId &&
+            v.principalId === record.principalId &&
+            v.settingId === record.settingId);
+        if (index === -1) {
+            this.userValues.push(record);
+            return;
+        }
+        this.userValues[index] = record;
+    }
+    async listWorkspaceValues(required) {
+        return this.workspaceValues.filter((v) => v.workspaceId === required.workspaceId);
+    }
+    async listUserValues(required) {
+        return this.userValues.filter((v) => v.workspaceId === required.workspaceId && v.principalId === required.principalId);
+    }
+    async listUserValuesByWorkspace(required) {
+        return this.userValues.filter((v) => v.workspaceId === required.workspaceId);
+    }
+    async deleteWorkspaceValue(required) {
+        this.workspaceValues = this.workspaceValues.filter((v) => !(v.workspaceId === required.workspaceId && v.settingId === required.settingId));
+    }
+    async deleteUserValue(required) {
+        this.userValues = this.userValues.filter((v) => !(v.workspaceId === required.workspaceId &&
+            v.principalId === required.principalId &&
+            v.settingId === required.settingId));
+    }
+    async appendRevision(record) {
+        const seq = this.nextSeq++;
+        this.revisions.push({ ...record, seq });
+        return seq;
+    }
+    async listRevisions(required) {
+        return this.revisions.filter((r) => r.settingId === required.settingId).sort((a, b) => a.seq - b.seq);
+    }
+    async listRevisionsSince(required) {
+        return this.revisions
+            .filter((r) => r.seq > required.sinceSeq &&
+            // Mirrors the SQL predicate exactly — see the port's doc. `null` means
+            // platform-wide (every workspace resolves through it); anything else is one tenant's.
+            (r.workspaceId === null || r.workspaceId === required.workspaceId))
+            .sort((a, b) => a.seq - b.seq)
+            .slice(0, required.limit);
+    }
+    async maxRevisionSeq() {
+        return this.revisions.reduce((max, r) => (r.seq > max ? r.seq : max), 0);
+    }
+    /**
+     * Runs `fn` atomically: every mutation it makes is discarded if it throws.
+     *
+     * A shallow copy of each array is enough because no method here mutates a
+     * record in place — `save*` REPLACES the element at its index, `delete*`
+     * reassigns a filtered array, `appendRevision` pushes. Restoring the arrays
+     * therefore restores the rows too. If a future method starts editing a
+     * record object in place, this must deep-copy instead.
+     *
+     * `nextSeq` is rolled back with the rest, matching SQLite: `sqlite_sequence`
+     * is an ordinary table, so an AUTOINCREMENT counter bumped inside a
+     * transaction is undone by its ROLLBACK. A seq handed out by a failed
+     * transaction is safe to reuse precisely because that revision no longer
+     * exists.
+     *
+     * **Deliberately NOT reentrant**, matching a SQLite adapter's `transaction`,
+     * where `BEGIN IMMEDIATE` inside an open transaction is an error. Refusing
+     * loudly is the point: an instance-level flag cannot tell "nested inside my
+     * caller's transaction" from "an unrelated transaction that started while
+     * mine was awaiting". Silently joining a stranger's transaction — and
+     * inheriting its rollback — is a worse defect than refusing. A caller that
+     * needs several writes to commit together opens ONE transaction and passes
+     * `skipTransaction` to the inner writes, as `resetNamespace` does.
+     */
+    async transaction(fn) {
+        if (this.inTransaction) {
+            throw new Error("InMemorySettingsRepo.transaction is not reentrant, and cannot host a second overlapping transaction. " +
+                "Open one transaction and pass `skipTransaction` to the inner writes (see resetNamespace).");
+        }
+        const snapshot = {
+            definitions: [...this.definitions],
+            globalValues: [...this.globalValues],
+            workspaceValues: [...this.workspaceValues],
+            userValues: [...this.userValues],
+            revisions: [...this.revisions],
+            nextSeq: this.nextSeq,
+        };
+        this.inTransaction = true;
+        try {
+            return await fn();
+        }
+        catch (error) {
+            this.definitions = snapshot.definitions;
+            this.globalValues = snapshot.globalValues;
+            this.workspaceValues = snapshot.workspaceValues;
+            this.userValues = snapshot.userValues;
+            this.revisions = snapshot.revisions;
+            this.nextSeq = snapshot.nextSeq;
+            throw error;
+        }
+        finally {
+            this.inTransaction = false;
+        }
+    }
+}
+//# sourceMappingURL=repo.memory.js.map