@quereus/store 4.11.0 → 4.12.0

package/dist/src/testing/kv-naming-conformance.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Shared physical-store-name distinctness battery — test-support; run under Mocha.
+ *
+ * Third sibling of {@link runKVStoreConformance} (the {@link KVStore} contract) and
+ * {@link runKVProviderConformance} (the atomic multi-store commit). This one asserts a
+ * single PROVIDER-level property that every backend must hold:
+ *
+ *   Two logical stores the engine considers distinct never share one physical store.
+ *
+ * Why it exists as a shared battery rather than a per-plugin test: the engine's only
+ * collision guard, `StoreModule.assertStoreNameFree`, compares LOGICAL store names
+ * (`{schema}.{table}` from `buildDataStoreName`) as plain JS strings. That guard stands
+ * in for a physical collision check only while each provider's translation from the
+ * logical name to its own native name (a LevelDB sublevel, an IndexedDB object store, a
+ * SQLite table, an on-device LevelDB file) is INJECTIVE — two different logical names can
+ * never come out the same. A provider that lowercases, strips punctuation, or otherwise
+ * folds characters breaks that silently: two `create table`s both succeed and their rows
+ * then interleave in one physical store. Nothing in the type system prevents the next
+ * provider from reintroducing it, so the property is pinned behaviorally here.
+ *
+ * The battery needs nothing beyond the public {@link KVStoreProvider} surface, so it runs
+ * for every backend: it writes a distinct marker into each store under ONE shared key and
+ * checks each store still reads back its own marker. Two entries sharing a physical store
+ * show up as one marker having overwritten another.
+ *
+ * A provider MAY reject a name its native namespace cannot represent — a throw from
+ * `getStore`/`getIndexStore` passes that entry, and the rejected entries are reported so
+ * the corpus cannot silently shrink to nothing. Silently folding two names onto one store
+ * never passes. Entries marked {@link StoreSpec.mustAccept} (logical names using only
+ * `[a-z0-9_.]`, which any KV namespace can represent) may not be rejected at all.
+ *
+ * Dependency and Mocha-global handling mirror kv-conformance.ts — see its header.
+ *
+ * NOTE: this asserts distinctness, not decodability. An injective encoding is what the
+ * property needs; nothing here requires a provider to be able to recover the logical name
+ * from the physical one, and no shipped provider does.
+ *
+ * NOTE: the marker check reads back through the very handles it wrote through, so a
+ * provider that (a) caches one read-your-own-writes handle PER LOGICAL NAME — as
+ * `IndexedDBProvider` does, wrapping each store in `CachedKVStore` — and (b) folds two
+ * logical names onto one physical store BELOW that cache would serve each marker from its
+ * own cache and pass. No shipped provider does both: the only caching provider names its
+ * object stores verbatim, so its folding (if any) would happen at the cache key and be
+ * caught. If a provider ever gains a lossy escape underneath a per-name cache, re-read the
+ * markers through handles reopened after `closeStore`/`closeIndexStore` instead.
+ */
+import type { KVStoreProvider } from '../common/kv-store.js';
+import type { KVProviderLifecycle } from './kv-lifecycle.js';
+/**
+ * Per-backend lifecycle adapter — the shared provider-battery shape, so a plugin's spec can
+ * hand one closure to this battery and to {@link runStoreReclaimConformance} alike. The
+ * suite drives its own per-test lifecycle and calls {@link makeNamingBackend} fresh for
+ * every test, so state never leaks between tests.
+ */
+export type KVNamingBackend = KVProviderLifecycle;
+/**
+ * Assert `provider` gives every logical store in {@link DISTINCT_STORES} its OWN physical
+ * store: write one marker per store under a single shared key, then check each store still
+ * reads back its own. A shared physical store shows up as one marker having replaced
+ * another.
+ *
+ * Exported standalone (like {@link assertBoundedIterate}) so a spec can drive it against a
+ * provider double built to violate the property and prove it rejects — a guard nobody has
+ * watched fail is not a guard. See `test/store-name-distinctness.spec.ts`.
+ *
+ * @param provider - A provider over a fresh, EMPTY physical keyspace.
+ * @param report - Where to record names the provider refused. Refusal is allowed (a
+ *   namespace that genuinely cannot represent a name must reject it rather than fold it),
+ *   but never silently: the battery logs whatever lands here.
+ */
+export declare function assertStoreNamesDistinct(provider: KVStoreProvider, report?: string[]): Promise<void>;
+/**
+ * Register the store-name distinctness battery under `describe(name)`. Call once per
+ * backend, from the same spec file that registers {@link runKVStoreConformance}.
+ */
+export declare function runStoreNameDistinctness(name: string, makeNamingBackend: () => KVNamingBackend): void;
+//# sourceMappingURL=kv-naming-conformance.d.ts.map

package/dist/src/testing/kv-naming-conformance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kv-naming-conformance.d.ts","sourceRoot":"","sources":["../../../src/testing/kv-naming-conformance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAGH,OAAO,KAAK,EAAW,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAU7D;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAgFlD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,CAC7C,QAAQ,EAAE,eAAe,EACzB,MAAM,GAAE,MAAM,EAAO,GACnB,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,eAAe,GAAG,IAAI,CAoFrG"}

package/dist/src/testing/kv-naming-conformance.js

@@ -0,0 +1,208 @@
+/**
+ * Shared physical-store-name distinctness battery — test-support; run under Mocha.
+ *
+ * Third sibling of {@link runKVStoreConformance} (the {@link KVStore} contract) and
+ * {@link runKVProviderConformance} (the atomic multi-store commit). This one asserts a
+ * single PROVIDER-level property that every backend must hold:
+ *
+ *   Two logical stores the engine considers distinct never share one physical store.
+ *
+ * Why it exists as a shared battery rather than a per-plugin test: the engine's only
+ * collision guard, `StoreModule.assertStoreNameFree`, compares LOGICAL store names
+ * (`{schema}.{table}` from `buildDataStoreName`) as plain JS strings. That guard stands
+ * in for a physical collision check only while each provider's translation from the
+ * logical name to its own native name (a LevelDB sublevel, an IndexedDB object store, a
+ * SQLite table, an on-device LevelDB file) is INJECTIVE — two different logical names can
+ * never come out the same. A provider that lowercases, strips punctuation, or otherwise
+ * folds characters breaks that silently: two `create table`s both succeed and their rows
+ * then interleave in one physical store. Nothing in the type system prevents the next
+ * provider from reintroducing it, so the property is pinned behaviorally here.
+ *
+ * The battery needs nothing beyond the public {@link KVStoreProvider} surface, so it runs
+ * for every backend: it writes a distinct marker into each store under ONE shared key and
+ * checks each store still reads back its own marker. Two entries sharing a physical store
+ * show up as one marker having overwritten another.
+ *
+ * A provider MAY reject a name its native namespace cannot represent — a throw from
+ * `getStore`/`getIndexStore` passes that entry, and the rejected entries are reported so
+ * the corpus cannot silently shrink to nothing. Silently folding two names onto one store
+ * never passes. Entries marked {@link StoreSpec.mustAccept} (logical names using only
+ * `[a-z0-9_.]`, which any KV namespace can represent) may not be rejected at all.
+ *
+ * Dependency and Mocha-global handling mirror kv-conformance.ts — see its header.
+ *
+ * NOTE: this asserts distinctness, not decodability. An injective encoding is what the
+ * property needs; nothing here requires a provider to be able to recover the logical name
+ * from the physical one, and no shipped provider does.
+ *
+ * NOTE: the marker check reads back through the very handles it wrote through, so a
+ * provider that (a) caches one read-your-own-writes handle PER LOGICAL NAME — as
+ * `IndexedDBProvider` does, wrapping each store in `CachedKVStore` — and (b) folds two
+ * logical names onto one physical store BELOW that cache would serve each marker from its
+ * own cache and pass. No shipped provider does both: the only caching provider names its
+ * object stores verbatim, so its folding (if any) would happen at the cache key and be
+ * caught. If a provider ever gains a lossy escape underneath a per-name cache, re-read the
+ * markers through handles reopened after `closeStore`/`closeIndexStore` instead.
+ */
+import assert from 'node:assert/strict';
+import { assertBytes, b } from './kv-assert.js';
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/** The single key every store's marker is written under. */
+const MARKER_KEY = b(0x01);
+/**
+ * Logical stores that must all land on DIFFERENT physical stores.
+ *
+ * Every name here is one the shared builders accept (no unpaired surrogates — those are
+ * refused above every provider by `assertKeyableIdentifiers`). The awkward ones are chosen
+ * to break a specific plausible encoding:
+ *
+ *   - `a-b` / `a b` / `a.b` / `a_b` — collapse onto each other under any "fold everything
+ *     outside `[a-zA-Z0-9_]` to `_`" sanitizer.
+ *   - `café` / `weißbier` — non-ASCII, which a byte-range filter drops or folds.
+ *   - `o'brien` — the quote character a SQL-identifier encoding has to deal with.
+ *   - index `x` on `t` vs. index `x` on `t2` — an index store name must carry its table.
+ *   - `other.t` vs `main.t` — same table name, different schema.
+ *
+ * Two near-miss pairs are deliberately ABSENT, because they compose to ONE logical name at
+ * the BUILDER — so no provider can tell them apart and asserting distinctness here would
+ * pin a failure nobody can fix. Both are guarded above the provider instead:
+ *
+ *   - schema `x` + table `y.z` vs. schema `x.y` + table `z` (both `x.y.z`) — a documented
+ *     limitation of the `.`-joined name; see the NOTE on `buildDataStoreName`.
+ *   - a table literally named `t_idx_x` vs. index `x` on table `t` (both `main.t_idx_x`) —
+ *     `_idx_` is a legal substring of an ordinary identifier, so the join is likewise not
+ *     boundary-safe. `StoreModuleBase.assertStoreNameFree` rejects whichever of the two is
+ *     created second, which is what keeps them from ever coexisting.
+ */
+const DISTINCT_STORES = [
+    { label: 'main.t', schema: 'main', table: 't', mustAccept: true },
+    { label: 'main.t2', schema: 'main', table: 't2', mustAccept: true },
+    { label: 'main.a_b', schema: 'main', table: 'a_b', mustAccept: true },
+    { label: 'other.t', schema: 'other', table: 't', mustAccept: true },
+    { label: 'main.t_idx_x (index x on table t)', schema: 'main', table: 't', index: 'x', mustAccept: true },
+    { label: 'main.t2_idx_x (index x on table t2)', schema: 'main', table: 't2', index: 'x', mustAccept: true },
+    { label: 'main.a-b', schema: 'main', table: 'a-b' },
+    { label: 'main.a b', schema: 'main', table: 'a b' },
+    { label: 'main.a.b', schema: 'main', table: 'a.b' },
+    { label: 'main.café', schema: 'main', table: 'café' },
+    { label: "main.o'brien", schema: 'main', table: "o'brien" },
+    { label: 'main.weißbier', schema: 'main', table: 'weißbier' },
+];
+/** Open the store a spec names, through the provider's public surface. */
+function openSpec(provider, spec) {
+    return spec.index === undefined
+        ? provider.getStore(spec.schema, spec.table)
+        : provider.getIndexStore(spec.schema, spec.table, spec.index);
+}
+/** Read a store's marker back, or `'<none>'` when the key is absent. */
+async function readMarker(store) {
+    const value = await store.get(MARKER_KEY);
+    return value === undefined ? '<none>' : decoder.decode(value);
+}
+/**
+ * Assert `provider` gives every logical store in {@link DISTINCT_STORES} its OWN physical
+ * store: write one marker per store under a single shared key, then check each store still
+ * reads back its own. A shared physical store shows up as one marker having replaced
+ * another.
+ *
+ * Exported standalone (like {@link assertBoundedIterate}) so a spec can drive it against a
+ * provider double built to violate the property and prove it rejects — a guard nobody has
+ * watched fail is not a guard. See `test/store-name-distinctness.spec.ts`.
+ *
+ * @param provider - A provider over a fresh, EMPTY physical keyspace.
+ * @param report - Where to record names the provider refused. Refusal is allowed (a
+ *   namespace that genuinely cannot represent a name must reject it rather than fold it),
+ *   but never silently: the battery logs whatever lands here.
+ */
+export async function assertStoreNamesDistinct(provider, report = []) {
+    const opened = [];
+    for (const spec of DISTINCT_STORES) {
+        try {
+            opened.push({ spec, store: await openSpec(provider, spec) });
+        }
+        catch (e) {
+            // A provider whose native namespace genuinely cannot represent this name is
+            // allowed to refuse it — that is the safe outcome. Folding it onto another
+            // store is not, and is what the marker check below catches.
+            assert.ok(!spec.mustAccept, `${spec.label} uses only [a-z0-9_.] and must be representable, but the provider rejected it: ${String(e)}`);
+            report.push(`${spec.label} (${String(e)})`);
+        }
+    }
+    // No explicit "did enough survive?" check is needed: the `mustAccept` entries above
+    // cannot be refused, so the compared set never shrinks below them.
+    for (const { spec, store } of opened) {
+        await store.put(MARKER_KEY, encoder.encode(spec.label));
+    }
+    for (const { spec, store } of opened) {
+        assert.strictEqual(await readMarker(store), spec.label, `store "${spec.label}" reads back another store's marker — the two share one physical store`);
+    }
+}
+/**
+ * Register the store-name distinctness battery under `describe(name)`. Call once per
+ * backend, from the same spec file that registers {@link runKVStoreConformance}.
+ */
+export function runStoreNameDistinctness(name, makeNamingBackend) {
+    describe(name, () => {
+        let backend;
+        let provider;
+        beforeEach(async () => {
+            backend = makeNamingBackend();
+            provider = await backend.open();
+        });
+        afterEach(async () => {
+            await backend.teardown();
+        });
+        it('gives every distinct logical store its own physical store', async () => {
+            const rejected = [];
+            await assertStoreNamesDistinct(provider, rejected);
+            if (rejected.length > 0) {
+                // Visible on a passing run too: a provider that quietly grew its rejection set
+                // would otherwise look identical to one that represents every name.
+                console.warn(`${name}: names refused by the provider (allowed, but recorded): ${rejected.join('; ')}`);
+            }
+        });
+        it('opens ONE physical store for either spelling of a case-insensitive identifier', async () => {
+            // SQL identifiers are case-insensitive, and the shared builders lowercase, so two
+            // spellings of one logical store must land on the same physical store — the mirror
+            // image of the distinctness property, and just as easy to break (a provider that
+            // lowercases only part of the name gets two stores for one index).
+            const upperData = await provider.getStore('MAIN', 'T');
+            await upperData.put(MARKER_KEY, encoder.encode('data'));
+            const lowerData = await provider.getStore('main', 't');
+            assertBytes(await lowerData.get(MARKER_KEY), encoder.encode('data'), 'getStore("MAIN","T") and getStore("main","t") must be the same physical store');
+            const upperIndex = await provider.getIndexStore('main', 't', 'IdxName');
+            await upperIndex.put(MARKER_KEY, encoder.encode('index'));
+            const lowerIndex = await provider.getIndexStore('MAIN', 'T', 'idxname');
+            assertBytes(await lowerIndex.get(MARKER_KEY), encoder.encode('index'), 'getIndexStore(…,"IdxName") and getIndexStore(…,"idxname") must be the same physical store');
+            // …and the index store is still not the data store (a provider could satisfy both
+            // checks above by returning one store for everything).
+            assert.strictEqual(await readMarker(lowerData), 'data', 'the index write leaked into the data store');
+        });
+        it('keeps the reserved catalog and stats stores disjoint from same-named tables', async () => {
+            const catalog = await provider.getCatalogStore();
+            const stats = await provider.getStatsStore('main', 't');
+            await catalog.put(MARKER_KEY, encoder.encode('catalog'));
+            await stats.put(MARKER_KEY, encoder.encode('stats'));
+            assert.strictEqual(await readMarker(catalog), 'catalog', 'the catalog and stats stores are the same physical store');
+            // A user table may legally be named `__catalog__` or `__stats__`. Its data store
+            // must not land on the reserved store of the same name — providers keep the
+            // reserved names in a namespace their encoded table names cannot reach.
+            const tableStores = new Map();
+            for (const table of ['__catalog__', '__stats__']) {
+                const store = await provider.getStore('main', table);
+                tableStores.set(table, store);
+                await store.put(MARKER_KEY, encoder.encode(`table ${table}`));
+            }
+            assert.strictEqual(await readMarker(catalog), 'catalog', 'a table named __catalog__ landed on the reserved catalog store');
+            assert.strictEqual(await readMarker(stats), 'stats', 'a table named __stats__ landed on the reserved stats store');
+            // …and the two user tables are distinct from EACH OTHER, not just from the
+            // reserved pair — a provider that folded both onto one store would otherwise
+            // leave the reserved markers intact and pass.
+            for (const [table, store] of tableStores) {
+                assert.strictEqual(await readMarker(store), `table ${table}`, `the user table "${table}" reads back another store's marker`);
+            }
+        });
+    });
+}
+//# sourceMappingURL=kv-naming-conformance.js.map

package/dist/src/testing/kv-naming-conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kv-naming-conformance.js","sourceRoot":"","sources":["../../../src/testing/kv-naming-conformance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,gBAAgB,CAAC;AAoChD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,4DAA4D;AAC5D,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,eAAe,GAAyB;IAC7C,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;IACjE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IACnE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;IACrE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;IACnE,EAAE,KAAK,EAAE,mCAAmC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;IACxG,EAAE,KAAK,EAAE,qCAAqC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;IAC3G,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE;IACnD,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE;IACnD,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE;IACnD,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACrD,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE;IAC3D,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE;CAC7D,CAAC;AAEF,0EAA0E;AAC1E,SAAS,QAAQ,CAAC,QAAyB,EAAE,IAAe;IAC3D,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS;QAC9B,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC;QAC5C,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,UAAU,CAAC,KAAc;IACvC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,QAAyB,EACzB,SAAmB,EAAE;IAErB,MAAM,MAAM,GAA+C,EAAE,CAAC;IAE9D,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC;YACJ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACZ,4EAA4E;YAC5E,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,CAAC,EAAE,CACR,CAAC,IAAI,CAAC,UAAU,EAChB,GAAG,IAAI,CAAC,KAAK,kFAAkF,MAAM,CAAC,CAAC,CAAC,EAAE,CAC1G,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;IACF,CAAC;IAED,oFAAoF;IACpF,mEAAmE;IACnE,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,EAAE,CAAC;QACtC,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,EAAE,CAAC;QACtC,MAAM,CAAC,WAAW,CACjB,MAAM,UAAU,CAAC,KAAK,CAAC,EACvB,IAAI,CAAC,KAAK,EACV,UAAU,IAAI,CAAC,KAAK,wEAAwE,CAC5F,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,iBAAwC;IAC9F,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE;QACnB,IAAI,OAAwB,CAAC;QAC7B,IAAI,QAAyB,CAAC;QAE9B,UAAU,CAAC,KAAK,IAAI,EAAE;YACrB,OAAO,GAAG,iBAAiB,EAAE,CAAC;YAC9B,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;YAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,MAAM,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,+EAA+E;gBAC/E,oEAAoE;gBACpE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,4DAA4D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxG,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;YAC9F,kFAAkF;YAClF,mFAAmF;YACnF,iFAAiF;YACjF,mEAAmE;YACnE,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvD,MAAM,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvD,WAAW,CACV,MAAM,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,+EAA+E,CAC/E,CAAC;YAEF,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YACxE,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YACxE,WAAW,CACV,MAAM,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAChC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EACvB,2FAA2F,CAC3F,CAAC;YAEF,kFAAkF;YAClF,uDAAuD;YACvD,MAAM,CAAC,WAAW,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,4CAA4C,CAAC,CAAC;QACvG,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;YAC5F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACzD,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,MAAM,CAAC,WAAW,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,0DAA0D,CAAC,CAAC;YAErH,iFAAiF;YACjF,4EAA4E;YAC5E,wEAAwE;YACxE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmB,CAAC;YAC/C,KAAK,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACrD,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,CAAC,WAAW,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,gEAAgE,CAAC,CAAC;YAC3H,MAAM,CAAC,WAAW,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,4DAA4D,CAAC,CAAC;YAEnH,2EAA2E;YAC3E,6EAA6E;YAC7E,8CAA8C;YAC9C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC1C,MAAM,CAAC,WAAW,CACjB,MAAM,UAAU,CAAC,KAAK,CAAC,EACvB,SAAS,KAAK,EAAE,EAChB,mBAAmB,KAAK,qCAAqC,CAC7D,CAAC;YACH,CAAC;QACF,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/testing/kv-reclaim-conformance.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Shared store-reclaim battery — test-support; run under Mocha.
+ *
+ * Fourth sibling of {@link runKVStoreConformance} (the {@link KVStore} contract),
+ * {@link runKVProviderConformance} (the atomic multi-store commit) and
+ * {@link runStoreNameDistinctness} (no two logical stores fold onto one physical store).
+ * This one asserts a single PROVIDER-level property that every backend must hold:
+ *
+ *   After a provider is told to delete a table's stores, re-opening those stores by the
+ *   same names must find them EMPTY — and every other store must be untouched.
+ *
+ * Why it exists as a shared battery rather than a per-plugin test: `deleteTableStores` /
+ * `deleteIndexStore` are how the engine RECLAIMS a dropped table's physical storage
+ * (`StoreModuleBase.tearDownTableStorage` on `drop table`, and the generic rename fallback
+ * after it has copied the rows to the new name). Store handles are re-opened lazily by
+ * name, so a provider that merely closes its handle leaves the bytes in place and the next
+ * table created under that name opens the old table's rows — `drop table t; create table t`
+ * comes back full. Two of the four shipped providers implemented exactly that, and nothing
+ * in the type system stops the next one, so the property is pinned behaviorally here.
+ *
+ * The battery needs nothing beyond the public {@link KVStoreProvider} surface, so it runs
+ * for every backend: it writes a marker into each store, deletes, and re-opens by the same
+ * name. One case seeds {@link BULK_ROW_COUNT} rows instead of a marker, because a provider
+ * with no native "empty this store" has to walk the keyspace in bounded chunks and only a
+ * store bigger than one chunk exercises resuming between passes.
+ *
+ * Both delete hooks are OPTIONAL in {@link KVStoreProvider}; a provider that omits one
+ * is skipped rather than crashed — but the skip is printed, so a provider cannot silently
+ * opt out of the property.
+ *
+ * Dependency and Mocha-global handling mirror kv-conformance.ts — see its header.
+ *
+ * NOTE: "empty" is asserted through the two read paths a caller can use — a point `get` of
+ * the marker key and a full `iterate()` — because a backend could plausibly satisfy one and
+ * not the other (an index-only delete, a tombstone a point read honors but a scan does not).
+ * Nothing here asserts that the physical storage was RELEASED: a provider is free to leave
+ * an empty database directory or unshrunk file behind, which is what the LevelDB-family
+ * providers do. Reclaiming bytes on disk is a per-provider concern; not serving stale rows
+ * is the contract.
+ */
+import type { KVProviderLifecycle } from './kv-lifecycle.js';
+/**
+ * Per-backend lifecycle adapter — the same shape {@link runStoreNameDistinctness} takes, so
+ * a plugin's spec can hand one closure to both batteries.
+ */
+export type KVReclaimBackend = KVProviderLifecycle;
+/**
+ * Register the store-reclaim battery under `describe(name)`. Call once per backend, from
+ * the same spec file that registers {@link runKVStoreConformance}.
+ */
+export declare function runStoreReclaimConformance(name: string, makeReclaimBackend: () => KVReclaimBackend): void;
+//# sourceMappingURL=kv-reclaim-conformance.d.ts.map

package/dist/src/testing/kv-reclaim-conformance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kv-reclaim-conformance.d.ts","sourceRoot":"","sources":["../../../src/testing/kv-reclaim-conformance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAU7D;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AA+InD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,GAAG,IAAI,CA0LzG"}

package/dist/src/testing/kv-reclaim-conformance.js

@@ -0,0 +1,287 @@
+/**
+ * Shared store-reclaim battery — test-support; run under Mocha.
+ *
+ * Fourth sibling of {@link runKVStoreConformance} (the {@link KVStore} contract),
+ * {@link runKVProviderConformance} (the atomic multi-store commit) and
+ * {@link runStoreNameDistinctness} (no two logical stores fold onto one physical store).
+ * This one asserts a single PROVIDER-level property that every backend must hold:
+ *
+ *   After a provider is told to delete a table's stores, re-opening those stores by the
+ *   same names must find them EMPTY — and every other store must be untouched.
+ *
+ * Why it exists as a shared battery rather than a per-plugin test: `deleteTableStores` /
+ * `deleteIndexStore` are how the engine RECLAIMS a dropped table's physical storage
+ * (`StoreModuleBase.tearDownTableStorage` on `drop table`, and the generic rename fallback
+ * after it has copied the rows to the new name). Store handles are re-opened lazily by
+ * name, so a provider that merely closes its handle leaves the bytes in place and the next
+ * table created under that name opens the old table's rows — `drop table t; create table t`
+ * comes back full. Two of the four shipped providers implemented exactly that, and nothing
+ * in the type system stops the next one, so the property is pinned behaviorally here.
+ *
+ * The battery needs nothing beyond the public {@link KVStoreProvider} surface, so it runs
+ * for every backend: it writes a marker into each store, deletes, and re-opens by the same
+ * name. One case seeds {@link BULK_ROW_COUNT} rows instead of a marker, because a provider
+ * with no native "empty this store" has to walk the keyspace in bounded chunks and only a
+ * store bigger than one chunk exercises resuming between passes.
+ *
+ * Both delete hooks are OPTIONAL in {@link KVStoreProvider}; a provider that omits one
+ * is skipped rather than crashed — but the skip is printed, so a provider cannot silently
+ * opt out of the property.
+ *
+ * Dependency and Mocha-global handling mirror kv-conformance.ts — see its header.
+ *
+ * NOTE: "empty" is asserted through the two read paths a caller can use — a point `get` of
+ * the marker key and a full `iterate()` — because a backend could plausibly satisfy one and
+ * not the other (an index-only delete, a tombstone a point read honors but a scan does not).
+ * Nothing here asserts that the physical storage was RELEASED: a provider is free to leave
+ * an empty database directory or unshrunk file behind, which is what the LevelDB-family
+ * providers do. Reclaiming bytes on disk is a per-provider concern; not serving stale rows
+ * is the contract.
+ */
+import assert from 'node:assert/strict';
+import { buildDataStoreName, buildIndexStoreName } from '../common/key-builder.js';
+import { b } from './kv-assert.js';
+/** The schema every store in this battery lives in. */
+const SCHEMA = 'main';
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/** The key each store's marker is written under before a delete. */
+const MARKER_KEY = b(0x01);
+/** A second key, written into a store RE-CREATED after a delete. */
+const REUSE_KEY = b(0x02);
+/**
+ * Rows seeded into one store by the bulk case, chosen to exceed the largest per-pass chunk
+ * any shipped provider erases in (`@quereus/plugin-react-native-leveldb` walks the keyspace
+ * 512 keys at a time), so a chunked erase has to make several passes and resume correctly
+ * between them. A provider that erases natively is unaffected by the size.
+ */
+const BULK_ROW_COUNT = 1100;
+/** The `i`-th bulk key — two bytes, so it can never collide with the 1-byte markers. */
+function bulkKey(i) {
+    return b((i >> 8) & 0xff, i & 0xff);
+}
+/**
+ * Battery+hook pairs already reported as skipped, so one omitted hook prints once rather
+ * than once per test.
+ */
+const reportedSkips = new Set();
+/**
+ * True when `provider` implements `hook`. A provider that omits one is skipped rather than
+ * failed — the hook is genuinely optional — but the skip is printed, because a silent skip
+ * is indistinguishable from a passing provider.
+ */
+function hasHook(name, provider, hook) {
+    if (typeof provider[hook] === 'function')
+        return true;
+    const key = `${name}:${hook}`;
+    if (!reportedSkips.has(key)) {
+        reportedSkips.add(key);
+        console.warn(`${name}: SKIPPED — the provider does not implement ${hook}(), so its reclaim property is unenforced`);
+    }
+    return false;
+}
+/** Call `deleteTableStores`, which the caller has already checked is present. */
+async function deleteTableStores(provider, tableName, indexNames) {
+    const hook = provider.deleteTableStores;
+    assert.ok(hook, 'deleteTableStores must be present here — callers check hasHook first');
+    await hook.call(provider, SCHEMA, tableName, indexNames);
+}
+/** Call `deleteIndexStore`, which the caller has already checked is present. */
+async function deleteIndexStore(provider, tableName, indexName) {
+    const hook = provider.deleteIndexStore;
+    assert.ok(hook, 'deleteIndexStore must be present here — callers check hasHook first');
+    await hook.call(provider, SCHEMA, tableName, indexName);
+}
+/** Lowercase hex of a key, for a legible dump of a store that should have been emptied. */
+function hex(bytes) {
+    let out = '';
+    for (const byte of bytes)
+        out += byte.toString(16).padStart(2, '0');
+    return out;
+}
+/** Every entry in a store as `{key hex}={marker}`, in iteration order. */
+async function dump(store) {
+    const entries = [];
+    for await (const { key, value } of store.iterate()) {
+        entries.push(`${hex(key)}=${decoder.decode(value)}`);
+    }
+    return entries;
+}
+/** How many entries a store yields on a full scan. */
+async function countEntries(store) {
+    let count = 0;
+    for await (const _entry of store.iterate())
+        count++;
+    return count;
+}
+/** Read a store's marker back, or `undefined` when the key is absent. */
+async function readMarker(store) {
+    const value = await store.get(MARKER_KEY);
+    return value === undefined ? undefined : decoder.decode(value);
+}
+/**
+ * Write one table's marker into its data store and into each of its index stores. The
+ * marker is the store's own logical name, so a failure names the store that leaked.
+ */
+async function seedTable(provider, tableName, indexNames = []) {
+    const data = await provider.getStore(SCHEMA, tableName);
+    await data.put(MARKER_KEY, encoder.encode(buildDataStoreName(SCHEMA, tableName)));
+    for (const indexName of indexNames) {
+        const index = await provider.getIndexStore(SCHEMA, tableName, indexName);
+        await index.put(MARKER_KEY, encoder.encode(buildIndexStoreName(SCHEMA, tableName, indexName)));
+    }
+}
+/** Assert a store re-opened after a delete reads back empty through BOTH read paths. */
+async function assertEmpty(store, label) {
+    assert.strictEqual(await readMarker(store), undefined, `${label} still serves its pre-delete row on a point read — the delete did not erase it`);
+    assert.deepStrictEqual(await dump(store), [], `${label} still yields entries on a scan — the delete did not erase it`);
+}
+/** Assert a store the delete must not have touched still holds its own marker. */
+async function assertMarkerIntact(store, expected) {
+    assert.strictEqual(await readMarker(store), expected, `store "${expected}" lost its row to an unrelated delete`);
+}
+/**
+ * Register the store-reclaim battery under `describe(name)`. Call once per backend, from
+ * the same spec file that registers {@link runKVStoreConformance}.
+ */
+export function runStoreReclaimConformance(name, makeReclaimBackend) {
+    describe(name, () => {
+        let backend;
+        let provider;
+        beforeEach(async () => {
+            backend = makeReclaimBackend();
+            provider = await backend.open();
+        });
+        afterEach(async () => {
+            await backend.teardown();
+        });
+        it('erases the data store and every named index store on deleteTableStores', async () => {
+            if (!hasHook(name, provider, 'deleteTableStores'))
+                return;
+            await seedTable(provider, 't', ['x', 'y']);
+            await deleteTableStores(provider, 't', ['x', 'y']);
+            // Re-open by the SAME names — the whole defect is that a lazily re-opened store
+            // serves the deleted table's rows.
+            await assertEmpty(await provider.getStore(SCHEMA, 't'), 'the data store of main.t');
+            await assertEmpty(await provider.getIndexStore(SCHEMA, 't', 'x'), 'index x of main.t');
+            await assertEmpty(await provider.getIndexStore(SCHEMA, 't', 'y'), 'index y of main.t');
+        });
+        it('gives a table re-created under a dropped name a store holding only its OWN rows', async () => {
+            if (!hasHook(name, provider, 'deleteTableStores'))
+                return;
+            await seedTable(provider, 't', ['x']);
+            await deleteTableStores(provider, 't', ['x']);
+            // The user-visible corruption scenario: `drop table t; create table t (...)`
+            // followed by an insert must leave exactly the new row — not the new row on top
+            // of the old table's.
+            const data = await provider.getStore(SCHEMA, 't');
+            await data.put(REUSE_KEY, encoder.encode('new data row'));
+            assert.deepStrictEqual(await dump(data), [`${hex(REUSE_KEY)}=new data row`], 'a table re-created under a dropped name reads back the dropped table\'s rows');
+            const index = await provider.getIndexStore(SCHEMA, 't', 'x');
+            await index.put(REUSE_KEY, encoder.encode('new index row'));
+            assert.deepStrictEqual(await dump(index), [`${hex(REUSE_KEY)}=new index row`], 'an index re-created under a dropped name reads back the dropped index\'s entries');
+        });
+        it('erases a store holding more rows than a provider clears in one pass', async () => {
+            if (!hasHook(name, provider, 'deleteTableStores'))
+                return;
+            // A provider with no native "empty this store" has to walk the keyspace in bounded
+            // chunks, so the whole resume-between-passes path only runs above its chunk size —
+            // a walk that restarts (or stops early) after each pass is invisible below it.
+            const data = await provider.getStore(SCHEMA, 't');
+            const seed = data.batch();
+            for (let i = 0; i < BULK_ROW_COUNT; i++) {
+                seed.put(bulkKey(i), encoder.encode(String(i)));
+            }
+            await seed.write();
+            assert.strictEqual(await countEntries(data), BULK_ROW_COUNT, 'the bulk seed itself did not land');
+            await deleteTableStores(provider, 't', []);
+            assert.strictEqual(await countEntries(await provider.getStore(SCHEMA, 't')), 0, `the data store of main.t still holds rows after a delete of ${BULK_ROW_COUNT} of them — a chunked erase that does not resume past its last key leaves a tail behind`);
+        });
+        it('erases only the named index store on deleteIndexStore', async () => {
+            if (!hasHook(name, provider, 'deleteIndexStore'))
+                return;
+            await seedTable(provider, 't', ['x', 'y']);
+            await deleteIndexStore(provider, 't', 'x');
+            await assertEmpty(await provider.getIndexStore(SCHEMA, 't', 'x'), 'index x of main.t');
+            await assertMarkerIntact(await provider.getStore(SCHEMA, 't'), buildDataStoreName(SCHEMA, 't'));
+            await assertMarkerIntact(await provider.getIndexStore(SCHEMA, 't', 'y'), buildIndexStoreName(SCHEMA, 't', 'y'));
+        });
+        it('erases a store whose handle the caller already closed', async () => {
+            if (!hasHook(name, provider, 'deleteIndexStore'))
+                return;
+            // The order every `drop index` actually takes: `StoreModuleIndex.tearDownIndexStore`
+            // closes the table's cached index handle (`StoreTableBase.releaseIndexStore`) and
+            // THEN asks the provider to delete that store. A provider whose delete reads or
+            // writes through its own cached handle finds it dead at that point, so this is the
+            // path a battery driving only live handles would never exercise.
+            await seedTable(provider, 't', ['x']);
+            const index = await provider.getIndexStore(SCHEMA, 't', 'x');
+            await index.close();
+            await deleteIndexStore(provider, 't', 'x');
+            await assertEmpty(await provider.getIndexStore(SCHEMA, 't', 'x'), 'index x of main.t');
+        });
+        it('leaves sibling tables untouched when a table is deleted', async () => {
+            if (!hasHook(name, provider, 'deleteTableStores'))
+                return;
+            await seedTable(provider, 't', ['x']);
+            await seedTable(provider, 't2');
+            // `_idx_` is a legal substring of an ordinary table name, which is exactly why the
+            // contract forbids reclaiming by a `{table}_idx_` prefix scan: this sibling table's
+            // DATA store is named `main.t_idx_y`, which such a scan would sweep up along with
+            // table t's index stores. (The near-miss `t_idx_x` is deliberately not used — it
+            // composes to the same logical name as index `x` on table `t`, so no provider can
+            // tell the two apart; `StoreModuleBase.assertStoreNameFree` is what keeps that pair
+            // from ever coexisting. Same exclusion as `runStoreNameDistinctness`.)
+            await seedTable(provider, 't_idx_y');
+            await deleteTableStores(provider, 't', ['x']);
+            await assertMarkerIntact(await provider.getStore(SCHEMA, 't2'), buildDataStoreName(SCHEMA, 't2'));
+            await assertMarkerIntact(await provider.getStore(SCHEMA, 't_idx_y'), buildDataStoreName(SCHEMA, 't_idx_y'));
+        });
+        it('leaves an index store the caller did not name untouched', async () => {
+            if (!hasHook(name, provider, 'deleteTableStores'))
+                return;
+            // `indexNames` is the authoritative list, and reclaiming anything outside it means
+            // the provider found the store some other way — a `{table}_idx_` prefix scan being
+            // the way that also destroys a sibling table's data (the case above). Storage for
+            // an index left out of the list leaks; that is the caller's bug to fix, not licence
+            // for the provider to guess.
+            await seedTable(provider, 't', ['x', 'unnamed']);
+            await deleteTableStores(provider, 't', ['x']);
+            await assertEmpty(await provider.getStore(SCHEMA, 't'), 'the data store of main.t');
+            await assertEmpty(await provider.getIndexStore(SCHEMA, 't', 'x'), 'index x of main.t');
+            await assertMarkerIntact(await provider.getIndexStore(SCHEMA, 't', 'unnamed'), buildIndexStoreName(SCHEMA, 't', 'unnamed'));
+        });
+        it('leaves the reserved stats and catalog stores untouched when a table is deleted', async () => {
+            if (!hasHook(name, provider, 'deleteTableStores'))
+                return;
+            const stats = await provider.getStatsStore(SCHEMA, 't');
+            const catalog = await provider.getCatalogStore();
+            await stats.put(MARKER_KEY, encoder.encode('stats'));
+            await catalog.put(MARKER_KEY, encoder.encode('catalog'));
+            await seedTable(provider, 't', ['x']);
+            await deleteTableStores(provider, 't', ['x']);
+            // Re-fetched through the provider rather than reusing the handles above: a provider
+            // that dropped the reserved store's physical storage while holding a live handle
+            // could otherwise still answer from it. (A provider is free to hand back the same
+            // cached handle — that is a pass, since nothing was deleted.)
+            await assertMarkerIntact(await provider.getStatsStore(SCHEMA, 't'), 'stats');
+            await assertMarkerIntact(await provider.getCatalogStore(), 'catalog');
+        });
+        it('treats deleting stores that were never created as a no-op', async () => {
+            // The engine calls these speculatively on its reclaim paths — dropping a table
+            // whose storage a previous drop already removed must succeed, not throw
+            // (`StoreModuleBase.reclaimDetachedTable` documents the idempotence it relies on).
+            if (hasHook(name, provider, 'deleteTableStores')) {
+                await deleteTableStores(provider, 'never-created', []);
+                await deleteTableStores(provider, 'never-created', ['nor-this-index']);
+            }
+            if (hasHook(name, provider, 'deleteIndexStore')) {
+                await seedTable(provider, 't');
+                // An index name the table never had — the store behind it does not exist.
+                await deleteIndexStore(provider, 't', 'never-created');
+                await assertMarkerIntact(await provider.getStore(SCHEMA, 't'), buildDataStoreName(SCHEMA, 't'));
+            }
+        });
+    });
+}
+//# sourceMappingURL=kv-reclaim-conformance.js.map