Datomic's storage-specific implementation of the shared v8 snapshot
adapter. Authorization graph algorithms remain outside this namespace.

Datomic-backed EACL authorization views.

Public reads, writes, consistency, caching, pagination, and lifecycle are
implemented once by `eacl.client.orchestration`. This namespace contributes
only Datomic's basis adapter, basis source, writer primitives, schema
operations, explicit speculative application, and Datomic-specific utilities.

Datomic-only entity, schema-definition, and ordered adjacency operations.

EACL: Enterprise Access Control. Spice-compatible authorization system in Datomic.

EACL: Enterprise Access Control. Spice-compatible authorization system in Datomic.

Compatibility façade over Datomic storage primitives and the shared v8
authorization engine. No authorization traversal is implemented here.

Explicit, offline integrity diagnostics.

Nothing in this namespace runs on EACL's authorization hot path. Callers
choose when to pay for a database scan or a schema-version read.

Certified inline native tuple-ref publication for non-serving staging.

Optional target-only Datomic transaction function for cache-coherent native
entity retraction and EACL relationship peer cleanup.

One-time migration from EACL v6 relationship storage to the v7 tuple model.

v6 stored one Datomic entity per relationship (7 datoms across
:eacl.relationship/* attributes). v7 stores each relationship as two
cardinality-many tuple datoms asserted directly on your domain entities:

  [:db/add <subject-eid>  :eacl.v7.relationship/subject-type+relation+resource-type+resource
   [<subject-type> <relation-eid> <resource-type> <resource-eid>]]
  [:db/add <resource-eid> :eacl.v7.relationship/resource-type+relation+subject-type+subject
   [<resource-type> <relation-eid> <subject-type> <subject-eid>]]

where <relation-eid> refers to the Relation schema entity, not the relation
name keyword.

Entry points:
- `migrate!` runs the whole migration end-to-end (see its docstring for the
  exact steps). It is idempotent and converges storage forward: verified v7
  tuples replace the v6 relationship entities in the same run.
- `assert-storage-compatible!` is a read-only legacy-source diagnostic.
  Ordinary clients require the subsequent storage 7-to-8 migration.


Flat v6 permissions are converted once to canonical expression entities.
Pass your SpiceDB schema string as {:schema ...} to validate and replace the
stored schema from source. Without it, migrate! deterministically converts
the stored union-only rows. `normalize-schema-entity-ids!` first gives
legacy schema entities the canonical :eacl/id handles the replacement needs.

Full walkthrough and edge cases:
docs/migration-v6-to-v7.md.

Permission-only released-v7 to v8 upgrade.

Relationship storage upgrades are a separate maintenance step. This
namespace never enumerates or rewrites them; only bounded schema-definition
rows are read and one atomic permission replacement is submitted.