life-as-api 0.2.0

package/dist/evidence/in-memory-raw-document-store.js

@@ -0,0 +1,84 @@
+// InMemoryRawDocumentStore — Slice-09.
+//
+// RAW_DOCUMENT_BYTES_ENCRYPTED_AT_REST_001: stores EncryptedBlob, not plaintext bytes.
+// RAW_DOCUMENT_IMMUTABLE_001: no update/delete path exists.
+// RAW_DOCUMENT_ACCESS_BOUND_001: putDocument/getDocument restricted to EvidenceWriter.
+// RAW_DOCUMENT_AGENT_NO_DIRECT_READ_001: runtime guard on putDocument + getDocument.
+import { asEvidenceId, asISOTime } from "../types/ids.js";
+function isEvidenceWriter(ctx) {
+    return ctx.kind === "owner" || ctx.kind === "system_projection" || ctx.kind === "test";
+}
+export class InMemoryRawDocumentStore {
+    _crypto;
+    _entries = new Map();
+    constructor(_crypto) {
+        this._crypto = _crypto;
+    }
+    async putDocument(ctx, input) {
+        if (!isEvidenceWriter(ctx)) {
+            throw new Error("RAW_DOCUMENT_ACCESS_BOUND_001: only Owner/System/Test may write raw documents");
+        }
+        const id = asEvidenceId(`ev_${globalThis.crypto.randomUUID()}`);
+        const encryptedBlob = await this._crypto.encryptBytes(input.bytes);
+        const createdAt = asISOTime(new Date().toISOString());
+        const ref = Object.freeze({
+            id,
+            uri: `evidence://${id}`,
+            mimeType: input.mimeType,
+            byteLength: input.bytes.byteLength,
+            encrypted: true,
+            createdAt,
+            ...(input.label !== undefined ? { label: input.label } : {}),
+        });
+        this._entries.set(id, {
+            ref,
+            encryptedBlob,
+            createdBy: ctx,
+            ...(input.metadata !== undefined ? { metadata: Object.freeze({ ...input.metadata }) } : {}),
+        });
+        return ref;
+    }
+    // ── Unit-of-Work snapshot support (UNIT_OF_WORK_IN_MEMORY_ATOMIC_BEHAVIOR_001) ──
+    _uowSnapshot() {
+        return new Map(this._entries);
+    }
+    _uowRestore(snap) {
+        this._entries.clear();
+        for (const [k, v] of snap)
+            this._entries.set(k, v);
+    }
+    async getDocument(ctx, evidenceId) {
+        if (!isEvidenceWriter(ctx)) {
+            throw new Error("RAW_DOCUMENT_AGENT_NO_DIRECT_READ_001: AgentConsentContext and AuditContext cannot read raw document bytes");
+        }
+        const entry = this._entries.get(evidenceId);
+        if (entry === undefined)
+            return undefined;
+        // Decrypt on every call — plaintext never cached in memory (RAW_DOCUMENT_BYTES_ENCRYPTED_AT_REST_001).
+        const plainBytes = await this._crypto.decryptBytes(entry.encryptedBlob);
+        return Object.freeze({
+            id: entry.ref.id,
+            mimeType: entry.ref.mimeType,
+            byteLength: entry.ref.byteLength,
+            createdAt: entry.ref.createdAt,
+            createdBy: entry.createdBy,
+            plainBytes: new Uint8Array(plainBytes), // defensive copy
+            ...(entry.ref.label !== undefined ? { label: entry.ref.label } : {}),
+            ...(entry.metadata !== undefined ? { metadata: entry.metadata } : {}),
+        });
+    }
+    getEvidenceRef(ctx, evidenceId) {
+        if (ctx == null)
+            throw new TypeError("AccessContext is required");
+        return this._entries.get(evidenceId)?.ref;
+    }
+    listEvidenceRefs(ctx, filter) {
+        if (ctx == null)
+            throw new TypeError("AccessContext is required");
+        let refs = Array.from(this._entries.values()).map((e) => e.ref);
+        if (filter?.mimeType !== undefined)
+            refs = refs.filter((r) => r.mimeType === filter.mimeType);
+        return refs;
+    }
+}
+//# sourceMappingURL=in-memory-raw-document-store.js.map

package/dist/evidence/in-memory-raw-document-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-raw-document-store.js","sourceRoot":"","sources":["../../src/evidence/in-memory-raw-document-store.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,uFAAuF;AACvF,4DAA4D;AAC5D,uFAAuF;AACvF,qFAAqF;AAOrF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE1D,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,OAAO,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC;AACzF,CAAC;AAED,MAAM,OAAO,wBAAwB;IAQN;IAPZ,QAAQ,GAAG,IAAI,GAAG,EAK/B,CAAC;IAEL,YAA6B,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAExD,KAAK,CAAC,WAAW,CAAC,GAAmB,EAAE,KAAuB;QAC5D,IAAI,CAAC,gBAAgB,CAAC,GAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,EAAE,GAAc,YAAY,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,SAAS,GAAO,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAgB,MAAM,CAAC,MAAM,CAAC;YACrC,EAAE;YACF,GAAG,EAAS,cAAc,EAAE,EAAE;YAC9B,QAAQ,EAAI,KAAK,CAAC,QAAQ;YAC1B,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YAClC,SAAS,EAAG,IAAI;YAChB,SAAS;YACT,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE;YACpB,GAAG;YACH,aAAa;YACb,SAAS,EAAE,GAAG;YACd,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mFAAmF;IACnF,YAAY;QACV,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,WAAW,CAAC,IAAkJ;QAC5J,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAmB,EAAE,UAAsB;QAC3D,IAAI,CAAC,gBAAgB,CAAC,GAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAC;QAChI,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAE1C,uGAAuG;QACvG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAExE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,EAAE,EAAU,KAAK,CAAC,GAAG,CAAC,EAAE;YACxB,QAAQ,EAAI,KAAK,CAAC,GAAG,CAAC,QAAQ;YAC9B,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU;YAChC,SAAS,EAAG,KAAK,CAAC,GAAG,CAAC,SAAS;YAC/B,SAAS,EAAG,KAAK,CAAC,SAAS;YAC3B,UAAU,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,EAAG,iBAAiB;YAC1D,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAM,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAgB,CAAC;IACpB,CAAC;IAED,cAAc,CAAC,GAAkB,EAAE,UAAsB;QACvD,IAAI,GAAG,IAAI,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC;IAC5C,CAAC;IAED,gBAAgB,CAAC,GAAkB,EAAE,MAAuB;QAC1D,IAAI,GAAG,IAAI,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAClE,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,MAAM,EAAE,QAAQ,KAAK,SAAS;YAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/evidence/raw-document-store.d.ts

@@ -0,0 +1,12 @@
+import type { EvidenceId } from "../types/ids.js";
+import type { AccessContext } from "../types/access-context.js";
+import type { EvidenceFilter, EvidenceRef, EvidenceWriter, RawDocument, RawDocumentInput } from "../types/evidence.js";
+export interface RawDocumentStore {
+    putDocument(ctx: EvidenceWriter, input: RawDocumentInput): Promise<EvidenceRef>;
+    getDocument(ctx: EvidenceWriter, evidenceId: EvidenceId): Promise<RawDocument | undefined>;
+    getEvidenceRef(ctx: AccessContext, evidenceId: EvidenceId): EvidenceRef | undefined;
+    listEvidenceRefs(ctx: AccessContext, filter?: EvidenceFilter): EvidenceRef[];
+}
+export interface FactoryCompatibleRawDocumentStore extends RawDocumentStore {
+    readonly factoryCompatible: "durable-raw-document-store";
+}

package/dist/evidence/raw-document-store.js

@@ -0,0 +1,8 @@
+// RawDocumentStore interface — Slice-09.
+//
+// RAW_DOCUMENT_STORE_EXISTS_001: a single typed home for encrypted raw documents.
+// RAW_DOCUMENT_ACCESS_BOUND_001: putDocument/getDocument require an EvidenceWriter.
+// RAW_DOCUMENT_AGENT_NO_DIRECT_READ_001: getDocument is type- and runtime-bound to EvidenceWriter.
+// getEvidenceRef/listEvidenceRefs expose metadata-only refs to any AccessContext.
+export {};
+//# sourceMappingURL=raw-document-store.js.map

package/dist/evidence/raw-document-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"raw-document-store.js","sourceRoot":"","sources":["../../src/evidence/raw-document-store.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,kFAAkF;AAClF,oFAAoF;AACpF,mGAAmG;AACnG,kFAAkF"}

package/dist/evidence/source-evidence-validator.d.ts

@@ -0,0 +1,4 @@
+import type { AccessContext } from "../types/access-context.js";
+import type { SourceInput } from "../types/source.js";
+import type { RawDocumentStore } from "./raw-document-store.js";
+export declare function validateSourceEvidenceRef(sourceInput: SourceInput, store: RawDocumentStore, ctx: AccessContext): void;

package/dist/evidence/source-evidence-validator.js

@@ -0,0 +1,14 @@
+// source-evidence-validator — Slice-09.
+//
+// RAW_DOCUMENT_SOURCE_LINK_001: validateSourceEvidenceRef ensures evidenceRef.id resolves.
+// RAW_DOCUMENT_EVIDENCE_REF_EXISTS_001: unresolved evidence ids are rejected.
+export function validateSourceEvidenceRef(sourceInput, store, ctx) {
+    const evidenceId = sourceInput.evidenceRef?.id;
+    if (evidenceId === undefined)
+        return;
+    const ref = store.getEvidenceRef(ctx, evidenceId);
+    if (ref === undefined) {
+        throw new Error(`RAW_DOCUMENT_EVIDENCE_REF_EXISTS_001: evidenceId "${evidenceId}" is not registered in RawDocumentStore`);
+    }
+}
+//# sourceMappingURL=source-evidence-validator.js.map

package/dist/evidence/source-evidence-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-evidence-validator.js","sourceRoot":"","sources":["../../src/evidence/source-evidence-validator.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,2FAA2F;AAC3F,8EAA8E;AAO9E,MAAM,UAAU,yBAAyB,CACvC,WAAwB,EACxB,KAA6B,EAC7B,GAA0B;IAE1B,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,EAAE,EAA4B,CAAC;IACzE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,qDAAqD,UAAU,yCAAyC,CACzG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/evidence/sqlite-raw-document-store.d.ts

@@ -0,0 +1,19 @@
+import Database from "better-sqlite3";
+import type { EvidenceId } from "../types/ids.js";
+import type { AccessContext } from "../types/access-context.js";
+import type { CryptoBoundary } from "../crypto/types.js";
+import type { EvidenceFilter, EvidenceRef, EvidenceWriter, RawDocument, RawDocumentInput } from "../types/evidence.js";
+import type { FactoryCompatibleRawDocumentStore } from "./raw-document-store.js";
+export declare class SQLiteRawDocumentStore implements FactoryCompatibleRawDocumentStore {
+    private readonly _crypto;
+    readonly factoryCompatible: "durable-raw-document-store";
+    private readonly _db;
+    private readonly _ownsConnection;
+    constructor(dbPathOrDb: string | Database.Database, _crypto: CryptoBoundary);
+    close(): void;
+    putDocument(ctx: EvidenceWriter, input: RawDocumentInput): Promise<EvidenceRef>;
+    getDocument(ctx: EvidenceWriter, evidenceId: EvidenceId): Promise<RawDocument | undefined>;
+    getEvidenceRef(ctx: AccessContext, evidenceId: EvidenceId): EvidenceRef | undefined;
+    listEvidenceRefs(ctx: AccessContext, filter?: EvidenceFilter): EvidenceRef[];
+    getRawEncryptedBlob(evidenceId: EvidenceId): string | undefined;
+}

package/dist/evidence/sqlite-raw-document-store.js

@@ -0,0 +1,122 @@
+// SQLiteRawDocumentStore — Slice-09 durable encrypted document store.
+//
+// RAW_DOCUMENT_BYTES_ENCRYPTED_AT_REST_001: encrypted_blob column stores JSON EncryptedBlob only.
+// RAW_DOCUMENT_IMMUTABLE_001: INSERT only — no UPDATE/DELETE anywhere in this file.
+// RAW_DOCUMENT_ACCESS_BOUND_001 / RAW_DOCUMENT_AGENT_NO_DIRECT_READ_001: writer guard on put/get.
+// RAW_DOCUMENT_SQLITE_REOPEN_ROUND_TRIP_001: documents survive a close + reopen cycle.
+// RAW_DOCUMENT_METADATA_PLAINTEXT_ACCEPTED_001: metadata columns are plaintext.
+//
+// CRYPTO_BOUNDARY_ONLY_001: all encryption delegated to the injected CryptoBoundary —
+// this module imports no crypto primitives and uses no WebCrypto APIs directly.
+import Database from "better-sqlite3";
+import { asEvidenceId, asISOTime } from "../types/ids.js";
+import { initializeSchema } from "../persistence/sqlite/schema.js";
+function isEvidenceWriter(ctx) {
+    return ctx.kind === "owner" || ctx.kind === "system_projection" || ctx.kind === "test";
+}
+function rowToEvidenceRef(row) {
+    const id = asEvidenceId(row.id);
+    return Object.freeze({
+        id,
+        uri: `evidence://${id}`,
+        mimeType: row.mime_type,
+        byteLength: row.byte_length,
+        encrypted: true,
+        createdAt: asISOTime(row.created_at),
+        ...(row.label != null ? { label: row.label } : {}),
+    });
+}
+export class SQLiteRawDocumentStore {
+    _crypto;
+    // RAW_DOCUMENT_STORE_FACTORY_COMPATIBLE_REQUIRED_001 / RAW_DOCUMENT_STORE_DURABLE_REQUIRED_001
+    factoryCompatible = "durable-raw-document-store";
+    _db;
+    _ownsConnection;
+    // Accepts a file path (opens own connection) or a shared Database instance
+    // (e.g., for SQLiteUnitOfWork transactions — UNIT_OF_WORK_SQLITE_TRANSACTION_001).
+    constructor(dbPathOrDb, _crypto) {
+        this._crypto = _crypto;
+        if (typeof dbPathOrDb === "string") {
+            this._db = new Database(dbPathOrDb);
+            this._ownsConnection = true;
+            initializeSchema(this._db);
+        }
+        else {
+            this._db = dbPathOrDb;
+            this._ownsConnection = false;
+        }
+    }
+    close() {
+        if (this._ownsConnection)
+            this._db.close();
+    }
+    async putDocument(ctx, input) {
+        if (!isEvidenceWriter(ctx)) {
+            throw new Error("RAW_DOCUMENT_ACCESS_BOUND_001: only Owner/System/Test may write raw documents");
+        }
+        const id = asEvidenceId(`ev_${globalThis.crypto.randomUUID()}`);
+        const encryptedBlob = await this._crypto.encryptBytes(input.bytes);
+        const createdAt = asISOTime(new Date().toISOString());
+        // RAW_DOCUMENT_IMMUTABLE_001: INSERT only.
+        this._db.prepare(`
+      INSERT INTO raw_documents (id, mime_type, byte_length, label, created_at, created_by, encrypted_blob, metadata)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(id, input.mimeType, input.bytes.byteLength, input.label ?? null, createdAt, JSON.stringify(ctx), JSON.stringify(encryptedBlob), input.metadata != null ? JSON.stringify(input.metadata) : null);
+        return rowToEvidenceRef({
+            id,
+            mime_type: input.mimeType,
+            byte_length: input.bytes.byteLength,
+            label: input.label ?? null,
+            created_at: createdAt,
+        });
+    }
+    async getDocument(ctx, evidenceId) {
+        if (!isEvidenceWriter(ctx)) {
+            throw new Error("RAW_DOCUMENT_AGENT_NO_DIRECT_READ_001: AgentConsentContext and AuditContext cannot read raw document bytes");
+        }
+        const row = this._db.prepare("SELECT * FROM raw_documents WHERE id = ?").get(evidenceId);
+        if (row === undefined)
+            return undefined;
+        const blob = JSON.parse(row.encrypted_blob);
+        const plainBytes = await this._crypto.decryptBytes(blob);
+        const createdBy = JSON.parse(row.created_by);
+        return Object.freeze({
+            id: asEvidenceId(row.id),
+            mimeType: row.mime_type,
+            byteLength: row.byte_length,
+            createdAt: asISOTime(row.created_at),
+            createdBy: Object.freeze(createdBy),
+            plainBytes: new Uint8Array(plainBytes), // defensive copy
+            ...(row.label != null ? { label: row.label } : {}),
+            ...(row.metadata != null ? { metadata: Object.freeze(JSON.parse(row.metadata)) } : {}),
+        });
+    }
+    getEvidenceRef(ctx, evidenceId) {
+        if (ctx == null)
+            throw new TypeError("AccessContext is required");
+        const row = this._db
+            .prepare("SELECT id, mime_type, byte_length, label, created_at FROM raw_documents WHERE id = ?")
+            .get(evidenceId);
+        return row !== undefined ? rowToEvidenceRef(row) : undefined;
+    }
+    listEvidenceRefs(ctx, filter) {
+        if (ctx == null)
+            throw new TypeError("AccessContext is required");
+        let sql = "SELECT id, mime_type, byte_length, label, created_at FROM raw_documents";
+        const params = [];
+        if (filter?.mimeType !== undefined) {
+            sql += " WHERE mime_type = ?";
+            params.push(filter.mimeType);
+        }
+        const rows = this._db.prepare(sql).all(...params);
+        return rows.map(rowToEvidenceRef);
+    }
+    // Return the raw encrypted_blob column for a given document (for at-rest verification).
+    getRawEncryptedBlob(evidenceId) {
+        const row = this._db
+            .prepare("SELECT encrypted_blob FROM raw_documents WHERE id = ?")
+            .get(evidenceId);
+        return row?.encrypted_blob;
+    }
+}
+//# sourceMappingURL=sqlite-raw-document-store.js.map

package/dist/evidence/sqlite-raw-document-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-raw-document-store.js","sourceRoot":"","sources":["../../src/evidence/sqlite-raw-document-store.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,kGAAkG;AAClG,oFAAoF;AACpF,kGAAkG;AAClG,uFAAuF;AACvF,gFAAgF;AAChF,EAAE;AACF,sFAAsF;AACtF,gFAAgF;AAEhF,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAMtC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAanE,SAAS,gBAAgB,CAAC,GAAkB;IAC1C,OAAO,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC;AACzF,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAsF;IAC9G,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE;QACF,GAAG,EAAS,cAAc,EAAE,EAAE;QAC9B,QAAQ,EAAI,GAAG,CAAC,SAAS;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,SAAS,EAAG,IAAa;QACzB,SAAS,EAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,sBAAsB;IAUd;IATnB,+FAA+F;IACtF,iBAAiB,GAAG,4BAAqC,CAAC;IAClD,GAAG,CAAoB;IACvB,eAAe,CAAU;IAE1C,2EAA2E;IAC3E,mFAAmF;IACnF,YACE,UAAsC,EACrB,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;QAExC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC;YACtB,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,eAAe;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAmB,EAAE,KAAuB;QAC5D,IAAI,CAAC,gBAAgB,CAAC,GAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,EAAE,GAAc,YAAY,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,SAAS,GAAO,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAE1D,2CAA2C;QAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;;;KAGhB,CAAC,CAAC,GAAG,CACJ,EAAE,EACF,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,KAAK,CAAC,UAAU,EACtB,KAAK,CAAC,KAAK,IAAI,IAAI,EACnB,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EACnB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAC7B,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAC/D,CAAC;QAEF,OAAO,gBAAgB,CAAC;YACtB,EAAE;YACF,SAAS,EAAI,KAAK,CAAC,QAAQ;YAC3B,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YACnC,KAAK,EAAQ,KAAK,CAAC,KAAK,IAAI,IAAI;YAChC,UAAU,EAAG,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAmB,EAAE,UAAsB;QAC3D,IAAI,CAAC,gBAAgB,CAAC,GAAoB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAC;QAChI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,UAAU,CAA+B,CAAC;QACvH,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAExC,MAAM,IAAI,GAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAkB,CAAC;QACnE,MAAM,UAAU,GAAI,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAmB,CAAC;QAEjE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,EAAE,EAAU,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,QAAQ,EAAI,GAAG,CAAC,SAAS;YACzB,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,SAAS,EAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;YACrC,SAAS,EAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACpC,UAAU,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,EAAG,iBAAiB;YAC1D,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAA4B,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClH,CAAgB,CAAC;IACpB,CAAC;IAED,cAAc,CAAC,GAAkB,EAAE,UAAsB;QACvD,IAAI,GAAG,IAAI,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CAAC,sFAAsF,CAAC;aAC/F,GAAG,CAAC,UAAU,CAAkG,CAAC;QACpH,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;IAED,gBAAgB,CAAC,GAAkB,EAAE,MAAuB;QAC1D,IAAI,GAAG,IAAI,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAClE,IAAI,GAAG,GAAG,yEAAyE,CAAC;QACpF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,GAAG,IAAI,sBAAsB,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAA6F,CAAC;QAC9I,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAED,wFAAwF;IACxF,mBAAmB,CAAC,UAAsB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CAAC,uDAAuD,CAAC;aAChE,GAAG,CAAC,UAAU,CAA2C,CAAC;QAC7D,OAAO,GAAG,EAAE,cAAc,CAAC;IAC7B,CAAC;CACF"}

package/dist/guardian/guardian-registry.d.ts

@@ -0,0 +1,96 @@
+import type { PersonId } from "../types/ids.js";
+/** A single guardian ↔ ward relationship record. */
+export interface GuardianRelationship {
+    /** Principal-ID of the guardian — matches VerifiedPrincipal.principalId. */
+    readonly guardianId: string;
+    /** PersonId of the ward (the person being assisted). */
+    readonly wardId: string;
+    /**
+     * Scopes this guardian is authorised to act on.
+     * Vocabulary (host-defined):
+     *   "context:mint"    — prerequisite for mintGuardianContext
+     *   "proposal:accept" — acceptProposal + rejectProposal on behalf of ward
+     *   "proposal:create" — createProposal on behalf of ward
+     *   "grant:create"    — host-side grant store operations (declared; not enforced here)
+     *   "consent:decide"  — reserved for future Consent facade
+     * Read operations are implied by a successfully minted guardian context.
+     * Erasure (requestErasure / getErasureStatus) is NEVER delegable regardless of scopes.
+     */
+    readonly guardianScopes: ReadonlyArray<string>;
+    /** Timestamp when the relationship was established (epoch ms). */
+    readonly establishedAt: number;
+    /** Optional expiry (epoch ms). Absent = unlimited duration. */
+    readonly validUntil?: number;
+    /** Who established the relationship. */
+    readonly establishedBy: "ward" | "legal-authority";
+    /** Free-text note, e.g. Betreuungsnummer from a court order. */
+    readonly notes?: string;
+}
+/**
+ * Trust gate for guardian-context minting and scope enforcement.
+ * GUARDIAN_REGISTRY_FAIL_CLOSED_001: configured → checked before every guardian action.
+ * Implementations must be fail-closed: any exception → treated as unauthorised.
+ */
+export interface GuardianRegistry {
+    /**
+     * Returns the stored relationship or undefined.
+     * NOTE: this is a raw lookup — it does NOT enforce expiry.
+     *   Use isAuthorized for all authorisation decisions.
+     * Returns the record even if expired (transparency / audit purposes).
+     */
+    getRelationship(guardianId: string, wardId: string): Promise<GuardianRelationship | undefined>;
+    /**
+     * Returns true iff guardianId has an active, unexpired relationship for wardId
+     * that includes the given scope.
+     * GUARDIAN_REGISTRY_FAIL_CLOSED_001: any exception → false.
+     * GUARDIAN_REGISTRY_EXPIRY_ENFORCED_001: validUntil <= now() → false.
+     * GUARDIAN_REGISTRY_SCOPE_EXACT_MATCH_001: exact match only.
+     */
+    isAuthorized(guardianId: string, wardId: string, scope: string): Promise<boolean>;
+    /**
+     * Returns all stored relationships for the ward, including expired ones.
+     * Callers must not use this for authorisation decisions — use isAuthorized.
+     * The full list (including expired) is returned for transparency and audit.
+     */
+    listGuardiansFor(wardId: string): Promise<ReadonlyArray<GuardianRelationship>>;
+}
+/** Development / test implementation of GuardianRegistry. */
+export declare class InMemoryGuardianRegistry implements GuardianRegistry {
+    private readonly _entries;
+    private readonly _now;
+    constructor(opts?: {
+        readonly now?: () => number;
+    });
+    private static _key;
+    /**
+     * Register or replace a relationship.
+     * Re-registering the same guardianId + wardId pair overwrites the previous entry.
+     */
+    register(rel: GuardianRelationship): this;
+    /**
+     * Revoke a relationship (ward's right to withdraw).
+     * Returns true if the relationship existed and was removed, false if unknown.
+     * GUARDIAN_REVOCATION_NEXT_MINT_ENFORCED_001: after revocation, the next
+     *   mintGuardianContext call will be denied. Short-lived existing contexts
+     *   are NOT retroactively revoked — this limitation is documented.
+     */
+    revoke(guardianId: string, wardId: string): boolean;
+    /**
+     * Raw lookup — returns stored record regardless of expiry.
+     * GUARDIAN_REGISTRY_FAIL_CLOSED_001: use isAuthorized for all authorisation.
+     */
+    getRelationship(guardianId: string, wardId: string): Promise<GuardianRelationship | undefined>;
+    /**
+     * GUARDIAN_REGISTRY_FAIL_CLOSED_001: unknown pair → false, exception → false.
+     * GUARDIAN_REGISTRY_EXPIRY_ENFORCED_001: validUntil defined and <= now() → false.
+     * GUARDIAN_REGISTRY_SCOPE_EXACT_MATCH_001: exact match in guardianScopes.
+     * Never throws — caller treats exceptions as untrusted anyway.
+     */
+    isAuthorized(guardianId: string, wardId: string, scope: string): Promise<boolean>;
+    /**
+     * Returns all stored relationships for a ward (including expired).
+     * For transparency; not for authorisation decisions.
+     */
+    listGuardiansFor(wardId: string): Promise<ReadonlyArray<GuardianRelationship>>;
+}
+export type { PersonId };

package/dist/guardian/guardian-registry.js

@@ -0,0 +1,95 @@
+// Platform-03 — Guardian Registry.
+//
+// GUARDIAN_REGISTRY_FAIL_CLOSED_001: isAuthorized returns false for any unknown
+//   pair, expired relationship, missing scope, or exception — never fail-open.
+// GUARDIAN_REGISTRY_EXPIRY_ENFORCED_001: validUntil epoch-ms <= now() → denied.
+//   Absence of validUntil = unlimited authorization.
+// GUARDIAN_REGISTRY_SCOPE_EXACT_MATCH_001: scope must appear exactly in
+//   guardianScopes; prefix or substring matches are not accepted.
+// GUARDIAN_REGISTRY_INTERFACE_GUARDIAN_MODULE_ONLY_001: GuardianRegistry interface
+//   is defined exclusively in src/guardian/; auth/ and sdk/ import type-only;
+//   no implementation is imported by production src code other than the re-export
+//   in src/index.ts.
+// ─── InMemoryGuardianRegistry ─────────────────────────────────────────────────
+/** Development / test implementation of GuardianRegistry. */
+export class InMemoryGuardianRegistry {
+    // Composite key: `${guardianId}::${wardId}`
+    _entries = new Map();
+    _now;
+    constructor(opts) {
+        this._now = opts?.now ?? (() => Date.now());
+    }
+    static _key(guardianId, wardId) {
+        return `${guardianId}::${wardId}`;
+    }
+    /**
+     * Register or replace a relationship.
+     * Re-registering the same guardianId + wardId pair overwrites the previous entry.
+     */
+    register(rel) {
+        this._entries.set(InMemoryGuardianRegistry._key(rel.guardianId, rel.wardId), rel);
+        return this;
+    }
+    /**
+     * Revoke a relationship (ward's right to withdraw).
+     * Returns true if the relationship existed and was removed, false if unknown.
+     * GUARDIAN_REVOCATION_NEXT_MINT_ENFORCED_001: after revocation, the next
+     *   mintGuardianContext call will be denied. Short-lived existing contexts
+     *   are NOT retroactively revoked — this limitation is documented.
+     */
+    revoke(guardianId, wardId) {
+        const key = InMemoryGuardianRegistry._key(guardianId, wardId);
+        if (!this._entries.has(key))
+            return false;
+        this._entries.delete(key);
+        return true;
+    }
+    /**
+     * Raw lookup — returns stored record regardless of expiry.
+     * GUARDIAN_REGISTRY_FAIL_CLOSED_001: use isAuthorized for all authorisation.
+     */
+    async getRelationship(guardianId, wardId) {
+        return this._entries.get(InMemoryGuardianRegistry._key(guardianId, wardId));
+    }
+    /**
+     * GUARDIAN_REGISTRY_FAIL_CLOSED_001: unknown pair → false, exception → false.
+     * GUARDIAN_REGISTRY_EXPIRY_ENFORCED_001: validUntil defined and <= now() → false.
+     * GUARDIAN_REGISTRY_SCOPE_EXACT_MATCH_001: exact match in guardianScopes.
+     * Never throws — caller treats exceptions as untrusted anyway.
+     */
+    async isAuthorized(guardianId, wardId, scope) {
+        try {
+            const rel = this._entries.get(InMemoryGuardianRegistry._key(guardianId, wardId));
+            if (rel === undefined)
+                return false;
+            // Expiry check — epoch-ms comparison (GUARDIAN_REGISTRY_EXPIRY_ENFORCED_001).
+            if (rel.validUntil !== undefined) {
+                const nowMs = this._now();
+                // validUntil <= now → expired
+                if (rel.validUntil <= nowMs)
+                    return false;
+            }
+            // Exact scope match (GUARDIAN_REGISTRY_SCOPE_EXACT_MATCH_001).
+            if (!rel.guardianScopes.includes(scope))
+                return false;
+            return true;
+        }
+        catch {
+            // GUARDIAN_REGISTRY_FAIL_CLOSED_001: any exception → false.
+            return false;
+        }
+    }
+    /**
+     * Returns all stored relationships for a ward (including expired).
+     * For transparency; not for authorisation decisions.
+     */
+    async listGuardiansFor(wardId) {
+        const result = [];
+        for (const rel of this._entries.values()) {
+            if (rel.wardId === wardId)
+                result.push(rel);
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=guardian-registry.js.map

package/dist/guardian/guardian-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardian-registry.js","sourceRoot":"","sources":["../../src/guardian/guardian-registry.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,qDAAqD;AACrD,wEAAwE;AACxE,kEAAkE;AAClE,mFAAmF;AACnF,8EAA8E;AAC9E,kFAAkF;AAClF,qBAAqB;AAmErB,iFAAiF;AAEjF,6DAA6D;AAC7D,MAAM,OAAO,wBAAwB;IACnC,4CAA4C;IAC3B,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACnD,IAAI,CAAe;IAEpC,YAAY,IAAsC;QAChD,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAEO,MAAM,CAAC,IAAI,CAAC,UAAkB,EAAE,MAAc;QACpD,OAAO,GAAG,UAAU,KAAK,MAAM,EAAE,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,GAAyB;QAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,UAAkB,EAAE,MAAc;QACvC,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,MAAc;QACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,MAAc,EAAE,KAAa;QAClE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YACjF,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAEpC,8EAA8E;YAC9E,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC1B,8BAA8B;gBAC9B,IAAI,GAAG,CAAC,UAAU,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC5C,CAAC;YAED,+DAA+D;YAC/D,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAEtD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,44 @@
+export type { LifeApi, SdkAdminContext } from "./sdk/life-api.js";
+export type { LifeApiTestBundle } from "./sdk/create-life-api.js";
+export { createInMemoryLifeApiForTest } from "./sdk/create-life-api.js";
+export type { AccessContextIssuer } from "./auth/access-context-issuer.js";
+export type { AccessContext, AgentConsentContext, OwnerContext, SystemProjectionContext, TestContext, } from "./types/access-context.js";
+export type { ConsentGrant, AgentIdentity, Capability } from "./types/consent.js";
+export type { PersonId, ClaimId, ContractId, GrantId, SourceId, EvidenceId, ProposalId, AuditId, ISOTime, } from "./types/ids.js";
+export { asPersonId, asClaimId, asContractId, asGrantId, asSourceId, asEvidenceId, asProposalId, asISOTime, } from "./types/ids.js";
+export type { EvidenceRef, EvidenceFilter } from "./types/evidence.js";
+export type { Source, SourceInput, SourceFilter, SourceKind, SourceStatus } from "./types/source.js";
+export type { Proposal, ProposalInput, ProposalFilter, ProposalStatus, ProposalAuthor, AcceptOptions, RejectOptions, ProposalDecider, } from "./types/proposal.js";
+export type { QueryContractsInput, ContextQueryResult, HydratedContractProjection, HydratedContractFieldProjection, HydratedContractFields, } from "./surface/evidence-backed-context-query.js";
+export type { EvidenceClaimCreator, CreateClaimWithNewEvidenceInput, CreateClaimFromExistingEvidenceInput, EvidenceBackedClaimResult, EvidenceBackedClaimWithNewEvidenceResult, } from "./evidence/evidence-backed-claim-creator.js";
+export type { PrincipalType, VerifiedPrincipal, AuthAdapter, AuthorizationDecision, AuthorizationPolicy, TenantBoundary, GrantDescriptor, GrantResolver, Clock, MintedContext, MintOptions, ContextMintingBoundary, } from "./auth/types.js";
+export type { ProductionFactoryConfig } from "./sdk/create-sqlite-life-api.js";
+export { createSQLiteLifeApiForProduction } from "./sdk/create-sqlite-life-api.js";
+export type { ProductionApiBundle, ProductionScopedLifeApi, ListProposalsInput, } from "./auth/production-scoped-life-api.js";
+export { assertAuthorizedForSubject } from "./auth/assert-authorized-for-subject.js";
+export { SubjectScopedLifeApi, createSubjectScopedLifeApi } from "./auth/subject-scoped-life-api.js";
+export { inspectProposalScope } from "./auth/proposal-scope-inspector.js";
+export { ProposalScopedLifeApi, createProposalScopedLifeApi } from "./auth/proposal-scoped-life-api.js";
+export type { Logger, LogEvent, LogLevel } from "./observability/logger.js";
+export { noopLogger } from "./observability/logger.js";
+export type { HealthStatus, HealthCheckItem, HealthCheckResult } from "./observability/health.js";
+export type { MetricsRecorder, MetricName, MetricLabels } from "./observability/metrics.js";
+export { noopMetricsRecorder } from "./observability/metrics.js";
+export type { KeyProvider, KeyDescriptor } from "./crypto/types.js";
+export type { TrustedAgentRegistry, TrustedAgentRegistryEntry } from "./agent/trusted-agent-registry.js";
+export { InMemoryTrustedAgentRegistry } from "./agent/trusted-agent-registry.js";
+export type { TrustedDataSourceRegistry, TrustedDataSourceEntry } from "./datasource/trusted-data-source-registry.js";
+export { InMemoryTrustedDataSourceRegistry } from "./datasource/trusted-data-source-registry.js";
+export type { ProposalPolicy, ProposalPolicyInput, ProposalDisposition } from "./proposal/proposal-policy.js";
+export { DefaultProposalPolicy, RegistryBackedProposalPolicy } from "./proposal/proposal-policy.js";
+export type { GuardianRegistry, GuardianRelationship } from "./guardian/guardian-registry.js";
+export { InMemoryGuardianRegistry } from "./guardian/guardian-registry.js";
+export type { GuardianContextMintingBoundary } from "./auth/types.js";
+export type { SubjectDataReport, GrantSummary, ProposalSummary, AuditEventSummary, SubjectDataReportOptions, } from "./compliance/subject-data-report.js";
+export { generateSubjectDataReport } from "./compliance/subject-data-report.js";
+export { MedicalAgent, medicalAgentRegistryEntry, MEDICAL_AGENT_ID, MEDICAL_AGENT_VERSION, ALLOWED_MEDICAL_PURPOSES } from "./agent/medical-agent.js";
+export type { MedicalPurpose } from "./agent/medical-agent.js";
+export { FinanceAgent, financeAgentRegistryEntry, FINANCE_AGENT_ID, FINANCE_AGENT_VERSION, ALLOWED_FINANCE_PURPOSES } from "./agent/finance-agent.js";
+export type { FinancePurpose } from "./agent/finance-agent.js";
+export { LegalAgent, legalAgentRegistryEntry, LEGAL_AGENT_ID, LEGAL_AGENT_VERSION, ALLOWED_LEGAL_PURPOSES } from "./agent/legal-agent.js";
+export type { LegalPurpose } from "./agent/legal-agent.js";

package/dist/index.js

@@ -0,0 +1,72 @@
+// Life as API — Public SDK surface.
+//
+// SDK_EXPORTS_ONLY_SAFE_SURFACE_001: only LifeApi, the factory, and required
+//   input/output types are exported. Internal implementations are NOT exported.
+// SDK_DOES_NOT_EXPORT_RAW_FACTSTORE_001: concrete FactStore implementations are not exported.
+// SDK_DOES_NOT_EXPORT_RAW_CRYPTO_001: crypto primitive implementations are not exported.
+//   Blocked: AesGcmCryptoBoundary, StaticKeyProvider, ClaimSerializer, EncryptedBlob,
+//   CryptoBoundary. Interface types (KeyProvider, KeyDescriptor) ARE exported — see below.
+// SDK_DOES_NOT_EXPORT_RAW_DOCUMENT_BYTES_001: concrete document store and getDocument() absent.
+// SDK_DOES_NOT_EXPORT_SOURCE_MUTATION_DIRECTLY_001: registries are not exported directly.
+// SDK_NO_INTERNAL_PATH_IMPORTS_001: callers import only from this file, not from src/ internals.
+// SDK_TYPECHECK_PUBLIC_API_001: types exported here are the source of truth for all callers.
+export { createInMemoryLifeApiForTest } from "./sdk/create-life-api.js";
+export { asPersonId, asClaimId, asContractId, asGrantId, asSourceId, asEvidenceId, asProposalId, asISOTime, } from "./types/ids.js";
+export { createSQLiteLifeApiForProduction } from "./sdk/create-sqlite-life-api.js";
+// ─── Auth boundary helpers (Production-01b) ──────────────────────────────────
+//
+// AUTH_CONTEXT_SUBJECT_SCOPE_HELPER_001: assertAuthorizedForSubject() is a
+//   host-adapter helper that enforces subject scope when authorizedPersonId is
+//   present on a MintedContext. It does NOT provide full LifeApi callsite
+//   enforcement (AUTH_CONTEXT_SUBJECT_SCOPE_ENFORCED_001 is deferred).
+// AUTH_TEST_ISSUER_NOT_PRODUCTION_001: TestContextMintingBoundary and
+//   DefaultAuthorizationPolicy are NOT exported — test/dev only.
+export { assertAuthorizedForSubject } from "./auth/assert-authorized-for-subject.js";
+// ─── SubjectScopedLifeApi facade (Production-01c) ────────────────────────────
+//
+// AUTH_CONTEXT_SUBJECT_SCOPE_ENFORCED_001: enforced for SubjectScopedLifeApi
+//   facade surface. Excluded methods remain deferred to Production-01d.
+// SubjectScopedLifeApi does NOT implement LifeApi — it is a narrower surface.
+// Host adapters use SubjectScopedLifeApi to bind MintedContext to a LifeApi
+// instance; excluded methods must be called on LifeApi directly.
+export { SubjectScopedLifeApi, createSubjectScopedLifeApi } from "./auth/subject-scoped-life-api.js";
+// ─── Proposal scope (Production-01d-a) ───────────────────────────────────────
+//
+// AUTH_PROPOSAL_ACCEPT_SCOPE_CHECKED_001: inspectProposalScope fires before
+//   every acceptProposal delegation. ProposalId-only is not subject-free proof.
+// AUTH_PROPOSAL_CANDIDATE_CLAIMS_SCOPED_001: every candidateClaim has a required
+//   subject: PersonId — candidateClaims are always subject-scoped.
+// ProposalScopedLifeApi does NOT implement LifeApi — narrower, scope-checked surface.
+// Production-01d-a: acceptProposal only. get/list/reject/create remain deferred.
+export { inspectProposalScope } from "./auth/proposal-scope-inspector.js";
+export { ProposalScopedLifeApi, createProposalScopedLifeApi } from "./auth/proposal-scoped-life-api.js";
+export { noopLogger } from "./observability/logger.js";
+export { noopMetricsRecorder } from "./observability/metrics.js";
+export { InMemoryTrustedAgentRegistry } from "./agent/trusted-agent-registry.js";
+export { InMemoryTrustedDataSourceRegistry } from "./datasource/trusted-data-source-registry.js";
+export { DefaultProposalPolicy, RegistryBackedProposalPolicy } from "./proposal/proposal-policy.js";
+export { InMemoryGuardianRegistry } from "./guardian/guardian-registry.js";
+export { generateSubjectDataReport } from "./compliance/subject-data-report.js";
+// ─── Platform-05 — Certified First-Party Agents ──────────────────────────────
+//
+// PURPOSE_TAG_VOCABULARY_EXTENDED_PLATFORM05_001: PurposeTag gained 11 additive values
+//   for certified first-party agents (diagnosis, treatment, emergency, tax, credit_check,
+//   insurance_claim, account_overview, notary, contract_review, evidence_preservation,
+//   court_filing). Union-widening only — fully backward-compatible.
+// MEDICAL_AGENT_PURPOSE_BOUND_001 / FINANCE_AGENT_PURPOSE_BOUND_001 / LEGAL_AGENT_PURPOSE_BOUND_001:
+//   each agent acts only when MintedContext.declaredPurpose is within its own allowed set.
+// MEDICAL_AGENT_REGISTRY_ENTRY_001 / FINANCE_AGENT_REGISTRY_ENTRY_001 / LEGAL_AGENT_REGISTRY_ENTRY_001:
+//   the *AgentRegistryEntry() factories build a TrustedAgentRegistryEntry certifiedBy
+//   "life-as-api-foundation" for direct registration with a TrustedAgentRegistry (Platform-01).
+// MEDICAL_AGENT_SCOPE_ENFORCED_001 / FINANCE_AGENT_SCOPE_ENFORCED_001 / LEGAL_AGENT_SCOPE_ENFORCED_001:
+//   run() throws a *_SCOPE_DENIED_001 coded error, fail-closed, for any purpose outside the
+//   agent's allowed set — including an absent declaredPurpose.
+// MEDICAL_AGENT_READ_ONLY_001 / FINANCE_AGENT_READ_ONLY_001 / LEGAL_AGENT_READ_ONLY_001:
+//   each agent's constructor accepts only a query function — no propose/write capability.
+// MEDICAL_AGENT_AUDIT_TRAIL_001 / FINANCE_AGENT_AUDIT_TRAIL_001 / LEGAL_AGENT_AUDIT_TRAIL_001:
+//   the optional onAudit hook fires on every run() call; real audit persistence is a host
+//   responsibility.
+export { MedicalAgent, medicalAgentRegistryEntry, MEDICAL_AGENT_ID, MEDICAL_AGENT_VERSION, ALLOWED_MEDICAL_PURPOSES } from "./agent/medical-agent.js";
+export { FinanceAgent, financeAgentRegistryEntry, FINANCE_AGENT_ID, FINANCE_AGENT_VERSION, ALLOWED_FINANCE_PURPOSES } from "./agent/finance-agent.js";
+export { LegalAgent, legalAgentRegistryEntry, LEGAL_AGENT_ID, LEGAL_AGENT_VERSION, ALLOWED_LEGAL_PURPOSES } from "./agent/legal-agent.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,8FAA8F;AAC9F,yFAAyF;AACzF,sFAAsF;AACtF,2FAA2F;AAC3F,gGAAgG;AAChG,0FAA0F;AAC1F,iGAAiG;AACjG,6FAA6F;AAM7F,OAAO,EAAE,4BAA4B,EAAE,MAA0B,0BAA0B,CAAC;AA8C5F,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,SAAS,EACT,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,SAAS,GACV,MAAM,gBAAgB,CAAC;AAuExB,OAAO,EAAE,gCAAgC,EAAE,MAAe,iCAAiC,CAAC;AAgB5F,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,0EAA0E;AAC1E,uEAAuE;AACvE,sEAAsE;AACtE,iEAAiE;AAEjE,OAAO,EAAE,0BAA0B,EAAE,MAAqB,yCAAyC,CAAC;AAEpG,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,8EAA8E;AAC9E,4EAA4E;AAC5E,iEAAiE;AAEjE,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAErG,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,iFAAiF;AACjF,mEAAmE;AACnE,sFAAsF;AACtF,iFAAiF;AAEjF,OAAO,EAAE,oBAAoB,EAAE,MAAwC,oCAAoC,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAU,oCAAoC,CAAC;AAW5G,OAAO,EAAE,UAAU,EAAE,MAAkD,2BAA2B,CAAC;AAqBnG,OAAO,EAAE,mBAAmB,EAAE,MAAyC,4BAA4B,CAAC;AA4BpG,OAAO,EAAE,4BAA4B,EAAE,MAA+B,mCAAmC,CAAC;AAwB1G,OAAO,EAAE,iCAAiC,EAAE,MAA4B,8CAA8C,CAAC;AAGvH,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAgB,+BAA+B,CAAC;AAiB9G,OAAO,EAAE,wBAAwB,EAAE,MAA0B,iCAAiC,CAAC;AA4B/F,OAAO,EAAE,yBAAyB,EAAE,MAAyB,qCAAqC,CAAC;AAEnG,gFAAgF;AAChF,EAAE;AACF,uFAAuF;AACvF,0FAA0F;AAC1F,uFAAuF;AACvF,oEAAoE;AACpE,qGAAqG;AACrG,2FAA2F;AAC3F,wGAAwG;AACxG,sFAAsF;AACtF,gGAAgG;AAChG,wGAAwG;AACxG,4FAA4F;AAC5F,+DAA+D;AAC/D,yFAAyF;AACzF,0FAA0F;AAC1F,+FAA+F;AAC/F,0FAA0F;AAC1F,oBAAoB;AAEpB,OAAO,EAAE,YAAY,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAGtJ,OAAO,EAAE,YAAY,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAGtJ,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAgB,wBAAwB,CAAC"}

package/dist/observability/health.d.ts

@@ -0,0 +1,12 @@
+export type HealthStatus = "ok" | "degraded" | "failed";
+export interface HealthCheckItem {
+    readonly name: string;
+    readonly status: HealthStatus;
+    readonly code: string;
+    readonly errorName?: string;
+}
+export interface HealthCheckResult {
+    readonly status: HealthStatus;
+    readonly checkedAt: string;
+    readonly checks: readonly HealthCheckItem[];
+}