life-as-api 0.2.0

package/dist/observability/health.js

@@ -0,0 +1,16 @@
+// D2b Observability — HealthCheck types.
+//
+// PRODUCTION_OBSERVABILITY_HEALTHCHECK_SURFACE_SPECIFIED_001
+// PRODUCTION_OBSERVABILITY_HEALTHCHECK_NO_DATA_EXPOSURE_001
+// PRODUCTION_OBSERVABILITY_HEALTHCHECK_ITEM_NAMES_STABLE_001
+//
+// HealthStatus semantics:
+//   "ok"       — all critical local checks passed.
+//   "degraded" — at least one non-critical check degraded (reserved for future checks).
+//   "failed"   — at least one critical local check failed.
+//
+// "ok" does NOT mean operational production readiness, backup readiness,
+// GDPR/legal readiness, or external IdP/KMS readiness.
+// PRODUCTION_OBSERVABILITY_HEALTHCHECK_NOT_OPERATIONAL_READINESS_CLAIM_001
+export {};
+//# sourceMappingURL=health.js.map

package/dist/observability/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/observability/health.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,6DAA6D;AAC7D,4DAA4D;AAC5D,6DAA6D;AAC7D,EAAE;AACF,0BAA0B;AAC1B,mDAAmD;AACnD,wFAAwF;AACxF,2DAA2D;AAC3D,EAAE;AACF,yEAAyE;AACzE,uDAAuD;AACvD,2EAA2E"}

package/dist/observability/logger.d.ts

@@ -0,0 +1,21 @@
+export type LogLevel = "debug" | "info" | "warn" | "error";
+export interface LogEvent {
+    readonly level: LogLevel;
+    readonly code: string;
+    readonly component: string;
+    readonly operation: string;
+    readonly message: string;
+    readonly timestamp: string;
+    readonly errorName?: string;
+    readonly reasonCode?: string;
+    readonly contextKind?: string;
+    readonly correlationId?: string;
+}
+export interface Logger {
+    debug?(event: LogEvent): void | Promise<void>;
+    info?(event: LogEvent): void | Promise<void>;
+    warn?(event: LogEvent): void | Promise<void>;
+    error?(event: LogEvent): void | Promise<void>;
+}
+export declare const noopLogger: Logger;
+export declare function safeLog(logger: Logger | undefined, event: LogEvent): void;

package/dist/observability/logger.js

@@ -0,0 +1,40 @@
+// D2a — Logger and Operator Diagnostics.
+//
+// PRODUCTION_OBSERVABILITY_LOGGER_INTERFACE_SPECIFIED_001: Logger has four optional level methods.
+// PRODUCTION_OBSERVABILITY_NOOP_LOGGER_DEFAULT_001: noopLogger is frozen with no methods.
+// PRODUCTION_OBSERVABILITY_NO_CONSOLE_DEFAULT_001: no console output emitted by default.
+// PRODUCTION_OBSERVABILITY_LOGGER_FAILURE_NON_INTERFERING_001: safeLog swallows all logger failures.
+// PRODUCTION_OBSERVABILITY_LOGGER_NOT_AUDIT_SOURCE_001: Logger is not tamper-evident and must not
+//   be used as compliance evidence or to prove authorization decisions.
+// PRODUCTION_OBSERVABILITY_HEALTHCHECK_DEFERRED_001: healthCheck is not part of this module (D2b).
+// PRODUCTION_OBSERVABILITY_METRICS_DEFERRED_001: metrics are not part of this module (D2c).
+//
+// Sensitive data policy: LogEvent fields must not contain rawBytes, JWTs, tokens, personId,
+// subjectId, candidateClaims, decrypted payloads, raw documents, Error.message, or Error.stack.
+// See docs/specs/post-mvp-observability-d2a-logger-spec.md §8 for the full policy.
+// noopLogger: library default. No methods — no console output — frozen.
+// PRODUCTION_OBSERVABILITY_NOOP_LOGGER_DEFAULT_001
+// PRODUCTION_OBSERVABILITY_NO_CONSOLE_DEFAULT_001
+export const noopLogger = Object.freeze({});
+// safeLog: emit a sanitized LogEvent to the logger at the matching level.
+// If the logger is absent, the matching method does not exist, the method throws synchronously,
+// or the returned Promise rejects — all failures are swallowed.
+// Never throws. Never masks the caller's error. Never affects transaction outcome.
+// PRODUCTION_OBSERVABILITY_LOGGER_FAILURE_NON_INTERFERING_001
+export function safeLog(logger, event) {
+    if (logger === undefined)
+        return;
+    const method = logger[event.level];
+    if (typeof method !== "function")
+        return;
+    try {
+        const result = method.call(logger, event);
+        if (result instanceof Promise) {
+            result.catch(() => { });
+        }
+    }
+    catch {
+        /* sync logger failure swallowed */
+    }
+}
+//# sourceMappingURL=logger.js.map

package/dist/observability/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/observability/logger.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,mGAAmG;AACnG,0FAA0F;AAC1F,yFAAyF;AACzF,qGAAqG;AACrG,kGAAkG;AAClG,wEAAwE;AACxE,mGAAmG;AACnG,4FAA4F;AAC5F,EAAE;AACF,4FAA4F;AAC5F,gGAAgG;AAChG,mFAAmF;AA6BnF,wEAAwE;AACxE,mDAAmD;AACnD,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAAW,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEpD,0EAA0E;AAC1E,gGAAgG;AAChG,gEAAgE;AAChE,mFAAmF;AACnF,8DAA8D;AAC9D,MAAM,UAAU,OAAO,CACrB,MAA0B,EAC1B,KAAe;IAEf,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAI,MAAgD,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrF,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAwC,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;AACH,CAAC"}

package/dist/observability/metrics.d.ts

@@ -0,0 +1,15 @@
+export type MetricName = "factory.create.failure" | "audit.write.failure" | "allow_path.rollback" | "health_check.outcome" | "proposal.mutation.outcome";
+export interface MetricLabels {
+    readonly component?: string;
+    readonly operation?: string;
+    readonly status?: "ok" | "failed" | "degraded" | "success" | "denied";
+    readonly errorCode?: string;
+    readonly checkName?: string;
+    readonly contextKind?: string;
+}
+export interface MetricsRecorder {
+    increment?(name: MetricName, value?: number, labels?: MetricLabels): void | Promise<void>;
+    observe?(name: MetricName, value: number, labels?: MetricLabels): void | Promise<void>;
+}
+export declare const noopMetricsRecorder: MetricsRecorder;
+export declare function safeRecord(metrics: MetricsRecorder | undefined, name: MetricName, value: number, labels?: MetricLabels): void;

package/dist/observability/metrics.js

@@ -0,0 +1,52 @@
+// D2c — Metrics Boundary.
+//
+// PRODUCTION_METRICS_BOUNDARY_SPECIFIED_001: D2c defines the metrics boundary.
+//   MetricsRecorder is the push-style adapter contract; noopMetricsRecorder is
+//   the library default. No external sink, HTTP endpoint, or OpenTelemetry added.
+// PRODUCTION_METRICS_NO_EXTERNAL_SINK_001: no external sink in this library.
+// PRODUCTION_METRICS_NO_HIGH_CARDINALITY_LABELS_001: labels use only the closed
+//   low-cardinality set — component, operation, status, errorCode, checkName, contextKind.
+// PRODUCTION_METRICS_NO_PERSONAL_DATA_LABELS_001: labels never contain personId,
+//   subjectId, proposalId, claimId, documentId, agentId, keyId, rawBytes,
+//   Error.message, Error.stack, SQL, file paths, or decrypted payload content.
+// PRODUCTION_METRICS_FAILURE_NON_INTERFERING_001: safeRecord swallows all recorder
+//   failures. A failing recorder never masks a business error, changes a transaction,
+//   or alters HealthCheckResult.
+// PRODUCTION_METRICS_NOT_AUDIT_SOURCE_001: metrics are not tamper-evident. Must not
+//   be used as compliance evidence or to prove authorization decisions.
+// PRODUCTION_METRICS_NOT_OPERATIONAL_READINESS_CLAIM_001: metric counts do not imply
+//   operational production readiness, SLA/SLO, or GDPR/legal readiness.
+// PRODUCTION_METRICS_NO_PRODUCT_API_SURFACE_001: no metrics method on
+//   ProductionScopedLifeApi. MetricsRecorder is a factory config input only.
+// PRODUCTION_METRICS_NAMES_STABLE_001: MetricName is a closed union. Five stable names.
+// PRODUCTION_METRICS_NOOP_DEFAULT_001: noopMetricsRecorder is the library default.
+//
+// See docs/specs/post-mvp-observability-d2c-metrics-spec.md for full policy.
+// noopMetricsRecorder: library default. Frozen. No external call. No output.
+// PRODUCTION_METRICS_NOOP_DEFAULT_001
+export const noopMetricsRecorder = Object.freeze({
+    increment() { },
+    observe() { },
+});
+// safeRecord: emit a counter increment to the recorder.
+// PRODUCTION_METRICS_FAILURE_NON_INTERFERING_001: swallows all recorder failures
+//   (sync throw and async reject). Never throws. Never masks the caller's error.
+//   Never affects transaction outcome. Not exported from src/index.ts.
+export function safeRecord(metrics, name, value, labels) {
+    if (metrics === undefined)
+        return;
+    const method = metrics.increment;
+    if (typeof method !== "function")
+        return;
+    try {
+        const result = method
+            .call(metrics, name, value, labels);
+        if (result instanceof Promise) {
+            result.catch(() => { });
+        }
+    }
+    catch {
+        /* sync recorder failure swallowed */
+    }
+}
+//# sourceMappingURL=metrics.js.map

package/dist/observability/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/observability/metrics.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,kFAAkF;AAClF,6EAA6E;AAC7E,gFAAgF;AAChF,2FAA2F;AAC3F,iFAAiF;AACjF,0EAA0E;AAC1E,+EAA+E;AAC/E,mFAAmF;AACnF,sFAAsF;AACtF,iCAAiC;AACjC,oFAAoF;AACpF,wEAAwE;AACxE,qFAAqF;AACrF,wEAAwE;AACxE,sEAAsE;AACtE,6EAA6E;AAC7E,wFAAwF;AACxF,mFAAmF;AACnF,EAAE;AACF,6EAA6E;AAkC7E,6EAA6E;AAC7E,sCAAsC;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAoB,MAAM,CAAC,MAAM,CAAC;IAChE,SAAS,KAAI,CAAC;IACd,OAAO,KAAM,CAAC;CACf,CAAC,CAAC;AAEH,wDAAwD;AACxD,iFAAiF;AACjF,iFAAiF;AACjF,uEAAuE;AACvE,MAAM,UAAU,UAAU,CACxB,OAAoC,EACpC,IAAmB,EACnB,KAAe,EACf,MAAqB;IAErB,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IACjC,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAI,MAAgF;aAC7F,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAA0C,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;AACH,CAAC"}

package/dist/persistence/backup.d.ts

@@ -0,0 +1,24 @@
+import Database from "better-sqlite3";
+type SemanticCheckCode = "RESTORE_SEMANTIC_ORPHANED_CLAIM_SOURCES_001" | "RESTORE_SEMANTIC_ORPHANED_EVIDENCE_REFS_001" | "RESTORE_SEMANTIC_ORPHANED_PROPOSAL_GRANTS_001" | "RESTORE_SEMANTIC_AUDIT_SEQUENCE_DUPLICATE_001";
+export interface SemanticValidationResult {
+    readonly status: "ok" | "failed";
+    readonly checkedAt: string;
+    readonly checkCount?: number;
+    readonly failedChecks?: readonly SemanticCheckCode[];
+    readonly errorName?: string;
+}
+export interface BackupResult {
+    readonly status: "ok" | "failed";
+    readonly createdAt: string;
+    readonly errorName?: string;
+}
+export interface ValidationResult {
+    readonly status: "ok" | "failed";
+    readonly checkedAt: string;
+    readonly schemaVersion?: number;
+    readonly errorName?: string;
+}
+export declare function backupSQLiteDatabase(db: Database.Database, destinationPath: string): Promise<BackupResult>;
+export declare function validateBackup(sourcePath: string): Promise<ValidationResult>;
+export declare function validateRestoreSemantics(sourcePath: string): Promise<SemanticValidationResult>;
+export {};

package/dist/persistence/backup.js

@@ -0,0 +1,251 @@
+// D3a — SQLite Backup and Restore Validation boundary.
+//
+// PRODUCTION_BACKUP_BOUNDARY_SPECIFIED_001: all 8 schema tables are included
+//   in a backup via the SQLite backup API (db.backup). The backup is a
+//   consistent, self-contained SQLite file — no .wal/.shm files required.
+// PRODUCTION_BACKUP_SQLITE_CONSISTENCY_STRATEGY_SPECIFIED_001: uses
+//   db.backup(dest) — online-safe, WAL-consistent, SAVEPOINT-safe. Never
+//   copies .db/.wal/.shm files manually; never uses VACUUM INTO.
+// PRODUCTION_BACKUP_NO_DECRYPTED_PAYLOAD_EXPORT_001: backup copies encrypted
+//   ciphertext columns only. No encrypted payload is decrypted, read, logged,
+//   or returned. No key provider is required.
+// PRODUCTION_BACKUP_NO_KEY_MATERIAL_CLAIM_001: backup does not include or
+//   manage external key material. AES-256 keys reside in StaticKeyProvider
+//   process memory only — never in the DB. Restore requires the original key
+//   provider to read encrypted payloads.
+// PRODUCTION_BACKUP_POST_BACKUP_VERIFICATION_REQUIRED_001: after db.backup()
+//   resolves, verifyCurrentSchema is run on the destination file. BackupResult
+//   reflects both steps.
+// PRODUCTION_BACKUP_NEVER_THROWS_001: backupSQLiteDatabase never throws.
+//   Failures are expressed as BackupResult { status: "failed" }.
+// PRODUCTION_RESTORE_VALIDATION_SPECIFIED_001: validateBackup opens the backup
+//   read-only, runs verifyCurrentSchema, and confirms migration_version equals
+//   CURRENT_SCHEMA_VERSION.
+// PRODUCTION_RESTORE_NO_ACTIVE_DB_OVERWRITE_001: validateBackup opens a
+//   separate read-only connection. It does not overwrite or modify any
+//   currently-open production database.
+// PRODUCTION_BACKUP_NOT_OPERATIONAL_READINESS_CLAIM_001: a successful backup
+//   does not constitute operational production readiness, SLA, or disaster
+//   recovery guarantee.
+// PRODUCTION_BACKUP_NOT_GDPR_LEGAL_CLAIM_001: backup/restore does not
+//   constitute GDPR-valid erasure or legal compliance. Restoring from backup
+//   before an erasure event reconstitutes erased data — this is a known
+//   limitation.
+//
+// Semantic Restore Validation (Rank 3):
+// RESTORE_SEMANTIC_VALIDATION_OFFLINE_ONLY_001: validateRestoreSemantics opens
+//   backup read-only; makes no writes; emits no audit events.
+// RESTORE_SEMANTIC_VALIDATION_SANITIZED_001: result carries only status,
+//   checkedAt, checkCount, failedChecks (error codes), and errorName. No entity
+//   IDs, no row counts, no DB path, no Error.message or Error.stack in result.
+// RESTORE_SEMANTIC_VALIDATION_NEVER_THROWS_001: validateRestoreSemantics never
+//   throws. All failures expressed as { status: "failed", ... }.
+// RESTORE_SEMANTIC_VALIDATION_NOT_OPERATIONAL_READINESS_001: { status: "ok" }
+//   does NOT constitute DR readiness, SLA, or legal erasure compliance.
+// RESTORE_SEMANTIC_VALIDATION_NOT_PRODUCT_API_001: not on ProductionApiBundle,
+//   ProductionScopedLifeApi, or root-exported from src/index.ts.
+import Database from "better-sqlite3";
+import { verifyCurrentSchema, CURRENT_SCHEMA_VERSION, } from "./sqlite/migrations.js";
+// ─── backupSQLiteDatabase ──────────────────────────────────────────────────────
+// Copies the database using the SQLite backup API (sqlite3_backup_*).
+// Online-safe: runs while other connections write; WAL-consistent; SAVEPOINT-safe.
+// After the backup resolves, verifyCurrentSchema is run on the destination file.
+// Returns { status: "failed" } on any failure — never throws.
+// Does not write audit events. Does not require key material. Does not read or
+// return any encrypted payload column content.
+export async function backupSQLiteDatabase(db, destinationPath) {
+    const createdAt = new Date().toISOString();
+    // Step 1: SQLite backup API — online-safe, WAL-consistent.
+    try {
+        await db.backup(destinationPath);
+    }
+    catch (err) {
+        return {
+            status: "failed",
+            createdAt,
+            ...(err instanceof Error ? { errorName: err.name } : {}),
+        };
+    }
+    // Step 2: Post-backup structural verification on destination (read-only).
+    let verifyDb;
+    try {
+        verifyDb = new Database(destinationPath, { readonly: true, fileMustExist: true });
+        const structResult = verifyCurrentSchema(verifyDb);
+        if (!structResult.ok) {
+            return { status: "failed", createdAt, errorName: "BackupVerificationError" };
+        }
+        return { status: "ok", createdAt };
+    }
+    catch (err) {
+        return {
+            status: "failed",
+            createdAt,
+            ...(err instanceof Error ? { errorName: err.name } : {}),
+        };
+    }
+    finally {
+        try {
+            verifyDb?.close();
+        }
+        catch { /* ignore close errors */ }
+    }
+}
+// ─── validateBackup ────────────────────────────────────────────────────────────
+// Opens the backup file read-only and verifies:
+//   1. All required tables, columns, and indexes exist (verifyCurrentSchema)
+//   2. migration_version === CURRENT_SCHEMA_VERSION
+// Returns { status: "ok", schemaVersion } on success.
+// Returns { status: "failed", errorName } on failure — never throws.
+// Does not decrypt payloads. Does not require key material. Does not write to
+// any table. Closes the read-only connection before returning.
+export async function validateBackup(sourcePath) {
+    const checkedAt = new Date().toISOString();
+    let db;
+    try {
+        db = new Database(sourcePath, { readonly: true, fileMustExist: true });
+        // Structural check — tables, columns, indexes.
+        const structResult = verifyCurrentSchema(db);
+        if (!structResult.ok) {
+            return { status: "failed", checkedAt, errorName: "SchemaVerificationError" };
+        }
+        // Migration version check.
+        const row = db
+            .prepare("SELECT value FROM schema_meta WHERE key = 'migration_version'")
+            .get();
+        const version = row !== undefined ? parseInt(row.value, 10) : NaN;
+        if (!Number.isFinite(version) || version !== CURRENT_SCHEMA_VERSION) {
+            return {
+                status: "failed",
+                checkedAt,
+                errorName: "SchemaMigrationVersionError",
+                ...(Number.isFinite(version) ? { schemaVersion: version } : {}),
+            };
+        }
+        return { status: "ok", checkedAt, schemaVersion: version };
+    }
+    catch (err) {
+        return {
+            status: "failed",
+            checkedAt,
+            ...(err instanceof Error ? { errorName: err.name } : {}),
+        };
+    }
+    finally {
+        try {
+            db?.close();
+        }
+        catch { /* ignore close errors */ }
+    }
+}
+// ─── validateRestoreSemantics ─────────────────────────────────────────────────
+// Opens the backup file (or any migrated SQLite file) read-only and runs four
+// application-layer referential integrity checks that structural and cryptographic
+// validation cannot detect:
+//
+//   1. Orphaned claim→source references
+//      (claims.source_id NOT IN sources.id)
+//   2. Orphaned source evidence references
+//      (sources.evidence_id references a raw_documents.id that does not exist)
+//   3. Orphaned proposal→grant references
+//      (proposals.under_grant NOT IN auth_grants.grant_id)
+//   4. Duplicate audit event sequence numbers
+//      (audit_events.sequence uniqueness violated post-restore)
+//
+// Returns { status: "ok" } when all four checks pass.
+// Returns { status: "failed", failedChecks: [...] } listing which checks failed
+//   (error codes only — no entity IDs, no row counts, no hash values).
+// Returns { status: "failed", errorName } on DB open or schema setup failure.
+//
+// Never throws (RESTORE_SEMANTIC_VALIDATION_NEVER_THROWS_001).
+// Opens a separate read-only connection — does not modify any open DB
+//   (RESTORE_SEMANTIC_VALIDATION_OFFLINE_ONLY_001).
+// { status: "ok" } is NOT a DR/SLA/GDPR claim
+//   (RESTORE_SEMANTIC_VALIDATION_NOT_OPERATIONAL_READINESS_001).
+export async function validateRestoreSemantics(sourcePath) {
+    const checkedAt = new Date().toISOString();
+    let db;
+    try {
+        db = new Database(sourcePath, { readonly: true, fileMustExist: true });
+        // Structural guard — fail fast if schema is invalid or wrong version.
+        // Reuses the same verifyCurrentSchema guard as validateBackup.
+        const structResult = verifyCurrentSchema(db);
+        if (!structResult.ok) {
+            return { status: "failed", checkedAt, errorName: "SchemaVerificationError" };
+        }
+        const failed = [];
+        // ── Check 1: Orphaned claim→source references ──────────────────────────
+        // RESTORE_SEMANTIC_ORPHANED_CLAIM_SOURCES_001
+        // Every claims.source_id must resolve to a sources.id in the same backup.
+        // An orphaned source_id indicates a truncated or partial backup.
+        const orphanedClaims = db
+            .prepare(`SELECT COUNT(*) AS cnt FROM claims
+         WHERE source_id NOT IN (SELECT id FROM sources)`)
+            .get();
+        if (orphanedClaims.cnt > 0) {
+            failed.push("RESTORE_SEMANTIC_ORPHANED_CLAIM_SOURCES_001");
+        }
+        // ── Check 2: Orphaned source→evidence references ───────────────────────
+        // RESTORE_SEMANTIC_ORPHANED_EVIDENCE_REFS_001
+        // Every non-null sources.evidence_id must resolve to a raw_documents.id.
+        // NULL evidence_id is allowed (source without attached document).
+        const orphanedEvidence = db
+            .prepare(`SELECT COUNT(*) AS cnt FROM sources
+         WHERE evidence_id IS NOT NULL
+           AND evidence_id NOT IN (SELECT id FROM raw_documents)`)
+            .get();
+        if (orphanedEvidence.cnt > 0) {
+            failed.push("RESTORE_SEMANTIC_ORPHANED_EVIDENCE_REFS_001");
+        }
+        // ── Check 3: Orphaned proposal→grant references ────────────────────────
+        // RESTORE_SEMANTIC_ORPHANED_PROPOSAL_GRANTS_001
+        // Every proposals.under_grant must resolve to an auth_grants.grant_id.
+        const orphanedGrants = db
+            .prepare(`SELECT COUNT(*) AS cnt FROM proposals
+         WHERE under_grant NOT IN (SELECT grant_id FROM auth_grants)`)
+            .get();
+        if (orphanedGrants.cnt > 0) {
+            failed.push("RESTORE_SEMANTIC_ORPHANED_PROPOSAL_GRANTS_001");
+        }
+        // ── Check 4: Duplicate audit event sequence numbers ────────────────────
+        // RESTORE_SEMANTIC_AUDIT_SEQUENCE_DUPLICATE_001
+        // The audit_events_sequence_unique index enforces uniqueness at write time.
+        // This check is defense-in-depth after restore — a corrupt restore could
+        // violate the constraint without triggering an index rebuild.
+        const dupSequences = db
+            .prepare(`SELECT COUNT(*) AS cnt FROM (
+           SELECT sequence FROM audit_events
+           GROUP BY sequence HAVING COUNT(*) > 1
+         )`)
+            .get();
+        if (dupSequences.cnt > 0) {
+            failed.push("RESTORE_SEMANTIC_AUDIT_SEQUENCE_DUPLICATE_001");
+        }
+        // ── Aggregate result ───────────────────────────────────────────────────
+        const TOTAL_CHECKS = 4;
+        if (failed.length === 0) {
+            return { status: "ok", checkedAt, checkCount: TOTAL_CHECKS };
+        }
+        return {
+            status: "failed",
+            checkedAt,
+            checkCount: TOTAL_CHECKS,
+            failedChecks: failed,
+        };
+    }
+    catch (err) {
+        // DB open, schema verification, or SQL threw. checkCount is omitted —
+        // setup itself failed before any individual check could run.
+        return {
+            status: "failed",
+            checkedAt,
+            ...(err instanceof Error ? { errorName: err.name } : {}),
+        };
+    }
+    finally {
+        try {
+            db?.close();
+        }
+        catch { /* ignore close errors */ }
+    }
+}
+//# sourceMappingURL=backup.js.map

package/dist/persistence/backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/persistence/backup.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,6EAA6E;AAC7E,uEAAuE;AACvE,0EAA0E;AAC1E,oEAAoE;AACpE,yEAAyE;AACzE,iEAAiE;AACjE,6EAA6E;AAC7E,8EAA8E;AAC9E,8CAA8C;AAC9C,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAC7E,yCAAyC;AACzC,6EAA6E;AAC7E,+EAA+E;AAC/E,yBAAyB;AACzB,yEAAyE;AACzE,iEAAiE;AACjE,+EAA+E;AAC/E,+EAA+E;AAC/E,4BAA4B;AAC5B,wEAAwE;AACxE,uEAAuE;AACvE,wCAAwC;AACxC,6EAA6E;AAC7E,2EAA2E;AAC3E,wBAAwB;AACxB,sEAAsE;AACtE,6EAA6E;AAC7E,wEAAwE;AACxE,gBAAgB;AAChB,EAAE;AACF,wCAAwC;AACxC,+EAA+E;AAC/E,8DAA8D;AAC9D,yEAAyE;AACzE,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,iEAAiE;AACjE,8EAA8E;AAC9E,wEAAwE;AACxE,+EAA+E;AAC/E,iEAAiE;AAEjE,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAwChC,kFAAkF;AAClF,sEAAsE;AACtE,mFAAmF;AACnF,iFAAiF;AACjF,8DAA8D;AAC9D,+EAA+E;AAC/E,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAqB,EACrB,eAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,SAAS;YACT,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,IAAI,QAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,QAAQ,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;QAC/E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,SAAS;YACT,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,gDAAgD;AAChD,6EAA6E;AAC7E,oDAAoD;AACpD,sDAAsD;AACtD,qEAAqE;AACrE,8EAA8E;AAC9E,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAkB;IAElB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,EAAiC,CAAC;IAEtC,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvE,+CAA+C;QAC/C,MAAM,YAAY,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;QAC/E,CAAC;QAED,2BAA2B;QAC3B,MAAM,GAAG,GAAG,EAAE;aACX,OAAO,CAAC,+DAA+D,CAAC;aACxE,GAAG,EAAmC,CAAC;QAC1C,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAElE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,sBAAsB,EAAE,CAAC;YACpE,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,SAAS;gBACT,SAAS,EAAE,6BAA6B;gBACxC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,SAAS;YACT,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,8EAA8E;AAC9E,mFAAmF;AACnF,4BAA4B;AAC5B,EAAE;AACF,wCAAwC;AACxC,4CAA4C;AAC5C,2CAA2C;AAC3C,+EAA+E;AAC/E,0CAA0C;AAC1C,2DAA2D;AAC3D,8CAA8C;AAC9C,gEAAgE;AAChE,EAAE;AACF,sDAAsD;AACtD,gFAAgF;AAChF,uEAAuE;AACvE,8EAA8E;AAC9E,EAAE;AACF,+DAA+D;AAC/D,sEAAsE;AACtE,oDAAoD;AACpD,8CAA8C;AAC9C,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAkB;IAElB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,EAAiC,CAAC;IAEtC,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvE,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,YAAY,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;QAC/E,CAAC;QAED,MAAM,MAAM,GAAwB,EAAE,CAAC;QAEvC,0EAA0E;QAC1E,8CAA8C;QAC9C,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,cAAc,GAAG,EAAE;aACtB,OAAO,CACN;yDACiD,CAClD;aACA,GAAG,EAAqB,CAAC;QAE5B,IAAI,cAAc,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;QAED,0EAA0E;QAC1E,8CAA8C;QAC9C,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,gBAAgB,GAAG,EAAE;aACxB,OAAO,CACN;;iEAEyD,CAC1D;aACA,GAAG,EAAqB,CAAC;QAE5B,IAAI,gBAAgB,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;QAED,0EAA0E;QAC1E,gDAAgD;QAChD,uEAAuE;QACvE,MAAM,cAAc,GAAG,EAAE;aACtB,OAAO,CACN;qEAC6D,CAC9D;aACA,GAAG,EAAqB,CAAC;QAE5B,IAAI,cAAc,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;QAED,0EAA0E;QAC1E,gDAAgD;QAChD,4EAA4E;QAC5E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,YAAY,GAAG,EAAE;aACpB,OAAO,CACN;;;WAGG,CACJ;aACA,GAAG,EAAqB,CAAC;QAE5B,IAAI,YAAY,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;QAED,0EAA0E;QAC1E,MAAM,YAAY,GAAG,CAAC,CAAC;QACvB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO;YACL,MAAM,EAAQ,QAAQ;YACtB,SAAS;YACT,UAAU,EAAI,YAAY;YAC1B,YAAY,EAAE,MAAM;SACrB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,sEAAsE;QACtE,6DAA6D;QAC7D,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,SAAS;YACT,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}

package/dist/persistence/decryptability-scan.d.ts

@@ -0,0 +1,10 @@
+import type { CryptoBoundary } from "../crypto/types.js";
+export interface DecryptabilityScanResult {
+    readonly status: "ok" | "partial" | "failed";
+    readonly scannedAt: string;
+    readonly totalCount?: number;
+    readonly decryptedCount?: number;
+    readonly failedCount?: number;
+    readonly errorName?: string;
+}
+export declare function scanBackupDecryptability(sourcePath: string, cryptoBoundary: CryptoBoundary): Promise<DecryptabilityScanResult>;

package/dist/persistence/decryptability-scan.js

@@ -0,0 +1,144 @@
+// D4c — Full Decryptability Scan boundary.
+//
+// PRODUCTION_DECRYPTABILITY_SCAN_OFFLINE_ONLY_001:
+//   Opens backup file read-only. Makes no writes to any SQLite table.
+//   Does not emit audit events. Does not call logger.
+// PRODUCTION_DECRYPTABILITY_SCAN_NO_PLAINTEXT_EXPOSURE_001:
+//   Decrypted bytes are discarded immediately after each decrypt call.
+//   Plaintext never appears in result, errors, logs, metrics, or audit.
+// PRODUCTION_DECRYPTABILITY_SCAN_AGGREGATE_RESULT_ONLY_001:
+//   Result contains only status, scannedAt, totalCount, decryptedCount,
+//   failedCount, and errorName. No entity IDs, no keyId strings, no
+//   ciphertext fragments, no per-row breakdown, no per-table breakdown.
+// PRODUCTION_DECRYPTABILITY_SCAN_THREE_TABLES_001:
+//   Covers all three encrypted tables: claims.encrypted_payload,
+//   raw_documents.encrypted_blob, proposals.encrypted_payload.
+// PRODUCTION_DECRYPTABILITY_SCAN_NOT_PRODUCT_API_001:
+//   Not on ProductionApiBundle, ProductionScopedLifeApi, or package root.
+// PRODUCTION_DECRYPTABILITY_SCAN_NEVER_THROWS_001:
+//   scanBackupDecryptability never throws. All errors expressed as
+//   DecryptabilityScanResult { status: "failed", scannedAt, errorName }.
+//
+// IMPORTANT: failedCount does NOT distinguish between wrong key bytes,
+// corrupt ciphertext, malformed blob, or any other decrypt failure.
+// This utility proves only that AES-GCM tag verification succeeds (or fails)
+// for each row with the provided CryptoBoundary. It is NOT a recovery claim.
+//
+// See docs/specs/post-mvp-d4c-decryptability-scan-spec.md
+import Database from "better-sqlite3";
+import { verifyCurrentSchema } from "./sqlite/migrations.js";
+// ─── Inventory SQL ────────────────────────────────────────────────────────────
+// Retrieves raw JSON blobs from all three encrypted payload columns.
+// Results are ordered to enable deterministic test assertions.
+// No entity IDs, primary keys, or foreign keys are selected.
+const DECRYPT_INVENTORY_SQL = `
+  SELECT encrypted_payload AS blob FROM claims
+  UNION ALL
+  SELECT encrypted_blob    AS blob FROM raw_documents
+  UNION ALL
+  SELECT encrypted_payload AS blob FROM proposals
+  ORDER BY 1
+`;
+// ─── scanBackupDecryptability ─────────────────────────────────────────────────
+// Opens a backup file (or any migrated SQLite file) read-only and attempts to
+// decrypt every encrypted payload using the provided CryptoBoundary.
+//
+// All decryption is delegated to the provided CryptoBoundary parameter.
+// This file contains no raw WebCrypto API calls (CRYPTO_BOUNDARY_ONLY_001).
+//
+// Decrypted bytes are discarded immediately after the decrypt call. They are
+// never assigned to a persistent variable, returned, logged, or audited.
+//
+// Algorithm:
+//   1. Open sourcePath read-only (fileMustExist: true).
+//   2. Run verifyCurrentSchema — fail fast if not a valid, current-version DB.
+//   3. Run DECRYPT_INVENTORY_SQL to enumerate all encrypted blobs.
+//   4. For each blob:
+//        a. Parse JSON → EncryptedBlob (malformed → failedCount++; continue)
+//        b. Call cryptoBoundary.decryptBytes(blob) → discard plaintext
+//        c. On throw (CRYPTO_TAMPER_DETECTED_001 or CRYPTO_WRONG_KEY_FAIL_CLOSED_001)
+//           → failedCount++; continue
+//   5. Close DB.
+//   6. Return aggregate DecryptabilityScanResult — counts only.
+//
+// Status semantics:
+//   "ok"      — failedCount === 0; all rows decrypted.
+//   "partial" — failedCount > 0 && decryptedCount > 0; some rows failed.
+//   "failed"  — DB open/schema/inventory failed (counts omitted); OR
+//               decryptedCount === 0 (all rows failed; counts present).
+export async function scanBackupDecryptability(sourcePath, cryptoBoundary) {
+    const scannedAt = new Date().toISOString();
+    let db;
+    try {
+        db = new Database(sourcePath, { readonly: true, fileMustExist: true });
+        // Structural check — fail early if schema is invalid or wrong version.
+        const structResult = verifyCurrentSchema(db);
+        if (!structResult.ok) {
+            return { status: "failed", scannedAt, errorName: "SchemaVerificationError" };
+        }
+        // Enumerate all encrypted blobs. No entity IDs are selected — only blob text.
+        const rows = db
+            .prepare(DECRYPT_INVENTORY_SQL)
+            .all();
+        let decryptedCount = 0;
+        let failedCount = 0;
+        for (const row of rows) {
+            // Malformed or NULL blob — count as failed; no plaintext involved.
+            if (row.blob === null || row.blob === "") {
+                failedCount++;
+                continue;
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(row.blob);
+            }
+            catch {
+                // Blob is not valid JSON — cannot construct EncryptedBlob.
+                failedCount++;
+                continue;
+            }
+            if (typeof parsed !== "object" ||
+                parsed === null ||
+                Array.isArray(parsed) ||
+                parsed["algorithm"] !== "AES-256-GCM") {
+                failedCount++;
+                continue;
+            }
+            const blob = parsed;
+            try {
+                // Attempt AES-GCM decrypt — the only thing we verify is that the tag
+                // passes. Returned Uint8Array is discarded immediately.
+                await cryptoBoundary.decryptBytes(blob);
+                decryptedCount++;
+            }
+            catch {
+                // CRYPTO_TAMPER_DETECTED_001: tag verification failed (corrupt ciphertext,
+                // wrong key bytes, or wrong IV). CRYPTO_WRONG_KEY_FAIL_CLOSED_001: keyId
+                // unknown to provider. Both are unrecoverable per-row failures.
+                // failedCount does not distinguish these failure modes — it is an aggregate.
+                failedCount++;
+            }
+        }
+        const totalCount = decryptedCount + failedCount;
+        const status = failedCount === 0 ? "ok"
+            : decryptedCount > 0 ? "partial"
+                : /* all rows failed */ "failed";
+        return { status, scannedAt, totalCount, decryptedCount, failedCount };
+    }
+    catch (err) {
+        // DB open, schema verification, or inventory SQL threw.
+        // Counts are omitted — the inventory step itself failed.
+        return {
+            status: "failed",
+            scannedAt,
+            ...(err instanceof Error ? { errorName: err.name } : {}),
+        };
+    }
+    finally {
+        try {
+            db?.close();
+        }
+        catch { /* ignore close errors */ }
+    }
+}
+//# sourceMappingURL=decryptability-scan.js.map

package/dist/persistence/decryptability-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decryptability-scan.js","sourceRoot":"","sources":["../../src/persistence/decryptability-scan.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,mDAAmD;AACnD,sEAAsE;AACtE,sDAAsD;AACtD,4DAA4D;AAC5D,uEAAuE;AACvE,wEAAwE;AACxE,4DAA4D;AAC5D,wEAAwE;AACxE,oEAAoE;AACpE,wEAAwE;AACxE,mDAAmD;AACnD,iEAAiE;AACjE,+DAA+D;AAC/D,sDAAsD;AACtD,0EAA0E;AAC1E,mDAAmD;AACnD,mEAAmE;AACnE,yEAAyE;AACzE,EAAE;AACF,uEAAuE;AACvE,oEAAoE;AACpE,6EAA6E;AAC7E,6EAA6E;AAC7E,EAAE;AACF,0DAA0D;AAE1D,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAgB7D,iFAAiF;AACjF,qEAAqE;AACrE,+DAA+D;AAC/D,6DAA6D;AAC7D,MAAM,qBAAqB,GAAG;;;;;;;CAO7B,CAAC;AAEF,iFAAiF;AACjF,8EAA8E;AAC9E,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,EAAE;AACF,aAAa;AACb,wDAAwD;AACxD,+EAA+E;AAC/E,mEAAmE;AACnE,sBAAsB;AACtB,6EAA6E;AAC7E,uEAAuE;AACvE,sFAAsF;AACtF,sCAAsC;AACtC,iBAAiB;AACjB,gEAAgE;AAChE,EAAE;AACF,oBAAoB;AACpB,uDAAuD;AACvD,yEAAyE;AACzE,qEAAqE;AACrE,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAsB,EACtB,cAA8B;IAE9B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,EAAiC,CAAC;IAEtC,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvE,uEAAuE;QACvE,MAAM,YAAY,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;QAC/E,CAAC;QAED,8EAA8E;QAC9E,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CAAC,qBAAqB,CAAC;aAC9B,GAAG,EAAoC,CAAC;QAE3C,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,WAAW,GAAM,CAAC,CAAC;QAEvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,mEAAmE;YACnE,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;gBACzC,WAAW,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YAED,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;gBAC3D,WAAW,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YAED,IACE,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,KAAK,IAAI;gBACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACpB,MAAkC,CAAC,WAAW,CAAC,KAAK,aAAa,EAClE,CAAC;gBACD,WAAW,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,MAAuB,CAAC;YAErC,IAAI,CAAC;gBACH,qEAAqE;gBACrE,wDAAwD;gBACxD,MAAM,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACxC,cAAc,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,2EAA2E;gBAC3E,yEAAyE;gBACzE,gEAAgE;gBAChE,6EAA6E;gBAC7E,WAAW,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,cAAc,GAAG,WAAW,CAAC;QAChD,MAAM,MAAM,GACV,WAAW,KAAK,CAAC,CAAS,CAAC,CAAC,IAAI;YAChC,CAAC,CAAC,cAAc,GAAG,CAAC,CAAM,CAAC,CAAC,SAAS;gBACrC,CAAC,CAAC,qBAAqB,CAAK,QAAQ,CAAC;QAEvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;IACxE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,wDAAwD;QACxD,yDAAyD;QACzD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,SAAS;YACT,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}

package/dist/persistence/in-memory-unit-of-work.d.ts

@@ -0,0 +1,11 @@
+import type { UnitOfWork } from "./unit-of-work.js";
+import { InMemoryRawDocumentStore } from "../evidence/in-memory-raw-document-store.js";
+import { InMemorySourceRegistry } from "../source/in-memory-source-registry.js";
+import { InMemoryFactStore } from "../store/in-memory-fact-store.js";
+export declare class InMemoryUnitOfWork implements UnitOfWork {
+    private readonly _docStore;
+    private readonly _srcReg;
+    private readonly _factStore;
+    constructor(_docStore: InMemoryRawDocumentStore, _srcReg: InMemorySourceRegistry, _factStore: InMemoryFactStore);
+    run<T>(fn: () => Promise<T>): Promise<T>;
+}