life-as-api 0.2.0

package/dist/persistence/sqlite/migrations.js

@@ -0,0 +1,535 @@
+// SQLite schema migration runner.
+//
+// SQLITE_MIGRATION_RUNNER_EXISTS_001: single authoritative source for schema history.
+//   initializeSchema() in schema.ts delegates here.
+// SQLITE_SCHEMA_VERSION_TRACKED_001: 'migration_version' (numeric) in schema_meta tracks
+//   the last completed step; 'schema_version' (string) is preserved for legacy readers.
+// SQLITE_MIGRATIONS_IDEMPOTENT_001: re-running on an up-to-date DB is a no-op.
+// SQLITE_MIGRATIONS_RUN_IN_TRANSACTION_001: all pending steps are in one transaction.
+// SQLITE_MIGRATION_FAILS_CLOSED_ON_UNKNOWN_FUTURE_VERSION_001: future version → throw.
+// SQLITE_MIGRATION_DDL_NO_PAYLOAD_LEAK_001: DDL contains no crypto or payload material.
+// SQLITE_MIGRATION_LEGACY_SCHEMA_NOT_ASSUMED_CURRENT_001: absent migration_version never
+//   silently assumes fully migrated — structural verification is always required.
+// SQLITE_MIGRATION_CURRENT_SCHEMA_STRUCTURAL_VERIFY_001: structural verification runs at
+//   the end of every runMigrations call, even when migration_version already equals current.
+import { sha256hexSync } from "../../crypto/sha256.js";
+import { buildChainCanonical } from "../../audit/sqlite-audit-log.js";
+// SQLITE_MIGRATION_RUNNER_EXISTS_001
+// PROPOSAL_QUEUE_SCHEMA_ENCRYPTED_PAYLOAD_001 ✅ Production-06a
+// PRODUCTION_AUDIT_C4_HASH_CHAIN_SEQUENCE_001 ✅ Audit Hardening C4 (v9)
+// GUARDIAN_AUDIT_MARKED_001 ✅ Platform-03 Guardianship (v10): acting_as_guardian, ward_id
+export const CURRENT_SCHEMA_VERSION = 10;
+// ─── Error codes ──────────────────────────────────────────────────────────────
+const FAIL_CLOSED_CODE = "SQLITE_MIGRATION_FAILS_CLOSED_ON_UNKNOWN_FUTURE_VERSION_001";
+const LEGACY_INCOMPLETE_CODE = "SQLITE_MIGRATION_LEGACY_SCHEMA_INCOMPLETE_001";
+const VERIFY_FAILED_CODE = "SQLITE_MIGRATION_CURRENT_SCHEMA_VERIFY_FAILED_001";
+// ─── Structural verification constants ───────────────────────────────────────
+// SQLITE_MIGRATION_LEGACY_SCHEMA_NOT_ASSUMED_CURRENT_001: these are the ground-truth
+// requirements. A DB is only treated as current when it passes all of these checks.
+const REQUIRED_TABLES = [
+    "schema_meta",
+    "claims",
+    "sources",
+    "raw_documents",
+    "audit_events",
+    "auth_tenant_memberships",
+    "auth_grants",
+    "proposals",
+];
+const REQUIRED_COLUMNS = {
+    sources: [
+        "id", "kind", "label", "status", "created_at", "created_by",
+        "evidence_id", "evidence_uri", "evidence_hash", "evidence_mime", "evidence_enc",
+        "metadata",
+    ],
+    raw_documents: [
+        "id", "mime_type", "byte_length", "label",
+        "created_at", "created_by", "encrypted_blob", "metadata",
+    ],
+    audit_events: [
+        "id", "recorded_at", "actor", "grant_id", "purpose", "decision",
+        "reason_code", "selector_fingerprint", "result_count", "result_claim_ids",
+        "contract_ids",
+        // PRODUCTION_AUDIT_C4_HASH_CHAIN_SEQUENCE_001 (v9)
+        "sequence", "prev_hash", "event_hash",
+        // GUARDIAN_AUDIT_MARKED_001 (v10)
+        "acting_as_guardian", "ward_id",
+    ],
+    auth_tenant_memberships: [
+        "tenant_id", "person_id", "status", "created_at", "updated_at",
+    ],
+    auth_grants: [
+        "grant_id", "agent_id", "tenant_id", "status",
+        "not_before", "not_after", "person_id", "created_at", "updated_at",
+    ],
+    // PROPOSAL_QUEUE_SCHEMA_ENCRYPTED_PAYLOAD_001: candidateClaims stored as encrypted blob only.
+    // PROPOSAL_QUEUE_NO_PLAINTEXT_CANDIDATE_CLAIMS_001: no candidateClaims/rationale/reject_reason columns.
+    proposals: [
+        "proposal_id", "status", "proposed_by_agent", "under_grant",
+        "encrypted_payload", "payload_key_id",
+        "created_at", "updated_at", "decided_at",
+    ],
+};
+// Required indexes introduced in v7. Checked by verifyCurrentSchema.
+const REQUIRED_INDEXES = [
+    "idx_proposals_status",
+    "idx_proposals_agent",
+    "idx_proposals_grant",
+    "idx_proposals_status_grant",
+    // PRODUCTION_AUDIT_C4_HASH_CHAIN_SEQUENCE_001 (v9): unique sequence index on audit_events.
+    "audit_events_sequence_unique",
+];
+// ─── Historical DDL snapshots ─────────────────────────────────────────────────
+// Each step preserves the schema state at that point in the project's history.
+// Step v1→v2 creates sources WITHOUT evidence columns; those arrive in v3→v4.
+const V1_SCHEMA_META_DDL = `
+CREATE TABLE IF NOT EXISTS schema_meta (
+  key   TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+) STRICT;
+`;
+const V1_CLAIMS_DDL = `
+CREATE TABLE IF NOT EXISTS claims (
+  id                 TEXT    PRIMARY KEY,
+  source_id          TEXT    NOT NULL,
+  subject            TEXT    NOT NULL,
+  predicate          TEXT    NOT NULL,
+  valid_from         TEXT    NOT NULL,
+  valid_to           TEXT,
+  recorded_at        TEXT    NOT NULL,
+  recorded_seq       INTEGER NOT NULL UNIQUE,
+  retracts           TEXT,
+  supersedes         TEXT,
+  overrides          TEXT,
+  contract_id        TEXT,
+  confidence         REAL,
+  serializer_version TEXT    NOT NULL,
+  encrypted_payload  TEXT    NOT NULL
+) STRICT;
+`;
+// Sources without evidence link columns (added in step v3→v4).
+const V2_SOURCES_BASE_DDL = `
+CREATE TABLE IF NOT EXISTS sources (
+  id         TEXT PRIMARY KEY,
+  kind       TEXT NOT NULL,
+  label      TEXT NOT NULL,
+  status     TEXT NOT NULL DEFAULT 'active',
+  created_at TEXT NOT NULL,
+  created_by TEXT NOT NULL,
+  metadata   TEXT
+) STRICT;
+`;
+const V3_RAW_DOCUMENTS_DDL = `
+CREATE TABLE IF NOT EXISTS raw_documents (
+  id             TEXT    PRIMARY KEY,
+  mime_type      TEXT    NOT NULL,
+  byte_length    INTEGER NOT NULL,
+  label          TEXT,
+  created_at     TEXT    NOT NULL,
+  created_by     TEXT    NOT NULL,
+  encrypted_blob TEXT    NOT NULL,
+  metadata       TEXT
+) STRICT;
+`;
+// Evidence link columns added to sources in step v3→v4.
+const V4_EVIDENCE_COLUMNS = [
+    "ALTER TABLE sources ADD COLUMN evidence_id   TEXT",
+    "ALTER TABLE sources ADD COLUMN evidence_uri  TEXT",
+    "ALTER TABLE sources ADD COLUMN evidence_hash TEXT",
+    "ALTER TABLE sources ADD COLUMN evidence_mime TEXT",
+    "ALTER TABLE sources ADD COLUMN evidence_enc  INTEGER",
+];
+const V5_AUDIT_EVENTS_DDL = `
+CREATE TABLE IF NOT EXISTS audit_events (
+  id                   TEXT    PRIMARY KEY,
+  recorded_at          TEXT    NOT NULL,
+  actor                TEXT    NOT NULL,
+  grant_id             TEXT,
+  purpose              TEXT,
+  decision             TEXT    NOT NULL,
+  reason_code          TEXT    NOT NULL,
+  selector_fingerprint TEXT    NOT NULL,
+  result_count         INTEGER NOT NULL,
+  result_claim_ids     TEXT    NOT NULL,
+  contract_ids         TEXT
+) STRICT;
+`;
+// AUTH_SQLITE_TENANT_MEMBERSHIP_SCHEMA_001 ✅ Production-02d-a
+const V6_AUTH_TENANT_MEMBERSHIPS_DDL = `
+CREATE TABLE IF NOT EXISTS auth_tenant_memberships (
+  tenant_id  TEXT NOT NULL,
+  person_id  TEXT NOT NULL,
+  status     TEXT NOT NULL CHECK (status IN ('active', 'suspended')),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (tenant_id, person_id)
+) STRICT;
+`;
+// AUTH_SQLITE_GRANT_SCHEMA_001 ✅ Production-02d-a
+const V6_AUTH_GRANTS_DDL = `
+CREATE TABLE IF NOT EXISTS auth_grants (
+  grant_id   TEXT NOT NULL PRIMARY KEY,
+  agent_id   TEXT NOT NULL,
+  tenant_id  TEXT NOT NULL,
+  status     TEXT NOT NULL CHECK (status IN ('active', 'revoked')),
+  not_before TEXT NOT NULL,
+  not_after  TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+) STRICT;
+`;
+const V6_AUTH_GRANTS_INDEX = `
+CREATE INDEX IF NOT EXISTS auth_grants_lookup
+  ON auth_grants (agent_id, tenant_id, grant_id);
+`;
+// PROPOSAL_QUEUE_SCHEMA_ENCRYPTED_PAYLOAD_001 ✅ Production-06a
+// PROPOSAL_QUEUE_NO_PLAINTEXT_CANDIDATE_CLAIMS_001 ✅ Production-06a
+// candidateClaims are stored as encrypted_payload (EncryptedBlob JSON).
+// No plaintext candidateClaims, rationale, or reject_reason columns.
+const V7_PROPOSALS_DDL = `
+CREATE TABLE IF NOT EXISTS proposals (
+  proposal_id       TEXT NOT NULL PRIMARY KEY,
+  status            TEXT NOT NULL CHECK (status IN ('pending', 'accepted', 'rejected')),
+  proposed_by_agent TEXT NOT NULL,
+  under_grant       TEXT NOT NULL,
+  encrypted_payload TEXT NOT NULL,
+  payload_key_id    TEXT NOT NULL,
+  created_at        TEXT NOT NULL,
+  updated_at        TEXT NOT NULL,
+  decided_at        TEXT
+) STRICT;
+`;
+const V7_PROPOSALS_IDX_STATUS = `
+CREATE INDEX IF NOT EXISTS idx_proposals_status
+  ON proposals (status);
+`;
+const V7_PROPOSALS_IDX_AGENT = `
+CREATE INDEX IF NOT EXISTS idx_proposals_agent
+  ON proposals (proposed_by_agent);
+`;
+const V7_PROPOSALS_IDX_GRANT = `
+CREATE INDEX IF NOT EXISTS idx_proposals_grant
+  ON proposals (under_grant);
+`;
+const V7_PROPOSALS_IDX_STATUS_GRANT = `
+CREATE INDEX IF NOT EXISTS idx_proposals_status_grant
+  ON proposals (status, under_grant);
+`;
+// PRODUCTION_AUTH_SCHEMA_V8_PERSON_SCOPE_001
+const V8_AUTH_GRANTS_PERSON_ID = `
+ALTER TABLE auth_grants ADD COLUMN person_id TEXT;
+`;
+// ─── v9: Audit Hardening C4 — Local Hash Chain ──────────────────────────────────
+// PRODUCTION_AUDIT_C4_HASH_CHAIN_SEQUENCE_001 / PRODUCTION_AUDIT_C4_PREV_HASH_LINKAGE_001 /
+// PRODUCTION_AUDIT_C4_BACKFILL_LEGACY_CHAIN_VALID_001
+//
+// DEFAULT 0 / DEFAULT '' are temporary scaffolding to satisfy NOT NULL during ALTER. The
+// backfill loop replaces them for every existing row before the unique index is created, so
+// no committed chain row ever carries the scaffold values.
+const V9_AUDIT_ADD_SEQUENCE = `ALTER TABLE audit_events ADD COLUMN sequence INTEGER NOT NULL DEFAULT 0`;
+const V9_AUDIT_ADD_PREV_HASH = `ALTER TABLE audit_events ADD COLUMN prev_hash TEXT`;
+const V9_AUDIT_ADD_EVENT_HASH = `ALTER TABLE audit_events ADD COLUMN event_hash TEXT NOT NULL DEFAULT ''`;
+const V9_AUDIT_SEQUENCE_INDEX = `CREATE UNIQUE INDEX audit_events_sequence_unique ON audit_events(sequence)`;
+// PRODUCTION_AUDIT_C4_BACKFILL_LEGACY_CHAIN_VALID_001: build a valid chain from current DB
+// state, ordered by rowid ASC (stable SQLite insertion order). Runs inside the migration
+// transaction; synchronous (better-sqlite3) so it uses sha256hexSync.
+function backfillAuditChain(db) {
+    const rows = db
+        .prepare(`SELECT id, recorded_at, actor, grant_id, purpose, decision, reason_code,
+              selector_fingerprint, result_count, result_claim_ids, contract_ids
+         FROM audit_events ORDER BY rowid ASC`)
+        .all();
+    const update = db.prepare(`UPDATE audit_events SET sequence = ?, prev_hash = ?, event_hash = ? WHERE id = ?`);
+    let prevEventHash = null;
+    for (let i = 0; i < rows.length; i++) {
+        const row = rows[i];
+        const seq = i + 1;
+        const canonical = buildChainCanonical({
+            actor: row.actor,
+            contract_ids: row.contract_ids,
+            decision: row.decision,
+            grant_id: row.grant_id,
+            id: row.id,
+            prev_hash: prevEventHash,
+            purpose: row.purpose,
+            reason_code: row.reason_code,
+            recorded_at: row.recorded_at,
+            result_claim_ids: row.result_claim_ids,
+            result_count: row.result_count,
+            selector_fingerprint: row.selector_fingerprint,
+            sequence: seq,
+        });
+        const eventHash = sha256hexSync(canonical);
+        update.run(seq, prevEventHash, eventHash, row.id);
+        prevEventHash = eventHash;
+    }
+}
+const MIGRATIONS = [
+    {
+        fromVersion: 0,
+        apply(db) {
+            db.exec(V1_SCHEMA_META_DDL);
+            db.exec(V1_CLAIMS_DDL);
+            // INSERT OR IGNORE never overwrites an existing schema_version string.
+            db.prepare("INSERT OR IGNORE INTO schema_meta (key, value) VALUES ('schema_version', 'sqlite-claims-v1')").run();
+        },
+    },
+    {
+        fromVersion: 1,
+        apply(db) {
+            db.exec(V2_SOURCES_BASE_DDL);
+        },
+    },
+    {
+        fromVersion: 2,
+        apply(db) {
+            db.exec(V3_RAW_DOCUMENTS_DDL);
+        },
+    },
+    {
+        fromVersion: 3,
+        apply(db) {
+            for (const sql of V4_EVIDENCE_COLUMNS) {
+                db.prepare(sql).run();
+            }
+        },
+    },
+    {
+        fromVersion: 4,
+        apply(db) {
+            db.exec(V5_AUDIT_EVENTS_DDL);
+        },
+    },
+    {
+        fromVersion: 5,
+        apply(db) {
+            db.exec(V6_AUTH_TENANT_MEMBERSHIPS_DDL);
+            db.exec(V6_AUTH_GRANTS_DDL);
+            db.exec(V6_AUTH_GRANTS_INDEX);
+        },
+    },
+    {
+        fromVersion: 6,
+        apply(db) {
+            db.exec(V7_PROPOSALS_DDL);
+            db.exec(V7_PROPOSALS_IDX_STATUS);
+            db.exec(V7_PROPOSALS_IDX_AGENT);
+            db.exec(V7_PROPOSALS_IDX_GRANT);
+            db.exec(V7_PROPOSALS_IDX_STATUS_GRANT);
+        },
+    },
+    {
+        fromVersion: 7,
+        apply(db) {
+            db.prepare(V8_AUTH_GRANTS_PERSON_ID.trim()).run();
+        },
+    },
+    {
+        // PRODUCTION_AUDIT_C4_HASH_CHAIN_SEQUENCE_001 (v9): add chain columns, backfill, unique index.
+        // PRODUCTION_AUDIT_C4_WRITE_ATOMIC_BEGIN_IMMEDIATE_001: runs within the single BEGIN IMMEDIATE
+        // migration transaction — no half-migrated chain is ever observable.
+        fromVersion: 8,
+        apply(db) {
+            db.prepare(V9_AUDIT_ADD_SEQUENCE).run();
+            db.prepare(V9_AUDIT_ADD_PREV_HASH).run();
+            db.prepare(V9_AUDIT_ADD_EVENT_HASH).run();
+            backfillAuditChain(db);
+            db.prepare(V9_AUDIT_SEQUENCE_INDEX).run();
+        },
+    },
+    {
+        // GUARDIAN_AUDIT_MARKED_001 (v10): add guardian audit columns to audit_events.
+        // Both columns are nullable — NULL = not a guardian action.
+        // GUARDIAN_AUDIT_HASH_CHAIN_BACKWARD_COMPATIBLE_001: pre-existing rows remain NULL; their
+        //   chain hashes are computed without these fields (absent from canonical) → unchanged.
+        fromVersion: 9,
+        apply(db) {
+            db.prepare(`ALTER TABLE audit_events ADD COLUMN acting_as_guardian INTEGER`).run();
+            db.prepare(`ALTER TABLE audit_events ADD COLUMN ward_id TEXT`).run();
+        },
+    },
+];
+// ─── Structural verification ──────────────────────────────────────────────────
+// SQLITE_MIGRATION_CURRENT_SCHEMA_STRUCTURAL_VERIFY_001
+export function verifyCurrentSchema(db) {
+    const missing = [];
+    const existingTables = new Set(db
+        .prepare("SELECT name FROM sqlite_master WHERE type='table'")
+        .all().map((r) => r.name));
+    for (const table of REQUIRED_TABLES) {
+        if (!existingTables.has(table))
+            missing.push(`table:${table}`);
+    }
+    // Only check columns and indexes once all required tables are confirmed present.
+    if (missing.length === 0) {
+        for (const [table, cols] of Object.entries(REQUIRED_COLUMNS)) {
+            const existingCols = new Set(db.pragma(`table_info(${table})`).map((r) => r.name));
+            for (const col of cols) {
+                if (!existingCols.has(col))
+                    missing.push(`${table}.${col}`);
+            }
+        }
+        const existingIndexes = new Set(db
+            .prepare("SELECT name FROM sqlite_master WHERE type='index'")
+            .all().map((r) => r.name));
+        for (const idx of REQUIRED_INDEXES) {
+            if (!existingIndexes.has(idx))
+                missing.push(`index:${idx}`);
+        }
+    }
+    return missing.length === 0 ? { ok: true } : { ok: false, missing };
+}
+// SQLITE_MIGRATION_CURRENT_SCHEMA_STRUCTURAL_VERIFY_001
+function assertCurrentSchema(db) {
+    const result = verifyCurrentSchema(db);
+    if (!result.ok) {
+        throw Object.assign(new Error(`[${VERIFY_FAILED_CODE}] Schema verification failed. ` +
+            `Missing: ${result.missing.join(", ")}.`), { code: VERIFY_FAILED_CODE, missing: result.missing });
+    }
+}
+// ─── Version inference ────────────────────────────────────────────────────────
+// Used only when schema_meta exists but migration_version key is absent.
+// Returns the highest migration step whose preconditions are met by the current schema.
+function inferMigrationVersion(db) {
+    const tables = new Set(db
+        .prepare("SELECT name FROM sqlite_master WHERE type='table'")
+        .all().map((r) => r.name));
+    if (!tables.has("claims"))
+        return 0; // schema_meta-only DB — start from scratch
+    if (!tables.has("sources"))
+        return 1;
+    const sourceCols = new Set(db.pragma("table_info(sources)").map((r) => r.name));
+    if (!tables.has("raw_documents"))
+        return 2;
+    if (!sourceCols.has("evidence_id"))
+        return 3;
+    if (!tables.has("audit_events"))
+        return 4;
+    if (!tables.has("auth_tenant_memberships") || !tables.has("auth_grants"))
+        return 5;
+    if (!tables.has("proposals"))
+        return 6;
+    // v8 check: auth_grants must have person_id column
+    const grantCols = new Set(db.pragma("table_info(auth_grants)").map(r => r.name));
+    if (!grantCols.has("person_id"))
+        return 7;
+    // The audit_events table exists. Before deciding whether it is a v8-complete DB awaiting
+    // the v9 chain upgrade, confirm its pre-v9 columns are intact. A table missing pre-v9
+    // columns (e.g. selector_fingerprint) is a structurally-broken legacy DB — fail closed here
+    // rather than letting the destructive v9 ALTER + backfill run and surface a raw SQLITE_ERROR.
+    // SQLITE_MIGRATION_LEGACY_SCHEMA_INCOMPLETE_001
+    const auditCols = new Set(db.pragma("table_info(audit_events)").map(r => r.name));
+    const PRE_V9_AUDIT_COLUMNS = [
+        "id", "recorded_at", "actor", "grant_id", "purpose", "decision",
+        "reason_code", "selector_fingerprint", "result_count", "result_claim_ids",
+        "contract_ids",
+    ];
+    const missingPreV9 = PRE_V9_AUDIT_COLUMNS.filter(c => !auditCols.has(c));
+    if (missingPreV9.length > 0) {
+        throw Object.assign(new Error(`[${LEGACY_INCOMPLETE_CODE}] Legacy database has all required tables but ` +
+            `audit_events is missing columns: ${missingPreV9.map(c => `audit_events.${c}`).join(", ")}. ` +
+            `Cannot determine a safe migration starting point.`), { code: LEGACY_INCOMPLETE_CODE, missing: missingPreV9.map(c => `audit_events.${c}`) });
+    }
+    // v9 check: audit_events must have the C4 hash-chain columns.
+    // PRODUCTION_AUDIT_C4_HASH_CHAIN_SEQUENCE_001
+    if (!auditCols.has("sequence") || !auditCols.has("event_hash"))
+        return 8;
+    // v10 check: audit_events must have the guardian columns.
+    // GUARDIAN_AUDIT_MARKED_001
+    if (!auditCols.has("acting_as_guardian") || !auditCols.has("ward_id"))
+        return 9;
+    // All tables and v10 columns present.
+    return 10;
+}
+// ─── Legacy DB handling ───────────────────────────────────────────────────────
+// SQLITE_MIGRATION_LEGACY_SCHEMA_NOT_ASSUMED_CURRENT_001
+// SQLITE_MIGRATION_OLD_SCHEMA_META_HANDLED_001
+function handleLegacyUnversioned(db) {
+    // schema_meta exists but migration_version key is absent.
+    // This DB was produced by the old flat initializeSchema() or is genuinely incomplete.
+    // We NEVER assume "fully migrated" without structural proof.
+    const inferred = inferMigrationVersion(db);
+    if (inferred === CURRENT_SCHEMA_VERSION) {
+        // All tables are present. Perform full column check before stamping.
+        // SQLITE_MIGRATION_LEGACY_SCHEMA_NOT_ASSUMED_CURRENT_001
+        const verification = verifyCurrentSchema(db);
+        if (!verification.ok) {
+            // Tables all present but columns are missing — cannot infer which step to re-run.
+            // SQLITE_MIGRATION_LEGACY_SCHEMA_INCOMPLETE_001
+            throw Object.assign(new Error(`[${LEGACY_INCOMPLETE_CODE}] Legacy database has all required tables but is ` +
+                `missing columns: ${verification.missing.join(", ")}. ` +
+                `Cannot determine a safe migration starting point.`), { code: LEGACY_INCOMPLETE_CODE, missing: verification.missing });
+        }
+        // Schema is structurally complete — stamp migration_version so future opens are fast.
+        writeMigrationVersion(db, CURRENT_SCHEMA_VERSION);
+        return CURRENT_SCHEMA_VERSION;
+    }
+    // inferred < CURRENT_SCHEMA_VERSION — run pending migrations from the inferred start.
+    return inferred;
+}
+// ─── Version read / write ─────────────────────────────────────────────────────
+function writeMigrationVersion(db, version) {
+    db.prepare("INSERT OR REPLACE INTO schema_meta (key, value) VALUES ('migration_version', ?)").run(String(version));
+}
+// ─── Migration execution ──────────────────────────────────────────────────────
+function applyPendingMigrations(db, fromVersion) {
+    const pending = MIGRATIONS.filter((m) => m.fromVersion >= fromVersion);
+    if (pending.length === 0)
+        return;
+    // SQLITE_MIGRATIONS_RUN_IN_TRANSACTION_001: all steps commit atomically.
+    // PRODUCTION_AUDIT_C4_WRITE_ATOMIC_BEGIN_IMMEDIATE_001: BEGIN IMMEDIATE reserves the write
+    // lock up front so schema changes + C4 backfill never leave a half-migrated chain.
+    db.prepare("BEGIN IMMEDIATE").run();
+    try {
+        for (const step of pending) {
+            step.apply(db);
+        }
+        writeMigrationVersion(db, CURRENT_SCHEMA_VERSION);
+        db.prepare("COMMIT").run();
+    }
+    catch (err) {
+        try {
+            db.prepare("ROLLBACK").run();
+        }
+        catch {
+            /* DB already closed or in bad state — original error is what matters */
+        }
+        throw err;
+    }
+}
+// ─── Public runner ────────────────────────────────────────────────────────────
+export function runMigrations(db) {
+    // Resolve the current migration version, handling the legacy unversioned case.
+    const hasMeta = db
+        .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='schema_meta'")
+        .get();
+    const current = (() => {
+        if (!hasMeta)
+            return 0; // completely empty DB
+        const row = db
+            .prepare("SELECT value FROM schema_meta WHERE key = 'migration_version'")
+            .get();
+        if (!row) {
+            // SQLITE_MIGRATION_LEGACY_SCHEMA_NOT_ASSUMED_CURRENT_001:
+            // schema_meta present but migration_version absent → do NOT assume current.
+            // SQLITE_MIGRATION_OLD_SCHEMA_META_HANDLED_001:
+            // old schema_version string and flat-initializeSchema DBs go through structural check.
+            return handleLegacyUnversioned(db);
+        }
+        return parseInt(row.value, 10);
+    })();
+    if (current > CURRENT_SCHEMA_VERSION) {
+        // SQLITE_MIGRATION_FAILS_CLOSED_ON_UNKNOWN_FUTURE_VERSION_001
+        throw Object.assign(new Error(`[${FAIL_CLOSED_CODE}] Database migration_version ${current} exceeds ` +
+            `runner ceiling ${CURRENT_SCHEMA_VERSION}. ` +
+            `Upgrade the Life-as-API package to open this database.`), { code: FAIL_CLOSED_CODE });
+    }
+    if (current < CURRENT_SCHEMA_VERSION) {
+        applyPendingMigrations(db, current);
+    }
+    // SQLITE_MIGRATION_CURRENT_SCHEMA_STRUCTURAL_VERIFY_001:
+    // Always verify structural completeness — even when migration_version claims current.
+    // This catches tampered version numbers and post-commit corruption.
+    assertCurrentSchema(db);
+}
+//# sourceMappingURL=migrations.js.map

package/dist/persistence/sqlite/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../src/persistence/sqlite/migrations.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,sFAAsF;AACtF,oDAAoD;AACpD,yFAAyF;AACzF,wFAAwF;AACxF,+EAA+E;AAC/E,sFAAsF;AACtF,uFAAuF;AACvF,wFAAwF;AACxF,yFAAyF;AACzF,kFAAkF;AAClF,yFAAyF;AACzF,6FAA6F;AAG7F,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAEtE,qCAAqC;AACrC,+DAA+D;AAC/D,wEAAwE;AACxE,0FAA0F;AAC1F,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,iFAAiF;AAEjF,MAAM,gBAAgB,GACpB,6DAA6D,CAAC;AAEhE,MAAM,sBAAsB,GAC1B,+CAA+C,CAAC;AAElD,MAAM,kBAAkB,GACtB,mDAAmD,CAAC;AAEtD,gFAAgF;AAChF,qFAAqF;AACrF,oFAAoF;AAEpF,MAAM,eAAe,GAAsB;IACzC,aAAa;IACb,QAAQ;IACR,SAAS;IACT,eAAe;IACf,cAAc;IACd,yBAAyB;IACzB,aAAa;IACb,WAAW;CACZ,CAAC;AAEF,MAAM,gBAAgB,GAAgD;IACpE,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY;QAC3D,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc;QAC/E,UAAU;KACX;IACD,aAAa,EAAE;QACb,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO;QACzC,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU;KACzD;IACD,YAAY,EAAE;QACZ,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU;QAC/D,aAAa,EAAE,sBAAsB,EAAE,cAAc,EAAE,kBAAkB;QACzE,cAAc;QACd,mDAAmD;QACnD,UAAU,EAAE,WAAW,EAAE,YAAY;QACrC,kCAAkC;QAClC,oBAAoB,EAAE,SAAS;KAChC;IACD,uBAAuB,EAAE;QACvB,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY;KAC/D;IACD,WAAW,EAAE;QACX,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ;QAC7C,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY;KACnE;IACD,8FAA8F;IAC9F,wGAAwG;IACxG,SAAS,EAAE;QACT,aAAa,EAAE,QAAQ,EAAE,mBAAmB,EAAE,aAAa;QAC3D,mBAAmB,EAAE,gBAAgB;QACrC,YAAY,EAAE,YAAY,EAAE,YAAY;KACzC;CACF,CAAC;AAEF,qEAAqE;AACrE,MAAM,gBAAgB,GAAsB;IAC1C,sBAAsB;IACtB,qBAAqB;IACrB,qBAAqB;IACrB,4BAA4B;IAC5B,2FAA2F;IAC3F,8BAA8B;CAC/B,CAAC;AAEF,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG;;;;;CAK1B,CAAC;AAEF,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;CAkBrB,CAAC;AAEF,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG;;;;;;;;;;CAU3B,CAAC;AAEF,MAAM,oBAAoB,GAAG;;;;;;;;;;;CAW5B,CAAC;AAEF,wDAAwD;AACxD,MAAM,mBAAmB,GAAsB;IAC7C,mDAAmD;IACnD,mDAAmD;IACnD,mDAAmD;IACnD,mDAAmD;IACnD,sDAAsD;CACvD,CAAC;AAEF,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;CAc3B,CAAC;AAEF,8DAA8D;AAC9D,MAAM,8BAA8B,GAAG;;;;;;;;;CAStC,CAAC;AAEF,kDAAkD;AAClD,MAAM,kBAAkB,GAAG;;;;;;;;;;;CAW1B,CAAC;AAEF,MAAM,oBAAoB,GAAG;;;CAG5B,CAAC;AAEF,+DAA+D;AAC/D,oEAAoE;AACpE,wEAAwE;AACxE,qEAAqE;AACrE,MAAM,gBAAgB,GAAG;;;;;;;;;;;;CAYxB,CAAC;AAEF,MAAM,uBAAuB,GAAG;;;CAG/B,CAAC;AAEF,MAAM,sBAAsB,GAAG;;;CAG9B,CAAC;AAEF,MAAM,sBAAsB,GAAG;;;CAG9B,CAAC;AAEF,MAAM,6BAA6B,GAAG;;;CAGrC,CAAC;AAEF,6CAA6C;AAC7C,MAAM,wBAAwB,GAAG;;CAEhC,CAAC;AAEF,mFAAmF;AACnF,4FAA4F;AAC5F,sDAAsD;AACtD,EAAE;AACF,yFAAyF;AACzF,4FAA4F;AAC5F,2DAA2D;AAC3D,MAAM,qBAAqB,GAAK,yEAAyE,CAAC;AAC1G,MAAM,sBAAsB,GAAI,oDAAoD,CAAC;AACrF,MAAM,uBAAuB,GAAG,yEAAyE,CAAC;AAC1G,MAAM,uBAAuB,GAC3B,4EAA4E,CAAC;AAgB/E,2FAA2F;AAC3F,yFAAyF;AACzF,sEAAsE;AACtE,SAAS,kBAAkB,CAAC,EAAY;IACtC,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;8CAEwC,CACzC;SACA,GAAG,EAAwB,CAAC;IAE/B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB,kFAAkF,CACnF,CAAC;IAEF,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,SAAS,GAAG,mBAAmB,CAAC;YACpC,KAAK,EAAiB,GAAG,CAAC,KAAK;YAC/B,YAAY,EAAU,GAAG,CAAC,YAAY;YACtC,QAAQ,EAAc,GAAG,CAAC,QAA4B;YACtD,QAAQ,EAAc,GAAG,CAAC,QAAQ;YAClC,EAAE,EAAoB,GAAG,CAAC,EAAE;YAC5B,SAAS,EAAa,aAAa;YACnC,OAAO,EAAe,GAAG,CAAC,OAAO;YACjC,WAAW,EAAW,GAAG,CAAC,WAAW;YACrC,WAAW,EAAW,GAAG,CAAC,WAAW;YACrC,gBAAgB,EAAM,GAAG,CAAC,gBAAgB;YAC1C,YAAY,EAAU,GAAG,CAAC,YAAY;YACtC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;YAC9C,QAAQ,EAAc,GAAG;SAC1B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAClD,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,GAA6B;IAC3C;QACE,WAAW,EAAE,CAAC;QACd,KAAK,CAAC,EAAE;YACN,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC5B,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACvB,uEAAuE;YACvE,EAAE,CAAC,OAAO,CACR,8FAA8F,CAC/F,CAAC,GAAG,EAAE,CAAC;QACV,CAAC;KACF;IACD;QACE,WAAW,EAAE,CAAC;QACd,KAAK,CAAC,EAAE;YACN,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/B,CAAC;KACF;IACD;QACE,WAAW,EAAE,CAAC;QACd,KAAK,CAAC,EAAE;YACN,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChC,CAAC;KACF;IACD;QACE,WAAW,EAAE,CAAC;QACd,KAAK,CAAC,EAAE;YACN,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;gBACtC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;KACF;IACD;QACE,WAAW,EAAE,CAAC;QACd,KAAK,CAAC,EAAE;YACN,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC/B,CAAC;KACF;IACD;QACE,WAAW,EAAE,CAAC;QACd,KAAK,CAAC,EAAE;YACN,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YACxC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC5B,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAChC,CAAC;KACF;IACD;QACE,WAAW,EAAE,CAAC;QACd,KAAK,CAAC,EAAE;YACN,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC1B,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACjC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YAChC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YAChC,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACzC,CAAC;KACF;IACD;QACE,WAAW,EAAE,CAAC;QACd,KAAK,CAAC,EAAE;YACN,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QACpD,CAAC;KACF;IACD;QACE,+FAA+F;QAC/F,+FAA+F;QAC/F,qEAAqE;QACrE,WAAW,EAAE,CAAC;QACd,KAAK,CAAC,EAAE;YACN,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAAE,CAAC;YACxC,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAAG,EAAE,CAAC;YACzC,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,EAAE,CAAC;YAC1C,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACvB,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5C,CAAC;KACF;IACD;QACE,+EAA+E;QAC/E,4DAA4D;QAC5D,0FAA0F;QAC1F,wFAAwF;QACxF,WAAW,EAAE,CAAC;QACd,KAAK,CAAC,EAAE;YACN,EAAE,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC,GAAG,EAAE,CAAC;YACnF,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,EAAE,CAAC;QACvE,CAAC;KACF;CACF,CAAC;AAEF,iFAAiF;AACjF,wDAAwD;AAExD,MAAM,UAAU,mBAAmB,CACjC,EAAY;IAEZ,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,cAAc,GAAG,IAAI,GAAG,CAE1B,EAAE;SACC,OAAO,CAAC,mDAAmD,CAAC;SAC5D,GAAG,EACP,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACrB,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,iFAAiF;IACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7D,MAAM,YAAY,GAAG,IAAI,GAAG,CACzB,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,GAAG,CAAwB,CAAC,GAAG,CAC3D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CACF,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAE3B,EAAE;aACC,OAAO,CAAC,mDAAmD,CAAC;aAC5D,GAAG,EACP,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACrB,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACnC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtE,CAAC;AAED,wDAAwD;AACxD,SAAS,mBAAmB,CAAC,EAAY;IACvC,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,IAAI,kBAAkB,gCAAgC;YACpD,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3C,EACD,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,yEAAyE;AACzE,wFAAwF;AAExF,SAAS,qBAAqB,CAAC,EAAY;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAElB,EAAE;SACC,OAAO,CAAC,mDAAmD,CAAC;SAC5D,GAAG,EACP,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACrB,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,2CAA2C;IAChF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,CAAC,CAAC;IAErC,MAAM,UAAU,GAAG,IAAI,GAAG,CACvB,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC5E,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,CAAC,CAAC;IAEvC,mDAAmD;IACnD,MAAM,SAAS,GAAG,IAAI,GAAG,CACtB,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACnF,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,CAAC,CAAC;IAE1C,yFAAyF;IACzF,sFAAsF;IACtF,4FAA4F;IAC5F,8FAA8F;IAC9F,gDAAgD;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,CACtB,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACpF,CAAC;IACF,MAAM,oBAAoB,GAAsB;QAC9C,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU;QAC/D,aAAa,EAAE,sBAAsB,EAAE,cAAc,EAAE,kBAAkB;QACzE,cAAc;KACf,CAAC;IACF,MAAM,YAAY,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,IAAI,sBAAsB,gDAAgD;YACxE,oCAAoC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7F,mDAAmD,CACtD,EACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,CACtF,CAAC;IACJ,CAAC;IAED,8DAA8D;IAC9D,8CAA8C;IAC9C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,CAAC;IAEzE,0DAA0D;IAC1D,4BAA4B;IAC5B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,CAAC,CAAC;IAEhF,sCAAsC;IACtC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,iFAAiF;AACjF,yDAAyD;AACzD,+CAA+C;AAE/C,SAAS,uBAAuB,CAAC,EAAY;IAC3C,0DAA0D;IAC1D,sFAAsF;IACtF,6DAA6D;IAE7D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAE3C,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACxC,qEAAqE;QACrE,yDAAyD;QACzD,MAAM,YAAY,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,kFAAkF;YAClF,gDAAgD;YAChD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,IAAI,sBAAsB,mDAAmD;gBAC3E,oBAAoB,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACvD,mDAAmD,CACtD,EACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,sFAAsF;QACtF,qBAAqB,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAClD,OAAO,sBAAsB,CAAC;IAChC,CAAC;IAED,sFAAsF;IACtF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iFAAiF;AAEjF,SAAS,qBAAqB,CAAC,EAAY,EAAE,OAAe;IAC1D,EAAE,CAAC,OAAO,CACR,iFAAiF,CAClF,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,iFAAiF;AAEjF,SAAS,sBAAsB,CAAC,EAAY,EAAE,WAAmB;IAC/D,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,yEAAyE;IACzE,2FAA2F;IAC3F,mFAAmF;IACnF,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,qBAAqB,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAClD,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,aAAa,CAAC,EAAY;IACxC,+EAA+E;IAC/E,MAAM,OAAO,GAAG,EAAE;SACf,OAAO,CAAC,0EAA0E,CAAC;SACnF,GAAG,EAAkC,CAAC;IAEzC,MAAM,OAAO,GAAW,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,CAAC,sBAAsB;QAE9C,MAAM,GAAG,GAAG,EAAE;aACX,OAAO,CAAC,+DAA+D,CAAC;aACxE,GAAG,EAAmC,CAAC;QAE1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,0DAA0D;YAC1D,4EAA4E;YAC5E,gDAAgD;YAChD,uFAAuF;YACvF,OAAO,uBAAuB,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,OAAO,GAAG,sBAAsB,EAAE,CAAC;QACrC,8DAA8D;QAC9D,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,IAAI,gBAAgB,gCAAgC,OAAO,WAAW;YACpE,kBAAkB,sBAAsB,IAAI;YAC5C,wDAAwD,CAC3D,EACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,sBAAsB,EAAE,CAAC;QACrC,sBAAsB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,yDAAyD;IACzD,sFAAsF;IACtF,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC"}

package/dist/persistence/sqlite/schema.d.ts

@@ -0,0 +1,10 @@
+import type { Database } from "better-sqlite3";
+export declare const SCHEMA_VERSION = "sqlite-claims-v1";
+export declare const SERIALIZER_VERSION = "claim-serializer-v1";
+export declare const CLAIMS_DDL = "\nCREATE TABLE IF NOT EXISTS claims (\n  id                 TEXT    PRIMARY KEY,\n  source_id          TEXT    NOT NULL,\n  subject            TEXT    NOT NULL,\n  predicate          TEXT    NOT NULL,\n  valid_from         TEXT    NOT NULL,\n  valid_to           TEXT,\n  recorded_at        TEXT    NOT NULL,\n  recorded_seq       INTEGER NOT NULL UNIQUE,\n  retracts           TEXT,\n  supersedes         TEXT,\n  overrides          TEXT,\n  contract_id        TEXT,\n  confidence         REAL,\n  serializer_version TEXT    NOT NULL,\n  encrypted_payload  TEXT    NOT NULL\n) STRICT;\n";
+export declare const SCHEMA_META_DDL = "\nCREATE TABLE IF NOT EXISTS schema_meta (\n  key   TEXT PRIMARY KEY,\n  value TEXT NOT NULL\n) STRICT;\n";
+export declare const SOURCES_DDL = "\nCREATE TABLE IF NOT EXISTS sources (\n  id             TEXT PRIMARY KEY,\n  kind           TEXT NOT NULL,\n  label          TEXT NOT NULL,\n  status         TEXT NOT NULL DEFAULT 'active',\n  created_at     TEXT NOT NULL,\n  created_by     TEXT NOT NULL,\n  evidence_id    TEXT,\n  evidence_uri   TEXT,\n  evidence_hash  TEXT,\n  evidence_mime  TEXT,\n  evidence_enc   INTEGER,\n  metadata       TEXT\n) STRICT;\n";
+export declare const RAW_DOCUMENTS_DDL = "\nCREATE TABLE IF NOT EXISTS raw_documents (\n  id             TEXT    PRIMARY KEY,\n  mime_type      TEXT    NOT NULL,\n  byte_length    INTEGER NOT NULL,\n  label          TEXT,\n  created_at     TEXT    NOT NULL,\n  created_by     TEXT    NOT NULL,\n  encrypted_blob TEXT    NOT NULL,\n  metadata       TEXT\n) STRICT;\n";
+export declare const AUDIT_EVENTS_DDL = "\nCREATE TABLE IF NOT EXISTS audit_events (\n  id                   TEXT    PRIMARY KEY,\n  recorded_at          TEXT    NOT NULL,\n  actor                TEXT    NOT NULL,\n  grant_id             TEXT,\n  purpose              TEXT,\n  decision             TEXT    NOT NULL,\n  reason_code          TEXT    NOT NULL,\n  selector_fingerprint TEXT    NOT NULL,\n  result_count         INTEGER NOT NULL,\n  result_claim_ids     TEXT    NOT NULL,\n  contract_ids         TEXT\n) STRICT;\n";
+export declare function initializeSchema(db: Database): void;
+export declare function getSchemaVersion(db: Database): string | undefined;

package/dist/persistence/sqlite/schema.js

@@ -0,0 +1,101 @@
+// SQLite schema for the claims table.
+//
+// SQLITE_SCHEMA_VERSIONED_001: schema version tracked in schema_meta table.
+// SQLITE_APPEND_ONLY_001: no UPDATE or DELETE statements anywhere in this module.
+// SQLITE_PAYLOAD_ENCRYPTED_AT_REST_001: encrypted_payload column stores ciphertext only.
+//
+// Column layout:
+//   Metadata columns  — plaintext (CRYPTO_METADATA_PLAINTEXT_ACCEPTED_001)
+//   encrypted_payload — JSON-serialized EncryptedBlob (AES-256-GCM ciphertext)
+//   serializer_version — "claim-serializer-v1" (SQLITE_SCHEMA_VERSIONED_001)
+import { runMigrations } from "./migrations.js";
+export const SCHEMA_VERSION = "sqlite-claims-v1";
+export const SERIALIZER_VERSION = "claim-serializer-v1";
+export const CLAIMS_DDL = `
+CREATE TABLE IF NOT EXISTS claims (
+  id                 TEXT    PRIMARY KEY,
+  source_id          TEXT    NOT NULL,
+  subject            TEXT    NOT NULL,
+  predicate          TEXT    NOT NULL,
+  valid_from         TEXT    NOT NULL,
+  valid_to           TEXT,
+  recorded_at        TEXT    NOT NULL,
+  recorded_seq       INTEGER NOT NULL UNIQUE,
+  retracts           TEXT,
+  supersedes         TEXT,
+  overrides          TEXT,
+  contract_id        TEXT,
+  confidence         REAL,
+  serializer_version TEXT    NOT NULL,
+  encrypted_payload  TEXT    NOT NULL
+) STRICT;
+`;
+export const SCHEMA_META_DDL = `
+CREATE TABLE IF NOT EXISTS schema_meta (
+  key   TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+) STRICT;
+`;
+// SOURCE_REGISTRY_EXISTS_001: source records are plaintext (MVP accepted risk — no PII here).
+export const SOURCES_DDL = `
+CREATE TABLE IF NOT EXISTS sources (
+  id             TEXT PRIMARY KEY,
+  kind           TEXT NOT NULL,
+  label          TEXT NOT NULL,
+  status         TEXT NOT NULL DEFAULT 'active',
+  created_at     TEXT NOT NULL,
+  created_by     TEXT NOT NULL,
+  evidence_id    TEXT,
+  evidence_uri   TEXT,
+  evidence_hash  TEXT,
+  evidence_mime  TEXT,
+  evidence_enc   INTEGER,
+  metadata       TEXT
+) STRICT;
+`;
+// RAW_DOCUMENT_BYTES_ENCRYPTED_AT_REST_001: encrypted_blob holds JSON EncryptedBlob only.
+// RAW_DOCUMENT_METADATA_PLAINTEXT_ACCEPTED_001: id/mime_type/byte_length/label/created_* are plaintext.
+export const RAW_DOCUMENTS_DDL = `
+CREATE TABLE IF NOT EXISTS raw_documents (
+  id             TEXT    PRIMARY KEY,
+  mime_type      TEXT    NOT NULL,
+  byte_length    INTEGER NOT NULL,
+  label          TEXT,
+  created_at     TEXT    NOT NULL,
+  created_by     TEXT    NOT NULL,
+  encrypted_blob TEXT    NOT NULL,
+  metadata       TEXT
+) STRICT;
+`;
+// AUDIT_DURABLE_SINK_EXISTS_001: audit_events table is append-only.
+// AUDIT_EVENT_NO_PAYLOAD_VALUES_001: no payload or document-bytes column — safe metadata only.
+// AUDIT_EVENT_NO_RAW_DOCUMENT_BYTES_001: encrypted_blob / plainBytes columns are absent by design.
+// AUDIT_EVENT_SELECTOR_FINGERPRINT_ONLY_001: selector_fingerprint stores a string summary, not the full selector.
+// AUDIT_EVENTS_APPEND_ONLY_001: INSERT only — no UPDATE or DELETE rows in schema or implementation.
+export const AUDIT_EVENTS_DDL = `
+CREATE TABLE IF NOT EXISTS audit_events (
+  id                   TEXT    PRIMARY KEY,
+  recorded_at          TEXT    NOT NULL,
+  actor                TEXT    NOT NULL,
+  grant_id             TEXT,
+  purpose              TEXT,
+  decision             TEXT    NOT NULL,
+  reason_code          TEXT    NOT NULL,
+  selector_fingerprint TEXT    NOT NULL,
+  result_count         INTEGER NOT NULL,
+  result_claim_ids     TEXT    NOT NULL,
+  contract_ids         TEXT
+) STRICT;
+`;
+export function initializeSchema(db) {
+    db.pragma("journal_mode = WAL");
+    db.pragma("foreign_keys = ON");
+    runMigrations(db); // SQLITE_MIGRATION_RUNNER_EXISTS_001
+}
+export function getSchemaVersion(db) {
+    const row = db
+        .prepare("SELECT value FROM schema_meta WHERE key = 'schema_version'")
+        .get();
+    return row?.value;
+}
+//# sourceMappingURL=schema.js.map