life-as-api 0.2.0

package/dist/sdk/create-sqlite-life-api.js

@@ -0,0 +1,654 @@
+// Production factory — readiness gate + final assembly.
+// Production-01a (AUTH_HOST_ADAPTER_REQUIRED_001)
+// Production-02c-a (AUTH_TENANT_BOUNDARY_REQUIRED_001, AUTH_GRANT_RESOLVER_REQUIRED_001)
+// Production-05-a (db guard, encryptionKey guard, DB-version assertion, readiness-blocked)
+// Production-06d-c-a (async durable ProposalQueue construction proof, ASSEMBLY_DEFERRED_001)
+// Production-06d-d-d (final assembly: steps 15–19, Promise<ProductionApiBundle>)
+//
+// AUTH_HOST_ADAPTER_REQUIRED_001: factory requires an AuthAdapter; missing config or
+//   missing authAdapter throws before any other guard fires.
+// AUTH_TENANT_BOUNDARY_REQUIRED_001: requires a TenantBoundary; thrown after authAdapter
+//   guard.
+// AUTH_GRANT_RESOLVER_REQUIRED_001: requires a GrantResolver; thrown after tenantBoundary
+//   guard.
+// PRODUCTION_FACTORY_DB_REQUIRED_001: requires a pre-migrated Database; thrown after
+//   grantResolver guard.
+// PRODUCTION_FACTORY_ENCRYPTION_KEY_REQUIRED_001: requires an encryptionKey; thrown after
+//   db guard.
+// PRODUCTION_FACTORY_ENCRYPTION_KEY_TOO_SHORT_001: rawBytes must be >= 32 bytes; thrown
+//   after encryptionKey-present check.
+// PRODUCTION_FACTORY_ENCRYPTION_KEY_ID_INVALID_001: keyId must be a non-empty string;
+//   thrown after rawBytes length check.
+// PRODUCTION_FACTORY_ENCRYPTION_SOURCE_AMBIGUOUS_001: thrown when both keyProvider and
+//   encryptionKey are provided simultaneously. Fail-closed — no partial construction.
+// PRODUCTION_FACTORY_KEY_PROVIDER_INVALID_001: thrown when keyProvider is present but null,
+//   non-object, or missing getCurrentKey/getKey methods.
+// PRODUCTION_FACTORY_DB_NOT_READY_001: thrown after keyId check when (a) migration_version
+//   is absent or ≠ CURRENT_SCHEMA_VERSION, or (b) verifyCurrentSchema() detects missing
+//   tables or columns (e.g. auth_tenant_memberships, auth_grants). migration_version alone
+//   is insufficient — structural verification is always required.
+// RAW_DOCUMENT_STORE_FACTORY_COMPATIBLE_REQUIRED_001: rawDocumentStore must be a
+//   FactoryCompatibleRawDocumentStore; missing or non-compatible instance throws at step 9
+//   before READINESS_BLOCKED (Production-06c).
+// RAW_DOCUMENT_STORE_INMEMORY_REJECTED_001: thrown at step 9.5 when rawDocumentStore lacks
+//   the factory-compatible durable marker — defense-in-depth against TS casts.
+// AUDIT_LOG_FACTORY_COMPATIBLE_REQUIRED_001: auditLog must be a FactoryCompatibleAuditLog;
+//   missing or non-compatible instance throws at step 10 (Production-06c).
+// AUDIT_LOG_INMEMORY_OR_NOOP_REJECTED_001: thrown at step 10.5 when auditLog lacks the
+//   durable marker — InMemoryAuditLog, noop, and test-only sinks not accepted.
+// PRODUCTION_FACTORY_READINESS_BLOCKED_001: historical — was thrown at step 11
+//   (Production-06c / Production-05-a) when all core deps were valid but ProposalQueue was
+//   not yet wired. Superseded at step 11 by Production-06d-c-a (durable construction proof
+//   + PRODUCTION_FACTORY_ASSEMBLY_DEFERRED_001).
+// PRODUCTION_FACTORY_PROPOSAL_QUEUE_COMPATIBLE_REQUIRED_001: thrown at step 11 when the
+//   constructed SQLiteProposalQueue does not carry the factoryCompatible marker
+//   ("durable-proposal-queue"). Defense-in-depth against casts and non-standard impls.
+// PRODUCTION_FACTORY_ASSEMBLY_DEFERRED_001: superseded by Production-06d-d-d.
+//   Was thrown at step 11 after all deps validated. Now replaced by bundle return.
+//   See PRODUCTION_FACTORY_ASSEMBLY_DEFERRED_SUPERSEDED_001 in INVARIANTS.md.
+// PRODUCTION_FACTORY_SCOPED_API_TRUST_GATED_001: createScopedApi calls
+//   issuer.assertTrusted(mintedCtx.context) before constructing ProductionScopedLifeApiImpl.
+//   Rejects manually constructed AccessContext objects and contexts from other factory
+//   invocations at capability creation time — not deferred to first method call.
+// PRODUCTION_FACTORY_ISSUER_API_PAIRING_001: AccessContextIssuer and LifeApiImpl are
+//   co-created in the same factory call; the issuer WeakSet is private to this invocation.
+// PRODUCTION_FACTORY_RAW_API_NOT_RETURNED_001: LifeApiImpl (rawApi) is sealed in the
+//   createScopedApi closure and never returned as a public value.
+// PRODUCTION_FACTORY_ASYNC_DEFERRED_BOUNDARY_001: createSQLiteLifeApiForProduction is
+//   async (Promise<ProductionApiBundle>); required by StaticKeyProvider.fromRawBytes
+//   (WebCrypto importKey) and SQLiteProposalQueue.open (static async).
+//
+// PRODUCTION_FACTORY_STILL_STUB_001: superseded by Production-05-a. The factory is no
+//   longer a stub — it is a readiness gate. See docs/INVARIANTS.md for historical record.
+//
+// Validation order (SPEC-b §6 + Production-06c + Production-06d-c-a):
+//   1. missing config                  → AUTH_HOST_ADAPTER_REQUIRED_001
+//   2. missing authAdapter             → AUTH_HOST_ADAPTER_REQUIRED_001
+//   3. missing tenantBoundary          → AUTH_TENANT_BOUNDARY_REQUIRED_001
+//   4. missing grantResolver           → AUTH_GRANT_RESOLVER_REQUIRED_001
+//   5. missing db                      → PRODUCTION_FACTORY_DB_REQUIRED_001
+//   6.  both keyProvider and encryptionKey → PRODUCTION_FACTORY_ENCRYPTION_SOURCE_AMBIGUOUS_001
+//   6.5 keyProvider present, invalid    → PRODUCTION_FACTORY_KEY_PROVIDER_INVALID_001
+//   6.6 neither provided               → PRODUCTION_FACTORY_ENCRYPTION_KEY_REQUIRED_001
+//   7.  rawBytes.length < 32           → PRODUCTION_FACTORY_ENCRYPTION_KEY_TOO_SHORT_001
+//   7.5 keyId not non-empty            → PRODUCTION_FACTORY_ENCRYPTION_KEY_ID_INVALID_001
+//   8. DB not structurally current    → PRODUCTION_FACTORY_DB_NOT_READY_001
+//   9. missing rawDocumentStore        → RAW_DOCUMENT_STORE_FACTORY_COMPATIBLE_REQUIRED_001
+//   9.5 rawDocumentStore wrong marker  → RAW_DOCUMENT_STORE_INMEMORY_REJECTED_001
+//   10. missing auditLog               → AUDIT_LOG_FACTORY_COMPATIBLE_REQUIRED_001
+//   10.5 auditLog wrong marker         → AUDIT_LOG_INMEMORY_OR_NOOP_REJECTED_001
+//   11. construct durable chain + open SQLiteProposalQueue:
+//       marker fail → PRODUCTION_FACTORY_PROPOSAL_QUEUE_COMPATIBLE_REQUIRED_001
+//       all valid → steps 15–19 (assembly) → return ProductionApiBundle
+//
+// AUTH_FACTORY_AUTH_ADAPTER_OPAQUE_001: this file must not import JwtAuthAdapter,
+//   JwtKeyRingAuthAdapter, StaticJwtKeyRing, or jwt-core. The factory is AuthAdapter-opaque.
+// PRODUCTION_FACTORY_DB_PRE_MIGRATED_001: the factory never calls runMigrations; the host
+//   must call runMigrations(db) before passing db to this factory.
+// PRODUCTION_FACTORY_NO_SECRET_LOGGING_001: rawBytes is never included in error messages,
+//   error properties, log statements, or serialized forms.
+// PRODUCTION_FACTORY_JWT_AND_AT_REST_KEYS_SEPARATE_001: encryptionKey.rawBytes is never
+//   passed to any JWT component.
+//
+// Platform-02 (TrustedDataSourceRegistry + ProposalPolicy) codes:
+// PROPOSAL_POLICY_OPTIONAL_NO_CHECK_WHEN_ABSENT_001: neither trustedDataSourceRegistry nor
+//   proposalPolicy set → effectiveQueue === queue; behavior is byte-identical to today.
+// PROPOSAL_POLICY_EXPLICIT_WINS_OVER_REGISTRY_001: explicit config.proposalPolicy wins over
+//   the trustedDataSourceRegistry convenience wiring when both are provided.
+import { safeLog } from "../observability/logger.js";
+import { safeRecord } from "../observability/metrics.js";
+import { CURRENT_SCHEMA_VERSION, verifyCurrentSchema } from "../persistence/sqlite/migrations.js";
+import { StaticKeyProvider } from "../crypto/static-key.js";
+import { AesGcmCryptoBoundary } from "../crypto/aes-gcm.js";
+import { ClaimSerializer } from "../crypto/claim-serializer.js";
+import { SQLiteFactStore } from "../persistence/sqlite/sqlite-fact-store.js";
+import { SQLiteSourceRegistry } from "../persistence/sqlite/sqlite-source-registry.js";
+import { SQLiteUnitOfWork } from "../persistence/sqlite/sqlite-unit-of-work.js";
+import { SQLiteAuditLog } from "../audit/sqlite-audit-log.js";
+import { SourceAwareFactStore } from "../source/source-aware-fact-store.js";
+import { SourceAwareClaimAppender } from "../proposal/source-aware-claim-appender.js";
+import { GrantRegistry } from "../consent/grant-registry.js";
+import { SQLiteProposalQueue } from "../proposal/sqlite-proposal-queue.js";
+import { EvidenceBackedContextQueryService } from "../surface/evidence-backed-context-query.js";
+import { EvidenceBackedClaimCreator } from "../evidence/evidence-backed-claim-creator.js";
+import { AccessContextIssuer } from "../auth/access-context-issuer.js";
+import { LifeApiImpl } from "./create-life-api.js";
+import { DefaultAuthorizationPolicy } from "../auth/default-authorization-policy.js";
+import { BackendContextMintingBoundary } from "../auth/backend-context-minting-boundary.js";
+import { StaticTrustTable } from "../resolution/trust-profile.js";
+import { ProductionScopedLifeApiImpl } from "../auth/production-scoped-life-api.js";
+import { RegistryBackedProposalPolicy } from "../proposal/proposal-policy.js";
+import { PolicyAwareProposalQueue } from "../proposal/policy-aware-proposal-queue.js";
+export async function createSQLiteLifeApiForProduction(config) {
+    // Steps 1–2: authAdapter guard.
+    if (config == null || config.authAdapter == null) {
+        // If config is non-null, logger/metrics may be present — emit diagnostics before throwing.
+        if (config != null) {
+            safeLog(config.logger, {
+                level: "error", code: "LOG_AUTH_ADAPTER_MISSING_001",
+                component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+                message: "factory readiness failed: authAdapter missing",
+                timestamp: new Date().toISOString(),
+            });
+            safeRecord(config.metrics, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+                status: "failed", errorCode: "AUTH_HOST_ADAPTER_REQUIRED_001" });
+        }
+        throw Object.assign(new Error("AUTH_HOST_ADAPTER_REQUIRED_001: createSQLiteLifeApiForProduction requires " +
+            "an AuthAdapter. Provide an implementation that verifies external credentials " +
+            "before minting trusted AccessContexts. Without an AuthAdapter, the minting " +
+            "boundary cannot enforce authentication — do not omit this argument."), { code: "AUTH_HOST_ADAPTER_REQUIRED_001" });
+    }
+    // Extract logger and metrics recorder once — available from step 3 onward.
+    const logger = config.logger;
+    const metricsRecorder = config.metrics;
+    // Step 3: tenantBoundary guard.
+    if (config.tenantBoundary == null) {
+        safeLog(logger, {
+            level: "error", code: "LOG_FACTORY_READINESS_FAILED_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "factory readiness failed: tenantBoundary missing",
+            timestamp: new Date().toISOString(),
+        });
+        safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+            status: "failed", errorCode: "AUTH_TENANT_BOUNDARY_REQUIRED_001" });
+        throw Object.assign(new Error("AUTH_TENANT_BOUNDARY_REQUIRED_001: createSQLiteLifeApiForProduction requires " +
+            "a TenantBoundary. Every OwnerContext mint must pass a pre-mint tenant-ownership " +
+            "check. Without a TenantBoundary, the factory cannot enforce tenant isolation."), { code: "AUTH_TENANT_BOUNDARY_REQUIRED_001" });
+    }
+    // Step 4: grantResolver guard.
+    if (config.grantResolver == null) {
+        safeLog(logger, {
+            level: "error", code: "LOG_FACTORY_READINESS_FAILED_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "factory readiness failed: grantResolver missing",
+            timestamp: new Date().toISOString(),
+        });
+        safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+            status: "failed", errorCode: "AUTH_GRANT_RESOLVER_REQUIRED_001" });
+        throw Object.assign(new Error("AUTH_GRANT_RESOLVER_REQUIRED_001: createSQLiteLifeApiForProduction requires " +
+            "a GrantResolver. Every AgentConsentContext mint requires a resolved, unexpired, " +
+            "tenant-scoped grant. Without a GrantResolver, the factory cannot enforce agent " +
+            "grant scope — do not omit this argument."), { code: "AUTH_GRANT_RESOLVER_REQUIRED_001" });
+    }
+    // Step 5: db guard (PRODUCTION_FACTORY_DB_REQUIRED_001).
+    if (config.db == null) {
+        safeLog(logger, {
+            level: "error", code: "LOG_FACTORY_READINESS_FAILED_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "factory readiness failed: db missing",
+            timestamp: new Date().toISOString(),
+        });
+        safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+            status: "failed", errorCode: "PRODUCTION_FACTORY_DB_REQUIRED_001" });
+        throw Object.assign(new Error("PRODUCTION_FACTORY_DB_REQUIRED_001: createSQLiteLifeApiForProduction requires " +
+            "a pre-migrated Database instance. Call runMigrations(db) on a better-sqlite3 " +
+            "Database before passing it to the factory. The factory does not open database " +
+            "files by path and does not run migrations itself."), { code: "PRODUCTION_FACTORY_DB_REQUIRED_001" });
+    }
+    // Step 6: encryption source — exactly one of keyProvider or encryptionKey must be provided.
+    // PRODUCTION_KMS_ADAPTER_AMBIGUOUS_CONFIG_REJECTED_001: both present → fail closed.
+    // PRODUCTION_KMS_ADAPTER_FACTORY_ACCEPTS_KEYPROVIDER_001: keyProvider path.
+    // PRODUCTION_FACTORY_NO_SECRET_LOGGING_001: no key material in any error or log event.
+    const hasKeyProvider = config.keyProvider != null;
+    const hasEncryptionKey = config.encryptionKey != null;
+    if (hasKeyProvider && hasEncryptionKey) {
+        safeLog(logger, {
+            level: "error", code: "LOG_FACTORY_READINESS_FAILED_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "factory readiness failed: both keyProvider and encryptionKey supplied — provide exactly one",
+            timestamp: new Date().toISOString(),
+            // No key material, no keyId — PRODUCTION_FACTORY_NO_SECRET_LOGGING_001
+        });
+        safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+            status: "failed", errorCode: "PRODUCTION_FACTORY_ENCRYPTION_SOURCE_AMBIGUOUS_001" });
+        throw Object.assign(new Error("PRODUCTION_FACTORY_ENCRYPTION_SOURCE_AMBIGUOUS_001: " +
+            "createSQLiteLifeApiForProduction received both keyProvider and encryptionKey. " +
+            "Supply exactly one encryption source: keyProvider (for an externally managed " +
+            "KeyProvider) or encryptionKey (for a StaticKeyProvider from raw bytes). " +
+            "Providing both is ambiguous and is rejected fail-closed."), { code: "PRODUCTION_FACTORY_ENCRYPTION_SOURCE_AMBIGUOUS_001" });
+    }
+    // Step 6.5: keyProvider structural validation.
+    // PRODUCTION_KMS_ADAPTER_INVALID_KEYPROVIDER_REJECTED_001
+    if (hasKeyProvider) {
+        const kp = config.keyProvider;
+        if (typeof kp !== "object" ||
+            typeof kp.getCurrentKey !== "function" ||
+            typeof kp.getKey !== "function") {
+            safeLog(logger, {
+                level: "error", code: "LOG_FACTORY_READINESS_FAILED_001",
+                component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+                message: "factory readiness failed: keyProvider is not a valid KeyProvider",
+                timestamp: new Date().toISOString(),
+                // No key material, no keyId — PRODUCTION_FACTORY_NO_SECRET_LOGGING_001
+            });
+            safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+                status: "failed", errorCode: "PRODUCTION_FACTORY_KEY_PROVIDER_INVALID_001" });
+            throw Object.assign(new Error("PRODUCTION_FACTORY_KEY_PROVIDER_INVALID_001: the supplied keyProvider is not a " +
+                "valid KeyProvider. A KeyProvider must be a non-null object with getCurrentKey() " +
+                "and getKey() methods. Provide an implementation of the KeyProvider interface."), { code: "PRODUCTION_FACTORY_KEY_PROVIDER_INVALID_001" });
+        }
+        // keyProvider is structurally valid — will be used at assembly time.
+    }
+    else if (!hasEncryptionKey) {
+        // Step 6.6: neither provided — PRODUCTION_FACTORY_ENCRYPTION_KEY_REQUIRED_001.
+        safeLog(logger, {
+            level: "error", code: "LOG_ENCRYPTION_KEY_INVALID_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "factory readiness failed: neither keyProvider nor encryptionKey provided",
+            timestamp: new Date().toISOString(),
+        });
+        safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+            status: "failed", errorCode: "PRODUCTION_FACTORY_ENCRYPTION_KEY_REQUIRED_001" });
+        throw Object.assign(new Error("PRODUCTION_FACTORY_ENCRYPTION_KEY_REQUIRED_001: createSQLiteLifeApiForProduction " +
+            "requires an encryption source. Provide either: keyProvider (a KeyProvider " +
+            "implementation) or encryptionKey ({ keyId: string, rawBytes: Uint8Array } with " +
+            "rawBytes of at least 32 bytes). The factory uses AES-256-GCM encryption at rest."), { code: "PRODUCTION_FACTORY_ENCRYPTION_KEY_REQUIRED_001" });
+    }
+    else {
+        // Step 7: rawBytes length guard (PRODUCTION_FACTORY_ENCRYPTION_KEY_TOO_SHORT_001).
+        // PRODUCTION_FACTORY_NO_SECRET_LOGGING_001: rawBytes never included in message or log.
+        const encKey = config.encryptionKey;
+        if (!(encKey.rawBytes instanceof Uint8Array) ||
+            encKey.rawBytes.length < 32) {
+            safeLog(logger, {
+                level: "error", code: "LOG_ENCRYPTION_KEY_INVALID_001",
+                component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+                message: "factory readiness failed: encryptionKey.rawBytes validation failed",
+                timestamp: new Date().toISOString(),
+                // No rawBytes, no key length, no keyId — PRODUCTION_FACTORY_NO_SECRET_LOGGING_001
+            });
+            safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+                status: "failed", errorCode: "PRODUCTION_FACTORY_ENCRYPTION_KEY_TOO_SHORT_001" });
+            throw Object.assign(new Error("PRODUCTION_FACTORY_ENCRYPTION_KEY_TOO_SHORT_001: encryptionKey.rawBytes must " +
+                "be a Uint8Array of at least 32 bytes for AES-256-GCM. Supply a 32-byte or " +
+                "longer Uint8Array derived from a cryptographically secure key source."), { code: "PRODUCTION_FACTORY_ENCRYPTION_KEY_TOO_SHORT_001" });
+        }
+        // Step 7.5: keyId must be a non-empty string (PRODUCTION_FACTORY_ENCRYPTION_KEY_ID_INVALID_001).
+        if (typeof encKey.keyId !== "string" || encKey.keyId.length === 0) {
+            safeLog(logger, {
+                level: "error", code: "LOG_ENCRYPTION_KEY_INVALID_001",
+                component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+                message: "factory readiness failed: encryptionKey.keyId validation failed",
+                timestamp: new Date().toISOString(),
+                // No keyId value emitted — PRODUCTION_FACTORY_NO_SECRET_LOGGING_001
+            });
+            safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+                status: "failed", errorCode: "PRODUCTION_FACTORY_ENCRYPTION_KEY_ID_INVALID_001" });
+            throw Object.assign(new Error("PRODUCTION_FACTORY_ENCRYPTION_KEY_ID_INVALID_001: encryptionKey.keyId must be a " +
+                "non-empty string identifying the key version (e.g. 'key-v1', 'prod-2026-01'). " +
+                "Provide a stable, non-empty string identifier for the supplied rawBytes material."), { code: "PRODUCTION_FACTORY_ENCRYPTION_KEY_ID_INVALID_001" });
+        }
+    }
+    // Step 8: DB readiness — migration_version assertion + full structural verification.
+    // migration_version alone is insufficient: a DB claiming current version but missing
+    // auth_tenant_memberships or auth_grants must fail closed.
+    // The factory does NOT run migrations — the caller must have called runMigrations(db).
+    // PRODUCTION_FACTORY_DB_NOT_READY_001 — PRODUCTION_FACTORY_DB_PRE_MIGRATED_001
+    const dbVersionRow = (() => {
+        try {
+            return config.db
+                .prepare("SELECT value FROM schema_meta WHERE key = 'migration_version'")
+                .get();
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    const dbVersion = dbVersionRow !== undefined ? parseInt(dbVersionRow.value, 10) : NaN;
+    if (!Number.isFinite(dbVersion) || dbVersion !== CURRENT_SCHEMA_VERSION) {
+        const found = Number.isFinite(dbVersion) ? String(dbVersion) : "(absent)";
+        safeLog(logger, {
+            level: "error", code: "LOG_SCHEMA_NOT_READY_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "factory readiness failed: schema version mismatch",
+            timestamp: new Date().toISOString(),
+        });
+        safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+            status: "failed", errorCode: "PRODUCTION_FACTORY_DB_NOT_READY_001" });
+        throw Object.assign(new Error(`PRODUCTION_FACTORY_DB_NOT_READY_001: The supplied database has ` +
+            `migration_version ${found}, but this factory requires ` +
+            `migration_version ${CURRENT_SCHEMA_VERSION}. ` +
+            `Call runMigrations(db) before passing the database to the production factory.`), { code: "PRODUCTION_FACTORY_DB_NOT_READY_001", found, required: CURRENT_SCHEMA_VERSION });
+    }
+    // Full structural verification — migration_version alone is insufficient.
+    // A DB claiming migration_version 6 but missing auth_tenant_memberships or auth_grants
+    // must fail closed (SQLITE_MIGRATION_CURRENT_SCHEMA_STRUCTURAL_VERIFY_001).
+    const structuralCheck = verifyCurrentSchema(config.db);
+    if (!structuralCheck.ok) {
+        safeLog(logger, {
+            level: "error", code: "LOG_SCHEMA_NOT_READY_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "factory readiness failed: schema structural verification failed",
+            timestamp: new Date().toISOString(),
+        });
+        safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+            status: "failed", errorCode: "PRODUCTION_FACTORY_DB_NOT_READY_001" });
+        throw Object.assign(new Error(`PRODUCTION_FACTORY_DB_NOT_READY_001: The supplied database claims ` +
+            `migration_version ${CURRENT_SCHEMA_VERSION} but fails structural verification. ` +
+            `Missing tables or columns: ${structuralCheck.missing.join(", ")}. ` +
+            `Call runMigrations(db) before passing the database to the production factory.`), {
+            code: "PRODUCTION_FACTORY_DB_NOT_READY_001",
+            found: String(CURRENT_SCHEMA_VERSION),
+            required: CURRENT_SCHEMA_VERSION,
+            missing: [...structuralCheck.missing],
+        });
+    }
+    // Step 9: rawDocumentStore must be present and factory-compatible.
+    // RAW_DOCUMENT_STORE_FACTORY_COMPATIBLE_REQUIRED_001
+    if (config.rawDocumentStore == null) {
+        safeLog(logger, {
+            level: "error", code: "LOG_FACTORY_READINESS_FAILED_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "factory readiness failed: rawDocumentStore missing",
+            timestamp: new Date().toISOString(),
+        });
+        safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+            status: "failed", errorCode: "RAW_DOCUMENT_STORE_FACTORY_COMPATIBLE_REQUIRED_001" });
+        throw Object.assign(new Error("RAW_DOCUMENT_STORE_FACTORY_COMPATIBLE_REQUIRED_001: createSQLiteLifeApiForProduction " +
+            "requires a FactoryCompatibleRawDocumentStore. Provide a SQLiteRawDocumentStore or a " +
+            "custom implementation that declares factoryCompatible: \"durable-raw-document-store\". " +
+            "InMemoryRawDocumentStore and test-only implementations are not accepted."), { code: "RAW_DOCUMENT_STORE_FACTORY_COMPATIBLE_REQUIRED_001" });
+    }
+    // Step 9.5: validate the durable marker — defense-in-depth against TypeScript casts.
+    // RAW_DOCUMENT_STORE_INMEMORY_REJECTED_001
+    if (config.rawDocumentStore.factoryCompatible !==
+        "durable-raw-document-store") {
+        safeLog(logger, {
+            level: "error", code: "LOG_FACTORY_READINESS_FAILED_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "factory readiness failed: rawDocumentStore not durable-compatible",
+            timestamp: new Date().toISOString(),
+        });
+        safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+            status: "failed", errorCode: "RAW_DOCUMENT_STORE_INMEMORY_REJECTED_001" });
+        throw Object.assign(new Error("RAW_DOCUMENT_STORE_INMEMORY_REJECTED_001: the supplied rawDocumentStore does not carry " +
+            "the factory-compatible durable marker (factoryCompatible: \"durable-raw-document-store\"). " +
+            "InMemoryRawDocumentStore, noop, and test-only implementations are not accepted. " +
+            "Supply a SQLiteRawDocumentStore or a custom durable implementation with the marker."), { code: "RAW_DOCUMENT_STORE_INMEMORY_REJECTED_001" });
+    }
+    // Step 10: auditLog must be present and factory-compatible.
+    // AUDIT_LOG_FACTORY_COMPATIBLE_REQUIRED_001
+    if (config.auditLog == null) {
+        safeLog(logger, {
+            level: "error", code: "LOG_FACTORY_READINESS_FAILED_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "factory readiness failed: auditLog missing",
+            timestamp: new Date().toISOString(),
+        });
+        safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+            status: "failed", errorCode: "AUDIT_LOG_FACTORY_COMPATIBLE_REQUIRED_001" });
+        throw Object.assign(new Error("AUDIT_LOG_FACTORY_COMPATIBLE_REQUIRED_001: createSQLiteLifeApiForProduction " +
+            "requires a FactoryCompatibleAuditLog. Provide a SQLiteAuditLog or a custom " +
+            "implementation that declares factoryCompatible: \"durable-audit-log\". " +
+            "InMemoryAuditLog, noop audit sinks, and test-only implementations are not accepted."), { code: "AUDIT_LOG_FACTORY_COMPATIBLE_REQUIRED_001" });
+    }
+    // Step 10.5: validate the durable marker — defense-in-depth against TypeScript casts.
+    // AUDIT_LOG_INMEMORY_OR_NOOP_REJECTED_001
+    if (config.auditLog.factoryCompatible !==
+        "durable-audit-log") {
+        safeLog(logger, {
+            level: "error", code: "LOG_FACTORY_READINESS_FAILED_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "factory readiness failed: auditLog not durable-compatible",
+            timestamp: new Date().toISOString(),
+        });
+        safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+            status: "failed", errorCode: "AUDIT_LOG_INMEMORY_OR_NOOP_REJECTED_001" });
+        throw Object.assign(new Error("AUDIT_LOG_INMEMORY_OR_NOOP_REJECTED_001: the supplied auditLog does not carry " +
+            "the factory-compatible durable marker (factoryCompatible: \"durable-audit-log\"). " +
+            "InMemoryAuditLog, noop audit sinks, and test-only implementations are not accepted. " +
+            "Supply a SQLiteAuditLog or a custom durable implementation with the marker."), { code: "AUDIT_LOG_INMEMORY_OR_NOOP_REJECTED_001" });
+    }
+    // Step 11: durable internal ProposalQueue construction proof (Production-06d-c-a).
+    //
+    // PRODUCTION_FACTORY_ASYNC_DEFERRED_BOUNDARY_001
+    // PRODUCTION_FACTORY_PROPOSAL_QUEUE_INTERNAL_CONSTRUCTION_REVIEWED_001
+    // PROPOSAL_QUEUE_DURABLE_APPENDER_REQUIRED_001
+    // PROPOSAL_QUEUE_NO_INMEMORY_FACTSTORE_APPENDER_001
+    // PROPOSAL_QUEUE_NO_NOOP_UNIT_OF_WORK_ASSEMBLY_001
+    //
+    // All core deps valid (steps 1–10.5). Resolve encryption source and construct crypto boundary.
+    // PRODUCTION_FACTORY_NO_SECRET_LOGGING_001: rawBytes is never included in any error.
+    // PRODUCTION_FACTORY_JWT_AND_AT_REST_KEYS_SEPARATE_001: resolvedKeyProvider never passed to JWT.
+    // PRODUCTION_KMS_ADAPTER_FACTORY_ACCEPTS_KEYPROVIDER_001: external keyProvider used directly.
+    // PRODUCTION_KMS_ADAPTER_STATIC_KEY_PATH_UNCHANGED_001: encryptionKey path unchanged.
+    let resolvedKeyProvider;
+    if (config.keyProvider != null) {
+        resolvedKeyProvider = config.keyProvider;
+        safeLog(logger, {
+            level: "info", code: "LOG_KEY_PROVIDER_WIRED_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "external keyProvider wired — encryptionKey path skipped",
+            timestamp: new Date().toISOString(),
+            // No key material, no keyId — PRODUCTION_FACTORY_NO_SECRET_LOGGING_001
+        });
+    }
+    else {
+        // config.encryptionKey is guaranteed non-null here: validated at step 7/7.5.
+        const ek = config.encryptionKey;
+        resolvedKeyProvider = await StaticKeyProvider.fromRawBytes(ek.keyId, ek.rawBytes);
+    }
+    const crypto = new AesGcmCryptoBoundary(resolvedKeyProvider);
+    const claimSerializer = new ClaimSerializer(crypto);
+    const sqliteFactStore = new SQLiteFactStore(config.db, claimSerializer);
+    const sqliteSourceReg = new SQLiteSourceRegistry(config.db);
+    const sourceAwareStore = new SourceAwareFactStore(sqliteFactStore, sqliteSourceReg);
+    const sqliteUoW = new SQLiteUnitOfWork(config.db);
+    const appender = new SourceAwareClaimAppender(sourceAwareStore, sqliteSourceReg, sqliteUoW);
+    // C2a: internal audit log for allow-path mutation audit — shares config.db connection.
+    // PRODUCTION_AUDIT_INTERNAL_LOG_SHARED_CONNECTION_001: audit_events table guaranteed by
+    // schema migration (schema v5+). Passing the Database instance sets _ownsConnection = false,
+    // so dispose does not close config.db. Distinct from the caller-supplied config.auditLog.
+    const internalMutationAuditLog = new SQLiteAuditLog(config.db);
+    // Internal GrantRegistry — in-memory, zero deps; distinct from config.grantResolver.
+    const grantRegistry = new GrantRegistry();
+    // Open SQLiteProposalQueue with the full durable appender chain.
+    // sqliteFactStore, sqliteSourceReg, and sqliteUoW all share config.db — single transaction
+    // scope (UNIT_OF_WORK_SQLITE_TRANSACTION_001).
+    const queue = await SQLiteProposalQueue.open(config.db, crypto, appender, grantRegistry, sqliteSourceReg);
+    // PRODUCTION_FACTORY_PROPOSAL_QUEUE_COMPATIBLE_REQUIRED_001
+    // Runtime two-layer defense: TypeScript structural check + runtime marker assertion.
+    if (queue.factoryCompatible !==
+        "durable-proposal-queue") {
+        safeLog(logger, {
+            level: "error", code: "LOG_FACTORY_READINESS_FAILED_001",
+            component: "SQLiteLifeApiFactory", operation: "createSQLiteLifeApiForProduction",
+            message: "factory readiness failed: proposalQueue not durable-compatible",
+            timestamp: new Date().toISOString(),
+        });
+        safeRecord(metricsRecorder, "factory.create.failure", 1, { component: "factory", operation: "createSQLiteLifeApiForProduction",
+            status: "failed", errorCode: "PRODUCTION_FACTORY_PROPOSAL_QUEUE_COMPATIBLE_REQUIRED_001" });
+        throw Object.assign(new Error("PRODUCTION_FACTORY_PROPOSAL_QUEUE_COMPATIBLE_REQUIRED_001: the constructed " +
+            "ProposalQueue does not carry the expected factory-compatible marker " +
+            "(factoryCompatible: \"durable-proposal-queue\"). SQLiteProposalQueue must declare " +
+            "this marker via FactoryCompatibleProposalQueue."), { code: "PRODUCTION_FACTORY_PROPOSAL_QUEUE_COMPATIBLE_REQUIRED_001" });
+    }
+    // Platform-02: resolve ProposalPolicy wiring. Explicit config.proposalPolicy wins over
+    // the trustedDataSourceRegistry convenience wiring (PROPOSAL_POLICY_EXPLICIT_WINS_OVER_REGISTRY_001).
+    // Neither field set → resolvedPolicy is undefined → effectiveQueue === queue, byte-identical
+    // to pre-Platform-02 behavior (PROPOSAL_POLICY_OPTIONAL_NO_CHECK_WHEN_ABSENT_001).
+    const resolvedPolicy = config.proposalPolicy ??
+        (config.trustedDataSourceRegistry != null
+            ? new RegistryBackedProposalPolicy(config.trustedDataSourceRegistry)
+            : undefined);
+    const effectiveQueue = resolvedPolicy !== undefined
+        ? new PolicyAwareProposalQueue(queue, resolvedPolicy, sqliteSourceReg, internalMutationAuditLog)
+        : queue;
+    // PRODUCTION_FACTORY_BLOCKER_LIST_EMPTY_REVIEWED_001
+    // All durable dependency blockers resolved. Proceeding to final assembly.
+    //
+    // Step 15: clock — config.clock is optional; fall back to system wall clock.
+    // PRODUCTION_FACTORY_CLOCK_FALLBACK_SAFE_001
+    const clock = config.clock ?? { now: () => new Date().toISOString() };
+    // Step 16: EvidenceBackedContextQueryService.
+    // PRODUCTION_FACTORY_QUERY_SVC_EMPTY_TRUST_001: StaticTrustTable.empty() — no
+    // cross-source trust chains at factory level.
+    const querySvc = new EvidenceBackedContextQueryService(sourceAwareStore, // FactStore
+    grantRegistry, // GrantRegistry
+    config.auditLog, // AuditLog
+    sqliteSourceReg, // SourceRegistry
+    config.rawDocumentStore, // RawDocumentStore
+    StaticTrustTable.empty());
+    // Step 17: EvidenceBackedClaimCreator.
+    // PRODUCTION_FACTORY_UOW_SHARED_001: sqliteUoW is shared with appender — claim writes
+    // and proposal-accept writes share a single SQLite transaction scope.
+    const claimCreator = new EvidenceBackedClaimCreator(config.rawDocumentStore, // RawDocumentStore
+    sqliteSourceReg, // SourceRegistry
+    sourceAwareStore, // FactStore
+    sqliteUoW);
+    // Step 18: co-create AccessContextIssuer and LifeApiImpl.
+    // PRODUCTION_FACTORY_ISSUER_API_PAIRING_001: issuer and rawApi are created together in
+    // this factory call. The issuer's WeakSet is private to this invocation — contexts minted
+    // by this bundle's auth are accepted by rawApi; all others are rejected.
+    // PRODUCTION_FACTORY_RAW_API_NOT_RETURNED_001: rawApi is captured in createScopedApi
+    // closure only; it is never returned as a public value.
+    const issuer = new AccessContextIssuer();
+    const rawApi = new LifeApiImpl(querySvc, // EvidenceBackedContextQueryService
+    claimCreator, // EvidenceBackedClaimCreator
+    effectiveQueue, // ProposalQueue (SQLiteProposalQueue, optionally policy-wrapped — Platform-02)
+    config.rawDocumentStore, // RawDocumentStore
+    sqliteSourceReg, // SourceRegistry
+    grantRegistry, // GrantRegistry
+    issuer, // AccessContextIssuer — paired with BackendContextMintingBoundary below
+    sourceAwareStore, // FactStore
+    config.auditLog, // AuditLog — general/deny/query audit (caller-supplied)
+    internalMutationAuditLog);
+    // Step 19: DefaultAuthorizationPolicy + BackendContextMintingBoundary + bundle.
+    // BackendContextMintingBoundary is a factory-internal production dependency here.
+    // Not exported from src/index.ts; callers receive ContextMintingBoundary only.
+    const policy = new DefaultAuthorizationPolicy(clock);
+    const auth = new BackendContextMintingBoundary({
+        adapter: config.authAdapter,
+        policy,
+        issuer, // SAME AccessContextIssuer as rawApi — paired
+        clock,
+        tenantBoundary: config.tenantBoundary,
+        grantResolver: config.grantResolver,
+        ...(config.trustedAgentRegistry != null
+            ? { trustedAgentRegistry: config.trustedAgentRegistry }
+            : {}),
+        // Platform-03: guardianRegistry optional; absent = mintGuardianContext throws GUARDIAN_REGISTRY_NOT_CONFIGURED_001.
+        // GUARDIAN_REGISTRY_OPTIONAL_NO_CHECK_WHEN_ABSENT_001
+        ...(config.guardianRegistry != null
+            ? { guardianRegistry: config.guardianRegistry, guardianAuditLog: internalMutationAuditLog }
+            : {}),
+    });
+    // PRODUCTION_FACTORY_SCOPED_API_TRUST_GATED_001: createScopedApi calls
+    // issuer.assertTrusted(mintedCtx.context) before constructing ProductionScopedLifeApiImpl.
+    // Trust is enforced at capability creation — not deferred to the first method call.
+    // Rejects: manually constructed AccessContext objects; contexts from a different factory
+    // invocation's issuer (cross-bundle replay). Accepts: contexts minted by this bundle's auth.
+    // PRODUCTION_FACTORY_BUNDLE_COMPLETE_001
+    const createScopedApi = (mintedCtx) => {
+        issuer.assertTrusted(mintedCtx.context);
+        return new ProductionScopedLifeApiImpl(rawApi, mintedCtx, config.auditLog, internalMutationAuditLog, sqliteUoW, logger, metricsRecorder);
+    };
+    // Step 20: healthCheck closure — D2b local readiness diagnostic.
+    //
+    // PRODUCTION_OBSERVABILITY_HEALTHCHECK_SURFACE_SPECIFIED_001
+    // PRODUCTION_OBSERVABILITY_HEALTHCHECK_NO_DATA_EXPOSURE_001: no DB path, SQL values,
+    //   keyId, rawBytes, user data, Error.message, or Error.stack in result or log events.
+    // PRODUCTION_OBSERVABILITY_HEALTHCHECK_NO_AUDIT_SIDE_EFFECT_001: no audit writes.
+    // PRODUCTION_OBSERVABILITY_HEALTHCHECK_LOGGER_NON_INTERFERING_001: logger failure is
+    //   swallowed (safeLog); result is valid regardless of logger state.
+    // PRODUCTION_OBSERVABILITY_HEALTHCHECK_DOES_NOT_THROW_001: ordinary check failures
+    //   return { status: "failed" } — never throw to the caller.
+    // PRODUCTION_OBSERVABILITY_HEALTHCHECK_NO_CONSOLE_001: output only via safeLog.
+    // PRODUCTION_OBSERVABILITY_HEALTHCHECK_ITEM_NAMES_STABLE_001: seven stable names.
+    const healthCheck = async () => {
+        const checkedAt = new Date().toISOString();
+        const items = [];
+        // Inner helper: run one synchronous check; catch failures; emit a sanitized log event.
+        // Never throws — always returns a HealthCheckItem.
+        const runCheck = (name, okCode, failCode, fn) => {
+            try {
+                fn();
+                safeRecord(metricsRecorder, "health_check.outcome", 1, { component: "healthCheck", operation: "healthCheck", checkName: name, status: "ok" });
+                return { name, status: "ok", code: okCode };
+            }
+            catch (err) {
+                safeLog(logger, {
+                    level: "warn",
+                    code: "LOG_HEALTHCHECK_CHECK_FAILED_001",
+                    component: "ProductionApiBundle",
+                    operation: "healthCheck",
+                    message: "health check failed: " + name,
+                    timestamp: new Date().toISOString(),
+                    // No error message or stack — errorName only.
+                    // PRODUCTION_OBSERVABILITY_HEALTHCHECK_NO_DATA_EXPOSURE_001
+                    ...(err instanceof Error ? { errorName: err.name } : {}),
+                });
+                safeRecord(metricsRecorder, "health_check.outcome", 1, { component: "healthCheck", operation: "healthCheck", checkName: name, status: "failed" });
+                return {
+                    name,
+                    status: "failed",
+                    code: failCode,
+                    // errorName only — no message, no stack, no sensitive data.
+                    ...(err instanceof Error ? { errorName: err.name } : {}),
+                };
+            }
+        };
+        // 1. db-connectivity — SELECT 1; no DML, no DDL, no user data.
+        // PRODUCTION_OBSERVABILITY_HEALTHCHECK_DB_CHECK_STATELESS_001
+        items.push(runCheck("db-connectivity", "HEALTHCHECK_DB_CONNECTIVITY_OK_001", "HEALTHCHECK_DB_CONNECTIVITY_FAILED_001", () => { config.db.prepare("SELECT 1").get(); }));
+        // 2. schema-version — migration_version === CURRENT_SCHEMA_VERSION.
+        items.push(runCheck("schema-version", "HEALTHCHECK_SCHEMA_VERSION_OK_001", "HEALTHCHECK_SCHEMA_VERSION_FAILED_001", () => {
+            const row = config.db
+                .prepare("SELECT value FROM schema_meta WHERE key = 'migration_version'")
+                .get();
+            const v = row !== undefined ? parseInt(row.value, 10) : NaN;
+            if (!Number.isFinite(v) || v !== CURRENT_SCHEMA_VERSION) {
+                throw new Error("HEALTHCHECK_SCHEMA_VERSION_FAILED_001");
+            }
+        }));
+        // 3. schema-structural — verifyCurrentSchema reused; no new verification logic.
+        // PRODUCTION_OBSERVABILITY_HEALTHCHECK_SCHEMA_USES_EXISTING_VERIFY_001
+        items.push(runCheck("schema-structural", "HEALTHCHECK_SCHEMA_STRUCTURAL_OK_001", "HEALTHCHECK_SCHEMA_STRUCTURAL_FAILED_001", () => {
+            const structResult = verifyCurrentSchema(config.db);
+            if (!structResult.ok) {
+                // Do not include missing table names in the item — use a stable code only.
+                // PRODUCTION_OBSERVABILITY_HEALTHCHECK_NO_DATA_EXPOSURE_001
+                throw new Error("HEALTHCHECK_SCHEMA_STRUCTURAL_FAILED_001");
+            }
+        }));
+        // 4. key-provider-loaded — resolved KeyProvider is non-null after factory assembly.
+        // Works for both StaticKeyProvider (encryptionKey path) and external keyProvider.
+        items.push(runCheck("key-provider-loaded", "HEALTHCHECK_KEY_PROVIDER_LOADED_OK_001", "HEALTHCHECK_KEY_PROVIDER_LOADED_FAILED_001", () => {
+            if (resolvedKeyProvider == null) {
+                throw new Error("HEALTHCHECK_KEY_PROVIDER_LOADED_FAILED_001");
+            }
+        }));
+        // 5–7. Opaque adapter reference checks — non-null only; no functional probe.
+        // PRODUCTION_OBSERVABILITY_HEALTHCHECK_OPAQUE_ADAPTERS_STRUCTURAL_ONLY_001
+        items.push(runCheck("auth-adapter-present", "HEALTHCHECK_AUTH_ADAPTER_PRESENT_OK_001", "HEALTHCHECK_AUTH_ADAPTER_PRESENT_FAILED_001", () => {
+            if (config.authAdapter == null) {
+                throw new Error("HEALTHCHECK_AUTH_ADAPTER_PRESENT_FAILED_001");
+            }
+        }));
+        items.push(runCheck("tenant-boundary-present", "HEALTHCHECK_TENANT_BOUNDARY_PRESENT_OK_001", "HEALTHCHECK_TENANT_BOUNDARY_PRESENT_FAILED_001", () => {
+            if (config.tenantBoundary == null) {
+                throw new Error("HEALTHCHECK_TENANT_BOUNDARY_PRESENT_FAILED_001");
+            }
+        }));
+        items.push(runCheck("grant-resolver-present", "HEALTHCHECK_GRANT_RESOLVER_PRESENT_OK_001", "HEALTHCHECK_GRANT_RESOLVER_PRESENT_FAILED_001", () => {
+            if (config.grantResolver == null) {
+                throw new Error("HEALTHCHECK_GRANT_RESOLVER_PRESENT_FAILED_001");
+            }
+        }));
+        // Aggregate status — worst-case of all items.
+        // PRODUCTION_OBSERVABILITY_HEALTHCHECK_STATUS_AGGREGATE_001
+        let status = "ok";
+        for (const item of items) {
+            if (item.status === "failed") {
+                status = "failed";
+                break;
+            }
+            if (item.status === "degraded") {
+                status = "degraded";
+            }
+        }
+        return { status, checkedAt, checks: items };
+    };
+    return { auth, createScopedApi, healthCheck };
+}
+//# sourceMappingURL=create-sqlite-life-api.js.map