life-as-api 0.2.0

package/dist/auth/sqlite-grant-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-grant-resolver.js","sourceRoot":"","sources":["../../src/auth/sqlite-grant-resolver.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,mCAAmC;AACnC,EAAE;AACF,0EAA0E;AAC1E,wFAAwF;AACxF,mCAAmC;AACnC,wFAAwF;AACxF,qEAAqE;AACrE,sFAAsF;AACtF,iDAAiD;AACjD,kFAAkF;AAClF,kFAAkF;AAClF,4CAA4C;AAC5C,oFAAoF;AACpF,+EAA+E;AAC/E,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,EAAE;AACF,0FAA0F;AAC1F,+DAA+D;AAI/D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,WAAW,GAAO,8BAA8B,CAAC;AACvD,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AAYpE,MAAM,OAAO,mBAAmB;IACb,MAAM,CAAQ;IACd,KAAK,CAAqB;IAE3C,YAAY,EAAqB,EAAE,KAAY;QAC7C,8DAA8D;QAC9D,MAAM,YAAY,GACf,EAAE;aACA,OAAO,CACN,0EAA0E,CAC3E;aACA,GAAG,EAAmC,KAAK,SAAS,CAAC;QAE1D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,IAAI,WAAW,yFAAyF,CACzG,EACD,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,iEAAiE;QACjE,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,OAAO,CACrB,iFAAiF;YAC/E,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAgB,EAChB,OAAgB,EAChB,QAAgB;QAEhB,sDAAsD;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAExC,CAAC;QAEd,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAExC,8EAA8E;QAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAE/C,wFAAwF;QACxF,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE9C,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,IAAI,gBAAgB,6BAA6B,GAAG,CAAC,UAAU,8CAA8C,GAAG,CAAC,QAAQ,EAAE,CAC5H,EACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAClD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACtB,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,IAAI,gBAAgB,4BAA4B,GAAG,CAAC,SAAS,8CAA8C,GAAG,CAAC,QAAQ,EAAE,CAC1H,EACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAE5C,iBAAiB;QACjB,IAAI,KAAK,GAAG,WAAW;YAAE,OAAO,SAAS,CAAC;QAC1C,8DAA8D;QAC9D,IAAI,KAAK,IAAI,UAAU;YAAE,OAAO,SAAS,CAAC;QAE1C,yCAAyC;QACzC,uFAAuF;QACvF,OAAO;YACL,OAAO,EAAG,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAG,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,oEAAoE;YACpE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/sqlite-tenant-boundary.d.ts

@@ -0,0 +1,7 @@
+import Database from "better-sqlite3";
+import type { TenantBoundary } from "./types.js";
+export declare class SQLiteTenantBoundary implements TenantBoundary {
+    private readonly _stmt;
+    constructor(db: Database.Database);
+    assertOwnership(tenantId: string, personId: string): Promise<void>;
+}

package/dist/auth/sqlite-tenant-boundary.js

@@ -0,0 +1,41 @@
+// SQLite-backed TenantBoundary — Production-02d-b.
+// Do NOT export from src/index.ts.
+//
+// AUTH_SQLITE_TENANT_BOUNDARY_BACKEND_001: implements TenantBoundary with a
+//   Database.Database-backed read path; behaviorally identical to InMemoryTenantBoundary.
+// AUTH_SQLITE_TENANT_MEMBERSHIP_STATUS_CHECKED_001: assertOwnership checks
+//   status === "active" at read time; suspended rows are denied with the same
+//   code as missing rows (AUTH_TENANT_OWNERSHIP_DENIED_001) — no enumeration leak.
+// AUTH_SQLITE_TENANT_MEMBERSHIP_SCHEMA_001: constructor throws this code when
+//   auth_tenant_memberships table is absent — signals missing runMigrations call,
+//   not a runtime auth denial.
+//
+// Storage-failure behavior: SQLite errors propagate as thrown — never converted
+//   to AUTH_TENANT_OWNERSHIP_DENIED_001 (a real storage failure is not a denial).
+const SCHEMA_CODE = "AUTH_SQLITE_TENANT_MEMBERSHIP_SCHEMA_001";
+const DENIED_CODE = "AUTH_TENANT_OWNERSHIP_DENIED_001";
+export class SQLiteTenantBoundary {
+    _stmt;
+    constructor(db) {
+        // AUTH_SQLITE_TENANT_MEMBERSHIP_SCHEMA_001: fail if migration has not run
+        const tablePresent = db
+            .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='auth_tenant_memberships'")
+            .get() !== undefined;
+        if (!tablePresent) {
+            throw Object.assign(new Error(`[${SCHEMA_CODE}] auth_tenant_memberships table absent — call runMigrations before constructing SQLiteTenantBoundary`), { code: SCHEMA_CODE });
+        }
+        this._stmt = db.prepare("SELECT status FROM auth_tenant_memberships WHERE tenant_id = ? AND person_id = ?");
+    }
+    async assertOwnership(tenantId, personId) {
+        // AUTH_SQLITE_TENANT_MEMBERSHIP_STATUS_CHECKED_001
+        // SQLite errors propagate — they are NOT caught here.
+        const row = this._stmt.get(tenantId, personId);
+        // AUTH_TENANT_SUBJECT_NOT_FOUND_SAFE_001:
+        // Missing and suspended use the same error code — no enumeration leak.
+        if (row === undefined || row.status !== "active") {
+            throw Object.assign(new Error(`[${DENIED_CODE}] subject is not an active member of the tenant`), { code: DENIED_CODE });
+        }
+        // Resolves void on success.
+    }
+}
+//# sourceMappingURL=sqlite-tenant-boundary.js.map

package/dist/auth/sqlite-tenant-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-tenant-boundary.js","sourceRoot":"","sources":["../../src/auth/sqlite-tenant-boundary.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,mCAAmC;AACnC,EAAE;AACF,4EAA4E;AAC5E,0FAA0F;AAC1F,2EAA2E;AAC3E,8EAA8E;AAC9E,mFAAmF;AACnF,8EAA8E;AAC9E,kFAAkF;AAClF,+BAA+B;AAC/B,EAAE;AACF,gFAAgF;AAChF,kFAAkF;AAKlF,MAAM,WAAW,GAAG,0CAA0C,CAAC;AAC/D,MAAM,WAAW,GAAG,kCAAkC,CAAC;AAEvD,MAAM,OAAO,oBAAoB;IACd,KAAK,CAAqB;IAE3C,YAAY,EAAqB;QAC/B,0EAA0E;QAC1E,MAAM,YAAY,GACf,EAAE;aACA,OAAO,CACN,sFAAsF,CACvF;aACA,GAAG,EAAmC,KAAK,SAAS,CAAC;QAE1D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,IAAI,WAAW,sGAAsG,CACtH,EACD,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,OAAO,CACrB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,QAAgB;QACtD,mDAAmD;QACnD,sDAAsD;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAEhC,CAAC;QAEd,0CAA0C;QAC1C,uEAAuE;QACvE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,IAAI,WAAW,iDAAiD,CACjE,EACD,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CAAC;QACJ,CAAC;QACD,4BAA4B;IAC9B,CAAC;CACF"}

package/dist/auth/static-jwt-key-ring.d.ts

@@ -0,0 +1,13 @@
+export type JwtKeyStatus = "active" | "verifying-only" | "revoked";
+export interface JwtKeyDescriptor {
+    readonly keyId: string;
+    readonly secret: Uint8Array;
+    readonly status: JwtKeyStatus;
+    readonly notBefore?: string;
+    readonly notAfter?: string;
+}
+export declare class StaticJwtKeyRing {
+    private readonly _keys;
+    constructor(keys: ReadonlyArray<JwtKeyDescriptor>);
+    resolveKey(keyId: string, nowMs: number): Buffer;
+}

package/dist/auth/static-jwt-key-ring.js

@@ -0,0 +1,73 @@
+// src/auth/static-jwt-key-ring.ts
+// TEST/DEV only — NOT exported from src/index.ts.
+// Constructor-injected, in-memory JWT key ring for HS256 secret management.
+// Analogous to StaticKeyProvider (src/crypto/static-key.ts) but for JWT HMAC secrets.
+// JWT secrets are raw Uint8Array — distinct from CryptoKey objects used in at-rest encryption.
+//
+// AUTH_JWT_SECRET_SOURCE_INJECTED_001   ✅ Production-04-a (architecture invariant)
+// AUTH_JWT_KEY_RING_VALIDATED_001       ✅ Production-04-a (construction-time postcondition)
+// AUTH_JWT_KEY_ID_DUPLICATE_001         ✅ Production-04-a
+// AUTH_JWT_ROTATION_GRACE_BOUNDED_001   ✅ Production-04-a
+// AUTH_JWT_KEY_REVOKED_DENIED_001       ✅ Production-04-a
+// AUTH_JWT_KEY_EXPIRED_DENIED_001       ✅ Production-04-a
+import { throwErr, MIN_SECRET_BYTES } from "./jwt-core.js";
+// ─── StaticJwtKeyRing ─────────────────────────────────────────────────────────
+export class StaticJwtKeyRing {
+    _keys;
+    constructor(keys) {
+        const map = new Map();
+        for (const desc of keys) {
+            // Empty / missing keyId
+            if (typeof desc.keyId !== "string" || desc.keyId.length === 0) {
+                throwErr("AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001", "each key descriptor in the ring must have a non-empty keyId");
+            }
+            // Duplicate keyId (AUTH_JWT_KEY_ID_DUPLICATE_001)
+            if (map.has(desc.keyId)) {
+                throwErr("AUTH_JWT_KEY_ID_DUPLICATE_001", `duplicate keyId in ring: "${desc.keyId}"`);
+            }
+            // Secret length guard (reuses AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001)
+            if (desc.secret == null || desc.secret.length < MIN_SECRET_BYTES) {
+                throwErr("AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001", `key "${desc.keyId}" secret must be a Uint8Array of at least ${MIN_SECRET_BYTES} bytes`);
+            }
+            // Temporal string validation — parse at construction to fail fast
+            if (desc.notBefore !== undefined && isNaN(Date.parse(desc.notBefore))) {
+                throwErr("AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001", `key "${desc.keyId}" notBefore is not a valid ISO-8601 instant`);
+            }
+            if (desc.notAfter !== undefined && isNaN(Date.parse(desc.notAfter))) {
+                throwErr("AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001", `key "${desc.keyId}" notAfter is not a valid ISO-8601 instant`);
+            }
+            // verifying-only must have notAfter to bound the grace window
+            // (AUTH_JWT_ROTATION_GRACE_BOUNDED_001)
+            if (desc.status === "verifying-only" && desc.notAfter === undefined) {
+                throwErr("AUTH_JWT_ROTATION_GRACE_BOUNDED_001", `verifying-only key "${desc.keyId}" must have notAfter to bound the grace window`);
+            }
+            map.set(desc.keyId, desc);
+        }
+        // AUTH_JWT_KEY_RING_VALIDATED_001: ring is internally consistent past this point
+        this._keys = map;
+    }
+    // Resolve a key for verification at the given instant (nowMs = epoch milliseconds).
+    // Throws on unknown, revoked, not-yet-active, or grace-window-closed keys.
+    resolveKey(keyId, nowMs) {
+        const desc = this._keys.get(keyId);
+        if (desc === undefined) {
+            throwErr("AUTH_CREDENTIAL_KEY_ID_UNKNOWN_001", `key "${keyId}" not found in ring`);
+        }
+        // Revoked: fail closed unconditionally — ignores token exp
+        // (AUTH_JWT_KEY_REVOKED_DENIED_001)
+        if (desc.status === "revoked") {
+            throwErr("AUTH_JWT_KEY_REVOKED_DENIED_001", `key "${keyId}" has been revoked`);
+        }
+        // notBefore: key not yet active (use parsed instant, not string comparison)
+        // (AUTH_JWT_KEY_REVOKED_DENIED_001 — pre-active treated as revoked/unavailable)
+        if (desc.notBefore !== undefined && nowMs < Date.parse(desc.notBefore)) {
+            throwErr("AUTH_JWT_KEY_REVOKED_DENIED_001", `key "${keyId}" is not yet active (notBefore)`);
+        }
+        // notAfter: grace window closed (AUTH_JWT_KEY_EXPIRED_DENIED_001)
+        if (desc.notAfter !== undefined && nowMs >= Date.parse(desc.notAfter)) {
+            throwErr("AUTH_JWT_KEY_EXPIRED_DENIED_001", `key "${keyId}" grace window has closed (notAfter)`);
+        }
+        return Buffer.from(desc.secret);
+    }
+}
+//# sourceMappingURL=static-jwt-key-ring.js.map

package/dist/auth/static-jwt-key-ring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-jwt-key-ring.js","sourceRoot":"","sources":["../../src/auth/static-jwt-key-ring.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,kDAAkD;AAClD,4EAA4E;AAC5E,sFAAsF;AACtF,+FAA+F;AAC/F,EAAE;AACF,mFAAmF;AACnF,4FAA4F;AAC5F,0DAA0D;AAC1D,0DAA0D;AAC1D,0DAA0D;AAC1D,0DAA0D;AAE1D,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAc3D,iFAAiF;AAEjF,MAAM,OAAO,gBAAgB;IACV,KAAK,CAAwC;IAE9D,YAAY,IAAqC;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,EAA4B,CAAC;QAEhD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,wBAAwB;YACxB,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9D,QAAQ,CACN,wCAAwC,EACxC,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YACD,kDAAkD;YAClD,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,+BAA+B,EAAE,6BAA6B,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;YACxF,CAAC;YACD,sEAAsE;YACtE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBACjE,QAAQ,CACN,wCAAwC,EACxC,QAAQ,IAAI,CAAC,KAAK,6CAA6C,gBAAgB,QAAQ,CACxF,CAAC;YACJ,CAAC;YACD,kEAAkE;YAClE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACtE,QAAQ,CACN,wCAAwC,EACxC,QAAQ,IAAI,CAAC,KAAK,6CAA6C,CAChE,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACpE,QAAQ,CACN,wCAAwC,EACxC,QAAQ,IAAI,CAAC,KAAK,4CAA4C,CAC/D,CAAC;YACJ,CAAC;YACD,8DAA8D;YAC9D,wCAAwC;YACxC,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACpE,QAAQ,CACN,qCAAqC,EACrC,uBAAuB,IAAI,CAAC,KAAK,gDAAgD,CAClF,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,iFAAiF;QACjF,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;IACnB,CAAC;IAED,oFAAoF;IACpF,2EAA2E;IAC3E,UAAU,CAAC,KAAa,EAAE,KAAa;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,QAAQ,CAAC,oCAAoC,EAAE,QAAQ,KAAK,qBAAqB,CAAC,CAAC;QACrF,CAAC;QAED,2DAA2D;QAC3D,oCAAoC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,QAAQ,CAAC,iCAAiC,EAAE,QAAQ,KAAK,oBAAoB,CAAC,CAAC;QACjF,CAAC;QAED,4EAA4E;QAC5E,gFAAgF;QAChF,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACvE,QAAQ,CAAC,iCAAiC,EAAE,QAAQ,KAAK,iCAAiC,CAAC,CAAC;QAC9F,CAAC;QAED,kEAAkE;QAClE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,QAAQ,CAAC,iCAAiC,EAAE,QAAQ,KAAK,sCAAsC,CAAC,CAAC;QACnG,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;CACF"}

package/dist/auth/subject-scoped-life-api.d.ts

@@ -0,0 +1,14 @@
+import type { PersonId } from "../types/ids.js";
+import type { ErasureStatus } from "../erasure/tombstone.js";
+import type { QueryContractsInput, ContextQueryResult } from "../surface/evidence-backed-context-query.js";
+import type { LifeApi } from "../sdk/life-api.js";
+import type { MintedContext } from "./types.js";
+export declare class SubjectScopedLifeApi {
+    private readonly _api;
+    private readonly _minted;
+    constructor(_api: LifeApi, _minted: MintedContext);
+    requestErasure(subject: PersonId): Promise<void>;
+    getErasureStatus(subject: PersonId): Promise<ErasureStatus | undefined>;
+    queryContracts(input: QueryContractsInput): Promise<ContextQueryResult>;
+}
+export declare function createSubjectScopedLifeApi(api: LifeApi, minted: MintedContext): SubjectScopedLifeApi;

package/dist/auth/subject-scoped-life-api.js

@@ -0,0 +1,51 @@
+// AUTH_CONTEXT_SUBJECT_SCOPE_ENFORCED_001 — Production-01c
+//
+// Facade: binds a LifeApi instance + a MintedContext. No ctx parameter on any facade method —
+// context is bound at construction time. assertAuthorizedForSubject() fires BEFORE any
+// subject-bearing LifeApi call. Excluded methods are intentionally absent.
+//
+// SubjectScopedLifeApi does NOT implement LifeApi.
+// Callers that need non-facade methods must call LifeApi directly with minted.context.
+//
+// PROPOSAL METHODS ARE EXCLUDED (Production-01c hardening):
+// ProposalId-only is not subject-free proof — a Proposal's candidateClaims may contain
+// subject-scoped data. getProposal/listProposals/acceptProposal/rejectProposal are deferred
+// to Production-01d where explicit Proposal-scope enforcement will be implemented.
+import { assertAuthorizedForSubject } from "./assert-authorized-for-subject.js";
+export class SubjectScopedLifeApi {
+    _api;
+    _minted;
+    constructor(_api, _minted) {
+        this._api = _api;
+        this._minted = _minted;
+    }
+    // ── Subject-enforced ──────────────────────────────────────────────────────────
+    // assertAuthorizedForSubject() fires BEFORE any LifeApi call.
+    async requestErasure(subject) {
+        assertAuthorizedForSubject(this._minted, subject);
+        return this._api.requestErasure(this._minted.context, subject);
+    }
+    async getErasureStatus(subject) {
+        assertAuthorizedForSubject(this._minted, subject);
+        return this._api.getErasureStatus(this._minted.context, subject);
+    }
+    async queryContracts(input) {
+        if (input.selector.subject !== undefined) {
+            // Case A: subject present — enforce exact match against authorizedPersonId
+            assertAuthorizedForSubject(this._minted, input.selector.subject);
+        }
+        else if (this._minted.authorizedPersonId !== undefined) {
+            // Case B: person-scoped credential cannot execute cross-subject queries.
+            // A missing subject selector would return data across all subjects in the tenant.
+            throw Object.assign(new Error("AUTH_SUBJECT_SCOPE_VIOLATION_001: person-scoped credential may not execute " +
+                "a cross-subject query (input.selector.subject is absent but " +
+                "MintedContext.authorizedPersonId is set)"), { code: "AUTH_SUBJECT_SCOPE_VIOLATION_001" });
+        }
+        // Case C: subject absent + authorizedPersonId absent → tenant/system scope, no restriction
+        return this._api.queryContracts(this._minted.context, input);
+    }
+}
+export function createSubjectScopedLifeApi(api, minted) {
+    return new SubjectScopedLifeApi(api, minted);
+}
+//# sourceMappingURL=subject-scoped-life-api.js.map

package/dist/auth/subject-scoped-life-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-scoped-life-api.js","sourceRoot":"","sources":["../../src/auth/subject-scoped-life-api.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,8FAA8F;AAC9F,uFAAuF;AACvF,2EAA2E;AAC3E,EAAE;AACF,mDAAmD;AACnD,uFAAuF;AACvF,EAAE;AACF,4DAA4D;AAC5D,uFAAuF;AACvF,4FAA4F;AAC5F,mFAAmF;AAQnF,OAAO,EAAE,0BAA0B,EAAE,MAAc,oCAAoC,CAAC;AAExF,MAAM,OAAO,oBAAoB;IAEZ;IACA;IAFnB,YACmB,IAAgB,EAChB,OAAsB;QADtB,SAAI,GAAJ,IAAI,CAAY;QAChB,YAAO,GAAP,OAAO,CAAe;IACtC,CAAC;IAEJ,iFAAiF;IACjF,8DAA8D;IAE9D,KAAK,CAAC,cAAc,CAAC,OAAiB;QACpC,0BAA0B,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAkC,EAAE,OAAO,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAiB;QACtC,0BAA0B,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAkC,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAA0B;QAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACzC,2EAA2E;YAC3E,0BAA0B,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnE,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACzD,yEAAyE;YACzE,kFAAkF;YAClF,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,6EAA6E;gBAC7E,8DAA8D;gBAC9D,0CAA0C,CAC3C,EACD,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAC7C,CAAC;QACJ,CAAC;QACD,2FAA2F;QAC3F,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;CAUF;AAED,MAAM,UAAU,0BAA0B,CACxC,GAAe,EACf,MAAqB;IAErB,OAAO,IAAI,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC"}

package/dist/auth/test-context-minting-boundary.d.ts

@@ -0,0 +1,13 @@
+import type { AuthAdapter, AuthorizationPolicy, Clock, ContextMintingBoundary, MintedContext } from "./types.js";
+import type { AccessContextIssuer } from "./access-context-issuer.js";
+/** @remarks TEST/DEV ONLY — not for production use. */
+export declare class TestContextMintingBoundary implements ContextMintingBoundary {
+    private readonly _opts;
+    constructor(_opts: {
+        readonly adapter: AuthAdapter;
+        readonly policy: AuthorizationPolicy;
+        readonly issuer: AccessContextIssuer;
+        readonly clock: Clock;
+    });
+    mint(credential: string, targetPersonId: string, requestedKind: "owner" | "agent" | "system" | "audit"): Promise<MintedContext>;
+}

package/dist/auth/test-context-minting-boundary.js

@@ -0,0 +1,74 @@
+// TEST/DEV ONLY — AUTH_CONTEXT_MINTING_BOUNDARY_001 (first concrete implementation).
+// Do NOT export from src/index.ts. Do NOT use in production.
+// AUTH_TOKEN_SECRETS_NOT_AUDITED_001: raw credential never enters MintedContext or errors.
+import { asPersonId, asGrantId, asISOTime } from "../types/ids.js";
+/** @remarks TEST/DEV ONLY — not for production use. */
+export class TestContextMintingBoundary {
+    _opts;
+    constructor(_opts) {
+        this._opts = _opts;
+    }
+    async mint(credential, targetPersonId, requestedKind) {
+        const { adapter, policy, issuer, clock } = this._opts;
+        // 1. Verify credential → VerifiedPrincipal (no raw credential stored beyond this call)
+        const principal = await adapter.verify(credential);
+        // 2. Expiry check before policy — AUTH_TOKEN_EXPIRY_CHECKED_001
+        if (principal.expiresAt <= clock.now()) {
+            throw Object.assign(new Error("AUTH_CREDENTIAL_EXPIRED_001: credential has expired"), { code: "AUTH_CREDENTIAL_EXPIRED_001" });
+        }
+        // 3. Resolve authorization decision
+        const decision = await policy.resolve(principal, targetPersonId);
+        // 4. Kind check — AUTH_DECISION_KIND_MISMATCH_001 (with specific sub-codes)
+        if (decision.kind !== requestedKind) {
+            // AUTH_AGENT_CANNOT_MINT_OWNER_001: specific invariant for this well-known violation
+            if (requestedKind === "owner" && principal.principalType === "agent") {
+                throw Object.assign(new Error("AUTH_AGENT_CANNOT_MINT_OWNER_001: an agent principal may not receive an OwnerContext"), { code: "AUTH_AGENT_CANNOT_MINT_OWNER_001" });
+            }
+            // AUTH_SERVICE_PRINCIPAL_REQUIRED_FOR_SYSTEM_CONTEXT_001
+            if (requestedKind === "system" && principal.principalType !== "service") {
+                throw Object.assign(new Error("AUTH_SERVICE_PRINCIPAL_REQUIRED_FOR_SYSTEM_CONTEXT_001: " +
+                    "only service principals may mint a SystemProjectionContext"), { code: "AUTH_SERVICE_PRINCIPAL_REQUIRED_FOR_SYSTEM_CONTEXT_001" });
+            }
+            throw Object.assign(new Error(`AUTH_DECISION_KIND_MISMATCH_001: policy resolved "${decision.kind}" ` +
+                `but "${requestedKind}" was requested`), { code: "AUTH_DECISION_KIND_MISMATCH_001" });
+        }
+        // 5. Mint context and build MintedContext — credential is NOT carried forward
+        const base = {
+            principalId: principal.principalId,
+            principalType: principal.principalType,
+            tenantId: principal.tenantId,
+        };
+        switch (decision.kind) {
+            case "owner": {
+                const ctx = issuer.mintOwner(asPersonId(decision.personId));
+                return {
+                    ...base,
+                    context: ctx,
+                    authorizedPersonId: principal.authorizedPersonId ?? decision.personId,
+                };
+            }
+            case "agent": {
+                const ctx = issuer.mintAgent({
+                    agentId: decision.agentId,
+                    grantId: asGrantId(decision.grantId),
+                    purpose: decision.purpose,
+                    notAfter: asISOTime(decision.notAfter),
+                });
+                return {
+                    ...base,
+                    context: ctx,
+                    authorizedGrantId: decision.grantId,
+                };
+            }
+            case "system": {
+                const ctx = issuer.mintSystemProjection();
+                return { ...base, context: ctx };
+            }
+            case "audit": {
+                const ctx = issuer.mintAudit(asPersonId(targetPersonId));
+                return { ...base, context: ctx };
+            }
+        }
+    }
+}
+//# sourceMappingURL=test-context-minting-boundary.js.map

package/dist/auth/test-context-minting-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-context-minting-boundary.js","sourceRoot":"","sources":["../../src/auth/test-context-minting-boundary.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,6DAA6D;AAC7D,2FAA2F;AAW3F,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEnE,uDAAuD;AACvD,MAAM,OAAO,0BAA0B;IAElB;IADnB,YACmB,KAKhB;QALgB,UAAK,GAAL,KAAK,CAKrB;IACA,CAAC;IAEJ,KAAK,CAAC,IAAI,CACR,UAAsB,EACtB,cAAsB,EACtB,aAAsD;QAEtD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAEtD,uFAAuF;QACvF,MAAM,SAAS,GAAsB,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEtE,gEAAgE;QAChE,IAAI,SAAS,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;YACvC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAChE,EAAE,IAAI,EAAE,6BAA6B,EAAE,CACxC,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAEjE,4EAA4E;QAC5E,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,qFAAqF;YACrF,IAAI,aAAa,KAAK,OAAO,IAAI,SAAS,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;gBACrE,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,sFAAsF,CACvF,EACD,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAC7C,CAAC;YACJ,CAAC;YACD,yDAAyD;YACzD,IAAI,aAAa,KAAK,QAAQ,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,0DAA0D;oBAC1D,4DAA4D,CAC7D,EACD,EAAE,IAAI,EAAE,wDAAwD,EAAE,CACnE,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,qDAAqD,QAAQ,CAAC,IAAI,IAAI;gBACtE,QAAQ,aAAa,iBAAiB,CACvC,EACD,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAC5C,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,MAAM,IAAI,GAAG;YACX,WAAW,EAAI,SAAS,CAAC,WAAW;YACpC,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,QAAQ,EAAO,SAAS,CAAC,QAAQ;SACzB,CAAC;QAEX,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC5D,OAAO;oBACL,GAAG,IAAI;oBACP,OAAO,EAAE,GAAG;oBACZ,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,IAAI,QAAQ,CAAC,QAAQ;iBACtE,CAAC;YACJ,CAAC;YAED,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;oBAC3B,OAAO,EAAG,QAAQ,CAAC,OAAO;oBAC1B,OAAO,EAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACrC,OAAO,EAAG,QAAQ,CAAC,OAAO;oBAC1B,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBACvC,CAAC,CAAC;gBACH,OAAO;oBACL,GAAG,IAAI;oBACP,OAAO,EAAE,GAAG;oBACZ,iBAAiB,EAAE,QAAQ,CAAC,OAAO;iBACpC,CAAC;YACJ,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAC1C,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACnC,CAAC;YAED,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;gBACzD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/auth/types.d.ts

@@ -0,0 +1,77 @@
+import type { AccessContext, PurposeTag } from "../types/access-context.js";
+import type { PersonId } from "../types/ids.js";
+export type PrincipalType = "user" | "agent" | "service" | "audit";
+export interface VerifiedPrincipal {
+    readonly principalId: string;
+    readonly principalType: PrincipalType;
+    readonly tenantId: string;
+    readonly roles: ReadonlyArray<"owner" | "agent" | "system" | "audit">;
+    readonly grantIds: ReadonlyArray<string>;
+    readonly authorizedPersonId?: string;
+    readonly expiresAt: string;
+    readonly issuedAt: string;
+}
+export interface AuthAdapter {
+    verify(credential: string): Promise<VerifiedPrincipal>;
+}
+export type AuthorizationDecision = {
+    readonly kind: "owner";
+    readonly personId: string;
+} | {
+    readonly kind: "agent";
+    readonly agentId: string;
+    readonly grantId: string;
+    readonly purpose: PurposeTag;
+    readonly notAfter: string;
+} | {
+    readonly kind: "system";
+    readonly projection: string;
+} | {
+    readonly kind: "audit";
+};
+export interface AuthorizationPolicy {
+    resolve(principal: VerifiedPrincipal, targetPersonId: string): Promise<AuthorizationDecision>;
+}
+export interface TenantBoundary {
+    assertOwnership(tenantId: string, personId: string): Promise<void>;
+}
+export interface GrantDescriptor {
+    readonly grantId: string;
+    readonly agentId: string;
+    readonly tenantId: string;
+    readonly notAfter: string;
+    readonly personId?: PersonId;
+    readonly purpose?: string;
+}
+export interface GrantResolver {
+    resolveActiveGrant(agentId: string, grantId: string, tenantId: string): Promise<GrantDescriptor | undefined>;
+}
+export interface Clock {
+    now(): string;
+}
+export interface MintedContext {
+    readonly context: AccessContext;
+    readonly principalId: string;
+    readonly principalType: PrincipalType;
+    readonly tenantId: string;
+    readonly authorizedPersonId?: string;
+    readonly authorizedGrantId?: string;
+    readonly guardianOf?: PersonId;
+    readonly guardianScopes?: ReadonlyArray<string>;
+    readonly declaredPurpose?: PurposeTag;
+}
+export interface MintOptions {
+    readonly declaredPurpose?: PurposeTag;
+}
+export interface ContextMintingBoundary {
+    mint(credential: string, targetPersonId: string, requestedKind: "owner" | "agent" | "system" | "audit", options?: MintOptions): Promise<MintedContext>;
+}
+export interface GuardianContextMintingBoundary extends ContextMintingBoundary {
+    /**
+     * Mint a guardian context on behalf of wardId.
+     * The returned context is an OwnerContext for wardId, marked with guardianOf = wardId.
+     * Denials throw AUTH_GUARDIAN_CONTEXT_MINT_DENIED_001 (opaque — internal reason not propagated).
+     * GUARDIAN_REGISTRY_NOT_CONFIGURED_001: no registry → throws that specific code.
+     */
+    mintGuardianContext(credential: string, wardId: string): Promise<MintedContext>;
+}

package/dist/auth/types.js

@@ -0,0 +1,16 @@
+// Auth boundary types — Production-01a.
+//
+// AUTH_CONTEXT_MINTING_BOUNDARY_001: ContextMintingBoundary is the only production
+//   path to a trusted AccessContext; raw AccessContextIssuer.mint*() must not be
+//   called outside this boundary in production deployments.
+// AUTH_NO_PUBLIC_ISSUER_EXPORT_001: these interfaces are exported; the
+//   AccessContextIssuer class and FakeAuthAdapter are NOT.
+// AUTH_HOST_ADAPTER_REQUIRED_001: production factory requires an AuthAdapter.
+// AUTH_CONTEXT_SUBJECT_SCOPE_ENFORCED_001: MintedContext carries authorizedPersonId /
+//   authorizedGrantId so call sites can enforce subject scope beyond WeakSet trust.
+//   AUTH_CONTEXT_INSTANCE_BOUND_001 (WeakSet) prevents cross-instance replay only —
+//   cross-subject misuse within the same instance requires authorizedPersonId enforcement.
+// AUTH_SERVICE_PRINCIPAL_REQUIRED_FOR_SYSTEM_CONTEXT_001: principalType "service"
+//   is the only allowed source for SystemProjectionContext minting.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,mFAAmF;AACnF,iFAAiF;AACjF,4DAA4D;AAC5D,uEAAuE;AACvE,2DAA2D;AAC3D,8EAA8E;AAC9E,sFAAsF;AACtF,oFAAoF;AACpF,oFAAoF;AACpF,2FAA2F;AAC3F,kFAAkF;AAClF,oEAAoE"}

package/dist/compliance/subject-data-report.d.ts

@@ -0,0 +1,43 @@
+import type { Database } from "better-sqlite3";
+export interface GrantSummary {
+    readonly grantId: string;
+    readonly agentId: string;
+    readonly status: string;
+    readonly purpose?: string;
+    readonly notBefore?: string;
+    readonly notAfter: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+export interface ProposalSummary {
+    readonly proposalId: string;
+    readonly status: string;
+    readonly proposedByAgent: string;
+    readonly underGrant: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly decidedAt?: string;
+}
+export interface AuditEventSummary {
+    readonly eventId: string;
+    readonly recordedAt: string;
+    readonly actor: string;
+    readonly decision: string;
+    readonly reasonCode: string;
+    readonly grantId?: string;
+    readonly actingAsGuardian?: boolean;
+    readonly wardId?: string;
+}
+export interface SubjectDataReport {
+    readonly generatedAt: string;
+    readonly subjectId: string;
+    readonly schemaVersion: number;
+    readonly grants: GrantSummary[];
+    readonly proposals: ProposalSummary[];
+    readonly auditEvents: AuditEventSummary[];
+    readonly dataIntegrityHash: string;
+}
+export interface SubjectDataReportOptions {
+    readonly now: string;
+}
+export declare function generateSubjectDataReport(db: Database, personId: string, opts: SubjectDataReportOptions): SubjectDataReport;

package/dist/compliance/subject-data-report.js

@@ -0,0 +1,155 @@
+// DSGVO Art. 15 (Auskunftsrecht) + Art. 20 (Datenportabilität) — Subject Data Report.
+//
+// SUBJECT_DATA_REPORT_GDPR_ART15_001: generateSubjectDataReport() produces a complete,
+//   structured account of all data held about a personId: active + expired grants,
+//   proposals linked to those grants, and audit events linked to those grants.
+// SUBJECT_DATA_REPORT_INTEGRITY_HASH_001: dataIntegrityHash = SHA-256 over the canonical
+//   JSON of the report (fields sorted, hash field excluded) — makes the report tamper-evident
+//   and admissible as evidence. Hosts wishing formal notarisation must additionally timestamp
+//   the hash with a qualified TSA.
+// SUBJECT_DATA_REPORT_INCLUDES_EXPIRED_GRANTS_001: all grants (status "active" + "revoked" +
+//   "expired") are included — GDPR right of access covers historical data.
+// SUBJECT_DATA_REPORT_NO_PLAINTEXT_PAYLOAD_001: proposal encrypted payloads are NOT included.
+//   The report records proposal metadata (id, status, agent, grant, timestamps) only —
+//   PROPOSAL_QUEUE_SCHEMA_ENCRYPTED_PAYLOAD_001 is respected; the key material required for
+//   decryption is not available to this layer.
+// SUBJECT_DATA_REPORT_AUDIT_VIA_GRANT_JOIN_001: audit events are linked to the subject via
+//   their grant_id → auth_grants.grant_id → auth_grants.person_id join. Events without a
+//   grant_id are per-subject owner actions (actor matches "user:<principalId>") included via
+//   the owner-event path. Events with an unknown/cross-subject grant_id are excluded.
+// SUBJECT_DATA_REPORT_GUARDIAN_EVENTS_INCLUDED_001: audit events with acting_as_guardian=1
+//   AND ward_id = personId are included — they represent actions taken on behalf of this person.
+// SUBJECT_DATA_REPORT_OWNER_ONLY_001: callers must enforce that only the subject (owner
+//   context or authorised guardian) may call this function. The function itself does NOT
+//   enforce caller identity — enforcement is the host's responsibility.
+import { sha256hexSync } from "../crypto/sha256.js";
+// ─── Canonical JSON (for integrity hash) ─────────────────────────────────────
+// SUBJECT_DATA_REPORT_INTEGRITY_HASH_001: sorted keys, no undefined/null values,
+// dataIntegrityHash field excluded. The sort is deterministic across V8 versions
+// because we sort recursively using Array.from(Object.keys()).sort().
+function canonicalJson(value) {
+    if (value === null || value === undefined)
+        return "null";
+    if (typeof value !== "object" && !Array.isArray(value))
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return "[" + value.map(canonicalJson).join(",") + "]";
+    }
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    const pairs = keys
+        .filter(k => obj[k] !== undefined)
+        .map(k => JSON.stringify(k) + ":" + canonicalJson(obj[k]));
+    return "{" + pairs.join(",") + "}";
+}
+// ─── generateSubjectDataReport ────────────────────────────────────────────────
+export function generateSubjectDataReport(db, personId, opts) {
+    // 1. Grants — all statuses (SUBJECT_DATA_REPORT_INCLUDES_EXPIRED_GRANTS_001)
+    const grantRows = db.prepare(`SELECT grant_id, agent_id, status, not_before, not_after, created_at, updated_at
+     FROM auth_grants
+     WHERE person_id = ?
+     ORDER BY created_at ASC`).all(personId);
+    const grants = grantRows.map(r => {
+        const g = {
+            grantId: r.grant_id,
+            agentId: r.agent_id,
+            status: r.status,
+            notAfter: r.not_after,
+            createdAt: r.created_at,
+            updatedAt: r.updated_at,
+        };
+        const withOptionals = { ...g };
+        if (r.not_before !== null && r.not_before !== undefined) {
+            withOptionals["notBefore"] = r.not_before;
+        }
+        return withOptionals;
+    });
+    const grantIds = grantRows.map(r => r.grant_id);
+    // 2. Proposals — linked via grants (SUBJECT_DATA_REPORT_NO_PLAINTEXT_PAYLOAD_001)
+    let proposals = [];
+    if (grantIds.length > 0) {
+        const placeholders = grantIds.map(() => "?").join(",");
+        const proposalRows = db.prepare(`SELECT proposal_id, status, proposed_by_agent, under_grant,
+              created_at, updated_at, decided_at
+       FROM proposals
+       WHERE under_grant IN (${placeholders})
+       ORDER BY created_at ASC`).all(...grantIds);
+        proposals = proposalRows.map(r => {
+            const p = {
+                proposalId: r.proposal_id,
+                status: r.status,
+                proposedByAgent: r.proposed_by_agent,
+                underGrant: r.under_grant,
+                createdAt: r.created_at,
+                updatedAt: r.updated_at,
+            };
+            if (r.decided_at !== null && r.decided_at !== undefined) {
+                p["decidedAt"] = r.decided_at;
+            }
+            return p;
+        });
+    }
+    // 3. Audit events — via grant join + guardian ward events
+    // (SUBJECT_DATA_REPORT_AUDIT_VIA_GRANT_JOIN_001 + SUBJECT_DATA_REPORT_GUARDIAN_EVENTS_INCLUDED_001)
+    let auditEvents = [];
+    {
+        const parts = [];
+        const params = [];
+        if (grantIds.length > 0) {
+            const placeholders = grantIds.map(() => "?").join(",");
+            parts.push(`SELECT id, recorded_at, actor, decision, reason_code, grant_id,
+                acting_as_guardian, ward_id
+         FROM audit_events
+         WHERE grant_id IN (${placeholders})`);
+            params.push(...grantIds);
+        }
+        // Guardian events: acting on behalf of this person as ward
+        parts.push(`SELECT id, recorded_at, actor, decision, reason_code, grant_id,
+              acting_as_guardian, ward_id
+       FROM audit_events
+       WHERE acting_as_guardian = 1 AND ward_id = ?`);
+        params.push(personId);
+        if (parts.length > 0) {
+            const sql = parts.join(" UNION ") + " ORDER BY recorded_at ASC";
+            const rows = db.prepare(sql).all(...params);
+            // Deduplicate by id (a row may appear in both queries)
+            const seen = new Set();
+            auditEvents = rows
+                .filter(r => {
+                if (seen.has(r.id))
+                    return false;
+                seen.add(r.id);
+                return true;
+            })
+                .map(r => {
+                const ev = {
+                    eventId: r.id,
+                    recordedAt: r.recorded_at,
+                    actor: r.actor,
+                    decision: r.decision,
+                    reasonCode: r.reason_code,
+                };
+                if (r.grant_id !== null && r.grant_id !== undefined)
+                    ev["grantId"] = r.grant_id;
+                if (r.acting_as_guardian === 1)
+                    ev["actingAsGuardian"] = true;
+                if (r.ward_id !== null && r.ward_id !== undefined)
+                    ev["wardId"] = r.ward_id;
+                return ev;
+            });
+        }
+    }
+    // 4. Assemble report without hash
+    const reportWithoutHash = {
+        generatedAt: opts.now,
+        subjectId: personId,
+        schemaVersion: 10,
+        grants,
+        proposals,
+        auditEvents,
+    };
+    // SUBJECT_DATA_REPORT_INTEGRITY_HASH_001: SHA-256 over canonical JSON
+    const dataIntegrityHash = sha256hexSync(Buffer.from(canonicalJson(reportWithoutHash), "utf8"));
+    return { ...reportWithoutHash, dataIntegrityHash };
+}
+//# sourceMappingURL=subject-data-report.js.map

package/dist/compliance/subject-data-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject-data-report.js","sourceRoot":"","sources":["../../src/compliance/subject-data-report.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,EAAE;AACF,uFAAuF;AACvF,mFAAmF;AACnF,+EAA+E;AAC/E,yFAAyF;AACzF,8FAA8F;AAC9F,8FAA8F;AAC9F,mCAAmC;AACnC,6FAA6F;AAC7F,2EAA2E;AAC3E,8FAA8F;AAC9F,uFAAuF;AACvF,4FAA4F;AAC5F,+CAA+C;AAC/C,2FAA2F;AAC3F,yFAAyF;AACzF,6FAA6F;AAC7F,sFAAsF;AACtF,2FAA2F;AAC3F,iGAAiG;AACjG,wFAAwF;AACxF,yFAAyF;AACzF,wEAAwE;AAGxE,OAAO,EAAE,aAAa,EAAE,MAAO,qBAAqB,CAAC;AAsFrD,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,sEAAsE;AAEtE,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,GAAI,KAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI;SACf,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AACrC,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,yBAAyB,CACvC,EAAkB,EAClB,QAAgB,EAChB,IAAkC;IAElC,6EAA6E;IAC7E,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAC1B;;;6BAGyB,CAC1B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEhB,MAAM,MAAM,GAAmB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC/C,MAAM,CAAC,GAAiB;YACtB,OAAO,EAAI,CAAC,CAAC,QAAQ;YACrB,OAAO,EAAI,CAAC,CAAC,QAAQ;YACrB,MAAM,EAAK,CAAC,CAAC,MAAM;YACnB,QAAQ,EAAG,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,SAAS,EAAE,CAAC,CAAC,UAAU;SACxB,CAAC;QACF,MAAM,aAAa,GAA4B,EAAE,GAAG,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACxD,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;QAC5C,CAAC;QACD,OAAO,aAAwC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAEhD,kFAAkF;IAClF,IAAI,SAAS,GAAsB,EAAE,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAC7B;;;+BAGyB,YAAY;+BACZ,CAC1B,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QAEnB,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC/B,MAAM,CAAC,GAA4B;gBACjC,UAAU,EAAO,CAAC,CAAC,WAAW;gBAC9B,MAAM,EAAW,CAAC,CAAC,MAAM;gBACzB,eAAe,EAAE,CAAC,CAAC,iBAAiB;gBACpC,UAAU,EAAO,CAAC,CAAC,WAAW;gBAC9B,SAAS,EAAQ,CAAC,CAAC,UAAU;gBAC7B,SAAS,EAAQ,CAAC,CAAC,UAAU;aAC9B,CAAC;YACF,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACxD,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;YAChC,CAAC;YACD,OAAO,CAA+B,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0DAA0D;IAC1D,oGAAoG;IACpG,IAAI,WAAW,GAAwB,EAAE,CAAC;IAC1C,CAAC;QACC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAc,EAAE,CAAC;QAE7B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvD,KAAK,CAAC,IAAI,CACR;;;8BAGsB,YAAY,GAAG,CACtC,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAED,2DAA2D;QAC3D,KAAK,CAAC,IAAI,CACR;;;oDAG8C,CAC/C,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEtB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,2BAA2B,CAAC;YAChE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAsB,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;YAEjE,uDAAuD;YACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,WAAW,GAAG,IAAI;iBACf,MAAM,CAAC,CAAC,CAAC,EAAE;gBACV,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACjC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACf,OAAO,IAAI,CAAC;YACd,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,CAAC,EAAE;gBACP,MAAM,EAAE,GAA4B;oBAClC,OAAO,EAAK,CAAC,CAAC,EAAE;oBAChB,UAAU,EAAE,CAAC,CAAC,WAAW;oBACzB,KAAK,EAAO,CAAC,CAAC,KAAK;oBACnB,QAAQ,EAAI,CAAC,CAAC,QAAQ;oBACtB,UAAU,EAAE,CAAC,CAAC,WAAW;iBAC1B,CAAC;gBACF,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;oBAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;gBAChF,IAAI,CAAC,CAAC,kBAAkB,KAAK,CAAC;oBAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC;gBAC9D,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;oBAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;gBAC5E,OAAO,EAAkC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,iBAAiB,GAAG;QACxB,WAAW,EAAI,IAAI,CAAC,GAAG;QACvB,SAAS,EAAM,QAAQ;QACvB,aAAa,EAAE,EAAE;QACjB,MAAM;QACN,SAAS;QACT,WAAW;KACZ,CAAC;IAEF,sEAAsE;IACtE,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/F,OAAO,EAAE,GAAG,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;AACrD,CAAC"}