limen-ai 1.0.0

package/dist/kernel/crypto/crypto_engine.js

@@ -0,0 +1,350 @@
+/**
+ * Cryptographic primitives implementation.
+ * S ref: I-11, FM-10, IP-1, IP-6
+ *
+ * Phase: 1 (Kernel) -- Build Order 4
+ * Required by audit (SHA-256 hash chaining) and vault.
+ *
+ * I-11: AES-256-GCM default encryption. PBKDF2 key derivation (600k iterations).
+ * IP-1: Vault for secure credential storage.
+ * IP-6: HMAC-SHA256 for webhook signing.
+ *
+ * All crypto uses Node.js built-in crypto module (I-01 compliance).
+ */
+import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, pbkdf2Sync, } from 'node:crypto';
+import { randomUUID } from 'node:crypto';
+/** AES-256-GCM constants. S ref: I-11. */
+const AES_256_GCM = 'aes-256-gcm';
+const KEY_LENGTH = 32; // 256 bits
+const IV_LENGTH = 12; // 96 bits (NIST SP 800-38D recommended for GCM)
+const AUTH_TAG_LENGTH = 16; // 128 bits
+/** Default PBKDF2 iterations. S ref: I-11. */
+const DEFAULT_PBKDF2_ITERATIONS = 600_000;
+/**
+ * Create a CryptoEngine implementation.
+ * S ref: I-11 (encryption at rest), §3.5 (SHA-256), IP-6 (HMAC)
+ */
+export function createCryptoEngine() {
+    return {
+        /**
+         * Derive tenant-specific key via PBKDF2.
+         * Key material never written to DB.
+         * S ref: I-11 (key derivation, 600000 iterations default)
+         */
+        deriveKey(masterKey, salt, iterations) {
+            try {
+                if (masterKey.length < KEY_LENGTH) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'INVALID_KEY_LENGTH',
+                            message: `Master key must be at least ${KEY_LENGTH} bytes, got ${masterKey.length}`,
+                            spec: 'I-11',
+                        },
+                    };
+                }
+                const derived = pbkdf2Sync(masterKey, salt, iterations, KEY_LENGTH, 'sha256');
+                return { ok: true, value: derived };
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    error: {
+                        code: 'KEY_DERIVATION_FAILED',
+                        message: err instanceof Error ? err.message : String(err),
+                        spec: 'I-11',
+                    },
+                };
+            }
+        },
+        /**
+         * Encrypt plaintext with AES-256-GCM.
+         * S ref: I-11 (AES-256-GCM default encryption)
+         */
+        encrypt(plaintext, key) {
+            try {
+                if (key.length !== KEY_LENGTH) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'INVALID_KEY_LENGTH',
+                            message: `Key must be exactly ${KEY_LENGTH} bytes, got ${key.length}`,
+                            spec: 'I-11',
+                        },
+                    };
+                }
+                // Each encryption uses a unique random IV (NIST SP 800-38D)
+                const iv = randomBytes(IV_LENGTH);
+                const cipher = createCipheriv(AES_256_GCM, key, iv);
+                const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+                const authTag = cipher.getAuthTag();
+                return {
+                    ok: true,
+                    value: {
+                        ciphertext,
+                        iv,
+                        authTag,
+                        keyVersion: 1,
+                        algorithm: AES_256_GCM,
+                    },
+                };
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    error: {
+                        code: 'ENCRYPTION_FAILED',
+                        message: err instanceof Error ? err.message : String(err),
+                        spec: 'I-11',
+                    },
+                };
+            }
+        },
+        /**
+         * Decrypt ciphertext with AES-256-GCM.
+         * S ref: I-11 (decryption with authentication)
+         */
+        decrypt(payload, key) {
+            try {
+                if (key.length !== KEY_LENGTH) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'INVALID_KEY_LENGTH',
+                            message: `Key must be exactly ${KEY_LENGTH} bytes, got ${key.length}`,
+                            spec: 'I-11',
+                        },
+                    };
+                }
+                const decipher = createDecipheriv(AES_256_GCM, key, payload.iv);
+                decipher.setAuthTag(payload.authTag);
+                const plaintext = Buffer.concat([decipher.update(payload.ciphertext), decipher.final()]);
+                return { ok: true, value: plaintext };
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    error: {
+                        code: 'DECRYPTION_FAILED',
+                        message: err instanceof Error ? err.message : String(err),
+                        spec: 'I-11',
+                    },
+                };
+            }
+        },
+        /**
+         * SHA-256 hash for audit chain.
+         * S ref: §3.5 (SHA-256 hash chaining)
+         */
+        sha256(data) {
+            return createHash('sha256').update(data).digest('hex');
+        },
+        /**
+         * HMAC-SHA256 for webhook signing.
+         * S ref: IP-6 (webhook signing)
+         */
+        hmacSha256(data, secret) {
+            return createHmac('sha256', secret).update(data).digest('hex');
+        },
+    };
+}
+/**
+ * Create VaultOperations implementation.
+ * S ref: I-11 (encryption at rest), IP-1 (secure credential storage)
+ */
+export function createVaultOperations(crypto, masterKey) {
+    return {
+        /**
+         * Store encrypted value in vault.
+         * S ref: I-11 (encryption at rest for secrets)
+         */
+        store(conn, ctx, keyName, plaintext) {
+            try {
+                // Derive a key for this vault entry
+                const salt = randomBytes(32);
+                const derivedKeyResult = crypto.deriveKey(masterKey, salt, DEFAULT_PBKDF2_ITERATIONS);
+                if (!derivedKeyResult.ok)
+                    return derivedKeyResult;
+                // Encrypt the value
+                const encryptResult = crypto.encrypt(plaintext, derivedKeyResult.value);
+                if (!encryptResult.ok)
+                    return encryptResult;
+                const payload = encryptResult.value;
+                const id = randomUUID();
+                const tenantId = ctx.tenantId;
+                // Upsert into vault
+                conn.run(`INSERT INTO core_vault (id, tenant_id, key_name, ciphertext, iv, auth_tag, algorithm, key_version, created_at, updated_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ','now'), strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+           ON CONFLICT(tenant_id, key_name) DO UPDATE SET
+             ciphertext = excluded.ciphertext,
+             iv = excluded.iv,
+             auth_tag = excluded.auth_tag,
+             key_version = key_version + 1,
+             updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')`, [id, tenantId, keyName,
+                    payload.ciphertext.toString('base64'),
+                    payload.iv.toString('base64'),
+                    payload.authTag.toString('base64'),
+                    payload.algorithm, payload.keyVersion]);
+                // Store key metadata (salt + iterations for re-derivation)
+                // SEC-003 fix: ON CONFLICT must UPDATE salt to match new encryption,
+                // otherwise retrieve() derives wrong key and decryption fails.
+                conn.run(`INSERT INTO core_encryption_keys (id, tenant_id, purpose, salt, iterations, algorithm, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+           ON CONFLICT (tenant_id, purpose) DO UPDATE SET
+             salt = excluded.salt,
+             iterations = excluded.iterations,
+             algorithm = excluded.algorithm`, [randomUUID(), tenantId, `vault:${keyName}`,
+                    salt.toString('base64'), DEFAULT_PBKDF2_ITERATIONS, AES_256_GCM]);
+                return { ok: true, value: undefined };
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    error: {
+                        code: 'VAULT_STORE_FAILED',
+                        message: err instanceof Error ? err.message : String(err),
+                        spec: 'I-11',
+                    },
+                };
+            }
+        },
+        /**
+         * Retrieve decrypted value from vault.
+         * S ref: I-11 (decryption for authorized access)
+         */
+        retrieve(conn, ctx, keyName) {
+            try {
+                const tenantId = ctx.tenantId;
+                // Get vault entry
+                const row = conn.get(`SELECT ciphertext, iv, auth_tag, algorithm, key_version
+           FROM core_vault WHERE key_name = ? AND (tenant_id = ? OR (tenant_id IS NULL AND ? IS NULL))`, [keyName, tenantId, tenantId]);
+                if (!row) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'VAULT_KEY_NOT_FOUND',
+                            message: `Vault key "${keyName}" not found`,
+                            spec: 'I-11',
+                        },
+                    };
+                }
+                // Get key metadata for re-derivation
+                const keyRow = conn.get(`SELECT salt, iterations FROM core_encryption_keys
+           WHERE purpose = ? AND (tenant_id = ? OR (tenant_id IS NULL AND ? IS NULL))
+           ORDER BY created_at DESC LIMIT 1`, [`vault:${keyName}`, tenantId, tenantId]);
+                if (!keyRow) {
+                    return {
+                        ok: false,
+                        error: {
+                            code: 'VAULT_KEY_METADATA_NOT_FOUND',
+                            message: `Key metadata for vault key "${keyName}" not found`,
+                            spec: 'I-11',
+                        },
+                    };
+                }
+                // Re-derive key
+                const salt = Buffer.from(keyRow.salt, 'base64');
+                const derivedKeyResult = crypto.deriveKey(masterKey, salt, keyRow.iterations);
+                if (!derivedKeyResult.ok)
+                    return derivedKeyResult;
+                // Decrypt
+                const payload = {
+                    ciphertext: Buffer.from(row.ciphertext, 'base64'),
+                    iv: Buffer.from(row.iv, 'base64'),
+                    authTag: Buffer.from(row.auth_tag, 'base64'),
+                    keyVersion: row.key_version,
+                    algorithm: row.algorithm,
+                };
+                return crypto.decrypt(payload, derivedKeyResult.value);
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    error: {
+                        code: 'VAULT_RETRIEVE_FAILED',
+                        message: err instanceof Error ? err.message : String(err),
+                        spec: 'I-11',
+                    },
+                };
+            }
+        },
+        /**
+         * Delete vault entry.
+         * S ref: I-02 (data deletion)
+         */
+        remove(conn, ctx, keyName) {
+            try {
+                const tenantId = ctx.tenantId;
+                conn.run(`DELETE FROM core_vault WHERE key_name = ? AND (tenant_id = ? OR (tenant_id IS NULL AND ? IS NULL))`, [keyName, tenantId, tenantId]);
+                return { ok: true, value: undefined };
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    error: {
+                        code: 'VAULT_REMOVE_FAILED',
+                        message: err instanceof Error ? err.message : String(err),
+                        spec: 'I-02',
+                    },
+                };
+            }
+        },
+        /**
+         * List vault key names (not values).
+         * S ref: I-11 (key inventory without exposing secrets)
+         */
+        list(conn, ctx) {
+            try {
+                const tenantId = ctx.tenantId;
+                const rows = conn.query(`SELECT key_name FROM core_vault WHERE tenant_id = ? OR (tenant_id IS NULL AND ? IS NULL)
+           ORDER BY key_name`, [tenantId, tenantId]);
+                return { ok: true, value: rows.map(r => r.key_name) };
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    error: {
+                        code: 'VAULT_LIST_FAILED',
+                        message: err instanceof Error ? err.message : String(err),
+                        spec: 'I-11',
+                    },
+                };
+            }
+        },
+    };
+}
+export function createStringEncryption(crypto, masterKey) {
+    // Use first KEY_LENGTH bytes of masterKey as the AES-256 key
+    const key = masterKey.subarray(0, KEY_LENGTH);
+    return {
+        encrypt(plaintext) {
+            const result = crypto.encrypt(Buffer.from(plaintext, 'utf8'), key);
+            if (!result.ok) {
+                throw new Error(`Encryption failed: ${result.error.code}`);
+            }
+            const { iv, authTag, ciphertext } = result.value;
+            return `${iv.toString('base64')}:${authTag.toString('base64')}:${ciphertext.toString('base64')}`;
+        },
+        decrypt(ciphertext) {
+            const parts = ciphertext.split(':');
+            if (parts.length !== 3) {
+                throw new Error('Invalid encrypted format: expected iv:authTag:ciphertext');
+            }
+            const [ivB64, authTagB64, ciphertextB64] = parts;
+            const payload = {
+                iv: Buffer.from(ivB64, 'base64'),
+                authTag: Buffer.from(authTagB64, 'base64'),
+                ciphertext: Buffer.from(ciphertextB64, 'base64'),
+                keyVersion: 1,
+                algorithm: AES_256_GCM,
+            };
+            const result = crypto.decrypt(payload, key);
+            if (!result.ok) {
+                throw new Error(`Decryption failed: ${result.error.code}`);
+            }
+            return result.value.toString('utf8');
+        },
+    };
+}
+export { DEFAULT_PBKDF2_ITERATIONS, KEY_LENGTH, IV_LENGTH, AUTH_TAG_LENGTH, AES_256_GCM };
+//# sourceMappingURL=crypto_engine.js.map

package/dist/kernel/crypto/crypto_engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto_engine.js","sourceRoot":"","sources":["../../../src/kernel/crypto/crypto_engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EACxD,WAAW,EAAE,UAAU,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,0CAA0C;AAC1C,MAAM,WAAW,GAAG,aAAsB,CAAC;AAC3C,MAAM,UAAU,GAAG,EAAE,CAAC,CAAI,WAAW;AACrC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAK,gDAAgD;AAC1E,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,WAAW;AAEvC,8CAA8C;AAC9C,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL;;;;WAIG;QACH,SAAS,CAAC,SAAiB,EAAE,IAAY,EAAE,UAAkB;YAC3D,IAAI,CAAC;gBACH,IAAI,SAAS,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;oBAClC,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,oBAAoB;4BAC1B,OAAO,EAAE,+BAA+B,UAAU,eAAe,SAAS,CAAC,MAAM,EAAE;4BACnF,IAAI,EAAE,MAAM;yBACb;qBACF,CAAC;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBAC9E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,uBAAuB;wBAC7B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;wBACzD,IAAI,EAAE,MAAM;qBACb;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,OAAO,CAAC,SAAiB,EAAE,GAAW;YACpC,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBAC9B,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,oBAAoB;4BAC1B,OAAO,EAAE,uBAAuB,UAAU,eAAe,GAAG,CAAC,MAAM,EAAE;4BACrE,IAAI,EAAE,MAAM;yBACb;qBACF,CAAC;gBACJ,CAAC;gBAED,4DAA4D;gBAC5D,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;gBAClC,MAAM,MAAM,GAAG,cAAc,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBACpD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAEpC,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,UAAU;wBACV,EAAE;wBACF,OAAO;wBACP,UAAU,EAAE,CAAC;wBACb,SAAS,EAAE,WAAW;qBACvB;iBACF,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,mBAAmB;wBACzB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;wBACzD,IAAI,EAAE,MAAM;qBACb;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,OAAO,CAAC,OAAyB,EAAE,GAAW;YAC5C,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBAC9B,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,oBAAoB;4BAC1B,OAAO,EAAE,uBAAuB,UAAU,eAAe,GAAG,CAAC,MAAM,EAAE;4BACrE,IAAI,EAAE,MAAM;yBACb;qBACF,CAAC;gBACJ,CAAC;gBAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBAChE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACrC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAEzF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,mBAAmB;wBACzB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;wBACzD,IAAI,EAAE,MAAM;qBACb;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,MAAM,CAAC,IAAY;YACjB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;QAED;;;WAGG;QACH,UAAU,CAAC,IAAY,EAAE,MAAc;YACrC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAoB,EAAE,SAAiB;IAC3E,OAAO;QACL;;;WAGG;QACH,KAAK,CAAC,IAAwB,EAAE,GAAqB,EAAE,OAAe,EAAE,SAAiB;YACvF,IAAI,CAAC;gBACH,oCAAoC;gBACpC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;gBAC7B,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;gBACtF,IAAI,CAAC,gBAAgB,CAAC,EAAE;oBAAE,OAAO,gBAAgB,CAAC;gBAElD,oBAAoB;gBACpB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACxE,IAAI,CAAC,aAAa,CAAC,EAAE;oBAAE,OAAO,aAAa,CAAC;gBAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC;gBACpC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAE9B,oBAAoB;gBACpB,IAAI,CAAC,GAAG,CACN;;;;;;;+DAOqD,EACrD,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO;oBACrB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACrC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC7B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAClC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CACxC,CAAC;gBAEF,2DAA2D;gBAC3D,qEAAqE;gBACrE,+DAA+D;gBAC/D,IAAI,CAAC,GAAG,CACN;;;;;4CAKkC,EAClC,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE;oBAC1C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,EAAE,WAAW,CAAC,CAClE,CAAC;gBAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;wBACzD,IAAI,EAAE,MAAM;qBACb;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,QAAQ,CAAC,IAAwB,EAAE,GAAqB,EAAE,OAAe;YACvE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAE9B,kBAAkB;gBAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAIlB;uGAC6F,EAC7F,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAC9B,CAAC;gBAEF,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,qBAAqB;4BAC3B,OAAO,EAAE,cAAc,OAAO,aAAa;4BAC3C,IAAI,EAAE,MAAM;yBACb;qBACF,CAAC;gBACJ,CAAC;gBAED,qCAAqC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CACrB;;4CAEkC,EAClC,CAAC,SAAS,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CACzC,CAAC;gBAEF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE;4BACL,IAAI,EAAE,8BAA8B;4BACpC,OAAO,EAAE,+BAA+B,OAAO,aAAa;4BAC5D,IAAI,EAAE,MAAM;yBACb;qBACF,CAAC;gBACJ,CAAC;gBAED,gBAAgB;gBAChB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAChD,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC9E,IAAI,CAAC,gBAAgB,CAAC,EAAE;oBAAE,OAAO,gBAAgB,CAAC;gBAElD,UAAU;gBACV,MAAM,OAAO,GAAqB;oBAChC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC;oBACjD,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC;oBACjC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC;oBAC5C,UAAU,EAAE,GAAG,CAAC,WAAW;oBAC3B,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB,CAAC;gBAEF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,uBAAuB;wBAC7B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;wBACzD,IAAI,EAAE,MAAM;qBACb;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,MAAM,CAAC,IAAwB,EAAE,GAAqB,EAAE,OAAe;YACrE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAC9B,IAAI,CAAC,GAAG,CACN,oGAAoG,EACpG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAC9B,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,qBAAqB;wBAC3B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;wBACzD,IAAI,EAAE,MAAM;qBACb;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;WAGG;QACH,IAAI,CAAC,IAAwB,EAAE,GAAqB;YAClD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CACrB;6BACmB,EACnB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CACrB,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE;wBACL,IAAI,EAAE,mBAAmB;wBACzB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;wBACzD,IAAI,EAAE,MAAM;qBACb;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAkBD,MAAM,UAAU,sBAAsB,CAAC,MAAoB,EAAE,SAAiB;IAC5E,6DAA6D;IAC7D,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAE9C,OAAO;QACL,OAAO,CAAC,SAAiB;YACvB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;YACjD,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnG,CAAC;QAED,OAAO,CAAC,UAAkB;YACxB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;YAC7E,MAAM,OAAO,GAAG;gBACd,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAChC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;gBAC1C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC;gBAChD,UAAU,EAAE,CAAC;gBACb,SAAS,EAAE,WAAW;aACvB,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,yBAAyB,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC"}

package/dist/kernel/database/database_lifecycle.d.ts

@@ -0,0 +1,24 @@
+/**
+ * SQLite database lifecycle implementation.
+ * S ref: §3.1, §3.4, §3.6, I-01, I-05, C-05, FM-05
+ *
+ * Phase: 1 (Kernel) -- Build Order 1
+ * Foundation: everything else depends on this.
+ *
+ * §3.1: SQLite foundation -- single-file database.
+ * §3.4: WAL mode, ACID transactions, crash recovery.
+ * §3.6: Entire engine state in dataDir. Backup = cp -r.
+ * I-01: Only production dependency is better-sqlite3.
+ * I-05: Database never in inconsistent state.
+ * C-05: Forward-only migrations.
+ * FM-05: WAL mode + busy timeout + foreign keys.
+ */
+import type { DatabaseLifecycle } from '../interfaces/index.js';
+declare const GENESIS_HASH = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+/**
+ * Create a DatabaseLifecycle implementation.
+ * S ref: §3.1, §3.4, §3.6, I-01, I-05, C-05, FM-05
+ */
+export declare function createDatabaseLifecycle(): DatabaseLifecycle;
+export { GENESIS_HASH };
+//# sourceMappingURL=database_lifecycle.d.ts.map

package/dist/kernel/database/database_lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database_lifecycle.d.ts","sourceRoot":"","sources":["../../../src/kernel/database/database_lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,OAAO,KAAK,EACkC,iBAAiB,EAG9D,MAAM,wBAAwB,CAAC;AAIhC,QAAA,MAAM,YAAY,qEAAqE,CAAC;AAwGxF;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,CA2U3D;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}