aeat.adapters.persistence.storage package¶

Persistence layer public API.

Public API of the storage subpackage. Callers outside adapters.persistence.storage must import only from here; internal modules (sql._orm, sql.engine, sql.session, sql.repository, and the encryption substrate under crypto, envelope, master_key, blob_store, secret_store) are implementation details.

The phrase encryption substrate denotes the layered crypto stack (master-key provider → envelope wrapper → encrypted blob store → typed column helpers) that every persisted record passes through. Throughout the package, “substrate” without a qualifier refers to this stack.

The public surface is grouped by contract:

SQL and secure-object persistence — engine/session helpers, typed catalogue repositories, SecureObjectRepository, and the secure-object work records SecureObjectWrite, SecureObjectDeletion, and SecureObjectNamespaceIntegrity.
Encryption substrate — Envelope, CipherEnvelope, EncryptedBlobStore, SecretStore, MasterKeyProvider, and the column-level helpers EncryptedString, EncryptedBytes, EncryptedJSON, and HashedLookup.
Path-shaped SDK bridges — materialise_secret(), export_to_temp_path(), and get_secret_store() for callers that cannot consume in-memory secret bytes.
Runtime and custody boundary — StorageRuntime, StorageRuntimeReadiness, runtime repository factories, activate_session(), get_active_master_key(), activate_master_key_provider(), and get_master_key_provider().
Recovery and rotation — RecoveryRecord, MintedRecovery, BIP-39 recovery helpers, RotationPlanEntry, RotationSummary, and master-key / blob-store rotation functions.
Secure-object hierarchy registry — STORAGE_NAMESPACE_REGISTRY, STORAGE_PATH_DEFINITIONS, namespace constants, and secure_object_logical_path() / secure_object_namespace_logical_path(); callers must use these exported symbols instead of constructing persisted secure-storage locations by hand.
Governance helpers — SensitivityClass, classification policies, redaction helpers, corpus manifests, path-safety helpers, and file-lock primitives.

aeat.adapters.persistence.storage package¶

Subpackages¶

Submodules¶