fix(documents): encrypt staged extracted-fact PHI at rest

The inbound-document store encrypts the raw upload
(`inbound_documents.content_encrypted`) because it is sensitive clinical
data, but the per-fact staging columns persisted the same class of data in
the clear: `extracted_facts.data_json` held the transcribed clinical values
(diagnosis text, lab values, medication names, stated codes) and
`provenance_json` held the verbatim source span (up to 2000 chars copied
straight out of the report). The at-rest guarantee was defeated for staged
facts, which persist through PENDING and are retained after the decision.

Convert both columns to the AES-256-GCM `*_encrypted` BYTEA convention shared
with the note columns, going through the same Bytes codec. The upload and
fact-edit paths encrypt on write; the confirm path decrypts at commit time to
write into the normal structured stores, so the review-then-confirm flow is
unchanged. Reads are fail-closed (a bad key id throws).

Register both columns in the encrypted-columns registry and the key-rotation
script so a dropped legacy key cannot strand them (the guard test enforces
both). Migration 0220 swaps the plaintext JSONB columns for the encrypted
BYTEA columns; pre-confirm staged rows are ephemeral and cannot be
re-encrypted in SQL, so any left by a pre-release build are dropped rather
than retained as plaintext (their parent document keeps its encrypted
original).

src/app/api/documents/inbound/[id]/facts/[factId]/route.ts

@@ -17,8 +17,8 @@ import {
   returnAllZodIssues,
   safeJson,
 } from "@/lib/api-response";
-import { prisma, toJson } from "@/lib/db";
-import { serialiseFact } from "@/lib/documents/store";
+import { prisma } from "@/lib/db";
+import { encryptFactData, serialiseFact } from "@/lib/documents/store";
 import { annotate } from "@/lib/logging/context";
 import { requireModuleEnabled } from "@/lib/modules/gate";
 import {
@@ -113,7 +113,7 @@ export const PATCH = apiHandler(
     const updated = await prisma.extractedFact.update({
       where: { id: fact.id },
       data: {
-        dataJson: toJson(editToFactData(parsed.data)),
+        dataEncrypted: encryptFactData(editToFactData(parsed.data)),
         // The values are now user-asserted — the fail-closed gate is cleared.
         needsReview: false,
       },

src/app/api/documents/inbound/route.ts

@@ -40,7 +40,7 @@ import {
   resolveDailyCap,
 } from "@/lib/ai/coach/budget";
 import { auditLog } from "@/lib/auth/audit";
-import { prisma, toJson } from "@/lib/db";
+import { prisma } from "@/lib/db";
 import {
   InboundExtractError,
   runInboundExtraction,
@@ -48,6 +48,8 @@ import {
 } from "@/lib/documents/extract";
 import {
   encryptDocumentToBytes,
+  encryptFactData,
+  encryptFactProvenance,
   serialiseDocument,
 } from "@/lib/documents/store";
 import {
@@ -108,8 +110,8 @@ async function persistExtraction(args: {
           status: "PENDING" as const,
           confidence: f.confidence,
           needsReview: f.needsReview,
-          dataJson: toJson(f.data),
-          provenanceJson: toJson(f.provenance),
+          dataEncrypted: encryptFactData(f.data),
+          provenanceEncrypted: encryptFactProvenance(f.provenance),
         })),
       },
     },

src/lib/crypto/encrypted-columns.ts

@@ -179,6 +179,13 @@ export const ENCRYPTED_COLUMNS: readonly EncryptedColumn[] = [
   // AES-256-GCM string → UTF-8 bytes. The most sensitive blob in the wave
   // (a full clinical document); never logged, never in wide-event meta.
   { model: "InboundDocument", field: "contentEncrypted", kind: "bytes" },
+  // The staged extracted-fact payloads: the FHIR-staged clinical values
+  // (diagnosis text / lab values / medication names / stated codes) and the
+  // verbatim source-span provenance. Both are PHI transcribed from the source
+  // document, so the staging rows carry the same at-rest guarantee as the
+  // document itself rather than persisting as plaintext JSONB.
+  { model: "ExtractedFact", field: "dataEncrypted", kind: "bytes" },
+  { model: "ExtractedFact", field: "provenanceEncrypted", kind: "bytes" },
 ] as const;
 
 /** Stable `Model.field` key for a registry entry. */

src/lib/documents/commit.ts

@@ -18,6 +18,7 @@
  */
 import { encryptToBytes } from "@/lib/ai/coach/bytes-codec";
 import { prisma } from "@/lib/db";
+import { decryptFactData } from "@/lib/documents/store";
 import { resolveOrMintBiomarker } from "@/lib/labs/biomarker-store";
 import type { ExtractedFact } from "@/generated/prisma/client";
 import type {
@@ -152,20 +153,14 @@ export async function commitApprovedFact(
   userId: string,
   fact: ExtractedFact,
 ): Promise<CommittedRecordRef> {
+  // Decrypt the staged payload at confirm time to write it into the normal
+  // structured store. Fail-closed: a bad key id throws and aborts the commit.
+  const data = decryptFactData(fact.dataEncrypted);
   if (fact.factType === "OBSERVATION") {
-    return commitObservation(
-      userId,
-      fact.dataJson as unknown as ObservationFactData,
-    );
+    return commitObservation(userId, data as ObservationFactData);
   }
   if (fact.factType === "CONDITION") {
-    return commitCondition(
-      userId,
-      fact.dataJson as unknown as ConditionFactData,
-    );
+    return commitCondition(userId, data as ConditionFactData);
   }
-  return commitMedication(
-    userId,
-    fact.dataJson as unknown as MedicationStatementFactData,
-  );
+  return commitMedication(userId, data as MedicationStatementFactData);
 }

src/lib/documents/store.ts

@@ -8,6 +8,7 @@
  */
 import { Buffer } from "node:buffer";
 
+import { decryptFromBytes, encryptToBytes } from "@/lib/ai/coach/bytes-codec";
 import { decrypt, encrypt } from "@/lib/crypto";
 import type {
   ExtractedFact,
@@ -40,6 +41,37 @@ export function decryptDocumentFromBytes(buf: Uint8Array): Buffer {
   return Buffer.from(base64, "base64");
 }
 
+/**
+ * Encrypt a staged fact's FHIR-staged payload into the `Bytes` column the
+ * schema stores. The structured clinical values (diagnosis text, lab values,
+ * medication names, stated codes) are PHI, so they ride the shared AES-256-GCM
+ * note codec (JSON → `encrypt()` string → UTF-8 bytes) rather than plaintext
+ * JSONB.
+ */
+export function encryptFactData(data: FactData): Uint8Array<ArrayBuffer> {
+  return encryptToBytes(JSON.stringify(data));
+}
+
+/** Decrypt a staged fact's payload back to its DTO shape. Throws on bad key. */
+export function decryptFactData(buf: Uint8Array): FactData {
+  return JSON.parse(decryptFromBytes(buf)) as FactData;
+}
+
+/**
+ * Encrypt a staged fact's provenance. The verbatim source span is a clinical
+ * document excerpt (PHI); encrypted with the same codec as the fact data.
+ */
+export function encryptFactProvenance(
+  provenance: FactProvenance,
+): Uint8Array<ArrayBuffer> {
+  return encryptToBytes(JSON.stringify(provenance));
+}
+
+/** Decrypt a staged fact's provenance back to its DTO shape. */
+export function decryptFactProvenance(buf: Uint8Array): FactProvenance {
+  return JSON.parse(decryptFromBytes(buf)) as FactProvenance;
+}
+
 /** Map a persisted document row (+ counts) to the list/detail DTO. */
 export function serialiseDocument(
   doc: InboundDocument,
@@ -72,8 +104,8 @@ export function serialiseFact(fact: ExtractedFact): ExtractedFactDto {
     status: fact.status as ExtractedFactStatus,
     confidence: fact.confidence,
     needsReview: fact.needsReview,
-    data: fact.dataJson as unknown as FactData,
-    provenance: fact.provenanceJson as unknown as FactProvenance,
+    data: decryptFactData(fact.dataEncrypted),
+    provenance: decryptFactProvenance(fact.provenanceEncrypted),
     committedRecordId: fact.committedRecordId,
     committedRecordType: fact.committedRecordType,
   };