@voltro/plugin-deactivation 0.86.0 → 0.87.0

package/dist/privacyRequests.js

@@ -0,0 +1,221 @@
+import { and as e, eq as t, gt as n, id as r, json as i, lte as a, or as o, queryFor as s, table as c, text as l, timestamp as u } from "@voltro/database";
+import { createHash as d } from "node:crypto";
+//#region src/privacyRequests.ts
+var f = c("_voltro_privacy_requests", {
+	id: r({ prefix: "pvreq" }),
+	subjectId: l().nullable(),
+	tenantId: l().nullable(),
+	kind: l().oneOf(["user", "guest"]),
+	activeKey: l().unique(),
+	status: l().oneOf([
+		"pending",
+		"erasing",
+		"withdrawn",
+		"completed"
+	]),
+	requestedAt: u(),
+	dueAt: u(),
+	claimedAt: u().nullable(),
+	withdrawnAt: u().nullable(),
+	completedAt: u().nullable(),
+	completedPlugins: i()
+}).index(["status", "dueAt"]).index(["subjectId", "tenantId"]).nonReactive(), p = f.tableName, m = (e) => s(f).where(t("id", e)).descriptor, h = (n) => e(t("subjectId", n.subjectId), t("tenantId", n.tenantId), t("kind", n.kind)), g = class extends Error {
+	code;
+	constructor(e) {
+		super(`privacy request: ${e}`), this.code = e, this.name = "PrivacyRequestRefused";
+	}
+}, _ = (e) => {
+	let t = e instanceof Date ? e.getTime() : new Date(String(e)).getTime();
+	if (!Number.isSafeInteger(t)) throw new g("request_unavailable");
+	return t;
+}, v = (e) => e === null ? null : _(e), y = (e) => {
+	if (typeof e.id != "string" || ![
+		"pending",
+		"erasing",
+		"withdrawn",
+		"completed"
+	].includes(String(e.status)) || !Array.isArray(e.completedPlugins) || !e.completedPlugins.every((e) => typeof e == "string")) throw new g("request_unavailable");
+	return {
+		requestId: e.id,
+		status: e.status,
+		requestedAt: _(e.requestedAt),
+		dueAt: _(e.dueAt),
+		claimedAt: v(e.claimedAt),
+		withdrawnAt: v(e.withdrawnAt),
+		completedAt: v(e.completedAt),
+		completedPlugins: [...e.completedPlugins]
+	};
+}, b = (e) => {
+	if (typeof e != "string" || e.trim().length === 0 || e.length > 128) throw new g("invalid_request");
+}, x = (e) => {
+	if (b(e.subjectId), e.kind !== "user" && e.kind !== "guest" || e.tenantId !== null && (typeof e.tenantId != "string" || !e.tenantId.trim())) throw new g("invalid_request");
+}, S = (e) => "active:" + d("sha256").update(JSON.stringify([
+	e.tenantId,
+	e.kind,
+	e.subjectId
+])).digest("hex"), C = (e, t) => e.subjectId === t.subjectId && e.tenantId === t.tenantId && e.kind === t.kind, w = async (e) => {
+	try {
+		return await e();
+	} catch (e) {
+		throw e instanceof g ? e : new g("request_unavailable");
+	}
+}, T = (r, i) => {
+	if (!Number.isSafeInteger(i.withdrawalMs) || i.withdrawalMs < 0) throw new g("invalid_request");
+	let c = i.now ?? Date.now, l = () => {
+		let e = c();
+		if (!Number.isSafeInteger(e) || !Number.isFinite(new Date(e).getTime())) throw new g("invalid_request");
+		return e;
+	}, u = async (e, t) => (await e.query(m(t)))[0];
+	return {
+		inspectRecent: async () => w(async () => {
+			let e = l(), t = await r.query(s(f).orderBy("requestedAt", "desc").orderBy("id", "desc").limit(101).descriptor);
+			return {
+				observedAt: e,
+				hasMore: t.length > 100,
+				requests: t.slice(0, 100).map(y)
+			};
+		}),
+		exportOwned: async (t) => w(async () => {
+			x(t);
+			let i = [], a;
+			for (let o = 0; o < 100; o++) {
+				let o = a === void 0 ? h(t) : e(h(t), n("id", a)), c = await r.query(s(f).where(o).orderBy("id", "asc").limit(1e3).descriptor);
+				for (let e of c) C(e, t) && i.push(y(e));
+				if (c.length < 1e3) return i;
+				let l = c.at(-1);
+				if (typeof l?.id != "string" || l.id === a) throw new g("request_unavailable");
+				a = l.id;
+			}
+			throw new g("request_unavailable");
+		}),
+		dispatchBatch: async (i) => w(async () => {
+			if (!Number.isSafeInteger(i.limit) || i.limit < 1 || i.limit > 1e3) throw new g("invalid_request");
+			let c = l(), u = o(t("status", "erasing"), e(t("status", "pending"), a("dueAt", new Date(c)))), d = i.after;
+			if (d !== void 0 && (b(d.requestId), !Number.isSafeInteger(d.dueAt) || !Number.isFinite(new Date(d.dueAt).getTime()))) throw new g("invalid_request");
+			let p = d === void 0 ? u : e(u, o(n("dueAt", new Date(d.dueAt)), e(t("dueAt", new Date(d.dueAt)), n("id", d.requestId)))), m = await r.query(s(f).where(p).orderBy("dueAt", "asc").orderBy("id", "asc").select("id", "dueAt").limit(i.limit + 1).descriptor), h = m.slice(0, i.limit).map((e) => {
+				if (typeof e.id != "string") throw new g("request_unavailable");
+				return b(e.id), {
+					requestId: e.id,
+					dueAt: _(e.dueAt)
+				};
+			});
+			return {
+				requestIds: h.map((e) => e.requestId),
+				next: m.length > i.limit ? h.at(-1) ?? null : null
+			};
+		}),
+		readWorker: async (e) => w(async () => {
+			b(e);
+			let t = await u(r, e);
+			if (!t) return null;
+			if (t.kind !== "user" && t.kind !== "guest") throw new g("request_unavailable");
+			return {
+				receipt: y(t),
+				kind: t.kind
+			};
+		}),
+		request: async (e, n) => w(async () => {
+			b(e), x(n);
+			let a = l(), o = a + i.withdrawalMs;
+			if (!Number.isSafeInteger(o) || !Number.isFinite(new Date(o).getTime())) throw new g("invalid_request");
+			try {
+				let t = await r.insertIgnoreWithOutcome(p, {
+					id: e,
+					subjectId: n.subjectId,
+					tenantId: n.tenantId,
+					kind: n.kind,
+					activeKey: S(n),
+					status: "pending",
+					requestedAt: new Date(a),
+					dueAt: new Date(o),
+					claimedAt: null,
+					withdrawnAt: null,
+					completedAt: null,
+					completedPlugins: []
+				}, { conflictColumns: ["id"] });
+				if (!C(t.row, n)) throw new g("request_unavailable");
+				return y(t.row);
+			} catch (i) {
+				let a = await u(r, e);
+				if (a) {
+					if (!C(a, n)) throw new g("request_unavailable");
+					return y(a);
+				}
+				throw (await r.query(s(f).where(t("activeKey", S(n))).descriptor)).length === 0 ? i : new g("active_request_exists");
+			}
+		}),
+		readOwned: async (e, t) => w(async () => {
+			b(e), x(t);
+			let n = await u(r, e);
+			return n && C(n, t) ? y(n) : null;
+		}),
+		withdraw: async (i, a) => w(async () => {
+			b(i), x(a);
+			let o = l();
+			return r.transactional(async (r) => {
+				await r.updateMany(p, {
+					status: "withdrawn",
+					withdrawnAt: new Date(o),
+					activeKey: `terminal:${i}`
+				}, { where: e(t("id", i), h(a), t("status", "pending"), n("dueAt", new Date(o))) });
+				let s = await u(r, i);
+				if (!s || !C(s, a)) throw new g("request_unavailable");
+				if (s.status !== "withdrawn") throw new g("invalid_transition");
+				return y(s);
+			});
+		}),
+		claim: async (n) => w(async () => {
+			b(n);
+			let i = l();
+			return r.transactional(async (r) => {
+				await r.updateMany(p, {
+					status: "erasing",
+					claimedAt: new Date(i)
+				}, { where: e(t("id", n), t("status", "pending"), a("dueAt", new Date(i))) });
+				let o = await u(r, n);
+				if (!o) throw new g("request_unavailable");
+				let s = y(o);
+				if (s.status === "pending") throw new g("invalid_transition");
+				if (s.status !== "erasing") return {
+					receipt: s,
+					target: null
+				};
+				if (typeof o.subjectId != "string" || o.tenantId !== null && typeof o.tenantId != "string" || o.kind !== "user" && o.kind !== "guest") throw new g("request_unavailable");
+				return {
+					receipt: s,
+					target: {
+						subjectId: o.subjectId,
+						tenantId: o.tenantId,
+						kind: o.kind
+					}
+				};
+			});
+		}),
+		finish: async (n, i, a) => w(async () => {
+			if (b(n), x(i), a.some((e) => typeof e != "string" || !e.trim()) || new Set(a).size !== a.length) throw new g("invalid_request");
+			let o = l();
+			await r.transactional(async (r) => {
+				let c = await r.updateMany(p, { status: "erasing" }, { where: e(t("id", n), h(i), t("status", "erasing")) }), l = await u(r, n);
+				if (c !== 1 || !l || !C(l, i) || typeof l.id != "string") throw new g("invalid_transition");
+				await r.update(p, l.id, {
+					status: "completed",
+					completedAt: new Date(o),
+					completedPlugins: [...a],
+					subjectId: null,
+					tenantId: null,
+					activeKey: `terminal:${l.id}`
+				});
+				for (let e of await r.query(s(f).where(h(i)).descriptor)) if (C(e, i)) {
+					if (e.status !== "withdrawn" || typeof e.id != "string") throw new g("invalid_transition");
+					await r.update(p, e.id, {
+						subjectId: null,
+						tenantId: null,
+						activeKey: `terminal:${e.id}`
+					});
+				}
+			});
+		})
+	};
+};
+//#endregion
+export { g as PrivacyRequestRefused, T as dataStorePrivacyRequests, f as privacyRequestsTable };

package/dist/privacyRpc.d.ts

@@ -0,0 +1,66 @@
+import { ActionProcedureDescriptor } from '@voltro/protocol';
+import { PluginRpcClientDescriptor } from '@voltro/protocol';
+import { Schema } from 'effect';
+import { YieldableError } from 'effect/Cause';
+
+export declare const exportSelfDescriptor: ActionProcedureDescriptor<"privacy.exportSelf", Schema.Struct<{
+    readonly requestId: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly requestId: Schema.String;
+    readonly plugins: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly data: Schema.Unknown;
+    }>>;
+}>, typeof PrivacyCoordinatorFailure>;
+
+declare class PrivacyCoordinatorFailure extends PrivacyCoordinatorFailure_base {
+}
+
+declare const PrivacyCoordinatorFailure_base: Schema.Class<PrivacyCoordinatorFailure, Schema.TaggedStruct<"PrivacyCoordinatorFailure", {
+    readonly code: Schema.Literals<readonly ["identity_required", "invalid_request", "request_unavailable", "active_request_exists", "invalid_transition", "coverage_missing", "hook_failed"]>;
+    readonly completed: Schema.$Array<Schema.String>;
+    readonly missing: Schema.$Array<Schema.String>;
+}>, YieldableError>;
+
+export declare const privacyRpcClientImports: ReadonlyArray<PluginRpcClientDescriptor>;
+
+export declare const requestErasureDescriptor: ActionProcedureDescriptor<"privacy.requestErasure", Schema.Struct<{
+    readonly requestId: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly requestId: Schema.String;
+    readonly status: Schema.Literals<readonly ["pending", "erasing", "withdrawn", "completed"]>;
+    readonly requestedAt: Schema.Number;
+    readonly dueAt: Schema.Number;
+    readonly claimedAt: Schema.NullOr<Schema.Number>;
+    readonly withdrawnAt: Schema.NullOr<Schema.Number>;
+    readonly completedAt: Schema.NullOr<Schema.Number>;
+    readonly completedPlugins: Schema.$Array<Schema.String>;
+}>, typeof PrivacyCoordinatorFailure>;
+
+export declare const requestStatusDescriptor: ActionProcedureDescriptor<"privacy.requestStatus", Schema.Struct<{
+    readonly requestId: Schema.String;
+}>, Schema.NullOr<Schema.Struct<{
+    readonly requestId: Schema.String;
+    readonly status: Schema.Literals<readonly ["pending", "erasing", "withdrawn", "completed"]>;
+    readonly requestedAt: Schema.Number;
+    readonly dueAt: Schema.Number;
+    readonly claimedAt: Schema.NullOr<Schema.Number>;
+    readonly withdrawnAt: Schema.NullOr<Schema.Number>;
+    readonly completedAt: Schema.NullOr<Schema.Number>;
+    readonly completedPlugins: Schema.$Array<Schema.String>;
+}>>, typeof PrivacyCoordinatorFailure>;
+
+export declare const withdrawErasureDescriptor: ActionProcedureDescriptor<"privacy.withdrawErasure", Schema.Struct<{
+    readonly requestId: Schema.String;
+}>, Schema.Struct<{
+    readonly requestId: Schema.String;
+    readonly status: Schema.Literals<readonly ["pending", "erasing", "withdrawn", "completed"]>;
+    readonly requestedAt: Schema.Number;
+    readonly dueAt: Schema.Number;
+    readonly claimedAt: Schema.NullOr<Schema.Number>;
+    readonly withdrawnAt: Schema.NullOr<Schema.Number>;
+    readonly completedAt: Schema.NullOr<Schema.Number>;
+    readonly completedPlugins: Schema.$Array<Schema.String>;
+}>, typeof PrivacyCoordinatorFailure>;
+
+export { }

package/dist/privacyRpc.js

@@ -0,0 +1,64 @@
+import { PrivacyCoordinatorFailure as e, PrivacyExportPackageSchema as t, PrivacyRequestReceiptSchema as n } from "./privacyContract.js";
+import { Schema as r } from "effect";
+import { defineAction as i } from "@voltro/protocol";
+//#region src/privacyRpc.ts
+var a = r.Struct({ requestId: r.optional(r.String) }), o = r.Struct({ requestId: r.String }), s = i({
+	name: "privacy.requestErasure",
+	input: a,
+	output: n,
+	error: e,
+	guards: [{ authenticated: !0 }]
+}), c = i({
+	name: "privacy.requestStatus",
+	input: o,
+	output: r.NullOr(n),
+	error: e,
+	guards: [{ authenticated: !0 }]
+}), l = i({
+	name: "privacy.withdrawErasure",
+	input: o,
+	output: n,
+	error: e,
+	guards: [{ authenticated: !0 }]
+}), u = i({
+	name: "privacy.exportSelf",
+	input: a,
+	output: t,
+	error: e,
+	guards: [{ authenticated: !0 }]
+}), d = [
+	{
+		tag: "privacy.requestErasure",
+		kind: "action",
+		import: {
+			module: "@voltro/plugin-deactivation/privacy/rpc",
+			name: "requestErasureDescriptor"
+		}
+	},
+	{
+		tag: "privacy.requestStatus",
+		kind: "action",
+		import: {
+			module: "@voltro/plugin-deactivation/privacy/rpc",
+			name: "requestStatusDescriptor"
+		}
+	},
+	{
+		tag: "privacy.withdrawErasure",
+		kind: "action",
+		import: {
+			module: "@voltro/plugin-deactivation/privacy/rpc",
+			name: "withdrawErasureDescriptor"
+		}
+	},
+	{
+		tag: "privacy.exportSelf",
+		kind: "action",
+		import: {
+			module: "@voltro/plugin-deactivation/privacy/rpc",
+			name: "exportSelfDescriptor"
+		}
+	}
+];
+//#endregion
+export { u as exportSelfDescriptor, d as privacyRpcClientImports, s as requestErasureDescriptor, c as requestStatusDescriptor, l as withdrawErasureDescriptor };

package/dist/privacyService.js

@@ -0,0 +1,5 @@
+import { Context as e } from "effect";
+//#region src/privacyService.ts
+var t = class extends e.Service()("voltro/PrivacyService") {};
+//#endregion
+export { t as PrivacyService };

package/dist/privacyTesting.d.ts

@@ -0,0 +1,85 @@
+import { Context } from 'effect';
+import { Effect } from 'effect';
+import { Layer } from 'effect';
+import { Schema } from 'effect';
+import { Subject } from '@voltro/protocol';
+import { SystemPortFixture } from '@voltro/testing/system';
+import { SystemSlotFixture } from '@voltro/testing/system';
+import { WorkflowRunHandle } from '@voltro/protocol';
+import { YieldableError } from 'effect/Cause';
+
+export declare const fakePrivacyOperations: (overrides?: Partial<PrivacyOperations>) => PrivacyOperations;
+
+declare class PrivacyCoordinatorFailure extends PrivacyCoordinatorFailure_base {
+}
+
+declare const PrivacyCoordinatorFailure_base: Schema.Class<PrivacyCoordinatorFailure, Schema.TaggedStruct<"PrivacyCoordinatorFailure", {
+    readonly code: Schema.Literals<readonly ["identity_required", "invalid_request", "request_unavailable", "active_request_exists", "invalid_transition", "coverage_missing", "hook_failed"]>;
+    readonly completed: Schema.$Array<Schema.String>;
+    readonly missing: Schema.$Array<Schema.String>;
+}>, YieldableError>;
+
+/** Internal scan position, not caller identity or authorization. */
+declare interface PrivacyDispatchCursor {
+    readonly dueAt: number;
+    readonly requestId: string;
+}
+
+declare interface PrivacyDispatchResult {
+    readonly submitted: ReadonlyArray<{
+        readonly requestId: string;
+        readonly status: WorkflowRunHandle['status'];
+    }>;
+    readonly failed: ReadonlyArray<string>;
+    readonly next: PrivacyDispatchCursor | null;
+}
+
+export declare const privacyExportFixture: SystemSlotFixture;
+
+declare type PrivacyExportPackage = typeof PrivacyExportPackageSchema.Type;
+
+declare const PrivacyExportPackageSchema: Schema.Struct<{
+    readonly requestId: Schema.String;
+    readonly plugins: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly data: Schema.Unknown;
+    }>>;
+}>;
+
+export declare const privacyFakeLayer: Layer.Layer<PrivacyService, never, never>;
+
+declare interface PrivacyOperations {
+    readonly requestErasure: (subject: Subject, requestId?: string) => Effect.Effect<PrivacyRequestReceipt, PrivacyCoordinatorFailure>;
+    readonly readSelf: (subject: Subject, requestId: string) => Effect.Effect<PrivacyRequestReceipt | null, PrivacyCoordinatorFailure>;
+    readonly withdraw: (subject: Subject, requestId: string) => Effect.Effect<PrivacyRequestReceipt, PrivacyCoordinatorFailure>;
+    readonly exportSelf: (subject: Subject, requestId?: string) => Effect.Effect<PrivacyExportPackage, PrivacyCoordinatorFailure>;
+    /** Trusted worker only; wire procedures never expose this method. */
+    readonly execute: (requestId: string) => Effect.Effect<PrivacyRequestReceipt, PrivacyCoordinatorFailure>;
+    /** Trusted schedule only; this port owns no timer or queue. */
+    readonly dispatch: (input: {
+        readonly limit: number;
+        readonly after?: PrivacyDispatchCursor;
+    }, start: (payload: {
+        readonly requestId: string;
+    }) => Promise<WorkflowRunHandle>) => Effect.Effect<PrivacyDispatchResult, PrivacyCoordinatorFailure>;
+}
+
+export declare const privacyPortFixture: SystemPortFixture;
+
+declare interface PrivacyRequestReceipt {
+    readonly requestId: string;
+    readonly status: 'pending' | 'erasing' | 'withdrawn' | 'completed';
+    readonly requestedAt: number;
+    readonly dueAt: number;
+    readonly claimedAt: number | null;
+    readonly withdrawnAt: number | null;
+    readonly completedAt: number | null;
+    readonly completedPlugins: ReadonlyArray<string>;
+}
+
+declare class PrivacyService extends PrivacyService_base {
+}
+
+declare const PrivacyService_base: Context.ServiceClass<PrivacyService, "voltro/PrivacyService", PrivacyOperations>;
+
+export { }

package/dist/privacyTesting.js

@@ -0,0 +1,55 @@
+import { PrivacyCoordinatorFailure as e, jsonPrivacyExport as t } from "./privacyContract.js";
+import { PrivacyService as n } from "./privacyService.js";
+import { Effect as r, Layer as i } from "effect";
+import { systemPortFixture as a } from "@voltro/testing/system";
+//#region src/privacyTesting.ts
+var o = () => r.fail(new e({
+	code: "request_unavailable",
+	completed: [],
+	missing: []
+})), s = (e = {}) => ({
+	requestErasure: o,
+	readSelf: () => r.succeed(null),
+	withdraw: o,
+	exportSelf: o,
+	execute: o,
+	dispatch: o,
+	...e
+}), c = i.succeed(n, s()), l = a({
+	tag: n,
+	fakeLayer: c,
+	read: r.flatMap(n, (e) => e.readSelf({
+		type: "user",
+		id: "fixture",
+		tenantId: "fixture"
+	}, "fixture")),
+	expected: null
+}), u = {
+	kind: "slot",
+	defaultImplementation: t,
+	defaultProbe: {
+		run: () => r.sync(() => t({
+			requestId: "export",
+			plugins: []
+		})),
+		expected: {
+			requestId: "export",
+			plugins: []
+		}
+	},
+	overrideProbe: {
+		run: () => r.sync(() => ({
+			...t({
+				requestId: "export",
+				plugins: []
+			}),
+			requestId: "packaged-export"
+		})),
+		expected: {
+			requestId: "packaged-export",
+			plugins: []
+		}
+	}
+};
+//#endregion
+export { s as fakePrivacyOperations, u as privacyExportFixture, c as privacyFakeLayer, l as privacyPortFixture };

package/dist/privacyWorkflow.d.ts

@@ -0,0 +1,34 @@
+import { Schema } from 'effect';
+import { Workflow } from 'effect/workflow/Workflow';
+import { WorkflowMessagesCarrier } from '@voltro/workflow';
+import { YieldableError } from 'effect/Cause';
+
+declare class PrivacyCoordinatorFailure extends PrivacyCoordinatorFailure_base {
+}
+
+declare const PrivacyCoordinatorFailure_base: Schema.Class<PrivacyCoordinatorFailure, Schema.TaggedStruct<"PrivacyCoordinatorFailure", {
+    readonly code: Schema.Literals<readonly ["identity_required", "invalid_request", "request_unavailable", "active_request_exists", "invalid_transition", "coverage_missing", "hook_failed"]>;
+    readonly completed: Schema.$Array<Schema.String>;
+    readonly missing: Schema.$Array<Schema.String>;
+}>, YieldableError>;
+
+/** Payload/journal carry an opaque request identity and safe receipt only. */
+export declare const PrivacyErasure: Workflow<"privacy.erase", Schema.Struct<{
+    requestId: Schema.NonEmptyString;
+}>, Schema.Struct<{
+    readonly requestId: Schema.String;
+    readonly status: Schema.Literals<readonly ["pending", "erasing", "withdrawn", "completed"]>;
+    readonly requestedAt: Schema.Number;
+    readonly dueAt: Schema.Number;
+    readonly claimedAt: Schema.NullOr<Schema.Number>;
+    readonly withdrawnAt: Schema.NullOr<Schema.Number>;
+    readonly completedAt: Schema.NullOr<Schema.Number>;
+    readonly completedPlugins: Schema.$Array<Schema.String>;
+}>, typeof PrivacyCoordinatorFailure> & {
+    readonly name: "privacy.erase";
+} & WorkflowMessagesCarrier<{
+    readonly signals: {};
+    readonly updates: {};
+}>;
+
+export { }

package/dist/privacyWorkflow.js

@@ -0,0 +1,16 @@
+import { PrivacyCoordinatorFailure as e, PrivacyRequestReceiptSchema as t } from "./privacyContract.js";
+import { Schema as n } from "effect";
+import { workflow as r } from "@voltro/workflow/define";
+//#region src/privacyWorkflow.ts
+var i = r({
+	name: "privacy.erase",
+	payload: { requestId: n.NonEmptyString },
+	success: t,
+	error: e,
+	idempotencyKey: ({ requestId: e }) => `privacy:${e}`,
+	concurrency: { limit: 4 },
+	suspendOnFailure: !0,
+	internal: !0
+});
+//#endregion
+export { i as PrivacyErasure };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-deactivation",
-  "version": "0.86.0",
+  "version": "0.87.0",
   "description": "Deactivation plugin — ships the `deactivation()` schema mixin (deactivatedAt + deactivatedBy → Actor). A deactivated subject can't log in but its data stays VISIBLE (distinct from soft-delete, which hides + anonymises). Pure schema mixin, like audit().",
   "keywords": [
     "voltro",
@@ -33,7 +33,32 @@
       "import": "./dist/guard.js",
       "default": "./dist/guard.js"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./privacy": {
+      "types": "./dist/privacyPlugin.d.ts",
+      "import": "./dist/privacyPlugin.js",
+      "default": "./dist/privacyPlugin.js"
+    },
+    "./privacy/rpc": {
+      "types": "./dist/privacyRpc.d.ts",
+      "import": "./dist/privacyRpc.js",
+      "default": "./dist/privacyRpc.js"
+    },
+    "./privacy/contract": {
+      "types": "./dist/privacyContract.d.ts",
+      "import": "./dist/privacyContract.js",
+      "default": "./dist/privacyContract.js"
+    },
+    "./privacy/workflow": {
+      "types": "./dist/privacyWorkflow.d.ts",
+      "import": "./dist/privacyWorkflow.js",
+      "default": "./dist/privacyWorkflow.js"
+    },
+    "./privacy/testing": {
+      "types": "./dist/privacyTesting.d.ts",
+      "import": "./dist/privacyTesting.js",
+      "default": "./dist/privacyTesting.js"
+    }
   },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -43,17 +68,23 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.86.0",
-    "@voltro/plugin-audit": "0.86.0",
-    "@voltro/protocol": "0.86.0"
+    "@voltro/database": "0.87.0",
+    "@voltro/plugin-audit": "0.87.0",
+    "@voltro/protocol": "0.87.0",
+    "@voltro/workflow": "0.87.0",
+    "@voltro/runtime": "0.87.0"
   },
   "peerDependencies": {
-    "@voltro/plugin-auth": "0.86.0",
-    "effect": "4.0.1"
+    "@voltro/plugin-auth": "0.87.0",
+    "effect": "4.0.1",
+    "@voltro/testing": "0.87.0"
   },
   "peerDependenciesMeta": {
     "@voltro/plugin-auth": {
       "optional": true
+    },
+    "@voltro/testing": {
+      "optional": true
     }
   },
   "publishConfig": {