@voltro/plugin-deactivation 0.86.0 → 0.88.0

package/dist/guard.js

@@ -1,5 +1,5 @@
 import { Effect as e, Schema as t } from "effect";
-//#region src/guard.ts
+// src/guard.ts
 var n = class extends t.TaggedError()("AccountDeactivated", {
 	userId: t.String,
 	deactivatedAt: t.String
@@ -49,5 +49,4 @@ var n = class extends t.TaggedError()("AccountDeactivated", {
 		};
 	};
 };
-//#endregion
 export { r as ACCOUNT_DEACTIVATED_CODE, n as AccountDeactivated, o as deactivationGuard, s as deactivationSubjectGuard };

package/dist/mixin.js

@@ -1,6 +1,6 @@
 import { defineMixin as e, reference as t, requireActors as n, timestamp as r } from "@voltro/database";
 import { audit as i } from "@voltro/plugin-audit/mixin";
-//#region src/mixin.ts
+// src/mixin.ts
 var a = () => e({
 	id: "voltro/deactivation",
 	requires: [i()],
@@ -9,5 +9,4 @@ var a = () => e({
 		deactivatedBy: t(n()).nullable()
 	}
 });
-//#endregion
 export { a as deactivation };

package/dist/privacy-app/schedules/privacy.dispatch.cron.tsx

@@ -0,0 +1,32 @@
+import { Effect } from 'effect'
+import { defineSchedule } from '@voltro/runtime'
+import { PrivacyService } from '@voltro/plugin-deactivation/privacy'
+import { PrivacyCoordinatorFailure } from '@voltro/plugin-deactivation/privacy/contract'
+import type { PrivacyDispatchCursor } from '@voltro/plugin-deactivation/privacy'
+
+export default defineSchedule({
+  name: 'privacy.dispatch',
+  cron: '* * * * *',
+  timezone: 'UTC',
+  handler: ctx => Effect.gen(function* () {
+    const service = yield* PrivacyService
+    const workflows = ctx.app.workflows
+    const refused = () => new PrivacyCoordinatorFailure({ code: 'request_unavailable', completed: [], missing: [] })
+    if (workflows === undefined) return yield* Effect.fail(refused())
+    let after: PrivacyDispatchCursor | undefined
+    let failed = false
+    for (let page = 0; page < 100; page++) {
+      const batch = yield* service.dispatch({ limit: 100, ...(after === undefined ? {} : { after }) },
+        payload => workflows.start('privacy.erase', payload))
+      failed ||= batch.failed.length > 0
+      if (batch.next === null) {
+        if (failed) return yield* Effect.fail(refused())
+        return
+      }
+      after = batch.next
+    }
+    // A firing that cannot exhaust its bounded scan reports failure. SQL rows
+    // remain eligible for the next firing; no local cursor or second queue.
+    return yield* Effect.fail(refused())
+  }),
+})

package/dist/privacy-app/workflows/privacy.erase.workflow.server.tsx

@@ -0,0 +1,16 @@
+import { Effect } from 'effect'
+import { step } from '@voltro/workflow'
+import { PrivacyService } from '@voltro/plugin-deactivation/privacy'
+import { PrivacyCoordinatorFailure, PrivacyRequestReceiptSchema } from '@voltro/plugin-deactivation/privacy/contract'
+
+export default () => (payload: { readonly requestId: string }) => Effect.gen(function* () {
+  const service = yield* PrivacyService
+  // SQL claims and every external hook stay inside one recoverable activity;
+  // only its safe receipt is journaled. A replay after terminal SQL is a read.
+  return yield* step({
+    name: 'complete-subject-erasure',
+    success: PrivacyRequestReceiptSchema,
+    error: PrivacyCoordinatorFailure,
+    execute: service.execute(payload.requestId),
+  })
+})

package/dist/privacy-app/workflows/privacy.erase.workflow.tsx

@@ -0,0 +1 @@
+export { PrivacyErasure } from '@voltro/plugin-deactivation/privacy/workflow'

package/dist/privacyContract.d.ts

@@ -0,0 +1,37 @@
+import { Schema } from 'effect';
+import { YieldableError } from 'effect/Cause';
+
+/** Default export packaging slot; hooks have already validated and detached JSON. */
+export declare const jsonPrivacyExport: (input: PrivacyExportPackage) => PrivacyExportPackage;
+
+export declare class PrivacyCoordinatorFailure extends PrivacyCoordinatorFailure_base {
+}
+
+declare const PrivacyCoordinatorFailure_base: Schema.Class<PrivacyCoordinatorFailure, Schema.TaggedStruct<"PrivacyCoordinatorFailure", {
+    readonly code: Schema.Literals<readonly ["identity_required", "invalid_request", "request_unavailable", "active_request_exists", "invalid_transition", "coverage_missing", "hook_failed"]>;
+    readonly completed: Schema.$Array<Schema.String>;
+    readonly missing: Schema.$Array<Schema.String>;
+}>, YieldableError>;
+
+export declare type PrivacyExportPackage = typeof PrivacyExportPackageSchema.Type;
+
+export declare const PrivacyExportPackageSchema: Schema.Struct<{
+    readonly requestId: Schema.String;
+    readonly plugins: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly data: Schema.Unknown;
+    }>>;
+}>;
+
+export declare const PrivacyRequestReceiptSchema: Schema.Struct<{
+    readonly requestId: Schema.String;
+    readonly status: Schema.Literals<readonly ["pending", "erasing", "withdrawn", "completed"]>;
+    readonly requestedAt: Schema.Number;
+    readonly dueAt: Schema.Number;
+    readonly claimedAt: Schema.NullOr<Schema.Number>;
+    readonly withdrawnAt: Schema.NullOr<Schema.Number>;
+    readonly completedAt: Schema.NullOr<Schema.Number>;
+    readonly completedPlugins: Schema.$Array<Schema.String>;
+}>;
+
+export { }

package/dist/privacyContract.js

@@ -0,0 +1,42 @@
+import { Schema as e } from "effect";
+// src/privacyContract.ts
+var t = class extends e.TaggedError()("PrivacyCoordinatorFailure", {
+	code: e.Literals([
+		"identity_required",
+		"invalid_request",
+		"request_unavailable",
+		"active_request_exists",
+		"invalid_transition",
+		"coverage_missing",
+		"hook_failed"
+	]),
+	completed: e.Array(e.String),
+	missing: e.Array(e.String)
+}) {}, n = e.Struct({
+	requestId: e.String,
+	status: e.Literals([
+		"pending",
+		"erasing",
+		"withdrawn",
+		"completed"
+	]),
+	requestedAt: e.Number,
+	dueAt: e.Number,
+	claimedAt: e.NullOr(e.Number),
+	withdrawnAt: e.NullOr(e.Number),
+	completedAt: e.NullOr(e.Number),
+	completedPlugins: e.Array(e.String)
+}), r = e.Struct({
+	requestId: e.String,
+	plugins: e.Array(e.Struct({
+		name: e.String,
+		data: e.Unknown
+	}))
+}), i = (e) => ({
+	requestId: e.requestId,
+	plugins: e.plugins.map((e) => ({
+		name: e.name,
+		data: e.data
+	}))
+});
+export { t as PrivacyCoordinatorFailure, r as PrivacyExportPackageSchema, n as PrivacyRequestReceiptSchema, i as jsonPrivacyExport };

package/dist/privacyCoordinator.js

@@ -0,0 +1,91 @@
+import { PrivacyCoordinatorFailure as e } from "./privacyContract.js";
+import { PrivacyRequestRefused as t, dataStorePrivacyRequests as n } from "./privacyRequests.js";
+import { Effect as r, Result as i } from "effect";
+import { randomUUID as a } from "node:crypto";
+// src/privacyCoordinator.ts
+var o = (t) => new e({
+	code: t,
+	completed: [],
+	missing: []
+}), s = (e) => r.tryPromise({
+	try: e,
+	catch: (e) => o(e instanceof t ? e.code : "request_unavailable")
+}), c = (e) => r.suspend(() => e.type !== "user" || !e.id.trim() || !e.tenantId.trim() ? r.fail(o("identity_required")) : r.succeed(Object.freeze({
+	subjectId: e.id,
+	tenantId: e.tenantId,
+	kind: e.kind === "guest" ? "guest" : "user"
+}))), l = (t, l, u = {}) => {
+	let d = n(t, {
+		withdrawalMs: u.withdrawalMs ?? 2592e6,
+		...u.now === void 0 ? {} : { now: u.now }
+	}), f = (t) => r.suspend(() => {
+		let n = l.coverage(t);
+		return n.missing.length !== 0 || n.participants.length === 0 ? r.fail(new e({
+			code: "coverage_missing",
+			completed: [],
+			missing: [...n.missing]
+		})) : r.void;
+	}), p = (t) => new e({
+		code: t.code === "coverage_missing" ? "coverage_missing" : t.code === "invalid_request" ? "invalid_request" : t.code === "unavailable" ? "request_unavailable" : "hook_failed",
+		completed: [...t.completed],
+		missing: [...t.missing]
+	});
+	return {
+		requestErasure: (e, t = a()) => r.gen(function* () {
+			let n = yield* c(e);
+			return yield* f(n.kind), yield* s(() => d.request(t, n));
+		}),
+		readSelf: (e, t) => r.gen(function* () {
+			let n = yield* c(e);
+			return yield* s(() => d.readOwned(t, n));
+		}),
+		withdraw: (e, t) => r.gen(function* () {
+			let n = yield* c(e);
+			return yield* s(() => d.withdraw(t, n));
+		}),
+		exportSelf: (e, t = a()) => r.gen(function* () {
+			let n = yield* c(e), i = yield* l.exportSubject({
+				requestId: t,
+				target: n
+			}).pipe(r.mapError(p));
+			return {
+				requestId: i.requestId,
+				plugins: i.plugins
+			};
+		}),
+		execute: (e) => r.gen(function* () {
+			let t = yield* s(() => d.readWorker(e));
+			if (t === null) return yield* r.fail(o("request_unavailable"));
+			if (t.receipt.status === "completed" || t.receipt.status === "withdrawn") return t.receipt;
+			yield* f(t.kind);
+			let n = yield* s(() => d.claim(e));
+			if (n.target === null) return n.receipt;
+			let i = n.target, a = yield* l.eraseSubject({
+				requestId: e,
+				target: i
+			}).pipe(r.mapError(p));
+			(yield* s(() => d.readWorker(e)))?.receipt.status !== "completed" && (yield* s(() => d.finish(e, i, a.completed)));
+			let c = yield* s(() => d.readWorker(e));
+			return c?.receipt.status === "completed" ? c.receipt : yield* r.fail(o("request_unavailable"));
+		}),
+		dispatch: (e, t) => r.gen(function* () {
+			let n = yield* s(() => d.dispatchBatch(e)), a = [], o = [];
+			for (let e of n.requestIds) {
+				let n = yield* r.tryPromise({
+					try: () => t({ requestId: e }),
+					catch: () => e
+				}).pipe(r.result);
+				i.isFailure(n) ? o.push(e) : a.push({
+					requestId: e,
+					status: n.success.status
+				});
+			}
+			return {
+				submitted: a,
+				failed: o,
+				next: n.next
+			};
+		})
+	};
+};
+export { l as dataStorePrivacyCoordinator, c as privacyTargetFromSubject };

package/dist/privacyPlugin.d.ts

@@ -0,0 +1,139 @@
+import { ColumnBuilder } from '@voltro/database';
+import { Context } from 'effect';
+import { Effect } from 'effect';
+import { FieldDefinitions } from '@voltro/database';
+import { Schema } from 'effect';
+import { Subject } from '@voltro/protocol';
+import { Table } from '@voltro/database';
+import { VoltroPlugin } from '@voltro/protocol';
+import { WorkflowRunHandle } from '@voltro/protocol';
+import { YieldableError } from 'effect/Cause';
+
+/** Default export packaging slot; hooks have already validated and detached JSON. */
+export declare const jsonPrivacyExport: (input: PrivacyExportPackage) => PrivacyExportPackage;
+
+export declare class PrivacyCoordinatorFailure extends PrivacyCoordinatorFailure_base {
+}
+
+declare const PrivacyCoordinatorFailure_base: Schema.Class<PrivacyCoordinatorFailure, Schema.TaggedStruct<"PrivacyCoordinatorFailure", {
+    readonly code: Schema.Literals<readonly ["identity_required", "invalid_request", "request_unavailable", "active_request_exists", "invalid_transition", "coverage_missing", "hook_failed"]>;
+    readonly completed: Schema.$Array<Schema.String>;
+    readonly missing: Schema.$Array<Schema.String>;
+}>, YieldableError>;
+
+/** Internal scan position, not caller identity or authorization. */
+export declare interface PrivacyDispatchCursor {
+    readonly dueAt: number;
+    readonly requestId: string;
+}
+
+export declare interface PrivacyDispatchResult {
+    readonly submitted: ReadonlyArray<{
+        readonly requestId: string;
+        readonly status: WorkflowRunHandle['status'];
+    }>;
+    readonly failed: ReadonlyArray<string>;
+    readonly next: PrivacyDispatchCursor | null;
+}
+
+export declare type PrivacyExportPackage = typeof PrivacyExportPackageSchema.Type;
+
+export declare const PrivacyExportPackageSchema: Schema.Struct<{
+    readonly requestId: Schema.String;
+    readonly plugins: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly data: Schema.Unknown;
+    }>>;
+}>;
+
+export declare interface PrivacyOperations {
+    readonly requestErasure: (subject: Subject, requestId?: string) => Effect.Effect<PrivacyRequestReceipt, PrivacyCoordinatorFailure>;
+    readonly readSelf: (subject: Subject, requestId: string) => Effect.Effect<PrivacyRequestReceipt | null, PrivacyCoordinatorFailure>;
+    readonly withdraw: (subject: Subject, requestId: string) => Effect.Effect<PrivacyRequestReceipt, PrivacyCoordinatorFailure>;
+    readonly exportSelf: (subject: Subject, requestId?: string) => Effect.Effect<PrivacyExportPackage, PrivacyCoordinatorFailure>;
+    /** Trusted worker only; wire procedures never expose this method. */
+    readonly execute: (requestId: string) => Effect.Effect<PrivacyRequestReceipt, PrivacyCoordinatorFailure>;
+    /** Trusted schedule only; this port owns no timer or queue. */
+    readonly dispatch: (input: {
+        readonly limit: number;
+        readonly after?: PrivacyDispatchCursor;
+    }, start: (payload: {
+        readonly requestId: string;
+    }) => Promise<WorkflowRunHandle>) => Effect.Effect<PrivacyDispatchResult, PrivacyCoordinatorFailure>;
+}
+
+/** Install self-service actions and app-shaped durable workflow/schedule sources.
+ * Subject and tenant always come from server authentication, never action input. */
+export declare const privacyPlugin: (options?: PrivacyPluginOptions) => VoltroPlugin;
+
+export declare interface PrivacyPluginOptions {
+    /** Original request deadline; retry never extends it. Defaults to 30 days. */
+    readonly withdrawalMs?: number;
+    /** Replace export packaging after the registry completes every export hook. */
+    readonly exportPackage?: (input: PrivacyExportPackage) => PrivacyExportPackage;
+    /** Replace the app's operations port; the request-table owner remains installed. */
+    readonly operations?: PrivacyOperations;
+    /** Test clock, shared by the coordinator and its SQL completion owner. */
+    readonly now?: () => number;
+}
+
+export declare interface PrivacyRequestReceipt {
+    readonly requestId: string;
+    readonly status: 'pending' | 'erasing' | 'withdrawn' | 'completed';
+    readonly requestedAt: number;
+    readonly dueAt: number;
+    readonly claimedAt: number | null;
+    readonly withdrawnAt: number | null;
+    readonly completedAt: number | null;
+    readonly completedPlugins: ReadonlyArray<string>;
+}
+
+export declare const PrivacyRequestReceiptSchema: Schema.Struct<{
+    readonly requestId: Schema.String;
+    readonly status: Schema.Literals<readonly ["pending", "erasing", "withdrawn", "completed"]>;
+    readonly requestedAt: Schema.Number;
+    readonly dueAt: Schema.Number;
+    readonly claimedAt: Schema.NullOr<Schema.Number>;
+    readonly withdrawnAt: Schema.NullOr<Schema.Number>;
+    readonly completedAt: Schema.NullOr<Schema.Number>;
+    readonly completedPlugins: Schema.$Array<Schema.String>;
+}>;
+
+export declare const privacyRequestsTable: Table<"_voltro_privacy_requests", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    readonly subjectId: ColumnBuilder<string | null, "text", boolean>;
+    readonly tenantId: ColumnBuilder<string | null, "text", boolean>;
+    readonly kind: ColumnBuilder<"user" | "guest", "text", boolean>;
+    readonly activeKey: ColumnBuilder<string, "text", boolean>;
+    readonly status: ColumnBuilder<"completed" | "pending" | "withdrawn" | "erasing", "text", boolean>;
+    readonly requestedAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly dueAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly claimedAt: ColumnBuilder<Date | null, "timestamp", boolean>;
+    readonly withdrawnAt: ColumnBuilder<Date | null, "timestamp", boolean>;
+    readonly completedAt: ColumnBuilder<Date | null, "timestamp", boolean>;
+    readonly completedPlugins: ColumnBuilder<unknown, "json", boolean>;
+}>, false, never>;
+
+export declare class PrivacyService extends PrivacyService_base {
+}
+
+declare const PrivacyService_base: Context.ServiceClass<PrivacyService, "voltro/PrivacyService", PrivacyOperations>;
+
+export declare const privacySystemContract: {
+    readonly slots: {
+        readonly exportPackage: {
+            readonly defaultExport: "jsonPrivacyExport";
+            readonly fixtureExport: "privacyExportFixture";
+        };
+    };
+    readonly ports: {
+        readonly operations: {
+            readonly tagExport: "PrivacyService";
+            readonly fakeLayerExport: "privacyFakeLayer";
+            readonly fixtureExport: "privacyPortFixture";
+        };
+    };
+    readonly events: readonly [];
+};
+
+export { }

package/dist/privacyPlugin.js

@@ -0,0 +1,138 @@
+import { PrivacyCoordinatorFailure as e, PrivacyExportPackageSchema as t, PrivacyRequestReceiptSchema as n, jsonPrivacyExport as r } from "./privacyContract.js";
+import { PrivacyRequestRefused as i, dataStorePrivacyRequests as a, privacyRequestsTable as o } from "./privacyRequests.js";
+import { dataStorePrivacyCoordinator as s, privacyTargetFromSubject as c } from "./privacyCoordinator.js";
+import { PrivacyService as l } from "./privacyService.js";
+import { exportSelfDescriptor as u, privacyRpcClientImports as d, requestErasureDescriptor as f, requestStatusDescriptor as p, withdrawErasureDescriptor as m } from "./privacyRpc.js";
+import { Effect as h, Layer as g, Schema as _ } from "effect";
+import { fileURLToPath as v } from "node:url";
+import { definePlugin as y } from "@voltro/protocol";
+// src/privacyPlugin.ts
+var b = {
+	slots: { exportPackage: {
+		defaultExport: "jsonPrivacyExport",
+		fixtureExport: "privacyExportFixture"
+	} },
+	ports: { operations: {
+		tagExport: "PrivacyService",
+		fakeLayerExport: "privacyFakeLayer",
+		fixtureExport: "privacyPortFixture"
+	} },
+	events: []
+}, x = () => new e({
+	code: "request_unavailable",
+	completed: [],
+	missing: []
+}), S = (e) => e.requestId, C = (n = {}) => {
+	let b = n.withdrawalMs ?? 2592e6;
+	if (!Number.isSafeInteger(b) || b < 0) throw Error("Privacy withdrawal window must be a non-negative safe integer");
+	let C = n.exportPackage ?? r, w, T, E, D, O = (e) => h.suspend(() => w === void 0 ? h.fail(x()) : e(w)), k = {
+		requestErasure: (e, t) => c(e).pipe(h.flatMap(() => O((n) => n.requestErasure(e, t)))),
+		readSelf: (e, t) => c(e).pipe(h.flatMap(() => O((n) => n.readSelf(e, t)))),
+		withdraw: (e, t) => c(e).pipe(h.flatMap(() => O((n) => n.withdraw(e, t)))),
+		exportSelf: (e, n) => c(e).pipe(h.flatMap(() => O((t) => t.exportSelf(e, n))), h.flatMap((e) => h.try({
+			try: () => _.decodeUnknownSync(t)(C(e)),
+			catch: x
+		}))),
+		execute: (e) => O((t) => t.execute(e)),
+		dispatch: (e, t) => O((n) => n.dispatch(e, t))
+	}, A = [
+		{
+			...f,
+			execute: (e, t) => k.requestErasure(t.request.subject, S(e))
+		},
+		{
+			...p,
+			execute: (e, t) => k.readSelf(t.request.subject, e.requestId)
+		},
+		{
+			...m,
+			execute: (e, t) => k.withdraw(t.request.subject, e.requestId)
+		},
+		{
+			...u,
+			execute: (e, t) => k.exportSelf(t.request.subject, S(e))
+		}
+	];
+	return y({
+		name: "@voltro/plugin-deactivation",
+		description: "Durable subject privacy requests, withdrawal and JSON export.",
+		permissions: ["store:write", "inspect:read"],
+		services: g.succeed(l, k),
+		routes: A,
+		rpcClientDescriptors: d,
+		sources: v(new URL("./privacy-app", "" + import.meta.url)),
+		extendSchema: { tables: [o] },
+		inspectEndpoints: [{
+			method: "GET",
+			path: "/status",
+			scope: "shared-store",
+			description: "Bounded recent privacy receipts and declared subject hook coverage; no subject or tenant identifiers.",
+			handler: () => h.tryPromise({
+				try: async () => T === void 0 || D === void 0 ? {
+					kind: "json",
+					status: 503,
+					data: { error: "privacy_unavailable" }
+				} : {
+					kind: "json",
+					data: {
+						...await T.inspectRecent(),
+						withdrawalMs: b,
+						limit: 100,
+						coverage: {
+							user: D.coverage("user"),
+							guest: D.coverage("guest")
+						}
+					}
+				},
+				catch: x
+			})
+		}],
+		subjectPrivacy: {
+			tables: [o.tableName],
+			kinds: ["user", "guest"],
+			erasePhase: "finalize"
+		},
+		onExport: (e, t) => h.tryPromise({
+			try: async () => {
+				if (T === void 0) throw x();
+				return T.exportOwned({
+					subjectId: e,
+					tenantId: t.tenantId,
+					kind: t.kind
+				});
+			},
+			catch: x
+		}),
+		onErase: (t, n) => h.tryPromise({
+			try: async () => {
+				if (T === void 0 || n.completed === void 0) throw x();
+				(await T.readWorker(n.requestId))?.receipt.status !== "completed" && await T.finish(n.requestId, {
+					subjectId: t,
+					tenantId: n.tenantId,
+					kind: n.kind
+				}, [...n.completed, "@voltro/plugin-deactivation"]);
+			},
+			catch: (t) => new e({
+				code: t instanceof i ? t.code : "request_unavailable",
+				completed: [],
+				missing: []
+			})
+		}),
+		bindDataStore: (e, t) => {
+			if (t?.privacyRegistry === void 0) throw Error("Privacy orchestration requires the installing app privacy registry");
+			if (E !== void 0 && E !== e) throw Error("Privacy plugin instance cannot be shared between app stores");
+			if (D !== void 0 && D !== t.privacyRegistry) throw Error("Privacy plugin instance cannot be shared between app registries");
+			E = e, D = t.privacyRegistry, T = a(e, {
+				withdrawalMs: b,
+				...n.now === void 0 ? {} : { now: n.now }
+			}), w = n.operations ?? s(e, t.privacyRegistry, {
+				withdrawalMs: b,
+				...n.now === void 0 ? {} : { now: n.now }
+			});
+		},
+		onDeactivate: () => h.sync(() => {
+			w = void 0, T = void 0, E = void 0, D = void 0;
+		})
+	});
+};
+export { e as PrivacyCoordinatorFailure, t as PrivacyExportPackageSchema, n as PrivacyRequestReceiptSchema, l as PrivacyService, r as jsonPrivacyExport, C as privacyPlugin, o as privacyRequestsTable, b as privacySystemContract };