@voltro/plugin-governance 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,248 @@
+import { Context } from 'effect';
+import { deriveKey } from '@voltro/runtime';
+import { ENCRYPTED_PREFIX } from '@voltro/database';
+import { FieldCipher } from '@voltro/database';
+import { isEncrypted } from '@voltro/database';
+import { makeAesCipher } from '@voltro/runtime';
+import { makeFieldCipher } from '@voltro/runtime';
+import { SchemaTable } from '@voltro/database';
+import { setFieldCipher } from '@voltro/runtime';
+import { VoltroPlugin } from '@voltro/protocol';
+
+export declare const CONSENT_TABLE = "_voltro_consent";
+
+/** Narrow slice of the framework DataStore the durable consent store needs. */
+export declare interface ConsentDataStore {
+    query: (descriptor: Record<string, unknown>) => Promise<ReadonlyArray<Record<string, unknown>>>;
+    insert: (table: string, row: Record<string, unknown>) => Promise<unknown>;
+}
+
+export declare interface ConsentRecord {
+    readonly subjectId: string;
+    readonly purpose: string;
+    readonly granted: boolean;
+    readonly at: string;
+    readonly tenantId?: string | null;
+}
+
+export declare interface ConsentStore {
+    readonly record: (entry: ConsentRecord) => Promise<void>;
+    /** Latest decision for (subject, purpose); `false` if never recorded. */
+    readonly has: (subjectId: string, purpose: string) => Promise<boolean>;
+    readonly list: (subjectId: string) => Promise<ReadonlyArray<ConsentRecord>>;
+}
+
+/**
+ * The slice of a built `Table` this package exposes — name + columns +
+ * indexes. `SchemaTable` is @voltro/database's PUBLIC structural table type,
+ * which names exactly that surface WITHOUT the private column-builder class
+ * the fully-inferred `Table` generic would drag across the package boundary
+ * (TS4094). Alias kept for readability at the annotation sites below.
+ */
+export declare type ConsentTable = SchemaTable;
+
+/**
+ * The consent ledger table — an append-only log of decisions. `has()` reads the
+ * most-recent row per (subject,purpose); `list()` reads a subject's history. A
+ * new decision is a new row (never an update), so the full audit trail persists.
+ * Built purely from column helpers so the DDL compiler handles per-dialect
+ * divergence.
+ */
+export declare const consentTable: ConsentTable;
+
+/** The consent table, ready to spread into `extendSchema.tables`. */
+export declare const consentTables: ReadonlyArray<ConsentTable>;
+
+/**
+ * A DataStore-backed {@link ConsentStore} — durable + cross-instance. `record`
+ * appends a row; `has` reads the most-recent row for (subject,purpose); `list`
+ * reads a subject's decisions newest-first. Because the store is shared, a
+ * consent recorded on one replica is immediately visible on every other — the
+ * cross-instance correctness the default memory store can't give.
+ */
+export declare const dataStoreConsentStore: (store: ConsentDataStore) => ConsentStore;
+
+/** Adapt a framework `DataStore` (untyped here) to `GovStore`. */
+export declare const dataStoreGovStore: (store: unknown) => GovStore;
+
+export { deriveKey }
+
+export { ENCRYPTED_PREFIX }
+
+/** Erase a subject across `scopes`. Returns an immutable erasure-log entry. */
+export declare const eraseSubject: (store: GovStore, scopes: ReadonlyArray<SubjectScope>, subjectId: string, opts?: ErasureOptions, now?: () => string) => Promise<ErasureLogEntry>;
+
+/**
+ * Most-recent GDPR erasure-log entries kept in memory (most-recent-first).
+ * The inspect surface only ever reads the newest entries, so capping the
+ * array keeps a long-lived process from growing the heap without limit on
+ * heavy erasure traffic. The log is process-memory + restart-cleared by
+ * design — mirror entries to your own store for durable audit evidence.
+ */
+export declare const ERASURE_LOG_CAP = 1000;
+
+export declare interface ErasureLogEntry {
+    readonly subjectId: string;
+    readonly at: string;
+    readonly mode: 'delete' | 'anonymize';
+    readonly affected: ReadonlyArray<{
+        table: string;
+        count: number;
+    }>;
+}
+
+export declare interface ErasureOptions {
+    /** `'delete'` removes rows; `'anonymize'` nulls `anonymizeFields` (keeps the
+     *  row for referential integrity / audit). Default `'delete'`. */
+    readonly mode?: 'delete' | 'anonymize';
+    readonly anonymizeFields?: ReadonlyArray<string>;
+}
+
+/** Collect every row across `scopes` that belongs to a subject → a portable bundle. */
+export declare const exportSubject: (store: GovStore, scopes: ReadonlyArray<SubjectScope>, subjectId: string) => Promise<Record<string, ReadonlyArray<Record<string, unknown>>>>;
+
+export { FieldCipher }
+
+export declare const governancePlugin: (options?: GovernancePluginOptions) => VoltroPlugin;
+
+export declare interface GovernancePluginOptions {
+    readonly retention?: ReadonlyArray<RetentionPolicy>;
+    /** Tables (+ subject column) the GDPR export/erase walk. */
+    readonly subjectScopes?: ReadonlyArray<SubjectScope>;
+    /** Default erasure mode + anonymise fields. */
+    readonly erasure?: ErasureOptions;
+    /**
+     * Consent ledger store. Default `memoryConsentStore()` (per-process,
+     * restart-cleared — a consent recorded on replica A reads `false` on
+     * replica B). Pass `'datastore'` for the DURABLE, cross-instance store
+     * (contributes the `_voltro_consent` table via `extendSchema`, needs
+     * `store:write` which the plugin already declares) — the production choice.
+     * Or pass a custom `ConsentStore` to back it with your own store.
+     */
+    readonly consent?: ConsentStore | 'datastore';
+    /** Retention sweep interval (ms). Default 1h. */
+    readonly sweepIntervalMs?: number;
+    /**
+     * Enable field-level encryption for `.encrypted()` columns. Registers
+     * an AES-256-GCM cipher whose key is resolved from the Secrets-Resolver.
+     * `true` reads the secret `VOLTRO_FIELD_ENCRYPTION_KEY`; pass
+     * `{ secretKey }` to name a different secret. Boot fails loud if the
+     * key can't be resolved (an `.encrypted()` column with no cipher is a
+     * silent-data-loss footgun).
+     */
+    readonly fieldEncryption?: boolean | {
+        readonly secretKey?: string;
+    };
+    readonly name?: string;
+}
+
+export declare class GovernanceService extends GovernanceService_base {
+}
+
+declare const GovernanceService_base: Context.TagClass<GovernanceService, "@voltro/plugin-governance/GovernanceService", GovernanceServiceShape>;
+
+export declare interface GovernanceServiceShape {
+    readonly exportSubject: (subjectId: string) => Promise<Record<string, ReadonlyArray<Record<string, unknown>>>>;
+    readonly eraseSubject: (subjectId: string, opts?: ErasureOptions) => Promise<ErasureLogEntry>;
+    readonly recordConsent: (entry: ConsentRecord) => Promise<void>;
+    readonly hasConsent: (subjectId: string, purpose: string) => Promise<boolean>;
+    readonly runRetentionNow: () => Promise<void>;
+}
+
+export declare interface GovStore {
+    /**
+     * All rows of a table.
+     *
+     * CEILING: this materialises the WHOLE table in memory. It is used by the
+     * GDPR export/erase walks, which are admin-gated, occasional, single-subject
+     * operations — fine in practice. Do NOT use it on the retention path (the
+     * retention table is the one that grows unbounded) — use {@link page} +
+     * a bounded loop there instead.
+     */
+    readonly all: (table: string) => Promise<ReadonlyArray<Record<string, unknown>>>;
+    /**
+     * One bounded page of rows (`limit` rows starting at `offset`, ordered by a
+     * stable key). Lets the retention sweep scan a large table in capped batches
+     * instead of loading it whole — the `_voltro_traces`-incident class the
+     * unbounded `all()` would otherwise reintroduce on a retention table.
+     */
+    readonly page: (table: string, limit: number, offset: number) => Promise<ReadonlyArray<Record<string, unknown>>>;
+    readonly delete: (table: string, id: string) => Promise<void>;
+    readonly update: (table: string, id: string, patch: Record<string, unknown>) => Promise<void>;
+}
+
+export { isEncrypted }
+
+export { makeAesCipher }
+
+export { makeFieldCipher }
+
+/**
+ * In-memory consent store (default + test). Latest-write-wins per
+ * (subject,purpose).
+ *
+ * BOUNDED: `has()` is backed by the `latest` map (one entry per
+ * subject+purpose — never dropped, so a recorded decision is never lost),
+ * while the `history` log that `list()` reads is capped at
+ * {@link CONSENT_HISTORY_CAP} most-recent entries. Without the cap a
+ * long-lived process with heavy consent traffic would grow the array — and
+ * the heap — without limit. This store is process-memory + restart-cleared
+ * by design; for durable, cross-instance consent supply a DataStore-backed
+ * `ConsentStore` via the plugin's `consent` option.
+ */
+export declare const memoryConsentStore: (historyCap?: number) => ConsentStore;
+
+/** In-memory GovStore for tests + dev. */
+export declare const memoryGovStore: (seed?: Record<string, Array<Record<string, unknown>>>) => GovStore & {
+    dump: () => Record<string, Array<Record<string, unknown>>>;
+};
+
+export declare interface RetentionPolicy {
+    readonly table: string;
+    /** Time-to-live in ms (e.g. 90 days = 90*86_400_000). */
+    readonly ttlMs: number;
+    /** Row date field the age is measured from. Default `'createdAt'`. */
+    readonly dateField?: string;
+    /** `'delete'` removes the row; `'anonymize'` nulls/redacts `anonymizeFields`. */
+    readonly action?: 'delete' | 'anonymize';
+    /** Fields to null when `action: 'anonymize'`. */
+    readonly anonymizeFields?: ReadonlyArray<string>;
+}
+
+declare interface RetentionReport {
+    readonly table: string;
+    readonly action: 'delete' | 'anonymize';
+    readonly affected: number;
+}
+
+/**
+ * Apply every policy once. Returns a per-table report.
+ *
+ * BOUNDED: each table is scanned in pages of `batchSize` (default
+ * {@link RETENTION_BATCH_SIZE}) — the sweep never loads the whole table into
+ * memory, so a large retention table (the one thing retention exists to keep
+ * from growing) can't OOM the process or fire one statement per row in an
+ * unbounded burst.
+ *
+ * Window math: the page is read ordered by a stable key at a moving `offset`.
+ * For `delete` the acted-on rows are removed, so the next page's rows shift
+ * into the gap — `offset` advances only by the rows the page LEFT in place
+ * (`page.length - deleted`). For `anonymize` rows stay, so `offset` advances
+ * by the full page. The loop ends when a page comes back shorter than the
+ * batch (table drained).
+ */
+export declare const runRetention: (store: GovStore, policies: ReadonlyArray<RetentionPolicy>, now?: number, batchSize?: number) => Promise<ReadonlyArray<RetentionReport>>;
+
+/** Pure — the ids of rows past their TTL. */
+export declare const selectExpired: (rows: ReadonlyArray<Record<string, unknown>>, policy: RetentionPolicy, now: number) => ReadonlyArray<string>;
+
+export { setFieldCipher }
+
+/** One table that references a subject, by which column. */
+export declare interface SubjectScope {
+    readonly table: string;
+    /** Column holding the subject id (e.g. 'userId', 'createdBy', 'id'). */
+    readonly subjectField: string;
+}
+
+export { }

package/dist/index.js

@@ -0,0 +1,366 @@
+import { consentDescriptor as e, eraseDescriptor as t, exportDescriptor as n, governanceRpcClientImports as r, hasConsentDescriptor as i } from "./rpc.js";
+import { Context as a, Effect as o, Layer as s } from "effect";
+import { ADMIN_SCOPE as c, definePlugin as l, requireScope as u } from "@voltro/protocol";
+import { deriveKey as d, makeAesCipher as f, makeFieldCipher as p, makeFieldCipher as m, resolveSecret as h, setFieldCipher as g, setFieldCipher as _ } from "@voltro/runtime";
+import { ENCRYPTED_PREFIX as v, and as y, boolean as b, eq as x, id as S, isEncrypted as C, table as w, text as T } from "@voltro/database";
+//#region src/store.ts
+var E = (e) => {
+	let t = e, n = (e, t) => ({
+		table: void 0,
+		predicate: void 0,
+		order: [{
+			column: "id",
+			direction: "asc"
+		}],
+		take: e,
+		skip: t,
+		projection: void 0
+	});
+	return {
+		all: (e) => t.query({
+			...n(void 0, void 0),
+			table: e
+		}),
+		page: (e, r, i) => t.query({
+			...n(r, i),
+			table: e
+		}),
+		delete: async (e, n) => {
+			await (t.hardDelete ?? t.delete).call(t, e, n);
+		},
+		update: async (e, n, r) => {
+			await t.update(e, n, r);
+		}
+	};
+}, D = (e = {}) => {
+	let t = new Map(Object.entries(e).map(([e, t]) => [e, t.map((e) => ({ ...e }))])), n = (e) => {
+		let n = t.get(e);
+		return n || (n = [], t.set(e, n)), n;
+	};
+	return {
+		all: async (e) => [...n(e)],
+		page: async (e, t, r) => n(e).slice(r, r + t).map((e) => ({ ...e })),
+		delete: async (e, t) => {
+			let r = n(e), i = r.findIndex((e) => String(e.id) === t);
+			i !== -1 && r.splice(i, 1);
+		},
+		update: async (e, t, r) => {
+			let i = n(e), a = i.findIndex((e) => String(e.id) === t);
+			a !== -1 && (i[a] = {
+				...i[a],
+				...r
+			});
+		},
+		dump: () => Object.fromEntries([...t.entries()].map(([e, t]) => [e, t.map((e) => ({ ...e }))]))
+	};
+}, O = (e, t, n) => {
+	let r = e[t], i = r instanceof Date ? r.getTime() : typeof r == "string" || typeof r == "number" ? new Date(r).getTime() : NaN;
+	return Number.isNaN(i) ? null : n - i;
+}, k = (e, t, n) => {
+	let r = t.dateField ?? "createdAt";
+	return e.filter((e) => {
+		let i = O(e, r, n);
+		return i !== null && i > t.ttlMs;
+	}).map((e) => String(e.id));
+}, A = 1e3, j = async (e, t, n = Date.now(), r = A) => {
+	let i = [];
+	for (let a of t) {
+		let t = a.action ?? "delete", o = 0, s = 0, c = !1;
+		for (; !c;) {
+			let i = await e.page(a.table, r, s), l = k(i, a, n);
+			if (t === "delete") {
+				for (let t of l) await e.delete(a.table, t);
+				s += i.length - l.length;
+			} else {
+				for (let t of l) {
+					let n = {};
+					for (let e of a.anonymizeFields ?? []) n[e] = null;
+					await e.update(a.table, t, n);
+				}
+				s += i.length;
+			}
+			o += l.length, c = i.length < r;
+		}
+		i.push({
+			table: a.table,
+			action: t,
+			affected: o
+		});
+	}
+	return i;
+}, M = async (e, t, n) => {
+	let r = {};
+	for (let i of t) {
+		let t = (await e.all(i.table)).filter((e) => String(e[i.subjectField]) === n);
+		t.length > 0 && (r[i.table] = (r[i.table] ?? []).concat(t));
+	}
+	return r;
+}, N = async (e, t, n, r = {}, i = () => (/* @__PURE__ */ new Date()).toISOString()) => {
+	let a = r.mode ?? "delete", o = [];
+	for (let i of t) {
+		let t = (await e.all(i.table)).filter((e) => String(e[i.subjectField]) === n);
+		for (let n of t) {
+			let t = String(n.id);
+			if (a === "delete") await e.delete(i.table, t);
+			else {
+				let n = {};
+				for (let e of r.anonymizeFields ?? []) n[e] = null;
+				await e.update(i.table, t, n);
+			}
+		}
+		t.length > 0 && o.push({
+			table: i.table,
+			count: t.length
+		});
+	}
+	return {
+		subjectId: n,
+		at: i(),
+		mode: a,
+		affected: o
+	};
+}, P = 1e4, F = (e = P) => {
+	let t = /* @__PURE__ */ new Map(), n = [], r = (e, t) => `${e}|${t}`;
+	return {
+		record: async (i) => {
+			t.set(r(i.subjectId, i.purpose), i), n.unshift(i), n.length > e && (n.length = e);
+		},
+		has: async (e, n) => t.get(r(e, n))?.granted ?? !1,
+		list: async (e) => n.filter((t) => t.subjectId === e)
+	};
+}, I = "_voltro_consent", L = w(I, {
+	id: S({ prefix: "consent" }),
+	subjectId: T(),
+	purpose: T(),
+	granted: b(),
+	at: T(),
+	tenantId: T().nullable()
+}).index("byConsentSubjectPurpose", ["subjectId", "purpose"]).index("byConsentSubject", ["subjectId"]), R = [L], z = (e) => ({
+	subjectId: String(e.subjectId),
+	purpose: String(e.purpose),
+	granted: e.granted === !0 || e.granted === 1 || e.granted === "true",
+	at: String(e.at),
+	tenantId: e.tenantId ?? null
+}), B = (e) => {
+	let t = (t, n) => e.query({
+		table: I,
+		predicate: t,
+		order: [{
+			column: "at",
+			direction: "desc"
+		}],
+		take: n,
+		skip: void 0,
+		projection: void 0
+	});
+	return {
+		record: async (t) => {
+			await e.insert(I, {
+				subjectId: t.subjectId,
+				purpose: t.purpose,
+				granted: t.granted,
+				at: t.at,
+				tenantId: t.tenantId ?? null
+			});
+		},
+		has: async (e, n) => {
+			let r = await t(y(x("subjectId", e), x("purpose", n)), 1);
+			return r[0] ? z(r[0]).granted : !1;
+		},
+		list: async (e) => (await t(x("subjectId", e))).map(z)
+	};
+}, V = 1e3, H = class extends a.Tag("@voltro/plugin-governance/GovernanceService")() {}, U = (a = {}) => {
+	let d = a.name ? `@voltro/plugin-governance#${a.name}` : "@voltro/plugin-governance", f = a.consent === "datastore", p = a.consent && a.consent !== "datastore" ? a.consent : f ? void 0 : F(), g, v = {
+		record: (e) => (p ?? g ?? F()).record(e),
+		has: (e, t) => (p ?? g ?? F()).has(e, t),
+		list: (e) => (p ?? g ?? F()).list(e)
+	}, y = a.subjectScopes ?? [], b = typeof a.fieldEncryption == "object" ? a.fieldEncryption.secretKey ?? "VOLTRO_FIELD_ENCRYPTION_KEY" : "VOLTRO_FIELD_ENCRYPTION_KEY", x = a.fieldEncryption ? [{
+		name: b,
+		required: !1,
+		secret: !0,
+		description: "AES-256-GCM key for `.encrypted()` columns (field encryption). Lose the key, lose the data — GCM fails closed."
+	}] : [], S = [], C, w, T = () => void 0, D = [], O = null, k = !1, A = () => {
+		if (!C) throw Error("governance: data store not bound yet");
+		return C;
+	}, P = {
+		exportSubject: (e) => M(A(), y, e),
+		eraseSubject: async (e, t) => {
+			let n = await N(A(), y, e, t ?? a.erasure ?? {});
+			return S.unshift(n), S.length > 1e3 && (S.length = V), n;
+		},
+		recordConsent: (e) => v.record(e),
+		hasConsent: (e, t) => v.has(e, t),
+		runRetentionNow: async () => {
+			if (!C || !a.retention) return;
+			let e = await j(C, a.retention);
+			D = e, O = (/* @__PURE__ */ new Date()).toISOString(), T("retention sweep", { report: e });
+		}
+	}, I = [
+		{
+			...n,
+			description: "GDPR data export for a subject (admin only).",
+			execute: (e, t) => o.gen(function* () {
+				return yield* u(t.request.subject, c), yield* o.promise(() => P.exportSubject(e.subjectId));
+			})
+		},
+		{
+			...t,
+			description: "GDPR erasure (right-to-be-forgotten) for a subject (admin only).",
+			execute: (e, t) => o.gen(function* () {
+				yield* u(t.request.subject, c);
+				let { subjectId: n, mode: r } = e;
+				return yield* o.promise(() => P.eraseSubject(n, r ? { mode: r } : void 0));
+			})
+		},
+		{
+			...e,
+			description: "Record the calling subject's consent for a purpose.",
+			execute: (e, t) => o.promise(async () => {
+				let { purpose: n, granted: r } = e, i = t.request.subject;
+				return await P.recordConsent({
+					subjectId: i.id ?? "anonymous",
+					purpose: n,
+					granted: r,
+					at: (/* @__PURE__ */ new Date()).toISOString(),
+					tenantId: i.tenantId ?? null
+				}), { ok: !0 };
+			})
+		},
+		{
+			...i,
+			description: "Whether the calling subject has granted consent for a purpose.",
+			execute: (e, t) => o.promise(async () => {
+				let n = t.request.subject;
+				return { granted: await P.hasConsent(n.id ?? "anonymous", e.purpose) };
+			})
+		}
+	], L = (e) => ({
+		kind: "json",
+		data: e
+	}), z = (e, t) => ({
+		kind: "json",
+		status: e,
+		data: { error: t }
+	}), U = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t);
+	return l({
+		name: d,
+		description: "Data governance — retention TTL sweep, GDPR export/erasure, consent ledger.",
+		permissions: ["store:write", "inspect:read"],
+		declaredEnv: x,
+		services: s.succeed(H, P),
+		routes: I,
+		rpcClientDescriptors: r,
+		inspectEndpoints: [
+			{
+				method: "GET",
+				path: "/status",
+				description: "Retention policies, subject scopes, field-encryption state, last sweep.",
+				handler: () => o.succeed(L({
+					retention: (a.retention ?? []).map((e) => ({
+						table: e.table,
+						ttlMs: e.ttlMs,
+						action: e.action ?? "delete"
+					})),
+					scopes: y.map((e) => ({
+						table: e.table,
+						subjectField: e.subjectField
+					})),
+					fieldEncryption: k,
+					sweepIntervalMs: a.sweepIntervalMs ?? 36e5,
+					lastSweepAt: O,
+					lastSweep: D,
+					erasureCount: S.length
+				}))
+			},
+			{
+				method: "GET",
+				path: "/erasures",
+				description: "GDPR erasure log (most recent first).",
+				handler: () => o.succeed(L({ erasures: S.slice(0, 100) }))
+			},
+			{
+				method: "GET",
+				path: "/consent",
+				description: "Consent ledger for a subject (?subjectId=…).",
+				handler: (e) => {
+					let t = U(e.url, "subjectId");
+					return t ? o.promise(async () => L({ records: await v.list(t) })) : o.succeed(z(400, "subjectId query param required"));
+				}
+			},
+			{
+				method: "POST",
+				path: "/export",
+				description: "Run a GDPR subject export.",
+				handler: (e) => o.promise(async () => {
+					let t;
+					try {
+						t = JSON.parse(e.body || "{}");
+					} catch {
+						return z(400, "invalid JSON body");
+					}
+					if (!t.subjectId) return z(400, "subjectId required");
+					try {
+						return L({ bundle: await P.exportSubject(t.subjectId) });
+					} catch (e) {
+						return z(500, e.message);
+					}
+				})
+			},
+			{
+				method: "POST",
+				path: "/erase",
+				description: "Run a GDPR erasure (right-to-be-forgotten).",
+				handler: (e) => o.promise(async () => {
+					let t;
+					try {
+						t = JSON.parse(e.body || "{}");
+					} catch {
+						return z(400, "invalid JSON body");
+					}
+					if (!t.subjectId) return z(400, "subjectId required");
+					try {
+						return L({ entry: await P.eraseSubject(t.subjectId, t.mode ? { mode: t.mode } : void 0) });
+					} catch (e) {
+						return z(500, e.message);
+					}
+				})
+			},
+			{
+				method: "POST",
+				path: "/sweep",
+				description: "Run the retention sweep now.",
+				handler: () => o.promise(async () => (await P.runRetentionNow(), L({
+					lastSweepAt: O,
+					lastSweep: D
+				})))
+			}
+		],
+		...f ? { extendSchema: { tables: R } } : {},
+		bindDataStore: (e, t) => {
+			if (C = E(e), f && (g = B(e)), a.retention && a.retention.length > 0) {
+				let e = a.sweepIntervalMs ?? 36e5;
+				w = t?.scheduleCoordinated("governance.retention.sweep", e, () => P.runRetentionNow());
+			}
+		},
+		onActivate: (e) => o.gen(function* () {
+			T = (t, n) => e.logger.warn(t, n);
+			let t = !1;
+			if (a.fieldEncryption) {
+				let e = b, n = yield* o.promise(() => h(e));
+				if (!n) return yield* o.die(/* @__PURE__ */ Error(`governance: fieldEncryption is enabled but secret "${e}" did not resolve — set it via the Secrets-Resolver / env`));
+				_(m(n)), t = !0, k = !0;
+			}
+			!f && !a.consent && e.logger.warn("governance: consent ledger uses the in-memory store — per-process + restart-cleared. Under >1 replica a consent recorded on one replica is invisible to others. Pass consent: 'datastore' (durable, cross-instance) in production."), e.logger.info("governance active", {
+				retention: a.retention?.length ?? 0,
+				scopes: y.length,
+				fieldEncryption: t,
+				consent: f ? "datastore" : a.consent ? "custom" : "memory"
+			});
+		}),
+		onDeactivate: () => o.sync(() => {
+			w?.stop(), w = void 0, a.fieldEncryption && _(void 0);
+		})
+	});
+};
+//#endregion
+export { I as CONSENT_TABLE, v as ENCRYPTED_PREFIX, V as ERASURE_LOG_CAP, H as GovernanceService, L as consentTable, R as consentTables, B as dataStoreConsentStore, E as dataStoreGovStore, d as deriveKey, N as eraseSubject, M as exportSubject, U as governancePlugin, C as isEncrypted, f as makeAesCipher, p as makeFieldCipher, F as memoryConsentStore, D as memoryGovStore, j as runRetention, k as selectExpired, g as setFieldCipher };

package/dist/rpc.d.ts

@@ -0,0 +1,41 @@
+import { ActionProcedureDescriptor } from '@voltro/protocol';
+import { MutationProcedureDescriptor } from '@voltro/protocol';
+import { PluginRpcClientDescriptor } from '@voltro/protocol';
+import { QueryProcedureDescriptor } from '@voltro/protocol';
+import { Schema } from 'effect';
+
+export declare const consentDescriptor: MutationProcedureDescriptor<"governance.consent", Schema.Struct<{
+    purpose: typeof Schema.String;
+    granted: typeof Schema.Boolean;
+}>, Schema.Struct<{
+    ok: typeof Schema.Boolean;
+}>, typeof Schema.Never>;
+
+export declare const eraseDescriptor: ActionProcedureDescriptor<"governance.erase", Schema.Struct<{
+    subjectId: typeof Schema.String;
+    mode: Schema.optional<Schema.Literal<["delete", "anonymize"]>>;
+}>, Schema.Struct<{
+    subjectId: typeof Schema.String;
+    at: typeof Schema.String;
+    mode: typeof Schema.String;
+    affected: Schema.Array$<Schema.Struct<{
+        table: typeof Schema.String;
+        count: typeof Schema.Number;
+    }>>;
+}>, typeof Schema.Never>;
+
+export declare const exportDescriptor: ActionProcedureDescriptor<"governance.export", Schema.Struct<{
+    subjectId: typeof Schema.String;
+}>, Schema.Record$<typeof Schema.String, typeof Schema.Unknown>, typeof Schema.Never>;
+
+/** Declared for the codegen (`VoltroPlugin.rpcClientDescriptors`) so each tag is
+ *  emitted into the generated client group. Kept in lockstep with the exports. */
+export declare const governanceRpcClientImports: ReadonlyArray<PluginRpcClientDescriptor>;
+
+export declare const hasConsentDescriptor: QueryProcedureDescriptor<"governance.hasConsent", Schema.Struct<{
+    purpose: typeof Schema.String;
+}>, Schema.Struct<{
+    granted: typeof Schema.Boolean;
+}>, typeof Schema.Never>;
+
+export { }