@voltro/plugin-governance 0.32.0 → 0.34.0

package/dist/index.js

@@ -1,10 +1,10 @@
 import { consentDescriptor as e, eraseDescriptor as t, exportDescriptor as n, governanceRpcClientImports as r, hasConsentDescriptor as i } from "./rpc.js";
 import { Context as a, Effect as o, Layer as s } from "effect";
-import { ADMIN_SCOPE as c, definePlugin as l, requireScope as u } from "@voltro/protocol";
-import { deriveKey as d, makeAesCipher as f, makeFieldCipher as p, makeFieldCipher as m, resolveSecret as h, setFieldCipher as g, setFieldCipher as _ } from "@voltro/runtime";
-import { ENCRYPTED_PREFIX as v, and as y, boolean as b, eq as x, id as S, isEncrypted as C, table as w, text as T } from "@voltro/database";
+import { ADMIN_SCOPE as c, definePlugin as l, pluginInstanceName as u, requireScope as d } from "@voltro/protocol";
+import { deriveKey as f, makeAesCipher as p, makeFieldCipher as m, makeFieldCipher as ee, resolveSecret as h, setFieldCipher as g, setFieldCipher as _ } from "@voltro/runtime";
+import { DEFAULT_SUBJECT_GRAPH_DEPTH as v, ENCRYPTED_PREFIX as y, and as b, boolean as x, deriveSubjectGraph as S, deriveSubjectGraph as C, eq as w, formatSubjectGraph as T, id as E, isEncrypted as D, table as O, text as k } from "@voltro/database";
 //#region src/store.ts
-var E = (e) => {
+var A = (e) => {
 	let t = e, n = (e, t) => ({
 		table: void 0,
 		predicate: void 0,
@@ -21,6 +21,15 @@ var E = (e) => {
 			...n(void 0, void 0),
 			table: e
 		}),
+		where: async (e, r, i) => i.length === 0 ? [] : t.query({
+			...n(void 0, void 0),
+			table: e,
+			predicate: {
+				column: r,
+				op: "in",
+				value: [...i]
+			}
+		}),
 		page: (e, r, i) => t.query({
 			...n(r, i),
 			table: e
@@ -32,13 +41,18 @@ var E = (e) => {
 			await t.update(e, n, r);
 		}
 	};
-}, D = (e = {}) => {
+}, j = (e = {}) => {
 	let t = new Map(Object.entries(e).map(([e, t]) => [e, t.map((e) => ({ ...e }))])), n = (e) => {
 		let n = t.get(e);
 		return n || (n = [], t.set(e, n)), n;
 	};
 	return {
 		all: async (e) => [...n(e)],
+		where: async (e, t, r) => {
+			if (r.length === 0) return [];
+			let i = new Set(r.map((e) => String(e)));
+			return n(e).filter((e) => i.has(String(e[t]))).map((e) => ({ ...e }));
+		},
 		page: async (e, t, r) => n(e).slice(r, r + t).map((e) => ({ ...e })),
 		delete: async (e, t) => {
 			let r = n(e), i = r.findIndex((e) => String(e.id) === t);
@@ -53,21 +67,121 @@ var E = (e) => {
 		},
 		dump: () => Object.fromEntries([...t.entries()].map(([e, t]) => [e, t.map((e) => ({ ...e }))]))
 	};
-}, O = (e, t, n) => {
+}, M = 500, N = 5e4, P = (e, t) => {
+	let n = [];
+	for (let r = 0; r < e.length; r += t) n.push(e.slice(r, r + t));
+	return n;
+}, F = (e, t) => e.table === t && e.subjectField === "id" ? {
+	table: e.table,
+	hops: [],
+	depth: 0,
+	via: "declared"
+} : {
+	table: e.table,
+	hops: [{
+		table: e.table,
+		foreignKey: e.subjectField,
+		parentKey: "id"
+	}],
+	depth: 1,
+	via: "declared"
+}, I = async (e, t, n, r = N) => {
+	let i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Map(), o = async (t, n, r) => {
+		if (r.length === 0) return [];
+		let i = `${t}\u0000${n}\u0000${r.join(",")}`, o = a.get(i);
+		if (o !== void 0) return o;
+		let s = [];
+		for (let i of P(r, 500)) s.push(...await e.where(t, n, i));
+		return a.set(i, s), s;
+	}, s = (e, t) => {
+		let n = i.get(e);
+		n === void 0 && (n = {
+			rows: /* @__PURE__ */ new Map(),
+			truncated: !1
+		}, i.set(e, n));
+		for (let e of t) {
+			if (n.rows.size >= r) {
+				n.truncated = !0;
+				break;
+			}
+			n.rows.set(String(e.id ?? JSON.stringify(e)), e);
+		}
+	};
+	for (let e of t) {
+		if (e.hops.length === 0) {
+			s(e.table, await o(e.table, "id", [n]));
+			continue;
+		}
+		let t = [n];
+		for (let n of e.hops) {
+			let e = await o(n.table, n.foreignKey, t);
+			if (e.length === 0) {
+				t = [];
+				break;
+			}
+			s(n.table, e), t = [...new Set(e.map((e) => String(e[n.parentKey] ?? e.id)))];
+		}
+	}
+	return [...i.entries()].map(([e, t]) => ({
+		table: e,
+		rows: [...t.rows.values()],
+		...t.truncated ? { truncated: !0 } : {}
+	}));
+}, L = async (e, t, n) => {
+	let r = await I(e, t, n), i = {};
+	for (let e of r) e.rows.length > 0 && (i[e.table] = e.rows);
+	return i;
+}, R = (e, t) => {
+	if (t === void 0 || t.length === 0) throw Error(`${e}: mode 'anonymize' needs a non-empty 'anonymizeFields' — with none, nothing is written and the result would report rows as affected that were not changed`);
+}, z = async (e, t, n, r = {}, i = () => (/* @__PURE__ */ new Date()).toISOString()) => {
+	let a = r.mode ?? "delete";
+	a === "anonymize" && R("governance erasure", r.anonymizeFields);
+	let o = await I(e, t, n), s = /* @__PURE__ */ new Map();
+	for (let e of t) {
+		let t = s.get(e.table);
+		(t === void 0 || e.depth > t) && s.set(e.table, e.depth);
+	}
+	let c = [...o].sort((e, t) => (s.get(t.table) ?? 0) - (s.get(e.table) ?? 0)), l = [], u = [];
+	for (let t of c) if (t.rows.length !== 0) {
+		t.truncated === !0 && u.push(t.table);
+		for (let n of t.rows) {
+			let i = String(n.id);
+			if (a === "delete") await e.delete(t.table, i);
+			else {
+				let n = {};
+				for (let e of r.anonymizeFields ?? []) n[e] = null;
+				await e.update(t.table, i, n);
+			}
+		}
+		l.push({
+			table: t.table,
+			count: t.rows.length
+		});
+	}
+	return {
+		subjectId: n,
+		at: i(),
+		mode: a,
+		affected: l,
+		...u.length > 0 ? { truncated: u } : {}
+	};
+}, B = (e, t, n) => {
 	let r = e[t], i = r instanceof Date ? r.getTime() : typeof r == "string" || typeof r == "number" ? new Date(r).getTime() : NaN;
 	return Number.isNaN(i) ? null : n - i;
-}, k = (e, t, n) => {
+}, V = (e, t, n) => {
 	let r = t.dateField ?? "createdAt";
 	return e.filter((e) => {
-		let i = O(e, r, n);
+		let i = B(e, r, n);
 		return i !== null && i > t.ttlMs;
 	}).map((e) => String(e.id));
-}, A = 1e3, j = async (e, t, n = Date.now(), r = A) => {
+}, H = 1e3, U = async (e, t, n = Date.now(), r = H) => {
 	let i = [];
 	for (let a of t) {
-		let t = a.action ?? "delete", o = 0, s = 0, c = !1;
+		let t = a.action ?? "delete";
+		t === "anonymize" && R(`retention policy '${a.table}'`, a.anonymizeFields);
+		let o = 0, s = 0, c = !1;
 		for (; !c;) {
-			let i = await e.page(a.table, r, s), l = k(i, a, n);
+			let i = await e.page(a.table, r, s), l = V(i, a, n);
 			if (t === "delete") {
 				for (let t of l) await e.delete(a.table, t);
 				s += i.length - l.length;
@@ -88,38 +202,7 @@ var E = (e) => {
 		});
 	}
 	return i;
-}, M = async (e, t, n) => {
-	let r = {};
-	for (let i of t) {
-		let t = (await e.all(i.table)).filter((e) => String(e[i.subjectField]) === n);
-		t.length > 0 && (r[i.table] = (r[i.table] ?? []).concat(t));
-	}
-	return r;
-}, N = async (e, t, n, r = {}, i = () => (/* @__PURE__ */ new Date()).toISOString()) => {
-	let a = r.mode ?? "delete", o = [];
-	for (let i of t) {
-		let t = (await e.all(i.table)).filter((e) => String(e[i.subjectField]) === n);
-		for (let n of t) {
-			let t = String(n.id);
-			if (a === "delete") await e.delete(i.table, t);
-			else {
-				let n = {};
-				for (let e of r.anonymizeFields ?? []) n[e] = null;
-				await e.update(i.table, t, n);
-			}
-		}
-		t.length > 0 && o.push({
-			table: i.table,
-			count: t.length
-		});
-	}
-	return {
-		subjectId: n,
-		at: i(),
-		mode: a,
-		affected: o
-	};
-}, P = 1e4, F = (e = P) => {
+}, W = 1e4, G = (e = W) => {
 	let t = /* @__PURE__ */ new Map(), n = [], r = (e, t) => `${e}|${t}`;
 	return {
 		record: async (i) => {
@@ -128,22 +211,22 @@ var E = (e) => {
 		has: async (e, n) => t.get(r(e, n))?.granted ?? !1,
 		list: async (e) => n.filter((t) => t.subjectId === e)
 	};
-}, I = "_voltro_consent", L = w(I, {
-	id: S({ prefix: "consent" }),
-	subjectId: T(),
-	purpose: T(),
-	granted: b(),
-	at: T(),
-	tenantId: T().nullable()
-}).index("byConsentSubjectPurpose", ["subjectId", "purpose"]).index("byConsentSubject", ["subjectId"]), R = [L], z = (e) => ({
+}, K = "_voltro_consent", q = O(K, {
+	id: E({ prefix: "consent" }),
+	subjectId: k(),
+	purpose: k(),
+	granted: x(),
+	at: k(),
+	tenantId: k().nullable()
+}).index("byConsentSubjectPurpose", ["subjectId", "purpose"]).index("byConsentSubject", ["subjectId"]), J = [q], Y = (e) => ({
 	subjectId: String(e.subjectId),
 	purpose: String(e.purpose),
 	granted: e.granted === !0 || e.granted === 1 || e.granted === "true",
 	at: String(e.at),
 	tenantId: e.tenantId ?? null
-}), B = (e) => {
+}), X = (e) => {
 	let t = (t, n) => e.query({
-		table: I,
+		table: K,
 		predicate: t,
 		order: [{
 			column: "at",
@@ -155,7 +238,7 @@ var E = (e) => {
 	});
 	return {
 		record: async (t) => {
-			await e.insert(I, {
+			await e.insert(K, {
 				subjectId: t.subjectId,
 				purpose: t.purpose,
 				granted: t.granted,
@@ -164,52 +247,79 @@ var E = (e) => {
 			});
 		},
 		has: async (e, n) => {
-			let r = await t(y(x("subjectId", e), x("purpose", n)), 1);
-			return r[0] ? z(r[0]).granted : !1;
+			let r = await t(b(w("subjectId", e), w("purpose", n)), 1);
+			return r[0] ? Y(r[0]).granted : !1;
 		},
-		list: async (e) => (await t(x("subjectId", e))).map(z)
+		list: async (e) => (await t(w("subjectId", e))).map(Y)
 	};
-}, V = 1e3, H = class extends a.Tag("@voltro/plugin-governance/GovernanceService")() {}, U = (a = {}) => {
-	let d = a.name ? `@voltro/plugin-governance#${a.name}` : "@voltro/plugin-governance", f = a.consent === "datastore", p = a.consent && a.consent !== "datastore" ? a.consent : f ? void 0 : F(), g, v = {
-		record: (e) => (p ?? g ?? F()).record(e),
-		has: (e, t) => (p ?? g ?? F()).has(e, t),
-		list: (e) => (p ?? g ?? F()).list(e)
-	}, y = a.subjectScopes ?? [], b = typeof a.fieldEncryption == "object" ? a.fieldEncryption.secretKey ?? "VOLTRO_FIELD_ENCRYPTION_KEY" : "VOLTRO_FIELD_ENCRYPTION_KEY", x = a.fieldEncryption ? [{
-		name: b,
+}, Z = 1e3, Q = class extends a.Tag("@voltro/plugin-governance/GovernanceService")() {}, $ = "@voltro/plugin-governance", te = (a = {}) => {
+	let f = u({
+		base: $,
+		alias: a.alias,
+		instance: a.name
+	}), p = a.consent === "datastore", m = a.consent && a.consent !== "datastore" ? a.consent : p ? void 0 : G(), g, v = {
+		record: (e) => (m ?? g ?? G()).record(e),
+		has: (e, t) => (m ?? g ?? G()).has(e, t),
+		list: (e) => (m ?? g ?? G()).list(e)
+	}, y = a.subjectScopes ?? [], b = a.deriveSubjectScopes, x = () => {
+		let e = b?.subjectTable ?? "actors", t = y.map((t) => F(t, e));
+		if (b === void 0) return {
+			subjectTable: e,
+			paths: t,
+			limitations: []
+		};
+		let n = C({
+			subjectTable: e,
+			...b.maxDepth === void 0 ? {} : { maxDepth: b.maxDepth },
+			...b.exclude === void 0 ? {} : { exclude: b.exclude }
+		}), r = new Set(n.paths.map((e) => `${e.table}|${e.hops.map((e) => e.foreignKey).join(">")}`)), i = t.filter((e) => !r.has(`${e.table}|${e.hops.map((e) => e.foreignKey).join(">")}`));
+		return {
+			...n,
+			paths: [...n.paths, ...i]
+		};
+	}, S = () => x().paths;
+	for (let e of a.retention ?? []) (e.action ?? "delete") === "anonymize" && R(`retention policy '${e.table}'`, e.anonymizeFields);
+	a.erasure?.mode === "anonymize" && R("erasure defaults", a.erasure.anonymizeFields);
+	let w = typeof a.fieldEncryption == "object" ? a.fieldEncryption.secretKey ?? "VOLTRO_FIELD_ENCRYPTION_KEY" : "VOLTRO_FIELD_ENCRYPTION_KEY", T = a.fieldEncryption ? [{
+		name: w,
 		required: !1,
 		secret: !0,
 		description: "AES-256-GCM key for `.encrypted()` columns (field encryption). Lose the key, lose the data — GCM fails closed."
-	}] : [], S = [], C, w, T = () => void 0, D = [], O = null, k = !1, A = () => {
-		if (!C) throw Error("governance: data store not bound yet");
-		return C;
-	}, P = {
-		exportSubject: (e) => M(A(), y, e),
+	}] : [], E = [], D, O, k = () => void 0, j = [], M = null, N = !1, P = () => {
+		if (!D) throw Error("governance: data store not bound yet");
+		return D;
+	}, I = {
+		subjectGraph: x,
+		exportSubject: (e) => L(P(), S(), e),
 		eraseSubject: async (e, t) => {
-			let n = await N(A(), y, e, t ?? a.erasure ?? {});
-			return S.unshift(n), S.length > 1e3 && (S.length = V), n;
+			let n = {
+				...a.erasure,
+				...t
+			}, r = await z(P(), S(), e, n);
+			return E.unshift(r), E.length > 1e3 && (E.length = Z), r;
 		},
 		recordConsent: (e) => v.record(e),
 		hasConsent: (e, t) => v.has(e, t),
 		runRetentionNow: async () => {
-			if (!C || !a.retention) return;
-			let e = await j(C, a.retention);
-			D = e, O = (/* @__PURE__ */ new Date()).toISOString(), T("retention sweep", { report: e });
+			if (!D || !a.retention) return;
+			let e = await U(D, a.retention);
+			j = e, M = (/* @__PURE__ */ new Date()).toISOString(), k("retention sweep", { report: e });
 		}
-	}, I = [
+	}, B = [
 		{
 			...n,
 			description: "GDPR data export for a subject (admin only).",
 			execute: (e, t) => o.gen(function* () {
-				return yield* u(t.request.subject, c), yield* o.promise(() => P.exportSubject(e.subjectId));
+				return yield* d(t.request.subject, c), yield* o.promise(() => I.exportSubject(e.subjectId));
 			})
 		},
 		{
 			...t,
 			description: "GDPR erasure (right-to-be-forgotten) for a subject (admin only).",
 			execute: (e, t) => o.gen(function* () {
-				yield* u(t.request.subject, c);
+				yield* d(t.request.subject, c);
 				let { subjectId: n, mode: r } = e;
-				return yield* o.promise(() => P.eraseSubject(n, r ? { mode: r } : void 0));
+				return yield* o.promise(() => I.eraseSubject(n, r ? { mode: r } : void 0));
 			})
 		},
 		{
@@ -217,7 +327,7 @@ var E = (e) => {
 			description: "Record the calling subject's consent for a purpose.",
 			execute: (e, t) => o.promise(async () => {
 				let { purpose: n, granted: r } = e, i = t.request.subject;
-				return await P.recordConsent({
+				return await I.recordConsent({
 					subjectId: i.id ?? "anonymous",
 					purpose: n,
 					granted: r,
@@ -231,35 +341,36 @@ var E = (e) => {
 			description: "Whether the calling subject has granted consent for a purpose.",
 			execute: (e, t) => o.promise(async () => {
 				let n = t.request.subject;
-				return { granted: await P.hasConsent(n.id ?? "anonymous", e.purpose) };
+				return { granted: await I.hasConsent(n.id ?? "anonymous", e.purpose) };
 			})
 		}
-	], L = (e) => ({
+	], V = (e) => ({
 		kind: "json",
 		data: e
-	}), z = (e, t) => ({
+	}), H = (e, t) => ({
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), U = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t);
+	}), W = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t);
 	return l({
-		name: d,
+		name: f,
+		baseName: $,
 		description: "Data governance — retention TTL sweep, GDPR export/erasure, consent ledger.",
 		permissions: [
 			"store:write",
 			"inspect:read",
 			"inspect:write"
 		],
-		declaredEnv: x,
-		services: s.succeed(H, P),
-		routes: I,
+		declaredEnv: T,
+		services: s.succeed(Q, I),
+		routes: B,
 		rpcClientDescriptors: r,
 		inspectEndpoints: [
 			{
 				method: "GET",
 				path: "/status",
 				description: "Retention policies, subject scopes, field-encryption state, last sweep.",
-				handler: () => o.succeed(L({
+				handler: () => o.succeed(V({
 					retention: (a.retention ?? []).map((e) => ({
 						table: e.table,
 						ttlMs: e.ttlMs,
@@ -269,26 +380,45 @@ var E = (e) => {
 						table: e.table,
 						subjectField: e.subjectField
 					})),
-					fieldEncryption: k,
+					fieldEncryption: N,
 					sweepIntervalMs: a.sweepIntervalMs ?? 36e5,
-					lastSweepAt: O,
-					lastSweep: D,
-					erasureCount: S.length
+					lastSweepAt: M,
+					lastSweep: j,
+					erasureCount: E.length
 				}))
 			},
 			{
 				method: "GET",
 				path: "/erasures",
 				description: "GDPR erasure log (most recent first).",
-				handler: () => o.succeed(L({ erasures: S.slice(0, 100) }))
+				handler: () => o.succeed(V({ erasures: E.slice(0, 100) }))
+			},
+			{
+				method: "GET",
+				path: "/subject-graph",
+				description: "The routes a DSAR export/erasure walks — AND what the derivation cannot see.",
+				handler: () => o.sync(() => {
+					let e = x();
+					return V({
+						subjectTable: e.subjectTable,
+						derived: b !== void 0,
+						paths: e.paths.map((t) => ({
+							table: t.table,
+							depth: t.depth,
+							via: t.via,
+							route: [e.subjectTable, ...t.hops.map((e) => `${e.table}.${e.foreignKey}`)]
+						})),
+						limitations: e.limitations
+					});
+				})
 			},
 			{
 				method: "GET",
 				path: "/consent",
 				description: "Consent ledger for a subject (?subjectId=…).",
 				handler: (e) => {
-					let t = U(e.url, "subjectId");
-					return t ? o.promise(async () => L({ records: await v.list(t) })) : o.succeed(z(400, "subjectId query param required"));
+					let t = W(e.url, "subjectId");
+					return t ? o.promise(async () => V({ records: await v.list(t) })) : o.succeed(H(400, "subjectId query param required"));
 				}
 			},
 			{
@@ -300,13 +430,13 @@ var E = (e) => {
 					try {
 						t = JSON.parse(e.body || "{}");
 					} catch {
-						return z(400, "invalid JSON body");
+						return H(400, "invalid JSON body");
 					}
-					if (!t.subjectId) return z(400, "subjectId required");
+					if (!t.subjectId) return H(400, "subjectId required");
 					try {
-						return L({ bundle: await P.exportSubject(t.subjectId) });
+						return V({ bundle: await I.exportSubject(t.subjectId) });
 					} catch (e) {
-						return z(500, e.message);
+						return H(500, e.message);
 					}
 				})
 			},
@@ -319,13 +449,13 @@ var E = (e) => {
 					try {
 						t = JSON.parse(e.body || "{}");
 					} catch {
-						return z(400, "invalid JSON body");
+						return H(400, "invalid JSON body");
 					}
-					if (!t.subjectId) return z(400, "subjectId required");
+					if (!t.subjectId) return H(400, "subjectId required");
 					try {
-						return L({ entry: await P.eraseSubject(t.subjectId, t.mode ? { mode: t.mode } : void 0) });
+						return V({ entry: await I.eraseSubject(t.subjectId, t.mode ? { mode: t.mode } : void 0) });
 					} catch (e) {
-						return z(500, e.message);
+						return H(500, e.message);
 					}
 				})
 			},
@@ -333,38 +463,45 @@ var E = (e) => {
 				method: "POST",
 				path: "/sweep",
 				description: "Run the retention sweep now.",
-				handler: () => o.promise(async () => (await P.runRetentionNow(), L({
-					lastSweepAt: O,
-					lastSweep: D
+				handler: () => o.promise(async () => (await I.runRetentionNow(), V({
+					lastSweepAt: M,
+					lastSweep: j
 				})))
 			}
 		],
-		...f ? { extendSchema: { tables: R } } : {},
+		...p ? { extendSchema: { tables: J } } : {},
 		bindDataStore: (e, t) => {
-			if (C = E(e), f && (g = B(e)), a.retention && a.retention.length > 0) {
+			if (D = A(e), p && (g = X(e)), a.retention && a.retention.length > 0) {
 				let e = a.sweepIntervalMs ?? 36e5;
-				w = t?.scheduleCoordinated("governance.retention.sweep", e, () => P.runRetentionNow());
+				O = t?.scheduleCoordinated("governance.retention.sweep", e, () => I.runRetentionNow());
 			}
 		},
 		onActivate: (e) => o.gen(function* () {
-			T = (t, n) => e.logger.warn(t, n);
+			k = (t, n) => e.logger.warn(t, n);
 			let t = !1;
 			if (a.fieldEncryption) {
-				let e = b, n = yield* o.promise(() => h(e));
+				let e = w, n = yield* o.promise(() => h(e));
 				if (!n) return yield* o.die(/* @__PURE__ */ Error(`governance: fieldEncryption is enabled but secret "${e}" did not resolve — set it via the Secrets-Resolver / env`));
-				_(m(n)), t = !0, k = !0;
+				_(ee(n)), t = !0, N = !0;
+			}
+			!p && !a.consent && e.logger.warn("governance: consent ledger uses the in-memory store — per-process + restart-cleared. Under >1 replica a consent recorded on one replica is invisible to others. Pass consent: 'datastore' (durable, cross-instance) in production.");
+			let n = x();
+			if (b !== void 0) {
+				let t = n.limitations.filter((e) => e.kind === "unreachable").length;
+				n.paths.length <= 1 && e.logger.warn(`governance: the derived subject scope reached ${n.paths.length} table(s) from '${n.subjectTable}'. A DSAR would export almost nothing. Check that subjectTable names a real table and that the app declares relations() or reference() columns pointing at it.`), t > 0 && e.logger.info(`governance: ${t} registered table(s) are NOT linked to '${n.subjectTable}' and are outside every DSAR. GET /_voltro/inspect/plugins/governance/subject-graph lists them; add subjectScopes for any that hold subject data.`);
 			}
-			!f && !a.consent && e.logger.warn("governance: consent ledger uses the in-memory store — per-process + restart-cleared. Under >1 replica a consent recorded on one replica is invisible to others. Pass consent: 'datastore' (durable, cross-instance) in production."), e.logger.info("governance active", {
+			e.logger.info("governance active", {
 				retention: a.retention?.length ?? 0,
-				scopes: y.length,
+				scopes: n.paths.length,
+				scopeSource: b === void 0 ? "declared" : "derived",
 				fieldEncryption: t,
-				consent: f ? "datastore" : a.consent ? "custom" : "memory"
+				consent: p ? "datastore" : a.consent ? "custom" : "memory"
 			});
 		}),
 		onDeactivate: () => o.sync(() => {
-			w?.stop(), w = void 0, a.fieldEncryption && _(void 0);
+			O?.stop(), O = void 0, a.fieldEncryption && _(void 0);
 		})
 	});
 };
 //#endregion
-export { I as CONSENT_TABLE, v as ENCRYPTED_PREFIX, V as ERASURE_LOG_CAP, H as GovernanceService, L as consentTable, R as consentTables, B as dataStoreConsentStore, E as dataStoreGovStore, d as deriveKey, N as eraseSubject, M as exportSubject, U as governancePlugin, C as isEncrypted, f as makeAesCipher, p as makeFieldCipher, F as memoryConsentStore, D as memoryGovStore, j as runRetention, k as selectExpired, g as setFieldCipher };
+export { K as CONSENT_TABLE, v as DEFAULT_SUBJECT_GRAPH_DEPTH, y as ENCRYPTED_PREFIX, Z as ERASURE_LOG_CAP, Q as GovernanceService, M as SUBJECT_KEY_CHUNK, N as SUBJECT_ROW_CAP, I as collectSubjectRows, q as consentTable, J as consentTables, X as dataStoreConsentStore, A as dataStoreGovStore, f as deriveKey, S as deriveSubjectGraph, z as eraseSubject, L as exportSubject, T as formatSubjectGraph, te as governancePlugin, D as isEncrypted, p as makeAesCipher, m as makeFieldCipher, G as memoryConsentStore, j as memoryGovStore, U as runRetention, F as scopeToPath, V as selectExpired, g as setFieldCipher };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-governance",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Data governance — retention policies (TTL sweep), GDPR subject export + erasure (right-to-be-forgotten), and consent recording. Builds on audit + soft-delete.",
   "keywords": [
     "voltro",
@@ -27,7 +27,8 @@
       "types": "./dist/rpc.d.ts",
       "import": "./dist/rpc.js",
       "default": "./dist/rpc.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -37,9 +38,9 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.32.0",
-    "@voltro/protocol": "0.32.0",
-    "@voltro/runtime": "0.32.0"
+    "@voltro/database": "0.34.0",
+    "@voltro/protocol": "0.34.0",
+    "@voltro/runtime": "0.34.0"
   },
   "peerDependencies": {
     "effect": "^3.22.0"