@voltro/plugin-governance 0.81.0 → 0.82.0

package/THIRD-PARTY-NOTICES.md

@@ -4551,7 +4551,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## undici@8.10.0
+## undici@8.11.2
 
 License: MIT
 

package/dist/index.d.ts

@@ -221,6 +221,9 @@ export declare interface GovernancePluginOptions {
      */
     readonly fieldEncryption?: boolean | {
         readonly secretKey?: string;
+        /** Names of the secrets holding the keys a rotation retires — read, never
+         *  written with. Default `['VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS']`. */
+        readonly previousSecretKeys?: ReadonlyArray<string>;
     };
     /**
      * Namespace for this plugin's rpc tags + inspect endpoints. Default `governance`.

package/dist/index.js

@@ -280,37 +280,42 @@ var A = (e) => {
 	}, S = () => x().paths;
 	for (let e of a.retention ?? []) (e.action ?? "delete") === "anonymize" && R(`retention policy '${e.table}'`, e.anonymizeFields);
 	a.erasure?.mode === "anonymize" && R("erasure defaults", a.erasure.anonymizeFields);
-	let w = typeof a.fieldEncryption == "object" ? a.fieldEncryption.secretKey ?? "VOLTRO_FIELD_ENCRYPTION_KEY" : "VOLTRO_FIELD_ENCRYPTION_KEY", T = a.fieldEncryption ? [{
+	let w = typeof a.fieldEncryption == "object" ? a.fieldEncryption.secretKey ?? "VOLTRO_FIELD_ENCRYPTION_KEY" : "VOLTRO_FIELD_ENCRYPTION_KEY", T = typeof a.fieldEncryption == "object" ? a.fieldEncryption.previousSecretKeys ?? ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"] : ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"], E = a.fieldEncryption ? [{
 		name: w,
 		required: !1,
 		secret: !0,
 		description: "AES-256-GCM key for `.encrypted()` columns (field encryption). Lose the key, lose the data — GCM fails closed."
-	}] : [], E = [], D, O, k = () => void 0, j = [], M = null, N = !1, P = () => {
-		if (!D) throw Error("governance: data store not bound yet");
-		return D;
-	}, I = {
+	}, ...T.map((e) => ({
+		name: e,
+		required: !1,
+		secret: !0,
+		description: "A retired field-encryption key, read during a rotation so values written under it stay readable. Remove once they are re-encrypted."
+	}))] : [], D = [], O, k, j = () => void 0, M = [], N = null, P = !1, I = () => {
+		if (!O) throw Error("governance: data store not bound yet");
+		return O;
+	}, B = {
 		subjectGraph: x,
-		exportSubject: (e) => L(P(), S(), e),
+		exportSubject: (e) => L(I(), S(), e),
 		eraseSubject: async (e, t) => {
 			let n = {
 				...a.erasure,
 				...t
-			}, r = await z(P(), S(), e, n);
-			return E.unshift(r), E.length > 1e3 && (E.length = Z), r;
+			}, r = await z(I(), S(), e, n);
+			return D.unshift(r), D.length > 1e3 && (D.length = Z), r;
 		},
 		recordConsent: (e) => v.record(e),
 		hasConsent: (e, t) => v.has(e, t),
 		runRetentionNow: async () => {
-			if (!D || !a.retention) return;
-			let e = await U(D, a.retention);
-			j = e, M = (/* @__PURE__ */ new Date()).toISOString(), k("retention sweep", { report: e });
+			if (!O || !a.retention) return;
+			let e = await U(O, a.retention);
+			M = e, N = (/* @__PURE__ */ new Date()).toISOString(), j("retention sweep", { report: e });
 		}
-	}, B = [
+	}, V = [
 		{
 			...n,
 			description: "GDPR data export for a subject (admin only).",
 			execute: (e, t) => o.gen(function* () {
-				return yield* d(t.request.subject, c), yield* o.promise(() => I.exportSubject(e.subjectId));
+				return yield* d(t.request.subject, c), yield* o.promise(() => B.exportSubject(e.subjectId));
 			})
 		},
 		{
@@ -319,7 +324,7 @@ var A = (e) => {
 			execute: (e, t) => o.gen(function* () {
 				yield* d(t.request.subject, c);
 				let { subjectId: n, mode: r } = e;
-				return yield* o.promise(() => I.eraseSubject(n, r ? { mode: r } : void 0));
+				return yield* o.promise(() => B.eraseSubject(n, r ? { mode: r } : void 0));
 			})
 		},
 		{
@@ -327,7 +332,7 @@ var A = (e) => {
 			description: "Record the calling subject's consent for a purpose.",
 			execute: (e, t) => o.promise(async () => {
 				let { purpose: n, granted: r } = e, i = t.request.subject;
-				return await I.recordConsent({
+				return await B.recordConsent({
 					subjectId: i.id ?? "anonymous",
 					purpose: n,
 					granted: r,
@@ -341,23 +346,23 @@ var A = (e) => {
 			description: "Whether the calling subject has granted consent for a purpose.",
 			execute: (e, t) => o.promise(async () => {
 				let n = t.request.subject;
-				return { granted: await I.hasConsent(n.id ?? "anonymous", e.purpose) };
+				return { granted: await B.hasConsent(n.id ?? "anonymous", e.purpose) };
 			})
 		}
-	], V = (e) => ({
+	], H = (e) => ({
 		kind: "json",
 		data: e
-	}), H = (e, t) => ({
+	}), W = (e, t) => ({
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), W = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t), K = [
+	}), K = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t), q = [
 		{
 			method: "GET",
 			path: "/status",
 			scope: "process",
 			description: "Retention policies, subject scopes, field-encryption state, last sweep.",
-			handler: () => o.succeed(V({
+			handler: () => o.succeed(H({
 				retention: (a.retention ?? []).map((e) => ({
 					table: e.table,
 					ttlMs: e.ttlMs,
@@ -367,11 +372,11 @@ var A = (e) => {
 					table: e.table,
 					subjectField: e.subjectField
 				})),
-				fieldEncryption: N,
+				fieldEncryption: P,
 				sweepIntervalMs: a.sweepIntervalMs ?? 36e5,
-				lastSweepAt: M,
-				lastSweep: j,
-				erasureCount: E.length
+				lastSweepAt: N,
+				lastSweep: M,
+				erasureCount: D.length
 			}))
 		},
 		{
@@ -379,7 +384,7 @@ var A = (e) => {
 			path: "/erasures",
 			scope: "process",
 			description: "GDPR erasure log (most recent first).",
-			handler: () => o.succeed(V({ erasures: E.slice(0, 100) }))
+			handler: () => o.succeed(H({ erasures: D.slice(0, 100) }))
 		},
 		{
 			method: "GET",
@@ -388,7 +393,7 @@ var A = (e) => {
 			description: "The routes a DSAR export/erasure walks — AND what the derivation cannot see.",
 			handler: () => o.sync(() => {
 				let e = x();
-				return V({
+				return H({
 					subjectTable: e.subjectTable,
 					derived: b !== void 0,
 					paths: e.paths.map((t) => ({
@@ -407,8 +412,8 @@ var A = (e) => {
 			scope: p ? "shared-store" : "process",
 			description: "Consent ledger for a subject (?subjectId=…).",
 			handler: (e) => {
-				let t = W(e.url, "subjectId");
-				return t ? o.promise(async () => V({ records: await v.list(t) })) : o.succeed(H(400, "subjectId query param required"));
+				let t = K(e.url, "subjectId");
+				return t ? o.promise(async () => H({ records: await v.list(t) })) : o.succeed(W(400, "subjectId query param required"));
 			}
 		},
 		{
@@ -420,13 +425,13 @@ var A = (e) => {
 				try {
 					t = JSON.parse(e.body || "{}");
 				} catch {
-					return H(400, "invalid JSON body");
+					return W(400, "invalid JSON body");
 				}
-				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return H(400, "subjectId must be a non-empty string");
+				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return W(400, "subjectId must be a non-empty string");
 				try {
-					return V({ bundle: await I.exportSubject(t.subjectId) });
+					return H({ bundle: await B.exportSubject(t.subjectId) });
 				} catch (e) {
-					return H(500, e.message);
+					return W(500, e.message);
 				}
 			})
 		},
@@ -439,15 +444,15 @@ var A = (e) => {
 				try {
 					t = JSON.parse(e.body || "{}");
 				} catch {
-					return H(400, "invalid JSON body");
+					return W(400, "invalid JSON body");
 				}
-				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return H(400, "subjectId must be a non-empty string");
+				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return W(400, "subjectId must be a non-empty string");
 				let n = "mode" in t ? t.mode : void 0;
-				if (n !== void 0 && n !== "delete" && n !== "anonymize") return H(400, "mode must be delete or anonymize");
+				if (n !== void 0 && n !== "delete" && n !== "anonymize") return W(400, "mode must be delete or anonymize");
 				try {
-					return V({ entry: await I.eraseSubject(t.subjectId, n ? { mode: n } : void 0) });
+					return H({ entry: await B.eraseSubject(t.subjectId, n ? { mode: n } : void 0) });
 				} catch (e) {
-					return H(500, e.message);
+					return W(500, e.message);
 				}
 			})
 		},
@@ -455,9 +460,9 @@ var A = (e) => {
 			method: "POST",
 			path: "/sweep",
 			description: "Run the retention sweep now.",
-			handler: () => o.promise(async () => (await I.runRetentionNow(), V({
-				lastSweepAt: M,
-				lastSweep: j
+			handler: () => o.promise(async () => (await B.runRetentionNow(), H({
+				lastSweepAt: N,
+				lastSweep: M
 			})))
 		}
 	];
@@ -470,25 +475,30 @@ var A = (e) => {
 			"inspect:read",
 			"inspect:write"
 		],
-		declaredEnv: T,
-		services: s.succeed(Q, I),
-		routes: B,
+		declaredEnv: E,
+		services: s.succeed(Q, B),
+		routes: V,
 		rpcClientDescriptors: r,
-		inspectEndpoints: K,
+		inspectEndpoints: q,
 		...p ? { extendSchema: { tables: J } } : {},
 		bindDataStore: (e, t) => {
-			if (D = A(e), p && (g = X(e)), a.retention && a.retention.length > 0) {
+			if (O = A(e), p && (g = X(e)), a.retention && a.retention.length > 0) {
 				let e = a.sweepIntervalMs ?? 36e5;
-				O = t?.scheduleCoordinated("governance.retention.sweep", e, () => I.runRetentionNow());
+				k = t?.scheduleCoordinated("governance.retention.sweep", e, () => B.runRetentionNow());
 			}
 		},
 		onActivate: (e) => o.gen(function* () {
-			k = (t, n) => e.logger.warn(t, n);
+			j = (t, n) => e.logger.warn(t, n);
 			let t = !1;
 			if (a.fieldEncryption) {
 				let e = w, n = yield* o.promise(() => h(e));
 				if (!n) return yield* o.die(/* @__PURE__ */ Error(`governance: fieldEncryption is enabled but secret "${e}" did not resolve — set it via the Secrets-Resolver / env`));
-				_(ee(n)), t = !0, N = !0;
+				let r = [];
+				for (let e of T) {
+					let t = yield* o.promise(() => h(e));
+					t !== void 0 && t.trim() !== "" && r.push(t);
+				}
+				_(ee(n, r)), t = !0, P = !0;
 			}
 			!p && !a.consent && e.logger.warn("governance: consent ledger uses the in-memory store — per-process + restart-cleared. Under >1 replica a consent recorded on one replica is invisible to others. Pass consent: 'datastore' (durable, cross-instance) in production.");
 			let n = x();
@@ -505,7 +515,7 @@ var A = (e) => {
 			});
 		}),
 		onDeactivate: () => o.sync(() => {
-			O?.stop(), O = void 0, a.fieldEncryption && _(void 0);
+			k?.stop(), k = void 0, a.fieldEncryption && _(void 0);
 		})
 	});
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-governance",
-  "version": "0.81.0",
+  "version": "0.82.0",
   "description": "Data governance — retention policies (TTL sweep), GDPR subject export + erasure (right-to-be-forgotten), and consent recording. Builds on audit + soft-delete.",
   "keywords": [
     "voltro",
@@ -38,9 +38,9 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.81.0",
-    "@voltro/protocol": "0.81.0",
-    "@voltro/runtime": "0.81.0"
+    "@voltro/database": "0.82.0",
+    "@voltro/protocol": "0.82.0",
+    "@voltro/runtime": "0.82.0"
   },
   "peerDependencies": {
     "effect": "^3.22.2"