@voltro/plugin-governance 0.83.1 → 0.85.0

package/dist/index.js

@@ -2,9 +2,9 @@ import { consentDescriptor as e, eraseDescriptor as t, exportDescriptor as n, go
 import { Context as a, Effect as o, Layer as s } from "effect";
 import { ADMIN_SCOPE as c, definePlugin as l, pluginInstanceName as u, requireScope as d } from "@voltro/protocol";
 import { deriveKey as f, makeAesCipher as p, makeFieldCipher as m, makeFieldCipher as ee, resolveSecret as h, setFieldCipher as g, setFieldCipher as _ } from "@voltro/runtime";
-import { DEFAULT_SUBJECT_GRAPH_DEPTH as v, ENCRYPTED_PREFIX as y, and as b, boolean as x, deriveSubjectGraph as S, deriveSubjectGraph as C, eq as w, formatSubjectGraph as T, id as E, isEncrypted as D, table as O, text as k } from "@voltro/database";
+import { DEFAULT_SUBJECT_GRAPH_DEPTH as v, ENCRYPTED_PREFIX as y, and as b, boolean as x, deriveSubjectGraph as S, deriveSubjectGraph as te, eq as C, formatSubjectGraph as w, getTable as T, gt as E, id as D, inSet as O, isEncrypted as k, lt as A, table as j, text as M } from "@voltro/database";
 //#region src/store.ts
-var A = (e) => {
+var N = (e) => {
 	let t = e, n = (e, t) => ({
 		table: void 0,
 		predicate: void 0,
@@ -34,6 +34,25 @@ var A = (e) => {
 			...n(r, i),
 			table: e
 		}),
+		scan: (e, r) => {
+			if (r.column !== void 0 && r.values?.length === 0) return Promise.resolve([]);
+			let i = [];
+			if (r.after !== void 0 && i.push(E("id", r.after)), r.column !== void 0) {
+				if (r.values === void 0) throw Error("governance scan needs values for its subject column");
+				i.push(O(r.column, r.values));
+			}
+			return r.expired && T(e)?.fields[r.expired.column]?.type === "timestamp" && i.push(A(r.expired.column, r.expired.before)), t.query({
+				...n(r.limit, void 0),
+				table: e,
+				predicate: i.length ? b(...i) : void 0,
+				projection: r.projection
+			});
+		},
+		...t.deleteMany && t.updateMany ? { writeMany: async (e, n, r) => {
+			if (n.length === 0) return 0;
+			let i = O("id", n);
+			return r === void 0 ? t.deleteMany(e, { where: i }) : t.updateMany(e, r, { where: i });
+		} } : {},
 		delete: async (e, n) => {
 			await (t.hardDelete ?? t.delete).call(t, e, n);
 		},
@@ -41,7 +60,7 @@ var A = (e) => {
 			await t.update(e, n, r);
 		}
 	};
-}, j = (e = {}) => {
+}, P = (e = {}) => {
 	let t = new Map(Object.entries(e).map(([e, t]) => [e, t.map((e) => ({ ...e }))])), n = (e) => {
 		let n = t.get(e);
 		return n || (n = [], t.set(e, n)), n;
@@ -54,6 +73,21 @@ var A = (e) => {
 			return n(e).filter((e) => i.has(String(e[t]))).map((e) => ({ ...e }));
 		},
 		page: async (e, t, r) => n(e).slice(r, r + t).map((e) => ({ ...e })),
+		scan: async (e, t) => {
+			let r = t.values === void 0 ? void 0 : new Set(t.values.map(String));
+			return n(e).filter((e) => (t.after === void 0 || String(e.id) > String(t.after)) && (t.column === void 0 || r?.has(String(e[t.column])))).sort((e, t) => String(e.id) < String(t.id) ? -1 : +(String(e.id) > String(t.id))).slice(0, t.limit).map((e) => t.projection ? Object.fromEntries(t.projection.map((t) => [t, e[t]])) : { ...e });
+		},
+		writeMany: async (e, r, i) => {
+			let a = new Set(r), o = n(e), s = 0;
+			if (i === void 0) {
+				let n = o.filter((e) => !a.has(String(e.id)) || (s++, !1));
+				t.set(e, n);
+			} else for (let e = 0; e < o.length; e++) a.has(String(o[e].id)) && (o[e] = {
+				...o[e],
+				...i
+			}, s++);
+			return s;
+		},
 		delete: async (e, t) => {
 			let r = n(e), i = r.findIndex((e) => String(e.id) === t);
 			i !== -1 && r.splice(i, 1);
@@ -67,11 +101,29 @@ var A = (e) => {
 		},
 		dump: () => Object.fromEntries([...t.entries()].map(([e, t]) => [e, t.map((e) => ({ ...e }))]))
 	};
-}, M = 500, N = 5e4, P = (e, t) => {
+}, F = async (e, t, n, r) => {
+	let i = 0;
+	if (e.writeMany) {
+		for (let a = 0; a < n.length; a += 500) i += await e.writeMany(t, n.slice(a, a + 500), r);
+		return i;
+	}
+	let a = 0, o = !1, s = await Promise.allSettled(Array.from({ length: Math.min(8, n.length) }, async () => {
+		for (; !o && a < n.length;) {
+			let s = n[a++];
+			try {
+				r === void 0 ? await e.delete(t, s) : await e.update(t, s, r), i++;
+			} catch (e) {
+				throw o = !0, e;
+			}
+		}
+	}));
+	for (let e of s) if (e.status === "rejected") throw e.reason;
+	return i;
+}, I = 500, L = 5e4, R = (e, t) => {
 	let n = [];
 	for (let r = 0; r < e.length; r += t) n.push(e.slice(r, r + t));
 	return n;
-}, F = (e, t) => e.table === t && e.subjectField === "id" ? {
+}, z = (e, t) => e.table === t && e.subjectField === "id" ? {
 	table: e.table,
 	hops: [],
 	depth: 0,
@@ -85,77 +137,96 @@ var A = (e) => {
 	}],
 	depth: 1,
 	via: "declared"
-}, I = async (e, t, n, r = N) => {
-	let i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Map(), o = async (t, n, r) => {
-		if (r.length === 0) return [];
-		let i = `${t}\u0000${n}\u0000${r.join(",")}`, o = a.get(i);
-		if (o !== void 0) return o;
-		let s = [];
-		for (let i of P(r, 500)) s.push(...await e.where(t, n, i));
-		return a.set(i, s), s;
-	}, s = (e, t) => {
-		let n = i.get(e);
-		n === void 0 && (n = {
+}, B = async (e, t, n, r = L) => {
+	let i = /* @__PURE__ */ new Map();
+	if (!Number.isSafeInteger(r) || r < 1) throw Error("subject rowCap must be a positive safe integer");
+	let a = /* @__PURE__ */ new Map();
+	for (let e of t) {
+		let t = e.hops.length ? e.hops : [{
+			table: e.table,
+			foreignKey: "id",
+			parentKey: "id"
+		}], n = a;
+		for (let e of t) {
+			let t = JSON.stringify([
+				e.table,
+				e.foreignKey,
+				e.parentKey
+			]), r = n.get(t);
+			r || (r = {
+				hop: e,
+				children: /* @__PURE__ */ new Map()
+			}, n.set(t, r)), n = r.children;
+		}
+	}
+	let o = (e) => {
+		let t = i.get(e);
+		return t || (t = {
 			rows: /* @__PURE__ */ new Map(),
 			truncated: !1
-		}, i.set(e, n));
+		}, i.set(e, t)), t;
+	}, s = (e, t) => {
+		let n = o(e);
 		for (let e of t) {
-			if (n.rows.size >= r) {
-				n.truncated = !0;
-				break;
+			let t = String(e.id ?? JSON.stringify(e));
+			if (!n.rows.has(t)) {
+				if (n.rows.size >= r) {
+					n.truncated = !0;
+					continue;
+				}
+				n.rows.set(t, e);
 			}
-			n.rows.set(String(e.id ?? JSON.stringify(e)), e);
 		}
-	};
-	for (let e of t) {
-		if (e.hops.length === 0) {
-			s(e.table, await o(e.table, "id", [n]));
-			continue;
-		}
-		let t = [n];
-		for (let n of e.hops) {
-			let e = await o(n.table, n.foreignKey, t);
-			if (e.length === 0) {
-				t = [];
-				break;
+	}, c = async (t, n) => {
+		let { hop: i, children: a } = t, l = o(i.table);
+		for (let t of R(n, 500)) {
+			let n;
+			for (;;) {
+				if (a.size === 0 && l.truncated) return;
+				let o = a.size ? 500 : Math.min(500, r - l.rows.size + 1), u = e.scan ? await e.scan(i.table, {
+					column: i.foreignKey,
+					values: t,
+					limit: o,
+					...n === void 0 ? {} : { after: n }
+				}) : await e.where(i.table, i.foreignKey, t);
+				if (s(i.table, u), u.length === 0) break;
+				let d = [...new Set(u.map((e) => String(e[i.parentKey] ?? e.id)))];
+				for (let e of a.values()) await c(e, d);
+				if (!e.scan || u.length < o) break;
+				let f = u[u.length - 1].id;
+				if (f === void 0 || f === n) throw Error("governance scan must advance a stable id cursor");
+				n = f;
 			}
-			s(n.table, e), t = [...new Set(e.map((e) => String(e[n.parentKey] ?? e.id)))];
 		}
-	}
+	};
+	for (let e of a.values()) await c(e, [n]);
 	return [...i.entries()].map(([e, t]) => ({
 		table: e,
 		rows: [...t.rows.values()],
 		...t.truncated ? { truncated: !0 } : {}
 	}));
-}, L = async (e, t, n) => {
-	let r = await I(e, t, n), i = {};
+}, V = async (e, t, n) => {
+	let r = await B(e, t, n), i = {};
 	for (let e of r) e.rows.length > 0 && (i[e.table] = e.rows);
 	return i;
-}, R = (e, t) => {
+}, H = (e, t) => {
 	if (t === void 0 || t.length === 0) throw Error(`${e}: mode 'anonymize' needs a non-empty 'anonymizeFields' — with none, nothing is written and the result would report rows as affected that were not changed`);
-}, z = async (e, t, n, r = {}, i = () => (/* @__PURE__ */ new Date()).toISOString()) => {
+}, U = async (e, t, n, r = {}, i = () => (/* @__PURE__ */ new Date()).toISOString()) => {
 	let a = r.mode ?? "delete";
-	a === "anonymize" && R("governance erasure", r.anonymizeFields);
-	let o = await I(e, t, n), s = /* @__PURE__ */ new Map();
+	a === "anonymize" && H("governance erasure", r.anonymizeFields);
+	let o = await B(e, t, n), s = /* @__PURE__ */ new Map();
 	for (let e of t) {
 		let t = s.get(e.table);
 		(t === void 0 || e.depth > t) && s.set(e.table, e.depth);
 	}
 	let c = [...o].sort((e, t) => (s.get(t.table) ?? 0) - (s.get(e.table) ?? 0)), l = [], u = [];
-	for (let t of c) if (t.rows.length !== 0) {
+	for (let t of c) {
+		if (t.rows.length === 0) continue;
 		t.truncated === !0 && u.push(t.table);
-		for (let n of t.rows) {
-			let i = String(n.id);
-			if (a === "delete") await e.delete(t.table, i);
-			else {
-				let n = {};
-				for (let e of r.anonymizeFields ?? []) n[e] = null;
-				await e.update(t.table, i, n);
-			}
-		}
+		let n = a === "delete" ? void 0 : Object.fromEntries((r.anonymizeFields ?? []).map((e) => [e, null])), i = await F(e, t.table, t.rows.map((e) => String(e.id)), n);
 		l.push({
 			table: t.table,
-			count: t.rows.length
+			count: i
 		});
 	}
 	return {
@@ -165,35 +236,44 @@ var A = (e) => {
 		affected: l,
 		...u.length > 0 ? { truncated: u } : {}
 	};
-}, B = (e, t, n) => {
+}, W = (e, t, n) => {
 	let r = e[t], i = r instanceof Date ? r.getTime() : typeof r == "string" || typeof r == "number" ? new Date(r).getTime() : NaN;
 	return Number.isNaN(i) ? null : n - i;
-}, V = (e, t, n) => {
+}, G = (e, t, n) => {
 	let r = t.dateField ?? "createdAt";
 	return e.filter((e) => {
-		let i = B(e, r, n);
+		let i = W(e, r, n);
 		return i !== null && i > t.ttlMs;
 	}).map((e) => String(e.id));
-}, H = 1e3, U = async (e, t, n = Date.now(), r = H) => {
+}, ne = 1e3, K = async (e, t, n = Date.now(), r = ne) => {
+	if (!Number.isSafeInteger(r) || r < 1) throw Error("retention batchSize must be a positive safe integer");
 	let i = [];
 	for (let a of t) {
 		let t = a.action ?? "delete";
-		t === "anonymize" && R(`retention policy '${a.table}'`, a.anonymizeFields);
-		let o = 0, s = 0, c = !1;
-		for (; !c;) {
-			let i = await e.page(a.table, r, s), l = V(i, a, n);
-			if (t === "delete") {
-				for (let t of l) await e.delete(a.table, t);
-				s += i.length - l.length;
-			} else {
-				for (let t of l) {
-					let n = {};
-					for (let e of a.anonymizeFields ?? []) n[e] = null;
-					await e.update(a.table, t, n);
-				}
-				s += i.length;
+		t === "anonymize" && H(`retention policy '${a.table}'`, a.anonymizeFields);
+		let o = 0, s = 0, c, l = !1;
+		for (; !l;) {
+			let i = a.dateField ?? "createdAt", u = new Date(Math.ceil(n - a.ttlMs)), d = e.scan ? await e.scan(a.table, {
+				limit: r,
+				...c === void 0 ? {} : { after: c },
+				projection: ["id", i],
+				...Number.isNaN(u.getTime()) ? {} : { expired: {
+					column: i,
+					before: u
+				} }
+			}) : await e.page(a.table, r, s), f = G(d, a, n);
+			if (t === "delete") o += await F(e, a.table, f), s += d.length - f.length;
+			else {
+				let t = {};
+				for (let e of a.anonymizeFields ?? []) t[e] = null;
+				o += await F(e, a.table, f, t), s += d.length;
+			}
+			if (d.length && e.scan) {
+				let e = d[d.length - 1].id;
+				if (e === void 0 || e === c) throw Error("retention scan must advance a stable id cursor");
+				c = e;
 			}
-			o += l.length, c = i.length < r;
+			l = d.length < r;
 		}
 		i.push({
 			table: a.table,
@@ -202,7 +282,7 @@ var A = (e) => {
 		});
 	}
 	return i;
-}, W = 1e4, G = (e = W) => {
+}, re = 1e4, q = (e = re) => {
 	let t = /* @__PURE__ */ new Map(), n = [], r = (e, t) => `${e}|${t}`;
 	return {
 		record: async (i) => {
@@ -211,22 +291,22 @@ var A = (e) => {
 		has: async (e, n) => t.get(r(e, n))?.granted ?? !1,
 		list: async (e) => n.filter((t) => t.subjectId === e)
 	};
-}, K = "_voltro_consent", q = O(K, {
-	id: E({ prefix: "consent" }),
-	subjectId: k(),
-	purpose: k(),
+}, J = "_voltro_consent", Y = j(J, {
+	id: D({ prefix: "consent" }),
+	subjectId: M(),
+	purpose: M(),
 	granted: x(),
-	at: k(),
-	tenantId: k().nullable()
-}).index("byConsentSubjectPurpose", ["subjectId", "purpose"]).index("byConsentSubject", ["subjectId"]), J = [q], Y = (e) => ({
+	at: M(),
+	tenantId: M().nullable()
+}).index("byConsentSubjectPurpose", ["subjectId", "purpose"]).index("byConsentSubject", ["subjectId"]), X = [Y], Z = (e) => ({
 	subjectId: String(e.subjectId),
 	purpose: String(e.purpose),
 	granted: e.granted === !0 || e.granted === 1 || e.granted === "true",
 	at: String(e.at),
 	tenantId: e.tenantId ?? null
-}), X = (e) => {
+}), Q = (e) => {
 	let t = (t, n) => e.query({
-		table: K,
+		table: J,
 		predicate: t,
 		order: [{
 			column: "at",
@@ -238,7 +318,7 @@ var A = (e) => {
 	});
 	return {
 		record: async (t) => {
-			await e.insert(K, {
+			await e.insert(J, {
 				subjectId: t.subjectId,
 				purpose: t.purpose,
 				granted: t.granted,
@@ -247,28 +327,28 @@ var A = (e) => {
 			});
 		},
 		has: async (e, n) => {
-			let r = await t(b(w("subjectId", e), w("purpose", n)), 1);
-			return r[0] ? Y(r[0]).granted : !1;
+			let r = await t(b(C("subjectId", e), C("purpose", n)), 1);
+			return r[0] ? Z(r[0]).granted : !1;
 		},
-		list: async (e) => (await t(w("subjectId", e))).map(Y)
+		list: async (e) => (await t(C("subjectId", e))).map(Z)
 	};
-}, Z = 1e3, Q = class extends a.Tag("@voltro/plugin-governance/GovernanceService")() {}, $ = "@voltro/plugin-governance", te = (a = {}) => {
+}, $ = 1e3, ie = class extends a.Service()("@voltro/plugin-governance/GovernanceService") {}, ae = "@voltro/plugin-governance", oe = (a = {}) => {
 	let f = u({
-		base: $,
+		base: ae,
 		alias: a.alias,
 		instance: a.name
-	}), p = a.consent === "datastore", m = a.consent && a.consent !== "datastore" ? a.consent : p ? void 0 : G(), g, v = {
-		record: (e) => (m ?? g ?? G()).record(e),
-		has: (e, t) => (m ?? g ?? G()).has(e, t),
-		list: (e) => (m ?? g ?? G()).list(e)
+	}), p = a.consent === "datastore", m = a.consent && a.consent !== "datastore" ? a.consent : p ? void 0 : q(), g, v = {
+		record: (e) => (m ?? g ?? q()).record(e),
+		has: (e, t) => (m ?? g ?? q()).has(e, t),
+		list: (e) => (m ?? g ?? q()).list(e)
 	}, y = a.subjectScopes ?? [], b = a.deriveSubjectScopes, x = () => {
-		let e = b?.subjectTable ?? "actors", t = y.map((t) => F(t, e));
+		let e = b?.subjectTable ?? "actors", t = y.map((t) => z(t, e));
 		if (b === void 0) return {
 			subjectTable: e,
 			paths: t,
 			limitations: []
 		};
-		let n = C({
+		let n = te({
 			subjectTable: e,
 			...b.maxDepth === void 0 ? {} : { maxDepth: b.maxDepth },
 			...b.exclude === void 0 ? {} : { exclude: b.exclude }
@@ -278,44 +358,44 @@ var A = (e) => {
 			paths: [...n.paths, ...i]
 		};
 	}, S = () => x().paths;
-	for (let e of a.retention ?? []) (e.action ?? "delete") === "anonymize" && R(`retention policy '${e.table}'`, e.anonymizeFields);
-	a.erasure?.mode === "anonymize" && R("erasure defaults", a.erasure.anonymizeFields);
-	let w = typeof a.fieldEncryption == "object" ? a.fieldEncryption.secretKey ?? "VOLTRO_FIELD_ENCRYPTION_KEY" : "VOLTRO_FIELD_ENCRYPTION_KEY", T = typeof a.fieldEncryption == "object" ? a.fieldEncryption.previousSecretKeys ?? ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"] : ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"], E = a.fieldEncryption ? [{
-		name: w,
+	for (let e of a.retention ?? []) (e.action ?? "delete") === "anonymize" && H(`retention policy '${e.table}'`, e.anonymizeFields);
+	a.erasure?.mode === "anonymize" && H("erasure defaults", a.erasure.anonymizeFields);
+	let C = typeof a.fieldEncryption == "object" ? a.fieldEncryption.secretKey ?? "VOLTRO_FIELD_ENCRYPTION_KEY" : "VOLTRO_FIELD_ENCRYPTION_KEY", w = typeof a.fieldEncryption == "object" ? a.fieldEncryption.previousSecretKeys ?? ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"] : ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"], T = a.fieldEncryption ? [{
+		name: C,
 		required: !1,
 		secret: !0,
 		description: "AES-256-GCM key for `.encrypted()` columns (field encryption). Lose the key, lose the data — GCM fails closed."
-	}, ...T.map((e) => ({
+	}, ...w.map((e) => ({
 		name: e,
 		required: !1,
 		secret: !0,
 		description: "A retired field-encryption key, read during a rotation so values written under it stay readable. Remove once they are re-encrypted."
-	}))] : [], D = [], O, k, j = () => void 0, M = [], N = null, P = !1, I = () => {
-		if (!O) throw Error("governance: data store not bound yet");
-		return O;
-	}, B = {
+	}))] : [], E = [], D, O, k = () => void 0, A = [], j = null, M = !1, P = () => {
+		if (!D) throw Error("governance: data store not bound yet");
+		return D;
+	}, F = {
 		subjectGraph: x,
-		exportSubject: (e) => L(I(), S(), e),
+		exportSubject: (e) => V(P(), S(), e),
 		eraseSubject: async (e, t) => {
 			let n = {
 				...a.erasure,
 				...t
-			}, r = await z(I(), S(), e, n);
-			return D.unshift(r), D.length > 1e3 && (D.length = Z), r;
+			}, r = await U(P(), S(), e, n);
+			return E.unshift(r), E.length > 1e3 && (E.length = $), r;
 		},
 		recordConsent: (e) => v.record(e),
 		hasConsent: (e, t) => v.has(e, t),
 		runRetentionNow: async () => {
-			if (!O || !a.retention) return;
-			let e = await U(O, a.retention);
-			M = e, N = (/* @__PURE__ */ new Date()).toISOString(), j("retention sweep", { report: e });
+			if (!D || !a.retention) return;
+			let e = await K(D, a.retention);
+			A = e, j = (/* @__PURE__ */ new Date()).toISOString(), k("retention sweep", { report: e });
 		}
-	}, V = [
+	}, I = [
 		{
 			...n,
 			description: "GDPR data export for a subject (admin only).",
 			execute: (e, t) => o.gen(function* () {
-				return yield* d(t.request.subject, c), yield* o.promise(() => B.exportSubject(e.subjectId));
+				return yield* d(t.request.subject, c), yield* o.promise(() => F.exportSubject(e.subjectId));
 			})
 		},
 		{
@@ -324,7 +404,7 @@ var A = (e) => {
 			execute: (e, t) => o.gen(function* () {
 				yield* d(t.request.subject, c);
 				let { subjectId: n, mode: r } = e;
-				return yield* o.promise(() => B.eraseSubject(n, r ? { mode: r } : void 0));
+				return yield* o.promise(() => F.eraseSubject(n, r ? { mode: r } : void 0));
 			})
 		},
 		{
@@ -332,7 +412,7 @@ var A = (e) => {
 			description: "Record the calling subject's consent for a purpose.",
 			execute: (e, t) => o.promise(async () => {
 				let { purpose: n, granted: r } = e, i = t.request.subject;
-				return await B.recordConsent({
+				return await F.recordConsent({
 					subjectId: i.id ?? "anonymous",
 					purpose: n,
 					granted: r,
@@ -346,23 +426,23 @@ var A = (e) => {
 			description: "Whether the calling subject has granted consent for a purpose.",
 			execute: (e, t) => o.promise(async () => {
 				let n = t.request.subject;
-				return { granted: await B.hasConsent(n.id ?? "anonymous", e.purpose) };
+				return { granted: await F.hasConsent(n.id ?? "anonymous", e.purpose) };
 			})
 		}
-	], H = (e) => ({
+	], L = (e) => ({
 		kind: "json",
 		data: e
-	}), W = (e, t) => ({
+	}), R = (e, t) => ({
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), K = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t), q = [
+	}), B = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t), W = [
 		{
 			method: "GET",
 			path: "/status",
 			scope: "process",
 			description: "Retention policies, subject scopes, field-encryption state, last sweep.",
-			handler: () => o.succeed(H({
+			handler: () => o.succeed(L({
 				retention: (a.retention ?? []).map((e) => ({
 					table: e.table,
 					ttlMs: e.ttlMs,
@@ -372,11 +452,11 @@ var A = (e) => {
 					table: e.table,
 					subjectField: e.subjectField
 				})),
-				fieldEncryption: P,
+				fieldEncryption: M,
 				sweepIntervalMs: a.sweepIntervalMs ?? 36e5,
-				lastSweepAt: N,
-				lastSweep: M,
-				erasureCount: D.length
+				lastSweepAt: j,
+				lastSweep: A,
+				erasureCount: E.length
 			}))
 		},
 		{
@@ -384,7 +464,7 @@ var A = (e) => {
 			path: "/erasures",
 			scope: "process",
 			description: "GDPR erasure log (most recent first).",
-			handler: () => o.succeed(H({ erasures: D.slice(0, 100) }))
+			handler: () => o.succeed(L({ erasures: E.slice(0, 100) }))
 		},
 		{
 			method: "GET",
@@ -393,7 +473,7 @@ var A = (e) => {
 			description: "The routes a DSAR export/erasure walks — AND what the derivation cannot see.",
 			handler: () => o.sync(() => {
 				let e = x();
-				return H({
+				return L({
 					subjectTable: e.subjectTable,
 					derived: b !== void 0,
 					paths: e.paths.map((t) => ({
@@ -412,8 +492,8 @@ var A = (e) => {
 			scope: p ? "shared-store" : "process",
 			description: "Consent ledger for a subject (?subjectId=…).",
 			handler: (e) => {
-				let t = K(e.url, "subjectId");
-				return t ? o.promise(async () => H({ records: await v.list(t) })) : o.succeed(W(400, "subjectId query param required"));
+				let t = B(e.url, "subjectId");
+				return t ? o.promise(async () => L({ records: await v.list(t) })) : o.succeed(R(400, "subjectId query param required"));
 			}
 		},
 		{
@@ -425,13 +505,13 @@ var A = (e) => {
 				try {
 					t = JSON.parse(e.body || "{}");
 				} catch {
-					return W(400, "invalid JSON body");
+					return R(400, "invalid JSON body");
 				}
-				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return W(400, "subjectId must be a non-empty string");
+				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return R(400, "subjectId must be a non-empty string");
 				try {
-					return H({ bundle: await B.exportSubject(t.subjectId) });
+					return L({ bundle: await F.exportSubject(t.subjectId) });
 				} catch (e) {
-					return W(500, e.message);
+					return R(500, e.message);
 				}
 			})
 		},
@@ -444,15 +524,15 @@ var A = (e) => {
 				try {
 					t = JSON.parse(e.body || "{}");
 				} catch {
-					return W(400, "invalid JSON body");
+					return R(400, "invalid JSON body");
 				}
-				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return W(400, "subjectId must be a non-empty string");
+				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return R(400, "subjectId must be a non-empty string");
 				let n = "mode" in t ? t.mode : void 0;
-				if (n !== void 0 && n !== "delete" && n !== "anonymize") return W(400, "mode must be delete or anonymize");
+				if (n !== void 0 && n !== "delete" && n !== "anonymize") return R(400, "mode must be delete or anonymize");
 				try {
-					return H({ entry: await B.eraseSubject(t.subjectId, n ? { mode: n } : void 0) });
+					return L({ entry: await F.eraseSubject(t.subjectId, n ? { mode: n } : void 0) });
 				} catch (e) {
-					return W(500, e.message);
+					return R(500, e.message);
 				}
 			})
 		},
@@ -460,45 +540,45 @@ var A = (e) => {
 			method: "POST",
 			path: "/sweep",
 			description: "Run the retention sweep now.",
-			handler: () => o.promise(async () => (await B.runRetentionNow(), H({
-				lastSweepAt: N,
-				lastSweep: M
+			handler: () => o.promise(async () => (await F.runRetentionNow(), L({
+				lastSweepAt: j,
+				lastSweep: A
 			})))
 		}
 	];
 	return l({
 		name: f,
-		baseName: $,
+		baseName: ae,
 		description: "Data governance — retention TTL sweep, GDPR export/erasure, consent ledger.",
 		permissions: [
 			"store:write",
 			"inspect:read",
 			"inspect:write"
 		],
-		declaredEnv: E,
-		services: s.succeed(Q, B),
-		routes: V,
+		declaredEnv: T,
+		services: s.succeed(ie, F),
+		routes: I,
 		rpcClientDescriptors: r,
-		inspectEndpoints: q,
-		...p ? { extendSchema: { tables: J } } : {},
+		inspectEndpoints: W,
+		...p ? { extendSchema: { tables: X } } : {},
 		bindDataStore: (e, t) => {
-			if (O = A(e), p && (g = X(e)), a.retention && a.retention.length > 0) {
+			if (D = N(e), p && (g = Q(e)), a.retention && a.retention.length > 0) {
 				let e = a.sweepIntervalMs ?? 36e5;
-				k = t?.scheduleCoordinated("governance.retention.sweep", e, () => B.runRetentionNow());
+				O = t?.scheduleCoordinated("governance.retention.sweep", e, () => F.runRetentionNow());
 			}
 		},
 		onActivate: (e) => o.gen(function* () {
-			j = (t, n) => e.logger.warn(t, n);
+			k = (t, n) => e.logger.warn(t, n);
 			let t = !1;
 			if (a.fieldEncryption) {
-				let e = w, n = yield* o.promise(() => h(e));
+				let e = C, n = yield* o.promise(() => h(e));
 				if (!n) return yield* o.die(/* @__PURE__ */ Error(`governance: fieldEncryption is enabled but secret "${e}" did not resolve — set it via the Secrets-Resolver / env`));
 				let r = [];
-				for (let e of T) {
+				for (let e of w) {
 					let t = yield* o.promise(() => h(e));
 					t !== void 0 && t.trim() !== "" && r.push(t);
 				}
-				_(ee(n, r)), t = !0, P = !0;
+				_(ee(n, r)), t = !0, M = !0;
 			}
 			!p && !a.consent && e.logger.warn("governance: consent ledger uses the in-memory store — per-process + restart-cleared. Under >1 replica a consent recorded on one replica is invisible to others. Pass consent: 'datastore' (durable, cross-instance) in production.");
 			let n = x();
@@ -515,9 +595,9 @@ var A = (e) => {
 			});
 		}),
 		onDeactivate: () => o.sync(() => {
-			k?.stop(), k = void 0, a.fieldEncryption && _(void 0);
+			O?.stop(), O = void 0, a.fieldEncryption && _(void 0);
 		})
 	});
 };
 //#endregion
-export { K as CONSENT_TABLE, v as DEFAULT_SUBJECT_GRAPH_DEPTH, y as ENCRYPTED_PREFIX, Z as ERASURE_LOG_CAP, Q as GovernanceService, M as SUBJECT_KEY_CHUNK, N as SUBJECT_ROW_CAP, I as collectSubjectRows, q as consentTable, J as consentTables, X as dataStoreConsentStore, A as dataStoreGovStore, f as deriveKey, S as deriveSubjectGraph, z as eraseSubject, L as exportSubject, T as formatSubjectGraph, te as governancePlugin, D as isEncrypted, p as makeAesCipher, m as makeFieldCipher, G as memoryConsentStore, j as memoryGovStore, U as runRetention, F as scopeToPath, V as selectExpired, g as setFieldCipher };
+export { J as CONSENT_TABLE, v as DEFAULT_SUBJECT_GRAPH_DEPTH, y as ENCRYPTED_PREFIX, $ as ERASURE_LOG_CAP, ie as GovernanceService, I as SUBJECT_KEY_CHUNK, L as SUBJECT_ROW_CAP, B as collectSubjectRows, Y as consentTable, X as consentTables, Q as dataStoreConsentStore, N as dataStoreGovStore, f as deriveKey, S as deriveSubjectGraph, U as eraseSubject, V as exportSubject, w as formatSubjectGraph, oe as governancePlugin, k as isEncrypted, p as makeAesCipher, m as makeFieldCipher, q as memoryConsentStore, P as memoryGovStore, K as runRetention, z as scopeToPath, G as selectExpired, g as setFieldCipher };