@voltro/plugin-governance 0.85.0 → 0.87.0

package/dist/index.js

@@ -1,418 +1,94 @@
 import { consentDescriptor as e, eraseDescriptor as t, exportDescriptor as n, governanceRpcClientImports as r, hasConsentDescriptor as i } from "./rpc.js";
-import { Context as a, Effect as o, Layer as s } from "effect";
-import { ADMIN_SCOPE as c, definePlugin as l, pluginInstanceName as u, requireScope as d } from "@voltro/protocol";
-import { deriveKey as f, makeAesCipher as p, makeFieldCipher as m, makeFieldCipher as ee, resolveSecret as h, setFieldCipher as g, setFieldCipher as _ } from "@voltro/runtime";
-import { DEFAULT_SUBJECT_GRAPH_DEPTH as v, ENCRYPTED_PREFIX as y, and as b, boolean as x, deriveSubjectGraph as S, deriveSubjectGraph as te, eq as C, formatSubjectGraph as w, getTable as T, gt as E, id as D, inSet as O, isEncrypted as k, lt as A, table as j, text as M } from "@voltro/database";
-//#region src/store.ts
-var N = (e) => {
-	let t = e, n = (e, t) => ({
-		table: void 0,
-		predicate: void 0,
-		order: [{
-			column: "id",
-			direction: "asc"
-		}],
-		take: e,
-		skip: t,
-		projection: void 0
-	});
-	return {
-		all: (e) => t.query({
-			...n(void 0, void 0),
-			table: e
-		}),
-		where: async (e, r, i) => i.length === 0 ? [] : t.query({
-			...n(void 0, void 0),
-			table: e,
-			predicate: {
-				column: r,
-				op: "in",
-				value: [...i]
-			}
-		}),
-		page: (e, r, i) => t.query({
-			...n(r, i),
-			table: e
-		}),
-		scan: (e, r) => {
-			if (r.column !== void 0 && r.values?.length === 0) return Promise.resolve([]);
-			let i = [];
-			if (r.after !== void 0 && i.push(E("id", r.after)), r.column !== void 0) {
-				if (r.values === void 0) throw Error("governance scan needs values for its subject column");
-				i.push(O(r.column, r.values));
-			}
-			return r.expired && T(e)?.fields[r.expired.column]?.type === "timestamp" && i.push(A(r.expired.column, r.expired.before)), t.query({
-				...n(r.limit, void 0),
-				table: e,
-				predicate: i.length ? b(...i) : void 0,
-				projection: r.projection
-			});
-		},
-		...t.deleteMany && t.updateMany ? { writeMany: async (e, n, r) => {
-			if (n.length === 0) return 0;
-			let i = O("id", n);
-			return r === void 0 ? t.deleteMany(e, { where: i }) : t.updateMany(e, r, { where: i });
-		} } : {},
-		delete: async (e, n) => {
-			await (t.hardDelete ?? t.delete).call(t, e, n);
-		},
-		update: async (e, n, r) => {
-			await t.update(e, n, r);
-		}
-	};
-}, P = (e = {}) => {
-	let t = new Map(Object.entries(e).map(([e, t]) => [e, t.map((e) => ({ ...e }))])), n = (e) => {
-		let n = t.get(e);
-		return n || (n = [], t.set(e, n)), n;
-	};
-	return {
-		all: async (e) => [...n(e)],
-		where: async (e, t, r) => {
-			if (r.length === 0) return [];
-			let i = new Set(r.map((e) => String(e)));
-			return n(e).filter((e) => i.has(String(e[t]))).map((e) => ({ ...e }));
-		},
-		page: async (e, t, r) => n(e).slice(r, r + t).map((e) => ({ ...e })),
-		scan: async (e, t) => {
-			let r = t.values === void 0 ? void 0 : new Set(t.values.map(String));
-			return n(e).filter((e) => (t.after === void 0 || String(e.id) > String(t.after)) && (t.column === void 0 || r?.has(String(e[t.column])))).sort((e, t) => String(e.id) < String(t.id) ? -1 : +(String(e.id) > String(t.id))).slice(0, t.limit).map((e) => t.projection ? Object.fromEntries(t.projection.map((t) => [t, e[t]])) : { ...e });
-		},
-		writeMany: async (e, r, i) => {
-			let a = new Set(r), o = n(e), s = 0;
-			if (i === void 0) {
-				let n = o.filter((e) => !a.has(String(e.id)) || (s++, !1));
-				t.set(e, n);
-			} else for (let e = 0; e < o.length; e++) a.has(String(o[e].id)) && (o[e] = {
-				...o[e],
-				...i
-			}, s++);
-			return s;
-		},
-		delete: async (e, t) => {
-			let r = n(e), i = r.findIndex((e) => String(e.id) === t);
-			i !== -1 && r.splice(i, 1);
-		},
-		update: async (e, t, r) => {
-			let i = n(e), a = i.findIndex((e) => String(e.id) === t);
-			a !== -1 && (i[a] = {
-				...i[a],
-				...r
-			});
-		},
-		dump: () => Object.fromEntries([...t.entries()].map(([e, t]) => [e, t.map((e) => ({ ...e }))]))
-	};
-}, F = async (e, t, n, r) => {
-	let i = 0;
-	if (e.writeMany) {
-		for (let a = 0; a < n.length; a += 500) i += await e.writeMany(t, n.slice(a, a + 500), r);
-		return i;
-	}
-	let a = 0, o = !1, s = await Promise.allSettled(Array.from({ length: Math.min(8, n.length) }, async () => {
-		for (; !o && a < n.length;) {
-			let s = n[a++];
-			try {
-				r === void 0 ? await e.delete(t, s) : await e.update(t, s, r), i++;
-			} catch (e) {
-				throw o = !0, e;
-			}
-		}
-	}));
-	for (let e of s) if (e.status === "rejected") throw e.reason;
-	return i;
-}, I = 500, L = 5e4, R = (e, t) => {
-	let n = [];
-	for (let r = 0; r < e.length; r += t) n.push(e.slice(r, r + t));
-	return n;
-}, z = (e, t) => e.table === t && e.subjectField === "id" ? {
-	table: e.table,
-	hops: [],
-	depth: 0,
-	via: "declared"
-} : {
-	table: e.table,
-	hops: [{
-		table: e.table,
-		foreignKey: e.subjectField,
-		parentKey: "id"
-	}],
-	depth: 1,
-	via: "declared"
-}, B = async (e, t, n, r = L) => {
-	let i = /* @__PURE__ */ new Map();
-	if (!Number.isSafeInteger(r) || r < 1) throw Error("subject rowCap must be a positive safe integer");
-	let a = /* @__PURE__ */ new Map();
-	for (let e of t) {
-		let t = e.hops.length ? e.hops : [{
-			table: e.table,
-			foreignKey: "id",
-			parentKey: "id"
-		}], n = a;
-		for (let e of t) {
-			let t = JSON.stringify([
-				e.table,
-				e.foreignKey,
-				e.parentKey
-			]), r = n.get(t);
-			r || (r = {
-				hop: e,
-				children: /* @__PURE__ */ new Map()
-			}, n.set(t, r)), n = r.children;
-		}
-	}
-	let o = (e) => {
-		let t = i.get(e);
-		return t || (t = {
-			rows: /* @__PURE__ */ new Map(),
-			truncated: !1
-		}, i.set(e, t)), t;
-	}, s = (e, t) => {
-		let n = o(e);
-		for (let e of t) {
-			let t = String(e.id ?? JSON.stringify(e));
-			if (!n.rows.has(t)) {
-				if (n.rows.size >= r) {
-					n.truncated = !0;
-					continue;
-				}
-				n.rows.set(t, e);
-			}
-		}
-	}, c = async (t, n) => {
-		let { hop: i, children: a } = t, l = o(i.table);
-		for (let t of R(n, 500)) {
-			let n;
-			for (;;) {
-				if (a.size === 0 && l.truncated) return;
-				let o = a.size ? 500 : Math.min(500, r - l.rows.size + 1), u = e.scan ? await e.scan(i.table, {
-					column: i.foreignKey,
-					values: t,
-					limit: o,
-					...n === void 0 ? {} : { after: n }
-				}) : await e.where(i.table, i.foreignKey, t);
-				if (s(i.table, u), u.length === 0) break;
-				let d = [...new Set(u.map((e) => String(e[i.parentKey] ?? e.id)))];
-				for (let e of a.values()) await c(e, d);
-				if (!e.scan || u.length < o) break;
-				let f = u[u.length - 1].id;
-				if (f === void 0 || f === n) throw Error("governance scan must advance a stable id cursor");
-				n = f;
-			}
-		}
-	};
-	for (let e of a.values()) await c(e, [n]);
-	return [...i.entries()].map(([e, t]) => ({
-		table: e,
-		rows: [...t.rows.values()],
-		...t.truncated ? { truncated: !0 } : {}
-	}));
-}, V = async (e, t, n) => {
-	let r = await B(e, t, n), i = {};
-	for (let e of r) e.rows.length > 0 && (i[e.table] = e.rows);
-	return i;
-}, H = (e, t) => {
-	if (t === void 0 || t.length === 0) throw Error(`${e}: mode 'anonymize' needs a non-empty 'anonymizeFields' — with none, nothing is written and the result would report rows as affected that were not changed`);
-}, U = async (e, t, n, r = {}, i = () => (/* @__PURE__ */ new Date()).toISOString()) => {
-	let a = r.mode ?? "delete";
-	a === "anonymize" && H("governance erasure", r.anonymizeFields);
-	let o = await B(e, t, n), s = /* @__PURE__ */ new Map();
-	for (let e of t) {
-		let t = s.get(e.table);
-		(t === void 0 || e.depth > t) && s.set(e.table, e.depth);
-	}
-	let c = [...o].sort((e, t) => (s.get(t.table) ?? 0) - (s.get(e.table) ?? 0)), l = [], u = [];
-	for (let t of c) {
-		if (t.rows.length === 0) continue;
-		t.truncated === !0 && u.push(t.table);
-		let n = a === "delete" ? void 0 : Object.fromEntries((r.anonymizeFields ?? []).map((e) => [e, null])), i = await F(e, t.table, t.rows.map((e) => String(e.id)), n);
-		l.push({
-			table: t.table,
-			count: i
-		});
-	}
-	return {
-		subjectId: n,
-		at: i(),
-		mode: a,
-		affected: l,
-		...u.length > 0 ? { truncated: u } : {}
-	};
-}, W = (e, t, n) => {
-	let r = e[t], i = r instanceof Date ? r.getTime() : typeof r == "string" || typeof r == "number" ? new Date(r).getTime() : NaN;
-	return Number.isNaN(i) ? null : n - i;
-}, G = (e, t, n) => {
-	let r = t.dateField ?? "createdAt";
-	return e.filter((e) => {
-		let i = W(e, r, n);
-		return i !== null && i > t.ttlMs;
-	}).map((e) => String(e.id));
-}, ne = 1e3, K = async (e, t, n = Date.now(), r = ne) => {
-	if (!Number.isSafeInteger(r) || r < 1) throw Error("retention batchSize must be a positive safe integer");
-	let i = [];
-	for (let a of t) {
-		let t = a.action ?? "delete";
-		t === "anonymize" && H(`retention policy '${a.table}'`, a.anonymizeFields);
-		let o = 0, s = 0, c, l = !1;
-		for (; !l;) {
-			let i = a.dateField ?? "createdAt", u = new Date(Math.ceil(n - a.ttlMs)), d = e.scan ? await e.scan(a.table, {
-				limit: r,
-				...c === void 0 ? {} : { after: c },
-				projection: ["id", i],
-				...Number.isNaN(u.getTime()) ? {} : { expired: {
-					column: i,
-					before: u
-				} }
-			}) : await e.page(a.table, r, s), f = G(d, a, n);
-			if (t === "delete") o += await F(e, a.table, f), s += d.length - f.length;
-			else {
-				let t = {};
-				for (let e of a.anonymizeFields ?? []) t[e] = null;
-				o += await F(e, a.table, f, t), s += d.length;
-			}
-			if (d.length && e.scan) {
-				let e = d[d.length - 1].id;
-				if (e === void 0 || e === c) throw Error("retention scan must advance a stable id cursor");
-				c = e;
-			}
-			l = d.length < r;
-		}
-		i.push({
-			table: a.table,
-			action: t,
-			affected: o
-		});
-	}
-	return i;
-}, re = 1e4, q = (e = re) => {
-	let t = /* @__PURE__ */ new Map(), n = [], r = (e, t) => `${e}|${t}`;
-	return {
-		record: async (i) => {
-			t.set(r(i.subjectId, i.purpose), i), n.unshift(i), n.length > e && (n.length = e);
-		},
-		has: async (e, n) => t.get(r(e, n))?.granted ?? !1,
-		list: async (e) => n.filter((t) => t.subjectId === e)
-	};
-}, J = "_voltro_consent", Y = j(J, {
-	id: D({ prefix: "consent" }),
-	subjectId: M(),
-	purpose: M(),
-	granted: x(),
-	at: M(),
-	tenantId: M().nullable()
-}).index("byConsentSubjectPurpose", ["subjectId", "purpose"]).index("byConsentSubject", ["subjectId"]), X = [Y], Z = (e) => ({
-	subjectId: String(e.subjectId),
-	purpose: String(e.purpose),
-	granted: e.granted === !0 || e.granted === 1 || e.granted === "true",
-	at: String(e.at),
-	tenantId: e.tenantId ?? null
-}), Q = (e) => {
-	let t = (t, n) => e.query({
-		table: J,
-		predicate: t,
-		order: [{
-			column: "at",
-			direction: "desc"
-		}],
-		take: n,
-		skip: void 0,
-		projection: void 0
-	});
-	return {
-		record: async (t) => {
-			await e.insert(J, {
-				subjectId: t.subjectId,
-				purpose: t.purpose,
-				granted: t.granted,
-				at: t.at,
-				tenantId: t.tenantId ?? null
-			});
-		},
-		has: async (e, n) => {
-			let r = await t(b(C("subjectId", e), C("purpose", n)), 1);
-			return r[0] ? Z(r[0]).granted : !1;
-		},
-		list: async (e) => (await t(C("subjectId", e))).map(Z)
-	};
-}, $ = 1e3, ie = class extends a.Service()("@voltro/plugin-governance/GovernanceService") {}, ae = "@voltro/plugin-governance", oe = (a = {}) => {
-	let f = u({
-		base: ae,
-		alias: a.alias,
-		instance: a.name
-	}), p = a.consent === "datastore", m = a.consent && a.consent !== "datastore" ? a.consent : p ? void 0 : q(), g, v = {
-		record: (e) => (m ?? g ?? q()).record(e),
-		has: (e, t) => (m ?? g ?? q()).has(e, t),
-		list: (e) => (m ?? g ?? q()).list(e)
-	}, y = a.subjectScopes ?? [], b = a.deriveSubjectScopes, x = () => {
-		let e = b?.subjectTable ?? "actors", t = y.map((t) => z(t, e));
-		if (b === void 0) return {
+import { dataStoreGovStore as a, memoryGovStore as o } from "./store.js";
+import { SUBJECT_KEY_CHUNK as s, SUBJECT_ROW_CAP as c, assertAnonymizable as l, collectSubjectRows as u, eraseSubject as d, exportSubject as f, scopeToPath as p } from "./gdpr.js";
+import { runRetention as m, selectExpired as h } from "./retention.js";
+import { CONSENT_TABLE as g, consentTable as _, consentTables as v, dataStoreConsentStore as y, memoryConsentStore as b } from "./consent.js";
+import { Context as x, Effect as S, Layer as ee } from "effect";
+import { ADMIN_SCOPE as C, definePlugin as te, pluginInstanceName as ne, requireScope as w } from "@voltro/protocol";
+import { FIELD_ENCRYPTION_ACTIVE_ENV as T, FIELD_ENCRYPTION_KEYS_ENV as E, deriveKey as D, deriveKey as O, fieldDecryptSnapshot as re, fieldKeyIdOf as k, getFieldCipher as A, isFieldKeyring as j, makeAesCipher as M, makeFieldCipher as N, makeFieldCipher as ie, makeFieldKeyring as P, makeFieldKeyring as ae, readFieldKeyHolders as oe, readFieldKeyReports as se, readFieldKeys as ce, resolveFieldKeyring as F, resolveFieldKeyring as I, resolveSecret as L, setFieldCipher as R, setFieldCipher as z } from "@voltro/runtime";
+import { DEFAULT_SUBJECT_GRAPH_DEPTH as B, ENCRYPTED_PREFIX as V, deriveSubjectGraph as H, deriveSubjectGraph as le, formatSubjectGraph as U, isEncrypted as W } from "@voltro/database";
+//#region src/index.ts
+var G = 1e3, K = class extends x.Service()("@voltro/plugin-governance/GovernanceService") {}, q = "@voltro/plugin-governance", J = (o = {}) => {
+	let s = ne({
+		base: q,
+		alias: o.alias,
+		instance: o.name
+	}), c = o.consent === "datastore", u = o.consent && o.consent !== "datastore" ? o.consent : c ? void 0 : b(), h, g = {
+		record: (e) => (u ?? h ?? b()).record(e),
+		has: (e, t) => (u ?? h ?? b()).has(e, t),
+		list: (e) => (u ?? h ?? b()).list(e)
+	}, _ = o.subjectScopes ?? [], x = o.deriveSubjectScopes, D = () => {
+		let e = x?.subjectTable ?? "actors", t = _.map((t) => p(t, e));
+		if (x === void 0) return {
 			subjectTable: e,
 			paths: t,
 			limitations: []
 		};
-		let n = te({
+		let n = le({
 			subjectTable: e,
-			...b.maxDepth === void 0 ? {} : { maxDepth: b.maxDepth },
-			...b.exclude === void 0 ? {} : { exclude: b.exclude }
+			...x.maxDepth === void 0 ? {} : { maxDepth: x.maxDepth },
+			...x.exclude === void 0 ? {} : { exclude: x.exclude }
 		}), r = new Set(n.paths.map((e) => `${e.table}|${e.hops.map((e) => e.foreignKey).join(">")}`)), i = t.filter((e) => !r.has(`${e.table}|${e.hops.map((e) => e.foreignKey).join(">")}`));
 		return {
 			...n,
 			paths: [...n.paths, ...i]
 		};
-	}, S = () => x().paths;
-	for (let e of a.retention ?? []) (e.action ?? "delete") === "anonymize" && H(`retention policy '${e.table}'`, e.anonymizeFields);
-	a.erasure?.mode === "anonymize" && H("erasure defaults", a.erasure.anonymizeFields);
-	let C = typeof a.fieldEncryption == "object" ? a.fieldEncryption.secretKey ?? "VOLTRO_FIELD_ENCRYPTION_KEY" : "VOLTRO_FIELD_ENCRYPTION_KEY", w = typeof a.fieldEncryption == "object" ? a.fieldEncryption.previousSecretKeys ?? ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"] : ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"], T = a.fieldEncryption ? [{
-		name: C,
+	}, k = () => D().paths;
+	for (let e of o.retention ?? []) (e.action ?? "delete") === "anonymize" && l(`retention policy '${e.table}'`, e.anonymizeFields);
+	o.erasure?.mode === "anonymize" && l("erasure defaults", o.erasure.anonymizeFields);
+	let M = typeof o.fieldEncryption == "object" ? o.fieldEncryption.secretKey ?? "VOLTRO_FIELD_ENCRYPTION_KEY" : "VOLTRO_FIELD_ENCRYPTION_KEY", N = typeof o.fieldEncryption == "object" ? o.fieldEncryption.previousSecretKeys ?? ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"] : ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"], P = o.fieldEncryption ? [{
+		name: M,
 		required: !1,
 		secret: !0,
 		description: "AES-256-GCM key for `.encrypted()` columns (field encryption). Lose the key, lose the data — GCM fails closed."
-	}, ...w.map((e) => ({
+	}, ...N.map((e) => ({
 		name: e,
 		required: !1,
 		secret: !0,
 		description: "A retired field-encryption key, read during a rotation so values written under it stay readable. Remove once they are re-encrypted."
-	}))] : [], E = [], D, O, k = () => void 0, A = [], j = null, M = !1, P = () => {
-		if (!D) throw Error("governance: data store not bound yet");
-		return D;
-	}, F = {
-		subjectGraph: x,
-		exportSubject: (e) => V(P(), S(), e),
+	}))] : [], F = [], R, B, V, H = () => void 0, U = [], W = null, J = !1, Y = () => {
+		if (!R) throw Error("governance: data store not bound yet");
+		return R;
+	}, X = {
+		subjectGraph: D,
+		exportSubject: (e) => f(Y(), k(), e),
 		eraseSubject: async (e, t) => {
 			let n = {
-				...a.erasure,
+				...o.erasure,
 				...t
-			}, r = await U(P(), S(), e, n);
-			return E.unshift(r), E.length > 1e3 && (E.length = $), r;
+			}, r = await d(Y(), k(), e, n);
+			return F.unshift(r), F.length > 1e3 && (F.length = G), r;
 		},
-		recordConsent: (e) => v.record(e),
-		hasConsent: (e, t) => v.has(e, t),
+		recordConsent: (e) => g.record(e),
+		hasConsent: (e, t) => g.has(e, t),
 		runRetentionNow: async () => {
-			if (!D || !a.retention) return;
-			let e = await K(D, a.retention);
-			A = e, j = (/* @__PURE__ */ new Date()).toISOString(), k("retention sweep", { report: e });
+			if (!R || !o.retention) return;
+			let e = await m(R, o.retention);
+			U = e, W = (/* @__PURE__ */ new Date()).toISOString(), H("retention sweep", { report: e });
 		}
-	}, I = [
+	}, ue = [
 		{
 			...n,
 			description: "GDPR data export for a subject (admin only).",
-			execute: (e, t) => o.gen(function* () {
-				return yield* d(t.request.subject, c), yield* o.promise(() => F.exportSubject(e.subjectId));
+			execute: (e, t) => S.gen(function* () {
+				return yield* w(t.request.subject, C), yield* S.promise(() => X.exportSubject(e.subjectId));
 			})
 		},
 		{
 			...t,
 			description: "GDPR erasure (right-to-be-forgotten) for a subject (admin only).",
-			execute: (e, t) => o.gen(function* () {
-				yield* d(t.request.subject, c);
+			execute: (e, t) => S.gen(function* () {
+				yield* w(t.request.subject, C);
 				let { subjectId: n, mode: r } = e;
-				return yield* o.promise(() => F.eraseSubject(n, r ? { mode: r } : void 0));
+				return yield* S.promise(() => X.eraseSubject(n, r ? { mode: r } : void 0));
 			})
 		},
 		{
 			...e,
 			description: "Record the calling subject's consent for a purpose.",
-			execute: (e, t) => o.promise(async () => {
+			execute: (e, t) => S.promise(async () => {
 				let { purpose: n, granted: r } = e, i = t.request.subject;
-				return await F.recordConsent({
+				return await X.recordConsent({
 					subjectId: i.id ?? "anonymous",
 					purpose: n,
 					granted: r,
@@ -424,39 +100,98 @@ var N = (e) => {
 		{
 			...i,
 			description: "Whether the calling subject has granted consent for a purpose.",
-			execute: (e, t) => o.promise(async () => {
+			execute: (e, t) => S.promise(async () => {
 				let n = t.request.subject;
-				return { granted: await F.hasConsent(n.id ?? "anonymous", e.purpose) };
+				return { granted: await X.hasConsent(n.id ?? "anonymous", e.purpose) };
 			})
 		}
-	], L = (e) => ({
+	], Z = (e) => ({
 		kind: "json",
 		data: e
-	}), R = (e, t) => ({
+	}), Q = (e, t) => ({
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), B = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t), W = [
+	}), de = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t), $ = (e) => e === null ? null : e.toISOString(), fe = async () => {
+		let e = A();
+		if (!j(e)) return null;
+		let t = {
+			active: e.activeKeyId,
+			requested: e.requestedKeyId,
+			held: e.keyIds,
+			fingerprints: e.fingerprints,
+			decrypts: re()
+		};
+		if (B === void 0) return {
+			...t,
+			recorded: null,
+			error: "the data store is not bound yet"
+		};
+		try {
+			let [e, n, r] = await Promise.all([
+				ce(B),
+				oe(B),
+				se(B)
+			]), i = Date.now();
+			return {
+				...t,
+				recorded: {
+					keys: e.map((e) => ({
+						keyId: e.keyId,
+						state: e.state,
+						registeredAt: $(e.registeredAt),
+						activatedAt: $(e.activatedAt),
+						replacedAt: $(e.replacedAt),
+						retiredAt: $(e.retiredAt),
+						requestedAt: $(e.requestedAt)
+					})),
+					holders: n.map((e) => ({
+						holderId: e.holderId,
+						keyIds: e.keyIds,
+						activeKeyId: e.activeKeyId,
+						expiresAt: e.expiresAt.toISOString(),
+						live: e.expiresAt.getTime() > i
+					})),
+					lastCount: r.status === void 0 ? null : {
+						reportedAt: r.status.reportedAt.toISOString(),
+						...r.status.report
+					},
+					lastRekey: r.rekey === void 0 ? null : {
+						reportedAt: r.rekey.reportedAt.toISOString(),
+						...r.rekey.report
+					}
+				},
+				error: null
+			};
+		} catch (e) {
+			return {
+				...t,
+				recorded: null,
+				error: e instanceof Error ? e.message : String(e)
+			};
+		}
+	}, pe = [
 		{
 			method: "GET",
 			path: "/status",
 			scope: "process",
-			description: "Retention policies, subject scopes, field-encryption state, last sweep.",
-			handler: () => o.succeed(L({
-				retention: (a.retention ?? []).map((e) => ({
+			description: "Retention policies, subject scopes, field-encryption state and keys, last sweep.",
+			handler: () => S.promise(async () => Z({
+				retention: (o.retention ?? []).map((e) => ({
 					table: e.table,
 					ttlMs: e.ttlMs,
 					action: e.action ?? "delete"
 				})),
-				scopes: y.map((e) => ({
+				scopes: _.map((e) => ({
 					table: e.table,
 					subjectField: e.subjectField
 				})),
-				fieldEncryption: M,
-				sweepIntervalMs: a.sweepIntervalMs ?? 36e5,
-				lastSweepAt: j,
-				lastSweep: A,
-				erasureCount: E.length
+				fieldEncryption: J || A() !== void 0,
+				fieldKeys: await fe(),
+				sweepIntervalMs: o.sweepIntervalMs ?? 36e5,
+				lastSweepAt: W,
+				lastSweep: U,
+				erasureCount: F.length
 			}))
 		},
 		{
@@ -464,18 +199,18 @@ var N = (e) => {
 			path: "/erasures",
 			scope: "process",
 			description: "GDPR erasure log (most recent first).",
-			handler: () => o.succeed(L({ erasures: E.slice(0, 100) }))
+			handler: () => S.succeed(Z({ erasures: F.slice(0, 100) }))
 		},
 		{
 			method: "GET",
 			path: "/subject-graph",
 			scope: "declaration",
 			description: "The routes a DSAR export/erasure walks — AND what the derivation cannot see.",
-			handler: () => o.sync(() => {
-				let e = x();
-				return L({
+			handler: () => S.sync(() => {
+				let e = D();
+				return Z({
 					subjectTable: e.subjectTable,
-					derived: b !== void 0,
+					derived: x !== void 0,
 					paths: e.paths.map((t) => ({
 						table: t.table,
 						depth: t.depth,
@@ -489,29 +224,29 @@ var N = (e) => {
 		{
 			method: "GET",
 			path: "/consent",
-			scope: p ? "shared-store" : "process",
+			scope: c ? "shared-store" : "process",
 			description: "Consent ledger for a subject (?subjectId=…).",
 			handler: (e) => {
-				let t = B(e.url, "subjectId");
-				return t ? o.promise(async () => L({ records: await v.list(t) })) : o.succeed(R(400, "subjectId query param required"));
+				let t = de(e.url, "subjectId");
+				return t ? S.promise(async () => Z({ records: await g.list(t) })) : S.succeed(Q(400, "subjectId query param required"));
 			}
 		},
 		{
 			method: "POST",
 			path: "/export",
 			description: "Run a GDPR subject export.",
-			handler: (e) => o.promise(async () => {
+			handler: (e) => S.promise(async () => {
 				let t;
 				try {
 					t = JSON.parse(e.body || "{}");
 				} catch {
-					return R(400, "invalid JSON body");
+					return Q(400, "invalid JSON body");
 				}
-				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return R(400, "subjectId must be a non-empty string");
+				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return Q(400, "subjectId must be a non-empty string");
 				try {
-					return L({ bundle: await F.exportSubject(t.subjectId) });
+					return Z({ bundle: await X.exportSubject(t.subjectId) });
 				} catch (e) {
-					return R(500, e.message);
+					return Q(500, e.message);
 				}
 			})
 		},
@@ -519,20 +254,20 @@ var N = (e) => {
 			method: "POST",
 			path: "/erase",
 			description: "Run a GDPR erasure (right-to-be-forgotten).",
-			handler: (e) => o.promise(async () => {
+			handler: (e) => S.promise(async () => {
 				let t;
 				try {
 					t = JSON.parse(e.body || "{}");
 				} catch {
-					return R(400, "invalid JSON body");
+					return Q(400, "invalid JSON body");
 				}
-				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return R(400, "subjectId must be a non-empty string");
+				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return Q(400, "subjectId must be a non-empty string");
 				let n = "mode" in t ? t.mode : void 0;
-				if (n !== void 0 && n !== "delete" && n !== "anonymize") return R(400, "mode must be delete or anonymize");
+				if (n !== void 0 && n !== "delete" && n !== "anonymize") return Q(400, "mode must be delete or anonymize");
 				try {
-					return L({ entry: await F.eraseSubject(t.subjectId, n ? { mode: n } : void 0) });
+					return Z({ entry: await X.eraseSubject(t.subjectId, n ? { mode: n } : void 0) });
 				} catch (e) {
-					return R(500, e.message);
+					return Q(500, e.message);
 				}
 			})
 		},
@@ -540,64 +275,80 @@ var N = (e) => {
 			method: "POST",
 			path: "/sweep",
 			description: "Run the retention sweep now.",
-			handler: () => o.promise(async () => (await F.runRetentionNow(), L({
-				lastSweepAt: j,
-				lastSweep: A
+			handler: () => S.promise(async () => (await X.runRetentionNow(), Z({
+				lastSweepAt: W,
+				lastSweep: U
 			})))
 		}
 	];
-	return l({
-		name: f,
-		baseName: ae,
+	return te({
+		name: s,
+		baseName: q,
 		description: "Data governance — retention TTL sweep, GDPR export/erasure, consent ledger.",
 		permissions: [
 			"store:write",
 			"inspect:read",
 			"inspect:write"
 		],
-		declaredEnv: T,
-		services: s.succeed(ie, F),
-		routes: I,
+		declaredEnv: P,
+		services: ee.succeed(K, X),
+		routes: ue,
 		rpcClientDescriptors: r,
-		inspectEndpoints: W,
-		...p ? { extendSchema: { tables: X } } : {},
+		inspectEndpoints: pe,
+		...c ? { extendSchema: { tables: v } } : {},
 		bindDataStore: (e, t) => {
-			if (D = N(e), p && (g = Q(e)), a.retention && a.retention.length > 0) {
-				let e = a.sweepIntervalMs ?? 36e5;
-				O = t?.scheduleCoordinated("governance.retention.sweep", e, () => F.runRetentionNow());
+			if (R = a(e), B = e, c && (h = y(e)), o.retention && o.retention.length > 0) {
+				let e = o.sweepIntervalMs ?? 36e5;
+				V = t?.scheduleCoordinated("governance.retention.sweep", e, () => X.runRetentionNow());
 			}
 		},
-		onActivate: (e) => o.gen(function* () {
-			k = (t, n) => e.logger.warn(t, n);
+		onActivate: (e) => S.gen(function* () {
+			H = (t, n) => e.logger.warn(t, n);
 			let t = !1;
-			if (a.fieldEncryption) {
-				let e = C, n = yield* o.promise(() => h(e));
-				if (!n) return yield* o.die(/* @__PURE__ */ Error(`governance: fieldEncryption is enabled but secret "${e}" did not resolve — set it via the Secrets-Resolver / env`));
-				let r = [];
-				for (let e of w) {
-					let t = yield* o.promise(() => h(e));
-					t !== void 0 && t.trim() !== "" && r.push(t);
+			if (o.fieldEncryption) {
+				let e = M, n = yield* S.promise(() => L(e)), r = yield* S.promise(() => L(E)), i = [];
+				for (let e of N) {
+					let t = yield* S.promise(() => L(e));
+					t !== void 0 && t.trim() !== "" && i.push(t);
+				}
+				if (r !== void 0 && r.trim() !== "") {
+					let e = yield* S.promise(() => L(T)), t = yield* S.try({
+						try: () => {
+							let t = I({
+								[E]: r,
+								[T]: e,
+								VOLTRO_FIELD_ENCRYPTION_KEY: n
+							});
+							for (let e of i) if (!t.keys.some((t) => O(t.secret).equals(O(e)))) throw Error(`governance: a key named in fieldEncryption.previousSecretKeys is not one of ${E}`);
+							return t;
+						},
+						catch: (e) => e instanceof Error ? e : Error(String(e))
+					}).pipe(S.orDie);
+					z(ae(t));
+				} else {
+					if (!n) return yield* S.die(/* @__PURE__ */ Error(`governance: fieldEncryption is enabled but secret "${e}" did not resolve — set it via the Secrets-Resolver / env, or configure ${E}`));
+					z(ie(n, i));
 				}
-				_(ee(n, r)), t = !0, M = !0;
+				t = !0, J = !0;
 			}
-			!p && !a.consent && e.logger.warn("governance: consent ledger uses the in-memory store — per-process + restart-cleared. Under >1 replica a consent recorded on one replica is invisible to others. Pass consent: 'datastore' (durable, cross-instance) in production.");
-			let n = x();
-			if (b !== void 0) {
+			!c && !o.consent && e.logger.warn("governance: consent ledger uses the in-memory store — per-process + restart-cleared. Under >1 replica a consent recorded on one replica is invisible to others. Pass consent: 'datastore' (durable, cross-instance) in production.");
+			let n = D();
+			if (x !== void 0) {
 				let t = n.limitations.filter((e) => e.kind === "unreachable").length;
 				n.paths.length <= 1 && e.logger.warn(`governance: the derived subject scope reached ${n.paths.length} table(s) from '${n.subjectTable}'. A DSAR would export almost nothing. Check that subjectTable names a real table and that the app declares relations() or reference() columns pointing at it.`), t > 0 && e.logger.info(`governance: ${t} registered table(s) are NOT linked to '${n.subjectTable}' and are outside every DSAR. GET /_voltro/inspect/plugins/governance/subject-graph lists them; add subjectScopes for any that hold subject data.`);
 			}
 			e.logger.info("governance active", {
-				retention: a.retention?.length ?? 0,
+				retention: o.retention?.length ?? 0,
 				scopes: n.paths.length,
-				scopeSource: b === void 0 ? "declared" : "derived",
+				scopeSource: x === void 0 ? "declared" : "derived",
 				fieldEncryption: t,
-				consent: p ? "datastore" : a.consent ? "custom" : "memory"
+				consent: c ? "datastore" : o.consent ? "custom" : "memory"
 			});
 		}),
-		onDeactivate: () => o.sync(() => {
-			O?.stop(), O = void 0, a.fieldEncryption && _(void 0);
+		onDeactivate: () => S.sync(() => {
+			V?.stop(), V = void 0, o.fieldEncryption && z(void 0);
 		})
 	});
 };
 //#endregion
-export { J as CONSENT_TABLE, v as DEFAULT_SUBJECT_GRAPH_DEPTH, y as ENCRYPTED_PREFIX, $ as ERASURE_LOG_CAP, ie as GovernanceService, I as SUBJECT_KEY_CHUNK, L as SUBJECT_ROW_CAP, B as collectSubjectRows, Y as consentTable, X as consentTables, Q as dataStoreConsentStore, N as dataStoreGovStore, f as deriveKey, S as deriveSubjectGraph, U as eraseSubject, V as exportSubject, w as formatSubjectGraph, oe as governancePlugin, k as isEncrypted, p as makeAesCipher, m as makeFieldCipher, q as memoryConsentStore, P as memoryGovStore, K as runRetention, z as scopeToPath, G as selectExpired, g as setFieldCipher };
+export { g as CONSENT_TABLE, B as DEFAULT_SUBJECT_GRAPH_DEPTH, V as ENCRYPTED_PREFIX, G as ERASURE_LOG_CAP, K as GovernanceService, s as SUBJECT_KEY_CHUNK, c as SUBJECT_ROW_CAP, u as collectSubjectRows, _ as consentTable, v as consentTables, y as dataStoreConsentStore, a as dataStoreGovStore, D as deriveKey, H as deriveSubjectGraph, d as eraseSubject, f as exportSubject, k as fieldKeyIdOf, U as formatSubjectGraph, J as governancePlugin, W as isEncrypted, M as makeAesCipher, N as makeFieldCipher, P as makeFieldKeyring, b as memoryConsentStore, o as memoryGovStore, F as resolveFieldKeyring, m as runRetention, p as scopeToPath, h as selectExpired, R as setFieldCipher };