@voltro/plugin-governance 0.86.0 → 0.88.0

package/dist/consent.js

@@ -1,5 +1,5 @@
 import { and as e, boolean as t, eq as n, id as r, table as i, text as a } from "@voltro/database";
-//#region src/consent.ts
+// src/consent.ts
 var o = 1e4, s = (e = o) => {
 	let t = /* @__PURE__ */ new Map(), n = [], r = (e, t) => `${e}|${t}`;
 	return {
@@ -51,5 +51,4 @@ var o = 1e4, s = (e = o) => {
 		list: async (e) => (await r(n("subjectId", e))).map(d)
 	};
 };
-//#endregion
 export { o as CONSENT_HISTORY_CAP, c as CONSENT_TABLE, l as consentTable, u as consentTables, f as dataStoreConsentStore, s as memoryConsentStore };

package/dist/gdpr.js

@@ -1,5 +1,5 @@
 import { writeGovernanceRows as e } from "./store.js";
-//#region src/gdpr.ts
+// src/gdpr.ts
 var t = 500, n = 5e4, r = (e, t) => {
 	let n = [];
 	for (let r = 0; r < e.length; r += t) n.push(e.slice(r, r + t));
@@ -55,22 +55,22 @@ var t = 500, n = 5e4, r = (e, t) => {
 	}, u = async (t, n) => {
 		let { hop: i, children: o } = t, s = c(i.table);
 		for (let t of r(n, 500)) {
-			let n;
+			let n, r = !1;
 			for (;;) {
 				if (o.size === 0 && s.truncated) return;
-				let r = o.size ? 500 : Math.min(500, a - s.rows.size + 1), c = e.scan ? await e.scan(i.table, {
+				let c = o.size || r ? 500 : Math.min(500, a - s.rows.size + 1), d = e.scan ? await e.scan(i.table, {
 					column: i.foreignKey,
 					values: t,
-					limit: r,
+					limit: c,
 					...n === void 0 ? {} : { after: n }
-				}) : await e.where(i.table, i.foreignKey, t);
-				if (l(i.table, c), c.length === 0) break;
-				let d = [...new Set(c.map((e) => String(e[i.parentKey] ?? e.id)))];
-				for (let e of o.values()) await u(e, d);
-				if (!e.scan || c.length < r) break;
-				let f = c[c.length - 1].id;
-				if (f === void 0 || f === n) throw Error("governance scan must advance a stable id cursor");
-				n = f;
+				}) : await e.where(i.table, i.foreignKey, t), f = s.rows.size;
+				if (l(i.table, d), r = d.length > 0 && s.rows.size === f, d.length === 0) break;
+				let p = [...new Set(d.map((e) => String(e[i.parentKey] ?? e.id)))];
+				for (let e of o.values()) await u(e, p);
+				if (!e.scan || d.length < c) break;
+				let m = d[d.length - 1].id;
+				if (m === void 0 || m === n) throw Error("governance scan must advance a stable id cursor");
+				n = m;
 			}
 		}
 	};
@@ -81,7 +81,9 @@ var t = 500, n = 5e4, r = (e, t) => {
 		...t.truncated ? { truncated: !0 } : {}
 	}));
 }, o = async (e, t, n) => {
-	let r = await a(e, t, n), i = {};
+	let r = await a(e, t, n);
+	if (r.some((e) => e.truncated === !0)) throw Error("governance: subject export exceeds the per-table row limit; no bundle was returned");
+	let i = {};
 	for (let e of r) e.rows.length > 0 && (i[e.table] = e.rows);
 	return i;
 }, s = (e, t) => {
@@ -112,5 +114,4 @@ var t = 500, n = 5e4, r = (e, t) => {
 		...p.length > 0 ? { truncated: p } : {}
 	};
 };
-//#endregion
 export { t as SUBJECT_KEY_CHUNK, n as SUBJECT_ROW_CAP, s as assertAnonymizable, a as collectSubjectRows, c as eraseSubject, o as exportSubject, i as scopeToPath };

package/dist/index.d.ts

@@ -5,10 +5,13 @@ import { deriveSubjectGraph } from '@voltro/database';
 import { DeriveSubjectGraphInput } from '@voltro/database';
 import { ENCRYPTED_PREFIX } from '@voltro/database';
 import { FieldCipher } from '@voltro/database';
+import { fieldKeyIdOf } from '@voltro/runtime';
 import { formatSubjectGraph } from '@voltro/database';
 import { isEncrypted } from '@voltro/database';
 import { makeAesCipher } from '@voltro/runtime';
 import { makeFieldCipher } from '@voltro/runtime';
+import { makeFieldKeyring } from '@voltro/runtime';
+import { resolveFieldKeyring } from '@voltro/runtime';
 import { SchemaTable } from '@voltro/database';
 import { setFieldCipher } from '@voltro/runtime';
 import { SubjectGraph } from '@voltro/database';
@@ -155,6 +158,8 @@ export declare const exportSubject: (store: GovStore, paths: ReadonlyArray<Subje
 
 export { FieldCipher }
 
+export { fieldKeyIdOf }
+
 export { formatSubjectGraph }
 
 export declare const governancePlugin: (options?: GovernancePluginOptions) => VoltroPlugin;
@@ -334,6 +339,8 @@ export { makeAesCipher }
 
 export { makeFieldCipher }
 
+export { makeFieldKeyring }
+
 /**
  * In-memory consent store (default + test). Latest-write-wins per
  * (subject,purpose).
@@ -354,6 +361,8 @@ export declare const memoryGovStore: (seed?: Record<string, Array<Record<string,
     dump: () => Record<string, Array<Record<string, unknown>>>;
 };
 
+export { resolveFieldKeyring }
+
 export declare interface RetentionPolicy {
     readonly table: string;
     /** Time-to-live in ms (e.g. 90 days = 90*86_400_000). */

package/dist/index.js

@@ -3,28 +3,28 @@ import { dataStoreGovStore as a, memoryGovStore as o } from "./store.js";
 import { SUBJECT_KEY_CHUNK as s, SUBJECT_ROW_CAP as c, assertAnonymizable as l, collectSubjectRows as u, eraseSubject as d, exportSubject as f, scopeToPath as p } from "./gdpr.js";
 import { runRetention as m, selectExpired as h } from "./retention.js";
 import { CONSENT_TABLE as g, consentTable as _, consentTables as v, dataStoreConsentStore as y, memoryConsentStore as b } from "./consent.js";
-import { Context as x, Effect as S, Layer as C } from "effect";
-import { ADMIN_SCOPE as w, definePlugin as T, pluginInstanceName as E, requireScope as D } from "@voltro/protocol";
-import { deriveKey as O, makeAesCipher as k, makeFieldCipher as A, makeFieldCipher as j, resolveSecret as M, setFieldCipher as N, setFieldCipher as P } from "@voltro/runtime";
-import { DEFAULT_SUBJECT_GRAPH_DEPTH as F, ENCRYPTED_PREFIX as I, deriveSubjectGraph as L, deriveSubjectGraph as R, formatSubjectGraph as z, isEncrypted as B } from "@voltro/database";
-//#region src/index.ts
-var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/GovernanceService") {}, U = "@voltro/plugin-governance", W = (o = {}) => {
-	let s = E({
-		base: U,
+import { Context as x, Effect as S, Layer as ee } from "effect";
+import { ADMIN_SCOPE as C, definePlugin as te, pluginInstanceName as ne, requireScope as w } from "@voltro/protocol";
+import { FIELD_ENCRYPTION_ACTIVE_ENV as T, FIELD_ENCRYPTION_KEYS_ENV as E, deriveKey as D, deriveKey as O, fieldDecryptSnapshot as re, fieldKeyIdOf as k, getFieldCipher as A, isFieldKeyring as j, makeAesCipher as M, makeFieldCipher as N, makeFieldCipher as ie, makeFieldKeyring as P, makeFieldKeyring as ae, readFieldKeyHolders as oe, readFieldKeyReports as se, readFieldKeys as ce, resolveFieldKeyring as F, resolveFieldKeyring as I, resolveSecret as L, setFieldCipher as R, setFieldCipher as z } from "@voltro/runtime";
+import { DEFAULT_SUBJECT_GRAPH_DEPTH as B, ENCRYPTED_PREFIX as V, deriveSubjectGraph as H, deriveSubjectGraph as le, formatSubjectGraph as U, isEncrypted as W } from "@voltro/database";
+// src/index.ts
+var G = 1e3, K = class extends x.Service()("@voltro/plugin-governance/GovernanceService") {}, q = "@voltro/plugin-governance", J = (o = {}) => {
+	let s = ne({
+		base: q,
 		alias: o.alias,
 		instance: o.name
 	}), c = o.consent === "datastore", u = o.consent && o.consent !== "datastore" ? o.consent : c ? void 0 : b(), h, g = {
 		record: (e) => (u ?? h ?? b()).record(e),
 		has: (e, t) => (u ?? h ?? b()).has(e, t),
 		list: (e) => (u ?? h ?? b()).list(e)
-	}, _ = o.subjectScopes ?? [], x = o.deriveSubjectScopes, O = () => {
+	}, _ = o.subjectScopes ?? [], x = o.deriveSubjectScopes, D = () => {
 		let e = x?.subjectTable ?? "actors", t = _.map((t) => p(t, e));
 		if (x === void 0) return {
 			subjectTable: e,
 			paths: t,
 			limitations: []
 		};
-		let n = R({
+		let n = le({
 			subjectTable: e,
 			...x.maxDepth === void 0 ? {} : { maxDepth: x.maxDepth },
 			...x.exclude === void 0 ? {} : { exclude: x.exclude }
@@ -33,11 +33,11 @@ var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/Governance
 			...n,
 			paths: [...n.paths, ...i]
 		};
-	}, k = () => O().paths;
+	}, k = () => D().paths;
 	for (let e of o.retention ?? []) (e.action ?? "delete") === "anonymize" && l(`retention policy '${e.table}'`, e.anonymizeFields);
 	o.erasure?.mode === "anonymize" && l("erasure defaults", o.erasure.anonymizeFields);
-	let A = typeof o.fieldEncryption == "object" ? o.fieldEncryption.secretKey ?? "VOLTRO_FIELD_ENCRYPTION_KEY" : "VOLTRO_FIELD_ENCRYPTION_KEY", N = typeof o.fieldEncryption == "object" ? o.fieldEncryption.previousSecretKeys ?? ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"] : ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"], F = o.fieldEncryption ? [{
-		name: A,
+	let M = typeof o.fieldEncryption == "object" ? o.fieldEncryption.secretKey ?? "VOLTRO_FIELD_ENCRYPTION_KEY" : "VOLTRO_FIELD_ENCRYPTION_KEY", N = typeof o.fieldEncryption == "object" ? o.fieldEncryption.previousSecretKeys ?? ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"] : ["VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS"], P = o.fieldEncryption ? [{
+		name: M,
 		required: !1,
 		secret: !0,
 		description: "AES-256-GCM key for `.encrypted()` columns (field encryption). Lose the key, lose the data — GCM fails closed."
@@ -46,41 +46,41 @@ var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/Governance
 		required: !1,
 		secret: !0,
 		description: "A retired field-encryption key, read during a rotation so values written under it stay readable. Remove once they are re-encrypted."
-	}))] : [], I = [], L, z, B = () => void 0, W = [], G = null, K = !1, q = () => {
-		if (!L) throw Error("governance: data store not bound yet");
-		return L;
-	}, J = {
-		subjectGraph: O,
-		exportSubject: (e) => f(q(), k(), e),
+	}))] : [], F = [], R, B, V, H = () => void 0, U = [], W = null, J = !1, Y = () => {
+		if (!R) throw Error("governance: data store not bound yet");
+		return R;
+	}, X = {
+		subjectGraph: D,
+		exportSubject: (e) => f(Y(), k(), e),
 		eraseSubject: async (e, t) => {
 			let n = {
 				...o.erasure,
 				...t
-			}, r = await d(q(), k(), e, n);
-			return I.unshift(r), I.length > 1e3 && (I.length = V), r;
+			}, r = await d(Y(), k(), e, n);
+			return F.unshift(r), F.length > 1e3 && (F.length = G), r;
 		},
 		recordConsent: (e) => g.record(e),
 		hasConsent: (e, t) => g.has(e, t),
 		runRetentionNow: async () => {
-			if (!L || !o.retention) return;
-			let e = await m(L, o.retention);
-			W = e, G = (/* @__PURE__ */ new Date()).toISOString(), B("retention sweep", { report: e });
+			if (!R || !o.retention) return;
+			let e = await m(R, o.retention);
+			U = e, W = (/* @__PURE__ */ new Date()).toISOString(), H("retention sweep", { report: e });
 		}
-	}, Y = [
+	}, ue = [
 		{
 			...n,
 			description: "GDPR data export for a subject (admin only).",
 			execute: (e, t) => S.gen(function* () {
-				return yield* D(t.request.subject, w), yield* S.promise(() => J.exportSubject(e.subjectId));
+				return yield* w(t.request.subject, C), yield* S.promise(() => X.exportSubject(e.subjectId));
 			})
 		},
 		{
 			...t,
 			description: "GDPR erasure (right-to-be-forgotten) for a subject (admin only).",
 			execute: (e, t) => S.gen(function* () {
-				yield* D(t.request.subject, w);
+				yield* w(t.request.subject, C);
 				let { subjectId: n, mode: r } = e;
-				return yield* S.promise(() => J.eraseSubject(n, r ? { mode: r } : void 0));
+				return yield* S.promise(() => X.eraseSubject(n, r ? { mode: r } : void 0));
 			})
 		},
 		{
@@ -88,7 +88,7 @@ var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/Governance
 			description: "Record the calling subject's consent for a purpose.",
 			execute: (e, t) => S.promise(async () => {
 				let { purpose: n, granted: r } = e, i = t.request.subject;
-				return await J.recordConsent({
+				return await X.recordConsent({
 					subjectId: i.id ?? "anonymous",
 					purpose: n,
 					granted: r,
@@ -102,23 +102,81 @@ var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/Governance
 			description: "Whether the calling subject has granted consent for a purpose.",
 			execute: (e, t) => S.promise(async () => {
 				let n = t.request.subject;
-				return { granted: await J.hasConsent(n.id ?? "anonymous", e.purpose) };
+				return { granted: await X.hasConsent(n.id ?? "anonymous", e.purpose) };
 			})
 		}
-	], X = (e) => ({
+	], Z = (e) => ({
 		kind: "json",
 		data: e
-	}), Z = (e, t) => ({
+	}), Q = (e, t) => ({
 		kind: "json",
 		status: e,
 		data: { error: t }
-	}), Q = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t), $ = [
+	}), de = (e, t) => new URLSearchParams(new URL(e, "http://x").search).get(t), $ = (e) => e === null ? null : e.toISOString(), fe = async () => {
+		let e = A();
+		if (!j(e)) return null;
+		let t = {
+			active: e.activeKeyId,
+			requested: e.requestedKeyId,
+			held: e.keyIds,
+			fingerprints: e.fingerprints,
+			decrypts: re()
+		};
+		if (B === void 0) return {
+			...t,
+			recorded: null,
+			error: "the data store is not bound yet"
+		};
+		try {
+			let [e, n, r] = await Promise.all([
+				ce(B),
+				oe(B),
+				se(B)
+			]), i = Date.now();
+			return {
+				...t,
+				recorded: {
+					keys: e.map((e) => ({
+						keyId: e.keyId,
+						state: e.state,
+						registeredAt: $(e.registeredAt),
+						activatedAt: $(e.activatedAt),
+						replacedAt: $(e.replacedAt),
+						retiredAt: $(e.retiredAt),
+						requestedAt: $(e.requestedAt)
+					})),
+					holders: n.map((e) => ({
+						holderId: e.holderId,
+						keyIds: e.keyIds,
+						activeKeyId: e.activeKeyId,
+						expiresAt: e.expiresAt.toISOString(),
+						live: e.expiresAt.getTime() > i
+					})),
+					lastCount: r.status === void 0 ? null : {
+						reportedAt: r.status.reportedAt.toISOString(),
+						...r.status.report
+					},
+					lastRekey: r.rekey === void 0 ? null : {
+						reportedAt: r.rekey.reportedAt.toISOString(),
+						...r.rekey.report
+					}
+				},
+				error: null
+			};
+		} catch (e) {
+			return {
+				...t,
+				recorded: null,
+				error: e instanceof Error ? e.message : String(e)
+			};
+		}
+	}, pe = [
 		{
 			method: "GET",
 			path: "/status",
 			scope: "process",
-			description: "Retention policies, subject scopes, field-encryption state, last sweep.",
-			handler: () => S.succeed(X({
+			description: "Retention policies, subject scopes, field-encryption state and keys, last sweep.",
+			handler: () => S.promise(async () => Z({
 				retention: (o.retention ?? []).map((e) => ({
 					table: e.table,
 					ttlMs: e.ttlMs,
@@ -128,11 +186,12 @@ var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/Governance
 					table: e.table,
 					subjectField: e.subjectField
 				})),
-				fieldEncryption: K,
+				fieldEncryption: J || A() !== void 0,
+				fieldKeys: await fe(),
 				sweepIntervalMs: o.sweepIntervalMs ?? 36e5,
-				lastSweepAt: G,
-				lastSweep: W,
-				erasureCount: I.length
+				lastSweepAt: W,
+				lastSweep: U,
+				erasureCount: F.length
 			}))
 		},
 		{
@@ -140,7 +199,7 @@ var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/Governance
 			path: "/erasures",
 			scope: "process",
 			description: "GDPR erasure log (most recent first).",
-			handler: () => S.succeed(X({ erasures: I.slice(0, 100) }))
+			handler: () => S.succeed(Z({ erasures: F.slice(0, 100) }))
 		},
 		{
 			method: "GET",
@@ -148,8 +207,8 @@ var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/Governance
 			scope: "declaration",
 			description: "The routes a DSAR export/erasure walks — AND what the derivation cannot see.",
 			handler: () => S.sync(() => {
-				let e = O();
-				return X({
+				let e = D();
+				return Z({
 					subjectTable: e.subjectTable,
 					derived: x !== void 0,
 					paths: e.paths.map((t) => ({
@@ -168,8 +227,8 @@ var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/Governance
 			scope: c ? "shared-store" : "process",
 			description: "Consent ledger for a subject (?subjectId=…).",
 			handler: (e) => {
-				let t = Q(e.url, "subjectId");
-				return t ? S.promise(async () => X({ records: await g.list(t) })) : S.succeed(Z(400, "subjectId query param required"));
+				let t = de(e.url, "subjectId");
+				return t ? S.promise(async () => Z({ records: await g.list(t) })) : S.succeed(Q(400, "subjectId query param required"));
 			}
 		},
 		{
@@ -181,13 +240,13 @@ var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/Governance
 				try {
 					t = JSON.parse(e.body || "{}");
 				} catch {
-					return Z(400, "invalid JSON body");
+					return Q(400, "invalid JSON body");
 				}
-				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return Z(400, "subjectId must be a non-empty string");
+				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return Q(400, "subjectId must be a non-empty string");
 				try {
-					return X({ bundle: await J.exportSubject(t.subjectId) });
+					return Z({ bundle: await X.exportSubject(t.subjectId) });
 				} catch (e) {
-					return Z(500, e.message);
+					return Q(500, e.message);
 				}
 			})
 		},
@@ -200,15 +259,15 @@ var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/Governance
 				try {
 					t = JSON.parse(e.body || "{}");
 				} catch {
-					return Z(400, "invalid JSON body");
+					return Q(400, "invalid JSON body");
 				}
-				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return Z(400, "subjectId must be a non-empty string");
+				if (typeof t != "object" || !t || Array.isArray(t) || !("subjectId" in t) || typeof t.subjectId != "string" || !t.subjectId.trim()) return Q(400, "subjectId must be a non-empty string");
 				let n = "mode" in t ? t.mode : void 0;
-				if (n !== void 0 && n !== "delete" && n !== "anonymize") return Z(400, "mode must be delete or anonymize");
+				if (n !== void 0 && n !== "delete" && n !== "anonymize") return Q(400, "mode must be delete or anonymize");
 				try {
-					return X({ entry: await J.eraseSubject(t.subjectId, n ? { mode: n } : void 0) });
+					return Z({ entry: await X.eraseSubject(t.subjectId, n ? { mode: n } : void 0) });
 				} catch (e) {
-					return Z(500, e.message);
+					return Q(500, e.message);
 				}
 			})
 		},
@@ -216,48 +275,64 @@ var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/Governance
 			method: "POST",
 			path: "/sweep",
 			description: "Run the retention sweep now.",
-			handler: () => S.promise(async () => (await J.runRetentionNow(), X({
-				lastSweepAt: G,
-				lastSweep: W
+			handler: () => S.promise(async () => (await X.runRetentionNow(), Z({
+				lastSweepAt: W,
+				lastSweep: U
 			})))
 		}
 	];
-	return T({
+	return te({
 		name: s,
-		baseName: U,
+		baseName: q,
 		description: "Data governance — retention TTL sweep, GDPR export/erasure, consent ledger.",
 		permissions: [
 			"store:write",
 			"inspect:read",
 			"inspect:write"
 		],
-		declaredEnv: F,
-		services: C.succeed(H, J),
-		routes: Y,
+		declaredEnv: P,
+		services: ee.succeed(K, X),
+		routes: ue,
 		rpcClientDescriptors: r,
-		inspectEndpoints: $,
+		inspectEndpoints: pe,
 		...c ? { extendSchema: { tables: v } } : {},
 		bindDataStore: (e, t) => {
-			if (L = a(e), c && (h = y(e)), o.retention && o.retention.length > 0) {
+			if (R = a(e), B = e, c && (h = y(e)), o.retention && o.retention.length > 0) {
 				let e = o.sweepIntervalMs ?? 36e5;
-				z = t?.scheduleCoordinated("governance.retention.sweep", e, () => J.runRetentionNow());
+				V = t?.scheduleCoordinated("governance.retention.sweep", e, () => X.runRetentionNow());
 			}
 		},
 		onActivate: (e) => S.gen(function* () {
-			B = (t, n) => e.logger.warn(t, n);
+			H = (t, n) => e.logger.warn(t, n);
 			let t = !1;
 			if (o.fieldEncryption) {
-				let e = A, n = yield* S.promise(() => M(e));
-				if (!n) return yield* S.die(/* @__PURE__ */ Error(`governance: fieldEncryption is enabled but secret "${e}" did not resolve — set it via the Secrets-Resolver / env`));
-				let r = [];
+				let e = M, n = yield* S.promise(() => L(e)), r = yield* S.promise(() => L(E)), i = [];
 				for (let e of N) {
-					let t = yield* S.promise(() => M(e));
-					t !== void 0 && t.trim() !== "" && r.push(t);
+					let t = yield* S.promise(() => L(e));
+					t !== void 0 && t.trim() !== "" && i.push(t);
+				}
+				if (r !== void 0 && r.trim() !== "") {
+					let e = yield* S.promise(() => L(T)), t = yield* S.try({
+						try: () => {
+							let t = I({
+								[E]: r,
+								[T]: e,
+								VOLTRO_FIELD_ENCRYPTION_KEY: n
+							});
+							for (let e of i) if (!t.keys.some((t) => O(t.secret).equals(O(e)))) throw Error(`governance: a key named in fieldEncryption.previousSecretKeys is not one of ${E}`);
+							return t;
+						},
+						catch: (e) => e instanceof Error ? e : Error(String(e))
+					}).pipe(S.orDie);
+					z(ae(t));
+				} else {
+					if (!n) return yield* S.die(/* @__PURE__ */ Error(`governance: fieldEncryption is enabled but secret "${e}" did not resolve — set it via the Secrets-Resolver / env, or configure ${E}`));
+					z(ie(n, i));
 				}
-				P(j(n, r)), t = !0, K = !0;
+				t = !0, J = !0;
 			}
 			!c && !o.consent && e.logger.warn("governance: consent ledger uses the in-memory store — per-process + restart-cleared. Under >1 replica a consent recorded on one replica is invisible to others. Pass consent: 'datastore' (durable, cross-instance) in production.");
-			let n = O();
+			let n = D();
 			if (x !== void 0) {
 				let t = n.limitations.filter((e) => e.kind === "unreachable").length;
 				n.paths.length <= 1 && e.logger.warn(`governance: the derived subject scope reached ${n.paths.length} table(s) from '${n.subjectTable}'. A DSAR would export almost nothing. Check that subjectTable names a real table and that the app declares relations() or reference() columns pointing at it.`), t > 0 && e.logger.info(`governance: ${t} registered table(s) are NOT linked to '${n.subjectTable}' and are outside every DSAR. GET /_voltro/inspect/plugins/governance/subject-graph lists them; add subjectScopes for any that hold subject data.`);
@@ -271,9 +346,8 @@ var V = 1e3, H = class extends x.Service()("@voltro/plugin-governance/Governance
 			});
 		}),
 		onDeactivate: () => S.sync(() => {
-			z?.stop(), z = void 0, o.fieldEncryption && P(void 0);
+			V?.stop(), V = void 0, o.fieldEncryption && z(void 0);
 		})
 	});
 };
-//#endregion
-export { g as CONSENT_TABLE, F as DEFAULT_SUBJECT_GRAPH_DEPTH, I as ENCRYPTED_PREFIX, V as ERASURE_LOG_CAP, H as GovernanceService, s as SUBJECT_KEY_CHUNK, c as SUBJECT_ROW_CAP, u as collectSubjectRows, _ as consentTable, v as consentTables, y as dataStoreConsentStore, a as dataStoreGovStore, O as deriveKey, L as deriveSubjectGraph, d as eraseSubject, f as exportSubject, z as formatSubjectGraph, W as governancePlugin, B as isEncrypted, k as makeAesCipher, A as makeFieldCipher, b as memoryConsentStore, o as memoryGovStore, m as runRetention, p as scopeToPath, h as selectExpired, N as setFieldCipher };
+export { g as CONSENT_TABLE, B as DEFAULT_SUBJECT_GRAPH_DEPTH, V as ENCRYPTED_PREFIX, G as ERASURE_LOG_CAP, K as GovernanceService, s as SUBJECT_KEY_CHUNK, c as SUBJECT_ROW_CAP, u as collectSubjectRows, _ as consentTable, v as consentTables, y as dataStoreConsentStore, a as dataStoreGovStore, D as deriveKey, H as deriveSubjectGraph, d as eraseSubject, f as exportSubject, k as fieldKeyIdOf, U as formatSubjectGraph, J as governancePlugin, W as isEncrypted, M as makeAesCipher, N as makeFieldCipher, P as makeFieldKeyring, b as memoryConsentStore, o as memoryGovStore, F as resolveFieldKeyring, m as runRetention, p as scopeToPath, h as selectExpired, R as setFieldCipher };

package/dist/retention.js

@@ -1,6 +1,6 @@
 import { writeGovernanceRows as e } from "./store.js";
 import { assertAnonymizable as t } from "./gdpr.js";
-//#region src/retention.ts
+// src/retention.ts
 var n = (e, t, n) => {
 	let r = e[t], i = r instanceof Date ? r.getTime() : typeof r == "string" || typeof r == "number" ? new Date(r).getTime() : NaN;
 	return Number.isNaN(i) ? null : n - i;
@@ -48,5 +48,4 @@ var n = (e, t, n) => {
 	}
 	return c;
 };
-//#endregion
 export { i as RETENTION_BATCH_SIZE, a as runRetention, r as selectExpired };

package/dist/rpc.js

@@ -1,6 +1,6 @@
 import { Schema as e } from "effect";
 import { ADMIN_SCOPE as t, defineAction as n, defineMutation as r, defineQuery as i } from "@voltro/protocol";
-//#region src/rpc.ts
+// src/rpc.ts
 var a = n({
 	name: "governance.export",
 	input: e.Struct({ subjectId: e.String }),
@@ -69,5 +69,4 @@ var a = n({
 		}
 	}
 ];
-//#endregion
 export { s as consentDescriptor, o as eraseDescriptor, a as exportDescriptor, l as governanceRpcClientImports, c as hasConsentDescriptor };

package/dist/store.js

@@ -1,5 +1,5 @@
 import { and as e, getTable as t, gt as n, inSet as r, lt as i } from "@voltro/database";
-//#region src/store.ts
+// src/store.ts
 var a = (a) => {
 	let o = a, s = (e, t) => ({
 		table: void 0,
@@ -116,5 +116,4 @@ var a = (a) => {
 	for (let e of s) if (e.status === "rejected") throw e.reason;
 	return i;
 };
-//#endregion
 export { a as dataStoreGovStore, o as memoryGovStore, s as writeGovernanceRows };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-governance",
-  "version": "0.86.0",
+  "version": "0.88.0",
   "description": "Data governance — retention policies (TTL sweep), GDPR subject export + erasure (right-to-be-forgotten), and consent recording. Builds on audit + soft-delete.",
   "keywords": [
     "voltro",
@@ -38,12 +38,12 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.86.0",
-    "@voltro/protocol": "0.86.0",
-    "@voltro/runtime": "0.86.0"
+    "@voltro/database": "0.88.0",
+    "@voltro/protocol": "0.88.0",
+    "@voltro/runtime": "0.88.0"
   },
   "peerDependencies": {
-    "effect": "4.0.1"
+    "effect": "4.1.0"
   },
   "publishConfig": {
     "access": "public"