feat(gdpr): runtime field encryption for x-gdpr-sensitive — Node core (ADR-0030)

The SDK-enforcement half of GDPR governance (mirrors the Go reference). New gdpr
module: a caller-bound Cipher interface (sync encrypt/decrypt onto KMS/Vault) + a
reference AesGcmCipher on node:crypto (AES-GCM, base64(iv||ct||tag)), and
protect/unprotect helpers that encrypt/decrypt exactly the schema's
x-gdpr-sensitive leaves in place (nested + array + root), byte-for-byte round-trip,
wrong key -> typed DecryptError. schema.sensitivePaths() parses x-gdpr-sensitive
(validation-neutral). data stays pure JSON (ciphertext string) so the envelope is
frozen (GR-1, schema_version 1, trace_id preserved); the Cipher seam keeps the core
zero-dep (GR-7). Opt-in; schema validation on cleartext. v1.7.0.

Author: muhammetsafak

CHANGELOG.md

@@ -9,6 +9,43 @@ The envelope wire format is versioned separately by `meta.schema_version`
 
 ## [Unreleased]
 
+## [1.7.0] - 2026-06-21
+
+### Added
+- **Runtime GDPR field encryption — the SDK-enforcement half of `x-gdpr-sensitive`
+  (ADR-0030).** The registry only *declares* and *audits* which `data` fields are
+  personal/sensitive; this core now *enforces* it on the wire. A producer encrypts each
+  marked leaf before publish, a consumer decrypts it after decode — PII rides the wire as
+  ciphertext while the envelope stays frozen. The Node mirror of the Go reference; purely
+  additive, opt-in and validation-neutral.
+  - New `gdpr.protect(data, schema, cipher)` / `gdpr.unprotect(...)` standalone helpers —
+    they rewrite each `x-gdpr-sensitive` leaf **in place**: `protect` canonically
+    JSON-encodes the value then replaces it with the cipher's **ciphertext string**;
+    `unprotect` is the byte-for-byte inverse (numbers restore to numbers, objects to
+    objects). They walk **nested objects** (`profile.full_name`) and **array items**
+    (`addresses[].line`); an absent marked field is skipped (not an error); a non-sensitive
+    field is never touched. A wrong-key / tampered / non-ciphertext value throws the typed
+    `DecryptError` so the consumer fails the message (retry / dead-letter).
+  - New `Cipher` interface — `encrypt(bytes): string` / `decrypt(string): bytes`, both
+    **synchronous** — the caller-provided seam onto a KMS / Vault / HSM / tokenisation
+    service, so the core pulls **no** crypto dependency (GR-7).
+  - New `AesGcmCipher` reference cipher built **only** on `node:crypto` — AES-GCM with a
+    random 12-byte IV prepended and base64 output (`base64(iv || ciphertext || tag)`);
+    16/24/32-byte keys select AES-128/192/256-GCM. The caller owns the key (no key
+    management). GCM authenticates, so a wrong key or tampered input throws rather than
+    returning corrupt plaintext. New typed errors `DecryptError`, `InvalidKeySizeError`,
+    `MalformedCiphertextError`.
+  - New `schema.sensitivePaths(schema)` + `SensitivePath` type — parses the
+    `x-gdpr-sensitive` keyword (boolean `true` or non-empty string category) and walks
+    nested objects, array items and the root mark, in sorted path order. Parsing is
+    **validation-neutral** — the keyword never makes a value valid or invalid, so annotating
+    a schema is non-breaking.
+  - The envelope stays **frozen** (GR-1): only `data` *values* change, a ciphertext is a
+    JSON string so `data` stays pure JSON (GR-3), `meta.schema_version` stays **1** and
+    `trace_id` is preserved (GR-4). An SDK without the key still carries the envelope.
+    Validate **cleartext** — before `protect`, after `unprotect`. Entirely opt-in and
+    backward compatible.
+
 ## [1.6.0] - 2026-06-21
 
 ### Added

README.md

@@ -165,6 +165,52 @@ Implement `OutboxStore` over your DB (`save`, `fetchUnpublished` oldest-first 
 adapter SHOULD claim/lock rows so two relays don't double-publish — `markPublished`,
 `markFailed`) and `OutboxTransport` (`publish(body, queue)`) over your broker.
 
+### GDPR field encryption (optional)
+
+A schema can mark a `data` field `x-gdpr-sensitive` (ADR-0030). `gdpr.protect` encrypts
+each marked leaf **in place** before publish, and `gdpr.unprotect` restores it after
+decode — so PII rides the wire as ciphertext while the envelope stays frozen.
+
+```ts
+import { EnvelopeCodec, gdpr, schema } from "@babelqueue/core";
+
+// Your key, your cipher — bind a KMS/Vault/HSM here, or use the bundled AES-256-GCM one.
+const cipher = new gdpr.AesGcmCipher(myKey); // 16/24/32-byte key
+
+// PRODUCER — validate CLEARTEXT, then encrypt the marked leaves.
+const env = EnvelopeCodec.make("urn:babel:people:created", person, { queue: "people" });
+const s = provider.schemaFor(env.job);
+if (s) {
+  await schema.validate(provider, env.job, env.data); // cleartext, before protect
+  gdpr.protect(env.data, s, cipher);                   // email/full_name/... → ciphertext
+}
+const body = EnvelopeCodec.encode(env);                // ciphertext rides inside data
+
+// CONSUMER — decrypt the marked leaves, then validate CLEARTEXT.
+const incoming = EnvelopeCodec.decode(body);
+const cs = provider.schemaFor(incoming.job!);
+if (cs) {
+  gdpr.unprotect(incoming.data as Record<string, unknown>, cs, cipher);
+  await schema.validate(provider, incoming.job!, incoming.data as Record<string, unknown>);
+}
+```
+
+`protect` canonically JSON-encodes each marked value then replaces it with the cipher's
+**ciphertext string**, so the round-trip is byte-for-byte exact (numbers come back as
+numbers, objects as objects). It walks **nested objects** (`profile.full_name`) and
+**array items** (`addresses[].line`); an absent marked field is skipped; a non-sensitive
+field is never touched. Validate **cleartext** — before `protect`, after `unprotect` —
+because a schema constraining a sensitive field would reject the ciphertext string.
+
+The `Cipher` is an **interface you bind** (`encrypt(bytes) → string` /
+`decrypt(string) → bytes`, both synchronous) so the core pulls **no crypto dependency**
+(GR-7). The bundled `AesGcmCipher` is built only on `node:crypto` (AES-256-GCM, random IV
+prepended, base64; GCM auth-tag verified so a wrong key or tampered ciphertext **throws**
+`DecryptError`). The envelope stays **frozen** (GR-1): only `data` *values* change, a
+ciphertext is a JSON string so `data` stays pure JSON (GR-3), `meta.schema_version` stays
+**1** and `trace_id` is preserved (GR-4) — an SDK without the key still carries the
+envelope, it just can't read the protected fields. Entirely opt-in.
+
 ## What this core is (and isn't)
 
 It enforces the **contract**: the envelope shape, URN identity, trace propagation,

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@babelqueue/core",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Polyglot Queues, Simplified — the Node/TypeScript core: the canonical BabelQueue wire-envelope codec, contracts and dead-letter helpers.",
   "keywords": [
     "queue",
@@ -59,7 +59,7 @@
     "build": "tsup",
     "typecheck": "tsc --noEmit",
     "lint": "eslint src test",
-    "test": "node --import tsx --test test/codec.test.ts test/dead-letter.test.ts test/conformance.test.ts test/overhead.test.ts test/idempotency.test.ts test/schema.test.ts test/otel.test.ts test/redrive.test.ts test/replay.test.ts test/outbox.test.ts",
+    "test": "node --import tsx --test test/codec.test.ts test/dead-letter.test.ts test/conformance.test.ts test/overhead.test.ts test/idempotency.test.ts test/schema.test.ts test/otel.test.ts test/redrive.test.ts test/replay.test.ts test/outbox.test.ts test/gdpr.test.ts",
     "coverage": "c8 --check-coverage --lines 90 --functions 90 --branches 85 --reporter=text npm test",
     "prepublishOnly": "npm run build"
   },