Package com.babelqueue.gdpr

package com.babelqueue.gdpr

Optional runtime GDPR field encryption (ADR-0030): the SDK-enforcement half of the registry's x-gdpr-sensitive declaration.

babelqueue-registry only DECLARES and AUDITS which fields are personal data (and offers a one-way mask for safe logging). This package ENFORCES it on the wire: a producer encrypts each marked data leaf before publish (Gdpr.protect(java.util.Map<java.lang.String, java.lang.Object>, java.util.Map<java.lang.String, java.lang.Object>, com.babelqueue.gdpr.Cipher)), a consumer decrypts it after decode (Gdpr.unprotect(java.util.Map<java.lang.String, java.lang.Object>, java.util.Map<java.lang.String, java.lang.Object>, com.babelqueue.gdpr.Cipher)). It is the Java mirror of the Go gdpr reference, so every SDK round-trips byte-for-byte.

The pieces:

• Cipher — the caller-provided encryption primitive (a seam onto KMS/Vault/HSM/tokenisation); keeping it an interface holds GR-7 (the core pulls no crypto dependency). AesGcmCipher is the JDK-only reference (AES-GCM via javax.crypto, random 12-byte IV prepended, Base64).
• Gdpr — protect/unprotect: standalone, opt-in helpers that rewrite each marked leaf in place. The sensitive paths come from the same per-URN schema the validation path already loads (SensitivePaths).

The wire envelope stays frozen (GR-1): only values inside data change — a sensitive leaf's value becomes a ciphertext string, data remains pure JSON (GR-3), meta.schema_version stays 1 and trace_id is untouched (GR-4). Validate cleartext BEFORE protect / AFTER unprotect. See .ssot/architecture/adr/0030-gdpr-sensitive-field-governance.md.

Related Packages

Package	Description
com.babelqueue	BabelQueue — Polyglot Queues, Simplified.
com.babelqueue.idempotency	Optional idempotency helper (ADR-0022): dedupe a consume handler on meta.id.
com.babelqueue.otel	Optional OpenTelemetry tracing for babelqueue (ADR-0025 v0.1 + ADR-0028 v0.2) — the Java mirror of the Go babelqueue-go/otel, Python babelqueue.otel and Node @babelqueue/core/otel modules.
com.babelqueue.outbox	Optional transactional-outbox helper (ADR-0029): the producer-side mirror of the consumer-side idempotency helper (ADR-0022).
com.babelqueue.schema	Optional per-URN data schema validation (ADR-0024): a dependency-free subset Draft-07 validator (PayloadValidator), a SchemaProvider (with the in-memory MapProvider), and the SchemaValidation producer/consumer helpers.

Class	Description
AesGcmCipher	A reference Cipher built ONLY on the JDK's javax.crypto (AES/GCM/NoPadding): AES-GCM authenticated encryption with a fresh random 12-byte IV per call, the IV prepended to the ciphertext, the whole thing Base64-encoded so it drops straight into a JSON string.
Cipher	The field-level protection primitive that the caller provides — a seam onto a KMS, a Vault transit engine, an HSM, a tokenisation service, or the reference AesGcmCipher below.
DecryptException	Raised by Gdpr.unprotect(java.util.Map<java.lang.String, java.lang.Object>, java.util.Map<java.lang.String, java.lang.Object>, com.babelqueue.gdpr.Cipher) when a protected field cannot be restored on the consume side — a wrong key, a tampered/garbled ciphertext, or a value that is not the string Gdpr.protect(java.util.Map<java.lang.String, java.lang.Object>, java.util.Map<java.lang.String, java.lang.Object>, com.babelqueue.gdpr.Cipher) produced.
Gdpr	The RUNTIME half of ADR-0030: SDK-side field-level encryption of the data fields a registry declared x-gdpr-sensitive.
InvalidKeySizeException	Thrown by AesGcmCipher(byte[]) when the key is not 16, 24, or 32 bytes (AES-128/192/256).
MalformedCiphertextException	Thrown by AesGcmCipher.decrypt(String) when the input is not valid Base64 or is too short to contain an IV — i.e.