@blamejs/blamejs-shop 0.3.47 → 0.3.48

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.48 (2026-06-02) — **Customers can export or request deletion of their personal data, and the admin console gets a privacy-request queue to fulfil it.** The framework had a complete data-subject-request engine but nothing reached it, so a store handling EU/California personal data had no way for a shopper to exercise their right of access or erasure and no operator path to fulfil one. A signed-in customer can now request a full export of their data — account, addresses, orders, subscriptions, loyalty, and support history, streamed as a downloadable JSON bundle — and can file a deletion request. The admin console gets a Privacy requests screen where an operator reviews each request, downloads the export, previews a deletion (a dry run that changes nothing), and then executes it. Erasure anonymizes the customer's account and archives their addresses and subscriptions while retaining orders, loyalty ledger, and support tickets that must be kept for tax and legal records. A customer can only ever see or act on their own requests; deletion is always filed by the customer and carried out by an operator. **Added:** *Customer data export and deletion requests* — A signed-in customer gets a Privacy & data area under their account where they can request a full export of their personal data and file a deletion request. The export is streamed as a downloadable JSON bundle covering their account, addresses, orders, subscriptions, loyalty balance and ledger, and support history. A customer can only access their own requests and downloads; a request belonging to anyone else returns not-found. · *Privacy-request queue in the admin console* — A new Privacy requests screen lists every data-subject request with its status. An operator can download a request's export, preview a deletion as a dry run that reports what would change without modifying anything, and then execute the deletion behind a confirmation step. Deletion anonymizes the customer's account and archives their addresses and subscriptions, while orders, the loyalty ledger, and support tickets are retained for tax and legal record-keeping. Every customer- and operator-entered field shown in either console is HTML-escaped.
+
 - v0.3.47 (2026-06-01) — **Admin product detail, collections list, and order shipment panels load with fewer database round trips.** Three admin-console screens re-derived data with one database query per item: the product-detail screen ran a query per variant per currency for current and historical prices, the collections list pulled up to 200 member rows for each collection just to count them, and the order-detail shipment panel hydrated each shipment and its labels sequentially. These now read in batched or parallel queries. The displayed data is unchanged, with one correctness improvement: a manual collection with more than 200 members now shows its true product count instead of a number capped at 200. **Changed:** *Batched admin product-detail price hydration* — The admin product-detail screen now loads every variant's current and historical prices across all currencies in a single batched query instead of one query per variant per currency. The screen renders identically. · *Collections list counts without pulling member rows* — The admin collections list now counts a manual collection's members with a COUNT query instead of fetching up to 200 member rows per collection. A manual collection with more than 200 members now shows its true count (previously the displayed count was capped at 200); rule-based collections keep their existing bounded preview count. · *Parallel shipment hydration on order detail* — The order-detail shipment panel now hydrates each shipment and its labels in parallel rather than one after another, so an order with several shipments opens faster.
 
 - v0.3.46 (2026-06-01) — **Storefront pages render in far fewer database round trips, and the search collection filter is consistent across cache tiers.** The dynamically rendered storefront (the path that serves returning, signed-in, or non-default-currency shoppers) re-derived product data with one database query per item — a home or search page could issue dozens to hundreds of round trips, where the cached edge already did the same work in a single batched query. The home grid, search results, product page, related-products rail, and cart now read product, variant, price, inventory, and media data in batched queries that mirror the edge exactly, so those pages render with far fewer round trips and identical output. As part of this, the search 'collection' filter now reflects manual collection membership consistently whether a page is served from the cache or rendered dynamically. **Changed:** *Batched product reads on storefront pages* — The home grid, search results, product detail, related-products rail, and cart now load product/variant/price/inventory/media data in batched database queries instead of one query per item. On a cache miss, a signed-in session, or a non-default currency the dynamic render path previously issued a query per product (and per variant); these pages now match the single-query shape the cached edge already used. Rendered pages are unchanged. · *Consistent search collection filter across cache tiers* — The 'collection' filter on the search page now reflects manual collection membership on both the cached and the dynamically rendered paths. Previously the dynamic path could additionally surface smart-collection rule matches in that filter, so a shopper could see different collection filter options depending on which path served the page. If you relied on smart (rule-based) collections appearing as search filters, they now appear only where a product is an explicit member; this aligns the two render paths.

package/lib/admin.js

@@ -511,6 +511,7 @@ function mount(router, deps) {
   var splitShipments = deps.splitShipments || null;  // order split-shipment planner disabled when absent
   var salesTaxFilings = deps.salesTaxFilings || null; // sales-tax-filing remittance console disabled when absent
   var supportTickets  = deps.supportTickets  || null; // support-ticket queue + thread console disabled when absent
+  var complianceExport = deps.complianceExport || null; // DSR queue (export/erasure) disabled when absent
   var orderExchanges  = deps.orderExchanges  || null; // exchange queue + FSM-action console disabled when absent
   var orderRatings    = deps.orderRatings    || null; // per-order rating moderation queue (flag/clear + public reply) disabled when absent
   var preorder        = deps.preorder        || null; // pre-order campaign console (define/launch/close) disabled when absent
@@ -521,7 +522,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, orderExport: !!orderExport };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, preorder: !!deps.preorder, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, customerSegments: !!customerSegments, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, knowledgeBase: !!deps.knowledgeBase, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets, complianceExport: !!complianceExport, orderExchanges: !!orderExchanges, orderRatings: !!orderRatings, orderExport: !!orderExport };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -4101,6 +4102,211 @@ function mount(router, deps) {
     _supportTransition("reopen",           "reopened");
   }
 
+  // ---- subject-access-request (DSR) queue -----------------------------
+  // The operator side of the GDPR / CCPA / LGPD lifecycle: list + detail +
+  // fulfil/dispatch/preview/execute/dismiss + a streaming export download.
+  // Content-negotiated like the other screens: bearer → JSON; signed-in
+  // browser → the HTML console. The primitive throws TypeError ONLY (no
+  // `.code`-bearing FSM error — confirmed across lib/compliance-export.js):
+  // a malformed id, a not-found row, and a bad-status transition are ALL
+  // TypeError, so the catch maps TypeError → a 4xx notice and there is no
+  // `.code` branch to order. If a future status-conflict error gains a
+  // `.code`, add the branch BEFORE the TypeError catch so it isn't collapsed.
+  if (complianceExport) {
+    var dsr         = complianceExport;
+    var dsrReaders  = deps.complianceExportReaders || {};
+    var dsrSections = deps.complianceExportSections || {};
+    var streamDsr   = deps.streamDsrBundle;
+
+    // Resolve the ?status= chip into a list. "all" / a bad chip → the whole
+    // board; a real status → the filtered list.
+    async function _dsrRows(filter) {
+      if (filter && filter !== "all" && DSR_STATUS_FILTERS.indexOf(filter) !== -1) {
+        return { rows: await dsr.listRequests({ status: filter, limit: 200 }), filter: filter };
+      }
+      return { rows: await dsr.listRequests({ limit: 200 }), filter: "all" };
+    }
+
+    router.get("/admin/dsr", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var filter = (url && url.searchParams.get("status")) || null;
+        var resolved = await _dsrRows(filter);
+        _json(res, 200, { rows: resolved.rows, status: resolved.filter });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var filter = (url && url.searchParams.get("status")) || null;
+        var resolved = await _dsrRows(filter);
+        _sendHtml(res, 200, renderAdminDsr({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          requests: resolved.rows, status: resolved.filter,
+        }));
+      },
+    ));
+
+    // Resolve a request by :id, surfacing a malformed / unknown id as a 404
+    // (defensive request-shape reader, never a 500). getRequest throws
+    // TypeError on a bad uuid → 404; a null row → 404.
+    async function _dsrOr404(req, res, isJson) {
+      var row;
+      try { row = await dsr.getRequest(req.params.id); }
+      catch (e) {
+        if (e instanceof TypeError) {
+          if (isJson) { _problem(res, 404, "dsr-request-not-found"); return null; }
+          _sendHtml(res, 404, renderAdminDsr({ shop_name: deps.shop_name, nav_available: navAvailable, requests: [], status: "all", notice: "Request not found." }));
+          return null;
+        }
+        throw e;
+      }
+      if (!row) {
+        if (isJson) { _problem(res, 404, "dsr-request-not-found"); return null; }
+        _sendHtml(res, 404, renderAdminDsr({ shop_name: deps.shop_name, nav_available: navAvailable, requests: [], status: "all", notice: "Request not found." }));
+        return null;
+      }
+      return row;
+    }
+
+    router.get("/admin/dsr/:id", _pageOrApi(true,
+      R(async function (req, res) {
+        var row = await _dsrOr404(req, res, true); if (!row) return;
+        var history = await dsr.auditForCustomer(row.customer_id);
+        _json(res, 200, { request: row, history: history });
+      }),
+      async function (req, res) {
+        var row = await _dsrOr404(req, res, false); if (!row) return;
+        var history = await dsr.auditForCustomer(row.customer_id);
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        // A deletion request's ?preview=1 renders the dry-run blast radius —
+        // processDeletion({ dry_run: true }) NEVER mutates (the primitive's
+        // only safety net). A bad-status row (already terminal) throws
+        // TypeError → drop the preview, render the detail without it.
+        var preview = null;
+        if (url && url.searchParams.get("preview") === "1" && row.request_kind === "deletion") {
+          try { preview = await dsr.processDeletion({ request_id: row.id, dry_run: true }); }
+          catch (e) { if (!(e instanceof TypeError)) throw e; preview = null; }
+        }
+        _sendHtml(res, 200, renderAdminDsrDetail({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          request: row, history: history, preview: preview,
+          moved:  url && url.searchParams.get("moved"),
+          notice: url && url.searchParams.get("err") ? "That action couldn't be completed for this request." : null,
+        }));
+      },
+    ));
+
+    // Streaming export download. Gated: the row must be an export in status
+    // fulfilled / delivered (an un-fulfilled / deletion / unknown row → 404).
+    // Status + ownership are validated BEFORE the first write (the bundle
+    // streams header-first; status can't change mid-stream). The route
+    // re-reads the readers rather than re-running fulfillRequest (which would
+    // re-flip status on every download).
+    router.get("/admin/dsr/:id/export.json", _pageOrApi(true,
+      R(async function (req, res) {
+        var row = await _dsrOr404(req, res, true); if (!row) return;
+        if (row.request_kind !== "export" || (row.status !== "fulfilled" && row.status !== "delivered")) {
+          return _problem(res, 404, "dsr-export-not-ready");
+        }
+        var sections = dsrSections[row.scope] || dsrSections.full || [];
+        await streamDsr(res, dsrReaders, sections, row);
+      }),
+      async function (req, res) {
+        var row = await _dsrOr404(req, res, false); if (!row) return;
+        if (row.request_kind !== "export" || (row.status !== "fulfilled" && row.status !== "delivered")) {
+          return _sendHtml(res, 404, renderAdminDsr({ shop_name: deps.shop_name, nav_available: navAvailable, requests: [], status: "all", notice: "Export not ready for download." }));
+        }
+        var sections = dsrSections[row.scope] || dsrSections.full || [];
+        await streamDsr(res, dsrReaders, sections, row);
+      },
+    ));
+
+    // Per-request action helper: run `opFn(id, body)`, then PRG back to the
+    // detail. The primitive throws TypeError for not-found / bad-status / bad
+    // input — all become an ?err=1 notice, never a 500. There is no
+    // `.code`-bearing error to branch on (see the block-head comment).
+    function _dsrAction(jsonHandler, auditEvent, opFn) {
+      return _pageOrApi(false, jsonHandler, async function (req, res) {
+        var id = req.params.id;
+        try { await opFn(id, req.body || {}); }
+        catch (e) {
+          if (e instanceof TypeError) {
+            return _redirect(res, "/admin/dsr/" + encodeURIComponent(id) + "?err=1");
+          }
+          throw e;
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + "." + auditEvent, outcome: "success", metadata: { id: id } });
+        _redirect(res, "/admin/dsr/" + encodeURIComponent(id) + "?moved=1");
+      });
+    }
+
+    router.post("/admin/dsr/:id/fulfill", _dsrAction(
+      R(async function (req, res) {
+        try { var bundle = await dsr.fulfillRequest({ request_id: req.params.id }); _json(res, 200, bundle); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      }),
+      "dsr.fulfill",
+      function (id) { return dsr.fulfillRequest({ request_id: id }); },
+    ));
+
+    router.post("/admin/dsr/:id/dispatch", _dsrAction(
+      R(async function (req, res) {
+        var body = req.body || {};
+        try { var row = await dsr.dispatchExport({ request_id: req.params.id, delivery_method: body.delivery_method, delivery_address: body.delivery_address }); _json(res, 200, row); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      }),
+      "dsr.dispatch",
+      function (id, body) { return dsr.dispatchExport({ request_id: id, delivery_method: body.delivery_method, delivery_address: body.delivery_address }); },
+    ));
+
+    router.post("/admin/dsr/:id/dismiss", _dsrAction(
+      R(async function (req, res) {
+        var body = req.body || {};
+        try { var row = await dsr.dismissRequest({ request_id: req.params.id, dismiss_reason: body.dismiss_reason }); _json(res, 200, row); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      }),
+      "dsr.dismiss",
+      function (id, body) { return dsr.dismissRequest({ request_id: id, dismiss_reason: body.dismiss_reason }); },
+    ));
+
+    // Execute erasure — irreversible, so it routes through the confirm
+    // interstitial. The detail's "Execute erasure…" button POSTs here; this
+    // browser handler renders renderAdminConfirm, whose Confirm button POSTs
+    // back here too (now carrying the confirmed flag via a hidden field), at
+    // which point processDeletion runs for real (dry_run: false). The bearer
+    // JSON path executes directly (tooling has no interstitial).
+    router.post("/admin/dsr/:id/delete/confirm", _pageOrApi(false,
+      R(async function (req, res) {
+        try { var result = await dsr.processDeletion({ request_id: req.params.id, dry_run: false }); _json(res, 200, result); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      }),
+      async function (req, res) {
+        var id = req.params.id;
+        var body = req.body || {};
+        if (body.confirmed !== "1") {
+          // First POST (from the detail button) — render the consequence.
+          return _sendHtml(res, 200, renderAdminConfirm({
+            shop_name: deps.shop_name, nav_available: navAvailable, active: "dsr",
+            heading: "Execute erasure",
+            consequence: "This permanently anonymizes the customer and archives their addresses + subscriptions. It cannot be undone.",
+            detail: "Orders, the loyalty ledger, and support tickets are retained for legal/accounting reasons. Continue?",
+            action: "/admin/dsr/" + encodeURIComponent(id) + "/delete/confirm",
+            fields: { confirmed: "1" },
+            confirm_label: "Execute erasure",
+            cancel_href: "/admin/dsr/" + encodeURIComponent(id),
+          }));
+        }
+        // Confirmed — run it for real, then PRG to the detail.
+        try { await dsr.processDeletion({ request_id: id, dry_run: false }); }
+        catch (e) {
+          if (e instanceof TypeError) return _redirect(res, "/admin/dsr/" + encodeURIComponent(id) + "?err=1");
+          throw e;
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".dsr.delete", outcome: "success", metadata: { id: id } });
+        _redirect(res, "/admin/dsr/" + encodeURIComponent(id) + "?moved=1");
+      },
+    ));
+  }
+
   // ---- order exchanges ------------------------------------------------
   //
   // The operator side of a customer-requested item swap: the FIFO queue of
@@ -9700,6 +9906,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "segments",     href: "/admin/segments",     label: "Segments",     requires: "customerSegments" },
   { key: "returns",      href: "/admin/returns",      label: "Returns",      requires: "returns" },
   { key: "support",      href: "/admin/support",      label: "Support",      requires: "supportTickets" },
+  { key: "dsr",          href: "/admin/dsr",          label: "Privacy requests", requires: "complianceExport" },
   { key: "exchanges",    href: "/admin/exchanges",    label: "Exchanges",    requires: "orderExchanges" },
   { key: "ratings",      href: "/admin/ratings",      label: "Ratings",      requires: "orderRatings" },
   { key: "reviews",      href: "/admin/reviews",      label: "Reviews",      requires: "reviews" },
@@ -11617,6 +11824,182 @@ function renderAdminSupportTicket(opts) {
   return _renderAdminShell(opts.shop_name, "Ticket", body, "support", opts.nav_available);
 }
 
+// ---- subject-access-request (DSR) queue --------------------------------
+//
+// The operator side of the GDPR / CCPA / LGPD request lifecycle: a
+// status-filterable list of export + deletion requests, one request's
+// detail with its per-customer audit history + the action forms (fulfil +
+// download an export, mark delivered, preview a deletion dry-run, execute
+// the erasure behind a confirm interstitial, dismiss). Models the support
+// console shape. Every dynamic value — including operator/customer free
+// text (reason / dismiss_reason / delivery_address) — is _htmlEscape'd:
+// the primitive bounds length + strips control bytes but does NOT strip
+// HTML, so escape-at-render is the XSS gate.
+var DSR_STATUS_FILTERS = ["all", "received", "processing", "fulfilled", "delivered", "dismissed"];
+
+function _dsrPillClass(status) {
+  if (status === "fulfilled" || status === "delivered") return "paid";
+  if (status === "dismissed") return "cancelled";
+  return "pending";   // received / processing
+}
+
+// Operator queue. Status chips filter the board; each row links to the
+// request detail. Renders the customer (short id), kind, jurisdiction,
+// scope, status pill, and when it was requested.
+function renderAdminDsr(opts) {
+  opts = opts || {};
+  var requests = opts.requests || [];
+  var active = opts.status || "all";
+  var notice = opts.notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var chips = "<div class=\"order-filters\">" +
+    DSR_STATUS_FILTERS.map(function (s) {
+      return "<a class=\"chip" + (active === s ? " chip--on" : "") + "\" href=\"/admin/dsr?status=" + encodeURIComponent(s) + "\">" + _htmlEscape(s) + "</a>";
+    }).join("") +
+    "</div>";
+
+  var rows = requests.map(function (r) {
+    return "<tr>" +
+      "<td><a class=\"order-id\" href=\"/admin/dsr/" + _htmlEscape(r.id) + "\">" + _htmlEscape(String(r.customer_id).slice(0, 8)) + "</a></td>" +
+      "<td>" + _htmlEscape(r.request_kind) + "</td>" +
+      "<td>" + _htmlEscape(r.jurisdiction) + "</td>" +
+      "<td>" + _htmlEscape(r.scope || "—") + "</td>" +
+      "<td><span class=\"status-pill " + _dsrPillClass(r.status) + "\">" + _htmlEscape(r.status) + "</span></td>" +
+      "<td>" + _htmlEscape(_fmtDate(r.requested_at)) + "</td>" +
+      "</tr>";
+  }).join("");
+
+  var table = requests.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Customer</th><th scope=\"col\">Kind</th><th scope=\"col\">Jurisdiction</th><th scope=\"col\">Scope</th><th scope=\"col\">Status</th><th scope=\"col\">Requested</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No “" + _htmlEscape(active) + "” privacy requests.</p>";
+
+  var body = "<section><h2>Privacy requests</h2>" +
+    "<p class=\"meta\">Subject-access requests (data export) and erasure requests under GDPR / CCPA / LGPD.</p>" +
+    notice + chips + table + "</section>";
+  return _renderAdminShell(opts.shop_name, "Privacy requests", body, "dsr", opts.nav_available);
+}
+
+// Request detail — the lifecycle, the customer's full request history, and
+// the action forms gated on kind + status. A deletion dry-run preview
+// (?preview=1) renders the per-domain blast-radius counts WITHOUT mutating.
+function renderAdminDsrDetail(opts) {
+  opts = opts || {};
+  var r = opts.request;
+  var history = opts.history || [];
+  var preview = opts.preview || null;   // processDeletion dry-run result
+  var moved  = opts.moved  ? "<div class=\"banner banner--ok\">Request updated.</div>" : "";
+  var notice = opts.notice ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  function _field(label, value) {
+    return "<p><span class=\"meta\">" + _htmlEscape(label) + "</span><br>" + (value ? _htmlEscape(String(value)) : "<span class=\"meta\">—</span>") + "</p>";
+  }
+
+  var isExport   = r.request_kind === "export";
+  var isDeletion = r.request_kind === "deletion";
+  var openState  = r.status === "received" || r.status === "processing";
+
+  // Action forms.
+  var actions = "";
+  if (isExport && openState) {
+    actions +=
+      "<form method=\"post\" action=\"/admin/dsr/" + _htmlEscape(r.id) + "/fulfill\" class=\"form-inline\">" +
+        "<button class=\"btn\" type=\"submit\">Fulfil request</button>" +
+      "</form>";
+  }
+  if (isExport && (r.status === "fulfilled" || r.status === "delivered")) {
+    actions +=
+      "<a class=\"btn\" href=\"/admin/dsr/" + _htmlEscape(r.id) + "/export.json\">Download export</a>";
+  }
+  if (isExport && r.status === "fulfilled") {
+    actions +=
+      "<form method=\"post\" action=\"/admin/dsr/" + _htmlEscape(r.id) + "/dispatch\" class=\"return-action\">" +
+        "<h4>Mark delivered</h4>" +
+        _setupField("Delivery method", "delivery_method", r.delivery_method || "", "text", "How the bundle reached the requester (e.g. email, secure-link).", " maxlength=\"64\" required") +
+        _setupField("Delivery address", "delivery_address", r.delivery_address || "", "text", "Where it was sent (email address / link / postal address).", " maxlength=\"1000\" required") +
+        "<button class=\"btn\" type=\"submit\">Mark delivered</button>" +
+      "</form>";
+  }
+  if (isDeletion && openState) {
+    actions +=
+      "<a class=\"btn\" href=\"/admin/dsr/" + _htmlEscape(r.id) + "?preview=1\">Preview erasure (dry run)</a>";
+    // Execute routes through the confirm interstitial (irreversible; the CSP
+    // forbids a client confirm()). The button POSTs to /delete/confirm which
+    // renders renderAdminConfirm; that page's Confirm POSTs the real execute.
+    actions +=
+      "<form method=\"post\" action=\"/admin/dsr/" + _htmlEscape(r.id) + "/delete/confirm\" class=\"form-inline\">" +
+        "<button class=\"btn btn--danger\" type=\"submit\">Execute erasure…</button>" +
+      "</form>";
+  }
+  if (r.status !== "delivered" && r.status !== "dismissed") {
+    actions +=
+      "<form method=\"post\" action=\"/admin/dsr/" + _htmlEscape(r.id) + "/dismiss\" class=\"return-action\">" +
+        "<h4>Dismiss</h4>" +
+        "<label class=\"form-field\"><span>Reason</span><textarea name=\"dismiss_reason\" rows=\"3\" maxlength=\"4000\" required></textarea></label>" +
+        "<button class=\"btn btn--danger\" type=\"submit\">Dismiss request</button>" +
+      "</form>";
+  }
+  var actionsHtml = actions
+    ? "<div class=\"return-actions\">" + actions + "</div>"
+    : "<span class=\"meta\">This request is in a terminal state — no further actions.</span>";
+
+  // Deletion dry-run preview panel (per-domain counts; never mutates).
+  var previewHtml = "";
+  if (preview) {
+    var dRows = (preview.domains || []).map(function (d) {
+      var note = d.note ? " <span class=\"meta\">(" + _htmlEscape(d.note) + ")</span>" : "";
+      return "<tr><td>" + _htmlEscape(d.table || d.domain) + "</td><td>" + _htmlEscape(String(d.deleted)) + note + "</td></tr>";
+    }).join("");
+    var absent = (preview.domains_absent || []).map(function (n) { return _htmlEscape(n); }).join(", ");
+    previewHtml =
+      "<div class=\"panel mt\"><h3 class=\"subhead\">Erasure preview (dry run — nothing was changed)</h3>" +
+        (dRows
+          ? "<table><thead><tr><th scope=\"col\">Table</th><th scope=\"col\">Affected</th></tr></thead><tbody>" + dRows + "</tbody></table>"
+          : "<p class=\"empty\">No per-domain handlers wired.</p>") +
+        (absent ? "<p class=\"meta\">Domains without a deletion handler: " + absent + "</p>" : "") +
+        "<p class=\"meta\">Total affected: " + _htmlEscape(String(preview.total_affected)) + "</p>" +
+      "</div>";
+  }
+
+  var histRows = history.map(function (h) {
+    return "<tr>" +
+      "<td>" + _htmlEscape(String(h.id).slice(0, 8)) + "</td>" +
+      "<td>" + _htmlEscape(h.request_kind) + "</td>" +
+      "<td><span class=\"status-pill " + _dsrPillClass(h.status) + "\">" + _htmlEscape(h.status) + "</span></td>" +
+      "<td>" + _htmlEscape(_fmtDate(h.requested_at)) + "</td>" +
+      "</tr>";
+  }).join("");
+  var historyHtml = history.length
+    ? "<table><thead><tr><th scope=\"col\">Request</th><th scope=\"col\">Kind</th><th scope=\"col\">Status</th><th scope=\"col\">Requested</th></tr></thead><tbody>" + histRows + "</tbody></table>"
+    : "<p class=\"empty\">No prior requests.</p>";
+
+  var body =
+    "<section class=\"mw-48\">" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/dsr\">&larr; Privacy requests</a></div>" +
+      "<h2>" + _htmlEscape(r.request_kind === "export" ? "Data export" : "Erasure") + " request " +
+        "<span class=\"status-pill " + _dsrPillClass(r.status) + "\">" + _htmlEscape(r.status) + "</span></h2>" +
+      "<p class=\"meta\">Requested " + _htmlEscape(_fmtDate(r.requested_at)) +
+        " · by " + _htmlEscape(r.requested_by) +
+        " · customer <code>" + _htmlEscape(String(r.customer_id).slice(0, 8)) + "</code></p>" +
+      moved + notice +
+      "<div class=\"two-col\">" +
+        "<div class=\"panel\"><h3 class=\"subhead\">Details</h3>" +
+          _field("Jurisdiction", r.jurisdiction) +
+          _field("Scope", r.scope) +
+          _field("Reason", r.reason) +
+          _field("Dismiss reason", r.dismiss_reason) +
+          _field("Delivery method", r.delivery_method) +
+          _field("Delivery address", r.delivery_address) +
+          _field("Fulfilled", r.fulfilled_at ? _fmtDate(r.fulfilled_at) : null) +
+          _field("Delivered", r.delivered_at ? _fmtDate(r.delivered_at) : null) +
+        "</div>" +
+        "<div class=\"panel\"><h3 class=\"subhead\">Customer request history</h3>" + historyHtml + "</div>" +
+      "</div>" +
+      previewHtml +
+      "<div class=\"panel mt\"><h3 class=\"subhead\">Actions</h3>" + actionsHtml + "</div>" +
+    "</section>";
+  return _renderAdminShell(opts.shop_name, "Privacy request", body, "dsr", opts.nav_available);
+}
+
 // The non-terminal exchange states the operator can filter the queue by —
 // lifecycle order (the terminal closed / rejected don't appear in the open
 // queue, so they're not filter chips).

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.47",
+  "version": "0.3.48",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/storefront.js

@@ -4515,6 +4515,163 @@ function renderSupportTicket(opts) {
   });
 }
 
+// ---- privacy & data (customer self-service DSR) ------------------------
+//
+// The signed-in customer files an export request (a copy of their data) OR
+// a deletion request (erasure), sees their own request history, and
+// downloads a fulfilled export bundle. Self-service FILES the request; an
+// operator reviews + executes it from the admin queue (identity
+// verification is a controller obligation under every jurisdiction). Every
+// dynamic value — including the customer's own free-text deletion reason
+// replayed in the history — is escaped (b.template.escapeHtml); the
+// primitive bounds length but does NOT strip HTML.
+var _DSR_JURISDICTIONS = [
+  ["gdpr", "GDPR (EU / UK)"],
+  ["ccpa", "CCPA (California)"],
+  ["lgpd", "LGPD (Brazil)"],
+  ["other", "Other"],
+];
+var _DSR_SCOPES = [
+  ["full", "Everything we hold on you"],
+  ["orders_only", "Orders only"],
+  ["identity_only", "Profile + addresses only"],
+];
+
+function _dsrStatusBadge(status) {
+  var esc = b.template.escapeHtml;
+  return "<span class=\"pdp__badge dsr-status--" + esc(String(status)) + "\">" + esc(String(status)) + "</span>";
+}
+
+function renderAccountPrivacy(opts) {
+  var esc = b.template.escapeHtml;
+  var history = opts.history || [];
+  var notice = "";
+  if (opts.ok === "export") {
+    notice = "<p class=\"form-notice form-notice--ok\" role=\"status\">Your data export request has been filed. We'll prepare it and let you know when it's ready to download.</p>";
+  } else if (opts.ok === "deletion") {
+    notice = "<p class=\"form-notice form-notice--ok\" role=\"status\">Your erasure request has been filed. We'll verify your identity and confirm once it's complete.</p>";
+  } else if (opts.notice) {
+    notice = "<p class=\"form-notice form-notice--error\" role=\"alert\">" + esc(String(opts.notice)) + "</p>";
+  }
+
+  var jurisdictionOpts = _DSR_JURISDICTIONS.map(function (j) {
+    return "<option value=\"" + esc(j[0]) + "\">" + esc(j[1]) + "</option>";
+  }).join("");
+  var scopeOpts = _DSR_SCOPES.map(function (s) {
+    return "<option value=\"" + esc(s[0]) + "\">" + esc(s[1]) + "</option>";
+  }).join("");
+
+  var rowsHtml = "";
+  for (var i = 0; i < history.length; i += 1) {
+    var r = history[i];
+    var date = r.requested_at ? new Date(Number(r.requested_at)).toISOString().slice(0, 10) : "";
+    var kindLabel = r.request_kind === "export" ? "Data export" : "Erasure";
+    var download = (r.request_kind === "export" && (r.status === "fulfilled" || r.status === "delivered"))
+      ? " &middot; <a href=\"/account/privacy/" + esc(String(r.id)) + "/export.json\">Download</a>"
+      : "";
+    var reason = r.reason
+      ? "<p class=\"return-card__meta\">Reason: " + esc(String(r.reason)) + "</p>"
+      : "";
+    rowsHtml +=
+      "<li class=\"return-card\">" +
+        "<div class=\"return-card__head\">" +
+          "<span class=\"return-card__rma\">" + esc(kindLabel) + "</span>" +
+          _dsrStatusBadge(r.status) +
+        "</div>" +
+        "<p class=\"return-card__meta\">" + esc(String(r.jurisdiction).toUpperCase()) +
+          (date ? " &middot; <time datetime=\"" + esc(date) + "\">" + esc(date) + "</time>" : "") +
+          download +
+        "</p>" +
+        reason +
+      "</li>";
+  }
+  var historyInner = rowsHtml
+    ? "<ul class=\"return-list\">" + rowsHtml + "</ul>"
+    : "<div class=\"account-empty\"><p class=\"account-empty__lede\">You haven't filed any privacy requests yet.</p></div>";
+
+  var body =
+    "<section class=\"account-returns\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li aria-current=\"page\">Privacy &amp; data</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-returns__title\">Privacy &amp; data</h1>" +
+      "<p class=\"section-head__lede\">Request a copy of the personal data we hold on you, or ask us to erase it. " +
+        "Most requests are completed within the statutory window (GDPR: one month; CCPA: 45 days; LGPD: 15 days).</p>" +
+      notice +
+      "<div class=\"panel\">" +
+        "<h2 class=\"pdp__variants-title\">Request a copy of your data</h2>" +
+        "<form class=\"return-form form-stack\" method=\"post\" action=\"/account/privacy/export\">" +
+          "<label class=\"form-field\"><span class=\"form-field__label\">Applicable law</span>" +
+            "<select name=\"jurisdiction\" required>" + jurisdictionOpts + "</select></label>" +
+          "<label class=\"form-field\"><span class=\"form-field__label\">What to include</span>" +
+            "<select name=\"scope\" required>" + scopeOpts + "</select></label>" +
+          "<button type=\"submit\" class=\"btn-primary\">Request my data</button>" +
+        "</form>" +
+      "</div>" +
+      "<div class=\"panel\">" +
+        "<h2 class=\"pdp__variants-title\">Erase your data</h2>" +
+        "<p class=\"return-card__meta\">This files a request to permanently erase your personal data. " +
+          "We'll verify your identity before acting on it.</p>" +
+        "<a class=\"btn-secondary\" href=\"/account/delete\">Request erasure</a>" +
+      "</div>" +
+      "<h2 class=\"pdp__variants-title\">Your requests</h2>" +
+      historyInner +
+    "</section>";
+  return _wrap({
+    title:      "Privacy & data",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
+// Server-rendered erasure-confirm interstitial (the CSP forbids a client
+// confirm()). Filing requires a non-empty reason + a jurisdiction. A Cancel
+// link returns to the privacy page.
+function renderAccountDelete(opts) {
+  var esc = b.template.escapeHtml;
+  var v = opts.values || {};
+  var notice = opts.notice
+    ? "<p class=\"form-notice form-notice--error\" role=\"alert\">" + esc(String(opts.notice)) + "</p>"
+    : "";
+  var jurisdictionOpts = _DSR_JURISDICTIONS.map(function (j) {
+    var sel = v.jurisdiction === j[0] ? " selected" : "";
+    return "<option value=\"" + esc(j[0]) + "\"" + sel + ">" + esc(j[1]) + "</option>";
+  }).join("");
+  var body =
+    "<section class=\"return-form-page\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li><a href=\"/account/privacy\">Privacy &amp; data</a></li>" +
+        "<li aria-current=\"page\">Erase my data</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"return-form-page__title\">Request data erasure</h1>" +
+      "<p class=\"form-notice\" role=\"note\">Filing this request asks us to permanently erase the personal data we hold on you. " +
+        "Orders and other records we're legally required to keep are retained but de-linked from your identity. " +
+        "We'll verify your identity before acting on it. This cannot be undone.</p>" +
+      notice +
+      "<form class=\"return-form form-stack\" method=\"post\" action=\"/account/delete\">" +
+        "<label class=\"form-field\"><span class=\"form-field__label\">Applicable law</span>" +
+          "<select name=\"jurisdiction\" required>" + jurisdictionOpts + "</select></label>" +
+        "<label class=\"form-field\"><span class=\"form-field__label\">Reason for your request</span>" +
+          "<textarea name=\"reason\" required maxlength=\"4000\" rows=\"4\">" + esc(v.reason == null ? "" : String(v.reason)) + "</textarea></label>" +
+        "<div class=\"actions-row\">" +
+          "<button type=\"submit\" class=\"btn-primary\">File erasure request</button>" +
+          "<a class=\"btn-secondary\" href=\"/account/privacy\">Cancel</a>" +
+        "</div>" +
+      "</form>" +
+    "</section>";
+  return _wrap({
+    title:      "Erase my data",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Loyalty transaction-type pill — reuses the `pdp__badge` class the
 // theme already styles. The type is one of the ledger's closed enum
 // (earn / redeem / expire / adjust / tier-bonus).
@@ -7736,6 +7893,7 @@ var ACCOUNT_DASH_PAGE =
   "      RAW_PREORDER_LINK\n" +
   // begin: profile + passkey management actions
   "      <a class=\"btn-secondary\" href=\"/account/profile\">Edit profile</a>\n" +
+  "      <a class=\"btn-secondary\" href=\"/account/privacy\">Privacy &amp; data</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/passkeys\">Manage passkeys</a>\n" +
   // end: profile + passkey management actions
   "      <form method=\"post\" action=\"/account/logout\"><button type=\"submit\" class=\"btn-ghost\">Sign out</button></form>\n" +
@@ -14144,6 +14302,128 @@ function mount(router, deps) {
       });
     }
 
+    // Privacy & data — the signed-in customer's self-service DSR surface.
+    // Filing an export or deletion request pins customer_id to the SESSION
+    // (never the form); requested_by is the fixed "customer-self-service"
+    // string (the session env carries no email — _currentCustomerEnv returns
+    // { customer_id, exp } only — and the primitive requires a non-empty
+    // requested_by). Self-service FILES the request; an operator reviews +
+    // executes it from /admin/dsr (PD-3). The export download is
+    // ownership-scoped (a stranger → 404) and streams the bundle.
+    if (deps.complianceExport && deps.customers) {
+      var dsr         = deps.complianceExport;
+      var dsrReaders  = deps.complianceExportReaders || {};
+      var dsrSections = deps.complianceExportSections || {};
+      var streamDsr   = deps.streamDsrBundle;
+
+      router.get("/account/privacy", async function (req, res) {
+        var auth = _accountAuth(req, res); if (!auth) return;
+        var history = [];
+        try { history = await dsr.auditForCustomer(auth.customer_id); } catch (_e) { history = []; }
+        var cartCount = await _cartCountForReq(req);
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        _send(res, 200, renderAccountPrivacy({
+          history:    history,
+          ok:         url && url.searchParams.get("ok"),
+          shop_name:  shopName,
+          cart_count: cartCount,
+        }));
+      });
+
+      // File a data-export request. customer_id is pinned to the session.
+      // A bad enum (jurisdiction / scope) throws TypeError → a 400 re-render
+      // with a notice, never a 500. No row is created on a bad enum (the
+      // primitive validates before INSERT).
+      router.post("/account/privacy/export", async function (req, res) {
+        var auth = _accountAuth(req, res); if (!auth) return;
+        var body = req.body || {};
+        try {
+          await dsr.requestExport({
+            customer_id:  auth.customer_id,
+            requested_by: "customer-self-service",
+            jurisdiction: body.jurisdiction,
+            scope:        body.scope,
+          });
+        } catch (e) {
+          if (e instanceof TypeError) {
+            var history = [];
+            try { history = await dsr.auditForCustomer(auth.customer_id); } catch (_e2) { history = []; }
+            var cc = await _cartCountForReq(req);
+            return _send(res, 400, renderAccountPrivacy({
+              history:    history,
+              notice:     "Please choose a valid law and scope and try again.",
+              shop_name:  shopName,
+              cart_count: cc,
+            }));
+          }
+          throw e;
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/privacy?ok=export");
+        return res.end ? res.end() : res.send("");
+      });
+
+      router.get("/account/delete", async function (req, res) {
+        var auth = _accountAuth(req, res); if (!auth) return;
+        var cartCount = await _cartCountForReq(req);
+        _send(res, 200, renderAccountDelete({ shop_name: shopName, cart_count: cartCount }));
+      });
+
+      // File a deletion request. customer_id is pinned to the session; this
+      // FILES the request (status received) — it does NOT execute the erasure
+      // (the operator reviews identity + runs processDeletion from the admin
+      // queue). A bad enum / empty reason throws TypeError → a 400 re-render.
+      router.post("/account/delete", async function (req, res) {
+        var auth = _accountAuth(req, res); if (!auth) return;
+        var body = req.body || {};
+        try {
+          await dsr.requestDeletion({
+            customer_id:  auth.customer_id,
+            requested_by: "customer-self-service",
+            jurisdiction: body.jurisdiction,
+            reason:       body.reason,
+          });
+        } catch (e) {
+          if (e instanceof TypeError) {
+            var cc = await _cartCountForReq(req);
+            return _send(res, 400, renderAccountDelete({
+              values:     body,
+              notice:     "Please choose a valid law and give a reason, then try again.",
+              shop_name:  shopName,
+              cart_count: cc,
+            }));
+          }
+          throw e;
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/privacy?ok=deletion");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // Ownership-scoped streaming export download. Resolve the row, verify
+      // it belongs to THIS session customer (IDOR gate — a stranger / unknown
+      // / malformed id → 404, never another customer's bundle), confirm it's
+      // a fulfilled/delivered export, then stream. Status + ownership are
+      // validated BEFORE the first write (the bundle streams header-first).
+      router.get("/account/privacy/:id/export.json", async function (req, res) {
+        var auth = _accountAuth(req, res); if (!auth) return;
+        var row;
+        try { row = await dsr.getRequest(req.params && req.params.id); }
+        catch (e) {
+          if (e instanceof TypeError) { _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme })); return; }
+          throw e;
+        }
+        if (!row || row.customer_id !== auth.customer_id ||
+            row.request_kind !== "export" ||
+            (row.status !== "fulfilled" && row.status !== "delivered")) {
+          _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+          return;
+        }
+        var sections = dsrSections[row.scope] || dsrSections.full || [];
+        await streamDsr(res, dsrReaders, sections, row);
+      });
+    }
+
     // Loyalty — the signed-in customer's points balance + tier, the
     // earn/redeem ledger, how points are earned, and (when a reward
     // catalog + redemption primitive are wired) a redeem-a-reward

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.47",
+  "version": "0.3.48",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {