@gjsify/site 0.64.6 → 0.64.7

package/README.md

@@ -63,6 +63,61 @@ and rasterised by GdkPixbuf), `SoftwareApplication` JSON-LD, `hreflang` alternat
 root owns it and must list this sitemap. A page title or meta description that is too short
 (or only the app name) is reported as a build warning.
 
+A metainfo URL that points into the site's own `/<lang>/…` pages (it starts with `gjsify.site.url`)
+is rewritten to the language of the page being rendered, so `/en/support/` becomes `/de/support/` on
+the German page. Other addresses are left alone.
+
+## Privacy pages
+
+With `gjsify.site.privacy` set, a build also writes `/<base><lang>/privacy/index.html` and links it
+from the footer of every page (title "Privacy" / "Datenschutz"). It opens with one built-in
+paragraph — about visiting THIS page, which sets no cookie, runs no analytics and loads nothing
+from a third-party domain, because this package adds none of those — then the consumer's own
+statement of what the APP does with data, read verbatim from the file `statements[lang]` names and
+rendered through a small Markdown subset (headings, paragraphs, lists, GFM tables, links, bold,
+inline code; `#`/`##`/`###` render as `h2`/`h3`/`h4`, one level up, since the page already has its
+own `h1`).
+
+```json
+"privacy": {
+  "statements": { "en": "docs/privacy.md", "de": "docs/privacy.de.md" },
+  "hostingPolicyUrl": "https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement"
+}
+```
+
+**The statement is never generated**, and every configured language needs its own entry — a
+missing one fails the build rather than silently showing English where a translation was promised.
+This is deliberate, not a gap to close: what the APP does with data is a claim about its own code,
+checked the same way `docs/store/privacy.md` already is in a consumer like Beifahrer (every
+substantive line cited to a `file:line`), and an app that talks to no data only because the page
+*says* so is exactly the "inaccurate privacy policy" app stores remove listings for. `@gjsify/site`
+can derive the hosting paragraph because it is a fact about what THIS package ships, not about the
+product — see [ADR 0109](../../../docs/adr/0109-a-static-site-generator-reads-an-app-from-its-metainfo.md)'s
+amendment on why that line is drawn there. `hostingPolicyUrl` is the one hosting fact that is a
+per-deployment choice rather than a package guarantee, so it is config, named only when given.
+
+## Legal Notice / Impressum pages
+
+With `gjsify.site.legalNotice` set, a build also writes `/<base><lang>/legal-notice/index.html` and
+links it from the footer of every page (title "Legal Notice" / "Impressum"). Same shape as
+`privacy` — one statement file per configured language, read verbatim and rendered through the same
+Markdown subset — but **no built-in paragraph is prepended**: unlike the privacy page, this package
+has nothing of its own to say about who is legally responsible for a site, so the whole page is the
+consumer's own statement.
+
+```json
+"legalNotice": {
+  "statements": { "en": "docs/legal-notice.md", "de": "docs/legal-notice.de.md" }
+}
+```
+
+German law (§ 5 DDG, formerly § 5 TMG) requires a "Legal Notice"/Impressum directly on a site tied
+to a business, not merely linked from another domain — the page this key builds satisfies that.
+Content is typically identical across one publisher's apps (same legal entity, same address), but
+this package does not assume or enforce that: each consumer supplies its own files, the same way
+`privacy` does, because what counts as identical is a fact about the publisher, not something a
+shared package can derive.
+
 `gjsify site build --overview <file> --out <dir>` renders one page that lists several apps, each
 linking to its own support page, for a host such as `jumplink.eu/support/`:
 
@@ -109,6 +164,8 @@ Lives in the root `package.json`, next to `ship` and `flatpak`.
 | `releaseAssets` | `false` ignores the GitHub release assets, so `downloads` is the whole list. Default `true`. |
 | `relatedApps` | `[url \| {url, name, summary, icon}]`: sites of other apps, listed in order under "More apps by <developer>" on the landing page, see below. Optional — without it there is no section and nothing is fetched. |
 | `support`, `legal` | `support`: `{kind, url}` links, or `{kind: "sepa", name, iban, bic?, reference?}`, a bank transfer shown as IBAN plus an EPC QR code. `legal`: `{label, url}` links. Both empty by default: nothing is invented. |
+| `privacy` | `{statements: {<lang>: <path>}, hostingPolicyUrl?}`: a privacy page at `/<lang>/privacy/`, see below. Absent: no such page. |
+| `legalNotice` | `{statements: {<lang>: <path>}}`: a Legal Notice/Impressum page at `/<lang>/legal-notice/`, see below. Absent: no such page. |
 
 A `sepa` entry carries no amount, and its IBAN is checked when the config loads — length per
 country, alphabet, and the mod-97 checksum — so a typo fails the build instead of printing a QR
@@ -139,7 +196,9 @@ unknown id fails the build with the known ids listed.
 
 The recommendation ("Recommended for your system") is made once per part, so each block
 highlights its own best match, and the big button at the top of the dialog offers the first
-declared component: the thing to install first.
+declared component: the thing to install first. On Linux the order is Flathub, the Flatpak
+bundle, the AppImage, then deb and rpm: the Flatpak runs sandboxed on the shared GNOME runtime
+and updates with it, where an AppImage trusts the host's typelibs and needs FUSE.
 
 ### Related apps
 

package/lib/render/markdown.d.ts

@@ -0,0 +1 @@
+export declare function renderMarkdown(source: string): string;

package/lib/render/markdown.js

@@ -0,0 +1,113 @@
+import { esc } from './html.js';
+const HEADING = /^(#{1,3})\s+(.*)$/;
+const ORDERED = /^\d+\.\s+(.*)$/;
+const UNORDERED = /^[-*]\s+(.*)$/;
+const HR = /^-{3,}$/;
+const TABLE_SEPARATOR = /^\|?\s*:?-{3,}:?\s*(\|\s*:?-{3,}:?\s*)+\|?$/;
+/** One pipe-table row, split on unescaped `|`, outer pipes dropped. */
+function splitRow(line) {
+    return line
+        .trim()
+        .replace(/^\|/, '')
+        .replace(/\|$/, '')
+        .split('|')
+        .map((cell) => cell.trim());
+}
+function isTableStart(lines, index) {
+    const line = lines[index];
+    const next = lines[index + 1];
+    return line !== undefined && line.includes('|') && next !== undefined && TABLE_SEPARATOR.test(next.trim());
+}
+function isBlockStart(lines, index) {
+    const line = lines[index];
+    return (line.trim() === '' ||
+        HEADING.test(line) ||
+        HR.test(line.trim()) ||
+        ORDERED.test(line) ||
+        UNORDERED.test(line) ||
+        isTableStart(lines, index));
+}
+function parseBlocks(source) {
+    const lines = source.replace(/\r\n/g, '\n').split('\n');
+    const blocks = [];
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (line.trim() === '') {
+            i++;
+            continue;
+        }
+        if (HR.test(line.trim())) {
+            blocks.push({ kind: 'hr' });
+            i++;
+            continue;
+        }
+        const heading = HEADING.exec(line);
+        if (heading) {
+            blocks.push({ kind: 'heading', level: (heading[1].length + 1), text: heading[2].trim() });
+            i++;
+            continue;
+        }
+        if (isTableStart(lines, i)) {
+            const header = splitRow(line);
+            i += 2;
+            const rows = [];
+            while (i < lines.length && lines[i].includes('|') && lines[i].trim() !== '') {
+                rows.push(splitRow(lines[i]));
+                i++;
+            }
+            blocks.push({ kind: 'table', header, rows });
+            continue;
+        }
+        if (ORDERED.test(line) || UNORDERED.test(line)) {
+            const ordered = ORDERED.test(line);
+            const pattern = ordered ? ORDERED : UNORDERED;
+            const items = [];
+            while (i < lines.length && pattern.test(lines[i])) {
+                items.push(pattern.exec(lines[i])[1].trim());
+                i++;
+            }
+            blocks.push({ kind: 'list', ordered, items });
+            continue;
+        }
+        const paragraph = [];
+        while (i < lines.length && !isBlockStart(lines, i)) {
+            paragraph.push(lines[i].trim());
+            i++;
+        }
+        blocks.push({ kind: 'paragraph', text: paragraph.join(' ') });
+    }
+    return blocks;
+}
+/** Escapes first, then marks up the already-escaped text — a link's URL and label are both safe. */
+function renderInline(text) {
+    let html = esc(text);
+    html = html.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_match, label, url) => `<a href="${url}">${label}</a>`);
+    html = html.replace(/`([^`]+)`/g, (_match, code) => `<code>${code}</code>`);
+    html = html.replace(/\*\*([^*]+)\*\*/g, (_match, bold) => `<strong>${bold}</strong>`);
+    return html;
+}
+function renderBlock(block) {
+    switch (block.kind) {
+        case 'heading':
+            return `<h${block.level}>${renderInline(block.text)}</h${block.level}>`;
+        case 'paragraph':
+            return `<p>${renderInline(block.text)}</p>`;
+        case 'list': {
+            const tag = block.ordered ? 'ol' : 'ul';
+            return `<${tag}>${block.items.map((item) => `<li>${renderInline(item)}</li>`).join('')}</${tag}>`;
+        }
+        case 'table': {
+            const head = `<thead><tr>${block.header.map((cell) => `<th>${renderInline(cell)}</th>`).join('')}</tr></thead>`;
+            const body = `<tbody>${block.rows
+                .map((row) => `<tr>${row.map((cell) => `<td>${renderInline(cell)}</td>`).join('')}</tr>`)
+                .join('')}</tbody>`;
+            return `<table>${head}${body}</table>`;
+        }
+        case 'hr':
+            return '<hr>';
+    }
+}
+export function renderMarkdown(source) {
+    return parseBlocks(source).map(renderBlock).join('\n');
+}

package/lib/render/pages.d.ts

@@ -15,7 +15,7 @@ export interface RenderContext {
     /** Published URL of the app icon, when there is one. */
     iconUrl?: string;
     /** Which page of the app this renders; the language switch and the head follow it. Default `app`. */
-    view?: 'app' | 'support';
+    view?: 'app' | 'support' | 'privacy' | 'legal-notice';
     /** Root-relative URL of the link-preview card for this language. */
     ogImage?: string;
 }
@@ -25,7 +25,14 @@ export type DownloadContext = Pick<RenderContext, 'data' | 't' | 'lang'>;
 export declare function localized(text: Localized, lang: string): string;
 export declare function pageUrl(data: SiteData, lang: string): string;
 export declare function absolute(data: SiteData, rootRelative: string): string;
+/**
+ * A link into this site's own `/<lang>/…` pages, moved to the language being rendered; any other
+ * address is returned as it came. Apps put e.g. their English support page in the metainfo.
+ */
+export declare function localizeOwnUrl(data: SiteData, url: string, lang: string): string;
 export declare function supportUrl(data: SiteData, lang: string): string;
+export declare function privacyUrl(data: SiteData, lang: string): string;
+export declare function legalNoticeUrl(data: SiteData, lang: string): string;
 /** The transfer reference when the config sets none: one per app, so the bank statement says what it was for. */
 export declare function supportReference(data: SiteData): string;
 export declare function languageName(code: string): string;
@@ -56,7 +63,7 @@ export declare function relatedSection(ctx: Pick<RenderContext, 'data' | 'lang'
 /** A bank transfer as a card: the details to read or copy, and an EPC QR code that fills them into a banking app. */
 export declare function sepaCard(entry: SiteSupportSepa, t: Translate): string;
 /** The title and description of one page; also what the build checks for weak ones. */
-export declare function pageMeta(ctx: Pick<RenderContext, 'data' | 'lang' | 't'>, view?: 'app' | 'support'): {
+export declare function pageMeta(ctx: Pick<RenderContext, 'data' | 'lang' | 't'>, view?: 'app' | 'support' | 'privacy' | 'legal-notice'): {
     name: string;
     title: string;
     description: string;
@@ -64,6 +71,20 @@ export declare function pageMeta(ctx: Pick<RenderContext, 'data' | 'lang' | 't'>
 export declare function renderPage(ctx: RenderContext): string;
 /** `/<lang>/support/`: the ways to support the app, as plain markup that needs no script. */
 export declare function renderSupportPage(page: RenderContext): string;
+/**
+ * `/<lang>/privacy/`: the hosting paragraph above, then the app's own statement of what it does
+ * with data — read verbatim from the file `gjsify.site.privacy.statements[lang]` names, rendered
+ * through the Markdown subset in `markdown.ts`. Never generated: see ADR 0109's amendment on why.
+ */
+export declare function renderPrivacyPage(page: RenderContext, statement: string): string;
+/**
+ * `/<lang>/legal-notice/`: the app's own Legal Notice / Impressum statement, read verbatim from
+ * `gjsify.site.legalNotice.statements[lang]` and rendered through the same Markdown subset as
+ * `privacy`. Unlike `privacy`, no built-in paragraph is prepended — there is nothing about hosting
+ * to disclose here, only who is legally responsible for the site, and that is entirely the
+ * consumer's own statement.
+ */
+export declare function renderLegalNoticePage(page: RenderContext, statement: string): string;
 /** The root page: a script picks the visitor's language, the link list is what everyone else (and every crawler) sees. */
 export declare function renderRoot(data: SiteData, assets: ClientAssets, iconUrl: string | undefined): string;
 export {};

package/lib/render/pages.js

@@ -2,6 +2,7 @@ import { epcPayload, formatIban, isBrowserPlatform, PLATFORM_ORDER, pickByLangua
 import { readableText } from './color.js';
 import { attrs, esc, fmt, plain } from './html.js';
 import { icon } from './icons.js';
+import { renderMarkdown } from './markdown.js';
 import { OG_HEIGHT, OG_WIDTH } from './og-card.js';
 import { qrSvg } from './qr.js';
 import { metaDescription, ogLocale, pageTitle, softwareApplicationJsonLd } from './seo.js';
@@ -35,9 +36,29 @@ export function pageUrl(data, lang) {
 export function absolute(data, rootRelative) {
     return new URL(rootRelative.replace(/^\//, ''), `${new URL(data.config.url).origin}/`).href;
 }
+/**
+ * A link into this site's own `/<lang>/…` pages, moved to the language being rendered; any other
+ * address is returned as it came. Apps put e.g. their English support page in the metainfo.
+ */
+export function localizeOwnUrl(data, url, lang) {
+    const own = `${data.config.url.replace(/\/+$/, '')}/`;
+    if (!url.startsWith(own))
+        return url;
+    const rest = url.slice(own.length);
+    const segment = /^[^/?#]*/.exec(rest)[0];
+    if (!data.config.languages.includes(segment))
+        return url;
+    return `${own}${lang}${rest.slice(segment.length)}`;
+}
 export function supportUrl(data, lang) {
     return `${pageUrl(data, lang)}support/`;
 }
+export function privacyUrl(data, lang) {
+    return `${pageUrl(data, lang)}privacy/`;
+}
+export function legalNoticeUrl(data, lang) {
+    return `${pageUrl(data, lang)}legal-notice/`;
+}
 /** The transfer reference when the config sets none: one per app, so the bank statement says what it was for. */
 export function supportReference(data) {
     return `Support ${data.app.name.source}`;
@@ -447,13 +468,13 @@ function sameUrl(a, b) {
     return a.replace(/\/+$/, '') === b.replace(/\/+$/, '');
 }
 function links(ctx) {
-    const { data, t } = ctx;
+    const { data, lang, t } = ctx;
     const items = LINKS.flatMap(([key, label, glyph]) => {
         const href = data.app.urls[key];
         // No point linking the page the reader is on: the metainfo's homepage is often this site.
         if (!href || (key === 'homepage' && sameUrl(href, data.config.url)))
             return [];
-        return [linkCard(href, label(t), glyph)];
+        return [linkCard(localizeOwnUrl(data, href, lang), label(t), glyph)];
     });
     if (data.config.flathub)
         items.unshift(linkCard(`https://flathub.org/apps/${data.config.flathub}`, 'Flathub', 'package'));
@@ -543,13 +564,24 @@ function tags(ctx) {
     ].join('\n');
     return body.trim() ? `<section class="tags-section">\n${body}\n</section>` : '';
 }
+/** Which address the current view's own page lives at, in another language. */
+function viewUrl(ctx, code) {
+    const { data, view } = ctx;
+    if (view === 'support')
+        return supportUrl(data, code);
+    if (view === 'privacy')
+        return privacyUrl(data, code);
+    if (view === 'legal-notice')
+        return legalNoticeUrl(data, code);
+    return pageUrl(data, code);
+}
 function languageSwitch(ctx, className, style) {
     const { data, lang, t } = ctx;
     const items = data.config.languages.map((code) => {
         const label = style === 'code' ? code.toUpperCase() : languageName(code);
         return code === lang
             ? `<li><span aria-current="true">${esc(label)}</span></li>`
-            : `<li><a href="${esc(ctx.view === 'support' ? supportUrl(data, code) : pageUrl(data, code))}" hreflang="${esc(code)}" lang="${esc(code)}">${esc(label)}</a></li>`;
+            : `<li><a href="${esc(viewUrl(ctx, code))}" hreflang="${esc(code)}" lang="${esc(code)}">${esc(label)}</a></li>`;
     });
     return `<nav class="${className}" aria-label="${esc(t('Language'))}"><ul>${items.join('')}</ul></nav>`;
 }
@@ -600,9 +632,16 @@ function footer(ctx) {
     const { data, lang, t } = ctx;
     const name = localized(data.app.name, lang);
     const repo = repositoryUrl(data);
-    const legal = data.config.legal
-        .map((link) => `<li><a href="${esc(link.url)}">${esc(link.label)}</a></li>`)
-        .join('');
+    // The privacy and legal-notice links are derived, never configured: a consumer with a
+    // `gjsify.site.privacy`/`legalNotice` block gets the link on every page without also listing
+    // it in `legal`, which would be a second place for the two to disagree.
+    const legal = [
+        ...(data.config.legalNotice
+            ? [`<li><a href="${esc(legalNoticeUrl(data, lang))}">${esc(t('Legal Notice'))}</a></li>`]
+            : []),
+        ...(data.config.privacy ? [`<li><a href="${esc(privacyUrl(data, lang))}">${esc(t('Privacy'))}</a></li>`] : []),
+        ...data.config.legal.map((link) => `<li><a href="${esc(link.url)}">${esc(link.label)}</a></li>`),
+    ].join('');
     const licenses = [
         data.app.license ? fmt(t('{app} is licensed under {license}.'), { app: name, license: data.app.license }) : '',
         data.app.contentLicense
@@ -632,6 +671,20 @@ export function pageMeta(ctx, view = 'app') {
             }),
         };
     }
+    if (view === 'privacy') {
+        return {
+            name,
+            title: `${t('Privacy')} – ${name}`,
+            description: plain(t('What {app} does with data.'), { app: name }),
+        };
+    }
+    if (view === 'legal-notice') {
+        return {
+            name,
+            title: `${t('Legal Notice')} – ${name}`,
+            description: plain(t('Who publishes {app}, and how to reach them.'), { app: name }),
+        };
+    }
     const summary = localized(data.app.summary, lang);
     const first = data.app.description.find((block) => block.type === 'paragraph');
     const paragraph = first?.type === 'paragraph' ? localized(first.text, lang) : undefined;
@@ -667,7 +720,7 @@ function structuredData(ctx, title, description) {
 function head(ctx) {
     const { data, lang } = ctx;
     const view = ctx.view ?? 'app';
-    const viewPath = (code) => (view === 'support' ? supportUrl(data, code) : pageUrl(data, code));
+    const viewPath = (code) => viewUrl({ data, view }, code);
     const { name, title, description } = pageMeta(ctx, view);
     const url = absolute(data, viewPath(lang));
     const ogImage = ctx.ogImage ? absolute(data, ctx.ogImage) : undefined;
@@ -781,6 +834,94 @@ ${footer(ctx)}
 </html>
 `;
 }
+/**
+ * The paragraph every privacy page opens with, regardless of what the app does. It is about
+ * visiting THIS static page, not about the app — this package adds no cookie, no analytics and no
+ * third-party resource of its own, so that much is true for every consumer. `hostingPolicyUrl` is
+ * the one fact that varies by deployment and is not guessed; left out, nothing about hosting is said.
+ */
+function hostingNotice(ctx) {
+    const { data, t } = ctx;
+    const intro = t('This page is a static file: no cookie, no analytics, nothing from a third party.');
+    const logs = t('Whoever serves it may keep ordinary web-server access logs of the request.');
+    const link = data.config.privacy?.hostingPolicyUrl;
+    return `<p class="privacy-hosting">${esc(intro)} ${esc(logs)}${link ? ` <a href="${esc(link)}">${esc(t("See the hosting provider's notice"))}</a>` : ''}</p>`;
+}
+/**
+ * `/<lang>/privacy/`: the hosting paragraph above, then the app's own statement of what it does
+ * with data — read verbatim from the file `gjsify.site.privacy.statements[lang]` names, rendered
+ * through the Markdown subset in `markdown.ts`. Never generated: see ADR 0109's amendment on why.
+ */
+export function renderPrivacyPage(page, statement) {
+    const ctx = { ...page, view: 'privacy' };
+    const { data, lang, t } = ctx;
+    const meta = pageMeta(ctx, 'privacy');
+    return `<!doctype html>
+<html lang="${esc(lang)}">
+<head>
+${head(ctx)}
+</head>
+<body>
+${topBar(ctx)}
+<header class="masthead">
+<div class="hero-inner">
+${ctx.iconUrl ? `<div class="hero-icon" style="--icon-url:url(${esc(ctx.iconUrl)})"><img src="${esc(ctx.iconUrl)}" alt="" width="128" height="128"></div>` : ''}
+<div class="hero-text">
+<h1>${esc(t('Privacy'))}</h1>
+<p class="hero-by">${esc(meta.name)}</p>
+</div>
+</div>
+</header>
+<main>
+<div class="column privacy-statement">
+${hostingNotice(ctx)}
+${renderMarkdown(statement)}
+<p class="support-back"><a href="${esc(pageUrl(data, lang))}">${fmt(t('Back to {app}'), { app: meta.name })}</a></p>
+</div>
+</main>
+${footer(ctx)}
+</body>
+</html>
+`;
+}
+/**
+ * `/<lang>/legal-notice/`: the app's own Legal Notice / Impressum statement, read verbatim from
+ * `gjsify.site.legalNotice.statements[lang]` and rendered through the same Markdown subset as
+ * `privacy`. Unlike `privacy`, no built-in paragraph is prepended — there is nothing about hosting
+ * to disclose here, only who is legally responsible for the site, and that is entirely the
+ * consumer's own statement.
+ */
+export function renderLegalNoticePage(page, statement) {
+    const ctx = { ...page, view: 'legal-notice' };
+    const { data, lang, t } = ctx;
+    const meta = pageMeta(ctx, 'legal-notice');
+    return `<!doctype html>
+<html lang="${esc(lang)}">
+<head>
+${head(ctx)}
+</head>
+<body>
+${topBar(ctx)}
+<header class="masthead">
+<div class="hero-inner">
+${ctx.iconUrl ? `<div class="hero-icon" style="--icon-url:url(${esc(ctx.iconUrl)})"><img src="${esc(ctx.iconUrl)}" alt="" width="128" height="128"></div>` : ''}
+<div class="hero-text">
+<h1>${esc(t('Legal Notice'))}</h1>
+<p class="hero-by">${esc(meta.name)}</p>
+</div>
+</div>
+</header>
+<main>
+<div class="column privacy-statement">
+${renderMarkdown(statement)}
+<p class="support-back"><a href="${esc(pageUrl(data, lang))}">${fmt(t('Back to {app}'), { app: meta.name })}</a></p>
+</div>
+</main>
+${footer(ctx)}
+</body>
+</html>
+`;
+}
 /** The root page: a script picks the visitor's language, the link list is what everyone else (and every crawler) sees. */
 export function renderRoot(data, assets, iconUrl) {
     const { config } = data;

package/lib/site-data/config.js

@@ -155,6 +155,48 @@ function parseDownloads(raw, components) {
         return { platform, format, url, label, available, component };
     });
 }
+/**
+ * `gjsify.site.privacy`: every configured language needs its own statement file. A language with
+ * no entry fails the build rather than falling back silently — a legal page missing a translation
+ * it promised is worse than no page at all.
+ */
+function parsePrivacy(raw, languages) {
+    const value = raw.privacy;
+    if (value === undefined)
+        return undefined;
+    if (!isRecord(value))
+        throw new Error('gjsify.site.privacy must be an object');
+    const statementsRaw = value.statements;
+    if (!isRecord(statementsRaw)) {
+        throw new Error('gjsify.site.privacy.statements must be an object mapping a language to a file path');
+    }
+    const statements = {};
+    for (const lang of languages) {
+        statements[lang] = stringField(statementsRaw, lang, 'gjsify.site.privacy.statements');
+    }
+    return { statements, hostingPolicyUrl: optionalString(value, 'hostingPolicyUrl') };
+}
+/**
+ * `gjsify.site.legalNotice`: same per-language requirement as `privacy` — a language with no entry
+ * fails the build. The content is usually identical across a publisher's apps, but that is a fact
+ * about what the consumer WRITES, not something this parser assumes or enforces.
+ */
+function parseLegalNotice(raw, languages) {
+    const value = raw.legalNotice;
+    if (value === undefined)
+        return undefined;
+    if (!isRecord(value))
+        throw new Error('gjsify.site.legalNotice must be an object');
+    const statementsRaw = value.statements;
+    if (!isRecord(statementsRaw)) {
+        throw new Error('gjsify.site.legalNotice.statements must be an object mapping a language to a file path');
+    }
+    const statements = {};
+    for (const lang of languages) {
+        statements[lang] = stringField(statementsRaw, lang, 'gjsify.site.legalNotice.statements');
+    }
+    return { statements };
+}
 function parseReleaseAssets(raw) {
     const value = raw.releaseAssets ?? true;
     if (typeof value !== 'boolean')
@@ -196,6 +238,8 @@ export function parseSiteConfig(manifest) {
         downloads: parseDownloads(raw, components),
         releaseAssets: parseReleaseAssets(raw),
         support: objectList(raw, 'support').map((entry, index) => parseSupport(entry, `gjsify.site.support[${index}]`)),
+        privacy: parsePrivacy(raw, languages),
+        legalNotice: parseLegalNotice(raw, languages),
         legal: objectList(raw, 'legal').map((entry, index) => ({
             label: stringField(entry, 'label', `gjsify.site.legal[${index}]`),
             url: stringField(entry, 'url', `gjsify.site.legal[${index}]`),

package/lib/site-data/downloads.js

@@ -12,9 +12,16 @@ export const PLATFORM_ORDER = [
 export function isBrowserPlatform(platform) {
     return platform === 'firefox' || platform === 'chromium';
 }
-/** Best format first, per OS. The first target in this order is the recommended one. */
+/**
+ * Best format first, per OS. The first target in this order is the recommended one.
+ *
+ * A Flatpak bundle outranks the AppImage on Linux: it runs sandboxed on the shared GNOME runtime
+ * and updates with that runtime through the system's Flatpak installation, while an AppImage runs
+ * against the host's typelibs and needs FUSE. Flathub stays ahead of both, as the same Flatpak
+ * with store updates.
+ */
 const FORMAT_RANK = {
-    linux: ['flathub', 'appimage', 'flatpak', 'deb', 'rpm'],
+    linux: ['flathub', 'flatpak', 'appimage', 'deb', 'rpm'],
     darwin: ['dmg', 'zip'],
     win32: ['msi', 'zip'],
     android: ['apk'],

package/lib/site-data/index.d.ts

@@ -5,8 +5,10 @@ export * from './github.js';
 export * from './load.js';
 export * from './metainfo.js';
 export * from './network.js';
+export * from './legal-notice.js';
 export * from './oars.js';
 export * from './po.js';
+export * from './privacy.js';
 export * from './related.js';
 export * from './screenshots.js';
 export * from './sepa.js';

package/lib/site-data/index.js

@@ -5,8 +5,10 @@ export * from './github.js';
 export * from './load.js';
 export * from './metainfo.js';
 export * from './network.js';
+export * from './legal-notice.js';
 export * from './oars.js';
 export * from './po.js';
+export * from './privacy.js';
 export * from './related.js';
 export * from './screenshots.js';
 export * from './sepa.js';

package/lib/site-data/legal-notice.d.ts

@@ -0,0 +1,7 @@
+import type { SiteLegalNoticeConfig } from './types.js';
+/**
+ * Reads every language's Legal Notice / Impressum statement, verbatim — the same contract as
+ * `loadPrivacyStatements`. A file that cannot be read fails the build naming the language and the
+ * configured path.
+ */
+export declare function loadLegalNoticeStatements(legalNotice: SiteLegalNoticeConfig, root: string): Promise<Record<string, string>>;

package/lib/site-data/legal-notice.js

@@ -0,0 +1,19 @@
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+/**
+ * Reads every language's Legal Notice / Impressum statement, verbatim — the same contract as
+ * `loadPrivacyStatements`. A file that cannot be read fails the build naming the language and the
+ * configured path.
+ */
+export async function loadLegalNoticeStatements(legalNotice, root) {
+    const entries = await Promise.all(Object.entries(legalNotice.statements).map(async ([lang, path]) => {
+        const file = resolve(root, path);
+        try {
+            return [lang, await readFile(file, 'utf8')];
+        }
+        catch (cause) {
+            throw new Error(`gjsify.site.legalNotice.statements.${lang} points to "${path}", which could not be read`, { cause });
+        }
+    }));
+    return Object.fromEntries(entries);
+}

package/lib/site-data/privacy.d.ts

@@ -0,0 +1,8 @@
+import type { SitePrivacyConfig } from './types.js';
+/**
+ * Reads every language's statement file, verbatim — never parsed beyond what the renderer's
+ * Markdown subset does at render time, never translated by this package. A file that cannot be
+ * read fails the build naming the language and the configured path, the same way a missing
+ * `gjsify.site.metainfo` does.
+ */
+export declare function loadPrivacyStatements(privacy: SitePrivacyConfig, root: string): Promise<Record<string, string>>;

package/lib/site-data/privacy.js

@@ -0,0 +1,22 @@
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+/**
+ * Reads every language's statement file, verbatim — never parsed beyond what the renderer's
+ * Markdown subset does at render time, never translated by this package. A file that cannot be
+ * read fails the build naming the language and the configured path, the same way a missing
+ * `gjsify.site.metainfo` does.
+ */
+export async function loadPrivacyStatements(privacy, root) {
+    const entries = await Promise.all(Object.entries(privacy.statements).map(async ([lang, path]) => {
+        const file = resolve(root, path);
+        try {
+            return [lang, await readFile(file, 'utf8')];
+        }
+        catch (cause) {
+            throw new Error(`gjsify.site.privacy.statements.${lang} points to "${path}", which could not be read`, {
+                cause,
+            });
+        }
+    }));
+    return Object.fromEntries(entries);
+}

package/lib/site-data/types.d.ts

@@ -41,6 +41,33 @@ export interface SiteLegalLink {
     label: string;
     url: string;
 }
+/**
+ * `gjsify.site.privacy`: a consumer-authored statement of what the APP does with data — never
+ * generated, because that claim is about the product's own code, not about this page. One file
+ * per configured language, each checked independently rather than translated by the generator.
+ */
+export interface SitePrivacyConfig {
+    /** `<lang>` (from `gjsify.site.languages`) → repo-relative path of that language's statement. */
+    statements: Record<string, string>;
+    /**
+     * Link to the hoster's own data-processing notice, named in the page's built-in hosting
+     * paragraph. Left out, nothing about hosting beyond what this package itself guarantees is
+     * said — a provider is a per-deployment fact this package cannot derive.
+     */
+    hostingPolicyUrl?: string;
+}
+/**
+ * `gjsify.site.legalNotice`: a consumer-authored "Legal Notice" / Impressum statement — one file per
+ * configured language, like `privacy`. Unlike `privacy`, the content is typically IDENTICAL across a
+ * publisher's apps (same legal entity, same address), but this package never assumes that: it reads
+ * whatever each consumer's own file says, the same way `privacy` does. No built-in paragraph is added
+ * — unlike the hosting disclosure on the privacy page, there is nothing this package itself can say
+ * about who is legally responsible for a site's content.
+ */
+export interface SiteLegalNoticeConfig {
+    /** `<lang>` (from `gjsify.site.languages`) → repo-relative path of that language's statement. */
+    statements: Record<string, string>;
+}
 /**
  * One part of the product a person installs separately — a desktop app, the browser extension it
  * pairs with, a command line build. Declared in `gjsify.site.components`, in the order they are
@@ -148,6 +175,10 @@ export interface SiteConfig {
     releaseAssets: boolean;
     support: SiteSupportEntry[];
     legal: SiteLegalLink[];
+    /** A privacy/data-practices page at `/<lang>/privacy/`. `undefined`: no such page is built. */
+    privacy?: SitePrivacyConfig;
+    /** A Legal Notice / Impressum page at `/<lang>/legal-notice/`. `undefined`: no such page is built. */
+    legalNotice?: SiteLegalNoticeConfig;
     /** Sites of other apps to list under "More apps by <developer>", in order. Empty: no section. */
     relatedApps: SiteRelatedAppConfig[];
 }

package/lib/site.js

@@ -10,10 +10,10 @@ import { readableText } from './render/color.js';
 import { svgToPng } from './render/image-backend.js';
 import { processImage } from './render/images.js';
 import { ogCardSvg } from './render/og-card.js';
-import { absolute, localized, pageMeta, pageUrl, renderPage, renderRoot, renderSupportPage, supportUrl, } from './render/pages.js';
+import { absolute, legalNoticeUrl, localized, pageMeta, pageUrl, privacyUrl, renderLegalNoticePage, renderPage, renderPrivacyPage, renderRoot, renderSupportPage, supportUrl, } from './render/pages.js';
 import { renderOverview } from './render/overview.js';
 import { robotsTxt, seoWarnings, sitemapXml } from './render/seo.js';
-import { UI_SOURCE_LANGUAGE, loadCatalogs, loadSiteData, mergeCatalogs, parseMetainfo, parseSiteConfig, pickByLanguage, translator, APP_MANIFEST_FILE, buildAppManifest, } from './site-data/index.js';
+import { UI_SOURCE_LANGUAGE, loadCatalogs, loadSiteData, mergeCatalogs, parseMetainfo, parseSiteConfig, pickByLanguage, translator, APP_MANIFEST_FILE, buildAppManifest, loadLegalNoticeStatements, loadPrivacyStatements, } from './site-data/index.js';
 /**
  * This package's own directory: `lib/` holds the client bundle, `po/` the page catalogues.
  *
@@ -129,6 +129,12 @@ export async function buildSite(options) {
     const iconHref = await iconDataUri(data, target);
     const { light = '#84bbfd' } = data.app.branding;
     const hasSupport = data.config.support.length > 0;
+    const privacyStatements = data.config.privacy
+        ? await loadPrivacyStatements(data.config.privacy, target.root)
+        : undefined;
+    const legalNoticeStatements = data.config.legalNotice
+        ? await loadLegalNoticeStatements(data.config.legalNotice, target.root)
+        : undefined;
     for (const lang of data.config.languages) {
         const t = translator(catalogs[lang]);
         const ctx = { data, lang, t, assets, images, iconUrl, ogImage: `${data.config.base}og-${lang}.png` };
@@ -149,12 +155,25 @@ export async function buildSite(options) {
             await mkdir(join(target.out, lang, 'support'), { recursive: true });
             await writeFile(join(target.out, lang, 'support', 'index.html'), renderSupportPage(ctx));
         }
+        if (privacyStatements) {
+            await mkdir(join(target.out, lang, 'privacy'), { recursive: true });
+            await writeFile(join(target.out, lang, 'privacy', 'index.html'), renderPrivacyPage(ctx, privacyStatements[lang]));
+        }
+        if (legalNoticeStatements) {
+            await mkdir(join(target.out, lang, 'legal-notice'), { recursive: true });
+            await writeFile(join(target.out, lang, 'legal-notice', 'index.html'), renderLegalNoticePage(ctx, legalNoticeStatements[lang]));
+        }
     }
     const manifest = buildAppManifest(data, iconUrl ? absolute(data, iconUrl) : undefined);
     await writeFile(join(target.out, APP_MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}\n`);
     await writeFile(join(target.out, 'index.html'), renderRoot(data, assets, iconUrl));
     const address = (build) => Object.fromEntries(data.config.languages.map((lang) => [lang, absolute(data, build(data, lang))]));
-    const pages = [address(pageUrl), ...(hasSupport ? [address(supportUrl)] : [])];
+    const pages = [
+        address(pageUrl),
+        ...(hasSupport ? [address(supportUrl)] : []),
+        ...(privacyStatements ? [address(privacyUrl)] : []),
+        ...(legalNoticeStatements ? [address(legalNoticeUrl)] : []),
+    ];
     await writeFile(join(target.out, 'sitemap.xml'), sitemapXml(pages, data.config.defaultLanguage));
     // Only a site served from the host root can own `/robots.txt`; below a path the host does.
     if (data.config.base === '/') {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/site",
-    "version": "0.64.6",
+    "version": "0.64.7",
     "description": "Static landing page generator for a GNOME-style app, rendered from its AppStream metainfo — downloads, screenshots, release notes, support links, no JavaScript required.",
     "type": "module",
     "main": "lib/index.js",
@@ -54,21 +54,21 @@
     "license": "MIT",
     "dependencies": {
         "@girs/gdkpixbuf-2.0": "5.4.0",
-        "@gjsify/console": "^0.64.6",
-        "@gjsify/crypto": "^0.64.6",
-        "@gjsify/fs": "^0.64.6",
-        "@gjsify/module": "^0.64.6",
-        "@gjsify/os": "^0.64.6",
-        "@gjsify/path": "^0.64.6",
-        "@gjsify/process": "^0.64.6",
-        "@gjsify/url": "^0.64.6",
+        "@gjsify/console": "^0.64.7",
+        "@gjsify/crypto": "^0.64.7",
+        "@gjsify/fs": "^0.64.7",
+        "@gjsify/module": "^0.64.7",
+        "@gjsify/os": "^0.64.7",
+        "@gjsify/path": "^0.64.7",
+        "@gjsify/process": "^0.64.7",
+        "@gjsify/url": "^0.64.7",
         "fast-xml-parser": "^5.11.2",
         "qrcode-generator": "^2.0.4"
     },
     "devDependencies": {
-        "@gjsify/cli": "^0.64.6",
+        "@gjsify/cli": "^0.64.7",
         "@gjsify/node-gi": "file:../../node-gi/node-gi",
-        "@gjsify/unit": "^0.64.6",
+        "@gjsify/unit": "^0.64.7",
         "@types/node": "^25.9.2",
         "typescript": "^6.0.3"
     },

package/po/de.po

@@ -210,6 +210,12 @@ msgstr "Architekturen"
 msgid "by {developer}"
 msgstr "von {developer}"
 
+msgid "Legal Notice"
+msgstr "Impressum"
+
+msgid "Privacy"
+msgstr "Datenschutz"
+
 msgid "{app} is licensed under {license}."
 msgstr "{app} steht unter der Lizenz {license}."
 
@@ -222,9 +228,24 @@ msgstr "Gemacht mit {project}"
 msgid "{app} is free software. Support its development with a transfer or a service."
 msgstr "{app} ist freie Software. Unterstütze die Entwicklung per Überweisung oder über einen Dienst."
 
+msgid "What {app} does with data."
+msgstr "Was {app} mit Daten tut."
+
+msgid "Who publishes {app}, and how to reach them."
+msgstr "Wer {app} veröffentlicht, und wie man diese Person erreicht."
+
 msgid "Back to {app}"
 msgstr "Zurück zu {app}"
 
+msgid "This page is a static file: no cookie, no analytics, nothing from a third party."
+msgstr "Diese Seite ist eine statische Datei: keine Cookies, keine Analysewerkzeuge, nichts von Drittanbietern."
+
+msgid "Whoever serves it may keep ordinary web-server access logs of the request."
+msgstr "Wer sie bereitstellt, kann dabei die üblichen Zugriffsprotokolle eines Webservers führen."
+
+msgid "See the hosting provider's notice"
+msgstr "Hinweis des Hosting-Anbieters"
+
 msgid "Flathub"
 msgstr "Flathub"
 

package/po/site.pot

@@ -209,6 +209,12 @@ msgstr ""
 msgid "by {developer}"
 msgstr ""
 
+msgid "Legal Notice"
+msgstr ""
+
+msgid "Privacy"
+msgstr ""
+
 msgid "{app} is licensed under {license}."
 msgstr ""
 
@@ -221,9 +227,24 @@ msgstr ""
 msgid "{app} is free software. Support its development with a transfer or a service."
 msgstr ""
 
+msgid "What {app} does with data."
+msgstr ""
+
+msgid "Who publishes {app}, and how to reach them."
+msgstr ""
+
 msgid "Back to {app}"
 msgstr ""
 
+msgid "This page is a static file: no cookie, no analytics, nothing from a third party."
+msgstr ""
+
+msgid "Whoever serves it may keep ordinary web-server access logs of the request."
+msgstr ""
+
+msgid "See the hosting provider's notice"
+msgstr ""
+
 msgid "Flathub"
 msgstr ""