@haruhimemoe/next-kit 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -6,6 +6,21 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-10-05
+
+### Added
+- `legal` entry point: the five-page legal convention every service ships (terms, privacy, your-privacy-rights, copyright, disclaimers). A `LegalSite` config (site name, operator, contact email, effective date, data stores, processors, cookies), seven plain server-safe blocks an app drops into its own legal MDX (`LegalContact`, `DataWeKeep`, `Processors`, `YourRights`, `DmcaNotice`, `NoWarranty`, `Changes`; no hooks, no `@haruhimemoe/ui`), and `legalEntries(site, pages?)` for the five standard `ContentEntry` records so apps stop hand-writing the same titles and descriptions. next-kit's first `.tsx` entry point. `LegalSite.hosting` adds an optional line to `DmcaNotice`; `Changes` takes an optional per-page `date`.
+
+### Changed
+- The `@haruhimemoe/ui` peer range also allows `^0.18.0`.
+
+## [0.8.0] - 2026-10-05
+
+### Changed
+- **Breaking.** The `@haruhimemoe/ui` peer range is now `^0.14.0 || ^0.15.0 || ^0.16.0 || ^0.17.0` (0.15 to 0.17 not yet published): `DeleteAccountForm` needs ui's `ConfirmDialog`.
+- `DeleteAccountForm` is a "Delete my account" button that opens a dialog: what goes is its description, the username is typed there, and a refusal or no answer is said in the dialog, which stays open. Once the account is deleted, focus moves to the "Your account is deleted." line.
+- The account components use ui's text tones (`Text`, `textClasses`) and Button's own width. No change in how they look.
+
 ## [0.7.0] - 2026-10-05
 
 ### Added
@@ -89,7 +104,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - `@haruhimemoe/next-kit/auth-react`: `createSignedInMarker`, `createAccountStore`, `useAccount`, `createAccount`, `RestoreSignedIn` and `osuSignIn`.
 - `@haruhimemoe/next-kit/testing`: `startMemoryMongo`, `setupTestDb`, `setupMsw` and the fake osu! app env.
 
-[unreleased]: https://github.com/haruhimemoe/next-kit/compare/v0.6.2...HEAD
+[unreleased]: https://github.com/haruhimemoe/next-kit/compare/v0.8.0...HEAD
+[0.8.0]: https://github.com/haruhimemoe/next-kit/compare/v0.7.0...v0.8.0
 [0.6.2]: https://github.com/haruhimemoe/next-kit/compare/v0.6.1...v0.6.2
 [0.6.1]: https://github.com/haruhimemoe/next-kit/compare/v0.6.0...v0.6.1
 [0.6.0]: https://github.com/haruhimemoe/next-kit/compare/v0.5.0...v0.6.0

package/README.md

@@ -13,6 +13,7 @@ The Next.js server plumbing the haruhime.moe tools share. [packs.haruhime.moe](h
 - **`/testing`:** Vitest helpers: one in-memory MongoDB per run, an msw server that refuses unhandled requests, and a fake env.
 - **`/api-keys`:** the shared key format (an app prefix like `hpk_` plus 32 random bytes), a key store over `api_keys`, and the `/api/v1` guard with the standard limits.
 - **`/docs`:** a content registry for an app's docs, guides and legal pages: sections, entries, app-made extra entries (like bb's tag pages), the path helpers a dynamic route needs, and `mdxToMarkdown` to turn bb-flavored MDX into plain Markdown. No runtime imports. **`/docs/files`:** reads the markdown files a registry's entries point at and reports drift between the registry and disk (node:fs).
+- **`/legal`:** the five-page legal convention (terms, privacy, your-privacy-rights, copyright, disclaimers). A `LegalSite` config, seven plain server-safe blocks (`LegalContact`, `DataWeKeep`, `Processors`, `YourRights`, `DmcaNotice`, `NoWarranty`, `Changes`) an app drops into its own legal MDX, and `legalEntries` for the app's content registry.
 - **`/vcs`:** document history in MongoDB on top of `@haruhimemoe/vcs`: one line of revisions per document, saves merged onto whatever landed since their base, revert, diffs, and autosave pruning.
 
 Every name, path, limit and message comes from the caller. There is no root entry point; import a subpath.
@@ -32,12 +33,13 @@ bun add @haruhimemoe/next-kit zod
 | `env` | nothing else |
 | `mongo` | `mongodb` ^7.6.0, `mongoose` ^9.10.2 |
 | `auth` | `better-auth` ^1.7.5, `mongodb`, `@haruhimemoe/osu` 0.2 or 0.3 |
-| `auth-react` | `react` ^19.3.0, `next` ^16.3.6, `@haruhimemoe/ui` ^0.5.0 \|\| ^0.6.0 \|\| ^0.7.0 \|\| ^0.8.0 \|\| ^0.9.0 \|\| ^0.10.0 \|\| ^0.11.0 \|\| ^0.12.0 \|\| ^0.13.0 (with its theme set up) |
+| `auth-react` | `react` ^19.3.0, `next` ^16.3.6, `@haruhimemoe/ui` ^0.14.0 \|\| ^0.15.0 \|\| ^0.16.0 \|\| ^0.17.0 (with its theme set up) |
 | `seo` | `next` ^16.3.6 types only (nothing loads at runtime) |
 | `testing` | `vitest` ^5.0.1, `msw` ^2.15.0, `mongodb-memory-server` ^11.3.0 |
 | `api-keys` | `mongodb` ^7.6.0 |
 | `docs` | nothing else |
 | `docs/files` | nothing else (`node:fs` is built in) |
+| `legal` | `react` ^19.3.0 (types only, for JSX) |
 | `vcs` | `mongodb` ^7.6.0, `@haruhimemoe/vcs` ^0.1.0 |
 
 ## Use
@@ -304,7 +306,7 @@ The command prints one `pass` or `FAIL` line per standard, names each missing fi
 | `SignInWithOsu({ next, signIn, signInPath?, label?, pendingLabel?, failedMessage? })` | Since 0.2.0. The large "Sign in with osu!" button. Calls `signIn(osuSignIn(next))`; an error (better-auth's `{ message }` or `{ error: { message } }`, or a throw) shows in a `role="alert"` line and the button comes back. `signInErrorMessage(error, fallback?)` reads it. |
 | `SignOutButton({ signOut, onSignedOut, redirectTo?, variant?, className?, label?, pendingLabel? })` | Since 0.2.0. Signs out, runs `onSignedOut` only once the session is gone, then `router.replace(redirectTo ?? "/")` and `router.refresh()`. |
 | `AccountMenu({ account, items, signOut, onSignedOut, avatarSrc?, signInPath?, signInLabel?, signOutLabel?, signOutRedirect? })` | Since 0.2.0. A sized blank while loading, a "Sign in" link back to this page when signed out, else ui's `HeaderMenu` with the avatar and name, `items` and Sign out. The avatar is a plain `<img>` (your CSP's img-src must allow a.ppy.sh and osu.ppy.sh); `avatarSrc` defaults to `osuAvatarSrc`. |
-| `DeleteAccountForm({ username, appName, deletes, onDeleted, endpoint?, homeHref?, homeLabel?, fetcher? })` | Since 0.2.0. ui's `TypeToConfirm` on the username, then `DELETE endpoint` (default `/api/account`) with `{ username }`. 204: `onDeleted`, "Your account is deleted." and home. Another 2xx: `onDeleted` and the answer's `notice` after that line, staying. A refusal shows `error.message` (else "Deleting failed (status)."); no answer, "Couldn't reach <appName>. Your account is still there." `deletes` is inline content in a `<p>`. |
+| `DeleteAccountForm({ username, appName, deletes, onDeleted, endpoint?, homeHref?, homeLabel?, fetcher? })` | Since 0.2.0. A "Delete my account" button (0.8.0; an in-page `TypeToConfirm` before) that opens ui's `ConfirmDialog`: `deletes` is its description, the username must be typed, then "Delete for good" sends `DELETE endpoint` (default `/api/account`) with `{ username }`. 204: `onDeleted`, "Your account is deleted." (focused) and home. Another 2xx: `onDeleted` and the answer's `notice` after that line, staying. A refusal shows `error.message` (else "Deleting failed (status).") in the dialog; no answer, "Couldn't reach <appName>. Your account is still there." The dialog stays open on both. Needs ui 0.14.0. |
 | `osuAvatarSrc(url)`, `OSU_AVATAR_HOSTS` | Since 0.2.0. An osu! avatar URL on https when it's on a.ppy.sh or osu.ppy.sh (a bare path is osu.ppy.sh's), else null. |
 
 ### seo
@@ -393,6 +395,16 @@ No runtime imports.
 | `readContentMarkdown(content, section, slug, { root?, siteUrl, transforms? })` | Reads a registered entry's markdown file and converts it with `mdxToMarkdown` (using the entry's `title`). `root` defaults to `process.cwd()`. Returns null for an unregistered slug; rejects (ENOENT) when the slug is registered but its file is missing. |
 | `contentFileDrift(content, { root? })` | `{ missingFiles, unregistered }`: `missingFiles` lists registered entries with no file on disk (like `"guides/x.mdx"`); `unregistered` lists `.mdx` files on disk with no registry entry. `root` defaults to `process.cwd()`. |
 
+### legal
+
+| Export | What it does |
+| --- | --- |
+| `LEGAL_SLUGS`, `LegalSlug` | The five standard legal page slugs, in order: `"terms"`, `"privacy"`, `"your-privacy-rights"`, `"copyright"`, `"disclaimers"`. |
+| `LegalSite` | The config every block and `legalEntries` renders from: `siteName`, `operator`, `contactEmail`, `effectiveDate` (`YYYY-MM-DD`), `stores` (`LegalDataStore[]`), `processors` (`LegalProcessor[]`), `cookies` (`string[]`), optional `hosting` (one sentence on what users can post, shown by `DmcaNotice`). |
+| `LegalDataStore`, `LegalProcessor` | One kind of data kept (`what`, `why`), and one third party that processes it (`name`, `purpose`, `link?`). |
+| `LegalContact`, `DataWeKeep`, `Processors`, `YourRights`, `DmcaNotice`, `NoWarranty`, `Changes` | The seven blocks. Each takes `{ site: LegalSite }` and renders plain semantic HTML (no `@haruhimemoe/ui`), so it inherits the app's MDX prose styling. `DataWeKeep` skips the cookies list when `site.cookies` is empty. `Processors` links a processor that has a `link`, and plain-texts one that doesn't. `DmcaNotice` prints `site.hosting` only when set. `Changes` also takes an optional `date` for a page updated on its own day. |
+| `legalEntries(site, pages?)` | The five `ContentEntry` records (`docs`'s registry shape) for the legal convention, with the default title and description (`site.siteName` filled in) and `lastUpdated` set to `site.effectiveDate`. `pages` overrides any field per slug; everything else keeps the default. |
+
 ### vcs
 
 | Export | What it does |

package/dist/auth-react/AccountMenu.d.ts

@@ -9,7 +9,7 @@
  *       (src/components/layout/AccountMenu.tsx), which differed only in the links.
  * @author David @dvhsh (https://dvh.sh)
  * @created Mon Sep 28, 2026
- * @modified Mon Sep 28, 2026
+ * @modified Mon Oct 5, 2026
  */
 import { type HeaderMenuItem } from "@haruhimemoe/ui";
 import type { ReactNode } from "react";

package/dist/auth-react/AccountMenu.js

@@ -9,11 +9,11 @@
  *       (src/components/layout/AccountMenu.tsx), which differed only in the links.
  * @author David @dvhsh (https://dvh.sh)
  * @created Mon Sep 28, 2026
- * @modified Mon Sep 28, 2026
+ * @modified Mon Oct 5, 2026
  */
 "use client";
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { HeaderMenu } from "@haruhimemoe/ui";
+import { HeaderMenu, textClasses } from "@haruhimemoe/ui";
 import { usePathname } from "next/navigation.js";
 import { DEFAULT_SIGN_IN_PATH, signInHref } from "../server/safe-next.js";
 import { osuAvatarSrc } from "./avatar.js";
@@ -29,7 +29,11 @@ export function AccountMenu({ account, items, signOut, onSignedOut, avatarSrc =
     if (account.status === "loading")
         return _jsx("span", { "aria-hidden": "true", className: "block h-7 w-16" });
     if (account.status === "signed-out") {
-        return (_jsx("a", { href: signInHref(pathname || "/", signInPath), className: "font-bold text-c3 text-sm transition-colors hover:text-c1", children: signInLabel }));
+        return (_jsx("a", { href: signInHref(pathname || "/", signInPath), className: textClasses({
+                tone: "muted",
+                bold: true,
+                className: "transition-colors hover:text-c1",
+            }), children: signInLabel }));
     }
     const avatar = avatarSrc(account.user.avatarUrl);
     return (_jsx(HeaderMenu, { label: _jsxs(_Fragment, { children: [avatar ? (_jsx("img", { src: avatar, alt: "", width: 28, height: 28, className: "rounded-full" })) : null, _jsx("span", { children: account.user.username })] }), items: items, children: _jsx(SignOutButton, { signOut: signOut, onSignedOut: onSignedOut, redirectTo: signOutRedirect, label: signOutLabel, variant: "ghost", className: "h-auto justify-start rounded px-3 py-2" }) }));

package/dist/auth-react/DeleteAccountForm.d.ts

@@ -1,15 +1,16 @@
 /**
  * @file src/auth-react/DeleteAccountForm.tsx
- * @desc "Delete my account". The confirmation is built into the page (ui's TypeToConfirm, no
- *       confirm() dialog): the button stays off until the osu! username is typed exactly, then
- *       one DELETE to the app's endpoint carries it. 204 means gone: signed out, the page says
- *       so and goes home. Another 2xx is gone too but stays, to show the answer's `notice` (work
- *       still waiting elsewhere). A refusal says the server's message, and no answer says the app
- *       couldn't be reached; nothing was deleted. The form never comes back once it's gone.
+ * @desc "Delete my account": a button that opens ui's ConfirmDialog (no confirm()), where what
+ *       goes is the description and the osu! username is typed before "Delete for good" sends one
+ *       DELETE with it to the app's endpoint. 204 means gone: signed out, the page says so and
+ *       goes home. Another 2xx is gone too but stays, to show the answer's `notice` (work still
+ *       waiting elsewhere). A refusal says the server's message in the dialog, no answer says the
+ *       app couldn't be reached, nothing was deleted and the dialog stays open. Once it's gone
+ *       the button never comes back and focus lands on the line that says so.
  *       Moved from pools and bb (src/components/account/DeleteAccountForm.tsx).
  * @author David @dvhsh (https://dvh.sh)
  * @created Mon Sep 28, 2026
- * @modified Mon Sep 28, 2026
+ * @modified Mon Oct 5, 2026
  */
 import { type ReactNode } from "react";
 /** DeleteAccountForm's props. */
@@ -35,6 +36,6 @@ export type DeleteAccountFormProps = {
  * @function DeleteAccountForm
  * @param props {DeleteAccountFormProps} the username, the app's name, what goes, the endpoint
  *        and what to do after
- * @returns {ReactNode} the typed-name confirmation, or what happened
+ * @returns {ReactNode} the "Delete my account" trigger and its confirm dialog, or what happened
  */
 export declare function DeleteAccountForm({ username, appName, deletes, onDeleted, endpoint, homeHref, homeLabel, fetcher, }: DeleteAccountFormProps): ReactNode;

package/dist/auth-react/DeleteAccountForm.js

@@ -1,19 +1,20 @@
 /**
  * @file src/auth-react/DeleteAccountForm.tsx
- * @desc "Delete my account". The confirmation is built into the page (ui's TypeToConfirm, no
- *       confirm() dialog): the button stays off until the osu! username is typed exactly, then
- *       one DELETE to the app's endpoint carries it. 204 means gone: signed out, the page says
- *       so and goes home. Another 2xx is gone too but stays, to show the answer's `notice` (work
- *       still waiting elsewhere). A refusal says the server's message, and no answer says the app
- *       couldn't be reached; nothing was deleted. The form never comes back once it's gone.
+ * @desc "Delete my account": a button that opens ui's ConfirmDialog (no confirm()), where what
+ *       goes is the description and the osu! username is typed before "Delete for good" sends one
+ *       DELETE with it to the app's endpoint. 204 means gone: signed out, the page says so and
+ *       goes home. Another 2xx is gone too but stays, to show the answer's `notice` (work still
+ *       waiting elsewhere). A refusal says the server's message in the dialog, no answer says the
+ *       app couldn't be reached, nothing was deleted and the dialog stays open. Once it's gone
+ *       the button never comes back and focus lands on the line that says so.
  *       Moved from pools and bb (src/components/account/DeleteAccountForm.tsx).
  * @author David @dvhsh (https://dvh.sh)
  * @created Mon Sep 28, 2026
- * @modified Mon Sep 28, 2026
+ * @modified Mon Oct 5, 2026
  */
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { buttonClasses, TypeToConfirm } from "@haruhimemoe/ui";
+import { buttonClasses, ConfirmDialog } from "@haruhimemoe/ui";
 import { useRouter } from "next/navigation.js";
 import { useId, useState } from "react";
 const messageOf = async (response) => {
@@ -30,41 +31,40 @@ const messageOf = async (response) => {
  * @function DeleteAccountForm
  * @param props {DeleteAccountFormProps} the username, the app's name, what goes, the endpoint
  *        and what to do after
- * @returns {ReactNode} the typed-name confirmation, or what happened
+ * @returns {ReactNode} the "Delete my account" trigger and its confirm dialog, or what happened
  */
 export function DeleteAccountForm({ username, appName, deletes, onDeleted, endpoint = "/api/account", homeHref = "/", homeLabel = "Go to the home page", fetcher = fetch, }) {
     const router = useRouter();
-    const id = useId();
-    const [error, setError] = useState(null);
-    // Once it's gone: what more to say. The form doesn't come back, so no second delete.
+    const doneId = `${useId()}-done`;
+    // Once it's gone: what more to say. The button doesn't come back, so no second delete.
     const [done, setDone] = useState(null);
+    const unreachable = `Couldn't reach ${appName}. Your account is still there.`;
+    // Throws to keep the dialog open with what went wrong.
     const remove = async () => {
-        setError(null);
+        let response;
         try {
-            const response = await fetcher(endpoint, {
+            response = await fetcher(endpoint, {
                 method: "DELETE",
                 headers: { "Content-Type": "application/json" },
                 body: JSON.stringify({ username }),
             });
-            if (!response.ok) {
-                setError(await messageOf(response));
-                return;
-            }
-            onDeleted();
-            if (response.status === 204) {
-                setDone("");
-                router.push(homeHref);
-                return;
-            }
-            const body = (await response.json().catch(() => ({})));
-            setDone(typeof body.notice === "string" ? body.notice : "");
         }
         catch {
-            setError(`Couldn't reach ${appName}. Your account is still there.`);
+            throw new Error(unreachable);
         }
+        if (!response.ok)
+            throw new Error(await messageOf(response));
+        onDeleted();
+        if (response.status === 204) {
+            setDone("");
+            router.push(homeHref);
+            return;
+        }
+        const body = (await response.json().catch(() => ({})));
+        setDone(typeof body.notice === "string" ? body.notice : "");
     };
     if (done !== null) {
-        return (_jsxs("div", { className: "flex flex-col gap-3", children: [_jsx("p", { role: "status", className: "text-c2 text-sm", children: `Your account is deleted. ${done}`.trim() }), _jsx("a", { href: homeHref, className: buttonClasses({ variant: "secondary", className: "self-start" }), children: homeLabel })] }));
+        return (_jsxs("div", { className: "flex flex-col gap-3", children: [_jsx("p", { id: doneId, role: "status", tabIndex: -1, className: "text-c2 text-sm outline-none", children: `Your account is deleted. ${done}`.trim() }), _jsx("a", { href: homeHref, className: buttonClasses({ variant: "secondary" }), children: homeLabel })] }));
     }
-    return (_jsx(TypeToConfirm, { id: id, expected: username, submitLabel: "Delete my account", pendingLabel: "Deleting\u2026", error: error, onConfirm: remove, children: _jsx("p", { className: "text-c2 text-sm", children: deletes }) }));
+    return (_jsx(ConfirmDialog, { trigger: "Delete my account", triggerProps: { variant: "danger" }, title: "Delete your account?", description: deletes, tone: "destructive", typeToConfirm: username, confirmLabel: "Delete for good", pendingLabel: "Deleting\u2026", failedMessage: (error) => (error instanceof Error ? error.message : unreachable), returnFocus: () => document.getElementById(doneId), onConfirm: remove }));
 }

package/dist/auth-react/RestoreSignedIn.d.ts

@@ -7,7 +7,7 @@
  *       and pools (src/components/auth/RestoreSignedIn.tsx, body-identical).
  * @author David @dvhsh (https://dvh.sh)
  * @created Mon Sep 28, 2026
- * @modified Mon Sep 28, 2026
+ * @modified Mon Oct 5, 2026
  */
 import { type ReactNode } from "react";
 /** RestoreSignedIn's props. */

package/dist/auth-react/RestoreSignedIn.js

@@ -7,14 +7,15 @@
  *       and pools (src/components/auth/RestoreSignedIn.tsx, body-identical).
  * @author David @dvhsh (https://dvh.sh)
  * @created Mon Sep 28, 2026
- * @modified Mon Sep 28, 2026
+ * @modified Mon Oct 5, 2026
  */
 "use client";
 import { jsx as _jsx } from "react/jsx-runtime";
+import { Text } from "@haruhimemoe/ui";
 import { useRouter } from "next/navigation.js";
 import { useEffect } from "react";
 const readDocumentCookie = () => document.cookie;
-const SIGNING_IN = _jsx("p", { className: "text-c3 text-sm", children: "Signing you in\u2026" });
+const SIGNING_IN = _jsx(Text, { tone: "muted", children: "Signing you in\u2026" });
 /**
  * @function RestoreSignedIn
  * @param props {RestoreSignedInProps} the store, the marker check, `next` and what to show

package/dist/auth-react/SignInWithOsu.d.ts

@@ -7,7 +7,7 @@
  *       (src/components/auth/SignInWithOsu.tsx), where only the error reading differed.
  * @author David @dvhsh (https://dvh.sh)
  * @created Mon Sep 28, 2026
- * @modified Mon Sep 28, 2026
+ * @modified Mon Oct 5, 2026
  */
 import { type ReactNode } from "react";
 import { type OsuSignIn } from "./sign-in.js";

package/dist/auth-react/SignInWithOsu.js

@@ -7,11 +7,11 @@
  *       (src/components/auth/SignInWithOsu.tsx), where only the error reading differed.
  * @author David @dvhsh (https://dvh.sh)
  * @created Mon Sep 28, 2026
- * @modified Mon Sep 28, 2026
+ * @modified Mon Oct 5, 2026
  */
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { Button } from "@haruhimemoe/ui";
+import { Button, Text } from "@haruhimemoe/ui";
 import { useState } from "react";
 import { osuSignIn } from "./sign-in.js";
 const FAILED = "Couldn't start osu! sign-in. Try again.";
@@ -54,5 +54,5 @@ export function SignInWithOsu({ next, signIn, signInPath, label = "Sign in with
         }
         setPending(false);
     };
-    return (_jsxs("div", { className: "flex flex-col items-center gap-2", children: [_jsx(Button, { size: "lg", onClick: onClick, disabled: pending, children: pending ? pendingLabel : label }), error ? (_jsx("p", { role: "alert", className: "font-bold text-rose-300 text-sm", children: error })) : null] }));
+    return (_jsxs("div", { className: "flex flex-col items-center gap-2", children: [_jsx(Button, { size: "lg", onClick: onClick, disabled: pending, children: pending ? pendingLabel : label }), error ? (_jsx(Text, { role: "alert", tone: "error", bold: true, children: error })) : null] }));
 }

package/dist/legal/blocks.d.ts

@@ -0,0 +1,62 @@
+/**
+ * @file src/legal/blocks.tsx
+ * @desc The seven legal blocks: plain server-safe React (no hooks) an app drops into its own
+ *       legal MDX pages, rendered from a `LegalSite` config instead of hand-written boilerplate.
+ *       Semantic HTML only (section, h2, p, ul, a), so it inherits the app's MDX prose styling.
+ *       No `@haruhimemoe/ui` dependency: these are plain text blocks, not UI components.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+import type { ReactElement } from "react";
+import type { LegalSite } from "./types.js";
+/** Every block's props: the site config it renders from. */
+export type LegalBlockProps = {
+    site: LegalSite;
+};
+/** `Changes` props: the site config, plus this page's own date when it differs from the site's. */
+export type ChangesProps = LegalBlockProps & {
+    date?: string | undefined;
+};
+/**
+ * @function LegalContact
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} who runs the site and the address for legal questions
+ */
+export declare const LegalContact: ({ site }: LegalBlockProps) => ReactElement;
+/**
+ * @function DataWeKeep
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} what the app stores and why, plus the cookies it sets
+ */
+export declare const DataWeKeep: ({ site }: LegalBlockProps) => ReactElement;
+/**
+ * @function Processors
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the third parties that process data on the app's behalf
+ */
+export declare const Processors: ({ site }: LegalBlockProps) => ReactElement;
+/**
+ * @function YourRights
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the GDPR and CCPA rights every visitor has, and how to use them
+ */
+export declare const YourRights: ({ site }: LegalBlockProps) => ReactElement;
+/**
+ * @function DmcaNotice
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the DMCA agent, and the notice and counter-notice steps
+ */
+export declare const DmcaNotice: ({ site }: LegalBlockProps) => ReactElement;
+/**
+ * @function NoWarranty
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the "as is" warranty disclaimer and limitation of liability
+ */
+export declare const NoWarranty: ({ site }: LegalBlockProps) => ReactElement;
+/**
+ * @function Changes
+ * @param props {ChangesProps} the site config and an optional per-page date
+ * @returns {ReactElement} the standard "we may update this page" line with its effective date
+ */
+export declare const Changes: ({ site, date }: ChangesProps) => ReactElement;

package/dist/legal/blocks.js

@@ -0,0 +1,43 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * @function LegalContact
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} who runs the site and the address for legal questions
+ */
+export const LegalContact = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Contact" }), _jsxs("p", { children: [site.operator, " runs ", site.siteName, ". For anything on this page, write to", " ", _jsx("a", { href: `mailto:${site.contactEmail}`, children: site.contactEmail }), "."] })] }));
+/**
+ * @function DataWeKeep
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} what the app stores and why, plus the cookies it sets
+ */
+export const DataWeKeep = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "What we store" }), _jsx("ul", { children: site.stores.map((store) => (_jsxs("li", { children: [_jsxs("strong", { children: [store.what, "."] }), " ", store.why] }, store.what))) }), site.cookies.length > 0 && (_jsxs(_Fragment, { children: [_jsx("h3", { children: "Cookies" }), _jsx("ul", { children: site.cookies.map((cookie) => (_jsx("li", { children: cookie }, cookie))) })] }))] }));
+/**
+ * @function Processors
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the third parties that process data on the app's behalf
+ */
+export const Processors = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Service providers" }), _jsx("ul", { children: site.processors.map((processor) => (_jsxs("li", { children: [_jsx("strong", { children: processor.link ? _jsx("a", { href: processor.link, children: processor.name }) : processor.name }), " ", processor.purpose] }, processor.name))) })] }));
+/**
+ * @function YourRights
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the GDPR and CCPA rights every visitor has, and how to use them
+ */
+export const YourRights = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Your rights under the GDPR" }), _jsxs("ul", { children: [_jsxs("li", { children: [_jsx("strong", { children: "Access and portability." }), " Get a copy of your data in a machine-readable file."] }), _jsxs("li", { children: [_jsx("strong", { children: "Rectification." }), " Have wrong data corrected."] }), _jsxs("li", { children: [_jsx("strong", { children: "Erasure." }), " Have your data deleted."] }), _jsxs("li", { children: [_jsx("strong", { children: "Restriction." }), " Ask us to pause using your data while a question about it is sorted out."] }), _jsxs("li", { children: [_jsx("strong", { children: "Objection." }), " Object to anything we do on the basis of legitimate interest."] }), _jsxs("li", { children: [_jsx("strong", { children: "Complaint." }), " Complain to your data protection supervisory authority."] })] }), _jsx("h2", { children: "Your rights under the CCPA" }), _jsxs("ul", { children: [_jsxs("li", { children: [_jsx("strong", { children: "Know, delete and correct." }), " Ask what we hold about you, ask us to delete it, and ask us to correct it."] }), _jsxs("li", { children: [_jsx("strong", { children: "Selling and sharing." }), " We don't sell or share personal information."] }), _jsxs("li", { children: [_jsx("strong", { children: "Opting out." }), " We honor Global Privacy Control signals."] })] }), _jsxs("p", { children: ["To use any of these rights, email", " ", _jsx("a", { href: `mailto:${site.contactEmail}`, children: site.contactEmail }), "."] })] }));
+/**
+ * @function DmcaNotice
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the DMCA agent, and the notice and counter-notice steps
+ */
+export const DmcaNotice = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Copyright and DMCA" }), site.hosting ? _jsx("p", { children: site.hosting }) : null, _jsxs("p", { children: ["Our designated agent for copyright notices is", " ", _jsx("a", { href: `mailto:${site.contactEmail}`, children: site.contactEmail }), "."] }), _jsx("h3", { children: "A takedown notice should include" }), _jsxs("ol", { children: [_jsx("li", { children: "your contact information;" }), _jsx("li", { children: "the copyrighted work you believe is infringed;" }), _jsx("li", { children: "the URL or page the material appears on;" }), _jsx("li", { children: "a good-faith statement that the use is not authorized;" }), _jsx("li", { children: "a sworn statement that you're the rights holder, or authorized to act for them;" }), _jsx("li", { children: "your physical or electronic signature." })] }), _jsx("h3", { children: "A counter-notice should include" }), _jsxs("ol", { children: [_jsx("li", { children: "your contact information;" }), _jsx("li", { children: "the material removed and where it appeared;" }), _jsx("li", { children: "a sworn, good-faith statement that it was removed by mistake or misidentification;" }), _jsxs("li", { children: ["your consent to the jurisdiction of your local courts, or ", site.operator, "'s;"] }), _jsx("li", { children: "your physical or electronic signature." })] })] }));
+/**
+ * @function NoWarranty
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the "as is" warranty disclaimer and limitation of liability
+ */
+export const NoWarranty = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Disclaimer of warranties" }), _jsxs("p", { children: [site.siteName, " is provided \"as is\" and \"as available\", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose and non-infringement."] }), _jsx("h2", { children: "Limitation of liability" }), _jsxs("p", { children: ["To the fullest extent the law allows, ", site.operator, " is not liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of data or accounts, arising from your use of ", site.siteName, "."] })] }));
+/**
+ * @function Changes
+ * @param props {ChangesProps} the site config and an optional per-page date
+ * @returns {ReactElement} the standard "we may update this page" line with its effective date
+ */
+export const Changes = ({ site, date }) => (_jsxs("section", { children: [_jsx("h2", { children: "Changes" }), _jsxs("p", { children: ["We may update this page. It was last updated on ", date ?? site.effectiveDate, "."] })] }));

package/dist/legal/entries.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @file src/legal/entries.ts
+ * @desc legalEntries: the five standard `ContentEntry` records (`docs`'s registry shape) for the
+ *       five-page legal convention, so apps stop hand-writing the same titles and descriptions.
+ *       An app overrides any field per slug through `pages`; unlisted fields keep the default.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+import type { ContentEntry } from "../docs/registry.js";
+import { type LegalSite, type LegalSlug } from "./types.js";
+/** Per-slug overrides for any `ContentEntry` field, keyed by `LegalSlug`. */
+export type LegalPageOverrides = Partial<Record<LegalSlug, Partial<ContentEntry>>>;
+/**
+ * @function legalEntries
+ * @param site {LegalSite} the site config; `siteName` fills the default descriptions
+ * @param pages {LegalPageOverrides} [pages] per-slug overrides (a different description, a
+ *   `navTitle`, a page-specific `lastUpdated`); omitted fields keep the default
+ * @returns {ContentEntry[]} the five entries, in `LEGAL_SLUGS` order, ready for the `legal` array
+ *   an app's content registry (`defineContent`) takes
+ */
+export declare const legalEntries: (site: LegalSite, pages?: LegalPageOverrides) => ContentEntry[];

package/dist/legal/entries.js

@@ -0,0 +1,45 @@
+/**
+ * @file src/legal/entries.ts
+ * @desc legalEntries: the five standard `ContentEntry` records (`docs`'s registry shape) for the
+ *       five-page legal convention, so apps stop hand-writing the same titles and descriptions.
+ *       An app overrides any field per slug through `pages`; unlisted fields keep the default.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+import { LEGAL_SLUGS } from "./types.js";
+/** The default title and description for each of the five legal slugs. */
+const DEFAULTS = {
+    terms: { title: "Terms of Service", description: "The rules for using {site}." },
+    privacy: { title: "Privacy Policy", description: "What {site} stores and why." },
+    "your-privacy-rights": {
+        title: "GDPR & CCPA",
+        description: "Your rights over your data under the GDPR and the CCPA, and how to use them.",
+    },
+    copyright: {
+        title: "Copyright & Takedown",
+        description: "How to report a copyright concern, and where to send a DMCA notice.",
+    },
+    disclaimers: {
+        title: "Disclaimers",
+        description: "Who {site} isn't affiliated with, and what it doesn't promise.",
+    },
+};
+/**
+ * @function legalEntries
+ * @param site {LegalSite} the site config; `siteName` fills the default descriptions
+ * @param pages {LegalPageOverrides} [pages] per-slug overrides (a different description, a
+ *   `navTitle`, a page-specific `lastUpdated`); omitted fields keep the default
+ * @returns {ContentEntry[]} the five entries, in `LEGAL_SLUGS` order, ready for the `legal` array
+ *   an app's content registry (`defineContent`) takes
+ */
+export const legalEntries = (site, pages) => LEGAL_SLUGS.map((slug) => {
+    const fallback = DEFAULTS[slug];
+    return {
+        slug,
+        title: fallback.title,
+        description: fallback.description.replace("{site}", site.siteName),
+        lastUpdated: site.effectiveDate,
+        ...pages?.[slug],
+    };
+});

package/dist/legal/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @file src/legal/index.ts
+ * @desc @haruhimemoe/next-kit/legal: the five-page legal convention (terms, privacy,
+ *       your-privacy-rights, copyright, disclaimers). `LegalSite` config, seven MDX blocks
+ *       rendered from it, and `legalEntries` for the app's content registry.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+export { Changes, type ChangesProps, DataWeKeep, DmcaNotice, type LegalBlockProps, LegalContact, NoWarranty, Processors, YourRights, } from "./blocks.js";
+export { type LegalPageOverrides, legalEntries } from "./entries.js";
+export { LEGAL_SLUGS, type LegalDataStore, type LegalProcessor, type LegalSite, type LegalSlug, } from "./types.js";

package/dist/legal/index.js

@@ -0,0 +1,12 @@
+/**
+ * @file src/legal/index.ts
+ * @desc @haruhimemoe/next-kit/legal: the five-page legal convention (terms, privacy,
+ *       your-privacy-rights, copyright, disclaimers). `LegalSite` config, seven MDX blocks
+ *       rendered from it, and `legalEntries` for the app's content registry.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+export { Changes, DataWeKeep, DmcaNotice, LegalContact, NoWarranty, Processors, YourRights, } from "./blocks.js";
+export { legalEntries } from "./entries.js";
+export { LEGAL_SLUGS, } from "./types.js";

package/dist/legal/types.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @file src/legal/types.ts
+ * @desc LegalSite: the per-app config the legal blocks and legalEntries render from. No site
+ *       name, URL, email or data list is hardcoded here; every app passes its own.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+/** A third party that processes data on the app's behalf, like Vercel or MongoDB Atlas. */
+export type LegalProcessor = {
+    name: string;
+    purpose: string;
+    link?: string;
+};
+/** One kind of data the app stores, and why. */
+export type LegalDataStore = {
+    what: string;
+    why: string;
+};
+/** The five standard legal page slugs every service ships, in the order they're listed. */
+export declare const LEGAL_SLUGS: readonly ["terms", "privacy", "your-privacy-rights", "copyright", "disclaimers"];
+/** One of `LEGAL_SLUGS`. */
+export type LegalSlug = (typeof LEGAL_SLUGS)[number];
+/** The config every legal block and `legalEntries` renders from. */
+export type LegalSite = {
+    /** The site's display name, like "packs.haruhime.moe". */
+    siteName: string;
+    /** Who runs the site, for the contact and "who's responsible" lines. */
+    operator: string;
+    /** Where a legal request, question or notice goes. */
+    contactEmail: string;
+    /** YYYY-MM-DD. Shown as this page's "last updated" date by `Changes`. */
+    effectiveDate: string;
+    /** What the app keeps, in `DataWeKeep`'s order. */
+    stores: readonly LegalDataStore[];
+    /** Who processes data on the app's behalf, in `Processors`'s order. */
+    processors: readonly LegalProcessor[];
+    /** The cookies the app sets, one line each, in `DataWeKeep`'s cookie list. */
+    cookies: readonly string[];
+    /** One sentence on what users can post or upload, shown by `DmcaNotice`. Omitted: no line. */
+    hosting?: string | undefined;
+};

package/dist/legal/types.js

@@ -0,0 +1,16 @@
+/**
+ * @file src/legal/types.ts
+ * @desc LegalSite: the per-app config the legal blocks and legalEntries render from. No site
+ *       name, URL, email or data list is hardcoded here; every app passes its own.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+/** The five standard legal page slugs every service ships, in the order they're listed. */
+export const LEGAL_SLUGS = [
+    "terms",
+    "privacy",
+    "your-privacy-rights",
+    "copyright",
+    "disclaimers",
+];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haruhimemoe/next-kit",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "The Next.js plumbing the haruhime.moe tools share: JSON route helpers, rate limits and budgets in MongoDB, bearer machine auth, zod env parsing, a connect-once MongoDB client with safe index builds, better-auth with osu! sign-in, the signed-in marker and account store for the browser, SEO: metadata, robots.txt, sitemaps, JSON-LD and llms.txt, and per-app API keys and the /api/v1 guard.",
   "keywords": [
     "nextjs",
@@ -70,6 +70,10 @@
       "types": "./dist/docs/files/index.d.ts",
       "default": "./dist/docs/files/index.js"
     },
+    "./legal": {
+      "types": "./dist/legal/index.d.ts",
+      "default": "./dist/legal/index.js"
+    },
     "./vcs": {
       "types": "./dist/vcs/index.d.ts",
       "default": "./dist/vcs/index.js"
@@ -104,7 +108,7 @@
   },
   "peerDependencies": {
     "@haruhimemoe/osu": "^0.2.0 || ^0.3.0 || ^0.4.0",
-    "@haruhimemoe/ui": "^0.5.0 || ^0.6.0 || ^0.7.0 || ^0.8.0 || ^0.9.0 || ^0.10.0 || ^0.11.0 || ^0.12.0 || ^0.13.0",
+    "@haruhimemoe/ui": "^0.14.0 || ^0.15.0 || ^0.16.0 || ^0.17.0 || ^0.18.0",
     "@haruhimemoe/vcs": "^0.1.0",
     "better-auth": "^1.7.5",
     "mongodb": "^7.6.0",
@@ -154,7 +158,7 @@
   "devDependencies": {
     "@biomejs/biome": "2.5.14",
     "@haruhimemoe/osu": "0.2.0",
-    "@haruhimemoe/ui": "0.5.0",
+    "@haruhimemoe/ui": "0.14.0",
     "@haruhimemoe/vcs": "0.1.0",
     "@testing-library/dom": "10.4.2",
     "@testing-library/react": "16.3.3",