@haruhimemoe/next-kit 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -6,6 +6,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.10.0] - 2026-10-05
+
+### Changed
+- **Breaking.** `next-kit check`'s legal standard requires all five pages of the legal convention: `content/legal/{terms,privacy,your-privacy-rights,copyright,disclaimers}.mdx` (was terms and privacy only).
+
+## [0.9.0] - 2026-10-05
+
+### Added
+- `legal` entry point: the five-page legal convention every service ships (terms, privacy, your-privacy-rights, copyright, disclaimers). A `LegalSite` config (site name, operator, contact email, effective date, data stores, processors, cookies), seven plain server-safe blocks an app drops into its own legal MDX (`LegalContact`, `DataWeKeep`, `Processors`, `YourRights`, `DmcaNotice`, `NoWarranty`, `Changes`; no hooks, no `@haruhimemoe/ui`), and `legalEntries(site, pages?)` for the five standard `ContentEntry` records so apps stop hand-writing the same titles and descriptions. next-kit's first `.tsx` entry point. `LegalSite.hosting` adds an optional line to `DmcaNotice`; `Changes` takes an optional per-page `date`.
+
+### Changed
+- The `@haruhimemoe/ui` peer range also allows `^0.18.0`.
+
 ## [0.8.0] - 2026-10-05
 
 ### Changed
@@ -96,7 +109,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - `@haruhimemoe/next-kit/auth-react`: `createSignedInMarker`, `createAccountStore`, `useAccount`, `createAccount`, `RestoreSignedIn` and `osuSignIn`.
 - `@haruhimemoe/next-kit/testing`: `startMemoryMongo`, `setupTestDb`, `setupMsw` and the fake osu! app env.
 
-[unreleased]: https://github.com/haruhimemoe/next-kit/compare/v0.8.0...HEAD
+[unreleased]: https://github.com/haruhimemoe/next-kit/compare/v0.10.0...HEAD
+[0.10.0]: https://github.com/haruhimemoe/next-kit/compare/v0.9.0...v0.10.0
+[0.9.0]: https://github.com/haruhimemoe/next-kit/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/haruhimemoe/next-kit/compare/v0.7.0...v0.8.0
 [0.6.2]: https://github.com/haruhimemoe/next-kit/compare/v0.6.1...v0.6.2
 [0.6.1]: https://github.com/haruhimemoe/next-kit/compare/v0.6.0...v0.6.1

package/README.md

@@ -13,6 +13,7 @@ The Next.js server plumbing the haruhime.moe tools share. [packs.haruhime.moe](h
 - **`/testing`:** Vitest helpers: one in-memory MongoDB per run, an msw server that refuses unhandled requests, and a fake env.
 - **`/api-keys`:** the shared key format (an app prefix like `hpk_` plus 32 random bytes), a key store over `api_keys`, and the `/api/v1` guard with the standard limits.
 - **`/docs`:** a content registry for an app's docs, guides and legal pages: sections, entries, app-made extra entries (like bb's tag pages), the path helpers a dynamic route needs, and `mdxToMarkdown` to turn bb-flavored MDX into plain Markdown. No runtime imports. **`/docs/files`:** reads the markdown files a registry's entries point at and reports drift between the registry and disk (node:fs).
+- **`/legal`:** the five-page legal convention (terms, privacy, your-privacy-rights, copyright, disclaimers). A `LegalSite` config, seven plain server-safe blocks (`LegalContact`, `DataWeKeep`, `Processors`, `YourRights`, `DmcaNotice`, `NoWarranty`, `Changes`) an app drops into its own legal MDX, and `legalEntries` for the app's content registry.
 - **`/vcs`:** document history in MongoDB on top of `@haruhimemoe/vcs`: one line of revisions per document, saves merged onto whatever landed since their base, revert, diffs, and autosave pruning.
 
 Every name, path, limit and message comes from the caller. There is no root entry point; import a subpath.
@@ -38,6 +39,7 @@ bun add @haruhimemoe/next-kit zod
 | `api-keys` | `mongodb` ^7.6.0 |
 | `docs` | nothing else |
 | `docs/files` | nothing else (`node:fs` is built in) |
+| `legal` | `react` ^19.3.0 (types only, for JSX) |
 | `vcs` | `mongodb` ^7.6.0, `@haruhimemoe/vcs` ^0.1.0 |
 
 ## Use
@@ -226,7 +228,7 @@ Every app is checked against:
 
 - **crawl** (always): `robots.ts`, `sitemap.ts`, `llms.txt/route.ts`, `llms-full.txt/route.ts`, and `.well-known/security.txt/route.ts` (each also accepted as a route handler, like `robots.txt/route.ts`).
 - **brand** (always): `brand/page.tsx`.
-- **legal** (always): `legal/page.tsx`, `legal/[x]/page.tsx`, `legal/[x]/md/route.ts` (any dynamic segment name), and `content/legal/terms.mdx` plus `content/legal/privacy.mdx`.
+- **legal** (always): `legal/page.tsx`, `legal/[x]/page.tsx`, `legal/[x]/md/route.ts` (any dynamic segment name), and the five legal convention pages: `content/legal/{terms,privacy,your-privacy-rights,copyright,disclaimers}.mdx`.
 - **docs**, once `src/app/api/v1` exists or any `content/docs` file does: `docs/page.tsx`, `docs/[x]/page.tsx`, `docs/[x]/md/route.ts`.
 - **guides**, only once a `content/guides` file exists: the same three files under `guides/`. An app with no guides is never asked for them.
 - **api**, once `src/app/api/v1` exists: `api/v1/me/route.ts`, `api/v1/openapi.json/route.ts`, `api/me/api-key/route.ts`, and `content/docs/api.mdx`.
@@ -393,6 +395,16 @@ No runtime imports.
 | `readContentMarkdown(content, section, slug, { root?, siteUrl, transforms? })` | Reads a registered entry's markdown file and converts it with `mdxToMarkdown` (using the entry's `title`). `root` defaults to `process.cwd()`. Returns null for an unregistered slug; rejects (ENOENT) when the slug is registered but its file is missing. |
 | `contentFileDrift(content, { root? })` | `{ missingFiles, unregistered }`: `missingFiles` lists registered entries with no file on disk (like `"guides/x.mdx"`); `unregistered` lists `.mdx` files on disk with no registry entry. `root` defaults to `process.cwd()`. |
 
+### legal
+
+| Export | What it does |
+| --- | --- |
+| `LEGAL_SLUGS`, `LegalSlug` | The five standard legal page slugs, in order: `"terms"`, `"privacy"`, `"your-privacy-rights"`, `"copyright"`, `"disclaimers"`. |
+| `LegalSite` | The config every block and `legalEntries` renders from: `siteName`, `operator`, `contactEmail`, `effectiveDate` (`YYYY-MM-DD`), `stores` (`LegalDataStore[]`), `processors` (`LegalProcessor[]`), `cookies` (`string[]`), optional `hosting` (one sentence on what users can post, shown by `DmcaNotice`). |
+| `LegalDataStore`, `LegalProcessor` | One kind of data kept (`what`, `why`), and one third party that processes it (`name`, `purpose`, `link?`). |
+| `LegalContact`, `DataWeKeep`, `Processors`, `YourRights`, `DmcaNotice`, `NoWarranty`, `Changes` | The seven blocks. Each takes `{ site: LegalSite }` and renders plain semantic HTML (no `@haruhimemoe/ui`), so it inherits the app's MDX prose styling. `DataWeKeep` skips the cookies list when `site.cookies` is empty. `Processors` links a processor that has a `link`, and plain-texts one that doesn't. `DmcaNotice` prints `site.hosting` only when set. `Changes` also takes an optional `date` for a page updated on its own day. |
+| `legalEntries(site, pages?)` | The five `ContentEntry` records (`docs`'s registry shape) for the legal convention, with the default title and description (`site.siteName` filled in) and `lastUpdated` set to `site.effectiveDate`. `pages` overrides any field per slug; everything else keeps the default. |
+
 ### vcs
 
 | Export | What it does |

package/dist/check/standards.d.ts

@@ -2,14 +2,14 @@
  * @file src/check/standards.ts
  * @desc The routes and content files every haruhime app serves, checked against an app's route
  *       file list (paths under src/app) and content file list (paths under content/). Crawl and
- *       brand are always checked; legal always checks its three routes plus its two content
- *       files; docs joins in once api/v1 exists or a content/docs file does; guides joins in
- *       only once a content/guides file does; the API standard, once api/v1 exists, checks its
+ *       brand are always checked; legal always checks its three routes plus the five pages of
+ *       the legal convention (LEGAL_SLUGS); docs joins in once api/v1 exists or a content/docs
+ *       file does; guides joins in only once a content/guides file does; the API standard, once api/v1 exists, checks its
  *       three routes plus content/docs/api.mdx. Checks files only: the content registry itself
  *       is never parsed.
  * @author David @dvhsh (https://dvh.sh)
  * @created Sat Oct 3, 2026
- * @modified Sun Oct 4, 2026
+ * @modified Mon Oct 5, 2026
  */
 /** One standard's outcome. `missing` entries carry their own prefix (src/app/... or content/...). */
 export type StandardResult = {

package/dist/check/standards.js

@@ -2,15 +2,16 @@
  * @file src/check/standards.ts
  * @desc The routes and content files every haruhime app serves, checked against an app's route
  *       file list (paths under src/app) and content file list (paths under content/). Crawl and
- *       brand are always checked; legal always checks its three routes plus its two content
- *       files; docs joins in once api/v1 exists or a content/docs file does; guides joins in
- *       only once a content/guides file does; the API standard, once api/v1 exists, checks its
+ *       brand are always checked; legal always checks its three routes plus the five pages of
+ *       the legal convention (LEGAL_SLUGS); docs joins in once api/v1 exists or a content/docs
+ *       file does; guides joins in only once a content/guides file does; the API standard, once api/v1 exists, checks its
  *       three routes plus content/docs/api.mdx. Checks files only: the content registry itself
  *       is never parsed.
  * @author David @dvhsh (https://dvh.sh)
  * @created Sat Oct 3, 2026
- * @modified Sun Oct 4, 2026
+ * @modified Mon Oct 5, 2026
  */
+import { LEGAL_SLUGS } from "../legal/types.js";
 /** A route under src/app, matched against any of `patterns`. */
 const route = (name, ...patterns) => ({
     missing: `src/app/${name}`,
@@ -37,8 +38,7 @@ const sectionRoutes = (section) => [
 ];
 const LEGAL = [
     ...sectionRoutes("legal"),
-    content("legal/terms.mdx"),
-    content("legal/privacy.mdx"),
+    ...LEGAL_SLUGS.map((slug) => content(`legal/${slug}.mdx`)),
 ];
 const DOCS = sectionRoutes("docs");
 const GUIDES = sectionRoutes("guides");

package/dist/legal/blocks.d.ts

@@ -0,0 +1,62 @@
+/**
+ * @file src/legal/blocks.tsx
+ * @desc The seven legal blocks: plain server-safe React (no hooks) an app drops into its own
+ *       legal MDX pages, rendered from a `LegalSite` config instead of hand-written boilerplate.
+ *       Semantic HTML only (section, h2, p, ul, a), so it inherits the app's MDX prose styling.
+ *       No `@haruhimemoe/ui` dependency: these are plain text blocks, not UI components.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+import type { ReactElement } from "react";
+import type { LegalSite } from "./types.js";
+/** Every block's props: the site config it renders from. */
+export type LegalBlockProps = {
+    site: LegalSite;
+};
+/** `Changes` props: the site config, plus this page's own date when it differs from the site's. */
+export type ChangesProps = LegalBlockProps & {
+    date?: string | undefined;
+};
+/**
+ * @function LegalContact
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} who runs the site and the address for legal questions
+ */
+export declare const LegalContact: ({ site }: LegalBlockProps) => ReactElement;
+/**
+ * @function DataWeKeep
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} what the app stores and why, plus the cookies it sets
+ */
+export declare const DataWeKeep: ({ site }: LegalBlockProps) => ReactElement;
+/**
+ * @function Processors
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the third parties that process data on the app's behalf
+ */
+export declare const Processors: ({ site }: LegalBlockProps) => ReactElement;
+/**
+ * @function YourRights
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the GDPR and CCPA rights every visitor has, and how to use them
+ */
+export declare const YourRights: ({ site }: LegalBlockProps) => ReactElement;
+/**
+ * @function DmcaNotice
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the DMCA agent, and the notice and counter-notice steps
+ */
+export declare const DmcaNotice: ({ site }: LegalBlockProps) => ReactElement;
+/**
+ * @function NoWarranty
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the "as is" warranty disclaimer and limitation of liability
+ */
+export declare const NoWarranty: ({ site }: LegalBlockProps) => ReactElement;
+/**
+ * @function Changes
+ * @param props {ChangesProps} the site config and an optional per-page date
+ * @returns {ReactElement} the standard "we may update this page" line with its effective date
+ */
+export declare const Changes: ({ site, date }: ChangesProps) => ReactElement;

package/dist/legal/blocks.js

@@ -0,0 +1,43 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * @function LegalContact
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} who runs the site and the address for legal questions
+ */
+export const LegalContact = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Contact" }), _jsxs("p", { children: [site.operator, " runs ", site.siteName, ". For anything on this page, write to", " ", _jsx("a", { href: `mailto:${site.contactEmail}`, children: site.contactEmail }), "."] })] }));
+/**
+ * @function DataWeKeep
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} what the app stores and why, plus the cookies it sets
+ */
+export const DataWeKeep = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "What we store" }), _jsx("ul", { children: site.stores.map((store) => (_jsxs("li", { children: [_jsxs("strong", { children: [store.what, "."] }), " ", store.why] }, store.what))) }), site.cookies.length > 0 && (_jsxs(_Fragment, { children: [_jsx("h3", { children: "Cookies" }), _jsx("ul", { children: site.cookies.map((cookie) => (_jsx("li", { children: cookie }, cookie))) })] }))] }));
+/**
+ * @function Processors
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the third parties that process data on the app's behalf
+ */
+export const Processors = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Service providers" }), _jsx("ul", { children: site.processors.map((processor) => (_jsxs("li", { children: [_jsx("strong", { children: processor.link ? _jsx("a", { href: processor.link, children: processor.name }) : processor.name }), " ", processor.purpose] }, processor.name))) })] }));
+/**
+ * @function YourRights
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the GDPR and CCPA rights every visitor has, and how to use them
+ */
+export const YourRights = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Your rights under the GDPR" }), _jsxs("ul", { children: [_jsxs("li", { children: [_jsx("strong", { children: "Access and portability." }), " Get a copy of your data in a machine-readable file."] }), _jsxs("li", { children: [_jsx("strong", { children: "Rectification." }), " Have wrong data corrected."] }), _jsxs("li", { children: [_jsx("strong", { children: "Erasure." }), " Have your data deleted."] }), _jsxs("li", { children: [_jsx("strong", { children: "Restriction." }), " Ask us to pause using your data while a question about it is sorted out."] }), _jsxs("li", { children: [_jsx("strong", { children: "Objection." }), " Object to anything we do on the basis of legitimate interest."] }), _jsxs("li", { children: [_jsx("strong", { children: "Complaint." }), " Complain to your data protection supervisory authority."] })] }), _jsx("h2", { children: "Your rights under the CCPA" }), _jsxs("ul", { children: [_jsxs("li", { children: [_jsx("strong", { children: "Know, delete and correct." }), " Ask what we hold about you, ask us to delete it, and ask us to correct it."] }), _jsxs("li", { children: [_jsx("strong", { children: "Selling and sharing." }), " We don't sell or share personal information."] }), _jsxs("li", { children: [_jsx("strong", { children: "Opting out." }), " We honor Global Privacy Control signals."] })] }), _jsxs("p", { children: ["To use any of these rights, email", " ", _jsx("a", { href: `mailto:${site.contactEmail}`, children: site.contactEmail }), "."] })] }));
+/**
+ * @function DmcaNotice
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the DMCA agent, and the notice and counter-notice steps
+ */
+export const DmcaNotice = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Copyright and DMCA" }), site.hosting ? _jsx("p", { children: site.hosting }) : null, _jsxs("p", { children: ["Our designated agent for copyright notices is", " ", _jsx("a", { href: `mailto:${site.contactEmail}`, children: site.contactEmail }), "."] }), _jsx("h3", { children: "A takedown notice should include" }), _jsxs("ol", { children: [_jsx("li", { children: "your contact information;" }), _jsx("li", { children: "the copyrighted work you believe is infringed;" }), _jsx("li", { children: "the URL or page the material appears on;" }), _jsx("li", { children: "a good-faith statement that the use is not authorized;" }), _jsx("li", { children: "a sworn statement that you're the rights holder, or authorized to act for them;" }), _jsx("li", { children: "your physical or electronic signature." })] }), _jsx("h3", { children: "A counter-notice should include" }), _jsxs("ol", { children: [_jsx("li", { children: "your contact information;" }), _jsx("li", { children: "the material removed and where it appeared;" }), _jsx("li", { children: "a sworn, good-faith statement that it was removed by mistake or misidentification;" }), _jsxs("li", { children: ["your consent to the jurisdiction of your local courts, or ", site.operator, "'s;"] }), _jsx("li", { children: "your physical or electronic signature." })] })] }));
+/**
+ * @function NoWarranty
+ * @param props {LegalBlockProps} the site config
+ * @returns {ReactElement} the "as is" warranty disclaimer and limitation of liability
+ */
+export const NoWarranty = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Disclaimer of warranties" }), _jsxs("p", { children: [site.siteName, " is provided \"as is\" and \"as available\", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose and non-infringement."] }), _jsx("h2", { children: "Limitation of liability" }), _jsxs("p", { children: ["To the fullest extent the law allows, ", site.operator, " is not liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of data or accounts, arising from your use of ", site.siteName, "."] })] }));
+/**
+ * @function Changes
+ * @param props {ChangesProps} the site config and an optional per-page date
+ * @returns {ReactElement} the standard "we may update this page" line with its effective date
+ */
+export const Changes = ({ site, date }) => (_jsxs("section", { children: [_jsx("h2", { children: "Changes" }), _jsxs("p", { children: ["We may update this page. It was last updated on ", date ?? site.effectiveDate, "."] })] }));

package/dist/legal/entries.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @file src/legal/entries.ts
+ * @desc legalEntries: the five standard `ContentEntry` records (`docs`'s registry shape) for the
+ *       five-page legal convention, so apps stop hand-writing the same titles and descriptions.
+ *       An app overrides any field per slug through `pages`; unlisted fields keep the default.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+import type { ContentEntry } from "../docs/registry.js";
+import { type LegalSite, type LegalSlug } from "./types.js";
+/** Per-slug overrides for any `ContentEntry` field, keyed by `LegalSlug`. */
+export type LegalPageOverrides = Partial<Record<LegalSlug, Partial<ContentEntry>>>;
+/**
+ * @function legalEntries
+ * @param site {LegalSite} the site config; `siteName` fills the default descriptions
+ * @param pages {LegalPageOverrides} [pages] per-slug overrides (a different description, a
+ *   `navTitle`, a page-specific `lastUpdated`); omitted fields keep the default
+ * @returns {ContentEntry[]} the five entries, in `LEGAL_SLUGS` order, ready for the `legal` array
+ *   an app's content registry (`defineContent`) takes
+ */
+export declare const legalEntries: (site: LegalSite, pages?: LegalPageOverrides) => ContentEntry[];

package/dist/legal/entries.js

@@ -0,0 +1,45 @@
+/**
+ * @file src/legal/entries.ts
+ * @desc legalEntries: the five standard `ContentEntry` records (`docs`'s registry shape) for the
+ *       five-page legal convention, so apps stop hand-writing the same titles and descriptions.
+ *       An app overrides any field per slug through `pages`; unlisted fields keep the default.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+import { LEGAL_SLUGS } from "./types.js";
+/** The default title and description for each of the five legal slugs. */
+const DEFAULTS = {
+    terms: { title: "Terms of Service", description: "The rules for using {site}." },
+    privacy: { title: "Privacy Policy", description: "What {site} stores and why." },
+    "your-privacy-rights": {
+        title: "GDPR & CCPA",
+        description: "Your rights over your data under the GDPR and the CCPA, and how to use them.",
+    },
+    copyright: {
+        title: "Copyright & Takedown",
+        description: "How to report a copyright concern, and where to send a DMCA notice.",
+    },
+    disclaimers: {
+        title: "Disclaimers",
+        description: "Who {site} isn't affiliated with, and what it doesn't promise.",
+    },
+};
+/**
+ * @function legalEntries
+ * @param site {LegalSite} the site config; `siteName` fills the default descriptions
+ * @param pages {LegalPageOverrides} [pages] per-slug overrides (a different description, a
+ *   `navTitle`, a page-specific `lastUpdated`); omitted fields keep the default
+ * @returns {ContentEntry[]} the five entries, in `LEGAL_SLUGS` order, ready for the `legal` array
+ *   an app's content registry (`defineContent`) takes
+ */
+export const legalEntries = (site, pages) => LEGAL_SLUGS.map((slug) => {
+    const fallback = DEFAULTS[slug];
+    return {
+        slug,
+        title: fallback.title,
+        description: fallback.description.replace("{site}", site.siteName),
+        lastUpdated: site.effectiveDate,
+        ...pages?.[slug],
+    };
+});

package/dist/legal/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @file src/legal/index.ts
+ * @desc @haruhimemoe/next-kit/legal: the five-page legal convention (terms, privacy,
+ *       your-privacy-rights, copyright, disclaimers). `LegalSite` config, seven MDX blocks
+ *       rendered from it, and `legalEntries` for the app's content registry.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+export { Changes, type ChangesProps, DataWeKeep, DmcaNotice, type LegalBlockProps, LegalContact, NoWarranty, Processors, YourRights, } from "./blocks.js";
+export { type LegalPageOverrides, legalEntries } from "./entries.js";
+export { LEGAL_SLUGS, type LegalDataStore, type LegalProcessor, type LegalSite, type LegalSlug, } from "./types.js";

package/dist/legal/index.js

@@ -0,0 +1,12 @@
+/**
+ * @file src/legal/index.ts
+ * @desc @haruhimemoe/next-kit/legal: the five-page legal convention (terms, privacy,
+ *       your-privacy-rights, copyright, disclaimers). `LegalSite` config, seven MDX blocks
+ *       rendered from it, and `legalEntries` for the app's content registry.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+export { Changes, DataWeKeep, DmcaNotice, LegalContact, NoWarranty, Processors, YourRights, } from "./blocks.js";
+export { legalEntries } from "./entries.js";
+export { LEGAL_SLUGS, } from "./types.js";

package/dist/legal/types.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @file src/legal/types.ts
+ * @desc LegalSite: the per-app config the legal blocks and legalEntries render from. No site
+ *       name, URL, email or data list is hardcoded here; every app passes its own.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+/** A third party that processes data on the app's behalf, like Vercel or MongoDB Atlas. */
+export type LegalProcessor = {
+    name: string;
+    purpose: string;
+    link?: string;
+};
+/** One kind of data the app stores, and why. */
+export type LegalDataStore = {
+    what: string;
+    why: string;
+};
+/** The five standard legal page slugs every service ships, in the order they're listed. */
+export declare const LEGAL_SLUGS: readonly ["terms", "privacy", "your-privacy-rights", "copyright", "disclaimers"];
+/** One of `LEGAL_SLUGS`. */
+export type LegalSlug = (typeof LEGAL_SLUGS)[number];
+/** The config every legal block and `legalEntries` renders from. */
+export type LegalSite = {
+    /** The site's display name, like "packs.haruhime.moe". */
+    siteName: string;
+    /** Who runs the site, for the contact and "who's responsible" lines. */
+    operator: string;
+    /** Where a legal request, question or notice goes. */
+    contactEmail: string;
+    /** YYYY-MM-DD. Shown as this page's "last updated" date by `Changes`. */
+    effectiveDate: string;
+    /** What the app keeps, in `DataWeKeep`'s order. */
+    stores: readonly LegalDataStore[];
+    /** Who processes data on the app's behalf, in `Processors`'s order. */
+    processors: readonly LegalProcessor[];
+    /** The cookies the app sets, one line each, in `DataWeKeep`'s cookie list. */
+    cookies: readonly string[];
+    /** One sentence on what users can post or upload, shown by `DmcaNotice`. Omitted: no line. */
+    hosting?: string | undefined;
+};

package/dist/legal/types.js

@@ -0,0 +1,16 @@
+/**
+ * @file src/legal/types.ts
+ * @desc LegalSite: the per-app config the legal blocks and legalEntries render from. No site
+ *       name, URL, email or data list is hardcoded here; every app passes its own.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+/** The five standard legal page slugs every service ships, in the order they're listed. */
+export const LEGAL_SLUGS = [
+    "terms",
+    "privacy",
+    "your-privacy-rights",
+    "copyright",
+    "disclaimers",
+];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haruhimemoe/next-kit",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "The Next.js plumbing the haruhime.moe tools share: JSON route helpers, rate limits and budgets in MongoDB, bearer machine auth, zod env parsing, a connect-once MongoDB client with safe index builds, better-auth with osu! sign-in, the signed-in marker and account store for the browser, SEO: metadata, robots.txt, sitemaps, JSON-LD and llms.txt, and per-app API keys and the /api/v1 guard.",
   "keywords": [
     "nextjs",
@@ -70,6 +70,10 @@
       "types": "./dist/docs/files/index.d.ts",
       "default": "./dist/docs/files/index.js"
     },
+    "./legal": {
+      "types": "./dist/legal/index.d.ts",
+      "default": "./dist/legal/index.js"
+    },
     "./vcs": {
       "types": "./dist/vcs/index.d.ts",
       "default": "./dist/vcs/index.js"
@@ -104,7 +108,7 @@
   },
   "peerDependencies": {
     "@haruhimemoe/osu": "^0.2.0 || ^0.3.0 || ^0.4.0",
-    "@haruhimemoe/ui": "^0.14.0 || ^0.15.0 || ^0.16.0 || ^0.17.0",
+    "@haruhimemoe/ui": "^0.14.0 || ^0.15.0 || ^0.16.0 || ^0.17.0 || ^0.18.0",
     "@haruhimemoe/vcs": "^0.1.0",
     "better-auth": "^1.7.5",
     "mongodb": "^7.6.0",