@haruhimemoe/next-kit 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -6,6 +6,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-10-05
+
+### Added
+- `legalMarkdownTransform(site)` in `legal`: a `mdxToMarkdown` `transforms` entry that turns each self-closing legal block tag (`<LegalContact />`, `<DataWeKeep />`, `<Processors />`, `<YourRights />`, `<DmcaNotice />`, `<NoWarranty />`, `<Changes />` and `<Changes date="YYYY-MM-DD" />`) into Markdown carrying the same words as its React block. Without it, an app that drops the legal blocks straight into its `content/legal/*.mdx` loses that text from its `.md` mirrors and llms-full.txt, since `mdxToMarkdown` strips unknown capitalized JSX. The seven blocks' sentences and list items now live in a new `legal/copy.ts`, shared by `blocks.tsx` and `legalMarkdownTransform` so the two outputs can't drift apart; `blocks.tsx`'s rendered output is unchanged.
+
+## [0.10.0] - 2026-10-05
+
+### Changed
+- **Breaking.** `next-kit check`'s legal standard requires all five pages of the legal convention: `content/legal/{terms,privacy,your-privacy-rights,copyright,disclaimers}.mdx` (was terms and privacy only).
+
 ## [0.9.0] - 2026-10-05
 
 ### Added
@@ -104,7 +114,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - `@haruhimemoe/next-kit/auth-react`: `createSignedInMarker`, `createAccountStore`, `useAccount`, `createAccount`, `RestoreSignedIn` and `osuSignIn`.
 - `@haruhimemoe/next-kit/testing`: `startMemoryMongo`, `setupTestDb`, `setupMsw` and the fake osu! app env.
 
-[unreleased]: https://github.com/haruhimemoe/next-kit/compare/v0.8.0...HEAD
+[unreleased]: https://github.com/haruhimemoe/next-kit/compare/v0.10.0...HEAD
+[0.10.0]: https://github.com/haruhimemoe/next-kit/compare/v0.9.0...v0.10.0
+[0.9.0]: https://github.com/haruhimemoe/next-kit/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/haruhimemoe/next-kit/compare/v0.7.0...v0.8.0
 [0.6.2]: https://github.com/haruhimemoe/next-kit/compare/v0.6.1...v0.6.2
 [0.6.1]: https://github.com/haruhimemoe/next-kit/compare/v0.6.0...v0.6.1

package/README.md

@@ -13,7 +13,7 @@ The Next.js server plumbing the haruhime.moe tools share. [packs.haruhime.moe](h
 - **`/testing`:** Vitest helpers: one in-memory MongoDB per run, an msw server that refuses unhandled requests, and a fake env.
 - **`/api-keys`:** the shared key format (an app prefix like `hpk_` plus 32 random bytes), a key store over `api_keys`, and the `/api/v1` guard with the standard limits.
 - **`/docs`:** a content registry for an app's docs, guides and legal pages: sections, entries, app-made extra entries (like bb's tag pages), the path helpers a dynamic route needs, and `mdxToMarkdown` to turn bb-flavored MDX into plain Markdown. No runtime imports. **`/docs/files`:** reads the markdown files a registry's entries point at and reports drift between the registry and disk (node:fs).
-- **`/legal`:** the five-page legal convention (terms, privacy, your-privacy-rights, copyright, disclaimers). A `LegalSite` config, seven plain server-safe blocks (`LegalContact`, `DataWeKeep`, `Processors`, `YourRights`, `DmcaNotice`, `NoWarranty`, `Changes`) an app drops into its own legal MDX, and `legalEntries` for the app's content registry.
+- **`/legal`:** the five-page legal convention (terms, privacy, your-privacy-rights, copyright, disclaimers). A `LegalSite` config, seven plain server-safe blocks (`LegalContact`, `DataWeKeep`, `Processors`, `YourRights`, `DmcaNotice`, `NoWarranty`, `Changes`) an app drops into its own legal MDX, `legalEntries` for the app's content registry, and `legalMarkdownTransform` so those blocks survive `mdxToMarkdown`'s `.md` mirrors and llms-full.txt instead of being dropped as unknown JSX.
 - **`/vcs`:** document history in MongoDB on top of `@haruhimemoe/vcs`: one line of revisions per document, saves merged onto whatever landed since their base, revert, diffs, and autosave pruning.
 
 Every name, path, limit and message comes from the caller. There is no root entry point; import a subpath.
@@ -228,7 +228,7 @@ Every app is checked against:
 
 - **crawl** (always): `robots.ts`, `sitemap.ts`, `llms.txt/route.ts`, `llms-full.txt/route.ts`, and `.well-known/security.txt/route.ts` (each also accepted as a route handler, like `robots.txt/route.ts`).
 - **brand** (always): `brand/page.tsx`.
-- **legal** (always): `legal/page.tsx`, `legal/[x]/page.tsx`, `legal/[x]/md/route.ts` (any dynamic segment name), and `content/legal/terms.mdx` plus `content/legal/privacy.mdx`.
+- **legal** (always): `legal/page.tsx`, `legal/[x]/page.tsx`, `legal/[x]/md/route.ts` (any dynamic segment name), and the five legal convention pages: `content/legal/{terms,privacy,your-privacy-rights,copyright,disclaimers}.mdx`.
 - **docs**, once `src/app/api/v1` exists or any `content/docs` file does: `docs/page.tsx`, `docs/[x]/page.tsx`, `docs/[x]/md/route.ts`.
 - **guides**, only once a `content/guides` file exists: the same three files under `guides/`. An app with no guides is never asked for them.
 - **api**, once `src/app/api/v1` exists: `api/v1/me/route.ts`, `api/v1/openapi.json/route.ts`, `api/me/api-key/route.ts`, and `content/docs/api.mdx`.
@@ -404,6 +404,7 @@ No runtime imports.
 | `LegalDataStore`, `LegalProcessor` | One kind of data kept (`what`, `why`), and one third party that processes it (`name`, `purpose`, `link?`). |
 | `LegalContact`, `DataWeKeep`, `Processors`, `YourRights`, `DmcaNotice`, `NoWarranty`, `Changes` | The seven blocks. Each takes `{ site: LegalSite }` and renders plain semantic HTML (no `@haruhimemoe/ui`), so it inherits the app's MDX prose styling. `DataWeKeep` skips the cookies list when `site.cookies` is empty. `Processors` links a processor that has a `link`, and plain-texts one that doesn't. `DmcaNotice` prints `site.hosting` only when set. `Changes` also takes an optional `date` for a page updated on its own day. |
 | `legalEntries(site, pages?)` | The five `ContentEntry` records (`docs`'s registry shape) for the legal convention, with the default title and description (`site.siteName` filled in) and `lastUpdated` set to `site.effectiveDate`. `pages` overrides any field per slug; everything else keeps the default. |
+| `legalMarkdownTransform(site)` | A `transforms` entry for `mdxToMarkdown` (see `docs`): replaces each self-closing legal block tag (`<LegalContact />`, ..., `<Changes />` or `<Changes date="YYYY-MM-DD" />`) with Markdown carrying the same words as its React block, so an app's `.md` mirrors and llms-full.txt don't silently lose the legal text. |
 
 ### vcs
 

package/dist/check/standards.d.ts

@@ -2,14 +2,14 @@
  * @file src/check/standards.ts
  * @desc The routes and content files every haruhime app serves, checked against an app's route
  *       file list (paths under src/app) and content file list (paths under content/). Crawl and
- *       brand are always checked; legal always checks its three routes plus its two content
- *       files; docs joins in once api/v1 exists or a content/docs file does; guides joins in
- *       only once a content/guides file does; the API standard, once api/v1 exists, checks its
+ *       brand are always checked; legal always checks its three routes plus the five pages of
+ *       the legal convention (LEGAL_SLUGS); docs joins in once api/v1 exists or a content/docs
+ *       file does; guides joins in only once a content/guides file does; the API standard, once api/v1 exists, checks its
  *       three routes plus content/docs/api.mdx. Checks files only: the content registry itself
  *       is never parsed.
  * @author David @dvhsh (https://dvh.sh)
  * @created Sat Oct 3, 2026
- * @modified Sun Oct 4, 2026
+ * @modified Mon Oct 5, 2026
  */
 /** One standard's outcome. `missing` entries carry their own prefix (src/app/... or content/...). */
 export type StandardResult = {

package/dist/check/standards.js

@@ -2,15 +2,16 @@
  * @file src/check/standards.ts
  * @desc The routes and content files every haruhime app serves, checked against an app's route
  *       file list (paths under src/app) and content file list (paths under content/). Crawl and
- *       brand are always checked; legal always checks its three routes plus its two content
- *       files; docs joins in once api/v1 exists or a content/docs file does; guides joins in
- *       only once a content/guides file does; the API standard, once api/v1 exists, checks its
+ *       brand are always checked; legal always checks its three routes plus the five pages of
+ *       the legal convention (LEGAL_SLUGS); docs joins in once api/v1 exists or a content/docs
+ *       file does; guides joins in only once a content/guides file does; the API standard, once api/v1 exists, checks its
  *       three routes plus content/docs/api.mdx. Checks files only: the content registry itself
  *       is never parsed.
  * @author David @dvhsh (https://dvh.sh)
  * @created Sat Oct 3, 2026
- * @modified Sun Oct 4, 2026
+ * @modified Mon Oct 5, 2026
  */
+import { LEGAL_SLUGS } from "../legal/types.js";
 /** A route under src/app, matched against any of `patterns`. */
 const route = (name, ...patterns) => ({
     missing: `src/app/${name}`,
@@ -37,8 +38,7 @@ const sectionRoutes = (section) => [
 ];
 const LEGAL = [
     ...sectionRoutes("legal"),
-    content("legal/terms.mdx"),
-    content("legal/privacy.mdx"),
+    ...LEGAL_SLUGS.map((slug) => content(`legal/${slug}.mdx`)),
 ];
 const DOCS = sectionRoutes("docs");
 const GUIDES = sectionRoutes("guides");

package/dist/legal/blocks.d.ts

@@ -3,7 +3,9 @@
  * @desc The seven legal blocks: plain server-safe React (no hooks) an app drops into its own
  *       legal MDX pages, rendered from a `LegalSite` config instead of hand-written boilerplate.
  *       Semantic HTML only (section, h2, p, ul, a), so it inherits the app's MDX prose styling.
- *       No `@haruhimemoe/ui` dependency: these are plain text blocks, not UI components.
+ *       No `@haruhimemoe/ui` dependency: these are plain text blocks, not UI components. The
+ *       sentences and list items come from ./copy.js, shared with markdown.ts's
+ *       `legalMarkdownTransform` so the two outputs can't drift apart.
  * @author David @dvhsh (https://dvh.sh)
  * @created Mon Oct 5, 2026
  * @modified Mon Oct 5, 2026

package/dist/legal/blocks.js

@@ -1,43 +1,44 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { CCPA_HEADING, CCPA_RIGHTS, CHANGES_HEADING, CONTACT_HEADING, COOKIES_HEADING, COUNTER_NOTICE_HEADING, COUNTER_NOTICE_ITEMS_BEFORE_JURISDICTION, COUNTER_NOTICE_SIGNATURE, changesParagraph, contactIntro, counterNoticeJurisdiction, DATA_HEADING, DMCA_AGENT_INTRO, DMCA_HEADING, GDPR_HEADING, GDPR_RIGHTS, LIABILITY_HEADING, liabilityParagraph, PROCESSORS_HEADING, RIGHTS_CLOSING_INTRO, TAKEDOWN_HEADING, TAKEDOWN_ITEMS, WARRANTY_HEADING, warrantyParagraph, } from "./copy.js";
 /**
  * @function LegalContact
  * @param props {LegalBlockProps} the site config
  * @returns {ReactElement} who runs the site and the address for legal questions
  */
-export const LegalContact = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Contact" }), _jsxs("p", { children: [site.operator, " runs ", site.siteName, ". For anything on this page, write to", " ", _jsx("a", { href: `mailto:${site.contactEmail}`, children: site.contactEmail }), "."] })] }));
+export const LegalContact = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: CONTACT_HEADING }), _jsxs("p", { children: [contactIntro(site), _jsx("a", { href: `mailto:${site.contactEmail}`, children: site.contactEmail }), "."] })] }));
 /**
  * @function DataWeKeep
  * @param props {LegalBlockProps} the site config
  * @returns {ReactElement} what the app stores and why, plus the cookies it sets
  */
-export const DataWeKeep = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "What we store" }), _jsx("ul", { children: site.stores.map((store) => (_jsxs("li", { children: [_jsxs("strong", { children: [store.what, "."] }), " ", store.why] }, store.what))) }), site.cookies.length > 0 && (_jsxs(_Fragment, { children: [_jsx("h3", { children: "Cookies" }), _jsx("ul", { children: site.cookies.map((cookie) => (_jsx("li", { children: cookie }, cookie))) })] }))] }));
+export const DataWeKeep = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: DATA_HEADING }), _jsx("ul", { children: site.stores.map((store) => (_jsxs("li", { children: [_jsxs("strong", { children: [store.what, "."] }), " ", store.why] }, store.what))) }), site.cookies.length > 0 && (_jsxs(_Fragment, { children: [_jsx("h3", { children: COOKIES_HEADING }), _jsx("ul", { children: site.cookies.map((cookie) => (_jsx("li", { children: cookie }, cookie))) })] }))] }));
 /**
  * @function Processors
  * @param props {LegalBlockProps} the site config
  * @returns {ReactElement} the third parties that process data on the app's behalf
  */
-export const Processors = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Service providers" }), _jsx("ul", { children: site.processors.map((processor) => (_jsxs("li", { children: [_jsx("strong", { children: processor.link ? _jsx("a", { href: processor.link, children: processor.name }) : processor.name }), " ", processor.purpose] }, processor.name))) })] }));
+export const Processors = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: PROCESSORS_HEADING }), _jsx("ul", { children: site.processors.map((processor) => (_jsxs("li", { children: [_jsx("strong", { children: processor.link ? _jsx("a", { href: processor.link, children: processor.name }) : processor.name }), " ", processor.purpose] }, processor.name))) })] }));
 /**
  * @function YourRights
  * @param props {LegalBlockProps} the site config
  * @returns {ReactElement} the GDPR and CCPA rights every visitor has, and how to use them
  */
-export const YourRights = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Your rights under the GDPR" }), _jsxs("ul", { children: [_jsxs("li", { children: [_jsx("strong", { children: "Access and portability." }), " Get a copy of your data in a machine-readable file."] }), _jsxs("li", { children: [_jsx("strong", { children: "Rectification." }), " Have wrong data corrected."] }), _jsxs("li", { children: [_jsx("strong", { children: "Erasure." }), " Have your data deleted."] }), _jsxs("li", { children: [_jsx("strong", { children: "Restriction." }), " Ask us to pause using your data while a question about it is sorted out."] }), _jsxs("li", { children: [_jsx("strong", { children: "Objection." }), " Object to anything we do on the basis of legitimate interest."] }), _jsxs("li", { children: [_jsx("strong", { children: "Complaint." }), " Complain to your data protection supervisory authority."] })] }), _jsx("h2", { children: "Your rights under the CCPA" }), _jsxs("ul", { children: [_jsxs("li", { children: [_jsx("strong", { children: "Know, delete and correct." }), " Ask what we hold about you, ask us to delete it, and ask us to correct it."] }), _jsxs("li", { children: [_jsx("strong", { children: "Selling and sharing." }), " We don't sell or share personal information."] }), _jsxs("li", { children: [_jsx("strong", { children: "Opting out." }), " We honor Global Privacy Control signals."] })] }), _jsxs("p", { children: ["To use any of these rights, email", " ", _jsx("a", { href: `mailto:${site.contactEmail}`, children: site.contactEmail }), "."] })] }));
+export const YourRights = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: GDPR_HEADING }), _jsx("ul", { children: GDPR_RIGHTS.map((right) => (_jsxs("li", { children: [_jsx("strong", { children: right.term }), " ", right.desc] }, right.term))) }), _jsx("h2", { children: CCPA_HEADING }), _jsx("ul", { children: CCPA_RIGHTS.map((right) => (_jsxs("li", { children: [_jsx("strong", { children: right.term }), " ", right.desc] }, right.term))) }), _jsxs("p", { children: [RIGHTS_CLOSING_INTRO, _jsx("a", { href: `mailto:${site.contactEmail}`, children: site.contactEmail }), "."] })] }));
 /**
  * @function DmcaNotice
  * @param props {LegalBlockProps} the site config
  * @returns {ReactElement} the DMCA agent, and the notice and counter-notice steps
  */
-export const DmcaNotice = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Copyright and DMCA" }), site.hosting ? _jsx("p", { children: site.hosting }) : null, _jsxs("p", { children: ["Our designated agent for copyright notices is", " ", _jsx("a", { href: `mailto:${site.contactEmail}`, children: site.contactEmail }), "."] }), _jsx("h3", { children: "A takedown notice should include" }), _jsxs("ol", { children: [_jsx("li", { children: "your contact information;" }), _jsx("li", { children: "the copyrighted work you believe is infringed;" }), _jsx("li", { children: "the URL or page the material appears on;" }), _jsx("li", { children: "a good-faith statement that the use is not authorized;" }), _jsx("li", { children: "a sworn statement that you're the rights holder, or authorized to act for them;" }), _jsx("li", { children: "your physical or electronic signature." })] }), _jsx("h3", { children: "A counter-notice should include" }), _jsxs("ol", { children: [_jsx("li", { children: "your contact information;" }), _jsx("li", { children: "the material removed and where it appeared;" }), _jsx("li", { children: "a sworn, good-faith statement that it was removed by mistake or misidentification;" }), _jsxs("li", { children: ["your consent to the jurisdiction of your local courts, or ", site.operator, "'s;"] }), _jsx("li", { children: "your physical or electronic signature." })] })] }));
+export const DmcaNotice = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: DMCA_HEADING }), site.hosting ? _jsx("p", { children: site.hosting }) : null, _jsxs("p", { children: [DMCA_AGENT_INTRO, _jsx("a", { href: `mailto:${site.contactEmail}`, children: site.contactEmail }), "."] }), _jsx("h3", { children: TAKEDOWN_HEADING }), _jsx("ol", { children: TAKEDOWN_ITEMS.map((item) => (_jsx("li", { children: item }, item))) }), _jsx("h3", { children: COUNTER_NOTICE_HEADING }), _jsxs("ol", { children: [COUNTER_NOTICE_ITEMS_BEFORE_JURISDICTION.map((item) => (_jsx("li", { children: item }, item))), _jsx("li", { children: counterNoticeJurisdiction(site) }), _jsx("li", { children: COUNTER_NOTICE_SIGNATURE })] })] }));
 /**
  * @function NoWarranty
  * @param props {LegalBlockProps} the site config
  * @returns {ReactElement} the "as is" warranty disclaimer and limitation of liability
  */
-export const NoWarranty = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: "Disclaimer of warranties" }), _jsxs("p", { children: [site.siteName, " is provided \"as is\" and \"as available\", without warranties of any kind, express or implied, including merchantability, fitness for a particular purpose and non-infringement."] }), _jsx("h2", { children: "Limitation of liability" }), _jsxs("p", { children: ["To the fullest extent the law allows, ", site.operator, " is not liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of data or accounts, arising from your use of ", site.siteName, "."] })] }));
+export const NoWarranty = ({ site }) => (_jsxs("section", { children: [_jsx("h2", { children: WARRANTY_HEADING }), _jsx("p", { children: warrantyParagraph(site) }), _jsx("h2", { children: LIABILITY_HEADING }), _jsx("p", { children: liabilityParagraph(site) })] }));
 /**
  * @function Changes
  * @param props {ChangesProps} the site config and an optional per-page date
  * @returns {ReactElement} the standard "we may update this page" line with its effective date
  */
-export const Changes = ({ site, date }) => (_jsxs("section", { children: [_jsx("h2", { children: "Changes" }), _jsxs("p", { children: ["We may update this page. It was last updated on ", date ?? site.effectiveDate, "."] })] }));
+export const Changes = ({ site, date }) => (_jsxs("section", { children: [_jsx("h2", { children: CHANGES_HEADING }), _jsx("p", { children: changesParagraph(date ?? site.effectiveDate) })] }));

package/dist/legal/copy.d.ts

@@ -0,0 +1,66 @@
+/**
+ * @file src/legal/copy.ts
+ * @desc The fixed sentences and list items behind the seven legal blocks (blocks.tsx) and their
+ *       Markdown mirror (markdown.ts's `legalMarkdownTransform`), kept in one place so the two
+ *       outputs can't drift apart. Pure data and template functions: no JSX, no Markdown syntax,
+ *       just the words. Anything that includes a link (the contact email, the DMCA agent email,
+ *       the rights-request email) is split into the text before the link so each renderer can
+ *       append its own link syntax.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+import type { LegalSite } from "./types.js";
+/** `LegalContact`'s h2 heading. */
+export declare const CONTACT_HEADING = "Contact";
+/** `LegalContact`'s sentence, up to (not including) the contact email link. */
+export declare const contactIntro: (site: LegalSite) => string;
+/** `DataWeKeep`'s h2 heading. */
+export declare const DATA_HEADING = "What we store";
+/** `DataWeKeep`'s h3 heading over the cookie list, shown only when `site.cookies` isn't empty. */
+export declare const COOKIES_HEADING = "Cookies";
+/** `Processors`'s h2 heading. */
+export declare const PROCESSORS_HEADING = "Service providers";
+/** One GDPR or CCPA right: a bold term and its plain-text description. */
+export type LegalRight = {
+    term: string;
+    desc: string;
+};
+/** `YourRights`'s GDPR section heading. */
+export declare const GDPR_HEADING = "Your rights under the GDPR";
+/** `YourRights`'s six GDPR rights, in list order. */
+export declare const GDPR_RIGHTS: readonly LegalRight[];
+/** `YourRights`'s CCPA section heading. */
+export declare const CCPA_HEADING = "Your rights under the CCPA";
+/** `YourRights`'s three CCPA rights, in list order. */
+export declare const CCPA_RIGHTS: readonly LegalRight[];
+/** `YourRights`'s closing sentence, up to (not including) the contact email link. */
+export declare const RIGHTS_CLOSING_INTRO = "To use any of these rights, email ";
+/** `DmcaNotice`'s h2 heading. */
+export declare const DMCA_HEADING = "Copyright and DMCA";
+/** `DmcaNotice`'s agent sentence, up to (not including) the contact email link. */
+export declare const DMCA_AGENT_INTRO = "Our designated agent for copyright notices is ";
+/** `DmcaNotice`'s h3 heading over the takedown-notice list. */
+export declare const TAKEDOWN_HEADING = "A takedown notice should include";
+/** `DmcaNotice`'s takedown-notice steps, in list order. */
+export declare const TAKEDOWN_ITEMS: readonly string[];
+/** `DmcaNotice`'s h3 heading over the counter-notice list. */
+export declare const COUNTER_NOTICE_HEADING = "A counter-notice should include";
+/** `DmcaNotice`'s counter-notice steps that come before the operator-specific jurisdiction step. */
+export declare const COUNTER_NOTICE_ITEMS_BEFORE_JURISDICTION: readonly string[];
+/** `DmcaNotice`'s jurisdiction step, templated with the site's operator. */
+export declare const counterNoticeJurisdiction: (site: LegalSite) => string;
+/** `DmcaNotice`'s final counter-notice step. */
+export declare const COUNTER_NOTICE_SIGNATURE = "your physical or electronic signature.";
+/** `NoWarranty`'s "as is" heading. */
+export declare const WARRANTY_HEADING = "Disclaimer of warranties";
+/** `NoWarranty`'s "as is" paragraph, templated with the site's name. */
+export declare const warrantyParagraph: (site: LegalSite) => string;
+/** `NoWarranty`'s limitation-of-liability heading. */
+export declare const LIABILITY_HEADING = "Limitation of liability";
+/** `NoWarranty`'s limitation-of-liability paragraph, templated with the operator and site name. */
+export declare const liabilityParagraph: (site: LegalSite) => string;
+/** `Changes`'s h2 heading. */
+export declare const CHANGES_HEADING = "Changes";
+/** `Changes`'s full sentence, templated with the page's effective date. */
+export declare const changesParagraph: (date: string) => string;

package/dist/legal/copy.js

@@ -0,0 +1,92 @@
+/**
+ * @file src/legal/copy.ts
+ * @desc The fixed sentences and list items behind the seven legal blocks (blocks.tsx) and their
+ *       Markdown mirror (markdown.ts's `legalMarkdownTransform`), kept in one place so the two
+ *       outputs can't drift apart. Pure data and template functions: no JSX, no Markdown syntax,
+ *       just the words. Anything that includes a link (the contact email, the DMCA agent email,
+ *       the rights-request email) is split into the text before the link so each renderer can
+ *       append its own link syntax.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+/** `LegalContact`'s h2 heading. */
+export const CONTACT_HEADING = "Contact";
+/** `LegalContact`'s sentence, up to (not including) the contact email link. */
+export const contactIntro = (site) => `${site.operator} runs ${site.siteName}. For anything on this page, write to `;
+/** `DataWeKeep`'s h2 heading. */
+export const DATA_HEADING = "What we store";
+/** `DataWeKeep`'s h3 heading over the cookie list, shown only when `site.cookies` isn't empty. */
+export const COOKIES_HEADING = "Cookies";
+/** `Processors`'s h2 heading. */
+export const PROCESSORS_HEADING = "Service providers";
+/** `YourRights`'s GDPR section heading. */
+export const GDPR_HEADING = "Your rights under the GDPR";
+/** `YourRights`'s six GDPR rights, in list order. */
+export const GDPR_RIGHTS = [
+    { term: "Access and portability.", desc: "Get a copy of your data in a machine-readable file." },
+    { term: "Rectification.", desc: "Have wrong data corrected." },
+    { term: "Erasure.", desc: "Have your data deleted." },
+    {
+        term: "Restriction.",
+        desc: "Ask us to pause using your data while a question about it is sorted out.",
+    },
+    { term: "Objection.", desc: "Object to anything we do on the basis of legitimate interest." },
+    { term: "Complaint.", desc: "Complain to your data protection supervisory authority." },
+];
+/** `YourRights`'s CCPA section heading. */
+export const CCPA_HEADING = "Your rights under the CCPA";
+/** `YourRights`'s three CCPA rights, in list order. */
+export const CCPA_RIGHTS = [
+    {
+        term: "Know, delete and correct.",
+        desc: "Ask what we hold about you, ask us to delete it, and ask us to correct it.",
+    },
+    { term: "Selling and sharing.", desc: "We don't sell or share personal information." },
+    { term: "Opting out.", desc: "We honor Global Privacy Control signals." },
+];
+/** `YourRights`'s closing sentence, up to (not including) the contact email link. */
+export const RIGHTS_CLOSING_INTRO = "To use any of these rights, email ";
+/** `DmcaNotice`'s h2 heading. */
+export const DMCA_HEADING = "Copyright and DMCA";
+/** `DmcaNotice`'s agent sentence, up to (not including) the contact email link. */
+export const DMCA_AGENT_INTRO = "Our designated agent for copyright notices is ";
+/** `DmcaNotice`'s h3 heading over the takedown-notice list. */
+export const TAKEDOWN_HEADING = "A takedown notice should include";
+/** `DmcaNotice`'s takedown-notice steps, in list order. */
+export const TAKEDOWN_ITEMS = [
+    "your contact information;",
+    "the copyrighted work you believe is infringed;",
+    "the URL or page the material appears on;",
+    "a good-faith statement that the use is not authorized;",
+    "a sworn statement that you're the rights holder, or authorized to act for them;",
+    "your physical or electronic signature.",
+];
+/** `DmcaNotice`'s h3 heading over the counter-notice list. */
+export const COUNTER_NOTICE_HEADING = "A counter-notice should include";
+/** `DmcaNotice`'s counter-notice steps that come before the operator-specific jurisdiction step. */
+export const COUNTER_NOTICE_ITEMS_BEFORE_JURISDICTION = [
+    "your contact information;",
+    "the material removed and where it appeared;",
+    "a sworn, good-faith statement that it was removed by mistake or misidentification;",
+];
+/** `DmcaNotice`'s jurisdiction step, templated with the site's operator. */
+export const counterNoticeJurisdiction = (site) => `your consent to the jurisdiction of your local courts, or ${site.operator}'s;`;
+/** `DmcaNotice`'s final counter-notice step. */
+export const COUNTER_NOTICE_SIGNATURE = "your physical or electronic signature.";
+/** `NoWarranty`'s "as is" heading. */
+export const WARRANTY_HEADING = "Disclaimer of warranties";
+/** `NoWarranty`'s "as is" paragraph, templated with the site's name. */
+export const warrantyParagraph = (site) => `${site.siteName} is provided "as is" and "as available", without warranties of any kind, ` +
+    `express or implied, including merchantability, fitness for a particular purpose and ` +
+    `non-infringement.`;
+/** `NoWarranty`'s limitation-of-liability heading. */
+export const LIABILITY_HEADING = "Limitation of liability";
+/** `NoWarranty`'s limitation-of-liability paragraph, templated with the operator and site name. */
+export const liabilityParagraph = (site) => `To the fullest extent the law allows, ${site.operator} is not liable for any indirect, ` +
+    `incidental, special, consequential or punitive damages, or for any loss of data or accounts, ` +
+    `arising from your use of ${site.siteName}.`;
+/** `Changes`'s h2 heading. */
+export const CHANGES_HEADING = "Changes";
+/** `Changes`'s full sentence, templated with the page's effective date. */
+export const changesParagraph = (date) => `We may update this page. It was last updated on ${date}.`;

package/dist/legal/index.d.ts

@@ -2,11 +2,13 @@
  * @file src/legal/index.ts
  * @desc @haruhimemoe/next-kit/legal: the five-page legal convention (terms, privacy,
  *       your-privacy-rights, copyright, disclaimers). `LegalSite` config, seven MDX blocks
- *       rendered from it, and `legalEntries` for the app's content registry.
+ *       rendered from it, `legalEntries` for the app's content registry, and
+ *       `legalMarkdownTransform` for the .md mirrors and llms-full.txt.
  * @author David @dvhsh (https://dvh.sh)
  * @created Mon Oct 5, 2026
  * @modified Mon Oct 5, 2026
  */
 export { Changes, type ChangesProps, DataWeKeep, DmcaNotice, type LegalBlockProps, LegalContact, NoWarranty, Processors, YourRights, } from "./blocks.js";
 export { type LegalPageOverrides, legalEntries } from "./entries.js";
+export { legalMarkdownTransform } from "./markdown.js";
 export { LEGAL_SLUGS, type LegalDataStore, type LegalProcessor, type LegalSite, type LegalSlug, } from "./types.js";

package/dist/legal/index.js

@@ -2,11 +2,13 @@
  * @file src/legal/index.ts
  * @desc @haruhimemoe/next-kit/legal: the five-page legal convention (terms, privacy,
  *       your-privacy-rights, copyright, disclaimers). `LegalSite` config, seven MDX blocks
- *       rendered from it, and `legalEntries` for the app's content registry.
+ *       rendered from it, `legalEntries` for the app's content registry, and
+ *       `legalMarkdownTransform` for the .md mirrors and llms-full.txt.
  * @author David @dvhsh (https://dvh.sh)
  * @created Mon Oct 5, 2026
  * @modified Mon Oct 5, 2026
  */
 export { Changes, DataWeKeep, DmcaNotice, LegalContact, NoWarranty, Processors, YourRights, } from "./blocks.js";
 export { legalEntries } from "./entries.js";
+export { legalMarkdownTransform } from "./markdown.js";
 export { LEGAL_SLUGS, } from "./types.js";

package/dist/legal/markdown.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @file src/legal/markdown.ts
+ * @desc `legalMarkdownTransform`: a `mdxToMarkdown` `transforms` entry (see ../docs/markdown.ts)
+ *       that turns each self-closing legal block tag (`<LegalContact />`, `<DataWeKeep />`,
+ *       `<Processors />`, `<YourRights />`, `<DmcaNotice />`, `<NoWarranty />`, `<Changes />`)
+ *       into Markdown carrying the same words as the matching React block in blocks.tsx. Without
+ *       this, mdxToMarkdown's rule 4 drops the unknown capitalized JSX and an app's .md mirrors
+ *       and llms-full.txt silently lose the legal text. The wording comes from ./copy.js, the
+ *       same module blocks.tsx renders from, so the two outputs can't drift apart.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+import type { LegalSite } from "./types.js";
+/**
+ * @function legalMarkdownTransform
+ * @param site {LegalSite} the site config every block renders from, same as the React blocks
+ * @returns {(source: string) => string} a next-kit `mdxToMarkdown` transform: replaces every
+ *   self-closing legal block tag with Markdown carrying the same words as its React block.
+ *   `<Changes date="YYYY-MM-DD" />` uses the given date, same as the `Changes` component's `date`
+ *   prop; `<Changes />` falls back to `site.effectiveDate`. Every other block takes no attributes.
+ */
+export declare const legalMarkdownTransform: (site: LegalSite) => (source: string) => string;

package/dist/legal/markdown.js

@@ -0,0 +1,115 @@
+/**
+ * @file src/legal/markdown.ts
+ * @desc `legalMarkdownTransform`: a `mdxToMarkdown` `transforms` entry (see ../docs/markdown.ts)
+ *       that turns each self-closing legal block tag (`<LegalContact />`, `<DataWeKeep />`,
+ *       `<Processors />`, `<YourRights />`, `<DmcaNotice />`, `<NoWarranty />`, `<Changes />`)
+ *       into Markdown carrying the same words as the matching React block in blocks.tsx. Without
+ *       this, mdxToMarkdown's rule 4 drops the unknown capitalized JSX and an app's .md mirrors
+ *       and llms-full.txt silently lose the legal text. The wording comes from ./copy.js, the
+ *       same module blocks.tsx renders from, so the two outputs can't drift apart.
+ * @author David @dvhsh (https://dvh.sh)
+ * @created Mon Oct 5, 2026
+ * @modified Mon Oct 5, 2026
+ */
+import { CCPA_HEADING, CCPA_RIGHTS, CHANGES_HEADING, CONTACT_HEADING, COOKIES_HEADING, COUNTER_NOTICE_HEADING, COUNTER_NOTICE_ITEMS_BEFORE_JURISDICTION, COUNTER_NOTICE_SIGNATURE, changesParagraph, contactIntro, counterNoticeJurisdiction, DATA_HEADING, DMCA_AGENT_INTRO, DMCA_HEADING, GDPR_HEADING, GDPR_RIGHTS, LIABILITY_HEADING, liabilityParagraph, PROCESSORS_HEADING, RIGHTS_CLOSING_INTRO, TAKEDOWN_HEADING, TAKEDOWN_ITEMS, WARRANTY_HEADING, warrantyParagraph, } from "./copy.js";
+/** One attribute on a self-closing tag: `name="value"`, `name='value'`, `name={"value"}` or
+ * `name={'value'}`. Only string-literal values are read; a JS expression prop is left alone. */
+const ATTR = /([\w-]+)=(?:"([^"]*)"|'([^']*)'|\{"([^"]*)"\}|\{'([^']*)'\})/g;
+/** Matches `<Name ...attrs.../>`, tolerating any run of whitespace and any attributes
+ * (quoted, single-quoted, braced, or valueless). */
+const tagPattern = (name) => new RegExp(`<${name}\\b((?:\\s+[\\w-]+(?:=(?:"[^"]*"|'[^']*'|\\{[^{}]*\\}))?)*)\\s*/>`, "g");
+/** Parses a matched tag's attribute string into a name -> value map. */
+const attributes = (body) => {
+    const out = {};
+    for (const match of body.matchAll(ATTR)) {
+        out[match[1]] = match[2] ?? match[3] ?? match[4] ?? match[5] ?? "";
+    }
+    return out;
+};
+/** `${intro}[email](mailto:email).`: an intro sentence plus a Markdown mailto link. */
+const mailtoLine = (intro, email) => `${intro}[${email}](mailto:${email}).`;
+/** One bullet per right, bold term then its plain-text description. */
+const rightsList = (rights) => rights.map((right) => `- **${right.term}** ${right.desc}`).join("\n");
+/** A numbered list, in source order. */
+const orderedList = (items) => items.map((item, index) => `${index + 1}. ${item}`).join("\n");
+const legalContactMarkdown = (site) => `## ${CONTACT_HEADING}\n\n${mailtoLine(contactIntro(site), site.contactEmail)}`;
+const dataWeKeepMarkdown = (site) => {
+    const stores = site.stores.map((store) => `- **${store.what}.** ${store.why}`).join("\n");
+    const cookies = site.cookies.length > 0
+        ? `\n\n### ${COOKIES_HEADING}\n\n${site.cookies.map((cookie) => `- ${cookie}`).join("\n")}`
+        : "";
+    return `## ${DATA_HEADING}\n\n${stores}${cookies}`;
+};
+const processorsMarkdown = (site) => {
+    const list = site.processors
+        .map((processor) => {
+        const name = processor.link ? `[${processor.name}](${processor.link})` : processor.name;
+        return `- **${name}** ${processor.purpose}`;
+    })
+        .join("\n");
+    return `## ${PROCESSORS_HEADING}\n\n${list}`;
+};
+const yourRightsMarkdown = (site) => [
+    `## ${GDPR_HEADING}`,
+    "",
+    rightsList(GDPR_RIGHTS),
+    "",
+    `## ${CCPA_HEADING}`,
+    "",
+    rightsList(CCPA_RIGHTS),
+    "",
+    mailtoLine(RIGHTS_CLOSING_INTRO, site.contactEmail),
+].join("\n");
+const dmcaNoticeMarkdown = (site) => [
+    `## ${DMCA_HEADING}`,
+    "",
+    ...(site.hosting ? [site.hosting, ""] : []),
+    mailtoLine(DMCA_AGENT_INTRO, site.contactEmail),
+    "",
+    `### ${TAKEDOWN_HEADING}`,
+    "",
+    orderedList(TAKEDOWN_ITEMS),
+    "",
+    `### ${COUNTER_NOTICE_HEADING}`,
+    "",
+    orderedList([
+        ...COUNTER_NOTICE_ITEMS_BEFORE_JURISDICTION,
+        counterNoticeJurisdiction(site),
+        COUNTER_NOTICE_SIGNATURE,
+    ]),
+].join("\n");
+const noWarrantyMarkdown = (site) => [
+    `## ${WARRANTY_HEADING}`,
+    "",
+    warrantyParagraph(site),
+    "",
+    `## ${LIABILITY_HEADING}`,
+    "",
+    liabilityParagraph(site),
+].join("\n");
+const changesMarkdown = (date) => `## ${CHANGES_HEADING}\n\n${changesParagraph(date)}`;
+/** Every block's tag name and Markdown renderer, keyed in the order they're tried. `Changes` is
+ * handled separately below so it can read its optional `date` attribute. */
+const SIMPLE_BLOCKS = [
+    ["LegalContact", legalContactMarkdown],
+    ["DataWeKeep", dataWeKeepMarkdown],
+    ["Processors", processorsMarkdown],
+    ["YourRights", yourRightsMarkdown],
+    ["DmcaNotice", dmcaNoticeMarkdown],
+    ["NoWarranty", noWarrantyMarkdown],
+];
+/**
+ * @function legalMarkdownTransform
+ * @param site {LegalSite} the site config every block renders from, same as the React blocks
+ * @returns {(source: string) => string} a next-kit `mdxToMarkdown` transform: replaces every
+ *   self-closing legal block tag with Markdown carrying the same words as its React block.
+ *   `<Changes date="YYYY-MM-DD" />` uses the given date, same as the `Changes` component's `date`
+ *   prop; `<Changes />` falls back to `site.effectiveDate`. Every other block takes no attributes.
+ */
+export const legalMarkdownTransform = (site) => (source) => {
+    let text = source.replace(tagPattern("Changes"), (_whole, body) => changesMarkdown(attributes(body).date ?? site.effectiveDate));
+    for (const [name, render] of SIMPLE_BLOCKS) {
+        text = text.replace(tagPattern(name), () => render(site));
+    }
+    return text;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haruhimemoe/next-kit",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "The Next.js plumbing the haruhime.moe tools share: JSON route helpers, rate limits and budgets in MongoDB, bearer machine auth, zod env parsing, a connect-once MongoDB client with safe index builds, better-auth with osu! sign-in, the signed-in marker and account store for the browser, SEO: metadata, robots.txt, sitemaps, JSON-LD and llms.txt, and per-app API keys and the /api/v1 guard.",
   "keywords": [
     "nextjs",