@lunora/privacy 0.0.0-stage → 1.0.0-alpha.1

package/LICENSE.md

@@ -0,0 +1,240 @@
+# Functional Source License, Version 1.1, Apache 2.0 Future License
+
+## Abbreviation
+
+FSL-1.1-Apache-2.0
+
+## Notice
+
+Copyright 2026 anolilab and contributors
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or service
+that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software that
+   exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee using
+   the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to the
+infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN
+IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following will
+apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.
+
+<!-- DEPENDENCIES -->
+
+# Licenses of bundled dependencies
+The published @lunora/privacy artifact additionally contains code with the following licenses:
+MIT
+
+# Bundled dependencies:
+## @visulima/path
+License: MIT
+By: Daniel Bannert
+Repository: git+https://github.com/visulima/visulima.git
+
+> MIT License
+>
+> Copyright (c) 2026 visulima
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+> SOFTWARE.
+>
+> ---
+>
+> MIT License
+>
+> Copyright (c) Pooya Parsa <pooya@pi0.io> - Daniel Roe <daniel@roe.dev>
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+> SOFTWARE.
+>
+> ---
+>
+> Copyright Joyent, Inc. and other Node contributors.
+>
+> Permission is hereby granted, free of charge, to any person obtaining a
+> copy of this software and associated documentation files (the
+> "Software"), to deal in the Software without restriction, including
+> without limitation the rights to use, copy, modify, merge, publish,
+> distribute, sublicense, and/or sell copies of the Software, and to permit
+> persons to whom the Software is furnished to do so, subject to the
+> following conditions:
+>
+> The above copyright notice and this permission notice shall be included
+> in all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+> OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+> MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+> NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+> DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+> OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+> USE OR OTHER DEALINGS IN THE SOFTWARE.
+>
+> ---
+>
+> Bundled zeptomatch (https://github.com/fabiospampinato/zeptomatch)
+>
+> The MIT License (MIT)
+>
+> Copyright (c) 2023-present Fabio Spampinato
+>
+> Permission is hereby granted, free of charge, to any person obtaining a
+> copy of this software and associated documentation files (the "Software"),
+> to deal in the Software without restriction, including without limitation
+> the rights to use, copy, modify, merge, publish, distribute, sublicense,
+> and/or sell copies of the Software, and to permit persons to whom the
+> Software is furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in
+> all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+> FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+> DEALINGS IN THE SOFTWARE.
+>
+>
+>
+> # Licenses of bundled dependencies
+> The published @visulima/path artifact additionally contains code with the following licenses:
+> MIT
+>
+> # Bundled dependencies:
+> ## binary-extensions
+> License: MIT
+> By: Sindre Sorhus
+> Repository: sindresorhus/binary-extensions
+>
+> > MIT License
+> >
+> > Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+> > Copyright (c) Paul Miller (https://paulmillr.com)
+> >
+> > Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+> >
+> > The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+> >
+> > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+<!-- /DEPENDENCIES -->
+
+<!-- TYPE_DEPENDENCIES -->
+<!-- /TYPE_DEPENDENCIES -->

package/README.md

@@ -1,3 +1,35 @@
-# Temporary Holding Version
+# @lunora/privacy
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Data-subject rights for Lunora apps: the GDPR Art. 15 and 20 export, Art. 17
+erasure, and retention holds for records the law says to keep.
+
+> **Not reviewed by a lawyer.** The legal and tax values in this package are research, not
+> legal advice, and no lawyer or tax adviser has checked them. The sources and open
+> questions are in `docs/legal.mdx`. Do not rely on a default until a qualified
+> lawyer and a tax adviser have reviewed it against your own processing.
+>
+> **Experimental.** The package is under development and is not released.
+
+## What is built
+
+- `retain`: a retention hold on a table's rows, naming a rule from a preset.
+- `definePrivacy`: the bound API, `privacyFor(ctx, identity?)`. Its `tick` reports requests near or past the Art. 12(3)
+  deadline, counted in calendar months under Reg. 1182/71 Art. 3(2)(c). Its `coverage` flags a table
+  that no dataset covers and that no exclusion explains. Its export decides, per
+  dataset, whether the archive lists Art. 15 only or Art. 15 and 20.
+- `@lunora/privacy/workflow`: the port RPC a durable workflow needs (`dispatchPort`,
+  `remotePorts`, the wire codec), derived from one method table.
+- `@lunora/privacy/eu`: the EU response time and erasure grace.
+- `@lunora/privacy/de`: the HGB §257 and AO §147 retention periods.
+
+## Status
+
+- Built and tested: the deadline and lifecycle rules, the request service, datasets,
+  the export archive, erasure, the deadline sweep, the signed download, restore
+  tombstones, the retention archive purge and the operator surface.
+- The Studio has a Privacy requests tab. It appears only when the app declares
+  `@lunora/privacy`.
+- Not finished: the runnable example app (`examples/privacy`) is not merged, the
+  workerd suite for the storage paths is not written, and registering the workflow
+  handlers from the per-call factory has not been checked against codegen (plan §4.2).
+- Not reviewed: every legal and tax value. See `docs/legal.mdx`.

package/dist/de.d.mts

@@ -0,0 +1,22 @@
+import { P as PrivacyPreset, R as RetentionRule } from "./packem_shared/rules.d-DJa3SIb3.mjs";
+/** Options for the German preset. Every option defaults to the decided value. */
+interface GermanyOptions {
+  /**
+   * The retention period for Buchungsbelege (vouchers and invoices): 8 is the statute for
+   * non-regulated businesses; 10 is the value decided on 2026-10-11, kept as the default. Regulated
+   * institutions keep 10 regardless of this option (HGB §257(4) S. 2).
+   */
+  readonly voucherYears?: 8 | 10;
+}
+/**
+ * German statutory retention periods (HGB §257, AO §147). Every rule is pending
+ * tax review. The package does not decide which table is a voucher; apps bind
+ * tables to these rules explicitly.
+ */
+declare const germany: (options?: GermanyOptions) => PrivacyPreset;
+/**
+ * The legal-claims hold. It is opt-in, because it applies only when the controller
+ * relies on Art. 17(3)(e) for specific data (LR L11).
+ */
+declare const legalClaimsHold: RetentionRule;
+export { type GermanyOptions, germany, legalClaimsHold };

package/dist/de.d.ts

@@ -0,0 +1,22 @@
+import { P as PrivacyPreset, R as RetentionRule } from "./packem_shared/rules.d-DJa3SIb3.js";
+/** Options for the German preset. Every option defaults to the decided value. */
+interface GermanyOptions {
+  /**
+   * The retention period for Buchungsbelege (vouchers and invoices): 8 is the statute for
+   * non-regulated businesses; 10 is the value decided on 2026-10-11, kept as the default. Regulated
+   * institutions keep 10 regardless of this option (HGB §257(4) S. 2).
+   */
+  readonly voucherYears?: 8 | 10;
+}
+/**
+ * German statutory retention periods (HGB §257, AO §147). Every rule is pending
+ * tax review. The package does not decide which table is a voucher; apps bind
+ * tables to these rules explicitly.
+ */
+declare const germany: (options?: GermanyOptions) => PrivacyPreset;
+/**
+ * The legal-claims hold. It is opt-in, because it applies only when the controller
+ * relies on Art. 17(3)(e) for specific data (LR L11).
+ */
+declare const legalClaimsHold: RetentionRule;
+export { type GermanyOptions, germany, legalClaimsHold };

package/dist/de.mjs

@@ -0,0 +1 @@
+const t=e=>e===8?"Set to the statutory 8 years (HGB §257(4) S. 1, AO §147(3) S. 1). Regulated institutions keep 10 years. Confirm with a tax adviser.":"Set to 10 years, the decided conservative value. The statute sets 8 years for Buchungsbelege (HGB §257(4) S. 1, AO §147(3) S. 1) and 10 years for regulated institutions. Keeping 10 years for non-regulated businesses conflicts with GDPR Art. 5(1)(e). Maintainer decision pending.",a=(e={})=>{const r=e.voucherYears??10;return{id:"de",retention:[{citation:"HGB §257(1) Nr. 1, (4) S. 1; AO §147(1) Nr. 1, (3) S. 1 (10 years, Handelsbücher and Jahresabschlüsse)",id:"de.books",reviewRequired:!0,start:"endOfCalendarYear",years:10},{citation:"HGB §257(1) Nr. 4, (4) S. 1; AO §147(1) Nr. 4, (3) S. 1 (statute: 8 years; see note)",id:"de.voucher",note:t(r),reviewRequired:!0,start:"endOfCalendarYear",years:r},{citation:"HGB §257(4) S. 2 (10 years for Kreditinstitute, Versicherungsunternehmen, Wertpapierinstitute)",id:"de.voucher.regulated",reviewRequired:!0,start:"endOfCalendarYear",years:10},{citation:"HGB §257(1) Nr. 2, 3, (4) S. 1; AO §147(1) Nr. 2, 3, (3) S. 1 (6 years, Handels- and Geschäftsbriefe)",id:"de.correspondence",reviewRequired:!0,start:"endOfCalendarYear",years:6}]}},s={citation:"BGB §195, §199(1)",id:"de.legalClaims",reviewRequired:!0,start:"endOfCalendarYear",years:3};export{a as germany,s as legalClaimsHold};

package/dist/eu.d.mts

@@ -0,0 +1,23 @@
+import { P as PrivacyPreset } from "./packem_shared/rules.d-DJa3SIb3.mjs";
+/** Art. 12(3): months from receipt to the response. LR review (L1) is still open. */
+declare const EU_RESPONSE_MONTHS = 1;
+/** The default erasure grace in days: decision D3. Capped before the deadline (L9). */
+declare const DEFAULT_ERASURE_GRACE_DAYS = 14;
+/** The longest grace an app may set, in days. Beyond this the cap is the only protection. */
+declare const MAX_ERASURE_GRACE_DAYS = 14;
+/** Options for the EU preset. Every option defaults to the decided value. */
+interface EuOptions {
+  /** Days between an accepted erasure request and the start of erasure. Integer, 0 to 14. Default 14. */
+  readonly erasureGraceDays?: number;
+}
+/**
+ * Refuse a grace that is not a whole number of days in range. Used by the preset and
+ * by `definePrivacy`, so both enforce the same range.
+ */
+declare const checkErasureGraceDays: (days: number) => number;
+/**
+ * EU GDPR preset: the response time and the erasure grace. Every value carries
+ * `reviewRequired`. The legal basis for each value is in `docs/legal.mdx`.
+ */
+declare const eu: (options?: EuOptions) => PrivacyPreset;
+export { DEFAULT_ERASURE_GRACE_DAYS, EU_RESPONSE_MONTHS, EuOptions, MAX_ERASURE_GRACE_DAYS, checkErasureGraceDays, eu };

package/dist/eu.d.ts

@@ -0,0 +1,23 @@
+import { P as PrivacyPreset } from "./packem_shared/rules.d-DJa3SIb3.js";
+/** Art. 12(3): months from receipt to the response. LR review (L1) is still open. */
+declare const EU_RESPONSE_MONTHS = 1;
+/** The default erasure grace in days: decision D3. Capped before the deadline (L9). */
+declare const DEFAULT_ERASURE_GRACE_DAYS = 14;
+/** The longest grace an app may set, in days. Beyond this the cap is the only protection. */
+declare const MAX_ERASURE_GRACE_DAYS = 14;
+/** Options for the EU preset. Every option defaults to the decided value. */
+interface EuOptions {
+  /** Days between an accepted erasure request and the start of erasure. Integer, 0 to 14. Default 14. */
+  readonly erasureGraceDays?: number;
+}
+/**
+ * Refuse a grace that is not a whole number of days in range. Used by the preset and
+ * by `definePrivacy`, so both enforce the same range.
+ */
+declare const checkErasureGraceDays: (days: number) => number;
+/**
+ * EU GDPR preset: the response time and the erasure grace. Every value carries
+ * `reviewRequired`. The legal basis for each value is in `docs/legal.mdx`.
+ */
+declare const eu: (options?: EuOptions) => PrivacyPreset;
+export { DEFAULT_ERASURE_GRACE_DAYS, EU_RESPONSE_MONTHS, EuOptions, MAX_ERASURE_GRACE_DAYS, checkErasureGraceDays, eu };

package/dist/eu.mjs

@@ -0,0 +1 @@
+import{LunoraError as o}from"@lunora/errors";const t=1,n=14,r=14,s=e=>{if(!Number.isInteger(e)||e<0||e>r)throw new o("BAD_REQUEST",`The erasure grace must be a whole number of days from 0 to ${String(r)}; got ${String(e)}.`);return e},E=(e={})=>({id:"eu",policy:{erasureGraceDays:s(e.erasureGraceDays??n),extensionMonths:2,responseMonths:t,reviewRequired:!0},retention:[]});export{n as DEFAULT_ERASURE_GRACE_DAYS,t as EU_RESPONSE_MONTHS,r as MAX_ERASURE_GRACE_DAYS,s as checkErasureGraceDays,E as eu};

package/dist/index.d.mts

@@ -0,0 +1,54 @@
+import { A as AUTH_DEFAULT_TABLES, D as Dataset, R as RequestStatus, b as RequestType, c as RequestRecord } from "./packem_shared/define.d-B0cbIvBs.mjs";
+export { type d as ArchivePort, type C as CoverageProblem, type e as DataOrigin, type f as DataPort, type g as DatasetPhase, type h as DatasetPlacement, type i as DatasetSpec, type j as Disposition, E as ERASE_BATCH, type k as ErasureOptions, type l as ErasureOutcome, type m as ExportOutcome, type L as LegalBasis, type n as Privacy, type P as PrivacyConfig, type o as PrivacyFor, type p as PrivacyIdentity, type a as PrivacyPorts, type q as PrivacyWorkflowContext, type r as RequestStore, type s as RetryResult, type t as RowDisposition, type S as StorePort, type u as SweepResult, type T as TableErasure, type v as TableSpec, type w as TombstonePort, x as defineDataset, y as definePrivacy, z as dispositionFor, B as isTerminal } from "./packem_shared/define.d-B0cbIvBs.mjs";
+export { type a as PrivacyPolicy, type P as PrivacyPreset, type b as RetainDirective, type R as RetentionRule, type c as RetentionStart, r as retain } from "./packem_shared/rules.d-DJa3SIb3.mjs";
+import { TableDefinition, SchemaExtension } from '@lunora/server';
+/** The better-auth table names `authDataset` covers by default. Codegen's coverage check reads the same list. */
+type AuthTable = (typeof AUTH_DEFAULT_TABLES)[number];
+/** The better-auth tables that hold a user's data, renamed. A table left out keeps its default name. */
+type AuthTableNames = { readonly [T in AuthTable]?: string; };
+/**
+ * The sign-in dataset. Table names default to better-auth's; `@lunora/auth` does
+ * not define these tables itself, so an app that renamed them passes the names.
+ */
+declare const authDataset: (names?: AuthTableNames) => Dataset;
+/** The document history: an append-only record of past row versions, written by table triggers. */
+declare const documentHistoryDataset: (table?: string) => Dataset;
+/** Cached action results. They are derived from the subject's own requests, and expire on their own. */
+declare const actionCacheDataset: (table?: string) => Dataset;
+/** The subject's files in object storage, under the key prefix `prefix` returns for that subject. */
+declare const storageObjectsDataset: (prefix: (subjectId: string) => string) => Dataset;
+/** Every status that is not terminal, for a `listOpen` that reads a status index once per status. */
+declare const OPEN_STATUSES: ReadonlyArray<RequestStatus>;
+/** The columns of a `privacy_requests` row. Dates are epoch milliseconds; `requestId` is the package's id. */
+interface RequestRow {
+  readonly dueAt: number;
+  readonly erasureGraceUntil?: number;
+  readonly expiresAt?: number;
+  readonly extendedDueAt?: number;
+  readonly reason?: string;
+  readonly receivedAt: number;
+  readonly requestId: string;
+  readonly status: RequestStatus;
+  readonly storageKey?: string;
+  readonly subjectId: string;
+  readonly type: RequestType;
+}
+/** A stored row as the package sees it: every date a `Date`. */
+declare const fromRequestRow: (row: RequestRow) => RequestRecord;
+/** A request as the row `RequestStore.insert` writes. */
+declare const toRequestRow: (record: RequestRecord) => RequestRow;
+/** A `RequestStore.update` patch as row columns. Only the keys the patch sets are written; `subjectId` is one of them. */
+declare const toRequestPatch: (patch: Partial<Omit<RequestRecord, "id">>) => Partial<Omit<RequestRow, "requestId">>;
+/** The three tables, before the `privacy_` prefix. */
+declare const privacyExtension: SchemaExtension<Record<"archive" | "events" | "requests", TableDefinition>, "privacy">;
+export {
+/**
+ * `@lunora/privacy`: data-subject rights for Lunora apps. Export (GDPR Art. 15
+ * and 20), erasure (Art. 17) and retention holds. This entry holds the pure core;
+ * the jurisdiction presets live at `./eu` and `./de`.
+ *
+ * The surface is what an app calls or annotates: the datasets, the bound API, the
+ * ports it implements and the retention directives. The services behind them stay
+ * internal, so the app reaches them through `definePrivacy`.
+ */
+type AuthTableNames, type Dataset, OPEN_STATUSES, type RequestRecord, type RequestRow, type RequestStatus, type RequestType, actionCacheDataset, authDataset, documentHistoryDataset, fromRequestRow, privacyExtension, storageObjectsDataset, toRequestPatch, toRequestRow };

package/dist/index.d.ts

@@ -0,0 +1,54 @@
+import { A as AUTH_DEFAULT_TABLES, D as Dataset, R as RequestStatus, b as RequestType, c as RequestRecord } from "./packem_shared/define.d-Dv7btZmk.js";
+export { type d as ArchivePort, type C as CoverageProblem, type e as DataOrigin, type f as DataPort, type g as DatasetPhase, type h as DatasetPlacement, type i as DatasetSpec, type j as Disposition, E as ERASE_BATCH, type k as ErasureOptions, type l as ErasureOutcome, type m as ExportOutcome, type L as LegalBasis, type n as Privacy, type P as PrivacyConfig, type o as PrivacyFor, type p as PrivacyIdentity, type a as PrivacyPorts, type q as PrivacyWorkflowContext, type r as RequestStore, type s as RetryResult, type t as RowDisposition, type S as StorePort, type u as SweepResult, type T as TableErasure, type v as TableSpec, type w as TombstonePort, x as defineDataset, y as definePrivacy, z as dispositionFor, B as isTerminal } from "./packem_shared/define.d-Dv7btZmk.js";
+export { type a as PrivacyPolicy, type P as PrivacyPreset, type b as RetainDirective, type R as RetentionRule, type c as RetentionStart, r as retain } from "./packem_shared/rules.d-DJa3SIb3.js";
+import { TableDefinition, SchemaExtension } from '@lunora/server';
+/** The better-auth table names `authDataset` covers by default. Codegen's coverage check reads the same list. */
+type AuthTable = (typeof AUTH_DEFAULT_TABLES)[number];
+/** The better-auth tables that hold a user's data, renamed. A table left out keeps its default name. */
+type AuthTableNames = { readonly [T in AuthTable]?: string; };
+/**
+ * The sign-in dataset. Table names default to better-auth's; `@lunora/auth` does
+ * not define these tables itself, so an app that renamed them passes the names.
+ */
+declare const authDataset: (names?: AuthTableNames) => Dataset;
+/** The document history: an append-only record of past row versions, written by table triggers. */
+declare const documentHistoryDataset: (table?: string) => Dataset;
+/** Cached action results. They are derived from the subject's own requests, and expire on their own. */
+declare const actionCacheDataset: (table?: string) => Dataset;
+/** The subject's files in object storage, under the key prefix `prefix` returns for that subject. */
+declare const storageObjectsDataset: (prefix: (subjectId: string) => string) => Dataset;
+/** Every status that is not terminal, for a `listOpen` that reads a status index once per status. */
+declare const OPEN_STATUSES: ReadonlyArray<RequestStatus>;
+/** The columns of a `privacy_requests` row. Dates are epoch milliseconds; `requestId` is the package's id. */
+interface RequestRow {
+  readonly dueAt: number;
+  readonly erasureGraceUntil?: number;
+  readonly expiresAt?: number;
+  readonly extendedDueAt?: number;
+  readonly reason?: string;
+  readonly receivedAt: number;
+  readonly requestId: string;
+  readonly status: RequestStatus;
+  readonly storageKey?: string;
+  readonly subjectId: string;
+  readonly type: RequestType;
+}
+/** A stored row as the package sees it: every date a `Date`. */
+declare const fromRequestRow: (row: RequestRow) => RequestRecord;
+/** A request as the row `RequestStore.insert` writes. */
+declare const toRequestRow: (record: RequestRecord) => RequestRow;
+/** A `RequestStore.update` patch as row columns. Only the keys the patch sets are written; `subjectId` is one of them. */
+declare const toRequestPatch: (patch: Partial<Omit<RequestRecord, "id">>) => Partial<Omit<RequestRow, "requestId">>;
+/** The three tables, before the `privacy_` prefix. */
+declare const privacyExtension: SchemaExtension<Record<"archive" | "events" | "requests", TableDefinition>, "privacy">;
+export {
+/**
+ * `@lunora/privacy`: data-subject rights for Lunora apps. Export (GDPR Art. 15
+ * and 20), erasure (Art. 17) and retention holds. This entry holds the pure core;
+ * the jurisdiction presets live at `./eu` and `./de`.
+ *
+ * The surface is what an app calls or annotates: the datasets, the bound API, the
+ * ports it implements and the retention directives. The services behind them stay
+ * internal, so the app reaches them through `definePrivacy`.
+ */
+type AuthTableNames, type Dataset, OPEN_STATUSES, type RequestRecord, type RequestRow, type RequestStatus, type RequestType, actionCacheDataset, authDataset, documentHistoryDataset, fromRequestRow, privacyExtension, storageObjectsDataset, toRequestPatch, toRequestRow };

package/dist/index.mjs

@@ -0,0 +1 @@
+import{actionCacheDataset as o,authDataset as r,documentHistoryDataset as a,storageObjectsDataset as s}from"./packem_shared/actionCacheDataset-BoSTUArg.mjs";import{defineDataset as i}from"./packem_shared/defineDataset-BoLQrc_1.mjs";import{definePrivacy as p}from"./packem_shared/definePrivacy-DsCj6Gwv.mjs";import{ERASE_BATCH as n,dispositionFor as c}from"./packem_shared/ERASE_BATCH-BqeymwxG.mjs";import{OPEN_STATUSES as R}from"./packem_shared/OPEN_STATUSES-B_NpOD7X.mjs";import{fromRequestRow as D,toRequestPatch as E,toRequestRow as S}from"./packem_shared/fromRequestRow-D-Vn3ieZ.mjs";import{retain as h}from"./packem_shared/retain-BtQqIGNh.mjs";import{default as y}from"./packem_shared/privacyExtension-EMCPGigC.mjs";import{isTerminal as P}from"./packem_shared/isTerminal-C0AnfFUl.mjs";export{n as ERASE_BATCH,R as OPEN_STATUSES,o as actionCacheDataset,r as authDataset,i as defineDataset,p as definePrivacy,c as dispositionFor,a as documentHistoryDataset,D as fromRequestRow,P as isTerminal,y as privacyExtension,h as retain,s as storageObjectsDataset,E as toRequestPatch,S as toRequestRow};

package/dist/packem_shared/ERASE_BATCH-BqeymwxG.mjs

@@ -0,0 +1 @@
+import{LunoraError as s}from"@lunora/errors";import{retentionRulesOf as a,retainUntil as u}from"./retain-BtQqIGNh.mjs";const h=100,f=(e,n,t,r)=>{if(e.from===void 0)return t;const o=n[e.from],i=o instanceof Date||typeof o=="number"?new Date(o):void 0;if(i===void 0||Number.isNaN(i.getTime()))throw new s("BAD_REQUEST",`Retention for ${r} starts from column "${e.from}", which must hold a Date or epoch milliseconds; got ${o===null?"null":typeof o}.`);return i},m=(e,n,t,r,o)=>{const i=t.get(e.rule);if(i===void 0)throw new s("BAD_REQUEST",`Retention rule "${e.rule}" is not in the preset set.`);const l=u(i,f(e,n,r,o));return l.getTime()>r.getTime()?{kind:"keep",until:l}:{kind:"delete"}},c=e=>(n,t,r,o)=>{const i=n.tables[t]?.erase??"delete";return i==="delete"||i==="anonymise"?{kind:i}:m(i,r,e,o,`${n.id}.${t}`)},E=async(e,n=1e4)=>{for(let t=1;t<=n;t+=1)if(!(await e()).hasMore)return t;throw new s("INTERNAL",`Erasure did not finish within ${String(n)} batches; the table may be refilling.`)},w=(e,n={})=>{const t=Object.entries(e).filter(([r,o])=>o>(n[r]??0)).map(([r])=>r).toSorted((r,o)=>r.localeCompare(o));return{complete:t.length===0,leftover:t}},g=e=>c(a(e));export{h as ERASE_BATCH,c as dispositionFor,g as dispositionForPresets,E as drainUntilEmpty,w as verifyErasure};

package/dist/packem_shared/OPEN_STATUSES-B_NpOD7X.mjs

@@ -0,0 +1 @@
+import{LunoraError as m}from"@lunora/errors";import{isTerminal as s,REQUEST_STATUSES as i}from"./isTerminal-C0AnfFUl.mjs";import{D as r}from"./deadlines-DlEH-01d.mjs";const p=e=>e.extendedDueAt??e.dueAt,u=e=>!s(e)&&e!=="ready",x=(e,t)=>u(e.status)&&t.getTime()>p(e).getTime(),c={erasure:"grace",export:"received"},T=new Set(Object.values(c)),A={cancelled:[],completed:[],expired:[],failed:["processing"],grace:["failed","processing"],processing:["completed","failed","ready"],ready:["expired"],received:["failed","processing"]};class E extends m{constructor(t,n){super("UNPROCESSABLE",`A privacy request cannot move from "${t}" to "${n}".`),this.from=t,this.to=n,this.name="InvalidTransitionError"}from;to}const N=e=>i.includes(e),h=i.filter(e=>!s(e)),S=(e,t)=>t==="cancelled"?T.has(e):A[e].includes(t),I=(e,t)=>{if(!S(e,t))throw new E(e,t);return t},_=(e,t)=>c[e]===t,C=(e,t)=>e.extendedDueAt===void 0&&t.getTime()<e.dueAt.getTime(),g=3,L=(e,t,n,o)=>{const a=Math.max(g,o),d=e.getTime()+n*r,l=t.getTime()-a*r;return new Date(Math.min(d,l))};export{E as InvalidTransitionError,g as MIN_DRAIN_BUDGET_DAYS,h as OPEN_STATUSES,u as awaitsResponse,_ as canCancel,C as canExtend,S as canTransition,p as effectiveDueAt,L as erasureGraceUntil,x as isOverdue,N as isRequestStatus,s as isTerminal,I as transition};

package/dist/packem_shared/actionCacheDataset-BoSTUArg.mjs

@@ -0,0 +1 @@
+import{A as a}from"./privacy-coverage-Edq9aBy0.mjs";import{defineDataset as t}from"./defineDataset-BoLQrc_1.mjs";const r={account:["password","accessToken","refreshToken","idToken"],apikey:["key"],member:[],passkey:[],session:["token"],teamMember:[],twoFactor:["secret","backupCodes"],user:[]},c=(e={})=>t("auth",{legalBasis:"contract",origin:"provided",purpose:"Sign-in identity: the account, its sessions, linked sign-in methods and second factors",tables:Object.fromEntries(a.map(s=>{const o=r[s];return[e[s]??s,o.length===0?{}:{omit:o}]}))}),d=(e="documentHistory")=>t("documentHistory",{legalBasis:"contract",origin:"observed",purpose:"Earlier versions of the subject's rows, kept for undo and for the record of changes",tables:{[e]:{}}}),p=(e="actionCache")=>t("actionCache",{legalBasis:"legitimate_interest",origin:"derived",purpose:"Cached results of the subject's own requests, kept for a short time to save repeated work",tables:{[e]:{}}}),u=e=>t("storageObjects",{files:{prefix:e},legalBasis:"contract",origin:"provided",purpose:"Files the subject uploaded",tables:{}});export{p as actionCacheDataset,c as authDataset,d as documentHistoryDataset,u as storageObjectsDataset};

package/dist/packem_shared/deadlines-DlEH-01d.mjs

@@ -0,0 +1 @@
+const U=864e5,n=(e,t)=>{const a=e.getUTCFullYear(),T=e.getUTCMonth()+t,s=new Date(Date.UTC(a,T,1)),C=new Date(Date.UTC(s.getUTCFullYear(),s.getUTCMonth()+1,0)).getUTCDate();return s.setUTCDate(Math.min(e.getUTCDate(),C)),s.setUTCHours(e.getUTCHours(),e.getUTCMinutes(),e.getUTCSeconds(),e.getUTCMilliseconds()),s},o={extensionMonths:2,responseMonths:1},r=(e,t=o)=>n(e,t.responseMonths),D=(e,t=o)=>n(e,t.responseMonths+t.extensionMonths);export{U as D,n as a,o as b,r as d,D as e};