@softure-ai/privacy 0.0.0-stage → 0.1.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SOFTURE
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,273 @@
-# Temporary Holding Version
+# @softure-ai/privacy
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+GDPR self-service and consent evidence for a Next.js app: a signed-in user downloads everything
+the app stores about them as JSON, or deletes their account, and neither lists tables by hand; every
+consent is recorded with the version of the legal document it was given to; legal pages render
+from the app's own text. Every enabled module that
+holds user data contributes its own export and deletion; the app adds its own contributors. Built
+from FIRE_TRACKER's `src/db/{account-export,account-deletion}.ts`, `src/app/api/moje-dane/` and
+`scripts/delete-empty-account.mts`, where the tables were listed by hand and deletion ran only from
+a CLI, and FIRE's `components/{legal-document,legal-section,legal-footer}.tsx`; FIRE checked the
+registration checkbox but stored nothing.
+
+## 1. What it provides
+
+- **A contributor registry.** Each module states what it holds through
+  `defineModule({ privacy: { exportUserData, deleteUserData } })` (`@softure-ai/core`, checked
+  against its manifest's `privacy` flags); the app adds `privacy({ contributors })`. A module is in
+  the export and the deletion by being enabled.
+- **The export.** `GET /api/privacy/export` answers a JSON attachment (`account-data-<date>.json`)
+  with every contributor's part under its id, read in one repeatable-read transaction, bounded by
+  `export.maxBytes`.
+- **The deletion.** A page with the export link and a delete form that asks for the current
+  password and an explicit confirmation. Every contributor deletes in one transaction; a refusal or
+  a failure rolls everything back. The sessions end with the account, the cookie is cleared, and the
+  browser lands on `afterDelete`.
+- **The consent ledger.** `privacy.consents` records who agreed to what, when, where and against
+  which version of which legal document. It is append-only: a withdrawal is a new row, and the
+  database refuses to update one. A ready hook records the registration checkbox of
+  `@softure-ai/auth`; other modules (the waitlist) record their own scopes.
+- **The legal document shell.** `LegalDocument`, `LegalSection` and `LegalFooter` render the app's
+  terms and privacy policy: version, effective date, table of contents, change history.
+
+`@softure-ai/auth`, `@softure-ai/feature-switches` and `@softure-ai/mcp-access` contribute already (their README section 11).
+
+## 2. Installation
+
+```bash
+npm install @softure-ai/privacy @softure-ai/auth @softure-ai/security @softure-ai/core @softure-ai/db @softure-ai/ui drizzle-orm
+```
+
+Peer dependencies: `next` 16, `react` 19, `drizzle-orm`. The module depends on `auth` (the account
+and the session) and `security` (rate limits): a configuration without them fails at startup.
+
+## 3. Configuration
+
+```ts
+import { auth, AUTH_RATE_LIMIT_BUCKETS } from "@softure-ai/auth";
+import { privacy, PRIVACY_RATE_LIMIT_BUCKETS } from "@softure-ai/privacy";
+import { security } from "@softure-ai/security";
+import { deleteProfile, exportProfile } from "./lib/profile-privacy";
+
+// in defineSoftureConfig({ modules: [...] }):
+security({ clientIp: cloudflareIp(), buckets: { ...AUTH_RATE_LIMIT_BUCKETS, ...PRIVACY_RATE_LIMIT_BUCKETS } }),
+auth({ ... }),
+auth({ onRegistered: recordRegistrationConsent() }), // from @softure-ai/privacy/server
+privacy({
+  documents: [
+    { id: "terms", version: "2026-10-01" },
+    { id: "privacy-policy", version: "2026-10-01" },
+  ],
+  contributors: [{ id: "profile", exportUserData: exportProfile, deleteUserData: deleteProfile }],
+}),
+```
+
+| Option | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `contributors` | `AppPrivacyContributor[]` | `[]` | The app's own data: `{ id, exportUserData?, deleteUserData? }`, at least one function each. |
+| `contributors[].id` | `string` | required | Kebab-case, at most 64 characters, unique, and not the id of an enabled module: it is the key of the contributor's part of the export. |
+| `documents` | `{ id, version }[]` | `[]` | The app's legal documents and the versions in force. A consent names a document by id and privacy records this version with it. Change `version` whenever the published text changes (a date such as `2026-10-01` works well). |
+| `documents[].id` | `string` | required | Kebab-case, at most 64 characters, unique, e.g. `terms`, `privacy-policy`. |
+| `documents[].version` | `string` | required | 1-32 letters, digits, `.`, `_` or `-`. |
+| `export.maxBytes` | `number` | `10485760` (10 MiB) | The largest export, in bytes of JSON (1 KiB to 100 MiB). A larger one is refused with `privacy.export_too_large`. |
+| `export.fileName` | `string` | `account-data` | The download's name before the date. |
+| `routes` | `{ account, export, afterDelete }` | `/account/privacy`, `/api/privacy/export`, `/` | Where the page and the route are mounted, and where a deleted account lands. |
+| `messages` | partial `pl` / `en` dictionaries | built in | Copy overrides (section 9). |
+
+A contributor is two functions over the module context (`{ db, clock, config }`, `db` being the
+transaction) and the user id:
+
+```ts
+import { ok, type ModuleContext } from "@softure-ai/core";
+import type { Queryable } from "@softure-ai/db";
+import { eq } from "drizzle-orm";
+import { profiles } from "../db/schema";
+
+export async function exportProfile(context: ModuleContext, userId: string) {
+  const db = context.db as Queryable;
+  const [profile] = await db.select().from(profiles).where(eq(profiles.userId, userId));
+  return ok({ displayName: profile?.displayName ?? null });
+}
+
+export async function deleteProfile(context: ModuleContext, userId: string) {
+  await (context.db as Queryable).delete(profiles).where(eq(profiles.userId, userId));
+  return ok();
+}
+```
+
+Rules for a contributor:
+
+- Query through `context.db` only: it is the transaction. A query on another handle is outside the
+  rollback and, under Postgres, waits on the transaction's locks.
+- `exportUserData` only reads: the export runs in a read-only transaction. Export plain JSON
+  values (dates become ISO strings), and never secrets: password hashes, token hashes, API keys.
+- Delete (or anonymise) everything that names the user. To keep data for a legal reason, return an
+  `Err` from `deleteUserData`: nothing is deleted, the user sees `privacy.deletion_refused`, and the
+  contributor's id and code are logged.
+- Throw only for bugs and database failures; both roll the deletion back.
+
+**Order.** The export runs the modules in the config's dependency order (dependencies first), then
+the app's contributors in their listed order. The deletion runs the reverse: the app's contributors
+first (last listed first), then each module before the modules it depends on, auth last. A row is
+therefore always deleted before the rows it references, whatever its foreign key's `ON DELETE`.
+
+### Consents
+
+```ts
+import { getConsent, hasConsent, listConsents, recordConsent } from "@softure-ai/privacy/server";
+
+await recordConsent(ctx, { subject: { userId }, purpose: "newsletter", granted: true, source: "account" });
+await recordConsent(ctx, { subject: { email }, purpose: "newsletter", granted: false, source: "unsubscribe" });
+await recordConsent(ctx, { subject: { userId }, purpose: "terms", granted: true, document: "terms", source: "account" });
+await hasConsent(ctx, { subject: { userId }, purpose: "terms" }); // latest row granted, current version
+```
+
+- `subject` is an account (`{ userId }`) or an email address without one (`{ email }`, stored as a
+  SHA-256 key, never as the address; `{ emailKey }` names the same subject by that key, for a
+  caller that holds only the key, such as mailing's unsubscribe hook). Reads keep the two apart; the export and the deletion of an
+  account cover both, so a waitlist consent given before registering goes with the account.
+- `purpose` and `source` are kebab-case (at most 64 characters); `document` names a declared
+  document, whose configured version is recorded. A bad subject, purpose or source gives
+  `privacy.consent_invalid`, an undeclared document `privacy.document_unknown`.
+- A withdrawal is `granted: false`: a new row, the earlier one stays as evidence. The state of a
+  purpose is its latest row: `getConsent` returns it with `isCurrentVersion` (false once the
+  document's configured version moved on, or the document is no longer declared), `hasConsent` is
+  true only for a granted row of the current version, `listConsents` gives the whole history.
+- Call these inside the transaction of the action they belong to (`ctx.db` being the transaction),
+  so the action and its evidence commit together.
+
+**Registration.** `recordRegistrationConsent({ documents? })` is an `onRegistered` hook for auth:
+when the app keeps `requireConsent` on, it records one row per document (purpose = the document's
+id, source `registration`) at the account's creation time, in the account's transaction. By
+default it records every declared document; `documents: ["terms"]` narrows it. With no document
+declared, or an undeclared one named, it throws and the registration rolls back: an account never
+exists without the evidence of its consent.
+
+## 4. Mounting
+
+```ts
+// app/account/privacy/page.tsx: the export link and the delete form; redirects to login without a session.
+export { PrivacyPage as default } from "@softure-ai/privacy/next";
+export const dynamic = "force-dynamic";
+```
+
+```ts
+// app/api/privacy/export/route.ts: the JSON download for the session's user.
+export { exportRoute as GET } from "@softure-ai/privacy/next";
+```
+
+Legal pages are the app's own pages around `LegalDocument`, with the text from the app's
+dictionaries or content files and the version from the config:
+
+```tsx
+// app/legal/terms/page.tsx
+import { getPrivacyMessages } from "@softure-ai/privacy/next";
+import { getLegalDocument } from "@softure-ai/privacy/server";
+import { LegalDocument } from "@softure-ai/privacy/ui";
+import config from "../../../softure.config";
+import { terms } from "../../../content/terms";
+
+export default function TermsPage() {
+  return (
+    <LegalDocument
+      title={terms.title}
+      version={getLegalDocument(config, "terms").version}
+      effectiveFrom="2026-10-01"
+      sections={terms.sections} // [{ id: "your-account", title: "2. Your account", content: <p>…</p> }]
+      changes={terms.changes} // newest first: [{ version, date: "2026-10-01", summary }]
+      messages={getPrivacyMessages(config)}
+      locale={config.locale}
+    />
+  );
+}
+```
+
+`LegalFooter` (`links: [{ href, label }]`, an optional `note`) goes into the root layout.
+
+Link the page from the app's account page. To build your own page, compose `DeleteAccountForm`
+from `@softure-ai/privacy/ui` with `deleteAccountAction` from `/next`, and link to the export route.
+
+The route answers 401 without a session, 429 with `retry-after` over the `privacy-export` limit,
+413 over `export.maxBytes` and 500 when a contributor fails, each with `{ error: <code> }`. The
+action reads the user from the session before it reads the form, and Next refuses it from another
+origin. Outside a request, call `collectUserData(ctx, userId)` and `eraseUserData(ctx, userId)`
+from `/server` (for example from an operator script); they apply no rate limit and ask for no
+password.
+
+## 5. Migrations and tables
+
+Schema `privacy`, one migration:
+
+| Table | Columns | Notes |
+| --- | --- | --- |
+| `consents` | `id` (identity), `user_id` (FK `auth.users`, cascade) or `email_key` (base64url SHA-256 of the trimmed, lowercased address), `purpose`, `granted`, `document_id` + `document_version` (both or neither), `source`, `recorded_at` | exactly one subject (`consents_one_subject`); a `BEFORE UPDATE` trigger refuses every update; indexed by subject, purpose and time |
+
+The export and the deletion run every other contributor on its own tables. `GET /api/health` of
+`@softure-ai/ops` checks that the table answers.
+
+## 6. Environment variables
+
+None.
+
+## 7. Switches
+
+None.
+
+## 8. Appearance
+
+The page is built from `@softure-ai/ui` (`Card`, `ButtonLink`, `PasswordField`, `Checkbox`,
+`FormError`, `Button` with the `danger` variant) and uses only its compiled classes, so
+`@softure-ai/ui/styles.css` styles it and the `--sft-*` tokens theme it. `DeleteAccountForm` takes
+`classNames` for its slots (`root`, `description`, `form`) and `unstyled`.
+
+The legal components are server components with the same rules. `LegalDocument` slots: `root`,
+`header`, `title`, `meta`, `intro`, `contents`, `contentsTitle`, `contentsList`, `link`, `changes`,
+`changesTitle`, `changesList`, `change`, `changeMeta`, and `sectionClassNames` for every
+`LegalSection` (`root`, `title`, `body`). `LegalFooter` slots: `root`, `list`, `link`, `note`.
+Sections scroll into view below a sticky header through `scroll-mt`; dates (`YYYY-MM-DD`) are
+written in the app's locale, in UTC so the server's time zone cannot move them.
+
+## 9. Copy
+
+`privacyMessages.{en,pl}`: `page` (title, lead), `export` (title, description, button), `delete`
+(title, description, password label, confirmation, submit and pending labels), `legal` (contents,
+version, effective from, change history, the footer's navigation name) and `errors` for every
+code the form and the route can give (`privacy.*`, `auth.unauthenticated`, `security.rate_limited`,
+`core.*`). Override any of them with
+`privacy({ messages: { pl: { errors: { privacy: { deletion_refused: "…" } } } } })`, for example to
+say how to reach the app's support.
+
+## 10. Hooks
+
+The contributors (section 3) are the hooks. `recordRegistrationConsent()` is a ready hook for
+auth's `onRegistered` (section 3). The rate limit buckets, both per user, are
+`PRIVACY_RATE_LIMIT_BUCKETS`: `privacy-export` (5 an hour) and `privacy-delete` (5 attempts in 15
+minutes, each a password check). Spread them into `security({ buckets })`; a missing bucket throws
+on first use and names it.
+
+## 11. GDPR
+
+This module is the GDPR surface: right of access (the export) and right to erasure (the deletion),
+and the evidence of consent (Art. 7(1)). What each module exports and deletes is in that module's
+section 11.
+
+Its own part is the consent ledger. The export lists every consent of the account and of its email
+address (`privacy.consents`, oldest first, each marked `account` or `email`; the email key is left
+out). The deletion removes them: once the data is gone there is nothing left to prove consent for.
+An email subject is stored only as a SHA-256 key, so the table holds no address; the key is a
+pseudonym, not anonymous data, because anyone with the address can compute it.
+Rate limit rows of `security` hold only SHA-256 prefixes of user ids and emails and are pruned two
+windows after they start.
+
+## 12. Limitations
+
+- The export is built in memory and bounded by `export.maxBytes`; there is no streaming or
+  background export with a download link yet.
+- Deletion is immediate: there is no grace period and no undo. Back up the database if the app
+  needs to restore accounts.
+- No deletion by an admin or from a CLI yet; call `eraseUserData` from a script of the app.
+- No page to review or withdraw consents yet; withdrawals come from the module that asked (the
+  waitlist, an unsubscribe) or from the app calling `recordConsent` with `granted: false`.
+- A new document version does not ask anyone to accept it again: `hasConsent` turns false and the
+  app decides what to show.
+- Legal text is the app's: the shell renders it, it does not write it.

package/dist/contract.d.ts

@@ -0,0 +1,58 @@
+import type { CoreErrorCode } from "@softure-ai/core";
+export type PrivacyErrorCode = "privacy.export_failed" | "privacy.export_too_large" | "privacy.deletion_refused" | "privacy.password_invalid" | "privacy.confirmation_required" | "privacy.consent_invalid" | "privacy.document_unknown";
+/**
+ * Whose consent it is: an account, or an email address that has none (a waitlist sign-up). An
+ * account's consents and its email's consents are both its own in the export and the deletion.
+ * `{ emailKey }` names the same email subject by its stored key (`getEmailKey`), for a caller that
+ * only holds the key, such as mailing's unsubscribe link.
+ */
+export type ConsentSubject = {
+    readonly userId: string;
+} | {
+    readonly email: string;
+} | {
+    readonly emailKey: string;
+};
+/** One row of the ledger: a consent given (`granted`) or withdrawn. */
+export interface ConsentRecord {
+    readonly purpose: string;
+    readonly granted: boolean;
+    /** The legal document and its version at the moment of consent; null for a purpose without one. */
+    readonly document: {
+        readonly id: string;
+        readonly version: string;
+    } | null;
+    /** Where it was given, e.g. `registration`, `waitlist`. */
+    readonly source: string;
+    readonly recordedAt: Date;
+}
+/** The current state of one purpose: its latest record, checked against the configured version. */
+export interface ConsentState extends ConsentRecord {
+    /**
+     * False when the record names a document version that is no longer the configured one (or a
+     * document the app no longer declares): the person agreed to an earlier text.
+     */
+    readonly isCurrentVersion: boolean;
+}
+/** The file a user downloads: every contributor's part under its id. */
+export interface PrivacyExport {
+    readonly format: "softure.privacy-export";
+    readonly version: 1;
+    readonly userId: string;
+    /** ISO 8601, UTC. */
+    readonly exportedAt: string;
+    /** Each contributor's data under its id (a module id or an app contributor id), in export order. */
+    readonly data: Readonly<Record<string, unknown>>;
+}
+/** Every code the delete form can show: its own, the session and rate limit refusals, the generic ones. */
+export type DeleteAccountErrorCode = Extract<PrivacyErrorCode, "privacy.deletion_refused" | "privacy.password_invalid" | "privacy.confirmation_required"> | "auth.unauthenticated" | "security.rate_limited" | CoreErrorCode;
+export type DeleteAccountField = "password" | "confirm";
+/** What the delete action returns to its form (`useActionState`); success redirects instead. */
+export interface DeleteAccountFormState {
+    readonly status: "idle" | "error";
+    readonly error?: DeleteAccountErrorCode;
+    /** The field the error belongs to; none for a form-level error. */
+    readonly field?: DeleteAccountField;
+}
+export declare const INITIAL_DELETE_ACCOUNT_STATE: DeleteAccountFormState;
+//# sourceMappingURL=contract.d.ts.map

package/dist/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,MAAM,gBAAgB,GACxB,uBAAuB,GACvB,0BAA0B,GAC1B,0BAA0B,GAC1B,0BAA0B,GAC1B,+BAA+B,GAC/B,yBAAyB,GACzB,0BAA0B,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtH,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED,mGAAmG;AACnG,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qBAAqB;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oGAAoG;IACpG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAClD;AAED,2GAA2G;AAC3G,MAAM,MAAM,sBAAsB,GAC9B,OAAO,CAAC,gBAAgB,EAAE,0BAA0B,GAAG,0BAA0B,GAAG,+BAA+B,CAAC,GACpH,sBAAsB,GACtB,uBAAuB,GACvB,aAAa,CAAC;AAElB,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,CAAC;AAExD,gGAAgG;AAChG,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC;IACxC,mEAAmE;IACnE,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED,eAAO,MAAM,4BAA4B,EAAE,sBAA2C,CAAC"}

package/dist/contract.js

@@ -0,0 +1,2 @@
+export const INITIAL_DELETE_ACCOUNT_STATE = { status: "idle" };
+//# sourceMappingURL=contract.js.map

package/dist/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAqEA,MAAM,CAAC,MAAM,4BAA4B,GAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,90 @@
+export declare const MODULE_ID = "privacy";
+/**
+ * Rate limit buckets privacy consumes, with defaults to spread into `security({ buckets })`, both
+ * per user: `privacy-export` (downloads) and `privacy-delete` (deletion attempts, each one a
+ * password check).
+ */
+export declare const PRIVACY_RATE_LIMIT_BUCKETS: {
+    readonly "privacy-export": {
+        readonly limit: 5;
+        readonly windowMinutes: 60;
+    };
+    readonly "privacy-delete": {
+        readonly limit: 5;
+        readonly windowMinutes: 15;
+    };
+};
+/**
+ * Enables the GDPR export, self-service account deletion and the consent ledger in
+ * `softure.config.ts` (after `auth({ ... })`):
+ * `privacy({ documents: [{ id: "terms", version: "2026-10-01" }], contributors: [{ id: "profile", exportUserData, deleteUserData }] })`.
+ * Every enabled module with user data contributes its own part; `contributors` adds the app's.
+ */
+export declare const privacy: import("@softure-ai/core").ModuleFactory<{
+    account: string;
+    export: string;
+    afterDelete: string;
+}, {
+    page: {
+        title: string;
+        lead: string;
+    };
+    export: {
+        title: string;
+        description: string;
+        button: string;
+    };
+    delete: {
+        title: string;
+        description: string;
+        password: string;
+        confirm: string;
+        submit: string;
+        pending: string;
+    };
+    legal: {
+        contents: string;
+        version: string;
+        effectiveFrom: string;
+        changes: string;
+        footer: string;
+    };
+    errors: {
+        privacy: {
+            export_failed: string;
+            export_too_large: string;
+            deletion_refused: string;
+            password_invalid: string;
+            confirmation_required: string;
+        };
+        auth: {
+            unauthenticated: string;
+        };
+        security: {
+            rate_limited: string;
+        };
+        core: {
+            database_failed: string;
+            unexpected: string;
+        };
+    };
+}, import("zod").ZodObject<{
+    contributors: import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        exportUserData: import("zod").ZodOptional<import("zod").ZodCustom<(context: import("@softure-ai/core").ModuleContext, userId: string) => Promise<import("@softure-ai/core").Result<unknown>>, (context: import("@softure-ai/core").ModuleContext, userId: string) => Promise<import("@softure-ai/core").Result<unknown>>>>;
+        deleteUserData: import("zod").ZodOptional<import("zod").ZodCustom<(context: import("@softure-ai/core").ModuleContext, userId: string) => Promise<import("@softure-ai/core").Result<undefined>>, (context: import("@softure-ai/core").ModuleContext, userId: string) => Promise<import("@softure-ai/core").Result<undefined>>>>;
+    }, import("zod/v4/core").$strict>>>;
+    documents: import("zod").ZodDefault<import("zod").ZodArray<import("zod").ZodObject<{
+        id: import("zod").ZodString;
+        version: import("zod").ZodString;
+    }, import("zod/v4/core").$strict>>>;
+    export: import("zod").ZodPrefault<import("zod").ZodObject<{
+        maxBytes: import("zod").ZodDefault<import("zod").ZodNumber>;
+        fileName: import("zod").ZodDefault<import("zod").ZodString>;
+    }, import("zod/v4/core").$strict>>;
+}, import("zod/v4/core").$strict>>;
+export { INITIAL_DELETE_ACCOUNT_STATE, type ConsentRecord, type ConsentState, type ConsentSubject, type DeleteAccountErrorCode, type DeleteAccountField, type DeleteAccountFormState, type PrivacyErrorCode, type PrivacyExport, } from "./contract.js";
+export { getPrivacyErrorMessage, privacyMessages, type PrivacyMessages } from "./messages/index.js";
+export { CONTRIBUTOR_ID_PATTERN, DEFAULT_EXPORT_MAX_BYTES, DOCUMENT_VERSION_PATTERN, type AppPrivacyContributor, type LegalDocumentDeclaration, type PrivacyOptions, type PrivacyOptionsInput, } from "./options.js";
+export { consents, privacySchema } from "./schema.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,SAAS,YAAY,CAAC;AAEnC;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;CAG7B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kCAqBlB,CAAC;AAEH,OAAO,EACL,4BAA4B,EAC5B,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACpG,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,52 @@
+// Public API of @softure-ai/privacy: the module factory for softure.config.ts, its types, messages,
+// rate limit buckets and the consents table. The registry, export, deletion and the consent ledger
+// are in `@softure-ai/privacy/server`, the Next.js adapter (page, export route, delete action) in
+// `/next`, the delete form and the legal document shell in `/ui`.
+import { defineModule, resolveMigrationsDir } from "@softure-ai/core";
+import { privacyMessages } from "./messages/index.js";
+import { privacyOptionsSchema } from "./options.js";
+import { privacyConsentsContributor } from "./server/consents-contributor.js";
+import { checkConsentsTable } from "./server/health.js";
+export const MODULE_ID = "privacy";
+/**
+ * Rate limit buckets privacy consumes, with defaults to spread into `security({ buckets })`, both
+ * per user: `privacy-export` (downloads) and `privacy-delete` (deletion attempts, each one a
+ * password check).
+ */
+export const PRIVACY_RATE_LIMIT_BUCKETS = {
+    "privacy-export": { limit: 5, windowMinutes: 60 },
+    "privacy-delete": { limit: 5, windowMinutes: 15 },
+};
+/**
+ * Enables the GDPR export, self-service account deletion and the consent ledger in
+ * `softure.config.ts` (after `auth({ ... })`):
+ * `privacy({ documents: [{ id: "terms", version: "2026-10-01" }], contributors: [{ id: "profile", exportUserData, deleteUserData }] })`.
+ * Every enabled module with user data contributes its own part; `contributors` adds the app's.
+ */
+export const privacy = defineModule({
+    manifest: {
+        id: MODULE_ID,
+        version: "0.1.5",
+        dependsOn: { auth: "^0.1.0", security: "^0.1.0" },
+        dbSchema: "privacy",
+        tables: ["consents"],
+        env: [],
+        switches: [],
+        routes: { account: "/account/privacy", export: "/api/privacy/export", afterDelete: "/" },
+        mount: [
+            { kind: "page", path: "app/account/privacy/page.tsx", export: "PrivacyPage" },
+            { kind: "route-handler", path: "app/api/privacy/export/route.ts", export: "exportRoute" },
+        ],
+        privacy: { exports: true, deletes: true },
+    },
+    messages: privacyMessages,
+    options: privacyOptionsSchema,
+    migrations: { dir: resolveMigrationsDir(import.meta.url, "../migrations/") },
+    privacy: privacyConsentsContributor,
+    health: checkConsentsTable,
+});
+export { INITIAL_DELETE_ACCOUNT_STATE, } from "./contract.js";
+export { getPrivacyErrorMessage, privacyMessages } from "./messages/index.js";
+export { CONTRIBUTOR_ID_PATTERN, DEFAULT_EXPORT_MAX_BYTES, DOCUMENT_VERSION_PATTERN, } from "./options.js";
+export { consents, privacySchema } from "./schema.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,mGAAmG;AACnG,kGAAkG;AAClG,kEAAkE;AAClE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;IACjD,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE;CACzC,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,YAAY,CAAC;IAClC,QAAQ,EAAE;QACR,EAAE,EAAE,SAAS;QACb,OAAO,EAAE,OAAO;QAChB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;QACjD,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,CAAC,UAAU,CAAC;QACpB,GAAG,EAAE,EAAE;QACP,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,qBAAqB,EAAE,WAAW,EAAE,GAAG,EAAE;QACxF,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,aAAa,EAAE;YAC7E,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,iCAAiC,EAAE,MAAM,EAAE,aAAa,EAAE;SAC1F;QACD,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;KAC1C;IACD,QAAQ,EAAE,eAAe;IACzB,OAAO,EAAE,oBAAoB;IAC7B,UAAU,EAAE,EAAE,GAAG,EAAE,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE;IAC5E,OAAO,EAAE,0BAA0B;IACnC,MAAM,EAAE,kBAAkB;CAC3B,CAAC,CAAC;AAEH,OAAO,EACL,4BAA4B,GAS7B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAwB,MAAM,qBAAqB,CAAC;AACpG,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,GAKzB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/messages/en.d.ts

@@ -0,0 +1,46 @@
+export declare const en: {
+    page: {
+        title: string;
+        lead: string;
+    };
+    export: {
+        title: string;
+        description: string;
+        button: string;
+    };
+    delete: {
+        title: string;
+        description: string;
+        password: string;
+        confirm: string;
+        submit: string;
+        pending: string;
+    };
+    legal: {
+        contents: string;
+        version: string;
+        effectiveFrom: string;
+        changes: string;
+        footer: string;
+    };
+    errors: {
+        privacy: {
+            export_failed: string;
+            export_too_large: string;
+            deletion_refused: string;
+            password_invalid: string;
+            confirmation_required: string;
+        };
+        auth: {
+            unauthenticated: string;
+        };
+        security: {
+            rate_limited: string;
+        };
+        core: {
+            database_failed: string;
+            unexpected: string;
+        };
+    };
+};
+//# sourceMappingURL=en.d.ts.map

package/dist/messages/en.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"en.d.ts","sourceRoot":"","sources":["../../src/messages/en.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4Cd,CAAC"}

package/dist/messages/en.js

@@ -0,0 +1,46 @@
+export const en = {
+    page: {
+        title: "Your data",
+        lead: "Download a copy of what this app stores about you, or delete your account.",
+    },
+    export: {
+        title: "Download your data",
+        description: "A JSON file with everything this app stores about your account.",
+        button: "Download my data",
+    },
+    delete: {
+        title: "Delete your account",
+        description: "This deletes your account and your data and signs you out on every device. It cannot be undone.",
+        password: "Current password",
+        confirm: "I understand that my account and my data will be deleted for good.",
+        submit: "Delete my account",
+        pending: "Deleting…",
+    },
+    legal: {
+        contents: "Contents",
+        version: "Version",
+        effectiveFrom: "Effective from",
+        changes: "Change history",
+        footer: "Legal information",
+    },
+    errors: {
+        privacy: {
+            export_failed: "Your data could not be collected. Try again in a moment.",
+            export_too_large: "Your data is too large to download here. Contact us and we will send it to you.",
+            deletion_refused: "Your account cannot be deleted right now, because some of its data must be kept for a while. Contact us for details.",
+            password_invalid: "This is not your current password.",
+            confirmation_required: "Confirm that you want to delete your account.",
+        },
+        auth: {
+            unauthenticated: "Your session has ended. Sign in again.",
+        },
+        security: {
+            rate_limited: "Too many attempts. Wait a moment and try again.",
+        },
+        core: {
+            database_failed: "Something went wrong on our side. Try again in a moment.",
+            unexpected: "Something went wrong on our side. Try again in a moment.",
+        },
+    },
+};
+//# sourceMappingURL=en.js.map

package/dist/messages/en.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"en.js","sourceRoot":"","sources":["../../src/messages/en.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,EAAE,GAAG;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE,4EAA4E;KACnF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,iEAAiE;QAC9E,MAAM,EAAE,kBAAkB;KAC3B;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,iGAAiG;QAC9G,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,oEAAoE;QAC7E,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,WAAW;KACrB;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,SAAS;QAClB,aAAa,EAAE,gBAAgB;QAC/B,OAAO,EAAE,gBAAgB;QACzB,MAAM,EAAE,mBAAmB;KAC5B;IACD,MAAM,EAAE;QACN,OAAO,EAAE;YACP,aAAa,EAAE,0DAA0D;YACzE,gBAAgB,EAAE,iFAAiF;YACnG,gBAAgB,EAAE,sHAAsH;YACxI,gBAAgB,EAAE,oCAAoC;YACtD,qBAAqB,EAAE,+CAA+C;SACvE;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,wCAAwC;SAC1D;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,iDAAiD;SAChE;QACD,IAAI,EAAE;YACJ,eAAe,EAAE,0DAA0D;YAC3E,UAAU,EAAE,0DAA0D;SACvE;KACF;CACF,CAAC"}