@softure-ai/privacy 0.0.0-stage → 0.1.5

package/dist/schema.d.ts

@@ -0,0 +1,162 @@
+export declare const privacySchema: import("drizzle-orm/pg-core").PgSchema<"privacy">;
+export declare const consents: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "consents";
+    schema: "privacy";
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "consents";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: "always";
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "consents";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        emailKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "email_key";
+            tableName: "consents";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        purpose: import("drizzle-orm/pg-core").PgColumn<{
+            name: "purpose";
+            tableName: "consents";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        granted: import("drizzle-orm/pg-core").PgColumn<{
+            name: "granted";
+            tableName: "consents";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        documentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "document_id";
+            tableName: "consents";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        documentVersion: import("drizzle-orm/pg-core").PgColumn<{
+            name: "document_version";
+            tableName: "consents";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        source: import("drizzle-orm/pg-core").PgColumn<{
+            name: "source";
+            tableName: "consents";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        recordedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "recorded_at";
+            tableName: "consents";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,aAAa,mDAAsB,CAAC;AAEjD,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUnB,CAAC"}

package/dist/schema.js

@@ -0,0 +1,17 @@
+// Drizzle view of the module's table (migrations/0001_create_consents.sql). The migration is the
+// source of truth; this file only types the queries.
+import { users } from "@softure-ai/auth";
+import { bigint, boolean, pgSchema, text, timestamp, uuid } from "drizzle-orm/pg-core";
+export const privacySchema = pgSchema("privacy");
+export const consents = privacySchema.table("consents", {
+    id: bigint("id", { mode: "number" }).primaryKey().generatedAlwaysAsIdentity(),
+    userId: uuid("user_id").references(() => users.id, { onDelete: "cascade" }),
+    emailKey: text("email_key"),
+    purpose: text("purpose").notNull(),
+    granted: boolean("granted").notNull(),
+    documentId: text("document_id"),
+    documentVersion: text("document_version"),
+    source: text("source").notNull(),
+    recordedAt: timestamp("recorded_at", { withTimezone: true }).notNull(),
+});
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,qDAAqD;AACrD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAEvF,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE;IACtD,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE;IAC7E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC3E,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IAClC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACrC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC;IACzC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,UAAU,EAAE,SAAS,CAAC,aAAa,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;CACvE,CAAC,CAAC"}

package/dist/server/collect.d.ts

@@ -0,0 +1,16 @@
+import { type Err, type Ok } from "@softure-ai/core";
+import type { PrivacyExport } from "../contract.js";
+import type { PrivacyContext } from "./context.js";
+export interface CollectedUserData {
+    readonly document: PrivacyExport;
+    /** The document as JSON, the bytes a download sends; measured against `export.maxBytes`. */
+    readonly json: string;
+}
+export type CollectUserDataResult = Ok<CollectedUserData> | Err<"privacy.export_failed" | "privacy.export_too_large">;
+/**
+ * Collects every exporting contributor's part for `userId`. A contributor's `Err` fails the whole
+ * export (`privacy.export_failed`, logged with the contributor's id and code): a file with a part
+ * missing would look complete. Thrown errors (a database failure) propagate after the rollback.
+ */
+export declare function collectUserData(ctx: PrivacyContext, userId: string): Promise<CollectUserDataResult>;
+//# sourceMappingURL=collect.d.ts.map

package/dist/server/collect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collect.d.ts","sourceRoot":"","sources":["../../src/server/collect.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,KAAK,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,4FAA4F;IAC5F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,qBAAqB,GAAG,EAAE,CAAC,iBAAiB,CAAC,GAAG,GAAG,CAAC,uBAAuB,GAAG,0BAA0B,CAAC,CAAC;AAEtH;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAoCzG"}

package/dist/server/collect.js

@@ -0,0 +1,44 @@
+// The export: every contributor's part of one user's data, read in one transaction so the parts
+// agree with each other, and bounded in size before it is handed to a response.
+import { err, ok } from "@softure-ai/core";
+import { getExportingContributors } from "./contributors.js";
+import { getPrivacyOptions } from "./options.js";
+/**
+ * Collects every exporting contributor's part for `userId`. A contributor's `Err` fails the whole
+ * export (`privacy.export_failed`, logged with the contributor's id and code): a file with a part
+ * missing would look complete. Thrown errors (a database failure) propagate after the rollback.
+ */
+export async function collectUserData(ctx, userId) {
+    const contributors = getExportingContributors(ctx.config);
+    const exportedAt = ctx.clock.now();
+    const collected = await ctx.db.transaction(async (tx) => {
+        const txCtx = { ...ctx, db: tx };
+        const data = {};
+        for (const contributor of contributors) {
+            const part = await contributor.exportUserData(txCtx, userId);
+            if (!part.ok) {
+                console.error(`@softure-ai/privacy: contributor "${contributor.id}" failed the export: ${part.error}`);
+                return err("privacy.export_failed");
+            }
+            data[contributor.id] = part.value;
+        }
+        return ok(data);
+    }, { isolationLevel: "repeatable read", accessMode: "read only" });
+    if (!collected.ok)
+        return collected;
+    const document = {
+        format: "softure.privacy-export",
+        version: 1,
+        userId,
+        exportedAt: exportedAt.toISOString(),
+        data: collected.value,
+    };
+    const json = JSON.stringify(document, null, 2);
+    const { maxBytes } = getPrivacyOptions(ctx.config).export;
+    if (Buffer.byteLength(json, "utf8") > maxBytes) {
+        console.error(`@softure-ai/privacy: an export exceeded export.maxBytes (${String(maxBytes)})`);
+        return err("privacy.export_too_large");
+    }
+    return ok({ document, json });
+}
+//# sourceMappingURL=collect.js.map

package/dist/server/collect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collect.js","sourceRoot":"","sources":["../../src/server/collect.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,gFAAgF;AAChF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAqB,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAUjD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAmB,EAAE,MAAc;IACvE,MAAM,YAAY,GAAG,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAEnC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,WAAW,CACxC,KAAK,EAAE,EAAE,EAAuE,EAAE;QAChF,MAAM,KAAK,GAAmB,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,qCAAqC,WAAW,CAAC,EAAE,wBAAwB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBACvG,OAAO,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC,EACD,EAAE,cAAc,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,CAC/D,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAEpC,MAAM,QAAQ,GAAkB;QAC9B,MAAM,EAAE,wBAAwB;QAChC,OAAO,EAAE,CAAC;QACV,MAAM;QACN,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,IAAI,EAAE,SAAS,CAAC,KAAK;KACtB,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAC1D,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC/C,OAAO,CAAC,KAAK,CAAC,4DAA4D,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/F,OAAO,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAChC,CAAC"}

package/dist/server/consents-contributor.d.ts

@@ -0,0 +1,14 @@
+import { type ModuleContext, type Ok, type PrivacyContributor } from "@softure-ai/core";
+import type { ConsentRecord } from "../contract.js";
+/** What privacy holds about one user, as it appears in their export. */
+export interface PrivacyUserData {
+    /** Every consent given or withdrawn, oldest first; `subject` says whether it names the account or its email. */
+    readonly consents: readonly (ConsentRecord & {
+        readonly subject: "account" | "email";
+    })[];
+}
+export declare function exportConsentUserData(context: ModuleContext, userId: string): Promise<Ok<PrivacyUserData>>;
+/** Deletes the user's consents: with the data gone there is nothing left to prove consent for. */
+export declare function deleteConsentUserData(context: ModuleContext, userId: string): Promise<Ok<undefined>>;
+export declare const privacyConsentsContributor: PrivacyContributor;
+//# sourceMappingURL=consents-contributor.d.ts.map

package/dist/server/consents-contributor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consents-contributor.d.ts","sourceRoot":"","sources":["../../src/server/consents-contributor.ts"],"names":[],"mappings":"AAIA,OAAO,EAAM,KAAK,aAAa,EAAE,KAAK,EAAE,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG5F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAIpD,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,gHAAgH;IAChH,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,GAAG;QAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAA;KAAE,CAAC,EAAE,CAAC;CAC3F;AAYD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAOhH;AAED,kGAAkG;AAClG,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAK1G;AAED,eAAO,MAAM,0BAA0B,EAAE,kBAGxC,CAAC"}

package/dist/server/consents-contributor.js

@@ -0,0 +1,40 @@
+// The privacy module's own part of a GDPR export and deletion: the consent ledger. A user's
+// consents are the rows of their account and the rows of their email address recorded before
+// the account existed (a waitlist sign-up).
+import { users } from "@softure-ai/auth";
+import { ok } from "@softure-ai/core";
+import { asc, eq, or } from "drizzle-orm";
+import { consents } from "../schema.js";
+import { getEmailKey, toConsentRecord } from "./consents.js";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** The rows of the account and of its email; null when no account has this id. */
+async function matchUserConsents(db, userId) {
+    if (!UUID.test(userId))
+        return null;
+    const [account] = await db.select({ email: users.email }).from(users).where(eq(users.id, userId));
+    if (account === undefined)
+        return eq(consents.userId, userId);
+    return or(eq(consents.userId, userId), eq(consents.emailKey, getEmailKey(account.email))) ?? null;
+}
+export async function exportConsentUserData(context, userId) {
+    // Core types `db` as unknown; privacy passes the @softure-ai/db handle or its transaction.
+    const db = context.db;
+    const condition = await matchUserConsents(db, userId);
+    if (condition === null)
+        return ok({ consents: [] });
+    const rows = await db.select().from(consents).where(condition).orderBy(asc(consents.recordedAt), asc(consents.id));
+    return ok({ consents: rows.map((row) => ({ ...toConsentRecord(row), subject: row.userId === null ? "email" : "account" })) });
+}
+/** Deletes the user's consents: with the data gone there is nothing left to prove consent for. */
+export async function deleteConsentUserData(context, userId) {
+    const db = context.db;
+    const condition = await matchUserConsents(db, userId);
+    if (condition !== null)
+        await db.delete(consents).where(condition);
+    return ok();
+}
+export const privacyConsentsContributor = {
+    exportUserData: exportConsentUserData,
+    deleteUserData: deleteConsentUserData,
+};
+//# sourceMappingURL=consents-contributor.js.map

package/dist/server/consents-contributor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consents-contributor.js","sourceRoot":"","sources":["../../src/server/consents-contributor.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,6FAA6F;AAC7F,4CAA4C;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,EAAE,EAAwD,MAAM,kBAAkB,CAAC;AAE5F,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAY,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAQ7D,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E,kFAAkF;AAClF,KAAK,UAAU,iBAAiB,CAAC,EAAa,EAAE,MAAc;IAC5D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAClG,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAsB,EAAE,MAAc;IAChF,2FAA2F;IAC3F,MAAM,EAAE,GAAG,OAAO,CAAC,EAAe,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACnH,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AAChI,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAsB,EAAE,MAAc;IAChF,MAAM,EAAE,GAAG,OAAO,CAAC,EAAe,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,IAAI;QAAE,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACnE,OAAO,EAAE,EAAE,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAuB;IAC5D,cAAc,EAAE,qBAAqB;IACrC,cAAc,EAAE,qBAAqB;CACtC,CAAC"}

package/dist/server/consents.d.ts

@@ -0,0 +1,42 @@
+import { type Err, type Ok } from "@softure-ai/core";
+import type { ConsentRecord, ConsentState, ConsentSubject } from "../contract.js";
+import { consents } from "../schema.js";
+import type { PrivacyContext } from "./context.js";
+export interface RecordConsentInput {
+    readonly subject: ConsentSubject;
+    /** What the consent is for, kebab-case, e.g. `terms` or `newsletter`. */
+    readonly purpose: string;
+    /** True to give consent, false to withdraw it (a new row; the earlier one stays as evidence). */
+    readonly granted: boolean;
+    /** The id of a document declared in `privacy({ documents })`; its configured version is recorded. */
+    readonly document?: string;
+    /** Where the consent was given, kebab-case, e.g. `registration`, `waitlist`, `account`. */
+    readonly source: string;
+}
+export type RecordConsentResult = Ok<ConsentRecord> | Err<"privacy.consent_invalid" | "privacy.document_unknown">;
+export interface ConsentQuery {
+    readonly subject: ConsentSubject;
+    readonly purpose: string;
+}
+/** The key an email subject is stored under: base64url SHA-256 of the trimmed, lowercased address. */
+export declare function getEmailKey(email: string): string;
+type ConsentRow = typeof consents.$inferSelect;
+export declare function toConsentRecord(row: ConsentRow): ConsentRecord;
+/**
+ * Records a consent at `recordedAt`. For `recordConsent` (the clock's now) and the registration
+ * hook (the account's creation time).
+ */
+export declare function insertConsent(ctx: PrivacyContext, input: RecordConsentInput, recordedAt: Date): Promise<RecordConsentResult>;
+/**
+ * Records that `subject` gave (or withdrew) consent to `purpose`, now. With `document`, the
+ * document's configured version is recorded with it. Database errors propagate.
+ */
+export declare function recordConsent(ctx: PrivacyContext, input: RecordConsentInput): Promise<RecordConsentResult>;
+/** The current state of one purpose for one subject (its latest record), or null when none was recorded. */
+export declare function getConsent(ctx: PrivacyContext, query: ConsentQuery): Promise<ConsentState | null>;
+/** Whether the latest record of the purpose grants it, for the document version in force. */
+export declare function hasConsent(ctx: PrivacyContext, query: ConsentQuery): Promise<boolean>;
+/** Every record of the subject, oldest first: the evidence of what was given and withdrawn, when. */
+export declare function listConsents(ctx: PrivacyContext, subject: ConsentSubject): Promise<ConsentRecord[]>;
+export {};
+//# sourceMappingURL=consents.d.ts.map

package/dist/server/consents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consents.d.ts","sourceRoot":"","sources":["../../src/server/consents.ts"],"names":[],"mappings":"AAIA,OAAO,EAAW,KAAK,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAG9D,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAElF,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAUnD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iGAAiG;IACjG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,qGAAqG;IACrG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,yBAAyB,GAAG,0BAA0B,CAAC,CAAC;AAElH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAmBD,KAAK,UAAU,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAC;AAE/C,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,aAAa,CAQ9D;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA0BlI;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAE1G;AAED,4GAA4G;AAC5G,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAavG;AAED,6FAA6F;AAC7F,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAG3F;AAED,qGAAqG;AACrG,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAKzG"}

package/dist/server/consents.js

@@ -0,0 +1,117 @@
+// The consent ledger: recording a consent or its withdrawal, and reading the current state and the
+// history of a subject. Rows are only ever inserted (the table refuses UPDATE); the current state
+// of a purpose is its latest row.
+import { createHash } from "node:crypto";
+import { err, ok } from "@softure-ai/core";
+import { and, asc, desc, eq } from "drizzle-orm";
+import { z } from "zod";
+import { CONTRIBUTOR_ID_PATTERN } from "../options.js";
+import { consents } from "../schema.js";
+import { findLegalDocument } from "./legal-documents.js";
+const MAX_NAME_LENGTH = 64;
+const MAX_EMAIL_LENGTH = 254;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** A SHA-256 digest in unpadded base64url, the shape of every stored email key. */
+const EMAIL_KEY = /^[A-Za-z0-9_-]{43}$/;
+const emailSchema = z.email();
+/** The key an email subject is stored under: base64url SHA-256 of the trimmed, lowercased address. */
+export function getEmailKey(email) {
+    return createHash("sha256").update(email.trim().toLowerCase()).digest("base64url");
+}
+const isName = (value) => value.length <= MAX_NAME_LENGTH && CONTRIBUTOR_ID_PATTERN.test(value);
+/** The subject's column values, or null when it cannot name anyone (not a UUID, an address or a key). */
+function toSubjectColumns(subject) {
+    if ("userId" in subject)
+        return UUID.test(subject.userId) ? { userId: subject.userId, emailKey: null } : null;
+    if ("emailKey" in subject)
+        return EMAIL_KEY.test(subject.emailKey) ? { userId: null, emailKey: subject.emailKey } : null;
+    const email = subject.email.trim().toLowerCase();
+    if (email.length > MAX_EMAIL_LENGTH || !emailSchema.safeParse(email).success)
+        return null;
+    return { userId: null, emailKey: getEmailKey(email) };
+}
+function matchSubject(subject) {
+    const columns = toSubjectColumns(subject);
+    if (columns === null)
+        return null;
+    return columns.userId === null ? eq(consents.emailKey, columns.emailKey) : eq(consents.userId, columns.userId);
+}
+export function toConsentRecord(row) {
+    return {
+        purpose: row.purpose,
+        granted: row.granted,
+        document: row.documentId === null || row.documentVersion === null ? null : { id: row.documentId, version: row.documentVersion },
+        source: row.source,
+        recordedAt: row.recordedAt,
+    };
+}
+/**
+ * Records a consent at `recordedAt`. For `recordConsent` (the clock's now) and the registration
+ * hook (the account's creation time).
+ */
+export async function insertConsent(ctx, input, recordedAt) {
+    const subject = toSubjectColumns(input.subject);
+    if (subject === null || !isName(input.purpose) || !isName(input.source))
+        return err("privacy.consent_invalid");
+    let document = null;
+    if (input.document !== undefined) {
+        const declared = findLegalDocument(ctx.config, input.document);
+        if (declared === undefined)
+            return err("privacy.document_unknown");
+        document = { id: declared.id, version: declared.version };
+    }
+    const [row] = await ctx.db
+        .insert(consents)
+        .values({
+        ...subject,
+        purpose: input.purpose,
+        granted: input.granted,
+        documentId: document?.id ?? null,
+        documentVersion: document?.version ?? null,
+        source: input.source,
+        recordedAt,
+    })
+        .returning();
+    // An INSERT … RETURNING without a conflict clause returns its row or throws.
+    if (row === undefined)
+        throw new Error("@softure-ai/privacy: recording a consent returned no row");
+    return ok(toConsentRecord(row));
+}
+/**
+ * Records that `subject` gave (or withdrew) consent to `purpose`, now. With `document`, the
+ * document's configured version is recorded with it. Database errors propagate.
+ */
+export function recordConsent(ctx, input) {
+    return insertConsent(ctx, input, ctx.clock.now());
+}
+/** The current state of one purpose for one subject (its latest record), or null when none was recorded. */
+export async function getConsent(ctx, query) {
+    const subject = matchSubject(query.subject);
+    if (subject === null)
+        return null;
+    const [row] = await ctx.db
+        .select()
+        .from(consents)
+        .where(and(subject, eq(consents.purpose, query.purpose)))
+        .orderBy(desc(consents.recordedAt), desc(consents.id))
+        .limit(1);
+    if (row === undefined)
+        return null;
+    const record = toConsentRecord(row);
+    const isCurrentVersion = record.document === null || findLegalDocument(ctx.config, record.document.id)?.version === record.document.version;
+    return { ...record, isCurrentVersion };
+}
+/** Whether the latest record of the purpose grants it, for the document version in force. */
+export async function hasConsent(ctx, query) {
+    const state = await getConsent(ctx, query);
+    return state !== null && state.granted && state.isCurrentVersion;
+}
+/** Every record of the subject, oldest first: the evidence of what was given and withdrawn, when. */
+export async function listConsents(ctx, subject) {
+    const condition = matchSubject(subject);
+    if (condition === null)
+        return [];
+    const rows = await ctx.db.select().from(consents).where(condition).orderBy(asc(consents.recordedAt), asc(consents.id));
+    return rows.map(toConsentRecord);
+}
+//# sourceMappingURL=consents.js.map

package/dist/server/consents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consents.js","sourceRoot":"","sources":["../../src/server/consents.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,kGAAkG;AAClG,kCAAkC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAqB,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAY,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,mFAAmF;AACnF,MAAM,SAAS,GAAG,qBAAqB,CAAC;AACxC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;AAqB9B,sGAAsG;AACtG,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,eAAe,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAExG,yGAAyG;AACzG,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,IAAI,QAAQ,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9G,IAAI,UAAU,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1F,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,YAAY,CAAC,OAAuB;IAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACjH,CAAC;AAID,MAAM,UAAU,eAAe,CAAC,GAAe;IAC7C,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE;QAC/H,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAmB,EAAE,KAAyB,EAAE,UAAgB;IAClG,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAE/G,IAAI,QAAQ,GAA2C,IAAI,CAAC;IAC5D,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACnE,QAAQ,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE;SACvB,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,CAAC;QACN,GAAG,OAAO;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI;QAChC,eAAe,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU;KACX,CAAC;SACD,SAAS,EAAE,CAAC;IACf,6EAA6E;IAC7E,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACnG,OAAO,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAmB,EAAE,KAAyB;IAC1E,OAAO,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,KAAmB;IACvE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;SACxD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;SACrD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC5I,OAAO,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,CAAC;AACzC,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,KAAmB;IACvE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,gBAAgB,CAAC;AACnE,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAmB,EAAE,OAAuB;IAC7E,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACvH,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC"}

package/dist/server/context.d.ts

@@ -0,0 +1,5 @@
+import type { ModuleContext } from "@softure-ai/core";
+import type { Queryable } from "@softure-ai/db";
+/** What the privacy server functions receive; contributors get the same with `db` as a transaction. */
+export type PrivacyContext = ModuleContext<Queryable>;
+//# sourceMappingURL=context.d.ts.map

package/dist/server/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/server/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,uGAAuG;AACvG,MAAM,MAAM,cAAc,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC"}

package/dist/server/context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=context.js.map

package/dist/server/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/server/context.ts"],"names":[],"mappings":""}

package/dist/server/contributors.d.ts

@@ -0,0 +1,23 @@
+import type { PrivacyContributor, SoftureConfig } from "@softure-ai/core";
+export interface RegisteredContributor extends PrivacyContributor {
+    /** A module id or an app contributor id; the key of its part of the export. */
+    readonly id: string;
+    readonly source: "module" | "app";
+}
+export type ExportingContributor = RegisteredContributor & Required<Pick<PrivacyContributor, "exportUserData">>;
+export type DeletingContributor = RegisteredContributor & Required<Pick<PrivacyContributor, "deleteUserData">>;
+/**
+ * Every contributor in export order: the modules in the config's dependency order (dependencies
+ * first), then the app's in the order it lists them. Throws when an app contributor takes the id of
+ * an enabled module: both parts would land under one key.
+ */
+export declare function getPrivacyContributors(config: SoftureConfig): readonly RegisteredContributor[];
+/** The contributors with an export, in export order. */
+export declare function getExportingContributors(config: SoftureConfig): readonly ExportingContributor[];
+/**
+ * The contributors with a deletion, in deletion order: the reverse of the export order. The app's
+ * own data goes first, then each module before the modules it depends on, so a row is always
+ * deleted before the rows it references, whatever the foreign key's ON DELETE action.
+ */
+export declare function getDeletingContributors(config: SoftureConfig): readonly DeletingContributor[];
+//# sourceMappingURL=contributors.d.ts.map

package/dist/server/contributors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contributors.d.ts","sourceRoot":"","sources":["../../src/server/contributors.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAG1E,MAAM,WAAW,qBAAsB,SAAQ,kBAAkB;IAC/D,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,CAAC;CACnC;AAED,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAChH,MAAM,MAAM,mBAAmB,GAAG,qBAAqB,GAAG,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAI/G;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,qBAAqB,EAAE,CAkB9F;AAED,wDAAwD;AACxD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,oBAAoB,EAAE,CAE/F;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,mBAAmB,EAAE,CAI7F"}

package/dist/server/contributors.js

@@ -0,0 +1,38 @@
+import { getPrivacyOptions } from "./options.js";
+const registries = new WeakMap();
+/**
+ * Every contributor in export order: the modules in the config's dependency order (dependencies
+ * first), then the app's in the order it lists them. Throws when an app contributor takes the id of
+ * an enabled module: both parts would land under one key.
+ */
+export function getPrivacyContributors(config) {
+    const cached = registries.get(config);
+    if (cached !== undefined)
+        return cached;
+    const modules = config.modules.flatMap((module) => module.privacy === null ? [] : [{ ...module.privacy, id: module.id, source: "module" }]);
+    const moduleIds = new Set(config.modules.map((module) => module.id));
+    const app = getPrivacyOptions(config).contributors.map((contributor) => {
+        if (moduleIds.has(contributor.id)) {
+            throw new Error(`@softure-ai/privacy: app contributor "${contributor.id}" has the id of an enabled module; give it another id`);
+        }
+        return { ...contributor, source: "app" };
+    });
+    const registry = Object.freeze([...modules, ...app]);
+    registries.set(config, registry);
+    return registry;
+}
+/** The contributors with an export, in export order. */
+export function getExportingContributors(config) {
+    return getPrivacyContributors(config).filter((contributor) => contributor.exportUserData !== undefined);
+}
+/**
+ * The contributors with a deletion, in deletion order: the reverse of the export order. The app's
+ * own data goes first, then each module before the modules it depends on, so a row is always
+ * deleted before the rows it references, whatever the foreign key's ON DELETE action.
+ */
+export function getDeletingContributors(config) {
+    return getPrivacyContributors(config)
+        .filter((contributor) => contributor.deleteUserData !== undefined)
+        .toReversed();
+}
+//# sourceMappingURL=contributors.js.map

package/dist/server/contributors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contributors.js","sourceRoot":"","sources":["../../src/server/contributors.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAWjD,MAAM,UAAU,GAAG,IAAI,OAAO,EAAmD,CAAC;AAElF;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAqB;IAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,MAAM,OAAO,GAA4B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACzE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,QAAiB,EAAE,CAAC,CACjG,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAA4B,iBAAiB,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QAC9F,IAAI,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yCAAyC,WAAW,CAAC,EAAE,uDAAuD,CAAC,CAAC;QAClI,CAAC;QACD,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,KAAc,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;IACrD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,wBAAwB,CAAC,MAAqB;IAC5D,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAuC,EAAE,CAAC,WAAW,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC;AAC/I,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAqB;IAC3D,OAAO,sBAAsB,CAAC,MAAM,CAAC;SAClC,MAAM,CAAC,CAAC,WAAW,EAAsC,EAAE,CAAC,WAAW,CAAC,cAAc,KAAK,SAAS,CAAC;SACrG,UAAU,EAAE,CAAC;AAClB,CAAC"}

package/dist/server/erase.d.ts

@@ -0,0 +1,10 @@
+import { type Err, type Ok } from "@softure-ai/core";
+import type { PrivacyContext } from "./context.js";
+export type EraseUserDataResult = Ok<undefined> | Err<"privacy.deletion_refused">;
+/**
+ * Deletes everything the app holds about `userId`. A contributor that must keep data (legal
+ * retention) returns an `Err`: nothing is deleted, the result is `privacy.deletion_refused`, and
+ * the contributor's id and code are logged. Thrown errors propagate after the rollback.
+ */
+export declare function eraseUserData(ctx: PrivacyContext, userId: string): Promise<EraseUserDataResult>;
+//# sourceMappingURL=erase.d.ts.map

package/dist/server/erase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"erase.d.ts","sourceRoot":"","sources":["../../src/server/erase.ts"],"names":[],"mappings":"AAGA,OAAO,EAAW,KAAK,GAAG,EAAkB,KAAK,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,MAAM,MAAM,mBAAmB,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAalF;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgBrG"}