@softure-ai/privacy 0.0.0-stage → 0.1.5

package/dist/ui/legal-footer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal-footer.d.ts","sourceRoot":"","sources":["../../src/ui/legal-footer.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAyB,MAAM,gBAAgB,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAM5D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AASD,wBAAgB,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,gBAAgB,+BAkB5F"}

package/dist/ui/legal-footer.js

@@ -0,0 +1,13 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { createSlotClassGetter } from "@softure-ai/ui";
+const DEFAULT_CLASSES = {
+    root: "sft:mx-auto sft:box-border sft:flex sft:w-full sft:flex-col sft:items-center sft:gap-2 sft:border-t sft:border-border sft:px-4 sft:py-4 sft:font-sans sft:text-sm sft:text-muted",
+    list: "sft:m-0 sft:flex sft:items-center sft:justify-center sft:gap-4 sft:p-0 sft:list-none",
+    link: "sft:text-muted sft:hover:text-foreground sft:focus-visible:outline-2 sft:focus-visible:outline-focus sft:focus-visible:outline-offset-2",
+    note: "sft:m-0 sft:text-xs sft:text-center",
+};
+export function LegalFooter({ links, note, messages, classNames, unstyled }) {
+    const slot = createSlotClassGetter({ defaults: DEFAULT_CLASSES, classNames, unstyled });
+    return (_jsxs("footer", { className: slot("root"), children: [_jsx("nav", { "aria-label": messages.legal.footer, children: _jsx("ul", { className: slot("list"), children: links.map((link) => (_jsx("li", { children: _jsx("a", { href: link.href, className: slot("link"), children: link.label }) }, link.href))) }) }), note === undefined ? null : _jsx("p", { className: slot("note"), children: note })] }));
+}
+//# sourceMappingURL=legal-footer.js.map

package/dist/ui/legal-footer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legal-footer.js","sourceRoot":"","sources":["../../src/ui/legal-footer.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAmB,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAwBxE,MAAM,eAAe,GAA8C;IACjE,IAAI,EAAE,kLAAkL;IACxL,IAAI,EAAE,sFAAsF;IAC5F,IAAI,EAAE,yIAAyI;IAC/I,IAAI,EAAE,qCAAqC;CAC5C,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAoB;IAC3F,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,OAAO,CACL,kBAAQ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,aAC7B,4BAAiB,QAAQ,CAAC,KAAK,CAAC,MAAM,YACpC,aAAI,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YACxB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACnB,uBACE,YAAG,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YACxC,IAAI,CAAC,KAAK,GACT,IAHG,IAAI,CAAC,IAAI,CAIb,CACN,CAAC,GACC,GACD,EACL,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAG,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAG,IAAI,GAAK,IAC5D,CACV,CAAC;AACJ,CAAC"}

package/migrations/0001_create_consents.sql

@@ -0,0 +1,37 @@
+-- The consent ledger: who agreed to what, when, from where and against which version of which
+-- legal document. Append-only: a withdrawal is a new row with granted = false, and the trigger
+-- below refuses any UPDATE, so the evidence of an earlier consent cannot be rewritten. Rows are
+-- deleted only with the person's data (the privacy contributor, on account deletion).
+-- A subject is either an account (user_id) or an email address without one (email_key: the
+-- base64url SHA-256 of the trimmed, lowercased address; the address itself is never stored).
+-- Rollback: DROP TABLE privacy.consents; DROP FUNCTION privacy.refuse_consent_update(); then
+--   DELETE FROM softure.migrations WHERE module = 'privacy' AND version = 1;
+CREATE TABLE consents (
+  -- Orders rows recorded in the same instant: the latest row of a purpose is its current state.
+  id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  user_id uuid REFERENCES auth.users (id) ON DELETE CASCADE,
+  email_key text CHECK (email_key ~ '^[A-Za-z0-9_-]{43}$'),
+  -- What the consent is for, e.g. terms, privacy-policy, newsletter.
+  purpose text NOT NULL CHECK (char_length(purpose) <= 64 AND purpose ~ '^[a-z][a-z0-9]*(-[a-z0-9]+)*$'),
+  granted boolean NOT NULL,
+  -- The legal document the person saw, with the version the app declared at that moment.
+  document_id text CHECK (char_length(document_id) <= 64 AND document_id ~ '^[a-z][a-z0-9]*(-[a-z0-9]+)*$'),
+  document_version text CHECK (document_version ~ '^[0-9A-Za-z][0-9A-Za-z._-]{0,31}$'),
+  -- Where it was given, e.g. registration, waitlist, account.
+  source text NOT NULL CHECK (char_length(source) <= 64 AND source ~ '^[a-z][a-z0-9]*(-[a-z0-9]+)*$'),
+  recorded_at timestamptz NOT NULL,
+  CONSTRAINT consents_one_subject CHECK (num_nonnulls(user_id, email_key) = 1),
+  CONSTRAINT consents_document_with_version CHECK ((document_id IS NULL) = (document_version IS NULL))
+);
+
+-- The current state and the history of a subject, per purpose, newest first.
+CREATE INDEX consents_user_id_idx ON consents (user_id, purpose, recorded_at DESC, id DESC) WHERE user_id IS NOT NULL;
+CREATE INDEX consents_email_key_idx ON consents (email_key, purpose, recorded_at DESC, id DESC) WHERE email_key IS NOT NULL;
+
+CREATE FUNCTION refuse_consent_update() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  RAISE EXCEPTION 'privacy.consents is append-only: record a new row instead of updating row %', OLD.id;
+END
+$$;
+
+CREATE TRIGGER consents_append_only BEFORE UPDATE ON consents FOR EACH ROW EXECUTE FUNCTION refuse_consent_update();

package/module.json

@@ -0,0 +1,15 @@
+{
+  "id": "privacy",
+  "version": "0.1.5",
+  "dependsOn": { "auth": "^0.1.0", "security": "^0.1.0" },
+  "dbSchema": "privacy",
+  "tables": ["consents"],
+  "env": [],
+  "switches": [],
+  "routes": { "account": "/account/privacy", "export": "/api/privacy/export", "afterDelete": "/" },
+  "mount": [
+    { "kind": "page", "path": "app/account/privacy/page.tsx", "export": "PrivacyPage" },
+    { "kind": "route-handler", "path": "app/api/privacy/export/route.ts", "export": "exportRoute" }
+  ],
+  "privacy": { "exports": true, "deletes": true }
+}

package/package.json

@@ -1,6 +1,66 @@
 {
   "name": "@softure-ai/privacy",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.5",
+  "description": "SOFTURE AI privacy module: modules and the app register GDPR export and deletion contributors; a JSON export endpoint and self-service account deletion for Next.js.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SOFTURE/AI.git",
+    "directory": "modules/privacy"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
+    "migrations",
+    "module.json"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "exports": {
+    ".": {
+      "@softure-ai/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./server": {
+      "@softure-ai/source": "./src/server/index.ts",
+      "types": "./dist/server/index.d.ts",
+      "default": "./dist/server/index.js"
+    },
+    "./next": {
+      "@softure-ai/source": "./src/next/index.ts",
+      "types": "./dist/next/index.d.ts",
+      "default": "./dist/next/index.js"
+    },
+    "./ui": {
+      "@softure-ai/source": "./src/ui/index.ts",
+      "types": "./dist/ui/index.d.ts",
+      "default": "./dist/ui/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json"
+  },
+  "dependencies": {
+    "@softure-ai/auth": "^0.1.0",
+    "@softure-ai/core": "^0.1.0",
+    "@softure-ai/db": "^0.1.0",
+    "@softure-ai/security": "^0.1.0",
+    "@softure-ai/ui": "^0.1.0",
+    "zod": "^4.6.5"
+  },
+  "peerDependencies": {
+    "drizzle-orm": "^0.45.2",
+    "next": "^16.0.0",
+    "react": "^19.0.0"
+  }
+}

package/src/contract.ts

@@ -0,0 +1,70 @@
+// Result types and error codes of the privacy module. No user-facing copy here: the UI translates
+// codes through `messages` (docs/02-module-standard.md §6).
+import type { CoreErrorCode } from "@softure-ai/core";
+
+export type PrivacyErrorCode =
+  | "privacy.export_failed"
+  | "privacy.export_too_large"
+  | "privacy.deletion_refused"
+  | "privacy.password_invalid"
+  | "privacy.confirmation_required"
+  | "privacy.consent_invalid"
+  | "privacy.document_unknown";
+
+/**
+ * Whose consent it is: an account, or an email address that has none (a waitlist sign-up). An
+ * account's consents and its email's consents are both its own in the export and the deletion.
+ * `{ emailKey }` names the same email subject by its stored key (`getEmailKey`), for a caller that
+ * only holds the key, such as mailing's unsubscribe link.
+ */
+export type ConsentSubject = { readonly userId: string } | { readonly email: string } | { readonly emailKey: string };
+
+/** One row of the ledger: a consent given (`granted`) or withdrawn. */
+export interface ConsentRecord {
+  readonly purpose: string;
+  readonly granted: boolean;
+  /** The legal document and its version at the moment of consent; null for a purpose without one. */
+  readonly document: { readonly id: string; readonly version: string } | null;
+  /** Where it was given, e.g. `registration`, `waitlist`. */
+  readonly source: string;
+  readonly recordedAt: Date;
+}
+
+/** The current state of one purpose: its latest record, checked against the configured version. */
+export interface ConsentState extends ConsentRecord {
+  /**
+   * False when the record names a document version that is no longer the configured one (or a
+   * document the app no longer declares): the person agreed to an earlier text.
+   */
+  readonly isCurrentVersion: boolean;
+}
+
+/** The file a user downloads: every contributor's part under its id. */
+export interface PrivacyExport {
+  readonly format: "softure.privacy-export";
+  readonly version: 1;
+  readonly userId: string;
+  /** ISO 8601, UTC. */
+  readonly exportedAt: string;
+  /** Each contributor's data under its id (a module id or an app contributor id), in export order. */
+  readonly data: Readonly<Record<string, unknown>>;
+}
+
+/** Every code the delete form can show: its own, the session and rate limit refusals, the generic ones. */
+export type DeleteAccountErrorCode =
+  | Extract<PrivacyErrorCode, "privacy.deletion_refused" | "privacy.password_invalid" | "privacy.confirmation_required">
+  | "auth.unauthenticated"
+  | "security.rate_limited"
+  | CoreErrorCode;
+
+export type DeleteAccountField = "password" | "confirm";
+
+/** What the delete action returns to its form (`useActionState`); success redirects instead. */
+export interface DeleteAccountFormState {
+  readonly status: "idle" | "error";
+  readonly error?: DeleteAccountErrorCode;
+  /** The field the error belongs to; none for a form-level error. */
+  readonly field?: DeleteAccountField;
+}
+
+export const INITIAL_DELETE_ACCOUNT_STATE: DeleteAccountFormState = { status: "idle" };

package/src/index.ts

@@ -0,0 +1,73 @@
+// Public API of @softure-ai/privacy: the module factory for softure.config.ts, its types, messages,
+// rate limit buckets and the consents table. The registry, export, deletion and the consent ledger
+// are in `@softure-ai/privacy/server`, the Next.js adapter (page, export route, delete action) in
+// `/next`, the delete form and the legal document shell in `/ui`.
+import { defineModule, resolveMigrationsDir } from "@softure-ai/core";
+import { privacyMessages } from "./messages/index.js";
+import { privacyOptionsSchema } from "./options.js";
+import { privacyConsentsContributor } from "./server/consents-contributor.js";
+import { checkConsentsTable } from "./server/health.js";
+
+export const MODULE_ID = "privacy";
+
+/**
+ * Rate limit buckets privacy consumes, with defaults to spread into `security({ buckets })`, both
+ * per user: `privacy-export` (downloads) and `privacy-delete` (deletion attempts, each one a
+ * password check).
+ */
+export const PRIVACY_RATE_LIMIT_BUCKETS = {
+  "privacy-export": { limit: 5, windowMinutes: 60 },
+  "privacy-delete": { limit: 5, windowMinutes: 15 },
+} as const;
+
+/**
+ * Enables the GDPR export, self-service account deletion and the consent ledger in
+ * `softure.config.ts` (after `auth({ ... })`):
+ * `privacy({ documents: [{ id: "terms", version: "2026-10-01" }], contributors: [{ id: "profile", exportUserData, deleteUserData }] })`.
+ * Every enabled module with user data contributes its own part; `contributors` adds the app's.
+ */
+export const privacy = defineModule({
+  manifest: {
+    id: MODULE_ID,
+    version: "0.1.5",
+    dependsOn: { auth: "^0.1.0", security: "^0.1.0" },
+    dbSchema: "privacy",
+    tables: ["consents"],
+    env: [],
+    switches: [],
+    routes: { account: "/account/privacy", export: "/api/privacy/export", afterDelete: "/" },
+    mount: [
+      { kind: "page", path: "app/account/privacy/page.tsx", export: "PrivacyPage" },
+      { kind: "route-handler", path: "app/api/privacy/export/route.ts", export: "exportRoute" },
+    ],
+    privacy: { exports: true, deletes: true },
+  },
+  messages: privacyMessages,
+  options: privacyOptionsSchema,
+  migrations: { dir: resolveMigrationsDir(import.meta.url, "../migrations/") },
+  privacy: privacyConsentsContributor,
+  health: checkConsentsTable,
+});
+
+export {
+  INITIAL_DELETE_ACCOUNT_STATE,
+  type ConsentRecord,
+  type ConsentState,
+  type ConsentSubject,
+  type DeleteAccountErrorCode,
+  type DeleteAccountField,
+  type DeleteAccountFormState,
+  type PrivacyErrorCode,
+  type PrivacyExport,
+} from "./contract.js";
+export { getPrivacyErrorMessage, privacyMessages, type PrivacyMessages } from "./messages/index.js";
+export {
+  CONTRIBUTOR_ID_PATTERN,
+  DEFAULT_EXPORT_MAX_BYTES,
+  DOCUMENT_VERSION_PATTERN,
+  type AppPrivacyContributor,
+  type LegalDocumentDeclaration,
+  type PrivacyOptions,
+  type PrivacyOptionsInput,
+} from "./options.js";
+export { consents, privacySchema } from "./schema.js";

package/src/messages/en.ts

@@ -0,0 +1,45 @@
+export const en = {
+  page: {
+    title: "Your data",
+    lead: "Download a copy of what this app stores about you, or delete your account.",
+  },
+  export: {
+    title: "Download your data",
+    description: "A JSON file with everything this app stores about your account.",
+    button: "Download my data",
+  },
+  delete: {
+    title: "Delete your account",
+    description: "This deletes your account and your data and signs you out on every device. It cannot be undone.",
+    password: "Current password",
+    confirm: "I understand that my account and my data will be deleted for good.",
+    submit: "Delete my account",
+    pending: "Deleting…",
+  },
+  legal: {
+    contents: "Contents",
+    version: "Version",
+    effectiveFrom: "Effective from",
+    changes: "Change history",
+    footer: "Legal information",
+  },
+  errors: {
+    privacy: {
+      export_failed: "Your data could not be collected. Try again in a moment.",
+      export_too_large: "Your data is too large to download here. Contact us and we will send it to you.",
+      deletion_refused: "Your account cannot be deleted right now, because some of its data must be kept for a while. Contact us for details.",
+      password_invalid: "This is not your current password.",
+      confirmation_required: "Confirm that you want to delete your account.",
+    },
+    auth: {
+      unauthenticated: "Your session has ended. Sign in again.",
+    },
+    security: {
+      rate_limited: "Too many attempts. Wait a moment and try again.",
+    },
+    core: {
+      database_failed: "Something went wrong on our side. Try again in a moment.",
+      unexpected: "Something went wrong on our side. Try again in a moment.",
+    },
+  },
+};

package/src/messages/index.ts

@@ -0,0 +1,18 @@
+import type { DeleteAccountErrorCode } from "../contract.js";
+import { en } from "./en.js";
+import { pl } from "./pl.js";
+
+/** Complete default dictionaries; apps pass partial overrides per locale. */
+export const privacyMessages = { en, pl };
+
+export type PrivacyMessages = typeof en;
+
+/** The copy for an error code; an unknown code gets the generic failure. */
+export function getPrivacyErrorMessage(messages: PrivacyMessages, code: DeleteAccountErrorCode): string {
+  const separator = code.lastIndexOf(".");
+  const namespace = code.slice(0, separator);
+  const name = code.slice(separator + 1);
+  const groups = messages.errors as Readonly<Record<string, Readonly<Record<string, string>>>>;
+  const group = Object.hasOwn(groups, namespace) ? groups[namespace] : undefined;
+  return (group !== undefined && Object.hasOwn(group, name) ? group[name] : undefined) ?? messages.errors.core.unexpected;
+}

package/src/messages/pl.ts

@@ -0,0 +1,47 @@
+import type { en } from "./en.js";
+
+export const pl: typeof en = {
+  page: {
+    title: "Twoje dane",
+    lead: "Pobierz kopię danych, które ta aplikacja o Tobie przechowuje, albo usuń konto.",
+  },
+  export: {
+    title: "Pobierz swoje dane",
+    description: "Plik JSON ze wszystkim, co ta aplikacja przechowuje o Twoim koncie.",
+    button: "Pobierz moje dane",
+  },
+  delete: {
+    title: "Usuń konto",
+    description: "To usunie Twoje konto i dane oraz wyloguje Cię na wszystkich urządzeniach. Tego nie da się cofnąć.",
+    password: "Obecne hasło",
+    confirm: "Rozumiem, że moje konto i moje dane zostaną usunięte na zawsze.",
+    submit: "Usuń moje konto",
+    pending: "Usuwanie…",
+  },
+  legal: {
+    contents: "Spis treści",
+    version: "Wersja",
+    effectiveFrom: "Obowiązuje od",
+    changes: "Historia zmian",
+    footer: "Informacje prawne",
+  },
+  errors: {
+    privacy: {
+      export_failed: "Nie udało się zebrać Twoich danych. Spróbuj ponownie za chwilę.",
+      export_too_large: "Twoich danych jest za dużo, by pobrać je tutaj. Napisz do nas, a prześlemy je.",
+      deletion_refused: "Nie można teraz usunąć konta, bo część jego danych musimy jeszcze przechowywać. Napisz do nas po szczegóły.",
+      password_invalid: "To nie jest Twoje obecne hasło.",
+      confirmation_required: "Potwierdź, że chcesz usunąć konto.",
+    },
+    auth: {
+      unauthenticated: "Twoja sesja wygasła. Zaloguj się ponownie.",
+    },
+    security: {
+      rate_limited: "Zbyt wiele prób. Odczekaj chwilę i spróbuj ponownie.",
+    },
+    core: {
+      database_failed: "Coś poszło nie tak po naszej stronie. Spróbuj ponownie za chwilę.",
+      unexpected: "Coś poszło nie tak po naszej stronie. Spróbuj ponownie za chwilę.",
+    },
+  },
+};

package/src/next/actions.ts

@@ -0,0 +1,61 @@
+"use server";
+
+// The account deletion action. The user comes from the session (never from a bound argument or
+// the form, which the client controls, docs/02 §8) before the form is read; unexpected failures
+// become `safeError` codes. Next refuses an action whose Origin does not match the host.
+import { getCurrentUser } from "@softure-ai/auth/next";
+import { errorLogLabel, safeError } from "@softure-ai/core";
+import { getSoftureConfig } from "@softure-ai/core/next";
+import { redirect } from "next/navigation";
+import { z } from "zod";
+import type { DeleteAccountErrorCode, DeleteAccountField, DeleteAccountFormState } from "../contract.js";
+import { getPrivacyRoutes } from "../server/options.js";
+import { deleteOwnAccount } from "../server/self-service.js";
+import { getPrivacyContext } from "./context.js";
+import { clearSessionCookie } from "./session-cookie.js";
+
+/** Longer values are cut: auth refuses them anyway, and nothing huge is hashed. */
+const MAX_FIELD_LENGTH = 4096;
+
+const deleteAccountInput = z.object({
+  password: z
+    .string()
+    .catch("")
+    .transform((value) => value.slice(0, MAX_FIELD_LENGTH)),
+  // A checked HTML checkbox sends "on" (or its value); an unchecked one sends nothing.
+  confirm: z.string().nullable().catch(null),
+});
+
+const FIELD_OF: Partial<Record<DeleteAccountErrorCode, DeleteAccountField>> = {
+  "privacy.password_invalid": "password",
+  "privacy.confirmation_required": "confirm",
+};
+
+function failure(error: DeleteAccountErrorCode): DeleteAccountFormState {
+  const field = FIELD_OF[error];
+  return field === undefined ? { status: "error", error } : { status: "error", error, field };
+}
+
+/** Deletes the signed-in user's account, ends the browser's session and goes to `afterDelete`. */
+export async function deleteAccountAction(_previous: DeleteAccountFormState, formData: FormData): Promise<DeleteAccountFormState> {
+  const config = getSoftureConfig();
+  let result;
+  try {
+    const user = await getCurrentUser();
+    if (user === null) return failure("auth.unauthenticated");
+    // Every field has a `catch`, so parsing cannot fail.
+    const input = deleteAccountInput.parse({ password: formData.get("password"), confirm: formData.get("confirm") });
+    result = await deleteOwnAccount(await getPrivacyContext(config), {
+      userId: user.id,
+      password: input.password,
+      isConfirmed: input.confirm !== null,
+    });
+  } catch (error) {
+    console.error(`@softure-ai/privacy: account deletion failed: ${errorLogLabel(error)}`);
+    return failure(safeError(error).error);
+  }
+  if (!result.ok) return failure(result.error);
+
+  await clearSessionCookie(config);
+  redirect(getPrivacyRoutes(config).afterDelete);
+}

package/src/next/context.ts

@@ -0,0 +1,14 @@
+// What the adapter hands the server functions: the registered config, the process-wide database
+// handle and the wall clock. Request scope (cookies, headers) stays in this folder.
+import { systemClock, type SoftureConfig } from "@softure-ai/core";
+import { getSoftureConfig } from "@softure-ai/core/next";
+import { getSharedDatabase } from "@softure-ai/db";
+import type { PrivacyContext } from "../server/context.js";
+
+export async function getPrivacyContext(config: SoftureConfig = getSoftureConfig()): Promise<PrivacyContext> {
+  if (config.database === null) {
+    throw new Error("@softure-ai/privacy: softure.config.ts has no database; privacy needs one");
+  }
+  const { db } = await getSharedDatabase(config.database.url);
+  return { db, clock: systemClock, config };
+}

package/src/next/index.ts

@@ -0,0 +1,6 @@
+// The Next.js adapter of @softure-ai/privacy: the page, the delete action and the export route
+// (docs/02-module-standard.md §8).
+export { deleteAccountAction } from "./actions.js";
+export { getPrivacyMessages } from "./messages.js";
+export { PrivacyPage } from "./pages.js";
+export { exportRoute } from "./route.js";

package/src/next/messages.ts

@@ -0,0 +1,9 @@
+import type { SoftureConfig } from "@softure-ai/core";
+import type { PrivacyMessages } from "../messages/index.js";
+import { getPrivacyModule } from "../server/options.js";
+
+/** The module's copy in the app's locale, with the app's overrides applied. */
+export function getPrivacyMessages(config: SoftureConfig): PrivacyMessages {
+  // The module factory merged the dictionaries; their shape is the module's own.
+  return getPrivacyModule(config).messages[config.locale] as PrivacyMessages;
+}

package/src/next/next-modules.d.ts

@@ -0,0 +1,12 @@
+// Next.js has no `exports` map, so NodeNext resolution (tsconfig.base.json) only finds
+// `next/navigation.js` and `next/headers.js`. The code must still import the bare specifiers:
+// Next's bundler aliases them per runtime, and the `.js` form bypasses the alias (measured:
+// `next build` failed to collect a route handler importing `next/navigation.js`, MODULE_UNPARSABLE
+// on the vendored app-router context). These declarations give the bare specifiers their types.
+declare module "next/navigation" {
+  export * from "next/navigation.js";
+}
+
+declare module "next/headers" {
+  export * from "next/headers.js";
+}

package/src/next/pages.tsx

@@ -0,0 +1,36 @@
+// The privacy page, ready to mount with one line:
+// `export { PrivacyPage as default } from "@softure-ai/privacy/next"` in app/account/privacy/page.tsx.
+// A server component: without a session it redirects to the login page and back.
+import { requireUser } from "@softure-ai/auth/next";
+import { getSoftureConfig } from "@softure-ai/core/next";
+import { ButtonLink, Card } from "@softure-ai/ui";
+import { getPrivacyRoutes } from "../server/options.js";
+import { DeleteAccountForm } from "../ui/delete-account-form.js";
+import { deleteAccountAction } from "./actions.js";
+import { getPrivacyMessages } from "./messages.js";
+
+const LAYOUT_CLASS = "sft:mx-auto sft:box-border sft:flex sft:w-full sft:flex-col sft:gap-4 sft:sm:max-w-md sft:px-4 sft:py-4";
+const DESCRIPTION_CLASS = "sft:m-0 sft:text-sm sft:text-muted";
+const SECTION_CLASS = "sft:flex sft:flex-col sft:gap-3";
+
+export async function PrivacyPage() {
+  const config = getSoftureConfig();
+  const routes = getPrivacyRoutes(config);
+  await requireUser({ next: routes.account });
+  const messages = getPrivacyMessages(config);
+  return (
+    <main className={LAYOUT_CLASS}>
+      <Card title={messages.page.title} subtitle={messages.page.lead} variant="lead">
+        <div className={SECTION_CLASS}>
+          <p className={DESCRIPTION_CLASS}>{messages.export.description}</p>
+          <ButtonLink href={routes.export} download variant="secondary">
+            {messages.export.button}
+          </ButtonLink>
+        </div>
+      </Card>
+      <Card title={messages.delete.title}>
+        <DeleteAccountForm action={deleteAccountAction} messages={messages} locale={config.locale} />
+      </Card>
+    </main>
+  );
+}

package/src/next/route.ts

@@ -0,0 +1,50 @@
+// The export route handler. Mount with a rename:
+// `export { exportRoute as GET } from "@softure-ai/privacy/next"` in app/api/privacy/export/route.ts.
+// The user comes from the session cookie only; the answer is a JSON attachment that is never cached.
+import { getCurrentUser } from "@softure-ai/auth/next";
+import { errorLogLabel, safeError, type SoftureConfig } from "@softure-ai/core";
+import { getSoftureConfig } from "@softure-ai/core/next";
+import { getPrivacyOptions } from "../server/options.js";
+import { exportOwnData } from "../server/self-service.js";
+import { getPrivacyContext } from "./context.js";
+
+const NO_STORE = { "cache-control": "no-store", "x-content-type-options": "nosniff" };
+
+function fail(error: string, status: number, headers: Record<string, string> = {}): Response {
+  return Response.json({ error }, { status, headers: { ...NO_STORE, ...headers } });
+}
+
+/** `account-data-2026-10-03.json`: the date of the download in the app's time zone. */
+function getFileName(config: SoftureConfig, now: Date): string {
+  const date = new Intl.DateTimeFormat("en-CA", { timeZone: config.timezone, year: "numeric", month: "2-digit", day: "2-digit" }).format(now);
+  return `${getPrivacyOptions(config).export.fileName}-${date}.json`;
+}
+
+/**
+ * The signed-in user's data as a JSON download. 401 without a session, 429 with `retry-after` over
+ * the `privacy-export` limit, 413 over `export.maxBytes`, 500 when a contributor fails.
+ */
+export async function exportRoute(): Promise<Response> {
+  try {
+    const config = getSoftureConfig();
+    const user = await getCurrentUser();
+    if (user === null) return fail("auth.unauthenticated", 401);
+
+    const ctx = await getPrivacyContext(config);
+    const result = await exportOwnData(ctx, { userId: user.id });
+    if (!result.ok) {
+      if ("retryAfterSeconds" in result) return fail(result.error, 429, { "retry-after": String(result.retryAfterSeconds) });
+      return fail(result.error, result.error === "privacy.export_too_large" ? 413 : 500);
+    }
+    return new Response(result.value.json, {
+      headers: {
+        ...NO_STORE,
+        "content-type": "application/json; charset=utf-8",
+        "content-disposition": `attachment; filename="${getFileName(config, ctx.clock.now())}"`,
+      },
+    });
+  } catch (error) {
+    console.error(`@softure-ai/privacy: export failed: ${errorLogLabel(error)}`);
+    return fail(safeError(error).error, 500);
+  }
+}

package/src/next/session-cookie.ts

@@ -0,0 +1,18 @@
+// Ending the browser's session cookie after the account is gone. The database sessions are
+// deleted with the account; this removes the cookie with the attributes auth set it with.
+import { getSessionCookie } from "@softure-ai/auth";
+import type { SoftureConfig } from "@softure-ai/core";
+import { cookies } from "next/headers";
+
+export async function clearSessionCookie(config: SoftureConfig): Promise<void> {
+  const cookie = getSessionCookie(config);
+  const store = await cookies();
+  store.set(cookie.name, "", {
+    httpOnly: cookie.httpOnly,
+    secure: cookie.secure,
+    sameSite: cookie.sameSite,
+    path: cookie.path,
+    domain: cookie.domain,
+    maxAge: 0,
+  });
+}