@tangle-network/starter-foundry 0.5.3 → 0.7.0

package/registry/families/gdpr-compliance-pack/files/docs/GDPR-controls.md

@@ -0,0 +1,65 @@
+# GDPR + CPRA — Control Surface
+
+This pack produces the artifacts an EU (GDPR) or California (CPRA) regulator
+will look for. The process obligations (DPO designation, DPIA approvals,
+Art. 33 breach notification) are operational — not shipped as code.
+
+## GDPR articles covered
+
+| Article | Control | Artifact |
+|---|---|---|
+| Art. 5 | Principles of processing | Legal-basis tagging in `data-inventory.ts` |
+| Art. 6 | Lawful basis | `data-inventory.ts` category legalBasis |
+| Art. 7 | Conditions for consent | `consent.ts` — withdrawable, affirmative, evidence |
+| Art. 12 | Transparent info | Privacy policy + consent banner |
+| Art. 13/14 | Information at collection | Privacy policy page (consumer ships) |
+| Art. 15 | Right of access | `data-subject-rights.ts` — collectExport |
+| Art. 16 | Right to rectification | Consumer's profile edit UI |
+| Art. 17 | Right to erasure | `data-subject-rights.ts` — honorErasure + Art. 17(3) exceptions |
+| Art. 20 | Right to data portability | collectExport produces JSON (machine-readable) |
+| Art. 21 | Right to object | Consumer wires to erasure with basis='objection-art-21' |
+| Art. 25 | Data protection by design | Minimum-necessary filtering + essential-only default consent |
+| Art. 30 | Record of processing activities | `data-inventory.ts` — RoPA shape + validator |
+| Art. 32 | Security of processing | TLS + encryption-at-rest (infra) |
+| Art. 33/34 | Breach notification | Operational — 72-hour clock; template in docs/ |
+| Art. 35 | DPIA | `docs/DPIA-template.md` |
+
+## CPRA parallel obligations
+
+- **Right to know** (§1798.100) — covered by Art. 15 export surface.
+- **Right to delete** (§1798.105) — covered by Art. 17 erasure surface.
+- **Right to opt-out of sale** (§1798.120) — CA-specific; wire a separate toggle in settings.
+- **"Do not sell my personal information" link** — render at site footer.
+- **Right to correct** (§1798.106) — consumer's profile edit UI.
+- **Non-discrimination** (§1798.125) — don't charge different prices for users exercising rights.
+
+## Consent — the six requirements of Art. 4(11)
+
+1. **Freely given** — not tied to service access unless consent is strictly necessary.
+2. **Specific** — per-category granularity (analytics ≠ marketing).
+3. **Informed** — privacy policy referenced + readable.
+4. **Unambiguous** — explicit opt-in, no pre-ticked boxes.
+5. **Affirmative action** — click, not scroll or "continue by staying on the page."
+6. **Withdrawable** — one-click via banner or settings; as easy as giving consent.
+
+## 30-day SLA on DSR requests
+
+Art. 12(3) — respond within 1 month. Extend by ≤2 months for complex requests if you notify the subject within the first month.
+
+## Legitimate interest — document the LIA
+
+If you use Art. 6(1)(f) as a legal basis, you MUST have a written Legitimate
+Interest Assessment. The assessment has three parts:
+
+1. **Purpose test** — what's the legitimate interest?
+2. **Necessity test** — is processing necessary to achieve that interest?
+3. **Balancing test** — does the interest override the subject's rights?
+
+Reference the LIA from `data-inventory.ts` via `liaReference`.
+
+## International transfers
+
+- **EU → US**: use the EU-US Data Privacy Framework (DPF) — supersedes Privacy Shield.
+- **EU → other**: use Standard Contractual Clauses (SCCs) + a Transfer Impact Assessment (TIA).
+- **UK → elsewhere**: use the UK International Data Transfer Agreement (IDTA) or the EU SCCs with the UK addendum.
+- Document the safeguard in `data-inventory.ts` via `internationalTransfer.safeguard`.

package/registry/families/gdpr-compliance-pack/files/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "{{packageName}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc --noEmit",
+    "validate": "node validate-hipaa-pack.mjs"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "typescript": "^5.9.0",
+    "@types/node": "^22.0.0"
+  }
+}

package/registry/families/gdpr-compliance-pack/files/src/components/CookieBanner.tsx

@@ -0,0 +1,115 @@
+// GDPR-compliant cookie banner. Shows BEFORE non-essential cookies are set.
+// Affirmative action required (no pre-ticked boxes). Consent withdrawable
+// via the "Preferences" link at any time.
+//
+// Consumer must wire onConsent to src/consent.ts's InMemoryConsentStore
+// (or production store) + attach the result to analytics/marketing gate.
+
+import { useEffect, useState } from 'react'
+
+export type ConsentCategory = 'essential' | 'analytics' | 'marketing' | 'personalization'
+
+export interface CookieBannerProps {
+  policyUrl: string
+  policyVersion: string
+  onConsent: (categories: ConsentCategory[]) => void | Promise<void>
+}
+
+const STORAGE_KEY = 'starter-foundry:gdpr-consent-v1'
+
+export function CookieBanner(props: CookieBannerProps): JSX.Element | null {
+  const [visible, setVisible] = useState(false)
+  const [showDetails, setShowDetails] = useState(false)
+  const [choices, setChoices] = useState<Record<ConsentCategory, boolean>>({
+    essential: true, // always on — Art. 6(1)(b)
+    analytics: false,
+    marketing: false,
+    personalization: false,
+  })
+
+  useEffect(() => {
+    const stored = typeof localStorage !== 'undefined' ? localStorage.getItem(STORAGE_KEY) : null
+    if (!stored) setVisible(true)
+    else {
+      try {
+        const prior = JSON.parse(stored)
+        if (prior.policyVersion !== props.policyVersion) setVisible(true)
+      } catch {
+        setVisible(true)
+      }
+    }
+  }, [props.policyVersion])
+
+  if (!visible) return null
+
+  function finalize(selected: ConsentCategory[]): void {
+    localStorage.setItem(
+      STORAGE_KEY,
+      JSON.stringify({ policyVersion: props.policyVersion, selected, at: new Date().toISOString() }),
+    )
+    void props.onConsent(selected)
+    setVisible(false)
+  }
+
+  return (
+    <div
+      role="dialog"
+      aria-labelledby="cookie-banner-title"
+      style={{
+        position: 'fixed',
+        bottom: 0,
+        left: 0,
+        right: 0,
+        background: '#0b0d10',
+        color: '#d5deeb',
+        padding: '24px',
+        borderTop: '1px solid rgba(255,255,255,0.1)',
+        zIndex: 1000,
+      }}
+    >
+      <h2 id="cookie-banner-title" style={{ margin: '0 0 8px', fontSize: 18 }}>
+        Cookies &amp; privacy
+      </h2>
+      <p style={{ margin: '0 0 12px', fontSize: 14, maxWidth: 720 }}>
+        We use cookies to run the service. Analytics + marketing cookies are OFF by default
+        and only set after you opt in. Read our{' '}
+        <a href={props.policyUrl} style={{ color: '#6ea8ff' }}>
+          privacy policy
+        </a>
+        .
+      </p>
+      {showDetails && (
+        <fieldset style={{ border: 'none', padding: 0, margin: '0 0 12px' }}>
+          {(['analytics', 'marketing', 'personalization'] as const).map((cat) => (
+            <label key={cat} style={{ display: 'block', margin: '4px 0' }}>
+              <input
+                type="checkbox"
+                checked={choices[cat]}
+                onChange={(e) => setChoices((s) => ({ ...s, [cat]: e.target.checked }))}
+              />{' '}
+              {cat}
+            </label>
+          ))}
+        </fieldset>
+      )}
+      <div style={{ display: 'flex', gap: 8, flexWrap: 'wrap' }}>
+        <button type="button" onClick={() => finalize(['essential'])}>Reject non-essential</button>
+        <button type="button" onClick={() => setShowDetails((v) => !v)}>
+          {showDetails ? 'Hide' : 'Customize'}
+        </button>
+        {showDetails && (
+          <button type="button" onClick={() => finalize((Object.keys(choices) as ConsentCategory[]).filter((k) => choices[k]))}>
+            Save selection
+          </button>
+        )}
+        <button
+          type="button"
+          onClick={() => finalize(['essential', 'analytics', 'marketing', 'personalization'])}
+          style={{ background: '#6ea8ff', color: '#0b0d10', border: 'none', padding: '8px 16px' }}
+        >
+          Accept all
+        </button>
+      </div>
+    </div>
+  )
+}

package/registry/families/gdpr-compliance-pack/files/src/consent.ts

@@ -0,0 +1,71 @@
+// GDPR Art. 4(11) consent primitives. Every requirement enforced:
+//   freely given, specific, informed, unambiguous, affirmative, withdrawable.
+
+export type ConsentCategory = 'essential' | 'analytics' | 'marketing' | 'personalization'
+
+export interface ConsentRecord {
+  id: string
+  userId: string
+  categories: ConsentCategory[]
+  /** The specific version of the privacy notice shown at capture time. */
+  policyVersion: string
+  /** Captured via 'banner', 'settings', or 'api'. */
+  source: 'banner' | 'settings' | 'api'
+  givenAt: string
+  withdrawnAt?: string
+  /** IP + user agent for Art. 7(1) evidence. */
+  ip?: string
+  userAgent?: string
+}
+
+export interface ConsentStore {
+  record(entry: ConsentRecord): Promise<void>
+  active(userId: string): Promise<ConsentRecord | null>
+  withdraw(userId: string, at?: string): Promise<void>
+  history(userId: string): Promise<ConsentRecord[]>
+}
+
+/** Essential category is implicit — no consent needed per Art. 6(1)(b). */
+export const DEFAULT_ESSENTIAL_CATEGORIES: ConsentCategory[] = ['essential']
+
+/** Pre-ticked boxes are invalid — this validator throws on any empty affirmative action. */
+export function validateConsentRequest(request: {
+  userId: string
+  explicitlyAccepted: ConsentCategory[]
+  policyVersion: string
+}): void {
+  if (!request.userId) throw new Error('GDPR consent: userId required')
+  if (!request.policyVersion) throw new Error('GDPR consent: policyVersion required')
+  // "Essential" doesn't need consent; only accept categories beyond essential.
+  const beyondEssential = request.explicitlyAccepted.filter((c) => c !== 'essential')
+  for (const cat of beyondEssential) {
+    if (!(['analytics', 'marketing', 'personalization'] as const).includes(cat as never)) {
+      throw new Error(`GDPR consent: unknown category "${cat}"`)
+    }
+  }
+}
+
+export class InMemoryConsentStore implements ConsentStore {
+  private entries: ConsentRecord[] = []
+
+  async record(entry: ConsentRecord): Promise<void> {
+    this.entries.push({ ...entry })
+  }
+
+  async active(userId: string): Promise<ConsentRecord | null> {
+    const recent = this.entries
+      .filter((e) => e.userId === userId && !e.withdrawnAt)
+      .sort((a, b) => b.givenAt.localeCompare(a.givenAt))
+    return recent[0] ?? null
+  }
+
+  async withdraw(userId: string, at = new Date().toISOString()): Promise<void> {
+    for (const e of this.entries) {
+      if (e.userId === userId && !e.withdrawnAt) e.withdrawnAt = at
+    }
+  }
+
+  async history(userId: string): Promise<ConsentRecord[]> {
+    return this.entries.filter((e) => e.userId === userId)
+  }
+}

package/registry/families/gdpr-compliance-pack/files/src/data-inventory.ts

@@ -0,0 +1,94 @@
+// Record of Processing Activities (RoPA) — Art. 30 requires every
+// controller to maintain this. Structure: per data category, the
+// legal basis, retention period, recipients, and international transfers.
+
+export type LegalBasis =
+  | 'consent'
+  | 'contract'
+  | 'legal-obligation'
+  | 'vital-interests'
+  | 'public-task'
+  | 'legitimate-interests'
+
+export interface DataCategory {
+  name: string
+  /** Which table / collection / system this lives in. */
+  location: string
+  /** Example fields — do not exhaustively enumerate PII inline. */
+  fields: string[]
+  legalBasis: LegalBasis
+  /** If legitimate-interests, the LIA document path. */
+  liaReference?: string
+  retentionDays: number
+  /** Third parties that receive this category. */
+  recipients: string[]
+  internationalTransfer?: { country: string; safeguard: string }
+}
+
+export interface RecordOfProcessing {
+  controllerName: string
+  controllerContact: string
+  dpoContact?: string
+  updatedAt: string
+  categories: DataCategory[]
+}
+
+export const EXAMPLE_ROPA: RecordOfProcessing = {
+  controllerName: 'Example Co.',
+  controllerContact: 'privacy@example.com',
+  dpoContact: 'dpo@example.com',
+  updatedAt: '2026-04-21',
+  categories: [
+    {
+      name: 'account',
+      location: 'users table',
+      fields: ['email', 'name', 'passwordHash'],
+      legalBasis: 'contract',
+      retentionDays: 2555, // 7 years for account records
+      recipients: ['better-auth (auth provider)'],
+    },
+    {
+      name: 'billing',
+      location: 'stripe + billing_events table',
+      fields: ['paymentMethodId', 'last4', 'amount', 'currency'],
+      legalBasis: 'contract',
+      retentionDays: 2555,
+      recipients: ['Stripe'],
+      internationalTransfer: { country: 'US', safeguard: 'EU-US Data Privacy Framework' },
+    },
+    {
+      name: 'analytics',
+      location: 'events table',
+      fields: ['userId', 'eventName', 'timestamp'],
+      legalBasis: 'consent',
+      retentionDays: 365,
+      recipients: [],
+    },
+    {
+      name: 'support-tickets',
+      location: 'tickets table',
+      fields: ['userId', 'subject', 'body', 'attachments'],
+      legalBasis: 'legitimate-interests',
+      liaReference: 'docs/legal/LIA-support.md',
+      retentionDays: 730,
+      recipients: [],
+    },
+  ],
+}
+
+export function validateRoPA(ropa: RecordOfProcessing): string[] {
+  const issues: string[] = []
+  if (!ropa.controllerName) issues.push('missing controllerName')
+  if (!ropa.controllerContact) issues.push('missing controllerContact')
+  for (const cat of ropa.categories) {
+    if (!cat.name) issues.push(`category missing name`)
+    if (cat.legalBasis === 'legitimate-interests' && !cat.liaReference) {
+      issues.push(`category ${cat.name}: legitimate-interests requires liaReference`)
+    }
+    if (cat.retentionDays <= 0) issues.push(`category ${cat.name}: invalid retentionDays`)
+    if (cat.internationalTransfer && !cat.internationalTransfer.safeguard) {
+      issues.push(`category ${cat.name}: international transfer needs a safeguard (SCC, DPF, etc.)`)
+    }
+  }
+  return issues
+}

package/registry/families/gdpr-compliance-pack/files/src/data-subject-rights.ts

@@ -0,0 +1,98 @@
+// Data Subject Rights — Art. 15 (access/export) + Art. 17 (erasure) + Art. 20 (portability).
+// The 30-day SLA applies to each. This module ships the framework-agnostic
+// contract; HTTP/router bindings live in the consuming service.
+
+export interface DataExport {
+  userId: string
+  exportedAt: string
+  /** Categories of data included in the export (data inventory). */
+  categories: string[]
+  /** JSON-structured data payload. */
+  payload: Record<string, unknown>
+  /** Machine-readable format per Art. 20 — default "application/json". */
+  format: string
+}
+
+export interface ErasureRequest {
+  userId: string
+  requestedAt: string
+  /** Tied to one of the Art. 17 grounds so we can document it. */
+  basis:
+    | 'no-longer-necessary'
+    | 'consent-withdrawn'
+    | 'objection-art-21'
+    | 'unlawfully-processed'
+    | 'legal-obligation'
+    | 'consent-of-child'
+}
+
+export interface ErasureDecision {
+  userId: string
+  honoredAt?: string
+  refusedAt?: string
+  refusalBasis?: 'legal-obligation' | 'public-interest' | 'legal-claims' | 'freedom-of-expression'
+  refusalExplanation?: string
+}
+
+export interface DataSubjectRightsHandler {
+  export(userId: string): Promise<DataExport>
+  erase(request: ErasureRequest): Promise<ErasureDecision>
+}
+
+/**
+ * Compose a data export by fanning out to per-category collectors. Each
+ * collector knows its own table/columns. Returns a single JSON payload
+ * suitable for right-to-portability (Art. 20).
+ */
+export type CategoryCollector = (userId: string) => Promise<Record<string, unknown>>
+
+export async function collectExport(
+  userId: string,
+  collectors: Record<string, CategoryCollector>,
+): Promise<DataExport> {
+  const payload: Record<string, unknown> = {}
+  for (const [category, collect] of Object.entries(collectors)) {
+    try {
+      payload[category] = await collect(userId)
+    } catch (err) {
+      payload[category] = { __error: (err as Error).message }
+    }
+  }
+  return {
+    userId,
+    exportedAt: new Date().toISOString(),
+    categories: Object.keys(collectors),
+    payload,
+    format: 'application/json',
+  }
+}
+
+/**
+ * Honor an erasure request, calling each per-category eraser. Art. 17(3)
+ * exceptions are checked via `shouldRetain` — if any returns a basis, the
+ * request is REFUSED with a documented reason (per Art. 12(4)).
+ */
+export type CategoryEraser = (userId: string) => Promise<void>
+export type RetentionChecker = (userId: string) => Promise<ErasureDecision['refusalBasis'] | null>
+
+export async function honorErasure(
+  request: ErasureRequest,
+  erasers: Record<string, CategoryEraser>,
+  retentionChecks: RetentionChecker[] = [],
+): Promise<ErasureDecision> {
+  for (const check of retentionChecks) {
+    const basis = await check(request.userId)
+    if (basis) {
+      return {
+        userId: request.userId,
+        refusedAt: new Date().toISOString(),
+        refusalBasis: basis,
+        refusalExplanation: `Art. 17(3) exception applies: ${basis}`,
+      }
+    }
+  }
+  for (const erase of Object.values(erasers)) {
+    await erase(request.userId)
+  }
+  return { userId: request.userId, honoredAt: new Date().toISOString() }
+}

package/registry/families/gdpr-compliance-pack/files/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "declaration": true,
+    "lib": ["ES2022"]
+  },
+  "include": ["src"]
+}

package/registry/families/gdpr-compliance-pack/files/validate-gdpr-pack.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { readFileSync, existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+for (const rel of [
+  'src/consent.ts',
+  'src/data-subject-rights.ts',
+  'src/data-inventory.ts',
+  'src/components/CookieBanner.tsx',
+  'docs/GDPR-controls.md',
+  'docs/DPIA-template.md',
+]) {
+  if (!existsSync(join(here, rel))) throw new Error(`missing ${rel}`)
+}
+
+const consent = readFileSync(join(here, 'src/consent.ts'), 'utf8')
+if (!consent.includes('withdrawnAt')) throw new Error('consent.ts must track withdrawnAt (Art. 7 withdrawability)')
+if (!/validateConsentRequest/.test(consent)) throw new Error('consent.ts missing validateConsentRequest')
+
+const dsr = readFileSync(join(here, 'src/data-subject-rights.ts'), 'utf8')
+if (!dsr.includes('honorErasure')) throw new Error('data-subject-rights.ts missing honorErasure')
+if (!dsr.includes('collectExport')) throw new Error('data-subject-rights.ts missing collectExport')
+if (!/Art\. 17\(3\)/.test(dsr)) throw new Error('data-subject-rights.ts must document Art. 17(3) exceptions')
+
+const controls = readFileSync(join(here, 'docs/GDPR-controls.md'), 'utf8')
+if (!/Art\. 15|Right of access/.test(controls)) throw new Error('GDPR-controls.md missing Art. 15 reference')
+if (!/Art\. 17|right to erasure/i.test(controls)) throw new Error('GDPR-controls.md missing Art. 17 reference')
+
+console.log('gdpr-pack ok')

package/registry/families/gdpr-compliance-pack/manifest.json

@@ -0,0 +1,56 @@
+{
+  "id": "gdpr-compliance-pack",
+  "description": "GDPR + CPRA compliance overlay — consent capture, right-to-export / right-to-delete endpoints, data inventory manifest, cookie banner. Composes onto fullstack-ts / nextjs-ts / ecommerce-headless.",
+  "tags": ["compliance", "gdpr", "cpra", "privacy"],
+  "taxonomy": { "language": "typescript", "runtime": "node", "surface": "api" },
+  "defaults": { "projectType": "compliance-pack", "serviceName": "starter-foundry-gdpr-pack" },
+  "files": [
+    { "source": "files/package.json", "target": "package.json" },
+    { "source": "files/tsconfig.json", "target": "tsconfig.json" },
+    { "source": "files/src/consent.ts", "target": "src/consent.ts" },
+    { "source": "files/src/data-subject-rights.ts", "target": "src/data-subject-rights.ts" },
+    { "source": "files/src/data-inventory.ts", "target": "src/data-inventory.ts" },
+    { "source": "files/src/components/CookieBanner.tsx", "target": "src/components/CookieBanner.tsx" },
+    { "source": "files/docs/GDPR-controls.md", "target": "docs/GDPR-controls.md" },
+    { "source": "files/docs/DPIA-template.md", "target": "docs/DPIA-template.md" },
+    { "source": "files/validate-gdpr-pack.mjs", "target": "validate-gdpr-pack.mjs" }
+  ],
+  "validationChecks": [
+    { "type": "file-exists", "path": "src/consent.ts" },
+    { "type": "file-exists", "path": "src/data-subject-rights.ts" },
+    { "type": "command-success", "command": ["node", "validate-gdpr-pack.mjs"], "expect": "gdpr-pack ok" }
+  ],
+  "contextHints": {
+    "commands": ["pnpm install", "pnpm build"],
+    "entrypoints": ["src/consent.ts", "src/data-subject-rights.ts", "docs/GDPR-controls.md"],
+    "preview": null,
+    "extensionPoints": ["src/data-inventory.ts"]
+  },
+  "keywords": ["gdpr", "gdpr compliance", "cpra", "consent management", "right to erasure", "data subject rights"],
+  "scoring": { "boost": { "gdpr compliance": 5, "data subject rights": 4 } },
+  "tieredKeywords": {
+    "tier1": ["gdpr compliance", "gdpr compliant", "cpra compliant", "data subject rights"],
+    "tier2": ["right to erasure", "right to be forgotten", "consent banner", "cookie banner gdpr"]
+  },
+  "buildHints": {
+    "whenToUse": "Shipping to EU / CA / other jurisdictions with data-subject rights obligations. Bolt onto an existing fullstack/api backend.",
+    "firstSteps": [
+      "Run `src/data-inventory.ts` to generate a first-draft Record of Processing Activities (RoPA). Customize per your product's schema.",
+      "Wire `/api/export-my-data` using `src/data-subject-rights.ts` — must respond within 30 days per Art. 12(3).",
+      "Wire `/api/delete-my-data` — must honor erasure within 30 days unless one of the Art. 17(3) exceptions applies.",
+      "Drop `CookieBanner.tsx` at the root layout — consent MUST be gathered BEFORE setting any non-essential cookies.",
+      "Fill out `docs/DPIA-template.md` if you process high-risk categories (Art. 35)."
+    ],
+    "gotchas": [
+      "'Consent' as a legal basis has SIX requirements per Art. 4(11) — freely given, specific, informed, unambiguous, affirmative, withdrawable. Pre-ticked boxes are invalid.",
+      "Legitimate interest (Art. 6(1)(f)) is often a better basis than consent for operational processing — but requires a documented LIA (Legitimate Interest Assessment).",
+      "Right-to-delete is NOT absolute. Exceptions: legal obligation, public interest, establishment of legal claims (Art. 17(3)). Document which exception applies when refusing.",
+      "Data breaches must be reported to the supervisory authority within 72 HOURS per Art. 33. Have the notification draft template pre-written.",
+      "CPRA (California) has parallel but not identical rules — the 'shine the light' + 'opt-out of sale' surfaces differ. This pack covers the shared 80%; add CPRA-specific flows as needed."
+    ],
+    "placeholders": [
+      { "path": "src/data-inventory.ts", "description": "RoPA seed. Extend with your actual data categories + legal bases + retention periods." },
+      { "path": "docs/DPIA-template.md", "description": "DPIA template. Fill before processing high-risk categories." }
+    ]
+  }
+}

package/registry/families/godot-web/files/README.md

@@ -0,0 +1,71 @@
+# {{serviceName}}
+
+Godot 4.3 HTML5 starter. The scaffold ships the project skeleton + a Web
+export preset; the editor is required to actually export (unlike
+bevy-web, Godot's build tool is the editor itself).
+
+## Setup
+
+1. Install Godot 4.3+ from [godotengine.org](https://godotengine.org) (or
+   `brew install --cask godot` on macOS).
+2. Open the Editor, click *Manage Export Templates*, and download the
+   templates that match your editor version exactly (4.3-stable editor
+   needs 4.3-stable templates).
+
+## Run in editor
+
+```sh
+godot --editor .
+# or drag project.godot onto the Godot executable
+```
+
+Press **F5** to run the main scene in a native window. Press **F8** to
+run the current scene.
+
+## Export to web
+
+**Editor:** *Project → Export → Web → Export Project*. Output lands in
+`exports/web/` as `index.html`, `index.js`, `index.wasm`, `index.pck`.
+
+**CLI (CI):**
+
+```sh
+godot --headless --export-release 'Web' exports/web/index.html
+```
+
+## Serving the export
+
+Godot's HTML5 build requires `SharedArrayBuffer`, which browsers only
+expose when the page is served with **cross-origin isolation headers**:
+
+```
+Cross-Origin-Opener-Policy: same-origin
+Cross-Origin-Embedder-Policy: require-corp
+```
+
+Without these, the canvas stays blank. Configure your static host:
+
+- **Cloudflare Pages**: add a `_headers` file in the output directory
+  with the two headers above.
+- **Vercel / Netlify**: set them in `vercel.json` / `netlify.toml`
+  scoped to the exports/web path.
+- **nginx**: `add_header Cross-Origin-Opener-Policy same-origin;
+  add_header Cross-Origin-Embedder-Policy require-corp;` inside the
+  serving `location` block.
+
+## Project layout
+
+- `project.godot` — engine config, main scene, display size.
+- `scenes/main.tscn` — root scene loaded at startup.
+- `scripts/main.gd` — GDScript attached to the scene root.
+- `export_presets.cfg` — Web target preset.
+- `exports/web/` — export output (gitignored by default).
+
+## Gotchas
+
+- **Export templates must match the editor version exactly.** A `4.3-dev`
+  template on a `4.3-stable` editor fails silently.
+- **Audio is autoplay-blocked** in every browser until the first user
+  input; wire audio to a click handler.
+- **Never commit `.godot/`** (editor cache) — the supplied .gitignore
+  excludes it.