Release v0.1.20: Enterprise Compliance Suite

Date: 2026-02-11

This release adds 1,110 lines of compliance infrastructure across 12 files.

What changed

• Audit logging — New audit_logs table with JSONB metadata. Fire-and-forget writeAuditLog() utility. Clerk webhooks now log user.created, user.updated, and user.deleted events. Queryable via new audit tRPC router with filtering by resource type, action, and time range.
• GDPR consent management — Append-only consent_records table tracking essential, analytics, and marketing consent. New consent tRPC router with getStatus, update, updateBulk, and history endpoints. Essential consent cannot be withdrawn.
• Cascading data deletion — New data_deletion_requests table with 30-day grace period. executeUserDeletion() cascades deletes across all 15 tables. Clerk user.deleted webhook now triggers full cascade instead of just removing the user row.
• Legal pages — New /privacy and /terms pages added as public routes. Footer updated with links to both.
• Rate limiting — In-memory sliding-window rate limiter in Edge middleware. Tiered: API (100/min), tRPC mutations (30/min), webhooks (60/min), billing (10/hr), SSE (5/min). Returns 429 with Retry-After and X-RateLimit-* headers.

Why it matters

These are table-stakes requirements for enterprise customers evaluating SOC 2, GDPR, and ISO 27001 compliance. Users now get audit trails, consent tracking, right-to-erasure support, legal pages, and abuse protection out of the box.

Technical notes

• Three new database tables: audit_logs, consent_records, data_deletion_requests
• Three new tRPC routers registered in root: audit, consent, dataDeletion
• Rate limiter uses separately typed RateLimitConfig variables to avoid TypeScript literal type inference issues with as const records