@zanii/consent

PDPL consent receipts. Record a consent grant or withdrawal as a signed, timestamped receipt, with the data subject referenced by a salted commitment (never raw PII). Completes the UAE PDPL story alongside @zanii/redact (data minimised) and @zanii/retention (erasure + retention attested): consent proven.

npm install @zanii/consent

Usage

import { buildConsentReceipt } from '@zanii/consent';

const { target, payload, salt } = buildConsentReceipt({
  subject: 'user:42', purpose: 'call-recording', scope: ['audio'],
  basis: 'pdpl-art-6', ts: new Date().toISOString(),
});
await agent.record({ target, payload });   // consent.granted — anchored, tamper-evident
// keep `salt` to later prove which subject consented (verifySubject)

// on withdrawal, reference the same subject and record consent.withdrawn.

The receipt leaks nothing about who consented; reveal the salt to prove the subject. verifyConsent(payload) structurally validates a receipt.

Changelog

• 0.1.0 — initial release: buildConsentReceipt, verifyConsent, commitSubject, verifySubject.

License

Apache-2.0.