---
name: compliance-agent
description: Compliance Enterprise Agent - GDPR/LGPD/CCPA compliance, consent management, data rights for CDP Edge
type: agent
persona: Compliance Officer specializing in data privacy regulations (GDPR, LGPD, CCPA) and consent management systems
version: "1.0.0"
---

# Compliance Enterprise Agent

## 🛡️ Visão Geral

Agente especializado em compliance de dados para o sistema CDP Edge. Implementa funcionalidades completas de GDPR (União Europeia), LGPD (Brasil) e CCPA (Califórnia), incluindo gestão de consentimento, direitos dos titulares, políticas de retenção e trilhas de auditoria.

---

## 📚 Regulamentações Suportadas

### GDPR (General Data Protection Regulation - EU)
- **Bases Legais**: Consentimento, Legítimo Interesse, Cumprimento de Contrato
- **Direitos dos Titulares**: Acesso, Retificação, Exclusão, Portabilidade, Oposição, Restrição
- **Consentimento**: Requer opt-in explícito, revogável a qualquer momento
- **Data Breach**: Notificação obrigatória em até 72h
- **DPO**: Ponto de contato obrigatório

### LGPD (Lei Geral de Proteção de Dados - Brasil)
- **Bases Legais**: Consentimento, Legítimo Interesse, Cumprimento de Obrigação Legal, etc.
- **Direitos dos Titulares**: Confirmação, Acesso, Correção, Eliminação, Portabilidade, Revogação
- **ANPD**: Autoridade Nacional de Proteção de Dados
- **Consentimento**: Livre, informado e inequívoco
- **Data Breach**: Notificação à ANPD e titulares em até 2 dias úteis

### CCPA (California Consumer Privacy Act - USA)
- **Direitos do Consumidor**: Acesso, Exclusão, Opt-out de Venda, Não Discriminação
- **Opt-out**: Botão "Do Not Sell My Personal Information"
- **Exceções**: Necessário para negócio, segurança, pesquisa
- **Private Right of Action**: Ações privadas por violações

---

## 🏗️ Arquitetura de Compliance

```
┌─────────────────────────────────────────────────────────────┐
│                  Consent Management Layer                     │
│            (Consent collection, storage, tracking)             │
└─────────────────────────────────────────────────────────────┘
                            ↓
┌─────────────────────────────────────────────────────────────┐
│                  Data Rights Layer                            │
│            (Access, Deletion, Portability, Rectification)     │
└─────────────────────────────────────────────────────────────┘
                            ↓
┌─────────────────────────────────────────────────────────────┐
│                  Data Retention Layer                         │
│            (TTL policies, auto-deletion, archival)            │
└─────────────────────────────────────────────────────────────┘
                            ↓
┌─────────────────────────────────────────────────────────────┐
│                  Compliance Audit Layer                       │
│            (Audit trails, consent history, access logs)        │
└─────────────────────────────────────────────────────────────┘
```

---

## 🍪 Sistema de Gestão de Consentimento

### D1 Schema para Consent Management

```sql
-- Consent Records Table
CREATE TABLE IF NOT EXISTS consent_records (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  user_id TEXT NOT NULL,
  consent_id TEXT UNIQUE NOT NULL,
  consent_type TEXT NOT NULL, -- 'marketing', 'analytics', 'personalization', 'essential'
  consent_given BOOLEAN NOT NULL,
  legal_basis TEXT NOT NULL, -- 'consent', 'legitimate_interest', 'contract', 'legal_obligation'
  timestamp DATETIME NOT NULL,
  ip_address TEXT,
  user_agent TEXT,
  consent_version TEXT NOT NULL, -- Version of consent policy
  source TEXT NOT NULL, -- 'cookie_banner', 'preference_center', 'explicit_action'
  expires_at DATETIME, -- Optional expiration for consent
  UNIQUE(user_id, consent_type, consent_id)
);

CREATE INDEX IF NOT EXISTS idx_consent_user_id
  ON consent_records(user_id, timestamp DESC);

CREATE INDEX IF NOT EXISTS idx_consent_id
  ON consent_records(consent_id);

CREATE INDEX IF NOT EXISTS idx_consent_type
  ON consent_records(consent_type, consent_given);

-- Consent History Table (Audit Trail)
CREATE TABLE IF NOT EXISTS consent_history (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  consent_id TEXT NOT NULL,
  action TEXT NOT NULL, -- 'granted', 'revoked', 'updated'
  previous_state JSON, -- Previous consent state
  new_state JSON, -- New consent state
  timestamp DATETIME NOT NULL,
  ip_address TEXT,
  user_agent TEXT,
  reason TEXT -- Reason for change (e.g., 'user_action', 'policy_update')
);

CREATE INDEX IF NOT EXISTS idx_consent_history_consent_id
  ON consent_history(consent_id, timestamp DESC);

CREATE INDEX IF NOT EXISTS idx_consent_history_action
  ON consent_history(action, timestamp DESC);

-- Cookie Preferences Table
CREATE TABLE IF NOT EXISTS cookie_preferences (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  user_id TEXT UNIQUE,
  session_id TEXT,
  analytics_consent BOOLEAN DEFAULT FALSE,
  marketing_consent BOOLEAN DEFAULT FALSE,
  personalization_consent BOOLEAN DEFAULT FALSE,
  necessary_consent BOOLEAN DEFAULT TRUE, -- Always true for essential cookies
  preferences_updated DATETIME NOT NULL,
  preference_source TEXT NOT NULL -- 'banner', 'preference_center', 'api'
);

CREATE INDEX IF NOT EXISTS idx_cookie_preferences_user_id
  ON cookie_preferences(user_id);

-- Data Retention Policies Table
CREATE TABLE IF NOT EXISTS retention_policies (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  data_type TEXT NOT NULL UNIQUE,
  retention_period_days INTEGER NOT NULL,
  legal_basis TEXT NOT NULL,
  policy_name TEXT NOT NULL,
  description TEXT,
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
  updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
);

-- User Data Deletion Requests Table
CREATE TABLE IF NOT EXISTS deletion_requests (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  user_id TEXT NOT NULL,
  request_id TEXT UNIQUE NOT NULL,
  request_type TEXT NOT NULL, -- 'deletion', 'rectification', 'portability', 'access'
  status TEXT NOT NULL, -- 'pending', 'in_progress', 'completed', 'rejected'
  requested_at DATETIME NOT NULL,
  completed_at DATETIME,
  rejection_reason TEXT,
  ip_address TEXT,
  user_agent TEXT,
  processed_by TEXT, -- System or admin user
  processing_notes TEXT
);

CREATE INDEX IF NOT EXISTS idx_deletion_requests_user_id
  ON deletion_requests(user_id, requested_at DESC);

CREATE INDEX IF NOT EXISTS idx_deletion_requests_status
  ON deletion_requests(status, requested_at);

-- Consent Policy Versions Table
CREATE TABLE IF NOT EXISTS consent_policy_versions (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  version TEXT UNIQUE NOT NULL,
  policy_text TEXT NOT NULL,
  effective_date DATETIME NOT NULL,
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP
);

CREATE INDEX IF NOT EXISTS idx_consent_policy_version
  ON consent_policy_versions(version, effective_date DESC);
```

---

## 🔐 Consent Management System

### Consent Collection & Storage

```typescript
/**
 * Consent Manager
 * Manages user consent collection, storage, and tracking
 */
class ConsentManager {
  constructor(env) {
    this.db = env.DB;
    this.currentPolicyVersion = '1.0.0'; // Current consent policy version
  }

  /**
   * Grant consent for a specific data processing purpose
   * @param {string} userId - User ID
   * @param {string} consentType - Type of consent (marketing, analytics, personalization, essential)
   * @param {object} metadata - Metadata (IP, user-agent, source)
   * @returns {Promise<object>} Consent record
   */
  async grantConsent(userId, consentType, metadata = {}) {
    const consentId = this.generateConsentId();
    const now = new Date().toISOString();
    const expiresAt = this.calculateExpiration(consentType);

    // Check if consent already exists
    const existingConsent = await this.getConsent(userId, consentType);

    // Record previous state for audit trail
    const previousState = existingConsent ? {
      consent_given: existingConsent.consent_given,
      legal_basis: existingConsent.legal_basis,
      timestamp: existingConsent.timestamp
    } : null;

    // Create or update consent record
    const consentRecord = {
      consent_id: consentId,
      consent_type: consentType,
      consent_given: true,
      legal_basis: 'consent',
      timestamp: now,
      ip_address: metadata.ip_address || null,
      user_agent: metadata.user_agent || null,
      consent_version: this.currentPolicyVersion,
      source: metadata.source || 'explicit_action',
      expires_at: expiresAt
    };

    if (existingConsent) {
      // Update existing consent
      await this.db.prepare(`
        UPDATE consent_records
        SET consent_given = ?, timestamp = ?, ip_address = ?,
            user_agent = ?, consent_version = ?, source = ?, expires_at = ?
        WHERE user_id = ? AND consent_type = ?
      `).bind(
        true, now, metadata.ip_address, metadata.user_agent,
        this.currentPolicyVersion, metadata.source, expiresAt,
        userId, consentType
      ).run();
    } else {
      // Insert new consent
      await this.db.prepare(`
        INSERT INTO consent_records
        (user_id, consent_id, consent_type, consent_given, legal_basis,
         timestamp, ip_address, user_agent, consent_version, source, expires_at)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
      `).bind(
        userId, consentId, consentType, true, 'consent',
        now, metadata.ip_address, metadata.user_agent,
        this.currentPolicyVersion, metadata.source, expiresAt
      ).run();
    }

    // Record in consent history
    await this.recordConsentHistory(consentId, 'granted', previousState, consentRecord, metadata);

    // Update cookie preferences
    await this.updateCookiePreferences(userId, consentType, true, metadata.source);

    return consentRecord;
  }

  /**
   * Revoke consent for a specific data processing purpose
   * @param {string} userId - User ID
   * @param {string} consentType - Type of consent
   * @param {object} metadata - Metadata (IP, user-agent, reason)
   * @returns {Promise<object>} Consent record
   */
  async revokeConsent(userId, consentType, metadata = {}) {
    const now = new Date().toISOString();

    // Get current consent state
    const existingConsent = await this.getConsent(userId, consentType);

    if (!existingConsent) {
      throw new Error('No consent found to revoke');
    }

    const previousState = {
      consent_given: existingConsent.consent_given,
      legal_basis: existingConsent.legal_basis,
      timestamp: existingConsent.timestamp
    };

    // Update consent record
    await this.db.prepare(`
      UPDATE consent_records
      SET consent_given = ?, timestamp = ?, source = ?
      WHERE user_id = ? AND consent_type = ?
    `).bind(
      false, now, metadata.source || 'user_action',
      userId, consentType
    ).run();

    // Record in consent history
    await this.recordConsentHistory(
      existingConsent.consent_id,
      'revoked',
      previousState,
      { ...existingConsent, consent_given: false, timestamp: now },
      metadata
    );

    // Update cookie preferences
    await this.updateCookiePreferences(userId, consentType, false, metadata.source);

    // Trigger data deletion for affected data (if required)
    await this.handleConsentRevocation(userId, consentType);

    return { consent_id: existingConsent.consent_id, consent_given: false, timestamp: now };
  }

  /**
   * Get current consent for a user and consent type
   * @param {string} userId - User ID
   * @param {string} consentType - Type of consent
   * @returns {Promise<object|null>} Consent record or null
   */
  async getConsent(userId, consentType) {
    const result = await this.db.prepare(`
      SELECT * FROM consent_records
      WHERE user_id = ? AND consent_type = ?
      ORDER BY timestamp DESC
      LIMIT 1
    `).bind(userId, consentType).first();

    return result || null;
  }

  /**
   * Get all consents for a user
   * @param {string} userId - User ID
   * @returns {Promise<Array>} All consent records
   */
  async getAllConsents(userId) {
    const results = await this.db.prepare(`
      SELECT * FROM consent_records
      WHERE user_id = ?
      ORDER BY timestamp DESC
    `).bind(userId).all();

    return results;
  }

  /**
   * Check if user has valid consent for a specific purpose
   * @param {string} userId - User ID
   * @param {string} consentType - Type of consent
   * @returns {Promise<boolean>} True if consent is valid
   */
  async hasValidConsent(userId, consentType) {
    const consent = await this.getConsent(userId, consentType);

    if (!consent) {
      return false;
    }

    // Check if consent is still valid (not revoked and not expired)
    if (!consent.consent_given) {
      return false;
    }

    // Check expiration
    if (consent.expires_at && new Date(consent.expires_at) < new Date()) {
      return false;
    }

    return true;
  }

  /**
   * Update cookie preferences for a user
   * @param {string} userId - User ID
   * @param {string} consentType - Type of consent
   * @param {boolean} value - Consent value
   * @param {string} source - Source of preference change
   */
  async updateCookiePreferences(userId, consentType, value, source) {
    const now = new Date().toISOString();

    // Map consent types to cookie preference columns
    const consentTypeMap = {
      'marketing': 'marketing_consent',
      'analytics': 'analytics_consent',
      'personalization': 'personalization_consent',
      'essential': 'necessary_consent'
    };

    const column = consentTypeMap[consentType];
    if (!column) {
      return;
    }

    // Check if preferences exist
    const existing = await this.db.prepare(`
      SELECT * FROM cookie_preferences WHERE user_id = ?
    `).bind(userId).first();

    if (existing) {
      // Update existing preferences
      await this.db.prepare(`
        UPDATE cookie_preferences
        SET ${column} = ?, preferences_updated = ?, preference_source = ?
        WHERE user_id = ?
      `).bind(value, now, source, userId).run();
    } else {
      // Insert new preferences
      await this.db.prepare(`
        INSERT INTO cookie_preferences
        (user_id, session_id, analytics_consent, marketing_consent,
         personalization_consent, necessary_consent, preferences_updated, preference_source)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
      `).bind(
        userId, null,
        consentType === 'analytics' ? value : false,
        consentType === 'marketing' ? value : false,
        consentType === 'personalization' ? value : false,
        true, // necessary_consent is always true
        now, source
      ).run();
    }
  }

  /**
   * Get cookie preferences for a user
   * @param {string} userId - User ID
   * @returns {Promise<object>} Cookie preferences
   */
  async getCookiePreferences(userId) {
    const result = await this.db.prepare(`
      SELECT * FROM cookie_preferences WHERE user_id = ?
    `).bind(userId).first();

    return result || {
      analytics_consent: false,
      marketing_consent: false,
      personalization_consent: false,
      necessary_consent: true
    };
  }

  /**
   * Record consent history for audit trail
   * @param {string} consentId - Consent ID
   * @param {string} action - Action (granted, revoked, updated)
   * @param {object} previousState - Previous consent state
   * @param {object} newState - New consent state
   * @param {object} metadata - Metadata
   */
  async recordConsentHistory(consentId, action, previousState, newState, metadata) {
    await this.db.prepare(`
      INSERT INTO consent_history
      (consent_id, action, previous_state, new_state, timestamp, ip_address, user_agent, reason)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
    `).bind(
      consentId,
      action,
      JSON.stringify(previousState),
      JSON.stringify(newState),
      new Date().toISOString(),
      metadata.ip_address || null,
      metadata.user_agent || null,
      metadata.reason || null
    ).run();
  }

  /**
   * Calculate expiration date for consent
   * @param {string} consentType - Type of consent
   * @returns {string|null} ISO date string or null
   */
  calculateExpiration(consentType) {
    const expirationPeriods = {
      'marketing': 365 * 2, // 2 years
      'analytics': 365 * 1, // 1 year
      'personalization': 365 * 1, // 1 year
      'essential': null // No expiration
    };

    const days = expirationPeriods[consentType];
    if (!days) {
      return null;
    }

    const expiresAt = new Date();
    expiresAt.setDate(expiresAt.getDate() + days);
    return expiresAt.toISOString();
  }

  /**
   * Generate unique consent ID
   * @returns {string} Consent ID
   */
  generateConsentId() {
    return `consent_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
  }

  /**
   * Handle consent revocation (trigger data deletion if required)
   * @param {string} userId - User ID
   * @param {string} consentType - Type of consent revoked
   */
  async handleConsentRevocation(userId, consentType) {
    // For marketing consent revocation, remove PII from marketing databases
    if (consentType === 'marketing') {
      // Remove user from marketing campaigns
      await this.removeFromMarketingLists(userId);
    }

    // For analytics consent revocation, anonymize analytics data
    if (consentType === 'analytics') {
      // Anonymize user analytics data
      await this.anonymizeAnalyticsData(userId);
    }
  }

  /**
   * Remove user from marketing lists
   * @param {string} userId - User ID
   */
  async removeFromMarketingLists(userId) {
    // Update user journeys to mark for marketing exclusion
    await this.db.prepare(`
      UPDATE user_journeys
      SET marketing_consent = false
      WHERE user_id = ?
    `).bind(userId).run();
  }

  /**
   * Anonymize analytics data for user
   * @param {string} userId - User ID
   */
  async anonymizeAnalyticsData(userId) {
    // Anonymize user_id in user_journeys (replace with hash)
    const anonymizedId = `anon_${crypto.randomUUID()}`;

    await this.db.prepare(`
      UPDATE user_journeys
      SET user_id = ?, anonymized = true
      WHERE user_id = ?
    `).bind(anonymizedId, userId).run();
  }
}

// Global consent manager instance
let consentManager = null;
```

---

## 👤 Data Rights Management

### GDPR/LGPD/CCPA Data Rights Implementation

```typescript
/**
 * Data Rights Manager
 * Handles GDPR/LGPD/CCPA data rights: access, deletion, portability, rectification
 */
class DataRightsManager {
  constructor(env) {
    this.db = env.DB;
    this.complianceConfig = {
      gdpr: {
        accessResponseTime: 30, // days
        deletionResponseTime: 30, // days
        portabilityResponseTime: 30 // days
      },
      lgpd: {
        accessResponseTime: 15, // days
        deletionResponseTime: 15, // days
        portabilityResponseTime: 15 // days
      },
      ccpa: {
        accessResponseTime: 45, // days
        deletionResponseTime: 45, // days
        optOutResponseTime: 10 // days
      }
    };
  }

  /**
   * Submit data access request (GDPR Art. 15, LGPD Art. 18, CCPA)
   * @param {string} userId - User ID
   * @param {object} metadata - Request metadata
   * @returns {Promise<string>} Request ID
   */
  async submitAccessRequest(userId, metadata = {}) {
    const requestId = this.generateRequestId('access');

    await this.db.prepare(`
      INSERT INTO deletion_requests
      (user_id, request_id, request_type, status, requested_at, ip_address, user_agent)
      VALUES (?, ?, 'access', 'pending', ?, ?, ?)
    `).bind(
      userId,
      requestId,
      new Date().toISOString(),
      metadata.ip_address || null,
      metadata.user_agent || null
    ).run();

    return requestId;
  }

  /**
   * Process data access request
   * @param {string} requestId - Request ID
   * @returns {Promise<object>} User data package
   */
  async processAccessRequest(requestId) {
    const request = await this.db.prepare(`
      SELECT * FROM deletion_requests WHERE request_id = ?
    `).bind(requestId).first();

    if (!request) {
      throw new Error('Request not found');
    }

    if (request.status !== 'pending') {
      throw new Error('Request already processed');
    }

    // Update status to in_progress
    await this.db.prepare(`
      UPDATE deletion_requests SET status = 'in_progress' WHERE request_id = ?
    `).bind(requestId).run();

    // Collect all user data
    const userData = await this.collectUserData(request.user_id);

    // Update status to completed
    await this.db.prepare(`
      UPDATE deletion_requests
      SET status = 'completed', completed_at = ?, processed_by = 'system'
      WHERE request_id = ?
    `).bind(new Date().toISOString(), requestId).run();

    return {
      request_id: requestId,
      user_id: request.user_id,
      data_collected_at: new Date().toISOString(),
      data: userData
    };
  }

  /**
   * Submit data deletion request (GDPR Art. 17, LGPD Art. 18, CCPA)
   * @param {string} userId - User ID
   * @param {string} reason - Reason for deletion (optional)
   * @param {object} metadata - Request metadata
   * @returns {Promise<string>} Request ID
   */
  async submitDeletionRequest(userId, reason = '', metadata = {}) {
    const requestId = this.generateRequestId('deletion');

    await this.db.prepare(`
      INSERT INTO deletion_requests
      (user_id, request_id, request_type, status, requested_at,
       ip_address, user_agent, processing_notes)
      VALUES (?, ?, 'deletion', 'pending', ?, ?, ?, ?)
    `).bind(
      userId,
      requestId,
      new Date().toISOString(),
      metadata.ip_address || null,
      metadata.user_agent || null,
      reason
    ).run();

    return requestId;
  }

  /**
   * Process data deletion request
   * @param {string} requestId - Request ID
   * @returns {Promise<object>} Deletion result
   */
  async processDeletionRequest(requestId) {
    const request = await this.db.prepare(`
      SELECT * FROM deletion_requests WHERE request_id = ?
    `).bind(requestId).first();

    if (!request) {
      throw new Error('Request not found');
    }

    if (request.status !== 'pending') {
      throw new Error('Request already processed');
    }

    // Update status to in_progress
    await this.db.prepare(`
      UPDATE deletion_requests SET status = 'in_progress' WHERE request_id = ?
    `).bind(requestId).run();

    // Perform deletion
    const deletionResult = await this.deleteUserData(request.user_id);

    // Update status to completed
    await this.db.prepare(`
      UPDATE deletion_requests
      SET status = 'completed', completed_at = ?, processed_by = 'system',
          processing_notes = ?
      WHERE request_id = ?
    `).bind(
      new Date().toISOString(),
      JSON.stringify(deletionResult),
      requestId
    ).run();

    return {
      request_id: requestId,
      user_id: request.user_id,
      deleted_at: new Date().toISOString(),
      deletion_summary: deletionResult
    };
  }

  /**
   * Submit data portability request (GDPR Art. 20, LGPD Art. 18)
   * @param {string} userId - User ID
   * @param {object} metadata - Request metadata
   * @returns {Promise<string>} Request ID
   */
  async submitPortabilityRequest(userId, metadata = {}) {
    const requestId = this.generateRequestId('portability');

    await this.db.prepare(`
      INSERT INTO deletion_requests
      (user_id, request_id, request_type, status, requested_at, ip_address, user_agent)
      VALUES (?, ?, 'portability', 'pending', ?, ?, ?)
    `).bind(
      userId,
      requestId,
      new Date().toISOString(),
      metadata.ip_address || null,
      metadata.user_agent || null
    ).run();

    return requestId;
  }

  /**
   * Process data portability request
   * @param {string} requestId - Request ID
   * @param {string} format - Export format (json, csv)
   * @returns {Promise<object>} Portable data package
   */
  async processPortabilityRequest(requestId, format = 'json') {
    const request = await this.db.prepare(`
      SELECT * FROM deletion_requests WHERE request_id = ?
    `).bind(requestId).first();

    if (!request) {
      throw new Error('Request not found');
    }

    if (request.status !== 'pending') {
      throw new Error('Request already processed');
    }

    // Update status to in_progress
    await this.db.prepare(`
      UPDATE deletion_requests SET status = 'in_progress' WHERE request_id = ?
    `).bind(requestId).run();

    // Collect and format user data
    const userData = await this.collectUserData(request.user_id);
    const portableData = await this.formatPortableData(userData, format);

    // Update status to completed
    await this.db.prepare(`
      UPDATE deletion_requests
      SET status = 'completed', completed_at = ?, processed_by = 'system'
      WHERE request_id = ?
    `).bind(new Date().toISOString(), requestId).run();

    return {
      request_id: requestId,
      user_id: request.user_id,
      exported_at: new Date().toISOString(),
      format: format,
      data: portableData
    };
  }

  /**
   * Submit data rectification request (GDPR Art. 16, LGPD Art. 18)
   * @param {string} userId - User ID
   * @param {object} corrections - Data corrections
   * @param {object} metadata - Request metadata
   * @returns {Promise<string>} Request ID
   */
  async submitRectificationRequest(userId, corrections, metadata = {}) {
    const requestId = this.generateRequestId('rectification');

    await this.db.prepare(`
      INSERT INTO deletion_requests
      (user_id, request_id, request_type, status, requested_at,
       ip_address, user_agent, processing_notes)
      VALUES (?, ?, 'rectification', 'pending', ?, ?, ?)
    `).bind(
      userId,
      requestId,
      new Date().toISOString(),
      metadata.ip_address || null,
      metadata.user_agent || null,
      JSON.stringify(corrections)
    ).run();

    return requestId;
  }

  /**
   * Process data rectification request
   * @param {string} requestId - Request ID
   * @returns {Promise<object>} Rectification result
   */
  async processRectificationRequest(requestId) {
    const request = await this.db.prepare(`
      SELECT * FROM deletion_requests WHERE request_id = ?
    `).bind(requestId).first();

    if (!request) {
      throw new Error('Request not found');
    }

    if (request.status !== 'pending') {
      throw new Error('Request already processed');
    }

    const corrections = JSON.parse(request.processing_notes || '{}');

    // Update status to in_progress
    await this.db.prepare(`
      UPDATE deletion_requests SET status = 'in_progress' WHERE request_id = ?
    `).bind(requestId).run();

    // Apply corrections
    const rectificationResult = await this.applyDataCorrections(request.user_id, corrections);

    // Update status to completed
    await this.db.prepare(`
      UPDATE deletion_requests
      SET status = 'completed', completed_at = ?, processed_by = 'system',
          processing_notes = ?
      WHERE request_id = ?
    `).bind(
      new Date().toISOString(),
      JSON.stringify(rectificationResult),
      requestId
    ).run();

    return {
      request_id: requestId,
      user_id: request.user_id,
      corrected_at: new Date().toISOString(),
      corrections_applied: rectificationResult
    };
  }

  /**
   * Collect all user data from the system
   * @param {string} userId - User ID
   * @returns {Promise<object>} All user data
   */
  async collectUserData(userId) {
    return {
      user_profile: await this.getUserProfile(userId),
      consent_records: await this.getUserConsents(userId),
      cookie_preferences: await this.getUserCookiePreferences(userId),
      user_journeys: await this.getUserJourneys(userId),
      attribution_data: await this.getUserAttributionData(userId),
      security_data: await this.getUserSecurityData(userId)
    };
  }

  /**
   * Get user profile data
   * @param {string} userId - User ID
   * @returns {Promise<Array>} User profile data
   */
  async getUserProfile(userId) {
    const results = await this.db.prepare(`
      SELECT * FROM user_profiles WHERE user_id = ?
    `).bind(userId).all();

    return results;
  }

  /**
   * Get user consent records
   * @param {string} userId - User ID
   * @returns {Promise<Array>} Consent records
   */
  async getUserConsents(userId) {
    const results = await this.db.prepare(`
      SELECT * FROM consent_records WHERE user_id = ?
    `).bind(userId).all();

    return results;
  }

  /**
   * Get user cookie preferences
   * @param {string} userId - User ID
   * @returns {Promise<object>} Cookie preferences
   */
  async getUserCookiePreferences(userId) {
    const result = await this.db.prepare(`
      SELECT * FROM cookie_preferences WHERE user_id = ?
    `).bind(userId).first();

    return result || {};
  }

  /**
   * Get user journey data
   * @param {string} userId - User ID
   * @returns {Promise<Array>} User journeys
   */
  async getUserJourneys(userId) {
    const results = await this.db.prepare(`
      SELECT * FROM user_journeys WHERE user_id = ?
    `).bind(userId).all();

    return results;
  }

  /**
   * Get user attribution data
   * @param {string} userId - User ID
   * @returns {Promise<Array>} Attribution data
   */
  async getUserAttributionData(userId) {
    const results = await this.db.prepare(`
      SELECT a.* FROM multi_touch_attribution a
      INNER JOIN user_journeys j ON a.conversion_id = j.conversion_id
      WHERE j.user_id = ?
    `).bind(userId).all();

    return results;
  }

  /**
   * Get user security data (excluding sensitive data)
   * @param {string} userId - User ID
   * @returns {Promise<Array>} Security data
   */
  async getUserSecurityData(userId) {
    // Return only non-sensitive security data
    const results = await this.db.prepare(`
      SELECT id, timestamp, log_type, action, blocked
      FROM audit_logs
      WHERE user_id = ?
    `).bind(userId).all();

    return results;
  }

  /**
   * Delete all user data from the system
   * @param {string} userId - User ID
   * @returns {Promise<object>} Deletion summary
   */
  async deleteUserData(userId) {
    const deletionSummary = {
      tables: {},
      deleted_at: new Date().toISOString()
    };

    // Delete from consent_records
    const consentResult = await this.db.prepare(`
      DELETE FROM consent_records WHERE user_id = ?
    `).bind(userId).run();
    deletionSummary.tables.consent_records = consentResult.meta.changes;

    // Delete from cookie_preferences
    const cookieResult = await this.db.prepare(`
      DELETE FROM cookie_preferences WHERE user_id = ?
    `).bind(userId).run();
    deletionSummary.tables.cookie_preferences = cookieResult.meta.changes;

    // Delete from user_journeys
    const journeyResult = await this.db.prepare(`
      DELETE FROM user_journeys WHERE user_id = ?
    `).bind(userId).run();
    deletionSummary.tables.user_journeys = journeyResult.meta.changes;

    // Delete from multi_touch_attribution (via user_journeys conversion_id)
    // This is handled by cascade delete in user_journeys

    // Delete from user_profiles
    const profileResult = await this.db.prepare(`
      DELETE FROM user_profiles WHERE user_id = ?
    `).bind(userId).run();
    deletionSummary.tables.user_profiles = profileResult.meta.changes;

    // Delete from ip_violations (if any)
    const violationsResult = await this.db.prepare(`
      DELETE FROM ip_violations WHERE user_id = ?
    `).bind(userId).run();
    deletionSummary.tables.ip_violations = violationsResult.meta.changes;

    return deletionSummary;
  }

  /**
   * Apply data corrections
   * @param {string} userId - User ID
   * @param {object} corrections - Data corrections
   * @returns {Promise<object>} Rectification summary
   */
  async applyDataCorrections(userId, corrections) {
    const rectificationSummary = {
      corrections: [],
      corrected_at: new Date().toISOString()
    };

    // Apply corrections to user_profiles
    if (corrections.user_profile) {
      const profileUpdates = corrections.user_profile;
      const setClauses = Object.keys(profileUpdates).map(key => `${key} = ?`).join(', ');
      const values = Object.values(profileUpdates);

      await this.db.prepare(`
        UPDATE user_profiles
        SET ${setClauses}
        WHERE user_id = ?
      `).bind(...values, userId).run();

      rectificationSummary.corrections.push({
        table: 'user_profiles',
        fields: Object.keys(profileUpdates)
      });
    }

    return rectificationSummary;
  }

  /**
   * Format portable data in specified format
   * @param {object} userData - User data
   * @param {string} format - Export format
   * @returns {Promise<string>} Formatted data
   */
  async formatPortableData(userData, format) {
    if (format === 'json') {
      return JSON.stringify(userData, null, 2);
    } else if (format === 'csv') {
      return await this.convertToCSV(userData);
    }

    return JSON.stringify(userData, null, 2);
  }

  /**
   * Convert user data to CSV format
   * @param {object} userData - User data
   * @returns {Promise<string>} CSV data
   */
  async convertToCSV(userData) {
    // Flatten data and convert to CSV
    // This is a simplified implementation
    const rows = [];

    for (const [table, data] of Object.entries(userData)) {
      if (Array.isArray(data) && data.length > 0) {
        const headers = Object.keys(data[0]).join(',');
        const values = data.map(row =>
          Object.values(row).map(val =>
            typeof val === 'string' ? `"${val}"` : val
          ).join(',')
        ).join('\n');

        rows.push(`\n### ${table} ###\n`);
        rows.push(headers);
        rows.push(values);
      }
    }

    return rows.join('\n');
  }

  /**
   * Generate unique request ID
   * @param {string} type - Request type
   * @returns {string} Request ID
   */
  generateRequestId(type) {
    return `${type}_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
  }
}

// Global data rights manager instance
let dataRightsManager = null;
```

---

## ⏱️ Data Retention Management

### Automated Data Retention Policies

```typescript
/**
 * Data Retention Manager
 * Manages automated data retention and deletion policies
 */
class DataRetentionManager {
  constructor(env) {
    this.db = env.DB;
    this.defaultRetentionPolicies = [
      {
        data_type: 'user_journeys',
        retention_period_days: 365 * 2, // 2 years
        legal_basis: 'legitimate_interest',
        policy_name: 'User Journey Retention',
        description: 'Retain user journey data for 2 years for attribution and analytics'
      },
      {
        data_type: 'consent_records',
        retention_period_days: 365 * 3, // 3 years
        legal_basis: 'legal_obligation',
        policy_name: 'Consent Record Retention',
        description: 'Retain consent records for 3 years for compliance audit'
      },
      {
        data_type: 'audit_logs',
        retention_period_days: 365 * 5, // 5 years
        legal_basis: 'legal_obligation',
        policy_name: 'Audit Log Retention',
        description: 'Retain audit logs for 5 years for security compliance'
      },
      {
        data_type: 'cookie_preferences',
        retention_period_days: 365 * 2, // 2 years
        legal_basis: 'consent',
        policy_name: 'Cookie Preferences Retention',
        description: 'Retain cookie preferences for 2 years'
      },
      {
        data_type: 'ip_violations',
        retention_period_days: 90, // 90 days
        legal_basis: 'legitimate_interest',
        policy_name: 'IP Violations Retention',
        description: 'Retain IP violation records for 90 days for security purposes'
      }
    ];
  }

  /**
   * Initialize default retention policies
   */
  async initializePolicies() {
    for (const policy of this.defaultRetentionPolicies) {
      await this.db.prepare(`
        INSERT OR IGNORE INTO retention_policies
        (data_type, retention_period_days, legal_basis, policy_name, description)
        VALUES (?, ?, ?, ?, ?)
      `).bind(
        policy.data_type,
        policy.retention_period_days,
        policy.legal_basis,
        policy.policy_name,
        policy.description
      ).run();
    }
  }

  /**
   * Execute data retention cleanup (run daily)
   * @returns {Promise<object>} Cleanup summary
   */
  async executeRetentionCleanup() {
    const cleanupSummary = {
      timestamp: new Date().toISOString(),
      policies_executed: [],
      total_records_deleted: 0,
      tables_cleaned: []
    };

    // Get all active retention policies
    const policies = await this.db.prepare(`
      SELECT * FROM retention_policies
    `).all();

    for (const policy of policies) {
      const deletionResult = await this.executePolicy(policy);
      cleanupSummary.policies_executed.push({
        policy_name: policy.policy_name,
        data_type: policy.data_type,
        records_deleted: deletionResult.deleted_count
      });
      cleanupSummary.total_records_deleted += deletionResult.deleted_count;

      if (!cleanupSummary.tables_cleaned.includes(policy.data_type)) {
        cleanupSummary.tables_cleaned.push(policy.data_type);
      }
    }

    return cleanupSummary;
  }

  /**
   * Execute a single retention policy
   * @param {object} policy - Retention policy
   * @returns {Promise<object>} Deletion result
   */
  async executePolicy(policy) {
    const cutoffDate = new Date();
    cutoffDate.setDate(cutoffDate.getDate() - policy.retention_period_days);
    const cutoffISO = cutoffDate.toISOString();

    let deletedCount = 0;

    switch (policy.data_type) {
      case 'user_journeys':
        deletedCount = await this.deleteOldUserJourneys(cutoffISO);
        break;

      case 'consent_records':
        deletedCount = await this.deleteOldConsentRecords(cutoffISO);
        break;

      case 'audit_logs':
        deletedCount = await this.deleteOldAuditLogs(cutoffISO);
        break;

      case 'cookie_preferences':
        deletedCount = await this.deleteOldCookiePreferences(cutoffISO);
        break;

      case 'ip_violations':
        deletedCount = await this.deleteOldIPViolations(cutoffISO);
        break;

      default:
        console.warn(`Unknown data type in retention policy: ${policy.data_type}`);
    }

    return {
      data_type: policy.data_type,
      cutoff_date: cutoffISO,
      deleted_count: deletedCount
    };
  }

  /**
   * Delete old user journeys
   * @param {string} cutoffDate - Cutoff date ISO string
   * @returns {Promise<number>} Number of deleted records
   */
  async deleteOldUserJourneys(cutoffDate) {
    const result = await this.db.prepare(`
      DELETE FROM user_journeys
      WHERE created_at < ? AND archived = 0
    `).bind(cutoffDate).run();

    return result.meta.changes || 0;
  }

  /**
   * Delete old consent records (keep only consent history)
   * @param {string} cutoffDate - Cutoff date ISO string
   * @returns {Promise<number>} Number of deleted records
   */
  async deleteOldConsentRecords(cutoffDate) {
    // Only delete old consent_records, keep consent_history
    const result = await this.db.prepare(`
      DELETE FROM consent_records
      WHERE timestamp < ? AND consent_given = false
    `).bind(cutoffDate).run();

    return result.meta.changes || 0;
  }

  /**
   * Delete old audit logs
   * @param {string} cutoffDate - Cutoff date ISO string
   * @returns {Promise<number>} Number of deleted records
   */
  async deleteOldAuditLogs(cutoffDate) {
    const result = await this.db.prepare(`
      DELETE FROM audit_logs
      WHERE timestamp < ? AND severity != 'CRITICAL'
    `).bind(cutoffDate).run();

    return result.meta.changes || 0;
  }

  /**
   * Delete old cookie preferences
   * @param {string} cutoffDate - Cutoff date ISO string
   * @returns {Promise<number>} Number of deleted records
   */
  async deleteOldCookiePreferences(cutoffDate) {
    const result = await this.db.prepare(`
      DELETE FROM cookie_preferences
      WHERE preferences_updated < ?
    `).bind(cutoffDate).run();

    return result.meta.changes || 0;
  }

  /**
   * Delete old IP violation records
   * @param {string} cutoffDate - Cutoff date ISO string
   * @returns {Promise<number>} Number of deleted records
   */
  async deleteOldIPViolations(cutoffDate) {
    const result = await this.db.prepare(`
      DELETE FROM ip_violations
      WHERE timestamp < ?
    `).bind(cutoffDate).run();

    return result.meta.changes || 0;
  }

  /**
   * Get retention policy statistics
   * @returns {Promise<object>} Retention statistics
   */
  async getRetentionStats() {
    const policies = await this.db.prepare(`
      SELECT * FROM retention_policies
    `).all();

    const stats = {
      policies: policies.length,
      data_types: {},
      total_retention_days: 0
    };

    for (const policy of policies) {
      stats.data_types[policy.data_type] = policy.retention_period_days;
      stats.total_retention_days += policy.retention_period_days;
    }

    // Count records in each table
    stats.record_counts = {
      user_journeys: await this.countRecords('user_journeys'),
      consent_records: await this.countRecords('consent_records'),
      audit_logs: await this.countRecords('audit_logs'),
      cookie_preferences: await this.countRecords('cookie_preferences'),
      ip_violations: await this.countRecords('ip_violations')
    };

    return stats;
  }

  /**
   * Count records in a table
   * @param {string} tableName - Table name
   * @returns {Promise<number>} Record count
   */
  async countRecords(tableName) {
    const result = await this.db.prepare(`
      SELECT COUNT(*) as count FROM ${tableName}
    `).first();

    return result ? result.count : 0;
  }
}

// Global data retention manager instance
let dataRetentionManager = null;
```

---

## 🎯 Compliance Audit Trail

### Comprehensive Audit Logging

```typescript
/**
 * Compliance Audit Logger
 * Records all compliance-related activities for audit purposes
 */
class ComplianceAuditLogger {
  constructor(env) {
    this.db = env.DB;
  }

  /**
   * Log compliance activity
   * @param {string} userId - User ID (optional)
   * @param {string} action - Action performed
   * @param {string} category - Category (consent, data_rights, retention, etc.)
   * @param {object} details - Action details
   * @param {object} metadata - Metadata (IP, user-agent)
   */
  async logActivity(userId, action, category, details, metadata = {}) {
    await this.db.prepare(`
      INSERT INTO audit_logs
      (timestamp, user_id, log_type, action, details, ip_address, user_agent)
      VALUES (?, ?, ?, ?, ?, ?, ?)
    `).bind(
      new Date().toISOString(),
      userId || null,
      category,
      action,
      JSON.stringify(details),
      metadata.ip_address || null,
      metadata.user_agent || null
    ).run();
  }

  /**
   * Log consent activity
   * @param {string} userId - User ID
   * @param {string} action - Action (granted, revoked, updated)
   * @param {string} consentType - Consent type
   * @param {object} details - Additional details
   * @param {object} metadata - Metadata
   */
  async logConsentActivity(userId, action, consentType, details, metadata) {
    await this.logActivity(
      userId,
      `consent_${action}`,
      'consent',
      {
        consent_type: consentType,
        ...details
      },
      metadata
    );
  }

  /**
   * Log data rights activity
   * @param {string} userId - User ID
   * @param {string} action - Action (access, deletion, portability, rectification)
   * @param {string} requestId - Request ID
   * @param {object} details - Additional details
   * @param {object} metadata - Metadata
   */
  async logDataRightsActivity(userId, action, requestId, details, metadata) {
    await this.logActivity(
      userId,
      `data_rights_${action}`,
      'data_rights',
      {
        request_id: requestId,
        action_type: action,
        ...details
      },
      metadata
    );
  }

  /**
   * Log retention activity
   * @param {string} action - Action (cleanup, policy_update)
   * @param {object} details - Policy details
   */
  async logRetentionActivity(action, details) {
    await this.logActivity(
      null,
      `retention_${action}`,
      'retention',
      details,
      {}
    );
  }

  /**
   * Get audit logs for a user
   * @param {string} userId - User ID
   * @param {number} limit - Limit results
   * @returns {Promise<Array>} Audit logs
   */
  async getUserAuditLogs(userId, limit = 100) {
    const results = await this.db.prepare(`
      SELECT * FROM audit_logs
      WHERE user_id = ?
      ORDER BY timestamp DESC
      LIMIT ?
    `).bind(userId, limit).all();

    return results;
  }

  /**
   * Get audit logs by category
   * @param {string} category - Log category
   * @param {number} limit - Limit results
   * @returns {Promise<Array>} Audit logs
   */
  async getAuditLogsByCategory(category, limit = 100) {
    const results = await this.db.prepare(`
      SELECT * FROM audit_logs
      WHERE log_type = ?
      ORDER BY timestamp DESC
      LIMIT ?
    `).bind(category, limit).all();

    return results;
  }

  /**
   * Get recent audit logs
   * @param {number} limit - Limit results
   * @returns {Promise<Array>} Recent audit logs
   */
  async getRecentAuditLogs(limit = 50) {
    const results = await this.db.prepare(`
      SELECT * FROM audit_logs
      ORDER BY timestamp DESC
      LIMIT ?
    `).bind(limit).all();

    return results;
  }
}

// Global compliance audit logger instance
let complianceAuditLogger = null;
```

---

## 🔗 Worker API Endpoints

### Compliance Management Endpoints

```typescript
/**
 * Compliance Management Endpoints
 */
export default {
  async fetch(request, env, ctx) {
    // Initialize components
    if (!consentManager) consentManager = new ConsentManager(env);
    if (!dataRightsManager) dataRightsManager = new DataRightsManager(env);
    if (!dataRetentionManager) {
      dataRetentionManager = new DataRetentionManager(env);
      await dataRetentionManager.initializePolicies();
    }
    if (!complianceAuditLogger) complianceAuditLogger = new ComplianceAuditLogger(env);

    const url = new URL(request.url);
    const path = url.pathname;
    const method = request.method;

    // Consent management endpoints
    if (path === '/api/compliance/consent/grant' && method === 'POST') {
      return handleGrantConsent(request, env);
    }

    if (path === '/api/compliance/consent/revoke' && method === 'POST') {
      return handleRevokeConsent(request, env);
    }

    if (path === '/api/compliance/consent/check' && method === 'GET') {
      return handleCheckConsent(request, env);
    }

    if (path === '/api/compliance/consent/preferences' && method === 'GET') {
      return handleGetCookiePreferences(request, env);
    }

    if (path === '/api/compliance/consent/preferences' && method === 'POST') {
      return handleUpdateCookiePreferences(request, env);
    }

    // Data rights endpoints
    if (path === '/api/compliance/data-rights/access' && method === 'POST') {
      return handleSubmitAccessRequest(request, env);
    }

    if (path === '/api/compliance/data-rights/deletion' && method === 'POST') {
      return handleSubmitDeletionRequest(request, env);
    }

    if (path === '/api/compliance/data-rights/portability' && method === 'POST') {
      return handleSubmitPortabilityRequest(request, env);
    }

    if (path === '/api/compliance/data-rights/rectification' && method === 'POST') {
      return handleSubmitRectificationRequest(request, env);
    }

    if (path === '/api/compliance/data-rights/request' && method === 'GET') {
      return handleGetDataRightsRequest(request, env);
    }

    if (path === '/api/compliance/data-rights/process' && method === 'POST') {
      return handleProcessDataRightsRequest(request, env);
    }

    // Retention management endpoints
    if (path === '/api/compliance/retention/cleanup' && method === 'POST') {
      return handleRetentionCleanup(request, env);
    }

    if (path === '/api/compliance/retention/stats' && method === 'GET') {
      return handleRetentionStats(request, env);
    }

    // Audit endpoints
    if (path === '/api/compliance/audit/user' && method === 'GET') {
      return handleGetUserAuditLogs(request, env);
    }

    if (path === '/api/compliance/audit/recent' && method === 'GET') {
      return handleGetRecentAuditLogs(request, env);
    }

    // Policy endpoints
    if (path === '/api/compliance/policy/current' && method === 'GET') {
      return handleGetCurrentPolicy(request, env);
    }

    return new Response('Not Found', { status: 404 });
  }
};

/**
 * Handle /api/compliance/consent/grant
 */
async function handleGrantConsent(request, env) {
  try {
    const body = await request.json();
    const { user_id, consent_type } = body;

    if (!user_id || !consent_type) {
      return new Response(JSON.stringify({
        success: false,
        error: 'Missing required fields: user_id, consent_type'
      }), {
        status: 400,
        headers: { 'Content-Type': 'application/json' }
      });
    }

    const metadata = {
      ip_address: request.headers.get('CF-Connecting-IP'),
      user_agent: request.headers.get('User-Agent'),
      source: body.source || 'api'
    };

    const consent = await consentManager.grantConsent(user_id, consent_type, metadata);

    await complianceAuditLogger.logConsentActivity(
      user_id,
      'granted',
      consent_type,
      { consent_id: consent.consent_id },
      metadata
    );

    return new Response(JSON.stringify({
      success: true,
      data: consent
    }), {
      headers: { 'Content-Type': 'application/json' }
    });
  } catch (error) {
    return new Response(JSON.stringify({
      success: false,
      error: error.message
    }), {
      status: 500,
      headers: { 'Content-Type': 'application/json' }
    });
  }
}

/**
 * Handle /api/compliance/consent/revoke
 */
async function handleRevokeConsent(request, env) {
  try {
    const body = await request.json();
    const { user_id, consent_type } = body;

    if (!user_id || !consent_type) {
      return new Response(JSON.stringify({
        success: false,
        error: 'Missing required fields: user_id, consent_type'
      }), {
        status: 400,
        headers: { 'Content-Type': 'application/json' }
      });
    }

    const metadata = {
      ip_address: request.headers.get('CF-Connecting-IP'),
      user_agent: request.headers.get('User-Agent'),
      source: body.source || 'api'
    };

    const consent = await consentManager.revokeConsent(user_id, consent_type, metadata);

    await complianceAuditLogger.logConsentActivity(
      user_id,
      'revoked',
      consent_type,
      { consent_id: consent.consent_id },
      metadata
    );

    return new Response(JSON.stringify({
      success: true,
      data: consent
    }), {
      headers: { 'Content-Type': 'application/json' }
    });
  } catch (error) {
    return new Response(JSON.stringify({
      success: false,
      error: error.message
    }), {
      status: 500,
      headers: { 'Content-Type': 'application/json' }
    });
  }
}

/**
 * Handle /api/compliance/consent/check
 */
async function handleCheckConsent(request, env) {
  const url = new URL(request.url);
  const user_id = url.searchParams.get('user_id');
  const consent_type = url.searchParams.get('consent_type');

  if (!user_id || !consent_type) {
    return new Response(JSON.stringify({
      success: false,
      error: 'Missing required parameters: user_id, consent_type'
    }), {
      status: 400,
      headers: { 'Content-Type': 'application/json' }
    });
  }

  const hasConsent = await consentManager.hasValidConsent(user_id, consent_type);

  return new Response(JSON.stringify({
    success: true,
    data: {
      user_id,
      consent_type,
      has_valid_consent: hasConsent
    }
  }), {
    headers: { 'Content-Type': 'application/json' }
  });
}

/**
 * Handle /api/compliance/data-rights/deletion
 */
async function handleSubmitDeletionRequest(request, env) {
  try {
    const body = await request.json();
    const { user_id, reason } = body;

    if (!user_id) {
      return new Response(JSON.stringify({
        success: false,
        error: 'Missing required field: user_id'
      }), {
        status: 400,
        headers: { 'Content-Type': 'application/json' }
      });
    }

    const metadata = {
      ip_address: request.headers.get('CF-Connecting-IP'),
      user_agent: request.headers.get('User-Agent')
    };

    const requestId = await dataRightsManager.submitDeletionRequest(user_id, reason, metadata);

    await complianceAuditLogger.logDataRightsActivity(
      user_id,
      'deletion',
      requestId,
      { reason },
      metadata
    );

    return new Response(JSON.stringify({
      success: true,
      data: {
        request_id: requestId,
        status: 'pending',
        message: 'Deletion request submitted. Processing will begin shortly.'
      }
    }), {
      headers: { 'Content-Type': 'application/json' }
    });
  } catch (error) {
    return new Response(JSON.stringify({
      success: false,
      error: error.message
    }), {
      status: 500,
      headers: { 'Content-Type': 'application/json' }
    });
  }
}

/**
 * Handle /api/compliance/data-rights/process
 */
async function handleProcessDataRightsRequest(request, env) {
  try {
    const body = await request.json();
    const { request_id, format } = body;

    if (!request_id) {
      return new Response(JSON.stringify({
        success: false,
        error: 'Missing required field: request_id'
      }), {
        status: 400,
        headers: { 'Content-Type': 'application/json' }
      });
    }

    // Get request details
    const requestDetails = await env.DB.prepare(`
      SELECT * FROM deletion_requests WHERE request_id = ?
    `).bind(request_id).first();

    if (!requestDetails) {
      return new Response(JSON.stringify({
        success: false,
        error: 'Request not found'
      }), {
        status: 404,
        headers: { 'Content-Type': 'application/json' }
      });
    }

    let result;
    switch (requestDetails.request_type) {
      case 'access':
        result = await dataRightsManager.processAccessRequest(request_id);
        break;
      case 'deletion':
        result = await dataRightsManager.processDeletionRequest(request_id);
        break;
      case 'portability':
        result = await dataRightsManager.processPortabilityRequest(request_id, format);
        break;
      case 'rectification':
        result = await dataRightsManager.processRectificationRequest(request_id);
        break;
      default:
        return new Response(JSON.stringify({
          success: false,
          error: 'Unknown request type'
        }), {
          status: 400,
          headers: { 'Content-Type': 'application/json' }
        });
    }

    return new Response(JSON.stringify({
      success: true,
      data: result
    }), {
      headers: { 'Content-Type': 'application/json' }
    });
  } catch (error) {
    return new Response(JSON.stringify({
      success: false,
      error: error.message
    }), {
      status: 500,
      headers: { 'Content-Type': 'application/json' }
    });
  }
}

/**
 * Handle /api/compliance/retention/cleanup
 */
async function handleRetentionCleanup(request, env) {
  try {
    const result = await dataRetentionManager.executeRetentionCleanup();

    await complianceAuditLogger.logRetentionActivity(
      'cleanup',
      {
        total_records_deleted: result.total_records_deleted,
        tables_cleaned: result.tables_cleaned
      }
    );

    return new Response(JSON.stringify({
      success: true,
      data: result
    }), {
      headers: { 'Content-Type': 'application/json' }
    });
  } catch (error) {
    return new Response(JSON.stringify({
      success: false,
      error: error.message
    }), {
      status: 500,
      headers: { 'Content-Type': 'application/json' }
    });
  }
}

/**
 * Handle /api/compliance/retention/stats
 */
async function handleRetentionStats(request, env) {
  const stats = await dataRetentionManager.getRetentionStats();

  return new Response(JSON.stringify({
    success: true,
    data: stats
  }), {
    headers: { 'Content-Type': 'application/json' }
  });
}

/**
 * Handle /api/compliance/audit/user
 */
async function handleGetUserAuditLogs(request, env) {
  const url = new URL(request.url);
  const user_id = url.searchParams.get('user_id');
  const limit = parseInt(url.searchParams.get('limit') || '100');

  if (!user_id) {
    return new Response(JSON.stringify({
      success: false,
      error: 'Missing required parameter: user_id'
    }), {
      status: 400,
      headers: { 'Content-Type': 'application/json' }
    });
  }

  const logs = await complianceAuditLogger.getUserAuditLogs(user_id, limit);

  return new Response(JSON.stringify({
    success: true,
    data: logs
  }), {
    headers: { 'Content-Type': 'application/json' }
  });
}

/**
 * Handle /api/compliance/audit/recent
 */
async function handleGetRecentAuditLogs(request, env) {
  const url = new URL(request.url);
  const limit = parseInt(url.searchParams.get('limit') || '50');

  const logs = await complianceAuditLogger.getRecentAuditLogs(limit);

  return new Response(JSON.stringify({
    success: true,
    data: logs
  }), {
    headers: { 'Content-Type': 'application/json' }
  });
}

/**
 * Handle /api/compliance/policy/current
 */
async function handleGetCurrentPolicy(request, env) {
  const policy = await env.DB.prepare(`
    SELECT * FROM consent_policy_versions
    ORDER BY effective_date DESC
    LIMIT 1
  `).first();

  return new Response(JSON.stringify({
    success: true,
    data: policy
  }), {
    headers: { 'Content-Type': 'application/json' }
  });
}
```

---

## 📋 Resumo de Implementação

### Componentes Criados

1. **ConsentManager** - Gestão completa de consentimento (GDPR, LGPD, CCPA)
2. **DataRightsManager** - Implementação de todos os direitos dos titulares
3. **DataRetentionManager** - Políticas de retenção automatizadas
4. **ComplianceAuditLogger** - Trilhas de auditoria completas

### Endpoints de Compliance

| Endpoint | Método | Descrição |
|----------|--------|-----------|
| `/api/compliance/consent/grant` | POST | Conceder consentimento |
| `/api/compliance/consent/revoke` | POST | Revogar consentimento |
| `/api/compliance/consent/check` | GET | Verificar consentimento válido |
| `/api/compliance/consent/preferences` | GET/POST | Gerenciar preferências de cookies |
| `/api/compliance/data-rights/access` | POST | Solicitar acesso aos dados |
| `/api/compliance/data-rights/deletion` | POST | Solicitar exclusão de dados |
| `/api/compliance/data-rights/portability` | POST | Solicitar portabilidade de dados |
| `/api/compliance/data-rights/rectification` | POST | Solicitar correção de dados |
| `/api/compliance/data-rights/process` | POST | Processar solicitação de direitos |
| `/api/compliance/retention/cleanup` | POST | Executar limpeza de retenção |
| `/api/compliance/retention/stats` | GET | Estatísticas de retenção |
| `/api/compliance/audit/user` | GET | Logs de auditoria por usuário |
| `/api/compliance/audit/recent` | GET | Logs de auditoria recentes |
| `/api/compliance/policy/current` | GET | Política de consentimento atual |

### Funcionalidades de Compliance

- **GDPR Compliance**: Todos os requisitos da Regulamentação Geral de Proteção de Dados (UE)
- **LGPD Compliance**: Todos os requisitos da Lei Geral de Proteção de Dados (Brasil)
- **CCPA Compliance**: Todos os requisitos da California Consumer Privacy Act (EUA)
- **Consent Management**: Sistema completo de gestão de consentimento com histórico
- **Data Rights**: Acesso, exclusão, portabilidade e correção de dados
- **Data Retention**: Políticas automatizadas de retenção e exclusão
- **Audit Trails**: Trilhas de auditoria completas para compliance

---

## 🔗 Integração com Outros Agentes

- **security-enterprise-agent.md**: Usa encryption de PII para LGPD/GDPR
- **attribution-agent.md**: Respeita consentimento para analytics e marketing
- **master-orchestrator.md**: Implementa middleware de consentimento antes de tracking
- **validator-agent.md**: O Compliance Agent DEVE ser consultado pelo Validator Agent para verificar conformidade de PII. Fluxo:

```
validator-agent (auditoria do código gerado)
    └─► checkComplianceCompliance(generatedCode)
            ├─ Verificar: SHA-256 aplicado em todos os campos PII (em, ph, fn, ln)?
            ├─ Verificar: Google Consent Mode v2 implementado (ad_storage, analytics_storage)?
            ├─ Verificar: url_passthrough: true ativo?
            ├─ Verificar: PII nunca logada em plaintext?
            └─ Verificar: opt-in explícito antes de tracking de marketing?

// No validator-agent, chamar:
const complianceCheck = await validateComplianceRequirements(generatedBrowserCode, generatedWorkerCode);
if (!complianceCheck.passed) {
  // Bloquear entrega e reportar issues ao Master Orchestrator
  return { status: 'BLOCKED', issues: complianceCheck.issues };
}
```

- **google-agent.md**: Consent Mode v2 gerado por este agente valida conformidade detectada pelo Compliance Agent

---

## ✅ Checklist de Implementação

- [x] Implementar ConsentManager com grant/revoke/check
- [x] Implementar DataRightsManager (access, deletion, portability, rectification)
- [x] Implementar DataRetentionManager com políticas automatizadas
- [x] Implementar ComplianceAuditLogger com trilhas completas
- [x] Criar D1 schemas para consent_records, consent_history, cookie_preferences
- [x] Criar D1 schemas para deletion_requests, retention_policies
- [x] Criar endpoints de API para todas as funcionalidades de compliance
- [x] Implementar GDPR compliance (Art. 15, 16, 17, 20)
- [x] Implementar LGPD compliance (Art. 18)
- [x] Implementar CCPA compliance (access, deletion, opt-out)
- [x] Implementar cookie preferences management
- [x] Implementar data retention policies automatizadas
- [x] Implementar audit trails para todas as atividades de compliance

---

## 📚 Referências

- [GDPR Official Text](https://gdpr-info.eu/)
- [LGPD Texto Completo](https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm)
- [CCPA Official Text](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&sectionId=1798.100)
- [IAB Europe Transparency & Consent Framework](https://iabeurope.eu/transparency-consent-framework/)

---

*Compliance Enterprise Agent v1.0.0 - CDP Edge Quantum Tier*