// ---------------------------------------------------------------------------
// Universal domain — applies to ALL projects regardless of industry
// ---------------------------------------------------------------------------
const UNIVERSAL_QUESTIONS = [
    {
        id: 'universal-01',
        domain: 'universal',
        question: 'What data protection laws apply in each target country (e.g., GDPR, LGPD, CCPA, POPIA)?',
        rationale: 'Data protection is the most common compliance area. Nearly every app collects some form of personal data.',
        keywords: ['gdpr', 'lgpd', 'ccpa', 'popia', 'data protection', 'personal data'],
    },
    {
        id: 'universal-02',
        domain: 'universal',
        question: 'What are the privacy policy requirements in each target country? Must it be in the local language?',
        rationale: 'Most jurisdictions require a publicly accessible privacy policy with specific disclosures.',
        keywords: ['privacy policy', 'privacy notice', 'disclosure'],
    },
    {
        id: 'universal-03',
        domain: 'universal',
        question: 'What accessibility standards are legally required (e.g., WCAG level, ADA, EAA)?',
        rationale: 'Accessibility lawsuits are increasing globally. Some countries mandate specific WCAG levels.',
        keywords: ['wcag', 'accessibility', 'ada', 'eaa', 'a11y'],
    },
    {
        id: 'universal-04',
        domain: 'universal',
        question: 'What are the mandatory data retention periods and deletion obligations in each country?',
        rationale: 'Over-retaining data creates liability. Under-retaining may violate tax or audit laws.',
        keywords: ['data retention', 'deletion', 'right to erasure', 'storage limitation'],
    },
    {
        id: 'universal-05',
        domain: 'universal',
        question: 'What consent mechanisms are required for data collection (opt-in vs opt-out, granularity)?',
        rationale: 'Consent requirements vary dramatically — EU requires explicit opt-in, US often allows opt-out.',
        keywords: ['consent', 'opt-in', 'opt-out', 'legitimate interest'],
    },
    {
        id: 'universal-06',
        domain: 'universal',
        question: 'What are the data breach notification requirements (timeline, authority, affected users)?',
        rationale: 'Breach notification deadlines range from 24 hours to 72 hours depending on jurisdiction.',
        keywords: ['breach notification', 'data breach', 'incident response', 'notification timeline'],
    },
    {
        id: 'universal-07',
        domain: 'universal',
        question: 'What restrictions exist on cross-border data transfers between the target countries?',
        rationale: 'Transferring data across borders may require Standard Contractual Clauses, adequacy decisions, or local storage.',
        keywords: ['cross-border', 'data transfer', 'scc', 'adequacy', 'data localization'],
    },
    {
        id: 'universal-08',
        domain: 'universal',
        question: 'What cookie and tracking consent requirements apply (e.g., cookie banners, ePrivacy)?',
        rationale: 'Cookie consent is separately regulated from general data protection in many jurisdictions.',
        keywords: ['cookie', 'tracking', 'eprivacy', 'cookie banner', 'analytics consent'],
    },
];
// ---------------------------------------------------------------------------
// Billing domain — invoicing, taxation, fiscal compliance
// ---------------------------------------------------------------------------
const BILLING_QUESTIONS = [
    {
        id: 'billing-01',
        domain: 'billing',
        question: 'What electronic invoice format is required in each country (e.g., CFDI in Mexico, FEL in Guatemala, Factura Electronica in Colombia)?',
        rationale: 'Many countries mandate specific XML/JSON invoice formats validated by the tax authority.',
        keywords: ['e-invoice', 'cfdi', 'fel', 'factura electronica', 'electronic invoice'],
    },
    {
        id: 'billing-02',
        domain: 'billing',
        question: 'Does the tax authority require real-time certification or pre-authorization of invoices?',
        rationale: 'Some countries require invoices to be stamped by an authorized provider before delivery.',
        keywords: ['pac', 'certification', 'tax stamp', 'timbrado', 'authorization'],
    },
    {
        id: 'billing-03',
        domain: 'billing',
        question: 'What is the mandatory fiscal document retention period in each country?',
        rationale: 'Fiscal retention periods (often 5-10 years) may exceed general data retention rules.',
        keywords: ['fiscal retention', 'document retention', 'tax records', 'archive'],
    },
    {
        id: 'billing-04',
        domain: 'billing',
        question: 'What mandatory fields must appear on invoices and receipts in each country?',
        rationale: 'Missing mandatory fields (tax ID, address, tax breakdown) can invalidate an invoice.',
        keywords: ['mandatory fields', 'invoice fields', 'tax id', 'rfc', 'nit'],
    },
    {
        id: 'billing-05',
        domain: 'billing',
        question: 'Are digital signatures or cryptographic seals required on fiscal documents?',
        rationale: 'Digital signatures ensure document integrity and are legally required in several countries.',
        keywords: ['digital signature', 'cryptographic seal', 'fiel', 'firma electronica'],
    },
    {
        id: 'billing-06',
        domain: 'billing',
        question: 'What periodic tax reporting obligations exist (e.g., monthly VAT returns, annual summaries)?',
        rationale: 'The system may need to generate or export data in formats required for tax filings.',
        keywords: ['tax reporting', 'vat return', 'tax filing', 'periodic report'],
    },
];
// ---------------------------------------------------------------------------
// Health domain — health data, patients, medical records
// ---------------------------------------------------------------------------
const HEALTH_QUESTIONS = [
    {
        id: 'health-01',
        domain: 'health',
        question: 'What health data protection laws apply (e.g., HIPAA, NOM-024 in Mexico, LGPD health provisions)?',
        rationale: 'Health data has stricter protections than general personal data in most jurisdictions.',
        keywords: ['hipaa', 'health data', 'medical records', 'phi', 'nom-024'],
    },
    {
        id: 'health-02',
        domain: 'health',
        question: 'What informed consent requirements exist for collecting and processing health data?',
        rationale: 'Health data typically requires explicit, specific consent separate from general terms.',
        keywords: ['informed consent', 'patient consent', 'health consent'],
    },
    {
        id: 'health-03',
        domain: 'health',
        question: 'What interoperability standards are required or recommended (e.g., HL7 FHIR, DICOM)?',
        rationale: 'Some jurisdictions mandate specific health data exchange formats for system interoperability.',
        keywords: ['hl7', 'fhir', 'dicom', 'interoperability', 'health exchange'],
    },
    {
        id: 'health-04',
        domain: 'health',
        question: 'What access control requirements exist for health data (role-based access, minimum necessary)?',
        rationale: 'Health regulations typically require strict access controls with audit capabilities.',
        keywords: ['access control', 'rbac', 'minimum necessary', 'need to know'],
    },
    {
        id: 'health-05',
        domain: 'health',
        question: 'What audit trail requirements exist for health record access and modifications?',
        rationale: 'Audit logs for health data access are legally required in most health data frameworks.',
        keywords: ['audit trail', 'audit log', 'access log', 'health audit'],
    },
    {
        id: 'health-06',
        domain: 'health',
        question: 'What patient data portability rights exist (e.g., right to export medical records)?',
        rationale: 'Patients may have the right to receive their health data in a structured, portable format.',
        keywords: ['data portability', 'patient rights', 'medical record export'],
    },
];
// ---------------------------------------------------------------------------
// Fintech domain — payments, banking, financial services
// ---------------------------------------------------------------------------
const FINTECH_QUESTIONS = [
    {
        id: 'fintech-01',
        domain: 'fintech',
        question: 'What PCI-DSS compliance level is required based on transaction volume and data handling?',
        rationale: 'PCI-DSS is a global standard but compliance level depends on how card data is processed.',
        keywords: ['pci-dss', 'pci', 'card data', 'payment security'],
    },
    {
        id: 'fintech-02',
        domain: 'fintech',
        question: 'What KYC (Know Your Customer) and AML (Anti-Money Laundering) requirements apply?',
        rationale: 'Financial services must verify customer identity and monitor for suspicious transactions.',
        keywords: [
            'kyc',
            'aml',
            'know your customer',
            'anti-money laundering',
            'identity verification',
        ],
    },
    {
        id: 'fintech-03',
        domain: 'fintech',
        question: 'What financial licenses or registrations are required to operate in each country?',
        rationale: 'Operating without proper licensing can result in criminal penalties and service shutdown.',
        keywords: ['financial license', 'fintech license', 'banking license', 'money transmitter'],
    },
    {
        id: 'fintech-04',
        domain: 'fintech',
        question: 'What regulatory reporting obligations exist (e.g., suspicious activity reports, transaction reporting)?',
        rationale: 'Financial institutions must file reports with regulators on specific transaction patterns.',
        keywords: ['regulatory reporting', 'sar', 'suspicious activity', 'transaction reporting'],
    },
    {
        id: 'fintech-05',
        domain: 'fintech',
        question: 'What transaction limits or thresholds trigger additional compliance requirements?',
        rationale: 'Certain transaction amounts trigger enhanced due diligence or reporting obligations.',
        keywords: ['transaction limits', 'threshold', 'enhanced due diligence', 'ctr'],
    },
    {
        id: 'fintech-06',
        domain: 'fintech',
        question: 'What fraud prevention and detection measures are legally required?',
        rationale: 'Some jurisdictions mandate specific fraud prevention mechanisms for financial services.',
        keywords: ['fraud prevention', 'fraud detection', 'strong authentication', 'sca', 'psd2'],
    },
];
// ---------------------------------------------------------------------------
// Education domain — students, minors, educational content
// ---------------------------------------------------------------------------
const EDUCATION_QUESTIONS = [
    {
        id: 'education-01',
        domain: 'education',
        question: "What laws protect minors' data in each country (e.g., COPPA, GDPR-K, local equivalents)?",
        rationale: "Processing children's data has the strictest requirements in most legal frameworks.",
        keywords: ['coppa', 'children', 'minor', 'gdpr-k', 'child data'],
    },
    {
        id: 'education-02',
        domain: 'education',
        question: 'What parental or guardian consent mechanisms are required for users under the age threshold?',
        rationale: 'Age thresholds vary (13 in US, 16 in some EU countries) and consent mechanisms differ.',
        keywords: ['parental consent', 'guardian consent', 'age threshold', 'verifiable consent'],
    },
    {
        id: 'education-03',
        domain: 'education',
        question: 'Are there regulations on educational content quality, certification, or accreditation?',
        rationale: 'Educational platforms may need accreditation or must follow curriculum standards.',
        keywords: ['accreditation', 'educational content', 'curriculum', 'certification'],
    },
    {
        id: 'education-04',
        domain: 'education',
        question: 'What student privacy laws apply (e.g., FERPA, local student data protection)?',
        rationale: 'Student records have special protections beyond general data protection in many countries.',
        keywords: ['ferpa', 'student privacy', 'student records', 'educational records'],
    },
];
// ---------------------------------------------------------------------------
// E-commerce domain — online retail, consumer transactions
// ---------------------------------------------------------------------------
const ECOMMERCE_QUESTIONS = [
    {
        id: 'ecommerce-01',
        domain: 'ecommerce',
        question: 'What consumer protection laws apply to online sales in each country?',
        rationale: 'Consumer protection rights (cooling-off periods, warranties) vary significantly by country.',
        keywords: ['consumer protection', 'consumer rights', 'warranty', 'cooling-off'],
    },
    {
        id: 'ecommerce-02',
        domain: 'ecommerce',
        question: 'What are the mandatory return, refund, and cancellation rights for online purchases?',
        rationale: 'Many countries grant statutory return rights (e.g., 14 days in EU) that override store policy.',
        keywords: ['return policy', 'refund', 'cancellation', 'right of withdrawal'],
    },
    {
        id: 'ecommerce-03',
        domain: 'ecommerce',
        question: 'What receipt or invoice requirements apply to online transactions in each country?',
        rationale: 'Online merchants must provide purchase confirmations with specific content in many jurisdictions.',
        keywords: ['receipt', 'purchase confirmation', 'order confirmation', 'invoice'],
    },
    {
        id: 'ecommerce-04',
        domain: 'ecommerce',
        question: 'What distance selling regulations apply (pre-contractual information, confirmation requirements)?',
        rationale: 'Distance selling laws require specific information before and after purchase.',
        keywords: ['distance selling', 'pre-contractual', 'terms and conditions', 'online contract'],
    },
];
// ---------------------------------------------------------------------------
// AI/ML domain — artificial intelligence, machine learning systems
// ---------------------------------------------------------------------------
const AI_ML_QUESTIONS = [
    {
        id: 'ai-ml-01',
        domain: 'ai-ml',
        question: 'What AI-specific regulations apply in each country (e.g., EU AI Act, local AI guidelines)?',
        rationale: 'AI regulation is rapidly evolving with the EU AI Act as the most comprehensive framework.',
        keywords: ['ai act', 'ai regulation', 'artificial intelligence', 'ai governance'],
    },
    {
        id: 'ai-ml-02',
        domain: 'ai-ml',
        question: 'What explainability or transparency requirements exist for AI/ML-driven decisions?',
        rationale: 'Many jurisdictions require that automated decisions be explainable to affected individuals.',
        keywords: ['explainability', 'transparency', 'xai', 'interpretability', 'black box'],
    },
    {
        id: 'ai-ml-03',
        domain: 'ai-ml',
        question: 'What restrictions exist on training data collection, usage, and bias mitigation?',
        rationale: 'Training data may be subject to copyright, consent requirements, and bias auditing.',
        keywords: ['training data', 'bias', 'fairness', 'data collection', 'copyright'],
    },
    {
        id: 'ai-ml-04',
        domain: 'ai-ml',
        question: 'What rights do users have regarding automated decision-making (e.g., right to human review)?',
        rationale: 'GDPR Art. 22 and similar laws grant rights against solely automated decisions with legal effects.',
        keywords: ['automated decision', 'human review', 'right to contest', 'profiling'],
    },
];
// ---------------------------------------------------------------------------
// Social domain — social platforms, user-generated content
// ---------------------------------------------------------------------------
const SOCIAL_QUESTIONS = [
    {
        id: 'social-01',
        domain: 'social',
        question: 'What content moderation obligations exist (e.g., DSA, NetzDG, local platform liability)?',
        rationale: 'Platform liability for user content varies from safe harbor to active moderation duties.',
        keywords: ['content moderation', 'dsa', 'netzDG', 'platform liability', 'takedown'],
    },
    {
        id: 'social-02',
        domain: 'social',
        question: 'What age verification mechanisms are required for social platforms?',
        rationale: 'Several countries now mandate age verification beyond simple self-declaration.',
        keywords: ['age verification', 'age gate', 'age assurance', 'social media age'],
    },
    {
        id: 'social-03',
        domain: 'social',
        question: 'What liability framework applies to user-generated content in each country?',
        rationale: 'Platforms may be liable for UGC under certain conditions depending on jurisdiction.',
        keywords: ['user-generated content', 'ugc', 'liability', 'safe harbor', 'notice and takedown'],
    },
    {
        id: 'social-04',
        domain: 'social',
        question: 'What right-to-be-forgotten or content removal obligations exist?',
        rationale: 'Users may have the right to request removal of their content and personal data from the platform.',
        keywords: ['right to be forgotten', 'content removal', 'erasure', 'delisting'],
    },
];
// ---------------------------------------------------------------------------
// Gaming domain — video games, online gaming, gambling
// ---------------------------------------------------------------------------
const GAMING_QUESTIONS = [
    {
        id: 'gaming-01',
        domain: 'gaming',
        question: 'What age rating or age gate requirements apply to games in each country?',
        rationale: 'Most countries require age classification systems (ESRB, PEGI, CERO) for games.',
        keywords: ['age rating', 'esrb', 'pegi', 'cero', 'age gate', 'content rating'],
    },
    {
        id: 'gaming-02',
        domain: 'gaming',
        question: 'What regulations apply to loot boxes, gacha mechanics, or randomized paid items?',
        rationale: 'Several countries classify loot boxes as gambling or require probability disclosures.',
        keywords: ['loot box', 'gacha', 'randomized', 'probability disclosure', 'paid items'],
    },
    {
        id: 'gaming-03',
        domain: 'gaming',
        question: 'Does the game involve real-money gambling, and what licensing is required?',
        rationale: 'Real-money gambling requires specific licenses in virtually every jurisdiction.',
        keywords: ['gambling license', 'betting', 'real-money', 'wagering', 'gambling regulation'],
    },
    {
        id: 'gaming-04',
        domain: 'gaming',
        question: 'What addiction prevention or responsible gaming measures are required?',
        rationale: 'Some countries mandate playtime warnings, spending limits, or cool-down mechanics.',
        keywords: [
            'addiction prevention',
            'responsible gaming',
            'playtime',
            'spending limit',
            'cool-down',
        ],
    },
];
// ---------------------------------------------------------------------------
// Full catalog
// ---------------------------------------------------------------------------
/** Complete catalog of legal questions organized by domain */
export const LEGAL_QUESTIONS = [
    ...UNIVERSAL_QUESTIONS,
    ...BILLING_QUESTIONS,
    ...HEALTH_QUESTIONS,
    ...FINTECH_QUESTIONS,
    ...EDUCATION_QUESTIONS,
    ...ECOMMERCE_QUESTIONS,
    ...AI_ML_QUESTIONS,
    ...SOCIAL_QUESTIONS,
    ...GAMING_QUESTIONS,
];
// ---------------------------------------------------------------------------
// Query functions
// ---------------------------------------------------------------------------
/**
 * Returns all questions for the given domains, always including 'universal'.
 * Deduplicates in case 'universal' is already in the input list.
 */
export function getQuestionsForDomains(domains) {
    const domainSet = new Set(domains);
    domainSet.add('universal');
    return LEGAL_QUESTIONS.filter((q) => domainSet.has(q.domain));
}
/**
 * Builds a prompt string that an LLM can use to investigate legal requirements
 * for a project's target countries and applicable domains.
 */
export function buildLegalPrompt(questions, countries, specDescription) {
    const countryList = countries.join(', ');
    const questionBlocks = questions
        .map((q) => `### ${q.id}\n**Question:** ${q.question}\n**Why it matters:** ${q.rationale}\n**Keywords:** ${q.keywords.join(', ')}`)
        .join('\n\n');
    return `You are a legal compliance analyst. Investigate the following legal questions for a software project.

## Project Description
${specDescription}

## Target Countries
${countryList}

## Instructions
For each question below, research the applicable laws and regulations in EACH target country listed above. Then produce concrete, actionable acceptance criteria that a development team can implement.

Your response MUST follow this format for each applicable regulation:
- **Regulation**: Name and reference (e.g., "GDPR Art. 17 — Right to Erasure")
- **Country**: Which country this applies to (or "all" if universal)
- **Criterion**: A specific, testable acceptance criterion (e.g., "System MUST delete all personal data within 30 days of a verified erasure request")
- **Priority**: mandatory | recommended | informational
- **Reference**: URL to official documentation or legal text

## Important Guidelines
1. Check for regulatory updates enacted after 2024 — regulations change frequently.
2. When multiple countries are listed, the final requirements are the UNION of all country-specific requirements. The strictest rule wins when requirements conflict.
3. If a regulation does not apply to this specific project, skip it — do not generate irrelevant criteria.
4. Be specific: "MUST encrypt health data at rest using AES-256" is better than "MUST protect data."
5. Include both technical requirements (encryption, access control) and process requirements (policies, training).

## Questions to Investigate

${questionBlocks}

## Output
Return a JSON array of objects with this shape:
\`\`\`json
[
  {
    "regulation": "string",
    "country": "string",
    "criterion": "string",
    "priority": "mandatory | recommended | informational",
    "reference": "string | null"
  }
]
\`\`\`

Only return the JSON array, no additional text.`;
}
//# sourceMappingURL=question-framework.js.map