// criteria-injector — Generates legal compliance content for spec injection
import { getQuestionsForDomains, buildLegalPrompt } from './question-framework.js';
/** Domain-to-criteria templates: each domain yields focused meta-criteria */
const DOMAIN_CRITERIA_TEMPLATES = {
    billing: [
        'Validate invoice format against local tax authority requirements',
        'Implement mandatory tax calculation and reporting per applicable jurisdiction',
    ],
    health: [
        'Ensure health data handling complies with applicable medical privacy laws (e.g., HIPAA, local equivalents)',
        'Implement audit logging for all access to protected health information',
    ],
    fintech: [
        'Verify compliance with financial regulation and anti-money laundering requirements',
        'Implement transaction record retention per applicable financial laws',
    ],
    education: [
        'Verify compliance with student data privacy laws (e.g., FERPA, local equivalents)',
        'Implement parental consent mechanisms where student age requires it',
    ],
    ecommerce: [
        'Implement mandatory consumer protection disclosures per target market',
        'Ensure refund and cancellation policies meet local consumer law requirements',
    ],
    social: [
        'Implement content moderation mechanisms as required by applicable platform regulation',
        'Verify compliance with user data portability and deletion rights',
    ],
    gaming: [
        'Verify compliance with age rating and content classification requirements',
        'Implement loot box / in-app purchase disclosures per applicable gaming regulation',
    ],
    'ai-ml': [
        'Implement transparency disclosures for AI-generated content per applicable AI regulation',
        'Verify compliance with algorithmic bias and fairness requirements',
    ],
    iot: [
        'Ensure device data collection complies with applicable IoT privacy regulation',
        'Implement mandatory security update mechanisms per connected device laws',
    ],
    hr: [
        'Verify employee data handling complies with applicable labor and privacy laws',
        'Implement mandatory data retention and deletion schedules for personnel records',
    ],
    'real-estate': [
        'Verify compliance with fair housing and anti-discrimination laws in property listings',
        'Implement mandatory property disclosure requirements per jurisdiction',
    ],
    logistics: [
        'Verify compliance with customs and cross-border data transfer regulations',
        'Implement shipment tracking data retention per applicable transport law',
    ],
    media: [
        'Verify compliance with copyright and intellectual property laws for content distribution',
        'Implement mandatory content licensing and attribution mechanisms',
    ],
    government: [
        'Ensure compliance with public sector accessibility standards (e.g., WCAG, Section 508)',
        'Implement mandatory data sovereignty and residency requirements for government data',
    ],
};
/**
 * Checks whether a legal profile warrants injection of legal content.
 * Returns true if the profile has domains beyond 'universal' or has countries specified.
 */
export function shouldInjectLegal(profile) {
    if (profile === null || profile === undefined) {
        return false;
    }
    const hasNonUniversalDomains = profile.domains.some((d) => d !== 'universal');
    const hasCountries = profile.countries.length > 0;
    return hasNonUniversalDomains || hasCountries;
}
/**
 * Generates an array of acceptance criteria strings to add to spec.md.
 * These are meta-criteria that remind the implementer to check legal requirements.
 * Returns 3-6 criteria based on detected domains.
 */
export function generateLegalCriteria(profile, _specDescription) {
    const criteria = [];
    // Always add data protection criterion if countries are specified
    if (profile.countries.length > 0) {
        const countryList = profile.countries.join(', ');
        criteria.push(`Verify compliance with data protection laws for target countries: [${countryList}]`);
    }
    // Add domain-specific criteria
    for (const domain of profile.domains) {
        if (domain === 'universal') {
            continue;
        }
        const templates = DOMAIN_CRITERIA_TEMPLATES[domain];
        for (const template of templates) {
            criteria.push(template);
        }
    }
    // Add consent criterion if handling PII or personal data
    const personalDataTypes = ['pii', 'biometric', 'health', 'children'];
    const hasPersonalData = profile.dataTypes.some((dt) => personalDataTypes.includes(dt));
    if (hasPersonalData) {
        criteria.push('Implement mandatory consent mechanism per applicable privacy regulation');
    }
    // Add minor protection if applicable
    if (profile.audience.includesMinors) {
        criteria.push('Implement age verification and parental consent per child protection laws');
    }
    // Cap at 6 criteria to avoid overwhelming the spec
    return criteria.slice(0, 6);
}
/**
 * Generates a markdown section to append to technical.md with legal compliance research instructions.
 * Since the MCP server has no LLM access, this generates prompts/instructions for the calling LLM.
 */
export function generateLegalSection(profile, specDescription) {
    const questions = getQuestionsForDomains(profile.domains);
    const prompt = buildLegalPrompt(questions, profile.countries, specDescription);
    const lines = [];
    lines.push('## Legal Compliance');
    lines.push('');
    lines.push('> **Disclaimer**: This section provides guidance for legal compliance research.');
    lines.push('> It does NOT constitute legal advice. Consult qualified legal professionals');
    lines.push('> for authoritative guidance on regulatory requirements.');
    lines.push('');
    // Detected profile summary
    lines.push('### Detected Profile');
    lines.push('');
    const nonUniversalDomains = profile.domains.filter((d) => d !== 'universal');
    if (nonUniversalDomains.length > 0) {
        lines.push(`- **Domains**: ${nonUniversalDomains.join(', ')}`);
    }
    if (profile.countries.length > 0) {
        lines.push(`- **Countries**: ${profile.countries.join(', ')}`);
    }
    if (profile.dataTypes.length > 0) {
        lines.push(`- **Sensitive data types**: ${profile.dataTypes.join(', ')}`);
    }
    const audienceTraits = [];
    if (profile.audience.includesMinors) {
        audienceTraits.push('minors');
    }
    if (profile.audience.includesPatients) {
        audienceTraits.push('patients');
    }
    if (profile.audience.includesEmployees) {
        audienceTraits.push('employees');
    }
    if (profile.audience.isB2B) {
        audienceTraits.push('B2B');
    }
    if (profile.audience.isB2C) {
        audienceTraits.push('B2C');
    }
    if (audienceTraits.length > 0) {
        lines.push(`- **Audience**: ${audienceTraits.join(', ')}`);
    }
    lines.push('');
    // Legal compliance research section
    lines.push('### Legal Compliance Research');
    lines.push('');
    lines.push('The following questions should be investigated to determine concrete legal requirements:');
    lines.push('');
    for (const q of questions) {
        lines.push(`#### ${q.domain}: ${q.id}`);
        lines.push('');
        lines.push(`**Question**: ${q.question}`);
        lines.push('');
        lines.push(`**Rationale**: ${q.rationale}`);
        lines.push('');
    }
    // LLM investigation instructions
    lines.push('### Investigation Instructions');
    lines.push('');
    lines.push(prompt);
    lines.push('');
    return lines.join('\n');
}
//# sourceMappingURL=criteria-injector.js.map