plainstamp 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -16,6 +16,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 Distribution is **npm-only**. Source remains in the operating organization's private repository; there is no public source repository host. Contact channel for issues, accuracy reports, security reports, and contribution proposals is **helpfulbutton140@agentmail.to** (see `docs/CONTRIBUTING.md`, `docs/SECURITY.md`).
 
+## [0.6.0] — 2026-05-08
+
+### Added
+
+- FCC Declaratory Ruling on AI-generated voice in robocalls (CG Docket No. 23-362, FCC 24-17, released February 8, 2024). Confirms that AI-generated voice clones and AI-synthesized voices used in calls to consumers are "artificial or prerecorded voices" within the meaning of the Telephone Consumer Protection Act of 1991 (47 U.S.C. § 227) and the Commission's implementing rules at 47 CFR § 64.1200. AI-voice robocalls require prior express consent (or prior express written consent for telemarketing); statutory damages $500 per call ($1,500 willful). Use cases `b2c-marketing`, `b2c-sales`, `b2c-customer-support`, `civic-or-electoral`, `general`. Channel `voice`. Severity `mandatory`.
+- Runtime Zod schema exports: `Channel`, `UseCase`, `Severity`, `JurisdictionId`, `LookupQuery`, `DisclosureElement`, `DisclosureRule`, `RuleSet` are now exported from the package root (previously only the corresponding TypeScript types were exported). This unblocks downstream consumers (Cloudflare Workers wrapper, validation layers, etc.) from re-implementing the validators.
+- Rule count 22 → 23. Tests still 51/51 passing.
+
+### Sibling project (not bundled in npm)
+
+- `cf-worker/` — Cloudflare Workers HTTP wrapper that exposes the plainstamp lookup engine over JSON-over-HTTP. Endpoints: `GET /` (info), `/health`, `/jurisdictions`, `/rules`, `/rules/:id`, `/lookup`, `POST /validate`. Scaffold only in this release (deploy in next iteration). Plan doc at `<autobiz>/ops/cloudflare/CLOUDFLARE_DEPLOY.md`. The cf-worker depends on plainstamp@^0.6.0 (this release).
+
 ## [0.5.0] — 2026-05-08
 
 ### Added

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export { lookup, generateDisclosureText, validateDisclosure, } from "./lookup.js
 export { loadBundledRules, loadRulesFromPath } from "./rules-loader.js";
 export { computeCoverageMatrix, renderCoverageMarkdown, renderCoverageCsv, type CoverageMatrix, type CoverageCell, } from "./coverage.js";
 export type { DisclosureRuleT, RuleSetT, LookupQueryT, LookupResultT, ChannelT, UseCaseT, SeverityT, JurisdictionIdT, DisclosureElementT, } from "./schema.js";
+export { Channel, UseCase, Severity, JurisdictionId, LookupQuery, DisclosureElement, DisclosureRule, RuleSet, } from "./schema.js";
 import type { LookupQueryT, LookupResultT, DisclosureRuleT } from "./schema.js";
 /**
  * High-level convenience: load the bundled rules and look up disclosures for

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,eAAe,EACf,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEhF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,aAAa,EAAE,CAEnE;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAK5C;AAED,uDAAuD;AACvD,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAGnE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,YAAY,EACnB,aAAa,EAAE,MAAM;;;;;IAKtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,eAAe,EACf,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,eAAe,EACf,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,OAAO,EACP,OAAO,EACP,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,OAAO,GACR,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEhF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,aAAa,EAAE,CAEnE;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAK5C;AAED,uDAAuD;AACvD,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAGnE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,YAAY,EACnB,aAAa,EAAE,MAAM;;;;;IAKtB"}

package/dist/index.js

@@ -1,6 +1,7 @@
 export { lookup, generateDisclosureText, validateDisclosure, } from "./lookup.js";
 export { loadBundledRules, loadRulesFromPath } from "./rules-loader.js";
 export { computeCoverageMatrix, renderCoverageMarkdown, renderCoverageCsv, } from "./coverage.js";
+export { Channel, UseCase, Severity, JurisdictionId, LookupQuery, DisclosureElement, DisclosureRule, RuleSet, } from "./schema.js";
 import { loadBundledRules } from "./rules-loader.js";
 import { lookup as lookupFn, validateDisclosure as validateFn } from "./lookup.js";
 /**

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,GAGlB,MAAM,eAAe,CAAC;AAavB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,MAAM,IAAI,QAAQ,EAAE,kBAAkB,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAGnF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,OAAO,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAmB,EACnB,aAAqB;IAErB,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;AAClE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,GAGlB,MAAM,eAAe,CAAC;AAYvB,OAAO,EACL,OAAO,EACP,OAAO,EACP,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,OAAO,GACR,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,MAAM,IAAI,QAAQ,EAAE,kBAAkB,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAGnF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,OAAO,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAmB,EACnB,aAAqB;IAErB,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plainstamp",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "AI disclosure compliance assistant — generates legally-grounded AI disclosure text per (jurisdiction × channel × use-case) and tracks regulatory updates. Operated by an autonomous AI agent under KS Elevated Solutions LLC.",
   "type": "module",
   "license": "MIT",

package/rules/seed.json

@@ -1004,6 +1004,58 @@
         "formal": "Notice under FD&C Act § 515C (21 U.S.C. § 360e-4) and FDA's Predetermined Change Control Plans for Artificial Intelligence-Enabled Device Software Functions (Final Guidance, December 4, 2024): The device identified herein is an artificial intelligence-enabled device software function (AI-DSF) authorized by FDA under [submission type and reference number]. The manufacturer's authorized marketing submission includes a Predetermined Change Control Plan (PCCP) comprising a Description of Modifications, a Modification Protocol, and an Impact Assessment. PCCP-conforming modifications may be implemented without a new marketing submission; modifications outside the authorized PCCP require a new submission per applicable FDA regulations. The device's labeling reflects the PCCP; the manufacturer's public device summary at [URL] reflects the current model version, validation data, and the cumulative record of PCCP-conforming modifications implemented to date."
       },
       "notes": "PCCP is the FDA's response to the 'locked algorithm' problem for AI/ML medical devices: prior to FDORA § 515C (2022), any change to the algorithm of a cleared/authorized AI/ML device that affected safety or effectiveness typically required a new 510(k) / De Novo / PMA submission, which made iterative model improvement impractical. The PCCP framework lets manufacturers pre-authorize a bounded set of modifications and the validation methods for each. The December 2024 final guidance applies to all medical devices regardless of pathway (510(k), De Novo, PMA) and supersedes the April 2023 draft. Disclosure scope: the FDA-required labeling under 21 CFR Part 801 (device labeling) and the public-facing 510(k) summary / De Novo decision summary / PMA approval order published on FDA's website constitute the public disclosure surface; manufacturers typically also publish device-summary pages on their own websites with current model version and validation data. Use case is `healthcare`. Stack with HHS Section 1557 PCDST nondiscrimination obligations and with state-level rules like California SB 1120 — Physicians Make Decisions Act when the device is used in coverage decisions. The patient-facing element is conditional: most FDA-regulated AI/ML devices are clinician-facing tools, but where the device produces output that is shown to patients (e.g., consumer-facing diabetes risk estimators, certain digital health products), the AI/ML disclosure should be patient-facing. The 'mandatory' severity reflects that AI/ML modifications must be authorized — either through PCCP or through a new submission — and that labeling disclosure is required; the 'recommended' framing applies to design choices about how detailed to make the user-facing AI/ML summary. Verify against the current FDA guidance and any device-class-specific guidance before production deployment."
+    },
+    {
+      "id": "us-fcc-tcpa-ai-voice-robocall-2024",
+      "jurisdiction": "us",
+      "channels": ["voice"],
+      "use_cases": [
+        "b2c-marketing",
+        "b2c-sales",
+        "b2c-customer-support",
+        "civic-or-electoral",
+        "general"
+      ],
+      "severity": "mandatory",
+      "short_title": "FCC Declaratory Ruling — AI-generated voice in robocalls is an 'artificial or prerecorded voice' under TCPA (February 2024)",
+      "summary": "On February 8, 2024, the U.S. Federal Communications Commission issued a Declaratory Ruling (CG Docket No. 23-362, FCC 24-17) confirming that AI-generated voice clones and other AI-synthesized voices used in calls to consumers are 'artificial or prerecorded voices' within the meaning of the Telephone Consumer Protection Act of 1991 (TCPA), 47 U.S.C. § 227(b)(1)(A)–(B), and the Commission's implementing rules at 47 CFR § 64.1200. The ruling means that any robocall to a wireless number that uses an AI-generated voice (or to a residential landline for a telemarketing purpose) requires the called party's prior express written consent (for telemarketing) or prior express consent (for non-telemarketing/informational) — and remains subject to the TCPA's identification-of-caller and opt-out requirements. Statutory damages under the TCPA are $500 per violation (per call), up to $1,500 per willful or knowing violation. State Attorneys General, the FCC, and a private right of action under § 227(b)(3) are all available enforcement paths.",
+      "required_elements": [
+        {
+          "id": "prior-express-consent",
+          "description": "Prior express written consent (for telemarketing AI-voice calls to wireless numbers and residential landlines) or prior express consent (for non-telemarketing/informational AI-voice calls) before placing the call. (Pre-call consent requirement; the consumer-facing disclosure occurs at consent-collection time, not at call time.)",
+          "required": false
+        },
+        {
+          "id": "caller-identification",
+          "description": "At the beginning of the AI-voice call, the message must clearly state the identity of the business, individual, or other entity that is responsible for initiating the call.",
+          "required": true,
+          "example": "This is an automated call from [business name]."
+        },
+        {
+          "id": "callback-number",
+          "description": "During or after the AI-voice message, the called party must be provided with a telephone number (other than that of the autodialer or prerecorded message player) that the called party can use to make a do-not-call request.",
+          "required": true,
+          "example": "To stop receiving calls from us, please call [phone number] or press [digit] now."
+        },
+        {
+          "id": "interactive-opt-out",
+          "description": "For telemarketing AI-voice calls, an automated, interactive voice- and/or key-press-activated opt-out mechanism must be available throughout the duration of the call.",
+          "required": false
+        }
+      ],
+      "citation": {
+        "statute": "Telephone Consumer Protection Act of 1991, codified at 47 U.S.C. § 227; 47 CFR § 64.1200",
+        "section": "FCC Declaratory Ruling, CG Docket No. 23-362, FCC 24-17 (released February 8, 2024)",
+        "source_url": "https://www.fcc.gov/document/fcc-makes-ai-generated-voices-robocalls-illegal",
+        "publisher": "U.S. Federal Communications Commission"
+      },
+      "effective_date": "2024-02-08",
+      "last_verified": "2026-05-08",
+      "template": {
+        "plain": "Notice — Automated Call: This is an automated call from [business name]. The voice you are hearing is an artificial or AI-generated voice, not a live person. To stop receiving calls from us, please press [digit] or call [phone number].",
+        "formal": "Notice under the Telephone Consumer Protection Act, 47 U.S.C. § 227, and the Federal Communications Commission's Declaratory Ruling FCC 24-17 (February 8, 2024) confirming that AI-generated voices in robocalls are 'artificial or prerecorded voices' under the TCPA: This call is being placed by [business name and contact information]. The voice in this call is artificially generated. The called party may opt out of future calls from this caller at any time by [opt-out instructions]. Calls placed in violation of the TCPA are subject to statutory damages of $500 per call, up to $1,500 per willful or knowing violation."
+      },
+      "notes": "The FCC's February 2024 Declaratory Ruling closed an interpretive gap — TCPA's 'artificial or prerecorded voice' language predates AI voice cloning, and there had been arguments that AI-generated voices were not covered. The ruling makes clear they are. Practical consequences: (1) any AI-voice call to a wireless number for any purpose typically requires prior express consent; (2) AI-voice calls for telemarketing require prior express written consent; (3) every AI-voice call must include caller identification and an opt-out path. The ruling stacks with state-level robocall laws (e.g., Florida, Oklahoma, Pennsylvania, Washington) that may impose additional consent or disclosure requirements; with California's B&P § 17941 bot-disclosure rule when the caller is in or reaching California; and with EU AI Act Article 50 when the caller reaches EU residents. The FCC has paired this ruling with separate caller-ID authentication enforcement (STIR/SHAKEN) targeting AI-voice scam robocalls. Class actions under TCPA are common; the per-call statutory damages structure means even small-volume AI-voice campaigns carry significant exposure. Legal-services and political-campaign callers face additional state-law restrictions. The April 2024 FCC Notice of Proposed Rulemaking (CG Docket 23-362) proposed disclosure rules specific to AI-generated content in calls and texts; verify the latest rulemaking status before production deployment."
     }
   ]
 }