srclawyer 0.4.0

package/LICENSE

@@ -0,0 +1,112 @@
+Business Source License 1.1
+
+Parameters
+
+Licensor:              Mystique Technologies LLC
+Licensed Work:         SrcLawyer
+                        The Licensed Work is © 2026 Mystique Technologies LLC
+Additional Use Grant:  You may use, copy, modify, and self-host the
+                        Licensed Work for any purpose, including internal
+                        use within a commercial organization of any size,
+                        and including use as part of your own software
+                        development and compliance processes. You may not
+                        offer the Licensed Work, or any modified or
+                        derivative version of it, to third parties as a
+                        hosted or managed service, or embed it in a
+                        competing commercial product or service, without
+                        a separate commercial license from Licensor.
+Change Date:            Four years from the date of the first publicly
+                        available distribution of a specific version of
+                        the Licensed Work.
+Change License:         Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the
+Licensed Work, please contact contact@mystique-technologies.com.
+
+Notice
+
+The Business Source License (this document, or the "License") is not
+an Open Source license. However, the Licensed Work will eventually be
+made available under an Open Source License, as stated in this
+License.
+
+License text copyright © 2024 MariaDB plc, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB plc.
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create
+derivative works, redistribute, and make non-production use of the
+Licensed Work. The Licensor may make an Additional Use Grant, above,
+permitting limited production use.
+
+Effective on the Change Date, or the fourth anniversary of the first
+publicly available distribution of a specific version of the Licensed
+Work under this License, whichever comes first, the Licensor hereby
+grants you rights under the terms of the Change License, and the
+rights granted in the paragraph above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or
+authorized resellers, or you must refrain from using the Licensed
+Work.
+
+All copies of the original and modified Licensed Work, and derivative
+works of the Licensed Work, are subject to this License. This License
+applies separately for each version of the Licensed Work and the
+Change Date may vary for each version of the Licensed Work released by
+Licensor.
+
+You must conspicuously display this License on each original or
+modified copy of the Licensed Work. If you receive the Licensed Work
+in original or modified form from a third party, the terms and
+conditions set forth in this License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will
+automatically terminate your rights under this License for the
+current and all other versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or
+logo of Licensor as expressly required by this License). TO THE EXTENT
+PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON AN "AS
+IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT,
+AND TITLE.
+
+MariaDB hereby grants you permission to use this License's text to
+license your works, and to refer to it using the trademark "Business
+Source License", as long as you comply with the Covenants of Licensor
+below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License's text and the
+"Business Source License" name and trademark, Licensor covenants to
+MariaDB, and to all other recipients of the licensed work to be
+provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later
+   version, or a license that is compatible with GPL Version 2.0 or a
+   later version, where "compatible" means that software provided
+   under the Change License can be included in a program with software
+   provided under GPL Version 2.0 or a later version. Licensor may
+   specify additional Change Licenses without limitation.
+
+2. To either: (a) specify an additional grant of rights to use that
+   does not impose any additional restriction on the right granted in
+   this License, as the Additional Use Grant; or (b) insert the text
+   "None" to specify a Change Date.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.
+
+Notice
+
+The Business Source License (this document, or the "License") is not
+an Open Source license. However, the Licensed Work will eventually be
+made available under an Open Source License, as stated in this
+License.

package/README.md

@@ -0,0 +1,58 @@
+# SrcLawyer
+
+Static analysis engine that derives privacy policy documentation directly from source code, and keeps it in sync as the code changes.
+
+> This is a Phase 1 scaffold: the CLI (`init`, `scan`), the Layer 1 static analysis engine — SDK/framework pattern detection, HTML/browser-API detection, and OpenAPI/GraphQL schema parsing — LLM-assisted reasoning for ambiguous findings (Layer 2, bring-your-own-key or managed), and markdown privacy policy generation. CI/CD integration is not yet implemented.
+>
+> Scanning is manual-only (`srclawyer scan`, run on demand) — this is the free/solo tier's permanent behavior, not a placeholder. CI/CD integration (PR-triggered scans, a weekly backstop scan) is scoped for the paid/team tier only; see `PRODUCT_SPEC.md` Section 8.5.
+
+## Usage
+
+```bash
+npm install
+npm run build
+node dist/cli.js init            # one-time: jurisdiction, markets, industry
+node dist/cli.js scan            # analyze the codebase and write PRIVACY_POLICY.md
+node dist/cli.js scan --json     # findings as JSON (still writes the policy file)
+node dist/cli.js scan --out docs/privacy.md
+```
+
+During development, run directly from source with `npm run dev -- scan`.
+
+## What `scan` does today
+
+- **Known SDK integrations** (import/require detection): Stripe, SendGrid, Twilio, Google Analytics, Mixpanel, Auth0, Firebase, Cognito — each mapped to the data categories it typically processes (`src/rules/processorProfiles.ts`).
+- **Request-body field collection** in Express (`req.body.x`, destructured `req.body`) and Next.js (both `pages/api` and the app router's `await request.json()`), classified against a field-name lexicon (`src/rules/dataCategoryLexicon.ts`).
+- **OpenAPI/Swagger schemas** (`components.schemas.*.properties`) and **GraphQL SDL** type/input fields.
+- **HTML forms and inline scripts** (`src/rules/htmlRules.ts`): native `<input>` elements classified by `type` (password/email/tel are unambiguous native signals) or by `id`/`name` against the lexicon; inline `<script>` blocks are extracted and run through the same SDK/framework/web-API rules as any other file.
+- **Browser platform APIs** (`src/rules/webApiRules.ts`): `getUserMedia` (split into microphone and camera access), geolocation, and `localStorage`/`sessionStorage` writes classified by key name.
+- Fields that can't be confidently classified (generic names like `data`, `payload`) are surfaced with `requiresReview: true` rather than silently guessed.
+- **A field-name allowlist** (`src/rules/safeFieldNames.ts`) suppresses findings entirely for exact-match structural fields (`id`, `createdAt`, `status`, pagination params, etc.) so "needs review" stays a signal, not noise from routine boilerplate. Anything not on the allowlist keeps the existing classify-or-flag behavior above.
+- **Unsupported language/framework detection** (`src/engine/languageDetection.ts`) runs at the start of every scan: it checks for Django (`manage.py`), Rails (`Gemfile` + `app/controllers`), gRPC (`.proto` files), and falls back to a file-count ratio for Python/Ruby/Go/Java/PHP/C# vs JS/TS/HTML. When it fires, a bordered warning appears at the top of the CLI output *and* at the top of the generated `PRIVACY_POLICY.md` (not just a log line easy to miss), the warning is included in `--json` output, and the process exits with code 1 so CI can't silently treat a scan of an unsupported codebase as a pass.
+- **Generates a markdown privacy policy** (`src/policy/generatePolicy.ts`) in the same command: findings are grouped by data category, each clause cites the file:line that justified it, third-party processors get their own section, and anything flagged `requiresReview` is excluded from the body and listed separately under "Items Requiring Manual Review" instead of being guessed. The mandatory disclaimer (`src/policy/disclaimer.ts`) is always appended, unconditionally.
+
+Every finding traces back to a file and line (`src/engine/types.ts#Finding`).
+
+## Network calls
+
+Detection itself is fully local and offline — no code leaves your machine for pattern matching. Once detection completes, `scan` makes one batched network call to grade the confidence of what it found (field names and derived yes/no signals only, never source code), and, for scans that use Zod schemas as request validators, one additional call sending a small redacted code fragment. This runs on every scan regardless of tier and is unrelated to the separate, optional LLM-assisted (Layer 2) reasoning described above. See `PRODUCT_SPEC.md`'s "Static Analysis Depth" section for the precise wording.
+
+## Secret handling
+
+`src/engine/secretRedaction.ts` strips known secret-shaped values (API keys, connection strings, JWTs, private key blocks) out of any evidence string before it's stored or printed, and out of any code fragment before it's sent as part of the confidence-grading call above — enforced at the base layer, independent of whether the optional LLM-assisted (Layer 2) path is configured.
+
+## Test fixtures
+
+`test-fixtures/` contains a small Express+Stripe app, a Next.js app (pages + app router), an OpenAPI spec, and a GraphQL schema, used to validate detection end-to-end. Run `node dist/cli.js scan` from inside `test-fixtures/` to see it work.
+
+## Accuracy corpus
+
+`npm test` never touches the network. A separate, real-world accuracy check lives in `test-fixtures/golden-corpus/` — see its own README for what it measures and why it's not part of the default test run.
+
+## License
+
+[Business Source License 1.1](LICENSE) (BUSL-1.1) — source-available, not OSI-approved open source.
+
+Free for any use, including internal use within a commercial organization of any size and as part of your own software development and compliance processes. The only restriction: you may not offer SrcLawyer, or a modified/derivative version of it, to third parties as a hosted or managed service, or embed it in a competing commercial product, without a separate commercial license from Mystique Technologies LLC (contact@mystique-technologies.com).
+
+Each version converts to the Apache License 2.0 four years after its first public release.

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Command } from "commander";
+import { runInit } from "./commands/init.js";
+import { runScan } from "./commands/scan.js";
+// Read from package.json rather than hardcoding, so --version can't silently drift out of sync with
+// the published version the way a literal string did through every prior release.
+const HERE = dirname(fileURLToPath(import.meta.url));
+const { version } = JSON.parse(readFileSync(join(HERE, "../package.json"), "utf8"));
+const program = new Command();
+program
+    .name("srclawyer")
+    .description("Static analysis engine that derives privacy policy documentation directly from source code")
+    .version(version);
+program
+    .command("init")
+    .description("One-time setup: jurisdiction, markets, industry")
+    .action(async () => {
+    await runInit(process.cwd());
+});
+program
+    .command("scan")
+    .description("Scan the codebase for data-collection patterns and generate a privacy policy")
+    .option("--json", "output findings as JSON", false)
+    .option("--out <path>", "path to write the generated privacy policy", "PRIVACY_POLICY.md")
+    .option("--no-llm", "skip AI-assisted resolution of ambiguous findings for this run")
+    .action(async (opts) => {
+    await runScan(process.cwd(), { json: opts.json, out: opts.out, llm: opts.llm });
+});
+program.parseAsync(process.argv);

package/dist/cloud/config.d.ts

@@ -0,0 +1,5 @@
+export interface ProtectedLogicEndpoint {
+    baseUrl: string;
+    apiKey: string;
+}
+export declare function resolveProtectedLogicEndpoint(): ProtectedLogicEndpoint;

package/dist/cloud/config.js

@@ -0,0 +1,23 @@
+/**
+ * Protected-logic service endpoint + auth. Not tier-gated (unlike src/llm/*) — this is Layer 1
+ * infrastructure now, needed regardless of free/byok/managed, so it isn't part of SrcLawyerConfig's
+ * tier/llm fields. `SRCLAWYER_PROTECTED_LOGIC_URL` is meant for local development against a
+ * `wrangler dev` instance; real deployments should never need to override it.
+ *
+ * DEFAULT_BASE_URL is the real deployed Worker (srclawyer-rules, tag v0.2.1). DEFAULT_API_KEY is
+ * the real shared free-tier key, matching the Worker's own API_KEY secret (set via `wrangler secret
+ * put API_KEY` on the Worker directly, never as a repo/CI secret). This is a deliberate choice, not
+ * an oversight: it's a low-privilege, purpose-built credential that only grants rate-limited access
+ * to the two protected-logic endpoints — categorically different from a GitHub PAT or a Cloudflare
+ * API token, which must never appear in a public repo. Baking it in here is what gives free-tier
+ * users zero-setup access with no account/key management of their own. Verified end-to-end against
+ * the live Worker (not just wrangler dev) before this was committed.
+ */
+const DEFAULT_BASE_URL = "https://srclawyer-rules.anishjha352.workers.dev";
+const DEFAULT_API_KEY = "dae3d13ec14ab78eeb5bae1398e0bee8fba55f218861860c81aa279c03c64888";
+export function resolveProtectedLogicEndpoint() {
+    return {
+        baseUrl: process.env.SRCLAWYER_PROTECTED_LOGIC_URL ?? DEFAULT_BASE_URL,
+        apiKey: process.env.SRCLAWYER_PROTECTED_LOGIC_API_KEY ?? DEFAULT_API_KEY,
+    };
+}

package/dist/cloud/protectedLogicClient.d.ts

@@ -0,0 +1,38 @@
+import type { Confidence, DataCategory } from "../engine/types.js";
+export interface ProtectedLogicClientOptions {
+    baseUrl: string;
+    apiKey: string;
+    batchSize?: number;
+    timeoutMs?: number;
+}
+export interface ScoreFieldsItem {
+    id: string;
+    lexiconCategory: DataCategory | null;
+    ambiguousName: boolean;
+    runtimeVerified: boolean;
+    siblingConfidentCount: number;
+}
+export interface ScoreFieldsResult {
+    id: string;
+    confidence: Confidence;
+    requiresReview: boolean;
+}
+export interface DetectZodSchemaItem {
+    id: string;
+    codeFragment: string;
+}
+export interface DetectZodSchemaResult {
+    id: string;
+    matched: boolean;
+    fields: Array<{
+        name: string;
+        line: number;
+    }>;
+}
+export interface ProtectedLogicOutcome<T> {
+    results: Map<string, T>;
+    /** Non-null if any batch failed — callers should surface this via ScanResult.protectedLogicWarning. */
+    error: string | null;
+}
+export declare function scoreFields(items: ScoreFieldsItem[], options: ProtectedLogicClientOptions): Promise<ProtectedLogicOutcome<ScoreFieldsResult>>;
+export declare function detectZodSchemas(items: DetectZodSchemaItem[], options: ProtectedLogicClientOptions): Promise<ProtectedLogicOutcome<DetectZodSchemaResult>>;

package/dist/cloud/protectedLogicClient.js

@@ -0,0 +1,71 @@
+/**
+ * Client for the two protected-logic endpoints (see PRODUCT_SPEC.md for the trust-claim language
+ * these calls are bound by). Mirrors resolveAmbiguousFindings.ts's established pattern deliberately:
+ * batch, try/catch per batch, never throw out of this module — a failure here degrades the scan
+ * (safe local fallback + a scan-level warning), it never crashes it.
+ */
+const DEFAULT_BATCH_SIZE = 25;
+const DEFAULT_TIMEOUT_MS = 10_000;
+function chunk(items, size) {
+    const batches = [];
+    for (let i = 0; i < items.length; i += size)
+        batches.push(items.slice(i, i + size));
+    return batches;
+}
+async function postJson(url, apiKey, body, timeoutMs) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/json", "x-api-key": apiKey },
+            body: JSON.stringify(body),
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            throw new Error(`protected-logic request failed (${response.status})`);
+        }
+        return (await response.json());
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export async function scoreFields(items, options) {
+    const results = new Map();
+    if (items.length === 0)
+        return { results, error: null };
+    const batchSize = options.batchSize ?? DEFAULT_BATCH_SIZE;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    let error = null;
+    for (const batch of chunk(items, batchSize)) {
+        try {
+            const response = await postJson(`${options.baseUrl}/v1/score-fields`, options.apiKey, { fields: batch }, timeoutMs);
+            for (const result of response.results)
+                results.set(result.id, result);
+        }
+        catch (err) {
+            error = err instanceof Error ? err.message : String(err);
+        }
+    }
+    return { results, error };
+}
+export async function detectZodSchemas(items, options) {
+    const results = new Map();
+    if (items.length === 0)
+        return { results, error: null };
+    const batchSize = options.batchSize ?? DEFAULT_BATCH_SIZE;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    let error = null;
+    for (const batch of chunk(items, batchSize)) {
+        try {
+            const response = await postJson(`${options.baseUrl}/v1/detect-zod-schema`, options.apiKey, { candidates: batch }, timeoutMs);
+            for (const result of response.results)
+                results.set(result.id, result);
+        }
+        catch (err) {
+            error = err instanceof Error ? err.message : String(err);
+        }
+    }
+    return { results, error };
+}

package/dist/cloud/resolveProtectedLogic.d.ts

@@ -0,0 +1,14 @@
+import type { Finding } from "../engine/types.js";
+import type { ZodCandidate } from "../rules/zodPreFilter.js";
+import { type ProtectedLogicClientOptions } from "./protectedLogicClient.js";
+export interface ResolveProtectedLogicResult {
+    findings: Finding[];
+    warning: string | null;
+}
+/**
+ * The one place that turns "findings with provisional confidence" and "files that might have a Zod
+ * schema" into final results, by calling the protected-logic service. Layered on top of scan() the
+ * same way resolveAmbiguousFindings.ts is layered on top of it for Layer 2 — not called from inside
+ * scan() itself, so scan()'s own purity/auditability claim stays true.
+ */
+export declare function resolveProtectedLogic(findings: Finding[], pendingZodCandidates: ZodCandidate[], options: ProtectedLogicClientOptions): Promise<ResolveProtectedLogicResult>;

package/dist/cloud/resolveProtectedLogic.js

@@ -0,0 +1,67 @@
+import { classifyFieldName, isAmbiguousFieldName } from "../rules/dataCategoryLexicon.js";
+import { countConfidentSiblings } from "../rules/confidenceFactors.js";
+import { detectZodSchemas, scoreFields } from "./protectedLogicClient.js";
+/**
+ * The one place that turns "findings with provisional confidence" and "files that might have a Zod
+ * schema" into final results, by calling the protected-logic service. Layered on top of scan() the
+ * same way resolveAmbiguousFindings.ts is layered on top of it for Layer 2 — not called from inside
+ * scan() itself, so scan()'s own purity/auditability claim stays true.
+ */
+export async function resolveProtectedLogic(findings, pendingZodCandidates, options) {
+    let workingFindings = findings;
+    const warnings = [];
+    if (pendingZodCandidates.length > 0) {
+        const byId = new Map(pendingZodCandidates.map((c) => [c.id, c]));
+        const { results, error } = await detectZodSchemas(pendingZodCandidates.map((c) => ({ id: c.id, codeFragment: c.codeFragment })), options);
+        if (error)
+            warnings.push(`Zod-schema detection unavailable (${error}) — schemas in this scan were not checked.`);
+        const zodFindings = [];
+        for (const [id, result] of results) {
+            const candidate = byId.get(id);
+            if (!candidate || !result.matched || result.fields.length === 0)
+                continue;
+            const allNames = result.fields.map((f) => f.name);
+            for (const field of result.fields) {
+                const sourceLine = candidate.fragmentLineToSourceLine[field.line - 1] ?? field.line;
+                const lexiconCategory = classifyFieldName(field.name);
+                const ambiguousName = isAmbiguousFieldName(field.name);
+                const siblingConfidentCount = countConfidentSiblings(allNames, field.name);
+                zodFindings.push({
+                    id: `zod:${id}:${sourceLine}:${field.name}`,
+                    dataCategories: lexiconCategory ? [lexiconCategory] : ["generic_pii"],
+                    processor: null,
+                    description: lexiconCategory
+                        ? `Zod schema field "${field.name}" collected, classified as ${lexiconCategory}.`
+                        : `Zod schema field "${field.name}" collected; could not confidently classify — needs review.`,
+                    confidence: "low",
+                    source: "zod-rule",
+                    location: { file: id, line: sourceLine, column: 0 },
+                    evidence: "", // the raw fragment already went through redactSecrets(); no further evidence is retained here
+                    requiresReview: true,
+                    confidenceFactors: { lexiconCategory, ambiguousName, runtimeVerified: true, siblingConfidentCount },
+                });
+            }
+        }
+        workingFindings = [...workingFindings, ...zodFindings];
+    }
+    const toScore = workingFindings.filter((f) => !!f.confidenceFactors);
+    if (toScore.length > 0) {
+        const items = toScore.map((f) => ({
+            id: f.id,
+            lexiconCategory: (f.confidenceFactors.lexiconCategory ?? null),
+            ambiguousName: Boolean(f.confidenceFactors.ambiguousName),
+            runtimeVerified: Boolean(f.confidenceFactors.runtimeVerified),
+            siblingConfidentCount: Number(f.confidenceFactors.siblingConfidentCount ?? 0),
+        }));
+        const { results, error } = await scoreFields(items, options);
+        if (error)
+            warnings.push(`Confidence scoring unavailable (${error}) — affected findings kept their safe local default (low confidence, flagged for review).`);
+        workingFindings = workingFindings.map((f) => {
+            const scored = results.get(f.id);
+            if (!scored)
+                return f;
+            return { ...f, confidence: scored.confidence, requiresReview: scored.requiresReview };
+        });
+    }
+    return { findings: workingFindings, warning: warnings.length > 0 ? warnings.join(" ") : null };
+}

package/dist/commands/init.d.ts

@@ -0,0 +1 @@
+export declare function runInit(root: string): Promise<void>;

package/dist/commands/init.js

@@ -0,0 +1,67 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { CONFIG_FILENAME, DEFAULT_CONFIG, configPath, writeConfig } from "../config/config.js";
+function guessIndustry(root) {
+    const pkgPath = join(root, "package.json");
+    if (!existsSync(pkgPath))
+        return null;
+    try {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        if (typeof pkg.description === "string" && pkg.description.length > 0)
+            return pkg.description;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+async function ask(lines, question, fallback) {
+    const suffix = fallback ? ` [${fallback}]` : "";
+    process.stdout.write(`${question}${suffix}: `);
+    const { value, done } = await lines.next();
+    const answer = done ? "" : value.trim();
+    return answer.length > 0 ? answer : fallback;
+}
+export async function runInit(root) {
+    const existingPath = configPath(root);
+    if (existsSync(existingPath)) {
+        console.log(`${CONFIG_FILENAME} already exists. Delete it first if you want to redo setup.`);
+        return;
+    }
+    const guessedIndustry = guessIndustry(root);
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const lines = rl[Symbol.asyncIterator]();
+    console.log("SrcLawyer setup — answered once, reused on every scan.\n");
+    const entityLocation = await ask(lines, "Where is your legal entity located? (country)", DEFAULT_CONFIG.entityLocation ?? "");
+    const targetMarketsRaw = await ask(lines, "Which regions/markets do you serve? (comma-separated, e.g. US, EU)", "");
+    const industry = await ask(lines, "What industry/vertical is this product in?", guessedIndustry ?? "");
+    const childrensDataRaw = await ask(lines, "Does this product knowingly collect data from children under 13/16?", "no");
+    const tierRaw = await ask(lines, "Tier: free (static analysis only) / byok (bring your own Anthropic key) / managed (not yet available)", "free");
+    const tier = normalizeTier(tierRaw);
+    let apiKeyEnvVar = null;
+    if (tier === "byok") {
+        apiKeyEnvVar = await ask(lines, "Which environment variable holds your Anthropic API key?", "ANTHROPIC_API_KEY");
+        console.log(`\nNote: only the name "${apiKeyEnvVar}" is written to ${CONFIG_FILENAME} — the key itself is never written to disk. It's read from your environment at scan time.`);
+    }
+    else if (tier === "managed") {
+        console.log("\nHeads up: the managed tier's hosted backend isn't available yet. Layer 1 (static analysis) will still run fine; AI-assisted resolution will report a clear error until it ships.");
+    }
+    rl.close();
+    const config = {
+        entityLocation: entityLocation || null,
+        targetMarkets: targetMarketsRaw.split(",").map((s) => s.trim()).filter(Boolean),
+        industry: industry || null,
+        collectsChildrensData: /^y(es)?$/i.test(childrensDataRaw.trim()),
+        tier,
+        ...(tier === "byok" ? { llm: { provider: "anthropic", apiKeyEnvVar } } : {}),
+    };
+    writeConfig(root, config);
+    console.log(`\nWrote ${CONFIG_FILENAME}. Run "srclawyer scan" to analyze this codebase.`);
+}
+function normalizeTier(raw) {
+    const normalized = raw.trim().toLowerCase();
+    if (normalized === "byok" || normalized === "managed")
+        return normalized;
+    return "free";
+}

package/dist/commands/scan.d.ts

@@ -0,0 +1,6 @@
+export interface ScanOptions {
+    json: boolean;
+    out: string;
+    llm: boolean;
+}
+export declare function runScan(root: string, options: ScanOptions): Promise<void>;

package/dist/commands/scan.js

@@ -0,0 +1,66 @@
+import { writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { loadConfig } from "../config/config.js";
+import { scan } from "../engine/scanEngine.js";
+import { formatText } from "../report/formatText.js";
+import { generatePolicyMarkdown } from "../policy/generatePolicy.js";
+import { resolveProviderForTier } from "../llm/resolveProviderForTier.js";
+import { resolveAmbiguousFindings } from "../llm/resolveAmbiguousFindings.js";
+import { resolveProtectedLogic } from "../cloud/resolveProtectedLogic.js";
+import { resolveProtectedLogicEndpoint } from "../cloud/config.js";
+export async function runScan(root, options) {
+    const config = loadConfig(root);
+    if (!config) {
+        console.error('No .privacypolicy.yml found. Run "srclawyer init" first.\n');
+    }
+    const result = await scan(root);
+    let findings = result.findings;
+    // Not tier-gated, not behind --no-llm: confidence scoring and Zod-schema detection are Layer 1
+    // capabilities now, needed on every real scan regardless of which LLM tier (if any) is configured.
+    // A failure here degrades honestly (findings keep their safe local fallback) rather than blocking
+    // the scan — see resolveProtectedLogic's own per-call error handling.
+    const hasScorableFindings = findings.some((f) => f.confidenceFactors) || result.pendingZodCandidates.length > 0;
+    let protectedLogicWarning = null;
+    if (hasScorableFindings) {
+        const endpoint = resolveProtectedLogicEndpoint();
+        const resolved = await resolveProtectedLogic(findings, result.pendingZodCandidates, endpoint);
+        findings = resolved.findings;
+        protectedLogicWarning = resolved.warning;
+        if (protectedLogicWarning)
+            console.error(protectedLogicWarning);
+    }
+    let llmError = null;
+    if (options.llm && config) {
+        const { provider, error } = resolveProviderForTier(config);
+        if (error) {
+            llmError = error;
+            console.error(error);
+        }
+        else if (provider) {
+            const ambiguous = findings.filter((f) => f.requiresReview);
+            if (ambiguous.length > 0) {
+                console.log(`Sending ${ambiguous.length} ambiguous item(s) to ${provider.name}...`);
+                const resolved = await resolveAmbiguousFindings(ambiguous, provider, {
+                    collectsChildrensData: config.collectsChildrensData,
+                });
+                const resolvedById = new Map(resolved.map((f) => [f.id, f]));
+                findings = findings.map((f) => resolvedById.get(f.id) ?? f);
+            }
+        }
+    }
+    const ambiguousCount = findings.filter((f) => f.requiresReview).length;
+    const finalResult = { ...result, findings, ambiguousCount };
+    const policyPath = resolve(root, options.out);
+    writeFileSync(policyPath, generatePolicyMarkdown(finalResult, config, llmError));
+    if (result.unsupportedStackWarning || llmError || protectedLogicWarning) {
+        process.exitCode = 1;
+    }
+    if (options.json) {
+        console.log(JSON.stringify({ ...finalResult, policyPath, llmError, protectedLogicWarning }, null, 2));
+        return;
+    }
+    console.log(formatText(finalResult));
+    if (protectedLogicWarning)
+        console.log(`\n${protectedLogicWarning}`);
+    console.log(`\nPrivacy policy written to ${join(options.out)}`);
+}

package/dist/config/config.d.ts

@@ -0,0 +1,18 @@
+export declare const CONFIG_FILENAME = ".privacypolicy.yml";
+export type SrcLawyerTier = "free" | "byok" | "managed";
+export interface SrcLawyerLlmConfig {
+    provider: "anthropic";
+    apiKeyEnvVar: string | null;
+}
+export interface SrcLawyerConfig {
+    entityLocation: string | null;
+    targetMarkets: string[];
+    industry: string | null;
+    collectsChildrensData: boolean;
+    tier?: SrcLawyerTier;
+    llm?: SrcLawyerLlmConfig;
+}
+export declare const DEFAULT_CONFIG: SrcLawyerConfig;
+export declare function configPath(root: string): string;
+export declare function loadConfig(root: string): SrcLawyerConfig | null;
+export declare function writeConfig(root: string, config: SrcLawyerConfig): void;

package/dist/config/config.js

@@ -0,0 +1,26 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import yaml from "js-yaml";
+export const CONFIG_FILENAME = ".privacypolicy.yml";
+export const DEFAULT_CONFIG = {
+    entityLocation: null,
+    targetMarkets: [],
+    industry: null,
+    collectsChildrensData: false,
+    tier: "free",
+};
+export function configPath(root) {
+    return join(root, CONFIG_FILENAME);
+}
+export function loadConfig(root) {
+    const path = configPath(root);
+    if (!existsSync(path))
+        return null;
+    const raw = readFileSync(path, "utf8");
+    return { ...DEFAULT_CONFIG, ...yaml.load(raw) };
+}
+export function writeConfig(root, config) {
+    const path = configPath(root);
+    const header = "# Generated by srclawyer init. Safe to edit by hand.\n";
+    writeFileSync(path, header + yaml.dump(config), "utf8");
+}

package/dist/engine/astUtils.d.ts

@@ -0,0 +1,2 @@
+import type { File } from "@babel/types";
+export declare function parseSource(source: string, filePath: string): File | null;

package/dist/engine/astUtils.js

@@ -0,0 +1,22 @@
+import { parse } from "@babel/parser";
+import { extname } from "node:path";
+export function parseSource(source, filePath) {
+    const ext = extname(filePath);
+    const plugins = ["jsx"];
+    if (ext === ".ts" || ext === ".tsx") {
+        plugins.length = 0;
+        plugins.push("typescript");
+        if (ext === ".tsx")
+            plugins.push("jsx");
+    }
+    try {
+        return parse(source, {
+            sourceType: "unambiguous",
+            plugins,
+            errorRecovery: true,
+        });
+    }
+    catch {
+        return null;
+    }
+}