srclawyer 0.5.0 → 0.6.1

package/dist/engine/languageDetection.js

@@ -1,22 +1,25 @@
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import fg from "fast-glob";
-const IGNORE = ["**/node_modules/**", "**/dist/**", "**/build/**", "**/.git/**", "**/vendor/**"];
-const SUPPORTED_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mjs", "cjs", "html", "htm"];
+const IGNORE = ["**/node_modules/**", "**/dist/**", "**/build/**", "**/.git/**", "**/vendor/**", "**/venv/**", "**/.venv/**", "**/__pycache__/**"];
+// Python moved from UNSUPPORTED_LANGUAGES to here once Flask detection shipped (Stage A) -- it's a
+// supported *language* now, but only one framework within it is actually understood. A Python project
+// using a different framework still needs an honest gap warning; see detectUnsupportedPythonFramework.
+const SUPPORTED_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mjs", "cjs", "html", "htm", "py"];
 const UNSUPPORTED_LANGUAGES = [
-    { label: "Python", extensions: ["py"] },
     { label: "Ruby", extensions: ["rb"] },
     { label: "Go", extensions: ["go"] },
     { label: "Java", extensions: ["java"] },
     { label: "PHP", extensions: ["php"] },
     { label: "C#", extensions: ["cs"] },
 ];
+const FASTAPI_IMPORT = /\bfrom\s+fastapi\b|\bimport\s+fastapi\b/;
 function bannerize(message) {
-    return `UNSUPPORTED CODEBASE — ${message} SrcLawyer only analyzes JavaScript/TypeScript and HTML today; the findings below (if any) are incomplete and MUST NOT be treated as a full compliance scan.`;
+    return `UNSUPPORTED CODEBASE — ${message} SrcLawyer only analyzes JavaScript/TypeScript, HTML, and Flask-based Python today; the findings below (if any) are incomplete and MUST NOT be treated as a full compliance scan.`;
 }
 async function detectFrameworkSignature(root) {
     if (existsSync(join(root, "manage.py"))) {
-        return bannerize("Django detected (manage.py found at the project root).");
+        return bannerize("Django detected (manage.py found at the project root) — Django support isn't built yet.");
     }
     const hasGemfile = existsSync(join(root, "Gemfile"));
     const hasRailsLayout = existsSync(join(root, "config", "routes.rb")) || existsSync(join(root, "app", "controllers"));
@@ -29,6 +32,27 @@ async function detectFrameworkSignature(root) {
     }
     return null;
 }
+/**
+ * Presence-based, like detectFrameworkSignature's manage.py check -- not an absence heuristic ("we
+ * found nothing so something must be wrong"), which can't tell a genuinely clean Flask file apart
+ * from an unsupported framework. Scans actual file content (not just a marker file) since FastAPI,
+ * unlike Django, has no single root-level marker file to check for instead.
+ */
+async function detectUnsupportedPythonFramework(root, pythonFiles) {
+    for (const filePath of pythonFiles) {
+        let content;
+        try {
+            content = readFileSync(filePath, "utf8");
+        }
+        catch {
+            continue;
+        }
+        if (FASTAPI_IMPORT.test(content)) {
+            return bannerize("FastAPI detected (a `fastapi` import was found) — FastAPI support isn't built yet.");
+        }
+    }
+    return null;
+}
 async function detectDominantUnsupportedLanguage(root) {
     const [supportedFiles, ...unsupportedGroups] = await Promise.all([
         fg(SUPPORTED_EXTENSIONS.map((ext) => `**/*.${ext}`), { cwd: root, ignore: IGNORE, dot: false }),
@@ -38,11 +62,17 @@ async function detectDominantUnsupportedLanguage(root) {
     const dominant = counts.filter((c) => c.count > 0).sort((a, b) => b.count - a.count)[0];
     if (!dominant || dominant.count <= supportedFiles.length)
         return null;
-    return bannerize(`${dominant.label} detected as the primary language (${dominant.count} file(s), vs ${supportedFiles.length} supported JS/TS/HTML file(s)).`);
+    return bannerize(`${dominant.label} detected as the primary language (${dominant.count} file(s), vs ${supportedFiles.length} supported file(s)).`);
 }
 export async function detectUnsupportedStack(root) {
     const frameworkWarning = await detectFrameworkSignature(root);
     if (frameworkWarning)
         return frameworkWarning;
+    const pythonFiles = await fg("**/*.py", { cwd: root, absolute: true, ignore: IGNORE, dot: false });
+    if (pythonFiles.length > 0) {
+        const pythonFrameworkWarning = await detectUnsupportedPythonFramework(root, pythonFiles);
+        if (pythonFrameworkWarning)
+            return pythonFrameworkWarning;
+    }
     return detectDominantUnsupportedLanguage(root);
 }

package/dist/engine/pythonAstUtils.d.ts

@@ -0,0 +1,2 @@
+import { type Tree } from "web-tree-sitter";
+export declare function parsePythonSource(source: string): Promise<Tree | null>;

package/dist/engine/pythonAstUtils.js

@@ -0,0 +1,44 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Parser, Language } from "web-tree-sitter";
+// This file compiles to dist/engine/pythonAstUtils.js; the grammar is copied to dist/grammars/ by
+// scripts/copyGrammars.js as part of `npm run build` (see grammars/README.md for why it's vendored
+// rather than an npm dependency).
+const HERE = dirname(fileURLToPath(import.meta.url));
+const GRAMMAR_PATH = join(HERE, "..", "grammars", "tree-sitter-python.wasm");
+// Initialized at most once per process, reused across every Python file in a scan -- mirrors
+// tsProject.ts's lazy-memoized pattern for the same reason (real setup cost, no benefit to repeating
+// it per file). Parser.init()/Language.load() are both async; parser.parse() itself is synchronous
+// once a Parser is set up, and this module's scan-time usage is sequential (not concurrent), so one
+// shared Parser instance is safe to reuse.
+let parserPromise = null;
+function initParser() {
+    if (!parserPromise) {
+        parserPromise = (async () => {
+            try {
+                await Parser.init();
+                const language = await Language.load(GRAMMAR_PATH);
+                const parser = new Parser();
+                parser.setLanguage(language);
+                return parser;
+            }
+            catch {
+                // Honest null, matching astUtils.ts's parseSource -- a missing/incompatible grammar build
+                // degrades this file's detection to nothing rather than crashing the whole scan.
+                return null;
+            }
+        })();
+    }
+    return parserPromise;
+}
+export async function parsePythonSource(source) {
+    const parser = await initParser();
+    if (!parser)
+        return null;
+    try {
+        return parser.parse(source);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/engine/scanEngine.js

@@ -4,10 +4,13 @@ import { discoverProjects } from "./discoverProjects.js";
 import { discoverFiles } from "./discoverFiles.js";
 import { detectUnsupportedStack } from "./languageDetection.js";
 import { parseSource } from "./astUtils.js";
+import { parsePythonSource } from "./pythonAstUtils.js";
 import { runSdkRules } from "../rules/sdkRules.js";
 import { runFrameworkRules } from "../rules/frameworkRules.js";
 import { runWebApiRules } from "../rules/webApiRules.js";
 import { runTypedRequestBodyRules } from "../rules/typedRequestBodyRules.js";
+import { runPythonSdkRules } from "../rules/pythonSdkRules.js";
+import { runPythonFrameworkRules } from "../rules/pythonFrameworkRules.js";
 import { findZodCandidates } from "../rules/zodPreFilter.js";
 import { buildTsProject } from "./tsProject.js";
 import { runHtmlInputRules, extractInlineScripts } from "../rules/htmlRules.js";
@@ -34,9 +37,11 @@ function makeLazyTsProject(files) {
         return handle;
     };
 }
-function runCodeRules(filePath, source, root, getTsProject, zodCandidates) {
+function runCodeRules(filePath, source, root, getTsProject, zodCandidates, oversizedZodFiles) {
     const ast = parseSource(source, filePath);
-    zodCandidates.push(...findZodCandidates(source, filePath, root));
+    const zodResult = findZodCandidates(source, filePath, root);
+    zodCandidates.push(...zodResult.candidates);
+    oversizedZodFiles.push(...zodResult.oversizedFiles);
     if (!ast)
         return [];
     return [
@@ -46,6 +51,12 @@ function runCodeRules(filePath, source, root, getTsProject, zodCandidates) {
         ...runTypedRequestBodyRules(ast, filePath, source, root, getTsProject),
     ];
 }
+async function runPythonCodeRules(filePath, source, root) {
+    const tree = await parsePythonSource(source);
+    if (!tree)
+        return [];
+    return [...runPythonSdkRules(tree, filePath, source, root), ...runPythonFrameworkRules(tree, filePath, source, root)];
+}
 /**
  * Pure, local, offline — no network access anywhere in this function or anything it calls. Zod
  * schemas and confidence scoring can no longer be fully resolved here (see pendingZodCandidates and
@@ -59,10 +70,12 @@ export async function scan(root) {
     const [projects, unsupportedStackWarning] = await Promise.all([discoverProjects(root), detectUnsupportedStack(root)]);
     const findings = [];
     const pendingZodCandidates = [];
+    const oversizedZodFiles = [];
     let filesScanned = 0;
     const projectRootList = [...new Set(projects.map((p) => p.root))];
     const fileSets = await Promise.all(projectRootList.map((projectRoot) => discoverFiles(projectRoot)));
     const allCodeFiles = new Set();
+    const allPythonFiles = new Set();
     const allHtmlFiles = new Set();
     const allSchemaFiles = new Set();
     const rootForFile = new Map();
@@ -74,6 +87,7 @@ export async function scan(root) {
             allCodeFiles.add(f);
             rootForFile.set(f, projectRoot);
         });
+        set.pythonFiles.forEach((f) => allPythonFiles.add(f));
         set.htmlFiles.forEach((f) => allHtmlFiles.add(f));
         set.schemaFiles.forEach((f) => allSchemaFiles.add(f));
     });
@@ -90,7 +104,18 @@ export async function scan(root) {
             continue;
         }
         const getTsProject = tsProjectByRoot.get(rootForFile.get(filePath) ?? "") ?? noTsProject;
-        findings.push(...runCodeRules(filePath, source, root, getTsProject, pendingZodCandidates));
+        findings.push(...runCodeRules(filePath, source, root, getTsProject, pendingZodCandidates, oversizedZodFiles));
+    }
+    for (const filePath of allPythonFiles) {
+        filesScanned += 1;
+        let source;
+        try {
+            source = readFileSync(filePath, "utf8");
+        }
+        catch {
+            continue;
+        }
+        findings.push(...(await runPythonCodeRules(filePath, source, root)));
     }
     for (const filePath of allHtmlFiles) {
         filesScanned += 1;
@@ -103,7 +128,7 @@ export async function scan(root) {
         }
         findings.push(...runHtmlInputRules(html, filePath, root));
         for (const script of extractInlineScripts(html)) {
-            findings.push(...runCodeRules(filePath, script.code, root, noTsProject, pendingZodCandidates));
+            findings.push(...runCodeRules(filePath, script.code, root, noTsProject, pendingZodCandidates, oversizedZodFiles));
         }
     }
     for (const filePath of allSchemaFiles) {
@@ -126,5 +151,17 @@ export async function scan(root) {
         }
     }
     const ambiguousCount = findings.filter((f) => f.requiresReview).length;
-    return { projects, findings, ambiguousCount, filesScanned, unsupportedStackWarning, pendingZodCandidates };
+    const maxZodFragmentBytes = pendingZodCandidates.length
+        ? Math.max(...pendingZodCandidates.map((c) => Buffer.byteLength(c.codeFragment, "utf8")))
+        : 0;
+    return {
+        projects,
+        findings,
+        ambiguousCount,
+        filesScanned,
+        unsupportedStackWarning,
+        pendingZodCandidates,
+        oversizedZodFiles,
+        maxZodFragmentBytes,
+    };
 }

package/dist/engine/types.d.ts

@@ -68,4 +68,13 @@ export interface ScanResult {
         codeFragment: string;
         fragmentLineToSourceLine: number[];
     }>;
+    /** Relative paths of files whose extracted Zod fragment was too large to send safely and was
+     *  dropped before ever reaching pendingZodCandidates -- surfaced in resolveProtectedLogic()'s
+     *  warning so a schema going unchecked is never silent, just like a failed network call is. */
+    oversizedZodFiles: string[];
+    /** The largest pendingZodCandidates fragment's byte size this scan, or 0 if none. Logged by the
+     *  caller so real-world fragment sizes keep being observed against MAX_FRAGMENT_BYTES
+     *  (zodPreFilter.ts) and the batching cap (protectedLogicClient.ts) -- both are provisional,
+     *  unvalidated against the Worker's real limit until its plan upgrade is confirmed. */
+    maxZodFragmentBytes: number;
 }

package/dist/grammars/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 Max Brunsfeld
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/policy/generatePolicy.d.ts

@@ -1,3 +1,3 @@
 import type { ScanResult } from "../engine/types.js";
 import { type SrcLawyerConfig } from "../config/config.js";
-export declare function generatePolicyMarkdown(result: ScanResult, config: SrcLawyerConfig | null, llmError?: string | null): string;
+export declare function generatePolicyMarkdown(result: ScanResult, config: SrcLawyerConfig | null, llmError?: string | null, protectedLogicWarning?: string | null): string;

package/dist/policy/generatePolicy.js

@@ -96,12 +96,122 @@ function renderContextSection(config) {
     lines.push(`- **Entity location:** ${config.entityLocation ?? "not specified"}`);
     lines.push(`- **Target markets:** ${config.targetMarkets.length > 0 ? config.targetMarkets.join(", ") : "not specified"}`);
     lines.push(`- **Industry:** ${config.industry ?? "not specified"}`);
-    lines.push(`- **Collects children's data:** ${config.collectsChildrensData ? "yes" : "no"}`);
+    lines.push(`- **Collects children's data:** ${config.collectsChildrensData === null || config.collectsChildrensData === undefined ? "not specified" : config.collectsChildrensData ? "yes" : "no"}`);
     return lines.join("\n");
 }
 function renderUnsupportedStackWarning(warning) {
     return ["> **WARNING: INCOMPLETE SCAN — DO NOT PUBLISH WITHOUT MANUAL REVIEW**", ">", `> ${warning}`].join("\n");
 }
+// Mirrors renderUnsupportedStackWarning's own reasoning exactly: this policy FILE gets committed and
+// shared on its own, without the CLI output that already shows this warning -- a reader of the file
+// alone has no other way to know confidence grading or Zod-schema detection didn't run for this scan.
+function renderProtectedLogicWarning(warning) {
+    return ["> **WARNING: PROTECTED-LOGIC SERVICE UNAVAILABLE — POLICY MAY BE INCOMPLETE**", ">", `> ${warning}`].join("\n");
+}
+function placeholder(label) {
+    return `[TO COMPLETE: ${label}]`;
+}
+// The one function permitted to record that a fact was never answered -- every new section below
+// goes through this (directly or via valueOrPlaceholder/triStateSentence) so renderPlaceholderSummary
+// can list everything that's missing in one place, without a second pass over the config.
+function placeholderLine(label, placeholders) {
+    placeholders.push(label);
+    return placeholder(label);
+}
+function valueOrPlaceholder(value, label, placeholders) {
+    if (value === null || value === undefined || value === "")
+        return placeholderLine(label, placeholders);
+    return value;
+}
+// Avoids a double terminal punctuation mark when a user-supplied value already ends with one --
+// e.g. a company name ending in "." ("Acme Inc.") or a URL ending in "/" (where appending "." right
+// after the slash reads as part of the path). The placeholder marker itself ends with "]", so this
+// never double-punctuates that either.
+function endSentence(prefix, value) {
+    const trimmed = value.trim();
+    return /[.!?/\]]$/.test(trimmed) ? `${prefix}${trimmed}` : `${prefix}${trimmed}.`;
+}
+function triStateSentence(value, label, trueText, falseText, placeholders) {
+    if (value === true)
+        return trueText;
+    if (value === false)
+        return falseText;
+    return placeholderLine(label, placeholders);
+}
+function renderIdentitySection(config, placeholders) {
+    const companyName = valueOrPlaceholder(config?.companyName, "company or product name", placeholders);
+    const siteUrl = valueOrPlaceholder(config?.siteUrl, "site or app URL", placeholders);
+    const privacyContactEmail = valueOrPlaceholder(config?.privacyContactEmail, "privacy contact email address", placeholders);
+    return [
+        "## About This Policy",
+        "",
+        endSentence("This policy is issued by ", companyName),
+        endSentence("It applies to the product or service available at ", siteUrl),
+        endSentence("Questions about this policy or requests regarding your personal data can be sent to ", privacyContactEmail),
+    ].join("\n");
+}
+// The sell/share and advertising sentences are the highest-risk new text in this document: the policy
+// can simultaneously list detected third-party integrations (e.g. Stripe) in the Third-Party Data
+// Processors section above. These sentences deliberately (1) use CCPA/CPRA's own defined terms rather
+// than casual language, (2) frame the statement as the user's own self-declared setup answer, not a
+// legal conclusion drawn by this tool, and (3) always close with an explicit cross-reference back to
+// the detected-processors section, in all three states (true/false/placeholder), so the two sections
+// are never read in isolation from each other. See docs/legal-wording-review.md -- this is drafted,
+// attorney-reviewable starting wording, not settled language.
+function renderDataPracticesSection(config, placeholders) {
+    const retention = valueOrPlaceholder(config?.dataRetentionPolicy, "data retention period or policy", placeholders);
+    const deletion = valueOrPlaceholder(config?.accountDeletionInstructions, "how a user can delete their account or request data deletion", placeholders);
+    const sellShare = triStateSentence(config?.sellsOrSharesData, 'whether personal data is sold or shared with third parties, as "sell" and "share" are defined under applicable law (e.g. CCPA/CPRA)', 'Based on information provided during setup, this product has been declared to sell or share personal data with third parties, as "sell" and "share" are defined under applicable law (e.g. CCPA/CPRA).', 'Based on information provided during setup, this product has not been declared to sell or share personal data with third parties, as "sell" and "share" are defined under applicable law (e.g. CCPA/CPRA).', placeholders);
+    const advertising = triStateSentence(config?.usesDataForAdvertising, "whether personal data is used for cross-context behavioral advertising", "Based on information provided during setup, this product has been declared to use personal data for cross-context behavioral advertising.", "Based on information provided during setup, this product has not been declared to use personal data for cross-context behavioral advertising.", placeholders);
+    const aiServices = triStateSentence(config?.sendsDataToAiServices, "whether user data is sent to third-party AI services as part of this product's own functionality", "User data may be sent to third-party AI services as part of this product's own functionality.", "User data is not sent to third-party AI services as part of this product's own functionality.", placeholders);
+    return [
+        "## Data Retention, Deletion, and Use",
+        "",
+        `Personal data is retained as follows: ${retention}`,
+        `To delete your account or request deletion of your personal data: ${deletion}`,
+        sellShare,
+        advertising,
+        "See the Third-Party Data Processors section above for the specific third-party integrations detected in this codebase; the declarations above describe this product's own stated practices and do not override what was actually detected there.",
+        aiServices,
+    ].join("\n");
+}
+function renderRightsSection(config, placeholders) {
+    const euUk = config?.hasEuUkUsers;
+    const california = config?.hasCaliforniaUsers;
+    if (euUk === false && california === false) {
+        return ["## Your Rights", "", "This product has not declared users in jurisdictions with additional statutory privacy rights (EU/UK, California)."].join("\n");
+    }
+    const lines = ["## Your Rights", ""];
+    if (euUk === true) {
+        lines.push("If you are located in the EU or UK, you may have rights under the GDPR and/or UK GDPR, including the right to access, correct, delete, or restrict the use of your personal data.");
+    }
+    else if (euUk !== false) {
+        lines.push(placeholderLine("whether this product has users in the EU/UK, which determines whether GDPR/UK GDPR disclosures apply", placeholders));
+    }
+    if (california === true) {
+        lines.push("If you are a California resident, you may have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the sale or sharing of your personal data.");
+    }
+    else if (california !== false) {
+        lines.push(placeholderLine("whether this product has users in California, which determines whether CCPA/CPRA disclosures apply", placeholders));
+    }
+    return lines.join("\n");
+}
+function renderChildrensPrivacySection(config, placeholders) {
+    const collects = config?.collectsChildrensData;
+    const collectsLine = triStateSentence(collects, "whether this product knowingly collects personal data from children", "This product knowingly collects personal data from children under applicable age thresholds (e.g. under 13 in the US, under 16 in the EU where applicable).", "This product does not knowingly collect personal data from children under applicable age thresholds.", placeholders);
+    const minimumAge = config?.minimumAge;
+    const ageLine = minimumAge === null || minimumAge === undefined
+        ? placeholderLine("minimum age required to use this product, if any", placeholders)
+        : `Users must be at least ${minimumAge} years old to use this product.`;
+    return ["## Children's Privacy", "", collectsLine, ageLine].join("\n");
+}
+function renderPlaceholderSummary(labels) {
+    const lines = ["## Placeholders — Complete Before Publishing", ""];
+    for (const label of labels) {
+        lines.push(`- ${placeholder(label)}`);
+    }
+    return lines.join("\n");
+}
 function outcomeOf(finding) {
     if (!finding.requiresReview)
         return "confident";
@@ -111,21 +221,34 @@ function outcomeOf(finding) {
         return "declined";
     return "unresolved";
 }
-export function generatePolicyMarkdown(result, config, llmError) {
+export function generatePolicyMarkdown(result, config, llmError, protectedLogicWarning) {
     const confidentFindings = result.findings.filter((f) => {
         const outcome = outcomeOf(f);
         return outcome === "confident" || outcome === "resolved";
     });
     const declinedFindings = result.findings.filter((f) => outcomeOf(f) === "declined");
     const reviewFindings = result.findings.filter((f) => outcomeOf(f) === "unresolved");
+    // Rendered first (before the final parts[] is assembled) so the shared placeholders array is fully
+    // populated in time for the top-of-document summary below.
+    const placeholders = [];
+    const identitySection = renderIdentitySection(config, placeholders);
+    const dataPracticesSection = renderDataPracticesSection(config, placeholders);
+    const rightsSection = renderRightsSection(config, placeholders);
+    const childrensPrivacySection = renderChildrensPrivacySection(config, placeholders);
     const parts = ["# Privacy Policy", ""];
     if (result.unsupportedStackWarning) {
         parts.push(renderUnsupportedStackWarning(result.unsupportedStackWarning), "");
     }
+    if (protectedLogicWarning) {
+        parts.push(renderProtectedLogicWarning(protectedLogicWarning), "");
+    }
     if (llmError) {
         parts.push(renderLlmErrorWarning(llmError), "");
     }
-    parts.push(`_Generated by SrcLawyer from static analysis of this codebase (${result.filesScanned} file(s) scanned)._`, "", renderContextSection(config), "", "## Data We Collect", "");
+    if (placeholders.length > 0) {
+        parts.push(renderPlaceholderSummary([...new Set(placeholders)]), "");
+    }
+    parts.push(`_Generated by SrcLawyer from static analysis of this codebase (${result.filesScanned} file(s) scanned)._`, "", renderContextSection(config), "", identitySection, "", "## Data We Collect", "");
     const categorySections = renderCategorySections(confidentFindings);
     if (categorySections.length > 0) {
         parts.push(categorySections.join("\n\n"));
@@ -140,6 +263,7 @@ export function generatePolicyMarkdown(result, config, llmError) {
     if (processorSection) {
         parts.push("", processorSection);
     }
+    parts.push("", dataPracticesSection, "", rightsSection, "", childrensPrivacySection);
     const declinedSection = renderDeclinedSection(declinedFindings);
     if (declinedSection) {
         parts.push("", declinedSection);

package/dist/policy/legalNotices.d.ts

@@ -0,0 +1,5 @@
+export declare const PRIVACY_POLICY_URL = "https://github.com/SrcLawyer/srclawyer#legal";
+export declare const TERMS_URL = "https://github.com/SrcLawyer/srclawyer#legal";
+export declare const NETWORK_CALLS_NOTICE: string;
+export declare const SCAN_DISCLAIMER_REMINDER = "Reminder: this is automated analysis, not legal advice \u2014 review the generated policy before publishing it.";
+export declare function byokNetworkNotice(apiKeyEnvVar: string | null): string;

package/dist/policy/legalNotices.js

@@ -0,0 +1,29 @@
+// No dedicated privacy-policy/terms site exists yet -- these point at the real, resolvable README
+// "Legal" section that covers the same ground today (not a placeholder or a dead `.invalid` link), and
+// should be repointed to a real site once one exists. Kept as named constants precisely so there's one
+// place to update when that happens -- a one-line change, not a hunt through every call site.
+//
+// Deliberately NOT labeled "Privacy policy:" / "Terms:" below: that would claim those documents exist
+// at this URL, when the Legal section itself says plainly that they don't yet -- this points at a
+// notice and disclaimer, not a substitute for either.
+export const PRIVACY_POLICY_URL = "https://github.com/SrcLawyer/srclawyer#legal";
+export const TERMS_URL = "https://github.com/SrcLawyer/srclawyer#legal";
+// Verbatim from README.md's own "Network calls" section (minus markdown backticks, since this prints
+// to a terminal) -- one wording for this claim, not a second paraphrase that can drift from the first.
+export const NETWORK_CALLS_NOTICE = [
+    "Heads up: SrcLawyer makes network calls.",
+    "",
+    "Detection itself is fully local and offline — no code leaves your machine for pattern matching.",
+    "Once detection completes, scan makes one batched network call to grade the confidence of what it",
+    "found (field names and derived yes/no signals only, never source code), and, for scans that use Zod",
+    "schemas as request validators, one additional call sending a small redacted code fragment. This runs",
+    "on every scan regardless of tier.",
+    "",
+    `Legal notice and disclaimer: ${PRIVACY_POLICY_URL}`,
+    "(A dedicated privacy policy and terms of service are coming; this points to what exists today.)",
+].join("\n");
+export const SCAN_DISCLAIMER_REMINDER = "Reminder: this is automated analysis, not legal advice — review the generated policy before publishing it.";
+export function byokNetworkNotice(apiKeyEnvVar) {
+    const keySource = apiKeyEnvVar ? `env var ${apiKeyEnvVar}` : "your configured key";
+    return `BYOK is configured: redacted code snippets for ambiguous findings will be sent to Anthropic under your own API key (${keySource}), for AI-assisted classification only.`;
+}

package/dist/report/formatText.js

@@ -38,7 +38,7 @@ export function formatText(result) {
     }
     else if (result.ambiguousCount > 0) {
         lines.push("");
-        lines.push(`${result.ambiguousCount} item(s) require deeper analysis before they can be included in a policy. Run "srclawyer scan" with a "byok"/"managed" tier configured to attempt AI-assisted resolution, or resolve manually.`);
+        lines.push(`${result.ambiguousCount} item(s) require deeper analysis before they can be included in a policy. Run "srclawyer scan" with the "byok" tier configured (bring your own Anthropic key) to attempt AI-assisted resolution, or resolve manually. A "managed" tier is planned but not yet available.`);
     }
     return lines.join("\n");
 }

package/dist/rules/dataCategoryLexicon.js

@@ -1,9 +1,15 @@
 const LEXICON = [
     { pattern: /email/i, category: "email" },
-    // Checked before the generic "name" pattern below: bank_name/account_holder_name end in
-    // "name" and would otherwise be classified as just "name", losing the payment-specific signal.
     { pattern: /bank[ _-]?name|routing[ _-]?number|account[ _-]?holder|iban|swift[ _-]?code/i, category: "payment_info" },
-    { pattern: /(full)?name$|firstname|lastname|surname/i, category: "name" },
+    // Anchored to the whole field name, not a bare "...name$" suffix match: the old pattern matched
+    // ANY field ending in "name" -- hostname, filename, directoryName, className, teamName, etc. -- none
+    // of which are a person's name. This matches only "name" itself and the known person-name
+    // decompositions (first/last/middle/maiden/nick/display/legal name, username), each allowing an
+    // optional separator (first_name, firstName, first-name). A compound this doesn't recognize falls
+    // through with no category match, landing in the same "could not confidently classify — needs
+    // review" path as any other unclassified field -- not the safe list, not a new discard path, just
+    // the existing honest-ambiguity treatment.
+    { pattern: /^(full|first|middle|last|sur|maiden|nick|display|legal)[\s_-]*name$|^name$|^user[\s_-]*name$/i, category: "name" },
     { pattern: /phone|mobile|telephone/i, category: "phone" },
     { pattern: /address|street|city|zip ?code|postal ?code/i, category: "physical_address" },
     { pattern: /card ?number|creditcard|cvv|cvc|cardholder/i, category: "payment_info" },