srclawyer 0.6.0 → 0.6.1

package/dist/cli.js

@@ -16,9 +16,51 @@ program
     .version(version);
 program
     .command("init")
-    .description("One-time setup: jurisdiction, markets, industry")
-    .action(async () => {
-    await runInit(process.cwd());
+    .description("One-time setup: jurisdiction, markets, industry, and optional policy details (company info, data practices, regional rights)")
+    .option("--policy-details", "ask the optional policy-detail questions (company info, data practices, regional rights)")
+    .option("--no-policy-details", "skip all optional policy-detail questions, leaving them unanswered")
+    .option("--collects-childrens-data", "declare that this product knowingly collects data from children under 13/16")
+    .option("--no-collects-childrens-data", "declare that this product does not knowingly collect data from children under 13/16")
+    .option("--company-name <name>", "company or product name")
+    .option("--site-url <url>", "site or app URL")
+    .option("--privacy-contact-email <email>", "privacy contact email address")
+    .option("--eu-uk-users", "declare that this product has users in the EU/UK")
+    .option("--no-eu-uk-users", "declare that this product has no users in the EU/UK")
+    .option("--california-users", "declare that this product has users in California")
+    .option("--no-california-users", "declare that this product has no users in California")
+    .option("--sells-or-shares-data", "declare that personal data is sold or shared with third parties")
+    .option("--no-sells-or-shares-data", "declare that personal data is not sold or shared with third parties")
+    .option("--uses-data-for-advertising", "declare that personal data is used for advertising")
+    .option("--no-uses-data-for-advertising", "declare that personal data is not used for advertising")
+    .option("--data-retention-policy <text>", "how long personal data is retained")
+    .option("--account-deletion-instructions <text>", "how a user can delete their account or request data deletion")
+    .option("--minimum-age <number>", "minimum age required to use this product")
+    .option("--sends-data-to-ai-services", "declare that user data is sent to third-party AI services")
+    .option("--no-sends-data-to-ai-services", "declare that user data is not sent to third-party AI services")
+    .action(async (opts) => {
+    let minimumAge;
+    if (opts.minimumAge !== undefined) {
+        const parsed = Number(opts.minimumAge);
+        if (!Number.isInteger(parsed) || parsed < 0) {
+            program.error(`error: --minimum-age must be a whole, non-negative number (got "${opts.minimumAge}")`);
+        }
+        minimumAge = parsed;
+    }
+    await runInit(process.cwd(), {
+        policyDetails: opts.policyDetails,
+        collectsChildrensData: opts.collectsChildrensData,
+        companyName: opts.companyName,
+        siteUrl: opts.siteUrl,
+        privacyContactEmail: opts.privacyContactEmail,
+        euUkUsers: opts.euUkUsers,
+        californiaUsers: opts.californiaUsers,
+        sellsOrSharesData: opts.sellsOrSharesData,
+        usesDataForAdvertising: opts.usesDataForAdvertising,
+        dataRetentionPolicy: opts.dataRetentionPolicy,
+        accountDeletionInstructions: opts.accountDeletionInstructions,
+        minimumAge,
+        sendsDataToAiServices: opts.sendsDataToAiServices,
+    });
 });
 program
     .command("scan")

package/dist/commands/init.d.ts

@@ -1 +1,16 @@
-export declare function runInit(root: string): Promise<void>;
+export interface InitFlags {
+    policyDetails?: boolean;
+    collectsChildrensData?: boolean;
+    companyName?: string;
+    siteUrl?: string;
+    privacyContactEmail?: string;
+    euUkUsers?: boolean;
+    californiaUsers?: boolean;
+    sellsOrSharesData?: boolean;
+    usesDataForAdvertising?: boolean;
+    dataRetentionPolicy?: string;
+    accountDeletionInstructions?: string;
+    minimumAge?: number;
+    sendsDataToAiServices?: boolean;
+}
+export declare function runInit(root: string, flags?: InitFlags): Promise<void>;

package/dist/commands/init.js

@@ -24,7 +24,62 @@ async function ask(lines, question, fallback) {
     const answer = done ? "" : value.trim();
     return answer.length > 0 ? answer : fallback;
 }
-export async function runInit(root) {
+async function askOptional(lines, question) {
+    process.stdout.write(`${question} (optional, press Enter to skip): `);
+    const { value, done } = await lines.next();
+    const answer = done ? "" : value.trim();
+    return answer.length > 0 ? answer : null;
+}
+// suggested, when not null, is shown as the bracketed default and adopted on a blank answer -- used
+// to prefill EU/UK and California questions from targetMarkets without ever forcing an answer. When
+// suggested is null (no signal), blank means genuinely unanswered, same as every other optional field.
+async function askYesNoOptional(lines, question, suggested = null) {
+    const suffix = suggested === null ? " (y/n, optional, press Enter to skip)" : ` [${suggested ? "y" : "n"}]`;
+    process.stdout.write(`${question}${suffix}: `);
+    const { value, done } = await lines.next();
+    const answer = done ? "" : value.trim().toLowerCase();
+    if (answer.length === 0)
+        return suggested;
+    return /^y(es)?$/.test(answer);
+}
+async function askOptionalAge(lines, question) {
+    const raw = await askOptional(lines, question);
+    if (raw === null)
+        return null;
+    const parsed = Number(raw);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+        console.log(`  (Could not read "${raw}" as a whole, non-negative number -- skipping. You can set this later by editing ${CONFIG_FILENAME}.)`);
+        return null;
+    }
+    return parsed;
+}
+// Generic resolution order for every new optional field: an explicit flag always wins outright;
+// otherwise the field is only asked if the policy-details gate resolved to yes; otherwise it's null.
+async function resolveField(flagValue, gateYes, askFn) {
+    if (flagValue !== undefined)
+        return flagValue;
+    if (!gateYes)
+        return null;
+    return askFn();
+}
+const EU_UK_TOKENS = new Set(["eu", "uk", "gb", "eea", "european union", "united kingdom"]);
+const CALIFORNIA_TOKENS = new Set(["ca", "california", "us-ca"]);
+function targetMarketsSuggestEuUk(markets) {
+    return markets.some((m) => EU_UK_TOKENS.has(m.trim().toLowerCase()));
+}
+function targetMarketsSuggestCalifornia(markets) {
+    return markets.some((m) => CALIFORNIA_TOKENS.has(m.trim().toLowerCase()));
+}
+// Only warns in the one direction that's a real contradiction: target markets signal a region, but
+// the final answer explicitly denies it. The reverse (no signal, but the user says yes) isn't a
+// contradiction -- targetMarkets is free text and was never meant to be an exhaustive jurisdiction
+// list. Never blocks or overrides -- the explicit answer always stands, this only warns.
+function warnIfContradictsTargetMarkets(label, finalValue, suggestedFromMarkets) {
+    if (suggestedFromMarkets && finalValue === false) {
+        console.log(`\nWarning: your target markets suggest ${label} users, but you indicated none -- the generated policy will omit ${label}-specific disclosures. Re-run init or edit ${CONFIG_FILENAME} if this is incorrect.\n`);
+    }
+}
+export async function runInit(root, flags = {}) {
     const existingPath = configPath(root);
     if (existsSync(existingPath)) {
         console.log(`${CONFIG_FILENAME} already exists. Delete it first if you want to redo setup.`);
@@ -43,37 +98,66 @@ export async function runInit(root) {
     console.log("SrcLawyer setup — answered once, reused on every scan.\n");
     const entityLocation = await ask(lines, "Where is your legal entity located? (country)", DEFAULT_CONFIG.entityLocation ?? "");
     const targetMarketsRaw = await ask(lines, "Which regions/markets do you serve? (comma-separated, e.g. US, EU)", "");
+    const targetMarkets = targetMarketsRaw.split(",").map((s) => s.trim()).filter(Boolean);
     const industry = await ask(lines, "What industry/vertical is this product in?", guessedIndustry ?? "");
-    const childrensDataRaw = await ask(lines, "Does this product knowingly collect data from children under 13/16?", "no");
+    const gateYes = flags.policyDetails !== undefined
+        ? flags.policyDetails
+        : /^y(es)?$/i.test((await ask(lines, "Add privacy policy details now? (company info, data practices, regional rights, etc.)", "y")).trim());
+    // Deliberately requires an explicit y/n -- a bare Enter, empty stdin, or a declined gate must leave
+    // this null (unanswered, rendered as a placeholder), never silently "no". Unlike askOptional's other
+    // callers, there is no safe default here: "no" is itself a real, consequential legal declaration, not
+    // a neutral fallback. Layer 2's high-stakes override (scan.ts) coerces null to false at its one call
+    // site, so leaving this unanswered never weakens that safety check -- see childrensDataOverride.test.ts.
+    const collectsChildrensData = await resolveField(flags.collectsChildrensData, gateYes, () => askYesNoOptional(lines, "Does this product knowingly collect data from children under 13/16?"));
+    const minimumAge = await resolveField(flags.minimumAge, gateYes, () => askOptionalAge(lines, "Minimum age required to use this product"));
+    const companyName = await resolveField(flags.companyName, gateYes, () => askOptional(lines, "Company or product name"));
+    const siteUrl = await resolveField(flags.siteUrl, gateYes, () => askOptional(lines, "Site or app URL"));
+    const privacyContactEmail = await resolveField(flags.privacyContactEmail, gateYes, () => askOptional(lines, "Privacy contact email"));
+    const euUkSuggested = targetMarketsSuggestEuUk(targetMarkets);
+    const hasEuUkUsers = await resolveField(flags.euUkUsers, gateYes, () => askYesNoOptional(lines, "Do you have users in the EU/UK?", euUkSuggested ? true : null));
+    warnIfContradictsTargetMarkets("EU/UK", hasEuUkUsers, euUkSuggested);
+    const californiaSuggested = targetMarketsSuggestCalifornia(targetMarkets);
+    const hasCaliforniaUsers = await resolveField(flags.californiaUsers, gateYes, () => askYesNoOptional(lines, "Do you have users in California?", californiaSuggested ? true : null));
+    warnIfContradictsTargetMarkets("California", hasCaliforniaUsers, californiaSuggested);
+    const sellsOrSharesData = await resolveField(flags.sellsOrSharesData, gateYes, () => askYesNoOptional(lines, "Does this product sell or share personal data with third parties?"));
+    const usesDataForAdvertising = await resolveField(flags.usesDataForAdvertising, gateYes, () => askYesNoOptional(lines, "Does this product use personal data for advertising?"));
+    const dataRetentionPolicy = await resolveField(flags.dataRetentionPolicy, gateYes, () => askOptional(lines, "How long is personal data retained?"));
+    const accountDeletionInstructions = await resolveField(flags.accountDeletionInstructions, gateYes, () => askOptional(lines, "How can a user delete their account or request data deletion?"));
+    // Deliberately about the SCANNED PRODUCT's own behavior (does it send its end-users' data to AI
+    // services as part of its own functionality) -- not about SrcLawyer's own, separately-documented
+    // BYOK network calls described in NETWORK_CALLS_NOTICE above.
+    const sendsDataToAiServices = await resolveField(flags.sendsDataToAiServices, gateYes, () => askYesNoOptional(lines, "Does this product send user data to third-party AI services (e.g. OpenAI, Anthropic) as part of its own functionality?"));
     // "managed" is deliberately not offered here -- it's a real SrcLawyerTier value and config.ts/
     // resolveProviderForTier.ts both still support it fully (a hand-edited config with tier: managed
     // still gets a clear, accurate error at scan time), but there's no advertised path to it from this
     // prompt, so a tester reading the choices here can't select a dead end during setup.
-    const tierRaw = await ask(lines, "Tier: free (static analysis only) / byok (bring your own Anthropic key)", "free");
-    const tier = normalizeTier(tierRaw);
+    const enableByokRaw = await ask(lines, "Enable optional AI-assisted review with your own Anthropic key? (advanced)", "n");
+    const tier = /^y(es)?$/i.test(enableByokRaw.trim()) ? "byok" : "free";
     let apiKeyEnvVar = null;
     if (tier === "byok") {
         apiKeyEnvVar = await ask(lines, "Which environment variable holds your Anthropic API key?", "ANTHROPIC_API_KEY");
         console.log(`\nNote: only the name "${apiKeyEnvVar}" is written to ${CONFIG_FILENAME} — the key itself is never written to disk. It's read from your environment at scan time.`);
     }
-    else if (tier === "managed") {
-        console.log("\nHeads up: the managed tier's hosted backend isn't available yet. Layer 1 (static analysis) will still run fine; AI-assisted resolution will report a clear error until it ships.");
-    }
     rl.close();
     const config = {
         entityLocation: entityLocation || null,
-        targetMarkets: targetMarketsRaw.split(",").map((s) => s.trim()).filter(Boolean),
+        targetMarkets,
         industry: industry || null,
-        collectsChildrensData: /^y(es)?$/i.test(childrensDataRaw.trim()),
+        collectsChildrensData,
         tier,
         ...(tier === "byok" ? { llm: { provider: "anthropic", apiKeyEnvVar } } : {}),
+        companyName,
+        siteUrl,
+        privacyContactEmail,
+        hasEuUkUsers,
+        hasCaliforniaUsers,
+        sellsOrSharesData,
+        usesDataForAdvertising,
+        dataRetentionPolicy,
+        accountDeletionInstructions,
+        minimumAge,
+        sendsDataToAiServices,
     };
     writeConfig(root, config);
     console.log(`\nWrote ${CONFIG_FILENAME}. Run "srclawyer scan" to analyze this codebase.`);
 }
-function normalizeTier(raw) {
-    const normalized = raw.trim().toLowerCase();
-    if (normalized === "byok" || normalized === "managed")
-        return normalized;
-    return "free";
-}

package/dist/commands/scan.js

@@ -56,7 +56,11 @@ export async function runScan(root, options) {
                 }
                 console.log(`Sending ${ambiguous.length} ambiguous item(s) to ${provider.name}...`);
                 const resolved = await resolveAmbiguousFindings(ambiguous, provider, {
-                    collectsChildrensData: config.collectsChildrensData,
+                    // Preserves today's exact override behavior bit-for-bit: a missing/legacy key already
+                    // behaved as false before collectsChildrensData became nullable. Only the generated
+                    // document (generatePolicy.ts) distinguishes "explicitly no" from "never answered" -- this
+                    // safety-critical override is unchanged.
+                    collectsChildrensData: config.collectsChildrensData ?? false,
                 });
                 const resolvedById = new Map(resolved.map((f) => [f.id, f]));
                 findings = findings.map((f) => resolvedById.get(f.id) ?? f);

package/dist/config/config.d.ts

@@ -10,9 +10,20 @@ export interface SrcLawyerConfig {
     entityLocation: string | null;
     targetMarkets: string[];
     industry: string | null;
-    collectsChildrensData: boolean;
+    collectsChildrensData: boolean | null;
     tier?: SrcLawyerTier;
     llm?: SrcLawyerLlmConfig;
+    companyName?: string | null;
+    siteUrl?: string | null;
+    privacyContactEmail?: string | null;
+    hasEuUkUsers?: boolean | null;
+    hasCaliforniaUsers?: boolean | null;
+    sellsOrSharesData?: boolean | null;
+    usesDataForAdvertising?: boolean | null;
+    dataRetentionPolicy?: string | null;
+    accountDeletionInstructions?: string | null;
+    minimumAge?: number | null;
+    sendsDataToAiServices?: boolean | null;
 }
 export declare const DEFAULT_CONFIG: SrcLawyerConfig;
 export declare function configPath(root: string): string;

package/dist/config/config.js

@@ -8,8 +8,19 @@ export const DEFAULT_CONFIG = {
     entityLocation: null,
     targetMarkets: [],
     industry: null,
-    collectsChildrensData: false,
+    collectsChildrensData: null,
     tier: "free",
+    companyName: null,
+    siteUrl: null,
+    privacyContactEmail: null,
+    hasEuUkUsers: null,
+    hasCaliforniaUsers: null,
+    sellsOrSharesData: null,
+    usesDataForAdvertising: null,
+    dataRetentionPolicy: null,
+    accountDeletionInstructions: null,
+    minimumAge: null,
+    sendsDataToAiServices: null,
 };
 export function configPath(root) {
     return join(root, CONFIG_FILENAME);

package/dist/policy/generatePolicy.js

@@ -96,7 +96,7 @@ function renderContextSection(config) {
     lines.push(`- **Entity location:** ${config.entityLocation ?? "not specified"}`);
     lines.push(`- **Target markets:** ${config.targetMarkets.length > 0 ? config.targetMarkets.join(", ") : "not specified"}`);
     lines.push(`- **Industry:** ${config.industry ?? "not specified"}`);
-    lines.push(`- **Collects children's data:** ${config.collectsChildrensData ? "yes" : "no"}`);
+    lines.push(`- **Collects children's data:** ${config.collectsChildrensData === null || config.collectsChildrensData === undefined ? "not specified" : config.collectsChildrensData ? "yes" : "no"}`);
     return lines.join("\n");
 }
 function renderUnsupportedStackWarning(warning) {
@@ -108,6 +108,110 @@ function renderUnsupportedStackWarning(warning) {
 function renderProtectedLogicWarning(warning) {
     return ["> **WARNING: PROTECTED-LOGIC SERVICE UNAVAILABLE — POLICY MAY BE INCOMPLETE**", ">", `> ${warning}`].join("\n");
 }
+function placeholder(label) {
+    return `[TO COMPLETE: ${label}]`;
+}
+// The one function permitted to record that a fact was never answered -- every new section below
+// goes through this (directly or via valueOrPlaceholder/triStateSentence) so renderPlaceholderSummary
+// can list everything that's missing in one place, without a second pass over the config.
+function placeholderLine(label, placeholders) {
+    placeholders.push(label);
+    return placeholder(label);
+}
+function valueOrPlaceholder(value, label, placeholders) {
+    if (value === null || value === undefined || value === "")
+        return placeholderLine(label, placeholders);
+    return value;
+}
+// Avoids a double terminal punctuation mark when a user-supplied value already ends with one --
+// e.g. a company name ending in "." ("Acme Inc.") or a URL ending in "/" (where appending "." right
+// after the slash reads as part of the path). The placeholder marker itself ends with "]", so this
+// never double-punctuates that either.
+function endSentence(prefix, value) {
+    const trimmed = value.trim();
+    return /[.!?/\]]$/.test(trimmed) ? `${prefix}${trimmed}` : `${prefix}${trimmed}.`;
+}
+function triStateSentence(value, label, trueText, falseText, placeholders) {
+    if (value === true)
+        return trueText;
+    if (value === false)
+        return falseText;
+    return placeholderLine(label, placeholders);
+}
+function renderIdentitySection(config, placeholders) {
+    const companyName = valueOrPlaceholder(config?.companyName, "company or product name", placeholders);
+    const siteUrl = valueOrPlaceholder(config?.siteUrl, "site or app URL", placeholders);
+    const privacyContactEmail = valueOrPlaceholder(config?.privacyContactEmail, "privacy contact email address", placeholders);
+    return [
+        "## About This Policy",
+        "",
+        endSentence("This policy is issued by ", companyName),
+        endSentence("It applies to the product or service available at ", siteUrl),
+        endSentence("Questions about this policy or requests regarding your personal data can be sent to ", privacyContactEmail),
+    ].join("\n");
+}
+// The sell/share and advertising sentences are the highest-risk new text in this document: the policy
+// can simultaneously list detected third-party integrations (e.g. Stripe) in the Third-Party Data
+// Processors section above. These sentences deliberately (1) use CCPA/CPRA's own defined terms rather
+// than casual language, (2) frame the statement as the user's own self-declared setup answer, not a
+// legal conclusion drawn by this tool, and (3) always close with an explicit cross-reference back to
+// the detected-processors section, in all three states (true/false/placeholder), so the two sections
+// are never read in isolation from each other. See docs/legal-wording-review.md -- this is drafted,
+// attorney-reviewable starting wording, not settled language.
+function renderDataPracticesSection(config, placeholders) {
+    const retention = valueOrPlaceholder(config?.dataRetentionPolicy, "data retention period or policy", placeholders);
+    const deletion = valueOrPlaceholder(config?.accountDeletionInstructions, "how a user can delete their account or request data deletion", placeholders);
+    const sellShare = triStateSentence(config?.sellsOrSharesData, 'whether personal data is sold or shared with third parties, as "sell" and "share" are defined under applicable law (e.g. CCPA/CPRA)', 'Based on information provided during setup, this product has been declared to sell or share personal data with third parties, as "sell" and "share" are defined under applicable law (e.g. CCPA/CPRA).', 'Based on information provided during setup, this product has not been declared to sell or share personal data with third parties, as "sell" and "share" are defined under applicable law (e.g. CCPA/CPRA).', placeholders);
+    const advertising = triStateSentence(config?.usesDataForAdvertising, "whether personal data is used for cross-context behavioral advertising", "Based on information provided during setup, this product has been declared to use personal data for cross-context behavioral advertising.", "Based on information provided during setup, this product has not been declared to use personal data for cross-context behavioral advertising.", placeholders);
+    const aiServices = triStateSentence(config?.sendsDataToAiServices, "whether user data is sent to third-party AI services as part of this product's own functionality", "User data may be sent to third-party AI services as part of this product's own functionality.", "User data is not sent to third-party AI services as part of this product's own functionality.", placeholders);
+    return [
+        "## Data Retention, Deletion, and Use",
+        "",
+        `Personal data is retained as follows: ${retention}`,
+        `To delete your account or request deletion of your personal data: ${deletion}`,
+        sellShare,
+        advertising,
+        "See the Third-Party Data Processors section above for the specific third-party integrations detected in this codebase; the declarations above describe this product's own stated practices and do not override what was actually detected there.",
+        aiServices,
+    ].join("\n");
+}
+function renderRightsSection(config, placeholders) {
+    const euUk = config?.hasEuUkUsers;
+    const california = config?.hasCaliforniaUsers;
+    if (euUk === false && california === false) {
+        return ["## Your Rights", "", "This product has not declared users in jurisdictions with additional statutory privacy rights (EU/UK, California)."].join("\n");
+    }
+    const lines = ["## Your Rights", ""];
+    if (euUk === true) {
+        lines.push("If you are located in the EU or UK, you may have rights under the GDPR and/or UK GDPR, including the right to access, correct, delete, or restrict the use of your personal data.");
+    }
+    else if (euUk !== false) {
+        lines.push(placeholderLine("whether this product has users in the EU/UK, which determines whether GDPR/UK GDPR disclosures apply", placeholders));
+    }
+    if (california === true) {
+        lines.push("If you are a California resident, you may have rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the sale or sharing of your personal data.");
+    }
+    else if (california !== false) {
+        lines.push(placeholderLine("whether this product has users in California, which determines whether CCPA/CPRA disclosures apply", placeholders));
+    }
+    return lines.join("\n");
+}
+function renderChildrensPrivacySection(config, placeholders) {
+    const collects = config?.collectsChildrensData;
+    const collectsLine = triStateSentence(collects, "whether this product knowingly collects personal data from children", "This product knowingly collects personal data from children under applicable age thresholds (e.g. under 13 in the US, under 16 in the EU where applicable).", "This product does not knowingly collect personal data from children under applicable age thresholds.", placeholders);
+    const minimumAge = config?.minimumAge;
+    const ageLine = minimumAge === null || minimumAge === undefined
+        ? placeholderLine("minimum age required to use this product, if any", placeholders)
+        : `Users must be at least ${minimumAge} years old to use this product.`;
+    return ["## Children's Privacy", "", collectsLine, ageLine].join("\n");
+}
+function renderPlaceholderSummary(labels) {
+    const lines = ["## Placeholders — Complete Before Publishing", ""];
+    for (const label of labels) {
+        lines.push(`- ${placeholder(label)}`);
+    }
+    return lines.join("\n");
+}
 function outcomeOf(finding) {
     if (!finding.requiresReview)
         return "confident";
@@ -124,6 +228,13 @@ export function generatePolicyMarkdown(result, config, llmError, protectedLogicW
     });
     const declinedFindings = result.findings.filter((f) => outcomeOf(f) === "declined");
     const reviewFindings = result.findings.filter((f) => outcomeOf(f) === "unresolved");
+    // Rendered first (before the final parts[] is assembled) so the shared placeholders array is fully
+    // populated in time for the top-of-document summary below.
+    const placeholders = [];
+    const identitySection = renderIdentitySection(config, placeholders);
+    const dataPracticesSection = renderDataPracticesSection(config, placeholders);
+    const rightsSection = renderRightsSection(config, placeholders);
+    const childrensPrivacySection = renderChildrensPrivacySection(config, placeholders);
     const parts = ["# Privacy Policy", ""];
     if (result.unsupportedStackWarning) {
         parts.push(renderUnsupportedStackWarning(result.unsupportedStackWarning), "");
@@ -134,7 +245,10 @@ export function generatePolicyMarkdown(result, config, llmError, protectedLogicW
     if (llmError) {
         parts.push(renderLlmErrorWarning(llmError), "");
     }
-    parts.push(`_Generated by SrcLawyer from static analysis of this codebase (${result.filesScanned} file(s) scanned)._`, "", renderContextSection(config), "", "## Data We Collect", "");
+    if (placeholders.length > 0) {
+        parts.push(renderPlaceholderSummary([...new Set(placeholders)]), "");
+    }
+    parts.push(`_Generated by SrcLawyer from static analysis of this codebase (${result.filesScanned} file(s) scanned)._`, "", renderContextSection(config), "", identitySection, "", "## Data We Collect", "");
     const categorySections = renderCategorySections(confidentFindings);
     if (categorySections.length > 0) {
         parts.push(categorySections.join("\n\n"));
@@ -149,6 +263,7 @@ export function generatePolicyMarkdown(result, config, llmError, protectedLogicW
     if (processorSection) {
         parts.push("", processorSection);
     }
+    parts.push("", dataPracticesSection, "", rightsSection, "", childrensPrivacySection);
     const declinedSection = renderDeclinedSection(declinedFindings);
     if (declinedSection) {
         parts.push("", declinedSection);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "srclawyer",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Static analysis engine that derives privacy policy documentation directly from source code",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",