Regulatory Compliance

'use strict';

/**
 * regulatory-compliance post-execute hook
 * Emits observability event via send-event.cjs per Iron Law III.
 * Events are appended to .claude/context/runtime/tool-events.jsonl
 */

const path = require('path');

function postExecute(context = {}) {
  try {
    const sendEventPath = path.resolve(__dirname, '../../../../tools/observability/send-event.cjs');

    let sendEvent;
    try {
      sendEvent = require(sendEventPath).sendEvent;
    } catch (_) {
      // Fail-open: observability is non-blocking
      process.stderr.write(
        '[regulatory-compliance/post-execute] send-event.cjs not found — skipping event\n'
      );
      return;
    }

    sendEvent({
      tool_name: 'regulatory-compliance',
      agent_id: context.agentId || process.env.AGENT_ID || 'unknown',
      session_id: context.sessionId || process.env.SESSION_ID || 'unknown',
      outcome: context.success !== false ? 'success' : 'failure',
      metadata: {
        subject: context.subject || 'unknown',
        decision: context.decision || 'unknown',
        regulationsAssessed: context.regulationsAssessed || [],
        findingCount: context.findingCount || 0,
      },
    });

    process.stderr.write('[regulatory-compliance/post-execute] Observability event emitted\n');
  } catch (err) {
    // Fail-open: post hooks must not block workflow
    process.stderr.write(`[regulatory-compliance/post-execute] Error (ignoring): ${err.message}\n`);
  }
}

module.exports = { postExecute };

'use strict';

/**
 * regulatory-compliance pre-execute hook
 * Validates skill inputs against schemas/input.schema.json before execution.
 * Follows Iron Law I: enforcement hooks must validate before code runs.
 */

const path = require('path');
const fs = require('fs');
const { safeParseJSON } = require('../../../lib/utils/safe-json.cjs');

function preExecute(input = {}) {
  try {
    // Load schema for validation
    const schemaPath = path.join(__dirname, '../schemas/input.schema.json');

    if (!fs.existsSync(schemaPath)) {
      process.stderr.write(
        '[regulatory-compliance/pre-execute] Schema not found — skipping validation\n'
      );
      return { continue: true };
    }

    const _schema = safeParseJSON(fs.readFileSync(schemaPath, 'utf8'));

    // Validate required fields
    if (!input.subject || typeof input.subject !== 'string' || input.subject.trim() === '') {
      process.stderr.write(
        '[regulatory-compliance/pre-execute] Input validation FAILED: "subject" is required and must be a non-empty string\n'
      );
      process.exit(2);
    }

    // Validate jurisdictions enum if provided
    const validJurisdictions = [
      'EU',
      'California',
      'Virginia',
      'Colorado',
      'Connecticut',
      'Texas',
      'Oregon',
      'Montana',
      'Florida',
      'Global',
    ];
    if (input.jurisdictions) {
      if (!Array.isArray(input.jurisdictions)) {
        process.stderr.write(
          '[regulatory-compliance/pre-execute] "jurisdictions" must be an array\n'
        );
        process.exit(2);
      }
      const invalid = input.jurisdictions.filter(j => !validJurisdictions.includes(j));
      if (invalid.length > 0) {
        process.stderr.write(
          `[regulatory-compliance/pre-execute] Invalid jurisdiction(s): ${invalid.join(', ')}. Valid: ${validJurisdictions.join(', ')}\n`
        );
        process.exit(2);
      }
    }

    // Validate regulations enum if provided
    const validRegulations = ['GDPR', 'CCPA', 'CPRA', 'VCDPA', 'ADA', 'WCAG', 'DPA', 'Section508'];
    if (input.regulations) {
      if (!Array.isArray(input.regulations)) {
        process.stderr.write(
          '[regulatory-compliance/pre-execute] "regulations" must be an array\n'
        );
        process.exit(2);
      }
      const invalid = input.regulations.filter(r => !validRegulations.includes(r));
      if (invalid.length > 0) {
        process.stderr.write(
          `[regulatory-compliance/pre-execute] Invalid regulation(s): ${invalid.join(', ')}. Valid: ${validRegulations.join(', ')}\n`
        );
        process.exit(2);
      }
    }

    // Validate assessmentScope if provided
    const validScopes = [
      'full',
      'gdpr-ccpa-only',
      'accessibility-only',
      'dpa-only',
      'privacy-by-design-only',
    ];
    if (input.assessmentScope && !validScopes.includes(input.assessmentScope)) {
      process.stderr.write(
        `[regulatory-compliance/pre-execute] Invalid assessmentScope: "${input.assessmentScope}". Valid: ${validScopes.join(', ')}\n`
      );
      process.exit(2);
    }

    process.stderr.write('[regulatory-compliance/pre-execute] Input validation PASSED\n');
    return { continue: true };
  } catch (err) {
    // Fail-open on unexpected errors (advisory hook behavior)
    process.stderr.write(
      `[regulatory-compliance/pre-execute] Unexpected error (allowing): ${err.message}\n`
    );
    return { continue: true };
  }
}

module.exports = { preExecute };

{
  "$schema": "https://json-schema.org/draft-07/schema#",
  "title": "RegulatoryCompliance Input",
  "description": "Validated inputs for the regulatory-compliance skill execution",
  "type": "object",
  "required": ["subject"],
  "properties": {
    "subject": {
      "type": "string",
      "description": "The system, feature, DPA, or interface being assessed for compliance"
    },
    "jurisdictions": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": [
          "EU",
          "California",
          "Virginia",
          "Colorado",
          "Connecticut",
          "Texas",
          "Oregon",
          "Montana",
          "Florida",
          "Global"
        ]
      },
      "description": "List of jurisdictions to assess compliance against",
      "default": ["EU", "California"]
    },
    "regulations": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["GDPR", "CCPA", "CPRA", "VCDPA", "ADA", "WCAG", "DPA", "Section508"]
      },
      "description": "Specific regulations to check; if omitted all applicable regulations are assessed"
    },
    "dataCategories": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Categories of personal data involved (e.g., name, email, IP address, behavioral data, biometrics)"
    },
    "assessmentScope": {
      "type": "string",
      "enum": [
        "full",
        "gdpr-ccpa-only",
        "accessibility-only",
        "dpa-only",
        "privacy-by-design-only"
      ],
      "description": "Scope of the compliance assessment",
      "default": "full"
    },
    "dpaPath": {
      "type": "string",
      "description": "File path to the DPA document to validate (required when assessmentScope includes DPA)"
    },
    "outputPath": {
      "type": "string",
      "description": "Directory path to write the compliance report; defaults to .claude/context/reports/compliance/"
    }
  },
  "additionalProperties": false
}

{
  "$schema": "https://json-schema.org/draft-07/schema#",
  "title": "RegulatoryCompliance Output",
  "description": "Structured output from the regulatory-compliance skill assessment",
  "type": "object",
  "required": ["decision", "regulationsAssessed", "assessmentDate", "findings"],
  "properties": {
    "decision": {
      "type": "string",
      "enum": ["PASS", "CONDITIONAL", "FAIL"],
      "description": "Overall compliance decision: PASS (all items verified), CONDITIONAL (minor/medium findings with remediation plan), FAIL (critical/high findings requiring remediation before deployment)"
    },
    "regulationsAssessed": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "List of regulations assessed (e.g., GDPR, CCPA, WCAG 2.1 AA, DPA)"
    },
    "assessmentDate": {
      "type": "string",
      "format": "date",
      "description": "Date the assessment was performed (YYYY-MM-DD)"
    },
    "subject": {
      "type": "string",
      "description": "The system or artifact that was assessed"
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": ["id", "regulation", "severity", "category", "description", "status"],
        "properties": {
          "id": {
            "type": "string",
            "description": "Finding identifier (e.g., RC-001)"
          },
          "regulation": {
            "type": "string",
            "description": "Regulation this finding relates to (e.g., GDPR, CCPA, WCAG)"
          },
          "severity": {
            "type": "string",
            "enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"],
            "description": "Severity level of the finding"
          },
          "category": {
            "type": "string",
            "description": "Compliance category (e.g., Consent Management, Data Inventory, Accessibility)"
          },
          "description": {
            "type": "string",
            "description": "Specific description of the compliance gap found"
          },
          "status": {
            "type": "string",
            "enum": ["PASS", "FAIL", "CONDITIONAL", "NOT_APPLICABLE"],
            "description": "Status of this specific finding"
          },
          "remediation": {
            "type": "string",
            "description": "Specific actionable remediation step"
          },
          "owner": {
            "type": "string",
            "description": "Agent or role responsible for remediation (e.g., developer, devops, compliance-checker)"
          },
          "deadline": {
            "type": "string",
            "description": "Remediation deadline (e.g., Before next deployment, 30 days, YYYY-MM-DD)"
          }
        }
      },
      "description": "Individual compliance findings"
    },
    "requiredMitigations": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Mitigations required before deployment (for CONDITIONAL decisions)"
    },
    "evidencePaths": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "File paths to evidence or report files generated"
    },
    "regulatoryLinks": {
      "type": "array",
      "items": {
        "type": "string",
        "format": "uri"
      },
      "description": "Links to authoritative regulatory sources consulted"
    },
    "nextReviewDate": {
      "type": "string",
      "format": "date",
      "description": "Recommended date for the next compliance assessment"
    },
    "recommendedNextStep": {
      "type": "string",
      "description": "Single recommended next action after this assessment"
    }
  },
  "additionalProperties": false
}

#!/usr/bin/env node
'use strict';

/**
 * regulatory-compliance/scripts/main.cjs
 * CLI entry point for the regulatory-compliance skill.
 *
 * Usage:
 *   node .claude/skills/regulatory-compliance/scripts/main.cjs \
 *     --subject "User Authentication API" \
 *     --jurisdictions EU,California \
 *     --regulations GDPR,CCPA,WCAG \
 *     --scope full
 */

const path = require('path');
const fs = require('fs');

const args = process.argv.slice(2);

function getArg(name) {
  const idx = args.indexOf(`--${name}`);
  if (idx === -1) return null;
  return args[idx + 1] || null;
}

function showHelp() {
  console.log(`
regulatory-compliance — Validate systems against GDPR/CCPA, WCAG/ADA, DPA, and privacy-by-design standards.

Usage:
  node main.cjs --subject <text> [options]

Options:
  --subject           Required. The system or artifact being assessed.
  --jurisdictions     Comma-separated list: EU,California,Virginia,Colorado,Connecticut,Texas,Oregon,Montana,Florida,Global
  --regulations       Comma-separated list: GDPR,CCPA,CPRA,VCDPA,ADA,WCAG,DPA,Section508
  --scope             Assessment scope: full|gdpr-ccpa-only|accessibility-only|dpa-only|privacy-by-design-only (default: full)
  --output            Output directory for compliance report (default: .claude/context/reports/compliance/)
  --help              Show this help message

Examples:
  node main.cjs --subject "User API" --jurisdictions EU,California --regulations GDPR,CCPA
  node main.cjs --subject "Login Page" --scope accessibility-only --regulations WCAG,ADA
  node main.cjs --subject "Vendor DPA" --scope dpa-only
`);
}

if (args.includes('--help') || args.length === 0) {
  showHelp();
  process.exit(0);
}

const subject = getArg('subject');
if (!subject) {
  console.error('ERROR: --subject is required');
  showHelp();
  process.exit(1);
}

const jurisdictions = getArg('jurisdictions')
  ? getArg('jurisdictions')
      .split(',')
      .map(j => j.trim())
  : ['EU', 'California'];

const regulations = getArg('regulations')
  ? getArg('regulations')
      .split(',')
      .map(r => r.trim())
  : null;

const scope = getArg('scope') || 'full';

const validScopes = [
  'full',
  'gdpr-ccpa-only',
  'accessibility-only',
  'dpa-only',
  'privacy-by-design-only',
];
if (!validScopes.includes(scope)) {
  console.error(`ERROR: Invalid scope "${scope}". Valid: ${validScopes.join(', ')}`);
  process.exit(1);
}

const outputDir = getArg('output') || '.claude/context/reports/compliance';

// Ensure output directory exists
if (!fs.existsSync(outputDir)) {
  fs.mkdirSync(outputDir, { recursive: true });
}

const today = new Date().toISOString().split('T')[0];
const outputFile = path.join(
  outputDir,
  `${subject.toLowerCase().replace(/[^a-z0-9]+/g, '-')}-compliance-${today}.md`
);

console.log(`
regulatory-compliance assessment
================================
Subject:       ${subject}
Jurisdictions: ${jurisdictions.join(', ')}
Regulations:   ${regulations ? regulations.join(', ') : 'All applicable'}
Scope:         ${scope}
Output:        ${outputFile}
Date:          ${today}

This skill is cognitive/prompt-driven. Invoke via agent context:
  Skill({ skill: 'regulatory-compliance' })

The skill will:
  1. Assess ${subject} against applicable regulations
  2. Generate structured PASS/CONDITIONAL/FAIL decision
  3. Write compliance report to: ${outputFile}

Reference: .claude/skills/regulatory-compliance/SKILL.md
`);

// Write a starter template to the output path
const reportContent = `<!-- Agent: compliance-checker | Task: # | Session: ${today} -->

# Compliance Assessment Report: ${subject}

**Assessment Date**: ${today}
**Subject**: ${subject}
**Jurisdictions**: ${jurisdictions.join(', ')}
**Regulations Assessed**: ${regulations ? regulations.join(', ') : 'GDPR, CCPA, WCAG 2.1 AA, DPA'}
**Scope**: ${scope}

> This report template was generated by regulatory-compliance/scripts/main.cjs.
> Complete the assessment by invoking Skill({ skill: 'regulatory-compliance' }) via agent context.

## Scope Definition

[Agent to complete: define assessment scope per SKILL.md Step 1]

## GDPR/CCPA Compliance Checklist

[Agent to complete: run checklist per SKILL.md Step 2]

## Privacy-by-Design Review

[Agent to complete: assess 7 principles per SKILL.md Step 3]

## ADA/WCAG Accessibility Audit

[Agent to complete: audit per SKILL.md Step 4]

## DPA Validation

[Agent to complete: validate per SKILL.md Step 5]

## Compliance Decision

\`\`\`json
{
  "decision": "PENDING",
  "regulationsAssessed": [],
  "assessmentDate": "${today}",
  "findings": [],
  "recommendedNextStep": "Complete assessment via compliance-checker agent"
}
\`\`\`
`;

fs.writeFileSync(outputFile, reportContent, 'utf8');
console.log(`Starter report template written to: ${outputFile}`);