Compliance gates

@dscodotco/compliance-gates turns the well-known consumer-protection “lawsuit attractants” into build gates that run in the pre-commit hook (lefthook.yml) and in the CI verify job (pnpm check:compliance), so a required disclosure, link, or warning can’t silently disappear.

Not legal advice. The gates enforce presence, not legal sufficiency — counsel still signs off on wording.

Two halves

1. ADA / accessibility — a Biome preset (@dscodotco/compliance-gates/biome) that enables the full a11y rule group at error. Extend it from biome.json; a11y violations then fail biome check.
2. Content gates — a config-driven CLI (compliance-check) that scans source for the required elements.

Configuring

// compliance.config.ts
import { arlAutoRenew, ccpaPrivacyChoices, prop65, canSpamFooter, ruoNotice,
 accessibilityStatement, noPreCheckedConsent, type ComplianceConfig } from "@dscodotco/compliance-gates";
 
export const config: ComplianceConfig = {
 checks: [
 ccpaPrivacyChoices(["surfaces/**/footer*.tsx", "surfaces/**/layout*.tsx"]),
 arlAutoRenew(["surfaces/**/checkout/**"]),
 prop65(["surfaces/**/product/**"]),
 canSpamFooter(["modules/comms/src/**", "modules/marketing/src/index.ts"]),
 ruoNotice(["surfaces/storefront/**"]),
 noPreCheckedConsent(["surfaces/**"]),
 ],
};

Run compliance-check (exit 1 on any violation).

Covered categories

Check kinds

• required-somewhere — at least one file in the globs contains one of anyOf.
• conditional — any file matching a trigger must also contain a required element.
• forbidden — no file may contain a banned pattern.

A required-somewhere or conditional check whose globs match zero files fails (“gate scoped to nothing”) — a gate pointed at a path that doesn’t exist, or whose target file was deleted, must never read as green.

Case-insensitive, skips test files, zero runtime dependencies. These checks are part of a broader 12-category compliance program maintained internally; the gates documented here are the mechanically enforced subset.