"use strict";
/**
 * TRID (TILA-RESPA Integrated Disclosure) Compliance Pack
 *
 * Previously bundled with TILA in `src/packs/tila-trid.ts`. Split per Thomas's
 * 2026-04-24 principle: one country, one regulation, one pack. CFPB enforces
 * TRID and other-TILA provisions separately at 12 CFR §1026.
 *
 * Scope: 12 CFR §1026.19(e) and (f) -- TRID integrated Loan Estimate and
 * Closing Disclosure rule. CFPB enforced. This pack governs the integrated
 * disclosure forms only:
 *   - §1026.37: Loan Estimate -- issued within 3 business days of application
 *   - §1026.38: Closing Disclosure -- delivered at least 3 business days before
 *     consummation
 *   - §1026.19(e): timing and delivery of Loan Estimate
 *   - §1026.19(f): timing and delivery of Closing Disclosure
 *   - Changed-circumstance revised LE workflow (§1026.19(e)(3)(iv))
 *
 * NOT in scope for this pack (see us-tila.ts):
 *   - Right-of-rescission (12 CFR §1026.23)
 *   - ATR/QM (12 CFR §1026.43)
 *   - Advertising trigger terms (12 CFR §§1026.16, 1026.24)
 *   - Credit-card disclosures
 *   - Consumer lease disclosures
 *   - ARM/HELOC disclosures (§1026.19(b), §1026.20(d), §1026.40)
 *
 * Cross-pack interactions:
 *   - us-trid x us-respa: TRID's Loan Estimate replaced RESPA's old HUD-1;
 *     both packs may apply at closing. Strictest-wins on retention (RESPA
 *     §1024.10 5-year vs TRID §1026.25 3-year -- RESPA governs retention).
 *   - us-trid x us-tila: TRID is the integrated-disclosure subset of Reg Z;
 *     us-tila covers the rest. If both bind, TRID governs the integrated
 *     disclosure forms specifically; us-tila governs all other Reg Z obligations.
 *   - us-trid x us-respa x us-tila: For mortgage closings, all three may
 *     activate. Strictest-wins: RESPA's 5-year retention, TRID's LE/CD clocks,
 *     and TILA's rescission clock all run in parallel.
 *
 * LLM-EGRESS PRIMACY RULES (Thomas directive 2026-04-22):
 *   - BLOCK: Loan Estimate and Closing Disclosure numeric fields (APR, finance
 *     charge, amount financed, total of payments, total loan costs) from being
 *     COMPUTED OR PLACED by an LLM. The LLM may never be the source of these
 *     figures; they must come from a licensed/regulated calculation engine and
 *     receive human verification before placement on the disclosure form.
 *   - ALLOW WITH GUARDRAILS: LLMs may EXPLAIN concepts (what is a Loan
 *     Estimate, what is a Closing Disclosure) but must not compute or quote
 *     specific numerical values.
 *   - REQUIRE: 3-business-day Loan Estimate delivery tracker; 3-business-day
 *     Closing Disclosure review window enforced before consummation.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.US_TRID_PACK = exports.US_TRID_CATEGORY_CLASSIFIERS = void 0;
/**
 * TRID (TILA-RESPA Integrated Disclosure) category classifiers.
 * Covers the integrated Loan Estimate and Closing Disclosure forms only.
 */
exports.US_TRID_CATEGORY_CLASSIFIERS = {
    LOAN_ESTIMATE_DRAFT: {
        references: ['12 CFR §1026.37 -- Loan Estimate form; §1026.19(e) delivery timing'],
        classifier: (input) => {
            if (/\b(?:Loan\s+Estimate|LE\s+(?:draft|form|delivery|issued?|revised?)|loan\s+estimate\s+(?:form|draft|delivery))\b/i.test(input))
                return true;
            if (/\b(?:three.business.day\s+loan\s+estimate|3.business.day\s+LE|LE\s+3.day)\b/i.test(input))
                return true;
            if (/\b(?:initial\s+LE|revised\s+LE|changed.circumstance\s+re.disclosure)\b/i.test(input))
                return true;
            return false;
        },
    },
    CLOSING_DISCLOSURE_DRAFT: {
        references: ['12 CFR §1026.38 -- Closing Disclosure form; §1026.19(f) delivery timing'],
        classifier: (input) => {
            if (/\b(?:Closing\s+Disclosure|CD\s+(?:draft|form|delivery|issued?|revised?)|closing\s+disclosure\s+(?:form|draft|delivery))\b/i.test(input))
                return true;
            if (/\b(?:three.business.day\s+closing|3.business.day\s+CD|CD\s+3.day|pre.consummation\s+CD)\b/i.test(input))
                return true;
            return false;
        },
    },
    APR_NUMERIC: {
        references: ['12 CFR §1026.38(b) -- APR on Closing Disclosure; §1026.37(b) -- APR on Loan Estimate'],
        classifier: (input) => {
            if (/\b(?:APR|annual\s+percentage\s+rate)[:\s]*\d+(?:\.\d+)?%/i.test(input))
                return true;
            if (/\b(?:disclosed\s+APR|tolerance\s+violation|APR\s+accuracy|TRID\s+APR)\b/i.test(input))
                return true;
            if (/\b(?:finance\s+charge|amount\s+financed|total\s+(?:of\s+)?payments|total\s+loan\s+costs?)[:\s]*\$[\d,.]+/i.test(input))
                return true;
            return false;
        },
    },
    TRID_TIMING_VIOLATION: {
        references: ['12 CFR §1026.19(e)(1)(iii) -- LE tolerance rules; §1026.19(f)(2) -- CD delivery timing'],
        classifier: (input) => {
            if (/\b(?:TRID\s+timing|LE\s+timing\s+violation|CD\s+timing\s+violation|tolerance\s+cure|increased\s+cost\s+tolerance)\b/i.test(input))
                return true;
            if (/\b(?:consummation\s+(?:date|window|deadline)|three\s+business\s+days\s+before\s+consummation)\b/i.test(input))
                return true;
            return false;
        },
    },
    MORTGAGE_APPLICATION_RECORD: {
        references: ['12 CFR §1026 -- TRID consumer credit transaction record; §1026.25 record retention'],
        classifier: (input) => {
            if (/\b(?:mortgage\s+(?:application|loan\s+record)|URLA|1003\s+form|consumer\s+credit\s+application)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['TRID -- information security for integrated disclosure delivery systems'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.US_TRID_PACK = {
    categoryClassifiers: exports.US_TRID_CATEGORY_CLASSIFIERS,
    subjectKeyedCategories: ['LOAN_ESTIMATE_DRAFT', 'CLOSING_DISCLOSURE_DRAFT'],
    id: 'us-trid',
    /** GAP-S1-01: MT-03a is the site/packs.html public code for this pack. */
    aliases: ['MT-03a'],
    name: 'TRID (TILA-RESPA Integrated Disclosure)',
    version: '1.0.0',
    description: 'TRID (12 CFR §1026.19(e)/(f)) LLM-egress policy for integrated Loan Estimate and Closing Disclosure forms. Blocks LLMs from computing or placing APR, finance charge, amount financed, total of payments, and total loan cost figures. Enforces 3-business-day Loan Estimate delivery and 3-business-day pre-consummation Closing Disclosure windows. Covers changed-circumstance re-disclosure workflow only. For non-TRID Reg Z obligations (rescission, ATR/QM, advertising) use us-tila.',
    authority: 'Consumer Financial Protection Bureau (CFPB)',
    industries: ['mortgage-lender', 'bank', 'credit-union', 'fintech-lender', 'heloc-lender'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Block LLM computation of APR / finance-charge / amount-financed; enforce TRID 3-business-day LE and CD delivery clocks',
            reference: '12 CFR §1026.37, §1026.38 (Loan Estimate / Closing Disclosure); §1026.19(e)(f)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect LOAN_ESTIMATE_DRAFT, CLOSING_DISCLOSURE_DRAFT, APR_NUMERIC, TRID_TIMING_VIOLATION fields in LLM prompts or outputs',
            reference: '12 CFR §1026.38(b)-(g) (Closing Disclosure fields); §1026.37(b) (Loan Estimate APR)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for all TRID delivery events, APR-block decisions, and changed-circumstance resets',
            reference: '12 CFR §1026.25 (record retention); 3 years for TRID Reg Z disclosures',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Named human must verify APR / finance-charge figures before placement on LE or CD; approval gate before consummation after CD delivery',
            reference: '12 CFR §1026.19(f)(1)(ii) -- 3-business-day CD waiting period before consummation',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'TRID 3-business-day LE delivery clock; 3-business-day CD pre-consummation window; changed-circumstance re-disclosure clock',
            reference: '12 CFR §1026.19(a)(1)(i) (LE 3-day); §1026.19(f)(1)(ii) (CD 3-day before consummation)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-loan TRID delivery state survives agent restarts; changed-circumstance tracking per loan',
            reference: '12 CFR §1026.19(e)(3)(iv) (changed circumstance re-disclosure); §1026.25 retention',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Disclosure that AI generated the narrative but numeric figures were human-verified; required before any LE/CD explanation to borrower',
            reference: '12 CFR §1026.37 (Loan Estimate); §1026.38 (Closing Disclosure)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'LLM provider attestation that it cannot source APR / finance-charge calculations; calculation engine methodology attestation',
            reference: '12 CFR §1026.17(c) (accuracy obligations for disclosed figures)',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detect LLM outputs containing numeric APR / finance-charge figures that bypass the human-verification gate',
            reference: '12 CFR §1026.38(b) (Closing Disclosure APR field); CFPB supervision procedures',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party TRID disclosure preparation vendors attested; loan-origination-system integration contract for calculation engine',
            reference: '12 CFR §1026.17(c) (accuracy obligations for disclosed figures)',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            aprLlmComputationBlocked: true,
            financeChargeLlmComputationBlocked: true,
            amountFinancedLlmComputationBlocked: true,
            totalOfPaymentsLlmComputationBlocked: true,
            totalLoanCostsLlmComputationBlocked: true,
            llmExplanationModePermitted: true,
            tridLeDeliveryBusinessDays: 3,
            tridCdPreConsummationBusinessDays: 3,
        },
        'data-classifier': {
            enabledCategories: [
                'LOAN_ESTIMATE_DRAFT',
                'CLOSING_DISCLOSURE_DRAFT',
                'APR_NUMERIC',
                'TRID_TIMING_VIOLATION',
                'MORTGAGE_APPLICATION_RECORD',
                'CREDENTIALS',
            ],
            loanEstimateDraftAction: 'REQUIRE_HUMAN_REVIEW',
            closingDisclosureDraftAction: 'REQUIRE_HUMAN_REVIEW',
            aprNumericAction: 'BLOCK_LLM_COMPUTE',
            tridTimingViolationAction: 'BLOCK',
        },
        'approval-queue': {
            aprVerificationRequiresHumanReview: true,
            financeChargeVerificationRequiresHumanReview: true,
            closingDisclosureConsummationGateRequired: true,
            changedCircumstanceReDisclosureRequiresHumanReview: true,
        },
        'event-bus': {
            tridLeThreeBusinessDayClockActive: true,
            tridCdThreeBusinessDayPreConsummationClockActive: true,
            changedCircumstanceReDisclosureClockActive: true,
        },
        'session-persistence': {
            perLoanTridDeliveryStateRequired: true,
            changedCircumstanceHistoryRequired: true,
        },
        'attestation-manager': {
            llmProviderAprCalculationProhibitionAttestation: true,
            calculationEngineSourceAttestationRequired: true,
        },
        'anomaly-detector': {
            tridAprNumericOutputDetectionActive: true,
        },
        'transparency-injector': {
            tilaNumericFigureHumanVerifiedDisclosureRequired: true,
        },
        'supply-chain': {
            tridDisclosureVendorAttestationRequired: true,
            calculationEngineContractRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['TRID-APR-BLOCK', 'NO-TRID-NUMERIC-COMPUTE', 'AUDIT-LOGGING'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'LOAN_ESTIMATE_DRAFT',
            'CLOSING_DISCLOSURE_DRAFT',
            'APR_NUMERIC',
            'TRID_TIMING_VIOLATION',
            'MORTGAGE_APPLICATION_RECORD',
            'CREDENTIALS',
        ],
        categoryActions: {
            LOAN_ESTIMATE_DRAFT: 'LOG',
            CLOSING_DISCLOSURE_DRAFT: 'LOG',
            APR_NUMERIC: 'BLOCK',
            TRID_TIMING_VIOLATION: 'BLOCK',
            MORTGAGE_APPLICATION_RECORD: 'LOG',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        // 3 years for TRID records per 12 CFR §1026.25(a).
        // If us-respa also active, RESPA 5-year retention governs (strictest-wins).
        auditLogRetentionDays: 1095,
        sessionRetentionDays: 1095,
        incidentRetentionDays: 1095,
        reference: '12 CFR §1026.25(a) -- 3-year retention for TRID/Reg Z records from consummation, action taken, or required action date. When us-respa also active, RESPA 5-year (§1024.10) governs via strictest-wins.',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us'],
    },
    incidentPolicy: {
        // No statutory individual notification specifically for TRID; GLBA / state
        // law governs data breach notification. Internal 72h escalation for
        // LLM-computes-APR violations (material accuracy failure).
        notificationDeadlineHours: 72,
        reference: '12 CFR §1026.25; §1026.38 -- LLM-computed APR on disclosure is a material accuracy violation; 72h internal escalation; consumer notification via GLBA/state law.',
        requiredRecipients: ['compliance-officer', 'general-counsel', 'cfpb-if-examined'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'us-trid-apr-llm-block',
            description: 'APR, finance charge, amount financed, and total of payments cannot be computed or sourced from an LLM; must come from licensed calculation engine',
            reference: '12 CFR §1026.38(b) (Closing Disclosure APR); §1026.37(b) (Loan Estimate APR)',
            check: 'us_trid_apr_llm_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'us-trid-le-delivery-clock',
            description: '3-business-day Loan Estimate delivery clock tracked per application',
            reference: '12 CFR §1026.19(a)(1)(i) -- LE within 3 business days of application receipt',
            check: 'us_trid_le_clock_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'us-trid-cd-pre-consummation-clock',
            description: '3-business-day Closing Disclosure pre-consummation waiting period enforced',
            reference: '12 CFR §1026.19(f)(1)(ii) -- CD at least 3 business days before consummation',
            check: 'us_trid_cd_clock_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'us-trid-human-apr-verification',
            description: 'Named human reviewer verifies APR / finance-charge figures before placement on LE or CD',
            reference: '12 CFR §1026.17(c) (accuracy obligations); §1026.38 (CD form)',
            check: 'us_trid_human_apr_verification_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'us-trid-changed-circumstance',
            description: 'Changed-circumstance re-disclosure workflow active; revised LE triggers 3-business-day reset',
            reference: '12 CFR §1026.19(e)(3)(iv) (valid changed circumstance)',
            check: 'us_trid_changed_circumstance_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'us-trid-audit-trail',
            description: 'Tamper-evident audit trail for all TRID delivery events and APR-block decisions',
            reference: '12 CFR §1026.25(a) -- 3-year retention',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=us-trid.js.map