/**
 * Texas Data Privacy and Security Act (TDPSA / HB 4) Compliance Pack
 *
 * Regulation: Texas Business and Commerce Code Chapter 541
 *             (enacted via HB 4, 88th Texas Legislature, 2023)
 *             Also known as TDPSA (Texas Data Privacy and Security Act)
 *
 * Jurisdiction: US-TX (Texas)
 * Regulator: Texas Attorney General (enforcement authority)
 *
 * Effective date: 1 July 2024
 *
 * Scope:
 *   Applies to controllers that conduct business in Texas OR produce products /
 *   services consumed by Texas residents AND:
 *   (a) process or sell personal data, AND
 *   (b) are not a small business as defined by the US Small Business Administration
 *       (size thresholds by industry -- tenant configuration required to verify).
 *
 *   Exemptions: entities governed by GLBA, HIPAA, FERPA, COPPA, FCRA; Texas
 *   state agencies; financial institutions covered by Texas Finance Code; non-profit
 *   organizations; institutions of higher education.
 *
 * Key obligations:
 *   1. Consumer rights: access, correction, deletion, portability, opt-out of
 *      sale / targeted advertising / profiling for significant decisions.
 *   2. Sensitive data: opt-in consent before processing biometric, health,
 *      mental health, immigration status, religious beliefs, sexual orientation,
 *      citizenship status, or children's data.
 *   3. Child data: opt-in required for data of known children under 13 and
 *      parental consent for 13-17 (where applicable, consistent with COPPA).
 *   4. Data Protection Impact Assessments (DPIA): required for high-risk
 *      processing activities (targeted advertising, sale of personal data,
 *      sensitive data, ADM profiling, children's data).
 *   5. Vendor contracts: data processing agreements with processors covering
 *      controller instructions, confidentiality, breach notification, deletion.
 *   6. Biometric data: additional consent requirements beyond general sensitive data.
 *   7. Privacy notice: clear, conspicuous, reasonably accessible notice.
 *
 * Retention:
 *   As long as reasonably necessary for purpose; mandatory deletion on consumer request.
 *
 * Incident:
 *   Breach affecting Texas residents: AG notification (typically 60 days per
 *   Texas Business & Commerce Code §521.053 -- verify against current rules);
 *   affected consumers per breach notification provisions.
 *
 * @connexum/ai-governance
 */
/**
 * F-NEW-VERA-PACK-C4-02 (LOW): Texas HB 4 jurisdiction-tagging note.
 *
 * All 6 substantive classifiers in this pack require explicit "texas", "TDPSA",
 * or "HB 4" markers in the raw input text. In production deployments where
 * jurisdiction is carried in session metadata (e.g., user profile, IP geolocation,
 * customer consent record, or operator configuration) rather than injected into
 * every message, classifiers will miss Texas-resident data.
 *
 * DEPLOYER ACTION REQUIRED: Inject the jurisdiction tag ("texas TDPSA consumer")
 * at the classifier input boundary -- either by prepending it to the input string
 * before calling the data-classifier, or by configuring the operator's
 * classification pipeline to merge session metadata into the classifier payload.
 *
 * Proof-of-concept: TEXAS_RESIDENT_PERSONAL_DATA accepts a ClassificationContext
 * parameter. If context carries a jurisdictionCode extension property that resolves
 * to 'texas', 'tdpsa', or 'us-tx' (case-insensitive), the classifier fires regardless
 * of whether the raw input contains a Texas marker. Operators who configure a
 * jurisdictionCode in their context pipeline can use this fallback. To extend metadata
 * awareness to all classifiers, apply this pattern per your jurisdiction strategy.
 */
export const TEXAS_HB4_CATEGORY_CLASSIFIERS = {
    TEXAS_RESIDENT_PERSONAL_DATA: {
        references: ['Tex. Bus. & Com. Code §541.001 -- personal data definition; §541.002 -- scope (Texas consumers)'],
        classifier: (input, context) => {
            // Proof-of-concept sessionMetadata fallback (F-NEW-VERA-PACK-C4-02):
            // If the operator injects jurisdiction via context extension (not a standard
            // ClassificationContext field -- operators must add this via their pipeline),
            // the classifier fires on any input when jurisdictionCode resolves to Texas.
            // eslint-disable-next-line @typescript-eslint/no-explicit-any
            const jurisdictionCode = context?.jurisdictionCode;
            if (jurisdictionCode && /\b(?:texas|tdpsa|us.tx)\b/i.test(jurisdictionCode))
                return true;
            if (/\b(?:texas\s+resident\s+data|texas\s+consumer\s+data|tdpsa\s+data|hb\s*4\s+texas\s+data|texas\s+privacy\s+act\s+data)\b/i.test(input))
                return true;
            if (/\b(?:texas\s+personal\s+data|tx\s+consumer\s+personal\s+data|tdpsa\s+personal\s+information|texas\s+data\s+privacy\s+security\s+act)\b/i.test(input))
                return true;
            return false;
        },
    },
    SENSITIVE_PERSONAL_DATA_TEXAS: {
        references: ['Tex. Bus. & Com. Code §541.002(4) -- sensitive data definition (health, biometric, immigration, religion, sexual orientation, etc.)'],
        classifier: (input) => {
            if (/\b(?:sensitive\s+data\s+texas|tdpsa\s+sensitive|texas\s+sensitive\s+personal\s+data|hb4\s+sensitive)\b/i.test(input))
                return true;
            if (/\b(?:immigration\s+status\s+texas|religious\s+beliefs\s+texas\s+data|sexual\s+orientation\s+texas\s+privacy|citizenship\s+status\s+texas\s+data)\b/i.test(input))
                return true;
            if (/\b(?:mental\s+health\s+data\s+texas|health\s+condition\s+texas\s+privacy|texas\s+health\s+sensitive\s+data)\b/i.test(input))
                return true;
            return false;
        },
    },
    BIOMETRIC_DATA_TEXAS: {
        references: ['Tex. Bus. & Com. Code §541.002(4) -- biometric data as sensitive; Tex. Bus. & Com. Code §503 (Capture or Use of Biometric Identifier -- CUBI)'],
        classifier: (input) => {
            if (/\b(?:biometric\s+data\s+texas|texas\s+biometric|tdpsa\s+biometric|hb4\s+biometric|cubi\s+texas|biometric\s+identifier\s+texas)\b/i.test(input))
                return true;
            if (/\b(?:fingerprint\s+texas|facial\s+geometry\s+texas|retina\s+scan\s+texas|voice\s+print\s+texas|texas\s+biometric\s+consent)\b/i.test(input))
                return true;
            return false;
        },
    },
    CHILD_DATA_TEXAS: {
        references: ['Tex. Bus. & Com. Code §541.002(4) -- data of children under 13 as sensitive; COPPA alignment; parental consent obligations'],
        classifier: (input) => {
            if (/\b(?:child\s+data\s+texas|children\s+data\s+texas|under\s+13\s+texas\s+privacy|minor\s+data\s+texas\s+tdpsa)\b/i.test(input))
                return true;
            if (/\b(?:hb4\s+child|tdpsa\s+child|parental\s+consent\s+texas\s+privacy|texas\s+coppa\s+overlay)\b/i.test(input))
                return true;
            return false;
        },
    },
    TARGETED_ADVERTISING_RECORD: {
        references: ['Tex. Bus. & Com. Code §541.001 -- targeted advertising definition; §541.053 -- opt-out of targeted advertising'],
        classifier: (input) => {
            if (/\b(?:targeted\s+advertising\s+texas|texas\s+opt.out\s+targeted\s+advertising|tdpsa\s+targeted\s+ads|hb4\s+advertising)\b/i.test(input))
                return true;
            if (/\b(?:texas\s+ad\s+targeting\s+opt.out|texas\s+targeted\s+advertising\s+record|behavioral\s+advertising\s+texas)\b/i.test(input))
                return true;
            return false;
        },
    },
    SALE_OF_PERSONAL_DATA_RECORD: {
        references: ['Tex. Bus. & Com. Code §541.001 -- sale of personal data definition; §541.053 -- opt-out right for sale'],
        classifier: (input) => {
            if (/\b(?:sale\s+of\s+personal\s+data\s+texas|texas\s+data\s+sale|tdpsa\s+data\s+sale|hb4\s+sale\s+data|texas\s+opt.out\s+sale)\b/i.test(input))
                return true;
            if (/\b(?:texas\s+sell\s+personal\s+information|data\s+broker\s+texas\s+tdpsa|monetizing\s+texas\s+resident\s+data)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['Tex. Bus. & Com. Code §541.001 -- personal data (identifiable natural person); §541.002 -- exclusions'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:ssn|social\s+security|driver.s\s+license\s+number|passport\s+number|texas\s+id)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Tex. Bus. & Com. Code §521 -- security breach notification; security standard for personal data'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const TEXAS_HB4_PACK = {
    categoryClassifiers: TEXAS_HB4_CATEGORY_CLASSIFIERS,
    id: 'texas-hb4',
    aliases: [],
    name: 'Texas TDPSA (HB 4 -- Data Privacy and Security Act)',
    version: '1.0.0',
    description: 'Texas Business and Commerce Code Chapter 541 (TDPSA -- Texas Data Privacy and Security Act, enacted via HB 4, effective 1 July 2024). Covers: consumer rights (access, correction, deletion, portability, opt-out of sale/targeted advertising/profiling); sensitive data opt-in consent (health, biometric, immigration, religion, sexual orientation, children); DPIA for high-risk processing; vendor contracts; biometric additional consent. Small-business exemption based on SBA size standards (tenant must configure revenue threshold). Enforcement by Texas AG. Activate alongside CCPA/CPRA if multi-state privacy compliance is needed.',
    authority: 'Texas Attorney General',
    industries: ['technology', 'retail', 'financial-services', 'healthcare', 'advertising', 'data-brokerage', 'insurance'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Enforce TDPSA opt-in consent gate for sensitive data processing; small-business exemption threshold check; DPIA requirement classification for high-risk processing activities; profiling opt-out enforcement.',
            reference: 'Tex. Bus. & Com. Code §541.002(4) -- sensitive data opt-in; §541.052 -- controller obligations; §541.055 -- DPIA requirements; §541.002 -- small business exemption',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify Texas resident personal data, sensitive data categories, biometric data, child data, targeted advertising records, and sale-of-data records for appropriate handling and opt-in/opt-out workflow triggering.',
            reference: 'Tex. Bus. & Com. Code §541.001 -- personal data definition; §541.002(4) -- sensitive data categories; §541.053 -- opt-out right categories',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human review for DPIA completion before high-risk processing deployment; sensitive data opt-in consent verification gate; biometric data additional consent workflow; parental consent verification for child data.',
            reference: 'Tex. Bus. & Com. Code §541.055 -- DPIA for high-risk activities; §541.002(4) -- sensitive data opt-in consent; COPPA alignment for child data under 13',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'DPIA documentation lifecycle; privacy notice accessibility attestation; processor contract (DPA) register; opt-out record keeping; biometric consent records.',
            reference: 'Tex. Bus. & Com. Code §541.055 -- DPIA documentation; §541.052(a)(4) -- privacy notice; §541.054 -- processor contracts; §541.053 -- opt-out implementation records',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Processor contracts (data processing agreements) covering controller instructions, sub-processing, confidentiality, return/deletion, and breach notification; AI vendor compliance with TDPSA sensitive data restrictions.',
            reference: 'Tex. Bus. & Com. Code §541.054 -- data processing agreement requirements (controller-processor); §541.052(a)(7) -- vendor obligations; security safeguards for processors',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Opt-out signal persistence (sale, targeted advertising, profiling); consent record continuity; mandatory deletion enforcement on consumer deletion request; retention limited to necessary purpose.',
            reference: 'Tex. Bus. & Com. Code §541.053 -- opt-out implementation; §541.051(a)(3) -- consumer deletion right; §541.052(a)(6) -- data minimization and retention limitation',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Privacy notice delivery: clear, conspicuous, reasonably accessible disclosure of categories processed, purposes, third parties, and consumer rights including opt-out of sale/targeted advertising/profiling.',
            reference: 'Tex. Bus. & Com. Code §541.052(a)(4) -- privacy notice requirements; §541.053 -- opt-out disclosures in privacy notice; FTC guidance on privacy notice clarity',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident records for consumer rights requests and responses, DPIA documentation, opt-out signal records, and breach notification history; required for Texas AG enforcement defense.',
            reference: 'Tex. Bus. & Com. Code §541.052 -- controller accountability obligations; Texas AG enforcement documentation requirements; §541.055 -- DPIA retention',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Security breach detection and Texas AG notification workflow (60-day clock per Tex. Bus. & Com. Code §521.053); consumer harm event escalation; opt-out signal processing events.',
            reference: 'Tex. Bus. & Com. Code §521.053 -- breach notification (60 days to individuals; notify AG if 500+ TX residents); §541.051 -- consumer rights request tracking events',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Sensitive personal data, biometric data, and child data encrypted at rest and in transit; security safeguards required by TDPSA to protect against unauthorized access.',
            reference: 'Tex. Bus. & Com. Code §541.052(a)(5) -- security practices to protect personal data; §521.052 -- security measures for sensitive personal information; biometric data security requirements',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            sensitiveDataOptInRequired: true,
            smallBusinessExemptionCheckRequired: true,
            biometricAdditionalConsentRequired: true,
            childDataParentalConsentRequired: true,
            profilingOptOutRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['TEXAS_RESIDENT_PERSONAL_DATA', 'SENSITIVE_PERSONAL_DATA_TEXAS', 'BIOMETRIC_DATA_TEXAS', 'CHILD_DATA_TEXAS', 'TARGETED_ADVERTISING_RECORD', 'SALE_OF_PERSONAL_DATA_RECORD', 'PII', 'CREDENTIALS'],
            sensitiveDataTexasAction: 'BLOCK',
            biometricDataTexasAction: 'BLOCK',
            childDataTexasAction: 'BLOCK',
            credentialsAction: 'BLOCK',
        },
        'approval-queue': {
            dpiaReviewRequired: true,
            sensitiveDataConsentVerificationRequired: true,
            biometricConsentWorkflowRequired: true,
            parentalConsentVerificationRequired: true,
        },
        'attestation-manager': {
            dpiaDocumentationRequired: true,
            privacyNoticeAccessibilityAttestationRequired: true,
            processorContractRegisterRequired: true,
            optOutRecordRetentionRequired: true,
        },
        'session-persistence': {
            optOutPersistenceRequired: true,
            deletionRequestEnforcementRequired: true,
            storageLimitationEnforced: true,
        },
        'transparency-injector': {
            tdpsaPrivacyNoticeRequired: true,
            saleOptOutDisclosureRequired: true,
            targetedAdvertisingOptOutDisclosureRequired: true,
            profilingOptOutDisclosureRequired: true,
        },
        'event-bus': {
            breachNotificationDays: 60,
            agNotificationThresholdResidents: 500,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-US', 'PROCESSOR-CONTRACT', 'BREACH-NOTIFICATION-SUPPORT'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates compliance risk for Texas resident sensitive personal data; TDPSA security obligations incompatible with PRC government access obligations.',
            baidu: 'PRC jurisdiction. Transfer of Texas resident sensitive personal data (health, biometric, immigration) to PRC creates significant TDPSA security and consent violation risk.',
            alibaba: 'PRC jurisdiction. Transfer of Texas resident sensitive personal data (health, biometric, children\'s data) to PRC violates TDPSA security safeguard requirements.',
        },
    },
    dataPolicy: {
        scanCategories: ['TEXAS_RESIDENT_PERSONAL_DATA', 'SENSITIVE_PERSONAL_DATA_TEXAS', 'BIOMETRIC_DATA_TEXAS', 'CHILD_DATA_TEXAS', 'TARGETED_ADVERTISING_RECORD', 'SALE_OF_PERSONAL_DATA_RECORD', 'PII', 'CREDENTIALS'],
        categoryActions: {
            TEXAS_RESIDENT_PERSONAL_DATA: 'WARN',
            SENSITIVE_PERSONAL_DATA_TEXAS: 'BLOCK',
            BIOMETRIC_DATA_TEXAS: 'BLOCK',
            CHILD_DATA_TEXAS: 'BLOCK',
            TARGETED_ADVERTISING_RECORD: 'WARN',
            SALE_OF_PERSONAL_DATA_RECORD: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // Retain as long as necessary for stated purpose; mandatory deletion on consumer request.
        // Breach notification records: retain for AG enforcement defense.
        auditLogRetentionDays: 1825, // 5 years (reasonable consumer rights defense period)
        sessionRetentionDays: 1825,
        incidentRetentionDays: 1825,
        reference: 'Tex. Bus. & Com. Code §541.052(a)(6) -- data minimization and retention limitation; §541.051(a)(3) -- consumer deletion right; §521.053 -- breach notification records for AG enforcement defense',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us'],
    },
    incidentPolicy: {
        // Tex. Bus. & Com. Code §521.053: notify individuals no later than 60 days after discovery.
        // Notify AG if breach affects 500+ Texas residents.
        notificationDeadlineHours: 1440, // 60 days = 1440 hours
        reference: 'Tex. Bus. & Com. Code §521.053 -- breach notification to affected Texas residents (60 days); AG notification when 500+ Texas residents affected; Tex. Bus. & Com. Code §541.052 -- security safeguards obligation',
        requiredRecipients: ['texas-attorney-general', 'affected-texas-consumers', 'chief-privacy-officer', 'chief-information-security-officer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'tx-hb4-sensitive-data-opt-in',
            description: 'TDPSA sensitive data opt-in gate active: biometric, health, mental health, immigration status, religious beliefs, sexual orientation, citizenship, and children\'s data blocked without explicit opt-in consent',
            reference: 'Tex. Bus. & Com. Code §541.002(4) -- sensitive data definition; §541.052(a)(2) -- opt-in consent requirement for sensitive data processing',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'tx-hb4-consumer-rights',
            description: 'TDPSA consumer rights workflow active: access, correction, deletion, portability, and opt-out of sale/targeted advertising/profiling all implemented and responding within 45-day deadline',
            reference: 'Tex. Bus. & Com. Code §541.051 -- consumer rights; §541.056 -- response deadline (45 days, extendable to 90 days)',
            check: 'approval_queue_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'tx-hb4-dpia-requirement',
            description: 'DPIA documentation active for high-risk processing: targeted advertising, sale of personal data, sensitive data processing, ADM profiling with significant effects, and children\'s data processing',
            reference: 'Tex. Bus. & Com. Code §541.055 -- mandatory DPIA for high-risk processing activities; categories aligned with TDPSA high-risk definition',
            check: 'gdpr_dpia_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'tx-hb4-data-classifier',
            description: 'Texas resident personal data, sensitive data categories, biometric data, child data, targeted advertising, and sale records classified and subject to appropriate opt-in/opt-out controls',
            reference: 'Tex. Bus. & Com. Code §541.001 -- personal data; §541.002(4) -- sensitive data categories; §541.053 -- opt-out categories',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'tx-hb4-privacy-notice',
            description: 'TDPSA-compliant privacy notice active: categories processed, purposes, third-party sharing, consumer rights including opt-out of sale/targeted advertising/profiling, and contact information disclosed',
            reference: 'Tex. Bus. & Com. Code §541.052(a)(4) -- privacy notice content requirements; §541.053 -- opt-out disclosures in notice',
            check: 'transparency_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'tx-hb4-processor-contracts',
            description: 'Data processing agreements with all processors covering TDPSA-required terms: controller instructions, confidentiality, sub-processing approval, return/deletion, audit rights, and breach notification',
            reference: 'Tex. Bus. & Com. Code §541.054 -- processor data processing agreement requirements; §541.052(a)(7) -- controller obligations for processor oversight',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'tx-hb4-breach-notification',
            description: 'Security breach detection active with 60-day Texas resident notification clock; AG notification configured for breaches affecting 500+ Texas residents',
            reference: 'Tex. Bus. & Com. Code §521.053 -- breach notification timeline (60 days); AG notification at 500+ resident threshold',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'tx-hb4-opt-out-persistence',
            description: 'Opt-out signals (sale, targeted advertising, profiling) persisted across session boundaries; consumer deletion requests enforced within statutory timeframe',
            reference: 'Tex. Bus. & Com. Code §541.053 -- opt-out right implementation; §541.051(a)(3) -- deletion right; opt-out signal persistence requirement',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'tx-hb4-encryption',
            description: 'Texas resident sensitive personal data, biometric data, and child data encrypted at rest and in transit; security practices proportionate to data sensitivity',
            reference: 'Tex. Bus. & Com. Code §541.052(a)(5) -- administrative, technical, physical security practices; §521.052 -- sensitive personal information security requirements',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=texas-hb4.js.map