"use strict";
/**
 * Quebec Law 25 -- Provincial Quebec Privacy Pack
 *
 * Split notice: Quebec Law 25 was previously bundled with PIPEDA in
 * `src/packs/pipeda.ts`. Split per Thomas's 2026-04-24 principle: one
 * country, one regulation, one pack. Federal CA (PIPEDA, OPC-enforced) and
 * provincial QC (Law 25, CAI-enforced) are distinct jurisdictions with
 * distinct enforcers.
 *
 * Cross-pack interaction: when both ca-pipeda and ca-qc-law25 are active
 * (Quebec resident's data held by a federally-regulated organization),
 * strictest-wins applies. Quebec Law 25's enhanced consent requirements
 * (explicit opt-in, high-risk PIA gate, s. 12.1 ADM information disclosure)
 * typically govern the data-handling side because they are stricter than
 * PIPEDA Principles 3-4 defaults. PIPEDA governs inter-provincial transfer
 * obligations and OPC enforcement pathway. Both breach clocks run in
 * parallel; the first deadline governs.
 *
 * Act to modernize legislative provisions as regards the protection of
 * personal information (Quebec Law 25, formerly Bill 64). Fully in force
 * September 22, 2024.
 *
 * Standards referenced:
 *   - Quebec Law 25 (Act to modernize legislative provisions as regards
 *     the protection of personal information, SQ 2021, c 25)
 *   - Quebec Law 25 s. 12.1 (ADM information obligations for automated
 *     decision-making systems, in force Sept 2023)
 *   - Quebec Law 25 s. 3.3 (high-risk processing PIA requirement)
 *   - CAI (Commission d'acces a l'information) enforcement guidance
 *   - OPC-CAI Memorandum of Understanding on coordinated enforcement
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.QC_LAW25_PACK = exports.QC_LAW25_CATEGORY_CLASSIFIERS = void 0;
/**
 * QC Law 25 category classifiers.
 * Covers Quebec high-risk personal information categories requiring
 * enhanced protection under s. 3.3, and Quebec-specific identifiers.
 */
exports.QC_LAW25_CATEGORY_CLASSIFIERS = {
    QC_LAW25_PERSONAL_INFO: {
        references: ['Quebec Law 25 s. 3 -- personal information; any information about an identifiable individual processed by a Quebec-subject organization'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            // Canadian SIN (Social Insurance Number)
            if (/\b\d{3}[-\s]\d{3}[-\s]\d{3}\b/.test(input))
                return true;
            // Canadian postal code (Quebec postal codes start with H, J, or G)
            if (/\b[HJGhjg]\d[A-Za-z]\s?\d[A-Za-z]\d\b/.test(input))
                return true;
            // General Canadian postal code
            if (/\b[A-Za-z]\d[A-Za-z]\s?\d[A-Za-z]\d\b/.test(input))
                return true;
            if (/\b(?:social\s+insurance\s+number|SIN|carte\s+d.assurance.maladie|RAMQ|renseignement\s+personnel)\b/i.test(input))
                return true;
            return false;
        },
    },
    QC_LAW25_HIGH_RISK_PI: {
        references: ['Quebec Law 25 s. 3.3 -- high-risk PI; health + financial + biometric + political / religious opinions + genetic data'],
        classifier: (input) => {
            if (/\b(?:health\s+(?:information|record|data)|medical\s+(?:history|record|diagnosis)|dossier\s+(?:medical|de\s+sante))\b/i.test(input))
                return true;
            if (/\b(?:biometric\s+(?:data|information)|genetic\s+data|fingerprint|facial\s+recognition|donnee\s+biometrique)\b/i.test(input))
                return true;
            if (/\b(?:financial\s+(?:account|statement)|credit\s+(?:score|report)|renseignement\s+(?:financier|de\s+sante))\b/i.test(input))
                return true;
            if (/\b(?:political\s+opinion|religious\s+belief|racial\s+origin|ethnic\s+origin|sexual\s+orientation|opinion\s+politique|croyance\s+religieuse)\b/i.test(input))
                return true;
            return false;
        },
    },
    QC_LAW25_ADM_OUTPUT: {
        references: ['Quebec Law 25 s. 12.1 -- automated decision-making information obligations; individual right to know ADM is used and to obtain human review'],
        classifier: (input) => {
            if (/\b(?:automated.decision|decision.automatisee|algorithmic.decision|profiling.output|systeme.de.decision.automatisee|ADM.output|QC_LAW25_ADM_OUTPUT)\b/i.test(input))
                return true;
            return false;
        },
    },
};
exports.QC_LAW25_PACK = {
    categoryClassifiers: exports.QC_LAW25_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: Quebec personal information and high-risk categories are
     * subject-keyed per Quebec Law 25. Each event must carry a data
     * subject ID to satisfy CAI audit obligations.
     */
    subjectKeyedCategories: ['QC_LAW25_PERSONAL_INFO', 'QC_LAW25_HIGH_RISK_PI'],
    id: 'ca-qc-law25',
    name: 'Quebec Law 25 (Canada -- Provincial Quebec)',
    version: '1.0.0',
    description: 'Quebec Law 25 (Act to modernize legislative provisions as regards the protection of personal information, SQ 2021 c 25). CAI-enforced. Fully in force September 2024. Adds AI-specific ADM disclosure (s. 12.1), high-risk PIA gate (s. 3.3), explicit consent requirements. Activate alongside ca-pipeda for complete Quebec compliance.',
    authority: 'Commission d\'acces a l\'information (CAI) -- Quebec provincial privacy regulator',
    industries: ['all-ca', 'saas', 'fintech', 'healthcare-ca', 'ecommerce', 'quebec-private-sector'],
    requiredModules: [
        { name: 'governance-runtime', required: true, reason: 'Meaningful consent per identifiable purpose + Quebec high-risk review gate', reference: 'Quebec Law 25 s. 3.3; PIPEDA Schedule 1 Principle 3 (incorporated by reference)' },
        { name: 'audit-integrity', required: true, reason: 'Processing records + CAI-required breach log retention', reference: 'Quebec Law 25 s. 3.5; Breach notification requirements' },
        { name: 'data-classifier', required: true, reason: 'QC_LAW25_PERSONAL_INFO + QC_LAW25_HIGH_RISK_PI + QC_LAW25_ADM_OUTPUT classification', reference: 'Quebec Law 25 s. 3.3' },
        { name: 'session-persistence', required: true, reason: 'Consent withdrawal continuity + DSR state', reference: 'Quebec Law 25 consent and access rights' },
        { name: 'supply-chain', required: true, reason: 'Cross-border transfer safeguards + confidentiality undertakings for Quebec residents\' data', reference: 'Quebec Law 25 s. 17 (cross-border disclosure conditions)' },
        { name: 'approval-queue', required: true, reason: 'High-risk processing PIA gate; human review for automated decisions affecting individuals', reference: 'Quebec Law 25 s. 3.3; s. 12.1' },
        { name: 'attestation-manager', required: true, reason: 'Privacy Management Program + accountable individual + PIA documentation', reference: 'Quebec Law 25 s. 3.3; OPC-CAI joint accountability guidance' },
        { name: 'data-subject-rights', required: true, reason: 'Access + correction + portability + right to know ADM used + human review right', reference: 'Quebec Law 25 subject rights provisions' },
        { name: 'transparency-injector', required: true, reason: 'Quebec Law 25 s. 12.1 ADM information obligations -- must inform individuals that automated decision-making is used', reference: 'Quebec Law 25 s. 12.1' },
        { name: 'event-bus', required: true, reason: 'CAI breach notification clock; incident escalation to CAI and affected individuals', reference: 'Quebec Law 25 breach notification requirements' },
    ],
    moduleConfig: {
        'governance-runtime': {
            meaningfulConsentRequired: true,
            quebecLaw25HighRiskReviewRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['QC_LAW25_PERSONAL_INFO', 'QC_LAW25_HIGH_RISK_PI', 'QC_LAW25_ADM_OUTPUT'],
            quebecHighRiskAction: 'BLOCK_WITHOUT_PIA',
        },
        'session-persistence': {
            consentWithdrawalSupportRequired: true,
        },
        'supply-chain': {
            crossBorderSafeguardsRequired: true,
            quebecCrossBorderConfidentialityUndertakingRequired: true,
        },
        'approval-queue': {
            highRiskProcessingReviewRequired: true,
            quebecAdmHumanReviewRequired: true,
        },
        'attestation-manager': {
            privacyManagementProgramRequired: true,
            accountableIndividualRequired: true,
            quebecPiaRequired: true,
            breachLogRetentionDays: 730, // 24 months per breach regulation
        },
        'data-subject-rights': {
            responseDeadlineDays: 30,
            supportedRights: ['ACCESS', 'CORRECTION', 'PORTABILITY', 'ADM_INFORMATION', 'HUMAN_REVIEW_OF_ADM'],
        },
        'transparency-injector': {
            quebecLaw25AdmInformationRequired: true,
        },
        'event-bus': {
            caiBreachNotificationActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['PIPEDA-READY', 'QUEBEC-LAW25-READY'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['QC_LAW25_PERSONAL_INFO', 'QC_LAW25_HIGH_RISK_PI', 'QC_LAW25_ADM_OUTPUT'],
        categoryActions: {
            QC_LAW25_PERSONAL_INFO: 'WARN',
            QC_LAW25_HIGH_RISK_PI: 'BLOCK',
            QC_LAW25_ADM_OUTPUT: 'REQUIRE_APPROVAL',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['CA-QC'],
        auditLogRetentionDays: 1095, // 3 years default
        sessionRetentionDays: 365,
        incidentRetentionDays: 730, // 24 months per Quebec breach regulation
        reference: 'Quebec Law 25 breach notification requirements; CAI guidance on data retention; Pax1 default 3 years',
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'Quebec Law 25 -- breach notification to CAI and affected individuals when risk of serious injury. Pax1 default 72h.',
        requiredRecipients: ['cai', 'accountable-individual', 'affected-individuals'],
        formalNotificationRequired: true,
    },
    // F-NEW-VERA-PACK-FINAL-006 (2026-05-03): renamed 6 borrowed pipeda_* check IDs to
    // ca_qc_law25_* namespace. ca-pipeda validators continue to use pipeda_* (unchanged).
    // New checks registered in src/packs/check-registry.ts.
    validators: [
        { id: 'qc-law25-consent', description: 'Meaningful consent per identifiable purpose (Quebec enhanced standard)', reference: 'Quebec Law 25 consent provisions; PIPEDA Schedule 1 Principle 3 (incorporated)', check: 'ca_qc_law25_consent_active', failSeverity: 'CRITICAL' },
        { id: 'qc-law25-high-risk-review', description: 'High-risk processing PIA gate active', reference: 'Quebec Law 25 s. 3.3', check: 'ca_qc_law25_high_risk_review_active', failSeverity: 'CRITICAL' },
        { id: 'qc-law25-adm-info', description: 'Quebec Law 25 s. 12.1 ADM information obligations active', reference: 'Quebec Law 25 s. 12.1', check: 'quebec_law25_adm_active', failSeverity: 'HIGH' },
        { id: 'qc-law25-pia', description: 'Quebec Law 25 PIA for high-risk processing active', reference: 'Quebec Law 25 s. 3.3', check: 'quebec_law25_pia_active', failSeverity: 'HIGH' },
        { id: 'qc-law25-breach-log', description: '24-month breach log retention', reference: 'Quebec Law 25 breach notification requirements', check: 'ca_qc_law25_breach_log_active', failSeverity: 'HIGH' },
        { id: 'qc-law25-dsr', description: 'Access + correction + portability + ADM information + human review DSR workflow', reference: 'Quebec Law 25 subject rights provisions', check: 'ca_qc_law25_dsr_active', failSeverity: 'HIGH' },
        { id: 'qc-law25-cross-border', description: 'Cross-border transfer safeguards + confidentiality undertakings', reference: 'Quebec Law 25 s. 17', check: 'ca_qc_law25_cross_border_active', failSeverity: 'HIGH' },
        { id: 'qc-law25-breach-notification', description: 'CAI breach notification on risk of serious injury', reference: 'Quebec Law 25 breach notification requirements', check: 'ca_qc_law25_breach_notification_active', failSeverity: 'CRITICAL' },
    ],
};
//# sourceMappingURL=ca-qc-law25.js.map