/**
 * HMDA Compliance Pack
 *
 * Home Mortgage Disclosure Act
 * Authority: CFPB (Regulation C, 12 CFR Part 1003; HMDA 12 USC §2801 et seq.)
 *
 * HMDA requires covered financial institutions to collect, record, report, and
 * disclose data about mortgage applications and loans. The Loan Application
 * Register (LAR) is submitted annually to the CFPB HMDA Platform.
 *
 * LLM-EGRESS PRIMACY RULES (Thomas directive 2026-04-22):
 *   - BLOCK ABSOLUTELY: race, ethnicity, sex, and age (GMI data -- Government
 *     Monitoring Information) from any LLM operating in a credit-decision path.
 *     12 CFR §1002.6 (Reg B) prohibits using GMI in creditworthiness evaluation.
 *     HMDA data is collected for MONITORING purposes only; it cannot legally
 *     flow into the credit-decision LLM context.
 *   - ALLOW WITH GUARDRAILS: aggregated, anonymised HMDA data to LLMs for
 *     post-decision report generation (LAR validation, aggregate statistics).
 *   - REQUIRE ATTESTATION: annual LAR submission attestation signed by a
 *     named compliance officer before the March 1 regulatory deadline.
 *
 * This pack is the strictest egress rule in the mortgage catalogue because the
 * regulatory consequence of feeding GMI data to a credit-decision LLM is a
 * simultaneous HMDA violation (improper use) AND an ECOA/Reg B violation
 * (prohibited basis in credit decision).
 *
 * @connexum/ai-governance
 */
/**
 * HMDA (Home Mortgage Disclosure Act, 12 U.S.C. §2801) category classifiers.
 * Covers Government Monitoring Information (GMI): race, ethnicity, sex, age
 * collected for fair-lending analysis. These categories must be collected
 * separately from underwriting data and not used in credit decisions.
 */
export const HMDA_CATEGORY_CLASSIFIERS = {
    HMDA_GMI_RACE: {
        references: ['Reg C 12 CFR §1003.4(a)(10) -- GMI race field for HMDA LAR'],
        classifier: (input) => {
            if (/\b(?:race\s*(?:field|code|GMI)|applicant\s+race|GMI\s+race|racial\s+(?:category|classification))\b/i.test(input))
                return true;
            if (/\b(?:American\s+Indian|Asian|Black\s+or\s+African\s+American|Native\s+Hawaiian|White)\s+applicant\b/i.test(input))
                return true;
            return false;
        },
    },
    HMDA_GMI_ETHNICITY: {
        references: ['Reg C 12 CFR §1003.4(a)(10) -- GMI ethnicity field for HMDA LAR'],
        classifier: (input) => {
            if (/\b(?:ethnicity\s*(?:field|code|GMI)|applicant\s+ethnicity|GMI\s+ethnicity|Hispanic\s+or\s+Latino)\b/i.test(input))
                return true;
            return false;
        },
    },
    HMDA_GMI_SEX: {
        references: ['Reg C 12 CFR §1003.4(a)(10) -- GMI sex field for HMDA LAR'],
        classifier: (input) => {
            if (/\b(?:sex\s*(?:field|code|GMI)|applicant\s+sex|GMI\s+sex)\b/i.test(input))
                return true;
            return false;
        },
    },
    HMDA_GMI_AGE: {
        references: ['Reg C 12 CFR §1003.4(a)(10) -- GMI age field for HMDA LAR'],
        classifier: (input) => {
            if (/\b(?:age\s*(?:field|code|GMI)|applicant\s+age|GMI\s+age)\b/i.test(input))
                return true;
            return false;
        },
    },
    HMDA_LAR_ENTRY: {
        references: ['Reg C 12 CFR §1003.4 -- LAR (Loan Application Register) entry'],
        classifier: (input) => {
            if (/\b(?:LAR\s+(?:entry|record|submission)|HMDA\s+(?:LAR|submission|report)|loan\s+application\s+register)\b/i.test(input))
                return true;
            return false;
        },
    },
    MORTGAGE_APPLICATION_RECORD: {
        references: ['Reg C 12 CFR §1003 -- mortgage application record subject to HMDA'],
        classifier: (input) => {
            if (/\b(?:mortgage\s+(?:application|loan|record)|URLA|1003\s+form|home\s+loan\s+application)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['HMDA -- information security for LAR submission systems'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const HMDA_PACK = {
    categoryClassifiers: HMDA_CATEGORY_CLASSIFIERS,
    /** P3.5: LAR entries and mortgage application records are subject-keyed per HMDA 12 USC §2803. */
    subjectKeyedCategories: ['HMDA_LAR_ENTRY', 'MORTGAGE_APPLICATION_RECORD'],
    id: 'hmda',
    /** GAP-S1-01: MT-02 is the site/packs.html public code for this pack. */
    aliases: ['MT-02'],
    name: 'HMDA (Home Mortgage Disclosure Act)',
    version: '1.0.0',
    description: 'Home Mortgage Disclosure Act (12 USC §2801, Regulation C 12 CFR Part 1003) LLM-egress policy. Absolutely blocks Government Monitoring Information (race, ethnicity, sex, age) from reaching any LLM used in a credit-decision path. Allows aggregated LAR data to LLMs for report generation only. Enforces annual LAR submission attestation.',
    authority: 'Consumer Financial Protection Bureau (CFPB)',
    industries: ['mortgage-lender', 'bank', 'credit-union', 'community-development-financial-institution', 'fintech-lender'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'GMI egress block in credit-decision contexts; deny-by-default for HMDA_LAR_ENTRY in production LLM paths',
            reference: 'HMDA 12 USC §2803; 12 CFR §1003.4 (data collection); Reg B 12 CFR §1002.6 (prohibited use)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect and tag GMI fields (race, ethnicity, sex, age, national origin) and HMDA_LAR_ENTRY data class before any LLM egress',
            reference: '12 CFR §1003.4(a)(10)-(11) (ethnicity and race); §1003.4(a)(12) (sex); §1003.4(a)(18) (age)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident record of all HMDA LAR entries, GMI block decisions, and annual attestation events',
            reference: '12 CFR §1003.5 (annual reporting); §1003.6 (quarterly reporting for large filers)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Named compliance officer sign-off required on annual LAR submission; human review gate on any LLM-generated HMDA aggregate analysis',
            reference: '12 CFR §1003.5(a) -- annual LAR submission by March 1',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'HMDA data is the primary instrument for detecting mortgage lending disparate impact; bias monitoring on approval rates, pricing, and denial reasons by GMI categories',
            reference: '12 USC §2801(b) (fair lending purpose); ECOA 15 USC §1691',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Annual LAR submission deadline event (March 1); quarterly reporting clock for large filers; GMI-block violation events',
            reference: '12 CFR §1003.5(a) annual; §1003.5(d) quarterly (large filers)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-application HMDA LAR state maintained across agent restarts; GMI collection state (collected / not collected / not applicable)',
            reference: '12 CFR §1003.4 (data collection obligations)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Annual LAR submission attestation; large-filer quarterly attestation; certifying officer designation',
            reference: '12 CFR §1003.5(a) -- annual submission with officer certification',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detect GMI fields that have been obfuscated or proxied (zip-code proxy, surname proxy) entering LLM credit-decision contexts',
            reference: 'Reg B 12 CFR §1002.6; CFPB HMDA examination procedures',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'CFPB HMDA Platform submission credentials and third-party HMDA processing service agreements',
            reference: '12 CFR §1003.5 (CFPB HMDA Platform); CFPB HMDA Filing Instructions Guide',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            gmiLlmEgressBlockInCreditDecisionContext: true,
            hmdaLarEntryLlmEgressRequiresAggregationOnly: true,
            hmdaMonitoringPurposeOnlyEnforced: true,
        },
        'data-classifier': {
            enabledCategories: [
                'HMDA_GMI_RACE',
                'HMDA_GMI_ETHNICITY',
                'HMDA_GMI_SEX',
                'HMDA_GMI_AGE',
                'HMDA_LAR_ENTRY',
                'MORTGAGE_APPLICATION_RECORD',
                'CREDENTIALS',
            ],
            gmiRaceAction: 'BLOCK',
            gmiEthnicityAction: 'BLOCK',
            gmiSexAction: 'BLOCK',
            gmiAgeAction: 'BLOCK',
            hmdaLarEntryAction: 'BLOCK_UNLESS_AGGREGATED_POST_DECISION',
        },
        'approval-queue': {
            annualLarSubmissionRequiresComplianceOfficerSignoff: true,
            llmHmdaAggregateAnalysisRequiresHumanReview: true,
        },
        'event-bus': {
            hmdaAnnualLarDeadlineMarch1Active: true,
            hmdaQuarterlyLarDeadlineActive: true,
            gmiBlockViolationAlertActive: true,
        },
        'bias-monitor': {
            hmdaDisparateImpactMonitoringRequired: true,
            approvalRateByGmiRequired: true,
            pricingDisparityByGmiRequired: true,
            denialReasonDisparityByGmiRequired: true,
        },
        'anomaly-detector': {
            gmiProxyDetectionActive: true,
            zipCodeProxyDetectionActive: true,
            surnameProxyDetectionActive: true,
        },
        'attestation-manager': {
            annualLarSubmissionAttestationRequired: true,
            certifyingOfficerDesignationRequired: true,
            larSubmissionDeadlineDays: 60, // March 1 = ~60 days after calendar year end
        },
        'session-persistence': {
            perApplicationHmdaStateRequired: true,
            gmiCollectionStatusTracked: true,
        },
        'supply-chain': {
            cfpbHmdaPlatformCredentialsManaged: true,
            thirdPartyHmdaProcessorAgreementRequired: true,
        },
    },
    providerPolicy: {
        // Any LLM operating in a credit-decision path that receives HMDA-governed
        // data without the aggregation guardrail is non-compliant. No specific
        // provider is categorically blocked but each must attest to not using
        // GMI input for creditworthiness model training.
        blockedProviders: [],
        requiredCapabilities: ['HMDA-GMI-EGRESS-BLOCK', 'NO-GMI-TRAINING-ATTESTATION'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'HMDA_GMI_RACE',
            'HMDA_GMI_ETHNICITY',
            'HMDA_GMI_SEX',
            'HMDA_GMI_AGE',
            'HMDA_LAR_ENTRY',
            'MORTGAGE_APPLICATION_RECORD',
            'CREDENTIALS',
        ],
        categoryActions: {
            HMDA_GMI_RACE: 'BLOCK',
            HMDA_GMI_ETHNICITY: 'BLOCK',
            HMDA_GMI_SEX: 'BLOCK',
            HMDA_GMI_AGE: 'BLOCK',
            HMDA_LAR_ENTRY: 'BLOCK',
            MORTGAGE_APPLICATION_RECORD: 'LOG',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        // 3 years minimum per 12 CFR §1003.5; most examiner guidance (and FFIEC HMDA
        // examination procedures) expect 5 years for complete LAR history.
        auditLogRetentionDays: 1825, // 5 years
        sessionRetentionDays: 1095, // 3 years minimum regulatory floor
        incidentRetentionDays: 1825,
        reference: '12 CFR §1003.5 -- 3-year minimum HMDA transaction record retention; FFIEC examination practice expects 5 years.',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us'],
    },
    incidentPolicy: {
        // OPERATOR_VERIFICATION_REQUIRED (F-NEW-VERA-PACK-C2-02, 2026-05-03):
        // HMDA (12 USC §2801 et seq.) does not impose a standalone consumer breach
        // notification obligation. Breach notification for HMDA data (which often
        // contains NPI, GMI, and applicant PII) is governed by GLBA (15 USC §6801
        // et seq.; 12 CFR Part 1016) for covered financial institutions and by
        // applicable state breach notification laws. The 72-hour default is an
        // operational internal-escalation convention for GMI-in-credit-decision
        // violations under Reg B (12 CFR §1002.6) and HMDA anomaly events.
        // Operators MUST verify with counsel which breach notification regime
        // applies to their institution before relying on this default.
        // Authoritative source: HMDA 12 USC §2801; Reg C 12 CFR §1003;
        // Reg B 12 CFR §1002.6; GLBA 15 USC §6801; FFIEC Exam Procedures.
        notificationDeadlineHours: 72,
        reference: 'HMDA 12 USC §2801 et seq.; Reg B 12 CFR §1002.6 -- GMI-in-credit-decision is a simultaneous HMDA + ECOA violation; 72h internal escalation required.',
        requiredRecipients: ['compliance-officer', 'fair-lending-officer', 'cfpb-if-investigated'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'hmda-gmi-credit-decision-block',
            description: 'GMI data (race, ethnicity, sex, age) absolutely blocked from LLMs operating in credit-decision paths',
            reference: '12 CFR §1003.4(a)(10)-(18); Reg B 12 CFR §1002.6(b)(1) (prohibited basis)',
            check: 'hmda_gmi_credit_decision_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'hmda-lar-aggregation-only',
            description: 'HMDA LAR entries only permitted to LLMs in aggregated, post-decision, anonymised form',
            reference: '12 CFR §1003.5 (public LAR disclosure); HMDA monitoring-only purpose',
            check: 'hmda_lar_aggregation_only_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'hmda-annual-lar-attestation',
            description: 'Annual LAR submission signed off by named compliance officer by March 1',
            reference: '12 CFR §1003.5(a) -- annual submission deadline; officer certification required',
            check: 'hmda_annual_lar_attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'hmda-disparate-impact-monitoring',
            description: 'Disparate impact monitoring on approval rates, pricing, and denial reasons by GMI categories',
            reference: '12 USC §2801(b); ECOA 15 USC §1691; Reg B 12 CFR §1002',
            check: 'bias_monitor_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'hmda-proxy-detection',
            description: 'Proxy variable detection (zip-code, surname, etc.) in LLM credit-decision prompts',
            reference: 'CFPB HMDA examination procedures; Reg B 12 CFR §1002.6',
            check: 'hmda_proxy_detection_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'hmda-lar-state-persistence',
            description: 'Per-application HMDA LAR state survives agent restarts; GMI collection status tracked',
            reference: '12 CFR §1003.4 (data collection); §1003.5 (reporting)',
            check: 'hmda_lar_state_persistence_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'hmda-audit-trail',
            description: 'Tamper-evident audit trail for all HMDA LAR entries and GMI block decisions',
            reference: '12 CFR §1003.5 -- 3-year retention floor',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'hmda-quarterly-large-filer-clock',
            description: 'Quarterly LAR submission clock active for large filers (>60,000 covered loans prior year)',
            reference: '12 CFR §1003.5(d)',
            check: 'hmda_quarterly_large_filer_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'hmda-supply-chain-attestation',
            description: 'Third-party HMDA processors attested; no GMI used for model training by any LLM provider',
            reference: '12 CFR §1003.5 (CFPB HMDA Platform); Reg B 12 CFR §1002.6',
            check: 'subservice_registry_active',
            failSeverity: 'MEDIUM',
        },
    ],
    /**
     * P3-T1: RAG retrieval audit logging required for this pack.
     * Strict-mode packs require every retrieval to be paired with the
     * subsequent decision so auditors can replay what was retrieved before
     * the decision was made.
     */
    requiresRetrievalAuditLogging: true,
    /**
     * P3-T1: Level 4 autonomy requires explicit operator attestation when this pack
     * is active. Cap is Level 3 -- HITL oversight must be preserved for regulated data.
     */
    maxAutonomyLevelWithoutAttestation: 3,
    /**
     * P3-T1: RAG citations required for this pack. Every claim grounded in
     * retrieval must cite the source for auditor replay.
     */
    requiresCitations: true,
    /** P3-T1: RAG retrieval limited to allowlisted sources. */
    requiresRagSourceAllowlist: true,
    /** P3-T1: hook profile recommendation for this pack. */
    recommendedHookProfile: 'strict',
};
//# sourceMappingURL=hmda.js.map