"use strict";
/**
 * FERPA Compliance Pack
 *
 * Family Educational Rights and Privacy Act (20 USC 1232g; 34 CFR Part 99).
 * Enacted 1974; implementing regulations updated most recently in 2012
 * (76 FR 75604) and supplemented by the Department of Education's
 * 2023-2024 guidance on AI and student records.
 *
 * FERPA protects education records of students attending educational
 * institutions that receive federal funding. Key obligations for AI systems:
 *
 *   - 34 CFR 99.3 (definitions): Education records = records directly
 *     related to a student maintained by an institution or its agents.
 *     AI systems that generate, process, or store such records are
 *     subject to FERPA.
 *   - 34 CFR 99.10-12: Parents/eligible students have rights to inspect,
 *     review, and correct education records.
 *   - 34 CFR 99.30: Prior written consent required before disclosure to
 *     third parties. AI vendors who receive education records are
 *     "school officials" under the school-official exception (34 CFR
 *     99.31(a)(1)) only if under direct control of the institution with
 *     a legitimate educational interest.
 *   - 34 CFR 99.31(a)(1): School-official exception. AI vendors must
 *     have: (a) legitimate educational interest, (b) direct control by
 *     institution, (c) no re-disclosure rights, (d) agreement to destroy
 *     or return records when purpose served.
 *   - 34 CFR 99.35: Studies exception for education research uses of
 *     AI; data use agreement required.
 *   - 34 CFR 99.36: Health/safety emergency exception (limited AI use
 *     without consent in emergency situations).
 *   - NIST SP 800-53 / FedRAMP: Not mandated by FERPA, but DoE 2023
 *     guidance recommends NIST CSF for AI systems handling student data.
 *   - COPPA intersection: Students under 13 -- AI systems also subject
 *     to COPPA (15 USC 6501); school-consent model applies.
 *
 * State counterparts: many states have separate student privacy laws
 * (CA Student Online Personal Information Protection Act [SOPIPA],
 * NY Education Law 2-d, TX Education Code 32.151-152). This pack
 * covers FERPA federal floor.
 *
 * Sovereignty: US Federal. Institution-level implementation required.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.FERPA_PACK = exports.FERPA_CATEGORY_CLASSIFIERS = void 0;
/**
 * FERPA category classifiers for the pack-driven classifier (W1).
 * EDUCATION_RECORD and related categories are declared here so the runtime
 * reads from this pack, not from hardcoded strings.
 */
exports.FERPA_CATEGORY_CLASSIFIERS = {
    EDUCATION_RECORD: {
        references: ['34 CFR 99.3 -- education record definition'],
        classifier: (input) => {
            // Student ID / enrollment number patterns
            if (/\b(?:student[_\-\s]?id|enrollment[_\-\s]?(?:number|#)|stu[_\-\s]?\d{4,12})\b/i.test(input))
                return true;
            // GPA / grade context
            if (/\b(?:GPA|grade\s+point\s+average|transcript|grade\s+report|academic\s+record)\b/i.test(input))
                return true;
            // Disciplinary records
            if (/\b(?:disciplinary\s+(?:record|action|report)|suspension|expulsion)\b/i.test(input))
                return true;
            // Financial aid records
            if (/\b(?:FAFSA|financial\s+aid\s+award|pell\s+grant|student\s+loan\s+(?:id|account))\b/i.test(input))
                return true;
            // Explicit FERPA record markers
            if (/\b(?:FERPA|education\s+record|student\s+record)\b/i.test(input))
                return true;
            return false;
        },
    },
    STUDENT_PII: {
        references: ['34 CFR 99.3 -- personally identifiable information in education records'],
        classifier: (input) => {
            // Name + institution context
            if (/\b(?:student\s+name|enrolled\s+at|attends|matriculated)\b/i.test(input))
                return true;
            return false;
        },
    },
    UNDER_13_STUDENT: {
        references: ['COPPA 15 USC 6501; 16 CFR 312 -- children under 13'],
        classifier: (input) => {
            if (/\b(?:under\s*13|age\s*[<:]\s*13|k-?12\s+student|elementary\s+school|kindergarten|grade\s+[1-5])\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['FERPA Security -- access credential protection'],
        pattern: /\b(?:password|api[_-]?key|secret[_-]?key|access[_-]?token)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i,
    },
};
exports.FERPA_PACK = {
    categoryClassifiers: exports.FERPA_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: Education records, student PII, and under-13 student data are
     * inherently subject-keyed -- each disclosure must carry a data subject ID
     * to satisfy FERPA 34 CFR §99.32 record-of-disclosures requirement.
     */
    subjectKeyedCategories: ['EDUCATION_RECORD', 'STUDENT_PII', 'UNDER_13_STUDENT'],
    id: 'ferpa',
    name: 'FERPA (Student Privacy)',
    version: '1.0.0',
    description: 'Family Educational Rights and Privacy Act (20 USC 1232g; 34 CFR Part 99) compliance for AI systems processing student education records. Covers school-official exception requirements for AI vendors (34 CFR 99.31(a)(1)), prior-written-consent rules, student right to inspect/correct records, data-use agreements for research exception (34 CFR 99.35), COPPA intersection for under-13 students, and DoE 2023 AI guidance on student data.',
    authority: 'US Department of Education (Family Policy Compliance Office, FPCO)',
    industries: ['edtech', 'higher-education', 'k12', 'education', 'learning-management', 'student-information-systems'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Prior-written-consent enforcement before disclosure; school-official exception controls; COPPA age gate for under-13',
            reference: '34 CFR 99.30 (prior consent); 34 CFR 99.31(a)(1) (school official exception); COPPA 15 USC 6501',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident access log per student record; disclosure records (who accessed, when, for what purpose)',
            reference: '34 CFR 99.32 (record of disclosures); 34 CFR 99.12(c)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Encryption of education records at rest and in transit; DoE 2023 AI guidance security baseline',
            reference: 'DoE 2023 AI and Student Privacy Guidance; NIST SP 800-53 (DoE recommended)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Identify and classify education records; detect PII; identify under-13 student data; flag for COPPA gate',
            reference: '34 CFR 99.3 (education record definition); COPPA Rule 16 CFR 312 (under-13)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-student rights tracking; parental consent status; COPPA school-consent workflow; legitimate-educational-interest verification',
            reference: '34 CFR 99.10-12 (parent/student rights); 34 CFR 99.31(a)(1) (legitimate educational interest)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'AI vendor school-official exception agreement; no-redisclosure terms; data-use agreement for research exception',
            reference: '34 CFR 99.31(a)(1) (school-official agreement); 34 CFR 99.35 (data-use agreement)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Prior written consent gate; health/safety emergency disclosure review; research DUA approval',
            reference: '34 CFR 99.30 (prior consent gate); 34 CFR 99.35 (DUA review); 34 CFR 99.36 (emergency gate)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'School-official exception documentation; annual FERPA notice of rights; vendor agreement register',
            reference: '34 CFR 99.7 (annual notice); 34 CFR 99.31(a)(1) (agreement documentation)',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Annual FERPA notice of rights to students/parents; disclosure of AI use to institution administrators',
            reference: '34 CFR 99.7 (annual notification of rights)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Disclosure events; consent-revocation events; breach detection and response stream',
            reference: '34 CFR 99.32 (record of disclosures); DoE incident response guidance',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'EDUCATION_RECORD',
                'STUDENT_PII',
                'UNDER_13_STUDENT',
                'DIRECTORY_INFORMATION',
                'CREDENTIALS',
            ],
            educationRecordAction: 'BLOCK_UNLESS_CONSENT_OR_EXCEPTION',
            under13Action: 'BLOCK_UNLESS_SCHOOL_CONSENT',
        },
        'governance-runtime': {
            priorWrittenConsentRequired: true,
            schoolOfficialExceptionControlRequired: true,
            coppaAgeGateRequired: true,
            legitimateEducationalInterestRequired: true,
        },
        'session-persistence': {
            perStudentRightsTrackingRequired: true,
            parentalConsentStatusRequired: true,
            coppaSchoolConsentRequired: true,
        },
        'supply-chain': {
            vendorSchoolOfficialAgreementRequired: true,
            vendorNoRedisclosureRequired: true,
            vendorDataUseAgreementRequired: true,
        },
        'approval-queue': {
            priorWrittenConsentGateRequired: true,
            researchDuaApprovalRequired: true,
            healthSafetyEmergencyGateRequired: true,
        },
        'attestation-manager': {
            annualFerpaNoticeRequired: true,
            schoolOfficialExceptionDocumentationRequired: true,
        },
        'transparency-injector': {
            annualRightsNoticeRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['DATA-RESIDENCY-US', 'ZERO-TRAINING-ON-INPUTS', 'NO-REDISCLOSURE'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'EDUCATION_RECORD',
            'STUDENT_PII',
            'UNDER_13_STUDENT',
            'CREDENTIALS',
        ],
        categoryActions: {
            EDUCATION_RECORD: 'BLOCK',
            STUDENT_PII: 'WARN',
            UNDER_13_STUDENT: 'BLOCK',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // 34 CFR 99.32: disclosure records retained as long as the education record; typically while student is enrolled + N years.
        // DoE guidance: retain audit logs minimum 5 years.
        auditLogRetentionDays: 1825,
        sessionRetentionDays: 1825,
        incidentRetentionDays: 1825,
        reference: '34 CFR 99.32 (disclosure records retained with education record); DoE audit log guidance (5 years)',
    },
    incidentPolicy: {
        // FERPA has no explicit breach notification statute. DoE guidance recommends notifying students/parents within 60 days of discovery.
        // Pax1 default: 72 hours for internal escalation, 60 days for formal student/parent notification.
        notificationDeadlineHours: 72,
        reference: 'DoE 2023 AI and Student Privacy Guidance (notify institution within reasonable time; 60-day default for student/parent)',
        requiredRecipients: ['institution-privacy-officer', 'doe-fpco', 'affected-students-or-parents'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'ferpa-prior-consent-gate',
            description: 'Prior written consent gate active before disclosure of education records',
            reference: '34 CFR 99.30',
            check: 'ferpa_prior_consent_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ferpa-school-official-agreement',
            description: 'AI vendor school-official exception agreement on file with required terms',
            reference: '34 CFR 99.31(a)(1)',
            check: 'ferpa_school_official_agreement_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ferpa-coppa-gate',
            description: 'COPPA age gate active for under-13 students; school-consent model enforced',
            reference: 'COPPA 15 USC 6501; 16 CFR 312; 34 CFR 99.30',
            check: 'ferpa_coppa_gate_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ferpa-education-record-classifier',
            description: 'Education records classified and blocked without consent or applicable exception',
            reference: '34 CFR 99.3 (education record definition)',
            check: 'ferpa_education_record_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ferpa-disclosure-log',
            description: 'Disclosure log maintained per student record',
            reference: '34 CFR 99.32',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'ferpa-dsr-rights',
            description: 'Student/parent rights to inspect and correct records supported',
            reference: '34 CFR 99.10-12',
            check: 'ferpa_dsr_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ferpa-annual-notice',
            description: 'Annual FERPA notification of rights delivered to students and parents',
            reference: '34 CFR 99.7',
            check: 'ferpa_annual_notice_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'ferpa-encryption',
            description: 'Education records encrypted at rest and in transit',
            reference: 'DoE 2023 AI and Student Privacy Guidance',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=ferpa.js.map