"use strict";
/**
 * NYC Local Law 144 Compliance Pack
 *
 * New York City Local Law 144 of 2021 -- Automated Employment Decision
 * Tools (AEDT). Effective 5 July 2023; enforced by NYC Department of
 * Consumer and Worker Protection (DCWP). Implementing regulations at
 * NYCRR 5-300.
 *
 * Standards referenced:
 *   - NYC Admin Code §20-870 (bias audit requirement)
 *   - NYC Admin Code §20-871 (public disclosure, candidate notice,
 *     alternative selection process)
 *   - NYCRR 5-300 (audit methodology + record-keeping)
 *   - 2024 DCWP FAQ (substantially-assists threshold + audit scope)
 *
 * Key obligations:
 *   - Annual independent bias audit within 1 year before AEDT use
 *   - Public disclosure of bias-audit summary on employer website
 *   - 10-business-day candidate notice before AEDT use
 *   - Alternative (non-AEDT) selection process option
 *   - Impact-ratio calculation per demographic category (gender,
 *     race/ethnicity, intersectional)
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.NYC_LL_144_PACK = exports.NYC_LL_144_CATEGORY_CLASSIFIERS = void 0;
/**
 * NYC Local Law 144 (Automated Employment Decision Tools) category classifiers.
 * Governs use of AI/ML for employment decisions affecting NYC candidates/employees.
 * Annual bias audits required; candidate notice 10 business days prior to use.
 */
exports.NYC_LL_144_CATEGORY_CLASSIFIERS = {
    EMPLOYMENT_DECISION: {
        references: ['NYC Admin. Code §20-871 -- automated employment decision tool; consequential hiring decisions'],
        classifier: (input) => {
            if (/\b(?:employment\s+(?:decision|screening|selection)|automated\s+(?:hiring|resume\s+screening|candidate\s+selection))\b/i.test(input))
                return true;
            if (/\b(?:AEDT|automated\s+employment\s+decision\s+tool|hiring\s+algorithm)\b/i.test(input))
                return true;
            return false;
        },
    },
    DEMOGRAPHIC_DATA: {
        references: ['NYC Admin. Code §20-871(c) -- bias audit must cover race/ethnicity/sex/intersectional categories'],
        classifier: (input) => {
            if (/\b(?:race|ethnicity|sex|gender)\s+(?:of\s+(?:candidate|applicant)|(?:category|group|data))\b/i.test(input))
                return true;
            if (/\b(?:demographic\s+(?:data|category|group|breakdown|subgroup))\b/i.test(input))
                return true;
            return false;
        },
    },
    CANDIDATE_PII: {
        references: ['NYC Admin. Code §20-871 -- candidate personal information in AEDT systems'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:candidate\s+(?:name|ID|profile|application)|applicant\s+(?:name|data|record))\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['NYC LL 144 -- access controls for AEDT systems; credential protection'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.NYC_LL_144_PACK = {
    categoryClassifiers: exports.NYC_LL_144_CATEGORY_CLASSIFIERS,
    /** P3.5: Candidate PII and employment decisions are subject-keyed per NYC LL 144. */
    subjectKeyedCategories: ['CANDIDATE_PII', 'EMPLOYMENT_DECISION'],
    id: 'nyc-ll-144',
    name: 'NYC LL 144 (AEDT Bias Audit)',
    version: '1.0.0',
    description: 'NYC Local Law 144 AEDT Bias Audit compliance. Annual independent bias audit + public disclosure + 10-business-day candidate notice + alternative-process option. NYCRR 5-300 audit methodology.',
    authority: 'NYC Department of Consumer and Worker Protection (DCWP)',
    industries: ['employers-nyc', 'employment-agencies-nyc', 'hr-technology-vendor', 'talent-acquisition-platform'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'AEDT scope classification; alternative-process enforcement',
            reference: 'NYC Admin Code §20-870(a); §20-871(a)(2)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident log of AEDT decisions + demographic signals',
            reference: 'NYCRR 5-300 record-keeping',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'EMPLOYMENT_DECISION + DEMOGRAPHIC_DATA + CANDIDATE_PII classification',
            reference: 'NYC Admin Code §20-870',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'NYC residence / NYC-job tagging; 3-year retention of demographic signal',
            reference: 'NYCRR 5-300',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Independent third-party auditor attestation and identity tracking',
            reference: 'NYC Admin Code §20-870(d)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: '10-business-day waiting period enforcement after candidate notice',
            reference: 'NYC Admin Code §20-871',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Bias audit attestation + public-URL disclosure attestation + annual renewal tracking',
            reference: 'NYC Admin Code §20-870, §20-871',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Impact-ratio computation per demographic category; NYCRR 5-300 methodology',
            reference: 'NYCRR 5-300',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Candidate notice + alternative-process disclosure',
            reference: 'NYC Admin Code §20-871',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'AEDT activation events; audit expiry alerts; DCWP enforcement signals',
            reference: 'NYC DCWP enforcement',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            aedtScopeClassificationRequired: true,
            alternativeProcessEnforcementRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['EMPLOYMENT_DECISION', 'DEMOGRAPHIC_DATA', 'CANDIDATE_PII', 'CREDENTIALS'],
            demographicDataForBiasAuditOnly: true,
        },
        'session-persistence': {
            nycResidenceTaggingRequired: true,
            demographicSignalRetentionDays: 1095, // 3 years
        },
        'supply-chain': {
            independentThirdPartyAuditorRequired: true,
        },
        'approval-queue': {
            tenBusinessDayCandidateNoticeRequired: true,
        },
        'attestation-manager': {
            biasAuditAnnualRenewalRequired: true,
            biasAuditAnnualRenewalWindowDays: 365,
            publicUrlDisclosureRequired: true,
            biasAuditRenewalEarlyWarningDays: 60,
        },
        'bias-monitor': {
            nycrr5300ImpactRatioMethodology: true,
            intersectionalCategoriesRequired: true,
        },
        'transparency-injector': {
            candidateNoticeRequired: true,
            alternativeProcessDisclosureRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['AEDT-BIAS-AUDIT-READY'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['EMPLOYMENT_DECISION', 'DEMOGRAPHIC_DATA', 'CANDIDATE_PII', 'CREDENTIALS'],
        categoryActions: {
            EMPLOYMENT_DECISION: 'LOG',
            DEMOGRAPHIC_DATA: 'LOG',
            CANDIDATE_PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US-NYC'],
        auditLogRetentionDays: 1095, // 3 years per NYCRR 5-300
        sessionRetentionDays: 1095,
        incidentRetentionDays: 1095,
        reference: 'NYCRR 5-300 record-keeping -- 3 years + bias audit evidence for 3 years beyond audit period',
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'No statutory NYC deadline but DCWP enforcement is rapid. Pax1 defaults to 72-hour internal escalation on AEDT control failure + 5-business-day update of public disclosure.',
        requiredRecipients: ['hr-leadership', 'legal-counsel', 'dcwp-contact-if-material'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'nyc144-bias-audit',
            description: 'Valid bias audit within last 365 days',
            reference: 'NYC Admin Code §20-870',
            check: 'nyc144_bias_audit_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nyc144-independent-auditor',
            description: 'Bias audit performed by independent third-party auditor',
            reference: 'NYC Admin Code §20-870(d)',
            check: 'nyc144_independent_auditor_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nyc144-public-disclosure',
            description: 'Bias audit summary publicly disclosed at a stable URL',
            reference: 'NYC Admin Code §20-871',
            check: 'nyc144_public_disclosure_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nyc144-candidate-notice',
            description: '10-business-day candidate notice before AEDT use',
            reference: 'NYC Admin Code §20-871',
            check: 'nyc144_candidate_notice_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nyc144-alternative-process',
            description: 'Alternative (non-AEDT) selection process offered',
            reference: 'NYC Admin Code §20-871(a)(2)',
            check: 'nyc144_alternative_process_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nyc144-aedt-scope',
            description: 'AEDT scope classification current (substantially-assists threshold)',
            reference: '2024 DCWP FAQ; §20-870(a)',
            check: 'nyc144_aedt_scope_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nyc144-impact-ratio',
            description: 'Impact ratios computed per NYCRR 5-300 methodology (intersectional)',
            reference: 'NYCRR 5-300',
            check: 'nyc144_impact_ratio_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nyc144-demographic-data',
            description: 'NYC demographic data tagged; non-NYC data not conflated',
            reference: 'NYC Admin Code §20-871',
            check: 'nyc144_demographic_tagging_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'nyc144-audit-renewal',
            description: '365-day audit renewal window with 60-day early warning',
            reference: 'NYC Admin Code §20-870',
            check: 'nyc144_audit_renewal_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nyc144-record-keeping',
            description: '3-year record retention per NYCRR 5-300',
            reference: 'NYCRR 5-300',
            check: 'nyc144_record_keeping_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=nyc-ll-144.js.map