"use strict";
/**
 * GDPR Compliance Pack
 *
 * EU General Data Protection Regulation (Regulation (EU) 2016/679)
 * compliance for AI systems processing personal data of EU/EEA
 * residents, regardless of where the controller/processor is
 * established (Art. 3 extraterritorial scope).
 *
 * Current state (2026):
 *   - **EU-US Data Privacy Framework (DPF)** (July 2023): primary
 *     transfer mechanism replacing invalidated Privacy Shield. Active
 *     and still valid in 2026 subject to ongoing litigation.
 *   - **EDPB Opinion 28/2024** on AI / GDPR: addresses lawful basis
 *     (Art. 6), purpose limitation (Art. 5(1)(b)), and automated
 *     decision-making (Art. 22) for AI systems, including generative
 *     AI training.
 *   - **Standard Contractual Clauses (SCCs)** 2021 module-based SCCs
 *     remain the non-DPF transfer fallback; Schrems II jurisprudence
 *     requires supplementary measures for high-risk jurisdictions.
 *   - **Art. 22 automated decision-making**: subjects have the right
 *     not to be subject to a decision based solely on automated
 *     processing that produces legal or similarly significant effects.
 *   - **Pairing**: when processing California residents, CCPA/CPRA
 *     pack should be activated alongside; when deploying in EU,
 *     EU AI Act pack for high-risk / GPAI obligations.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.GDPR_PACK = exports.GDPR_CATEGORY_CLASSIFIERS = void 0;
const _base_classifiers_1 = require("./_base-classifiers");
/**
 * GDPR category classifiers for the pack-driven classifier.
 * GDPR Art. 9 defines special categories of personal data.
 * The behavioral validator tests SPECIAL_CATEGORY -> BLOCK.
 */
exports.GDPR_CATEGORY_CLASSIFIERS = {
    PII: {
        references: ['GDPR Art. 4(1) -- personal data definition'],
        classifier: (input) => {
            // Shared US-style patterns (email, US SSN). Most EU citizens
            // don't have a US SSN, so the patterns below are required for
            // the GDPR pack to fire on legitimately EU personal data.
            if ((0, _base_classifiers_1.sharedPiiClassifier)(input))
                return true;
            if (/\b(?:name|full name|first name|last name)[:\s]+[A-Z][a-z]+ [A-Z][a-z]+/i.test(input))
                return true;
            // F-NEW-HIGH-6 (2026-05-02): EU-specific personal data shapes.
            // Without these, GDPR did not fire on a passport number, NHS
            // number, German Personalausweis, French INSEE/NIR, Spanish DNI,
            // Dutch BSN, Italian Codice Fiscale, IBAN, or EU phone number --
            // even though every one of these is GDPR Art. 4(1) personal data.
            //
            // Each pattern below is keyword-anchored so the classifier
            // doesn't false-fire on raw 8-12 digit strings everywhere.
            // Generic "passport number: <alphanumeric 6-12>" -- covers most EU passports
            if (/\b(?:passport(?:\s+(?:no\.?|number|#))?|passeport|reisepass|pasaporte)[:\s#]*[A-Z0-9]{6,12}\b/i.test(input))
                return true;
            // National ID / national identifier (generic + several country variants)
            if (/\b(?:national(?:\s+id| identifier)?|nationalid|personnummer|fodselsnummer|f.dselsnummer|cpr|kennitala)[:\s#]*[A-Z0-9-]{6,15}\b/i.test(input))
                return true;
            // German Personalausweis / Steueridentifikationsnummer
            if (/\b(?:personalausweis|steueridentifikationsnummer|steuer-id|tax-id-de)[:\s#]*\d{10,11}\b/i.test(input))
                return true;
            // French INSEE / NIR (numero de securite sociale) -- 13 digits + 2-digit key
            if (/\b(?:nir|insee|num.ro.*s.curit.*social)[:\s#]*[12]\s?\d{2}\s?\d{2}\s?\d{2}\s?\d{3}\s?\d{3}(?:\s?\d{2})?\b/i.test(input))
                return true;
            // Spanish DNI / NIE -- 8 digits + letter (DNI), or X/Y/Z + 7 digits + letter (NIE)
            if (/\b(?:dni|nie)[:\s#]*[XYZ]?\d{7,8}[A-Z]\b/i.test(input))
                return true;
            // Dutch BSN -- 9 digits keyword-anchored
            if (/\b(?:bsn|burgerservicenummer)[:\s#]*\d{9}\b/i.test(input))
                return true;
            // Italian Codice Fiscale -- 16 alphanumeric
            if (/\b(?:codice fiscale|cf)[:\s#]*[A-Z]{6}\d{2}[A-Z]\d{2}[A-Z]\d{3}[A-Z]\b/i.test(input))
                return true;
            // UK NHS number -- 10 digits, formatted with spaces or dashes (e.g. "485 777 3456")
            if (/\b(?:nhs(?:\s+number)?|nhs#)[:\s]*\d{3}[\s-]?\d{3}[\s-]?\d{4}\b/i.test(input))
                return true;
            // UK National Insurance Number (NI/NINO) -- 2 letters, 6 digits, 1 letter
            if (/\b(?:national insurance|ni number|nino)[:\s#]*[A-Z]{2}\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-Z]\b/i.test(input))
                return true;
            // IBAN -- starts with 2-letter country code + 2 check digits + up to 30 alphanumerics
            if (/\b[A-Z]{2}\d{2}\s?[A-Z0-9]{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{4}\s?[A-Z0-9]{0,18}\b/.test(input))
                return true;
            // EU-style phone number with country code: +<country> followed by 6-13 digits/spaces/dashes
            if (/\+(?:3[0-9]|4[0-9]|5[0-9]|7[0-9])[\s\d-]{6,13}\b/.test(input))
                return true;
            return false;
        },
    },
    PHI: {
        references: ['GDPR Art. 9(1) -- health data as special category'],
        classifier: (input) => {
            if (/\b(?:patient|diagnosis|prescription|medical record|health condition|clinical)\b/i.test(input))
                return true;
            if (/\bPHI\b/.test(input))
                return true;
            return false;
        },
    },
    SPECIAL_CATEGORY: {
        references: ['GDPR Art. 9(1) -- special categories of personal data'],
        classifier: (input) => {
            // Health / medical indicators
            if (/\b(?:HIV|AIDS|cancer|diabetes|mental health|psychiatric|therapy|disability|chronic illness)\b/i.test(input))
                return true;
            // Biometric data
            if (/\b(?:fingerprint|retinal|biometric|facial recognition|voiceprint)\s*(?:data|id|hash|template)?\b/i.test(input))
                return true;
            // Racial or ethnic origin
            if (/\b(?:racial|ethnic|race|ethnicity|national origin)\s*(?:origin|background|group)?\b/i.test(input))
                return true;
            // Political opinions
            if (/\b(?:political|party membership|trade union|union member)\b/i.test(input))
                return true;
            // Religious beliefs
            if (/\b(?:religion|religious belief|faith|church|mosque|synagogue|Muslim|Christian|Jewish|Hindu|Buddhist)\b/i.test(input))
                return true;
            // Sexual orientation
            if (/\b(?:sexual orientation|sexuality|LGBT|gay|lesbian|bisexual|transgender|queer)\b/i.test(input))
                return true;
            // Genetic data
            if (/\b(?:genetic data|DNA|genome|genotype|genetic profile)\b/i.test(input))
                return true;
            // Criminal convictions
            if (/\b(?:criminal conviction|criminal record|offence|felony|criminal history)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['GDPR Art. 32 -- security of processing'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
    DSR_REQUEST: {
        references: ['GDPR Art. 15-22 -- Data subject rights (access, rectification, erasure, portability, objection)'],
        classifier: (input) => {
            if (/\b(dsar|data\s+subject\s+access\s+request)\b/i.test(input))
                return true;
            if (/\bright\s+(?:to\s+)?(erasure|to\s+be\s+forgotten|of\s+access|to\s+rectification|to\s+restriction|to\s+object(?:ion)?|to\s+data\s+portability)\b/i.test(input))
                return true;
            if (/\bdata\s+portability\s+request\b/i.test(input))
                return true;
            if (/\brectification\s+request\b/i.test(input))
                return true;
            if (/\bgdpr\s+art\.?\s*(?:15|16|17|18|19|20|21|22)\b/i.test(input))
                return true;
            if (/\bsubject\s+objects\s+to\s+processing\b/i.test(input))
                return true;
            if (/\brespond\s+within\s+30\s+days\b/i.test(input) && /\b(request|access|gdpr|subject)\b/i.test(input))
                return true;
            return false;
        },
    },
    BREACH_72H_NOTIFICATION: {
        references: ['GDPR Art. 33 -- Notification of personal data breach to supervisory authority within 72 hours'],
        classifier: (input) => {
            if (/\bpersonal\s+data\s+breach\b/i.test(input))
                return true;
            if (/\bgdpr\s+(art\.?\s*)?33\b/i.test(input))
                return true;
            if (/\b72[\s-]?hour\s+(notification|deadline|clock|window)/i.test(input))
                return true;
            if (/\bdpa\s+notification\s+(required|due)/i.test(input))
                return true;
            if (/\bsupervisory\s+authority\b/i.test(input) && /\b(notify|notification|breach)\b/i.test(input))
                return true;
            if (/\bdata\s+breach\s+notification\b/i.test(input))
                return true;
            if (/\bbreach\s+notification\s+overdue\b/i.test(input))
                return true;
            if (/\bwithout\s+undue\s+delay\b/i.test(input) && /\b(breach|notify)\b/i.test(input))
                return true;
            return false;
        },
    },
    INTERNATIONAL_TRANSFER: {
        references: ['GDPR Art. 44-49 -- International transfers; SCCs, adequacy decisions, BCRs'],
        classifier: (input) => {
            if (/\bstandard\s+contractual\s+clauses?\b/i.test(input))
                return true;
            if (/\bsccs?\b/i.test(input) && /\b(transfer|gdpr|eu|chapter\s+v)\b/i.test(input))
                return true;
            if (/\bbinding\s+corporate\s+rules?\b/i.test(input))
                return true;
            if (/\bbcrs?\b/i.test(input) && /\b(transfer|approve|gdpr)\b/i.test(input))
                return true;
            if (/\badequacy\s+decision\b/i.test(input))
                return true;
            if (/\bschrems\s+ii\b/i.test(input))
                return true;
            if (/\b(international|cross[\s-]border)\s+(data\s+)?transfer\b/i.test(input))
                return true;
            if (/\btransfer\s+impact\s+assessment\b/i.test(input))
                return true;
            if (/\bgdpr\s+(art\.?\s*)?(44|45|46|47|48|49)\b/i.test(input))
                return true;
            if (/\b(third\s+country|non[\s-]adequate\s+jurisdiction)\b/i.test(input))
                return true;
            return false;
        },
    },
    AUTOMATED_DECISION: {
        references: ['GDPR Art. 22 -- Automated individual decision-making, including profiling'],
        classifier: (input) => {
            if (/\bautomated\s+decision/i.test(input))
                return true;
            if (/\bgdpr\s+(art\.?\s*)?22\b/i.test(input))
                return true;
            if (/\bsolely\s+automated\s+processing\b/i.test(input))
                return true;
            if (/\bprofiling[\s-]based\s+decision\b/i.test(input))
                return true;
            if (/\bright\s+(?:not\s+)?to\s+(human\s+intervention|be\s+subject\s+to\s+a\s+decision\s+based\s+solely\s+on\s+automated)/i.test(input))
                return true;
            if (/\bmeaningful\s+information\s+about\s+the\s+logic\b/i.test(input))
                return true;
            if (/\b(legal\s+effect|significant\s+effect)\b/i.test(input) && /\b(automated|profiling|data\s+subject)\b/i.test(input))
                return true;
            return false;
        },
    },
};
exports.GDPR_PACK = {
    categoryClassifiers: exports.GDPR_CATEGORY_CLASSIFIERS,
    /** P3.5: PII, PHI, and special-category data are inherently subject-keyed per GDPR Art. 4(1). */
    subjectKeyedCategories: ['PII', 'PHI', 'SPECIAL_CATEGORY'],
    id: 'gdpr',
    name: 'GDPR (EU General Data Protection Regulation)',
    version: '1.0.0',
    description: 'EU GDPR (Regulation (EU) 2016/679) compliance for AI systems processing personal data of EU/EEA residents. Includes EU-US Data Privacy Framework (2023) as primary transfer mechanism, 2021 Module SCCs as fallback, EDPB Opinion 28/2024 AI guidance, and Art. 22 automated decision-making protections.',
    authority: 'European Data Protection Board (EDPB) + national supervisory authorities',
    industries: ['all-eu', 'saas', 'fintech', 'healthcare', 'legal', 'ecommerce', 'adtech', 'hr-tech'],
    requiredModules: [
        {
            name: 'data-classifier',
            required: true,
            reason: 'PII detection and data minimisation',
            reference: 'Art. 5(1)(c) -- Data Minimisation; Art. 9 -- Special Categories',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Records of processing activities; evidence of lawful basis',
            reference: 'Art. 30 -- Records of Processing Activities; Art. 5(2) -- Accountability',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Data protection by design and default; security of processing',
            reference: 'Art. 25, Art. 32 -- Data Protection by Design + Security',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Access control; lawful basis enforcement; purpose limitation',
            reference: 'Art. 5(1)(b), Art. 25, Art. 32',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Breach detection triggering 72-hour notification clock',
            reference: 'Art. 33 -- Notification of Breach',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Purpose limitation state; lawful basis per processing activity',
            reference: 'Art. 5(1)(b) -- Purpose Limitation',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Controller / processor authentication',
            reference: 'Art. 28 -- Processor; Art. 32',
        },
        {
            name: 'data-subject-rights',
            required: true,
            reason: 'Right to access, rectification, erasure, portability, objection, automated-decision opt-out',
            reference: 'Art. 15-22 -- Data Subject Rights',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Art. 22 automated-decision safeguards; human review for consequential decisions',
            reference: 'Art. 22 -- Automated Individual Decision-Making',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Sub-processor management; DPA verification; transfer mechanism attestation',
            reference: 'Art. 28(2), Art. 44-49 -- Sub-processors + Transfers',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Records of processing activities + DPIAs + transfer impact assessments',
            reference: 'Art. 30, Art. 35 -- ROPA + DPIA',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: ['PII', 'PHI', 'SPECIAL_CATEGORY'],
            defaultAction: 'WARN',
            specialCategoryAction: 'BLOCK', // Art. 9 requires stricter basis
        },
        'encryption-layer': {
            algorithm: 'aes-256-gcm',
            encryptionForPersonalData: true,
        },
        'data-subject-rights': {
            responseDeadlineDays: 30, // Art. 12(3)
            extensionDeadlineDays: 60, // up to 2 additional months
            supportedRights: ['ACCESS', 'RECTIFICATION', 'ERASURE', 'PORTABILITY', 'OBJECTION', 'RESTRICTION', 'AUTOMATED_DECISION_OPT_OUT'],
        },
        'approval-queue': {
            article22HumanReviewRequired: true,
        },
        'governance-runtime': {
            lawfulBasisEnforced: true,
            purposeLimitationEnforced: true,
            dpfTransferMechanismSupported: true,
            sccTransferMechanismSupported: true,
        },
        'attestation-manager': {
            ropaRequired: true,
            dpiaRequired: true,
            transferImpactAssessmentRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['GDPR-DPA'],
        blockReasons: {
            deepseek: 'No DPF / SCC pathway viable; PRC National Intelligence Law creates Schrems II / equivalent adequacy failure.',
            baidu: 'No adequate transfer mechanism for PRC.',
            alibaba: 'No adequate transfer mechanism for PRC.',
        },
    },
    dataPolicy: {
        scanCategories: ['PII', 'PHI', 'SPECIAL_CATEGORY', 'CREDENTIALS', 'DSR_REQUEST', 'BREACH_72H_NOTIFICATION', 'INTERNATIONAL_TRANSFER', 'AUTOMATED_DECISION'],
        categoryActions: {
            PII: 'WARN',
            PHI: 'BLOCK',
            SPECIAL_CATEGORY: 'BLOCK',
            CREDENTIALS: 'BLOCK',
            DSR_REQUEST: 'WARN',
            BREACH_72H_NOTIFICATION: 'WARN',
            INTERNATIONAL_TRANSFER: 'WARN',
            AUTOMATED_DECISION: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['EU'],
        auditLogRetentionDays: 1095, // 3 years default (purpose-dependent)
        sessionRetentionDays: 365,
        incidentRetentionDays: 1825, // 5 years for breach evidence
        reference: 'Art. 5(1)(e) -- Storage Limitation (purpose-dependent). Pax1 default 3 years with 5-year breach-evidence retention.',
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'Art. 33 -- 72-hour notification to supervisory authority from awareness. Art. 34 -- notify affected data subjects without undue delay if high risk.',
        requiredRecipients: ['dpo', 'supervisory-authority', 'affected-data-subjects-if-high-risk'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'gdpr-pii-detection',
            description: 'PII and Special Category detection active',
            reference: 'Art. 5(1)(c), Art. 9',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'gdpr-encryption',
            description: 'Personal data encrypted at rest and in transit',
            reference: 'Art. 32(1)(a)',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'gdpr-audit-trail',
            description: 'Records of processing activities (ROPA) maintained',
            reference: 'Art. 30',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'gdpr-breach-notification',
            description: '72-hour breach notification configured',
            reference: 'Art. 33',
            check: 'gdpr_breach_72h_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'gdpr-transfer-check',
            description: 'Transfers to non-adequate jurisdictions use DPF or SCCs',
            reference: 'Art. 44-49',
            check: 'gdpr_transfer_mechanism_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'gdpr-dpa-check',
            description: 'All processors have a DPA on file',
            reference: 'Art. 28',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'gdpr-purpose-limitation',
            description: 'Processing limited to stated purposes',
            reference: 'Art. 5(1)(b)',
            check: 'gdpr_purpose_limitation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'gdpr-lawful-basis',
            description: 'Lawful basis identified and enforced for each processing activity',
            reference: 'Art. 6',
            check: 'gdpr_lawful_basis_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'gdpr-dsr',
            description: 'Data subject rights workflow active (Art. 15-22)',
            reference: 'Art. 15-22',
            check: 'dsr_deadline_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'gdpr-article-22',
            description: 'Automated-decision opt-out and human review for Art. 22 decisions',
            reference: 'Art. 22',
            check: 'gdpr_article22_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'gdpr-ropa',
            description: 'Records of Processing Activities complete per Art. 30',
            reference: 'Art. 30',
            check: 'gdpr_ropa_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'gdpr-dpia',
            description: 'Data Protection Impact Assessment completed for high-risk processing',
            reference: 'Art. 35',
            check: 'gdpr_dpia_active',
            failSeverity: 'MEDIUM',
        },
    ],
    /**
     * P3-T1: RAG retrieval audit logging required for this pack.
     * Strict-mode packs require every retrieval to be paired with the
     * subsequent decision so auditors can replay what was retrieved before
     * the decision was made.
     */
    requiresRetrievalAuditLogging: true,
    /**
     * P3-T1: Level 4 autonomy requires explicit operator attestation when this pack
     * is active. Cap is Level 3 -- HITL oversight must be preserved for regulated data.
     */
    maxAutonomyLevelWithoutAttestation: 3,
    /**
     * P3-T1: RAG citations required for this pack. Every claim grounded in
     * retrieval must cite the source for auditor replay.
     */
    requiresCitations: true,
    /** P3-T1: RAG retrieval limited to allowlisted sources. */
    requiresRagSourceAllowlist: true,
    /** P3-T1: hook profile recommendation for this pack. */
    recommendedHookProfile: 'strict',
};
//# sourceMappingURL=gdpr.js.map