"use strict";
/**
 * PIPL Compliance Pack
 *
 * Personal Information Protection Law of the People's Republic of
 * China (effective 1 November 2021). Enforced by the Cyberspace
 * Administration of China (CAC) with supporting authorities.
 *
 * Standards referenced:
 *   - PIPL (Nov 2021)
 *   - Data Security Law (DSL, Sept 2021)
 *   - Cybersecurity Law (CSL, June 2017)
 *   - 2024 CAC Provisions on Promoting and Regulating Cross-Border
 *     Data Flows (CBDT Provisions)
 *   - Interim Measures for Generative AI Services (15 Aug 2023)
 *   - 2023 Measures for Security Assessment of Outbound Data Transfer
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.PIPL_PACK = exports.PIPL_CATEGORY_CLASSIFIERS = void 0;
/**
 * PIPL (PRC Personal Information Protection Law) category classifiers.
 * Covers Chinese personal information, sensitive personal information (Art. 28),
 * important data, and child data per PIPL + DSL + CSL framework.
 */
exports.PIPL_CATEGORY_CLASSIFIERS = {
    PII_CN: {
        references: ['PIPL Art. 4 -- personal information; any information that identifies or could identify a natural person'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            // Chinese ID (18-digit resident identity card)
            if (/\b\d{17}[\dXx]\b/.test(input))
                return true;
            // Chinese passport (E + 8 digits)
            if (/\b[EeGg]\d{8}\b/.test(input))
                return true;
            if (/\b(?:居民身份证|身份证号|护照号|手机号|姓名|出生日期)\b/.test(input))
                return true;
            if (/\b(?:chinese\s+(?:id|resident\s+id)|resident\s+identity\s+card|personal\s+information\s+(?:of|belonging\s+to)\s+(?:chinese|PRC))\b/i.test(input))
                return true;
            return false;
        },
    },
    SENSITIVE_PII_CN: {
        references: ['PIPL Art. 28 -- sensitive personal information; heightened protection category'],
        classifier: (input) => {
            // Financial account / biometric
            if (/\b(?:biometric\s+(?:data|information)|genetic\s+(?:data|information)|生物识别|基因信息|指纹|虹膜|人脸识别)\b/i.test(input))
                return true;
            // Health / medical
            if (/\b(?:medical\s+(?:record|history|diagnosis)|health\s+(?:data|information)|疾病|医疗|诊断)\b/i.test(input))
                return true;
            // Financial account
            if (/\b(?:bank\s+account\s+(?:number|details)|financial\s+account|银行账号|金融账户)\b/i.test(input))
                return true;
            // Religious / political
            if (/\b(?:religious\s+belief|political\s+view|宗教信仰|政治观点)\b/i.test(input))
                return true;
            // Location data (precise)
            if (/\b(?:precise\s+location|location\s+tracking|行踪轨迹|精确位置)\b/i.test(input))
                return true;
            return false;
        },
    },
    IMPORTANT_DATA: {
        references: ['PRC Data Security Law (DSL) Art. 21 -- important data; data affecting national security or public interest'],
        classifier: (input) => {
            if (/\b(?:important\s+data|national\s+security\s+data|critical\s+(?:infrastructure\s+data|information\s+infrastructure)|重要数据|关键信息基础设施)\b/i.test(input))
                return true;
            if (/\b(?:cross.?border\s+data\s+transfer|outbound\s+data\s+(?:transfer|flow)|数据出境|跨境数据)\b/i.test(input))
                return true;
            return false;
        },
    },
    CHILD_DATA_CN: {
        references: ['PIPL Art. 31 -- processing personal information of minors under 14; parental consent required'],
        classifier: (input) => {
            if (/\b(?:minor\s+(?:under|age\s+14)|child\s+(?:data|information)|未成年人|儿童个人信息|14岁以下)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['PIPL Art. 51 -- security measures; technical controls for personal information processors'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.PIPL_PACK = {
    categoryClassifiers: exports.PIPL_CATEGORY_CLASSIFIERS,
    /** P3.5: Chinese PII, sensitive PII, and child data are subject-keyed per PIPL Art. 4. */
    subjectKeyedCategories: ['PII_CN', 'SENSITIVE_PII_CN', 'CHILD_DATA_CN'],
    id: 'pipl',
    name: 'PIPL (China)',
    version: '1.0.0',
    description: 'PRC Personal Information Protection Law (1 Nov 2021) with 2024 CAC CBDT Provisions and Interim Measures for Generative AI Services (Aug 2023). Extraterritorial reach for processing of Chinese individuals.',
    authority: 'Cyberspace Administration of China (CAC) + Ministry of Industry and Information Technology (MIIT) + Ministry of Public Security (MPS)',
    industries: ['all-cn', 'saas', 'fintech', 'healthcare', 'ecommerce', 'adtech', 'generative-ai'],
    requiredModules: [
        { name: 'governance-runtime', required: true, reason: 'Art. 13 legal basis + child-specific consent + ADM gate', reference: 'PIPL Art. 13, 24, 31' },
        { name: 'audit-integrity', required: true, reason: 'Processing records + CAC audit evidence', reference: 'PIPL Art. 51' },
        { name: 'data-classifier', required: true, reason: 'PII_CN + SENSITIVE_PII_CN + IMPORTANT_DATA + CHILD_DATA_CN', reference: 'PIPL Art. 28, 31; DSL Art. 21' },
        { name: 'session-persistence', required: true, reason: 'Separate-consent continuity + DSR state', reference: 'PIPL Art. 14' },
        { name: 'supply-chain', required: true, reason: 'CBDT mechanism (security assessment / standard contract / certification)', reference: 'PIPL Art. 38; 2024 CAC CBDT Provisions' },
        { name: 'approval-queue', required: true, reason: 'Separate consent for sensitive / CBDT / significant-impact ADM', reference: 'PIPL Arts. 14, 29, 39; Art. 24' },
        { name: 'attestation-manager', required: true, reason: 'PIPO designation + CAC GenAI registration + security assessment attestations', reference: 'PIPL Art. 52; Interim Measures for GenAI' },
        { name: 'data-subject-rights', required: true, reason: 'Arts. 44-50 data subject rights', reference: 'PIPL Art. 44-50' },
        { name: 'transparency-injector', required: true, reason: 'ADM explanation notice + sensitive-data notice', reference: 'PIPL Art. 24, Art. 30' },
        { name: 'bias-monitor', required: true, reason: 'ADM fairness; non-discriminatory outcomes', reference: 'PIPL Art. 24' },
        { name: 'event-bus', required: true, reason: 'Prompt breach notification clock (Pax1 default 72h)', reference: 'PIPL Art. 57' },
    ],
    moduleConfig: {
        'governance-runtime': {
            piplLegalBasisEnforced: true,
            childSpecificConsentRequired: true,
            piplAdmExplanationRightEnforced: true,
        },
        'data-classifier': {
            enabledCategories: ['PII_CN', 'SENSITIVE_PII_CN', 'IMPORTANT_DATA', 'CHILD_DATA_CN', 'CREDENTIALS'],
            sensitivePiiCnAction: 'BLOCK_UNLESS_SEPARATE_CONSENT',
            importantDataAction: 'BLOCK_CBDT_WITHOUT_ASSESSMENT',
        },
        'supply-chain': {
            cbdtMechanismRequired: true, // CAC security assessment / standard contract / certification
            dataLocalisationCheckRequired: true, // CIIO check
        },
        'approval-queue': {
            separateConsentRequired: true,
            admOptOutRequired: true,
        },
        'attestation-manager': {
            pipoDesignationRequired: true,
            cacGenaiRegistrationRequired: true,
            securityAssessmentRequired: true,
        },
        'data-subject-rights': {
            responseDeadlineDays: 15,
            supportedRights: ['KNOW', 'DECIDE', 'ACCESS', 'CORRECT', 'DELETE', 'PORTABILITY', 'COMPLAIN'],
        },
        'bias-monitor': {
            piplFairnessMonitoringRequired: true,
        },
        'transparency-injector': {
            piplAdmExplanationRequired: true,
            piplSensitiveDataNoticeRequired: true,
        },
        'event-bus': {
            piplBreachNotificationHours: 72,
        },
    },
    providerPolicy: {
        // PIPL applies in China; blocked providers here restrict non-China-compliant providers for China scope
        blockedProviders: [],
        requiredCapabilities: ['PIPL-READY', 'CAC-SECURITY-ASSESSMENT'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['PII_CN', 'SENSITIVE_PII_CN', 'IMPORTANT_DATA', 'CHILD_DATA_CN', 'CREDENTIALS'],
        categoryActions: {
            PII_CN: 'WARN',
            SENSITIVE_PII_CN: 'BLOCK',
            IMPORTANT_DATA: 'BLOCK',
            CHILD_DATA_CN: 'BLOCK',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['CN'],
        auditLogRetentionDays: 1095, // 3 years PIPL default
        sessionRetentionDays: 365,
        incidentRetentionDays: 1825, // 5 years for Important Data per DSL
        reference: 'PIPL processing records (3-year default); DSL Important Data (5+ years)',
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'PIPL Art. 57 -- prompt notification. Pax1 default 72h to CAC + affected individuals.',
        requiredRecipients: ['cac', 'pipo', 'affected-data-subjects', 'senior-management'],
        formalNotificationRequired: true,
    },
    validators: [
        { id: 'pipl-legal-basis', description: 'PIPL Art. 13 legal basis identified per activity', reference: 'PIPL Art. 13', check: 'pipl_legal_basis_active', failSeverity: 'CRITICAL' },
        { id: 'pipl-separate-consent', description: 'Separate consent for sensitive / CBDT / ADM', reference: 'PIPL Arts. 14, 29, 39', check: 'pipl_separate_consent_active', failSeverity: 'CRITICAL' },
        { id: 'pipl-pipo', description: 'Personal Information Protection Officer designated', reference: 'PIPL Art. 52', check: 'pipl_pipo_active', failSeverity: 'HIGH' },
        { id: 'pipl-adm', description: 'ADM explanation + opt-out for significant-impact decisions', reference: 'PIPL Art. 24', check: 'pipl_adm_active', failSeverity: 'CRITICAL' },
        { id: 'pipl-cbdt', description: 'Cross-border data transfer mechanism verified', reference: 'PIPL Art. 38; 2024 CBDT Provisions', check: 'pipl_cbdt_active', failSeverity: 'CRITICAL' },
        { id: 'pipl-genai-registration', description: 'CAC GenAI registration + security assessment for generative AI', reference: 'Interim Measures for GenAI (Aug 2023)', check: 'pipl_genai_active', failSeverity: 'HIGH' },
        { id: 'pipl-important-data', description: 'Important Data classification + CBDT gating', reference: 'DSL Art. 21; PIPL Art. 38', check: 'pipl_important_data_active', failSeverity: 'HIGH' },
        { id: 'pipl-child-data', description: 'Children (under 14) specific consent + protection program', reference: 'PIPL Art. 31', check: 'pipl_child_data_active', failSeverity: 'HIGH' },
        { id: 'pipl-dsr', description: 'Arts. 44-50 DSR workflow active (7 rights)', reference: 'PIPL Arts. 44-50', check: 'pipl_dsr_active', failSeverity: 'HIGH' },
        { id: 'pipl-breach-notice', description: 'Prompt breach notification (72h default)', reference: 'PIPL Art. 57', check: 'pipl_breach_notice_active', failSeverity: 'CRITICAL' },
        { id: 'pipl-fairness', description: 'ADM fairness monitoring (PIPL Art. 24 non-discrimination)', reference: 'PIPL Art. 24', check: 'pipl_fairness_active', failSeverity: 'MEDIUM' },
    ],
};
//# sourceMappingURL=pipl.js.map