"use strict";
/**
 * GLBA (Gramm-Leach-Bliley Act) Compliance Pack
 *
 * 15 USC 6801-6809 (privacy + safeguards), 6821-6827 (pretexting).
 * As amended by:
 *   - 2021 Safeguards Rule amendment (16 CFR Part 314; full compliance
 *     9 June 2023) -- 9-element WISP, qualified individual, encryption,
 *     MFA, service-provider oversight, incident response plan, annual
 *     board report, penetration testing or continuous monitoring.
 *   - 2024 Notice of Security Event rule (16 CFR 314.5; effective
 *     13 May 2024) -- 30-day FTC notification for security events
 *     affecting 500+ consumers.
 *
 * Privacy Rule enforced by CFPB Regulation P (12 CFR Part 1016) for
 * most consumer financial institutions. FTC retains jurisdiction over
 * some entities and over the Safeguards / Pretexting rules.
 *
 * Authority: FTC, CFPB, banking regulators (FRB, OCC, FDIC, NCUA).
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.GLBA_PACK = exports.GLBA_CATEGORY_CLASSIFIERS = void 0;
const _base_classifiers_1 = require("./_base-classifiers");
/**
 * Financial-context marker for the GLBA NPI classifier.
 *
 * An input is considered to be in a financial context when it contains any
 * of the following signals that are specific to consumer financial records:
 *   - Explicit account-number or routing-number label
 *   - Account balance / transaction / credit balance keywords
 *   - Income / salary / net-worth / assets keywords
 *   - Tax ID (EIN) pattern
 *   - Payment card number (PAN)
 *
 * This marker is used via requireMarker() so that a bare SSN only fires the
 * GLBA NPI category when at least one financial-context signal is also present.
 * A raw SSN in a non-financial document (e.g. a medical record, HR form) will
 * not trigger GLBA; HIPAA or CCPA will handle those contexts instead.
 */
const glbaFinancialContextMarker = (input) => {
    // Explicit account-number or routing-number label (already the NPI trigger on its own)
    if (/\b(?:account\s*(?:number|#|no\.?)|routing\s*(?:number|#))[:\s]*\d{6,17}\b/i.test(input))
        return true;
    // Account balance / transaction / record / statement and credit/debit/ledger balance keywords
    // (Vera F-NEW-VERA-PACK-GLBA-NPI-COVERAGE). "account record", "account statement", "account holder"
    // are financial-context phrases sufficient to distinguish GLBA NPI from a medical or HR SSN.
    if (/\b(?:account\s+(?:balance|transaction|record|statement|holder|owner|history)|credit\s+balance|debit\s+balance|ledger\s+balance)\b/i.test(input))
        return true;
    // Payment card number (PAN)
    if (/\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13})\b/.test(input))
        return true;
    // Tax ID / EIN pattern
    if (/\b\d{2}-\d{7}\b/.test(input))
        return true;
    // Income / salary / net-worth / assets labels with a dollar or numeric value
    if (/\b(?:annual income|salary|net worth|assets)[:\s]*\$?[\d,]+\b/i.test(input))
        return true;
    return false;
};
/** SSN-only classifier composed with financial context so raw SSNs in medical / HR docs do NOT fire GLBA. */
const ssnWithFinancialContext = (0, _base_classifiers_1.requireMarker)((input) => /\b\d{3}-\d{2}-\d{4}\b/.test(input), glbaFinancialContextMarker);
/**
 * GLBA (Gramm-Leach-Bliley Act) category classifiers.
 * GLBA Safeguards Rule (16 CFR Part 314) protects Nonpublic Personal
 * Information (NPI) of financial institution customers.
 */
exports.GLBA_CATEGORY_CLASSIFIERS = {
    NPI: {
        references: ['GLBA §6809(4) -- nonpublic personal information; 16 CFR Part 314 Safeguards Rule'],
        classifier: (input) => {
            // Bank account numbers (explicit label + digits) — standalone trigger; no marker needed
            if (/\b(?:account\s*(?:number|#|no\.?)|routing\s*(?:number|#))[:\s]*\d{6,17}\b/i.test(input))
                return true;
            // Account balance / transaction and credit/debit/ledger balance — standalone triggers (Vera coverage fix)
            // Note: "account record", "account statement", "account holder" are financial-context markers
            // only (used for SSN gating below) and are NOT standalone NPI triggers on their own.
            if (/\b(?:account\s+(?:balance|transaction)|credit\s+balance|debit\s+balance|ledger\s+balance)\b/i.test(input))
                return true;
            // Social security numbers in a financial context only — requireMarker prevents GLBA
            // firing on SSNs that appear in medical records, HR forms, or other non-financial documents.
            if (ssnWithFinancialContext(input))
                return true;
            // Credit/debit card numbers (PAN pattern)
            if (/\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13})\b/.test(input))
                return true;
            // Tax ID / EIN
            if (/\b\d{2}-\d{7}\b/.test(input))
                return true;
            // Income / salary markers in financial context
            if (/\b(?:annual income|salary|net worth|assets)[:\s]*\$?[\d,]+\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['GLBA §6809(4) -- personal data within NPI scope'],
        classifier: (input) => {
            if ((0, _base_classifiers_1.sharedPiiClassifier)(input))
                return true;
            if (/\b(?:name|address|phone)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['GLBA Safeguards Rule 16 CFR §314.4 -- access controls and authentication'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
    PRIVACY_NOTICE_VIOLATION: {
        references: ['CFPB Regulation P 12 CFR Part 1016 -- annual privacy notice'],
        classifier: (input) => {
            if (/\b(annual\s+)?privacy\s+notice\b/i.test(input) && /\b(not\s+(delivered|provided|sent)|missing|overdue|opt[\s-]?out\s+not\s+honored|violation)/i.test(input))
                return true;
            if (/\bregulation\s+p\s+(annual\s+)?notice\b/i.test(input))
                return true;
            if (/\b12\s+cfr\s+1016\b/i.test(input))
                return true;
            if (/\bcfpb\s+regulation\s+p\b/i.test(input))
                return true;
            if (/\bglba\s+privacy\s+notice\b/i.test(input))
                return true;
            return false;
        },
    },
    SAFEGUARDS_GAP: {
        references: ['16 CFR Part 314 -- GLBA Safeguards Rule (risk assessment, training, MFA, qualified individual)'],
        classifier: (input) => {
            if (/\bsafeguards\s+rule\b/i.test(input))
                return true;
            if (/\b16\s+cfr\s+314(\.[0-9]+)?\b/i.test(input))
                return true;
            if (/\bqualified\s+individual\s+not\s+designated\b/i.test(input))
                return true;
            if (/\bglba\s+(employee\s+)?training\s+(program\s+)?lapsed\b/i.test(input))
                return true;
            if (/\bmulti[\s-]?factor\s+authentication\s+missing\s+for\s+glba\b/i.test(input))
                return true;
            if (/\brisk\s+assessment\s+not\s+performed\b/i.test(input) && /\b(glba|safeguards)\b/i.test(input))
                return true;
            return false;
        },
    },
    NOTICE_OF_SECURITY_EVENT: {
        references: ['16 CFR §314.5 (2024 amendment) -- notify FTC of security events affecting 500+ customers within 30 days'],
        classifier: (input) => {
            if (/\bnotice\s+of\s+security\s+event\b/i.test(input))
                return true;
            if (/\b16\s+cfr\s+314\.5\b/i.test(input))
                return true;
            if (/\bftc\s+notification\b/i.test(input) && /\b(security\s+event|glba|nipo|customer\s+npi)\b/i.test(input))
                return true;
            if (/\bglba\s+security\s+event\s+notification\b/i.test(input))
                return true;
            if (/\bunauthorized\s+acquisition\s+of\s+npi\b/i.test(input))
                return true;
            return false;
        },
    },
};
exports.GLBA_PACK = {
    categoryClassifiers: exports.GLBA_CATEGORY_CLASSIFIERS,
    /** P3.5: Non-Public Personal Information is inherently subject-keyed per GLBA 15 USC §6801. */
    subjectKeyedCategories: ['NPI'],
    id: 'glba',
    name: 'GLBA',
    version: '1.0.0',
    description: 'Gramm-Leach-Bliley Act compliance with the 2021 Safeguards Rule amendment and 2024 Notice of Security Event rule. Covers financial institutions under FTC (16 CFR 313, 314), CFPB Regulation P (12 CFR 1016), and banking-regulator guidance.',
    authority: 'FTC; CFPB; FRB, OCC, FDIC, NCUA',
    industries: [
        'banking',
        'credit-union',
        'insurance',
        'securities',
        'mortgage',
        'auto-dealer-financing',
        'tax-preparation',
        'check-cashing',
        'money-transmitter',
        'debt-collection',
        'fintech',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Named qualified individual gate; deny-by-default access to consumer info',
            reference: '16 CFR 314.4(a) -- qualified individual',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident record of NPI access, opt-out events, security events',
            reference: '16 CFR 314.4(g)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Encryption at rest and in transit for NPI',
            reference: '16 CFR 314.4(c)(3)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'NPI detection (financial account, balance, transactions, credit score, tax data)',
            reference: '16 CFR 313.3 -- nonpublic personal information definition',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'MFA on every agent accessing consumer information',
            reference: '16 CFR 314.4(c)(5) -- MFA requirement',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Consumer opt-out preferences must survive restarts; notice delivery timestamps',
            reference: '16 CFR 313.7-10',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Stream NPI access, sharing decisions, security events',
            reference: '16 CFR 314.4(d)',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detect pretexting attempts and abnormal NPI access patterns',
            reference: '15 USC 6821; 16 CFR 314.4(d)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Service-provider oversight with due diligence and contractual safeguards',
            reference: '16 CFR 314.4(f)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human approval for NPI sharing when opt-out exceptions are claimed; pretexting escalations',
            reference: '16 CFR 313.13-15; 15 USC 6821',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'WISP, risk assessment, pentest / vuln scan, annual board report attestations',
            reference: '16 CFR 314.4(a), (b), (d), (i)',
        },
    ],
    moduleConfig: {
        'agent-auth': {
            mfaRequired: true,
            mfaMandatoryForNpiAccess: true,
        },
        'governance-runtime': {
            qualifiedIndividualRequired: true,
            optOutExceptionApprovalRequired: true,
        },
        'attestation-manager': {
            wispAnnualReviewRequired: true,
            boardAnnualReportRequired: true,
            penetrationTestCadenceDays: 365,
            vulnerabilityScanCadenceDays: 182,
        },
        'supply-chain': {
            serviceProviderDueDiligenceRequired: true,
            contractualSafeguardsRequired: true,
            periodicServiceProviderAssessmentDays: 365,
        },
        'session-persistence': {
            optOutPersistenceRequired: true,
            privacyNoticeAnnualDeliveryRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'NPI_ACCOUNT',
                'NPI_BALANCE',
                'NPI_TRANSACTION',
                'NPI_CREDIT_SCORE',
                'NPI_TAX',
                'PII',
                'CREDENTIALS',
            ],
            defaultAction: 'WARN',
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['GLBA-SERVICE-PROVIDER-CONTRACT'],
        blockReasons: {
            deepseek: 'PRC jurisdiction; cannot contractually satisfy 16 CFR 314.4(f) service-provider safeguards for consumer NPI.',
            baidu: 'PRC jurisdiction. Cannot meet GLBA safeguards oversight requirements.',
            alibaba: 'PRC jurisdiction. Cannot meet GLBA safeguards oversight requirements.',
        },
    },
    dataPolicy: {
        scanCategories: ['NPI', 'PII', 'CREDENTIALS', 'PRIVACY_NOTICE_VIOLATION', 'SAFEGUARDS_GAP', 'NOTICE_OF_SECURITY_EVENT'],
        categoryActions: {
            NPI: 'BLOCK', // blocked unless opt-out allows or an exception applies
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
            PRIVACY_NOTICE_VIOLATION: 'WARN',
            SAFEGUARDS_GAP: 'WARN',
            NOTICE_OF_SECURITY_EVENT: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // 5 years aligned with FTC enforcement + banking-agency exam cycle
        auditLogRetentionDays: 1825,
        sessionRetentionDays: 365,
        incidentRetentionDays: 1825,
        reference: 'FTC enforcement statute of limitations + banking-agency examination cycle',
    },
    incidentPolicy: {
        // 30 days for FTC notification; 72h internal escalation
        notificationDeadlineHours: 720,
        reference: '16 CFR 314.5 -- 30-day FTC notification for security events affecting 500+ consumers.',
        requiredRecipients: ['ftc', 'qualified-individual', 'incident-response-team'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'glba-wisp',
            description: 'Written Information Security Program documented and reviewed annually',
            reference: '16 CFR 314.4(a), (i)',
            check: 'wisp_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'glba-qualified-individual',
            description: 'Qualified individual designated',
            reference: '16 CFR 314.4(a)',
            check: 'qualified_individual_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'glba-risk-assessment',
            description: 'Written risk assessment current',
            reference: '16 CFR 314.4(b)',
            check: 'risk_assessment_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'glba-encryption',
            description: 'Encryption at rest and in transit enforced for NPI',
            reference: '16 CFR 314.4(c)(3)',
            check: 'encryption_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'glba-mfa',
            description: 'MFA enforced on all agents accessing consumer information',
            reference: '16 CFR 314.4(c)(5)',
            check: 'glba_mfa_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'glba-service-provider',
            description: 'Service-provider due diligence + contractual safeguards + periodic assessment',
            reference: '16 CFR 314.4(f)',
            check: 'service_provider_oversight_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'glba-opt-out',
            description: 'Consumer opt-out of sharing with non-affiliated third parties honoured',
            reference: '16 CFR 313.7-10; Reg P §§1016.7-10',
            check: 'glba_opt_out_honoured',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'glba-privacy-notice',
            description: 'Initial + annual privacy notice delivery tracked',
            reference: '16 CFR 313.4-9; Reg P §§1016.4-9',
            check: 'glba_privacy_notice_current',
            failSeverity: 'HIGH',
        },
        {
            id: 'glba-pretexting',
            description: 'Pretexting detection active; suspicious NPI requests escalated',
            reference: '15 USC 6821',
            check: 'pretexting_detection_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'glba-testing-cadence',
            description: 'Annual penetration test + semiannual vulnerability scan OR continuous monitoring',
            reference: '16 CFR 314.4(d)',
            check: 'glba_testing_cadence_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'glba-30day-notice',
            description: '30-day FTC notification configured for events affecting 500+ consumers',
            reference: '16 CFR 314.5',
            check: 'glba_30day_notice_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'glba-board-report',
            description: 'Annual written report to board from qualified individual',
            reference: '16 CFR 314.4(i)',
            check: 'glba_board_report_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=glba.js.map