"use strict";
/**
 * LGPD Compliance Pack
 *
 * Lei Geral de Proteção de Dados Pessoais (Law 13.709/2018) --
 * Brazilian General Data Protection Law. Entered into force
 * September 2020; sanctions effective August 2021. Enforced by
 * Autoridade Nacional de Proteção de Dados (ANPD).
 *
 * Standards referenced:
 *   - Law 13.709/2018 (LGPD)
 *   - ANPD Resolution CD/ANPD 2/2022 (RIPD methodology)
 *   - 2024 ANPD guidance on automated decision-making (Art. 20)
 *   - 2024 ANPD SCCs resolution for international transfers
 *
 * Extraterritorial scope (Art. 3): applies to processing of data of
 * individuals located in Brazil, offering goods/services to
 * Brazilian individuals, or data collected in Brazil.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.LGPD_PACK = exports.LGPD_CATEGORY_CLASSIFIERS = void 0;
/**
 * LGPD (Lei Geral de Proteção de Dados, Brazil) category classifiers.
 * Brazil's data protection law with special categories for sensitive data (Art. 11).
 */
exports.LGPD_CATEGORY_CLASSIFIERS = {
    PII_BR: {
        references: ['LGPD Art. 5(I) -- dados pessoais; personal data of Brazilian residents'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            // Brazilian CPF (Cadastro de Pessoas Físicas)
            if (/\b\d{3}\.\d{3}\.\d{3}-\d{2}\b/.test(input))
                return true;
            // Brazilian RG (identity document)
            if (/\b(?:RG|CPF|CNPJ)[:\s#]*[\d.\/-]{8,20}\b/i.test(input))
                return true;
            if (/\b(?:nome\s+completo|endereço|data\s+de\s+nascimento)\b/i.test(input))
                return true;
            return false;
        },
    },
    SENSITIVE_PII_BR: {
        references: ['LGPD Art. 5(II) + Art. 11 -- dados pessoais sensíveis; sensitive data categories'],
        classifier: (input) => {
            // Health / medical -- Portuguese
            if (/\b(?:saúde|condição\s+médica|diagnóstico|origem\s+racial|étnica)\b/i.test(input))
                return true;
            // Health / medical -- English (F-NEW-VERA-PACK-C2-06: missing English health patterns)
            if (/\b(?:health\s+record|medical\s+history|lab\s+result|prescription|medical\s+condition|clinical\s+diagnosis)\b/i.test(input))
                return true;
            // Racial origin
            if (/\b(?:racial\s+origin|ethnic\s+origin|raça|etnia)\b/i.test(input))
                return true;
            // Religious / political
            if (/\b(?:religious\s+belief|political\s+opinion|opinião\s+política|crença\s+religiosa)\b/i.test(input))
                return true;
            // Biometric / genetic
            if (/\b(?:biometric\s+data|genetic\s+data|dado\s+biométrico|dado\s+genético)\b/i.test(input))
                return true;
            // Sexual orientation
            if (/\b(?:sexual\s+orientation|orientação\s+sexual)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * F-NEW-VERA-PACK-C2-06: LGPD Art. 33-36 international transfer chapter.
     * Cross-border transfers are permitted under SCCs or adequacy decisions but
     * require documented legal basis. Action is WARN because transfers may be
     * lawful under SCCs; BLOCK without legal-basis verification would over-gate.
     */
    CROSS_BORDER_TRANSFER_BR: {
        references: ['LGPD Art. 33-36 -- international data transfer; 2024 ANPD SCCs resolution'],
        classifier: (input) => {
            if (/\b(?:cross.?border\s+(?:transfer|data\s+(?:transfer|flow))|international\s+transfer)\b/i.test(input))
                return true;
            // French/PT cross-border terms -- accented chars, no \b wrapper
            if (/transferência\s+internacional/i.test(input))
                return true;
            if (/\b(?:data\s+export\s+brazil|exportação\s+de\s+dados\s+brasil|ANPD\s+SCC|cláusulas\s+contratuais\s+padrão)\b/i.test(input))
                return true;
            if (/\b(?:cross.?border\s+data\s+processing|transferência\s+de\s+dados\s+para\s+o\s+exterior)\b/i.test(input))
                return true;
            return false;
        },
    },
    CHILD_DATA: {
        references: ['LGPD Art. 14 -- processing of children personal data; specific consent required'],
        classifier: (input) => {
            if (/\b(?:child\s+(?:data|information|personal\s+data)|minor\s+(?:data|information)|criança|adolescente)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['LGPD Art. 46 -- security measures; credential protection for data controllers'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.LGPD_PACK = {
    categoryClassifiers: exports.LGPD_CATEGORY_CLASSIFIERS,
    /** P3.5: Brazilian PII and sensitive data are subject-keyed per LGPD Art. 5(III). */
    subjectKeyedCategories: ['PII_BR', 'SENSITIVE_PII_BR', 'CHILD_DATA', 'CROSS_BORDER_TRANSFER_BR'],
    id: 'lgpd',
    name: 'LGPD (Brazil)',
    version: '1.0.0',
    description: 'Brazilian General Data Protection Law (Lei 13.709/2018) compliance with 2024 ANPD guidance on automated decision-making and SCCs. Extraterritorial reach for any processing of Brazilian residents\' data.',
    authority: 'Autoridade Nacional de Proteção de Dados (ANPD)',
    industries: ['all-br', 'saas', 'fintech', 'healthcare', 'ecommerce', 'adtech', 'hr-tech'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Legal basis enforcement (Art. 7 + Art. 11) + child-specific consent gate',
            reference: 'LGPD Art. 7, 11, 14',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Records of processing activities; ANPD audit evidence',
            reference: 'LGPD Art. 37',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'PII_BR + SENSITIVE_PII_BR + CHILD_DATA classification',
            reference: 'LGPD Art. 5(II), Art. 11, Art. 14',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Legal basis continuity + consent revocation + DSR state',
            reference: 'LGPD Art. 8 §5',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'International transfer mechanism verification (adequacy / SCCs / specific bases)',
            reference: 'LGPD Art. 33-36 + 2024 ANPD SCCs Resolution',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Art. 20 ADM review right; sensitive-data processing approval',
            reference: 'LGPD Art. 20 + 2024 ANPD ADM Guidance',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Encarregado (DPO) designation + RIPD for high-risk processing + legal basis per activity',
            reference: 'LGPD Art. 38, 41',
        },
        {
            name: 'data-subject-rights',
            required: true,
            reason: 'Arts. 17-22 data subject rights workflow',
            reference: 'LGPD Art. 17-22',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Review-right notice + ADM criteria disclosure',
            reference: 'LGPD Art. 9, Art. 20',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Discrimination risk in automated decisions (non-discriminatory principle)',
            reference: 'LGPD Art. 6(IX) Non-Discrimination',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Breach notification clock (48-72h per ANPD interpretation)',
            reference: 'LGPD Art. 48',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            lgpdLegalBasisEnforced: true,
            childSpecificConsentRequired: true, // Art. 14
            lgpdAdmReviewRightEnforced: true,
        },
        'data-classifier': {
            enabledCategories: ['PII_BR', 'SENSITIVE_PII_BR', 'CHILD_DATA', 'CROSS_BORDER_TRANSFER_BR', 'CREDENTIALS'],
            sensitivePiiBrAction: 'BLOCK_UNLESS_ART_11_BASIS',
            childDataAction: 'BLOCK_UNLESS_SPECIFIC_CONSENT',
            // F-NEW-VERA-PACK-C2-06: cross-border transfers WARN; may be lawful under ANPD SCCs or adequacy.
            crossBorderTransferBrAction: 'WARN',
        },
        'session-persistence': {
            legalBasisContinuityRequired: true,
            consentRevocationSupportRequired: true,
        },
        'supply-chain': {
            internationalTransferMechanismRequired: true,
            anpdAdequacyTrackingRequired: true,
        },
        'approval-queue': {
            admReviewRightRequired: true,
            sensitiveDataBasisApprovalRequired: true,
        },
        'attestation-manager': {
            encarregadoDesignationRequired: true,
            ripdRequired: true, // Relatório de Impacto à Proteção de Dados Pessoais
            ropaLgpdRequired: true, // Records of Processing Activities
        },
        'data-subject-rights': {
            responseDeadlineDays: 15, // ANPD guidance
            supportedRights: ['CONFIRMATION', 'ACCESS', 'RECTIFICATION', 'ANONYMISATION', 'PORTABILITY', 'ERASURE', 'REVOCATION_CONSENT', 'REVIEW_ADM'],
        },
        'bias-monitor': {
            lgpdNonDiscriminationActive: true,
        },
        'transparency-injector': {
            reviewRightNoticeRequired: true,
            admCriteriaDisclosureRequired: true,
        },
        'event-bus': {
            lgpdBreachNotificationHours: 72, // conservative per ANPD interpretation
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['LGPD-READY'],
        blockReasons: {
            deepseek: 'PRC jurisdiction; no LGPD adequacy or SCC mechanism viable.',
            baidu: 'PRC jurisdiction; no LGPD adequacy or SCC mechanism viable.',
            alibaba: 'PRC jurisdiction; no LGPD adequacy or SCC mechanism viable.',
        },
    },
    dataPolicy: {
        scanCategories: ['PII_BR', 'SENSITIVE_PII_BR', 'CHILD_DATA', 'CROSS_BORDER_TRANSFER_BR', 'CREDENTIALS'],
        categoryActions: {
            PII_BR: 'WARN',
            SENSITIVE_PII_BR: 'BLOCK',
            CHILD_DATA: 'BLOCK',
            // F-NEW-VERA-PACK-C2-06: LGPD Art. 33-36 transfers may be lawful under SCCs;
            // WARN prompts review without blocking potentially-authorised flows.
            CROSS_BORDER_TRANSFER_BR: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['BR'],
        auditLogRetentionDays: 1825, // 5 years default
        sessionRetentionDays: 365,
        incidentRetentionDays: 1825,
        reference: 'LGPD + standard record-keeping (5-year default retention for ANPD audit readiness)',
    },
    incidentPolicy: {
        notificationDeadlineHours: 72, // conservative ANPD interpretation
        reference: 'LGPD Art. 48 -- "reasonable time"; ANPD interprets as 48-72 hours for serious incidents. Pax1 default 72 hours.',
        requiredRecipients: ['anpd', 'encarregado-dpo', 'affected-data-subjects', 'senior-management'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'lgpd-legal-basis',
            description: 'Legal basis identified per processing activity (Art. 7 / Art. 11)',
            reference: 'LGPD Art. 7, 11',
            check: 'lgpd_legal_basis_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'lgpd-encarregado',
            description: 'Encarregado (DPO) designated and publicly disclosed',
            reference: 'LGPD Art. 41',
            check: 'lgpd_encarregado_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'lgpd-ripd',
            description: 'RIPD (DPIA) on file for high-risk processing',
            reference: 'LGPD Art. 38; ANPD Resolution CD/ANPD 2/2022',
            check: 'lgpd_ripd_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'lgpd-dsr',
            description: 'Arts. 17-22 data subject rights workflow active (8 rights)',
            reference: 'LGPD Art. 17-22',
            check: 'lgpd_dsr_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'lgpd-adm-review',
            description: 'Art. 20 ADM review-right gate active',
            reference: 'LGPD Art. 20 + 2024 ANPD Guidance',
            check: 'lgpd_adm_review_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'lgpd-sensitive-data',
            description: 'Sensitive data (Art. 11) blocked without specific basis',
            reference: 'LGPD Art. 11',
            check: 'lgpd_sensitive_data_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'lgpd-child-data',
            description: 'Child data blocked without specific consent + best interest',
            reference: 'LGPD Art. 14',
            check: 'lgpd_child_data_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'lgpd-transfer',
            description: 'International transfer mechanism (adequacy / SCCs / legal basis) verified',
            reference: 'LGPD Art. 33-36',
            check: 'lgpd_transfer_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'lgpd-breach-notice',
            description: '48-72 hour breach notification clock active',
            reference: 'LGPD Art. 48 + ANPD interpretation',
            check: 'lgpd_breach_notice_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'lgpd-ropa',
            description: 'Records of Processing Activities (ROPA) maintained',
            reference: 'LGPD Art. 37',
            check: 'lgpd_ropa_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'lgpd-non-discrimination',
            description: 'Non-discriminatory-processing principle enforced',
            reference: 'LGPD Art. 6(IX)',
            check: 'lgpd_non_discrimination_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=lgpd.js.map