/**
 * CCPA / CPRA Compliance Pack
 *
 * California Consumer Privacy Act (2018) as amended by the California
 * Privacy Rights Act (effective 1 Jan 2023). Enforced by the California
 * Attorney General and the California Privacy Protection Agency (CPPA).
 *
 * 2024-2026 rulemaking in force:
 *   - CPPA Automated Decision-Making Technology (ADMT) regulations.
 *     Consumers may opt out of ADMT for "significant decisions"
 *     (housing, employment, education, healthcare, financial services,
 *     insurance, and similar). Pre-use notice required; meaningful
 *     information about logic must be accessible.
 *   - CPPA cybersecurity audit regulations: annual independent
 *     cybersecurity audit mandatory above processing thresholds.
 *   - CPPA risk assessment regulations: written risk assessment
 *     required before AI training, profiling, ADMT, selling PI of
 *     minors, or large-scale SPI processing.
 *   - SB 362 (Delete Act): universal data broker delete mechanism
 *     phasing in through 2026.
 *   - AB 2013: generative AI training data transparency required for
 *     models made available to Californians from 1 Jan 2026.
 *
 * Thresholds (any one triggers coverage):
 *   - Annual gross revenue > $25M, OR
 *   - Buys/sells/shares PI of 100k+ CA consumers or households, OR
 *   - Derives 50%+ of annual revenue from selling/sharing PI.
 * B2B data is in scope since 1 Jan 2023.
 *
 * Pax1 treats CCPA/CPRA as the anchor US state privacy pack; other
 * state privacy laws (VA, CO, CT, UT, TX, OR, MT, TN, IA, DE, NH, NJ,
 * KY, MD, MN, RI, IN, etc.) layer via the Regulatory Tracker agent.
 *
 * @connexum/ai-governance
 */
import { sharedPiiClassifier } from './_base-classifiers.js';
/**
 * CCPA/CPRA (California Consumer Privacy Act / Privacy Rights Act) category classifiers.
 * Covers California personal information (PI), sensitive PI (SPI), and credentials.
 */
export const CCPA_CATEGORY_CLASSIFIERS = {
    PI: {
        references: ['CCPA §1798.140(o) -- personal information; any information that identifies, describes, or could be linked to a California consumer'],
        classifier: (input) => {
            if (sharedPiiClassifier(input))
                return true;
            // Driver's license (California-specific format)
            if (/\b(?:driver(?:'?s)?\s+license(?:\s+number)?|DL\s+number|CA\s+ID)\s*[:\s#]*[A-Za-z]\d{7}\b/i.test(input))
                return true;
            if (/\b(?:california\s+(?:consumer|resident)\s+(?:data|information|personal\s+information)|california\s+PI)\b/i.test(input))
                return true;
            return false;
        },
    },
    SPI: {
        references: ['CCPA §1798.121 + CPRA -- sensitive personal information; heightened protection + opt-out right'],
        classifier: (input) => {
            // SSN / government ID
            if (/\b(?:social\s+security|SSN|government\s+(?:id|identification)|state\s+id\s+(?:number|card))\b/i.test(input))
                return true;
            // Financial account / payment card
            if (/\b(?:financial\s+account\s+(?:number|access)|payment\s+card\s+(?:number|data)|bank\s+account\s+number)\b/i.test(input))
                return true;
            // Precise geolocation
            if (/\b(?:precise\s+geolocation|GPS\s+coordinates|real.?time\s+location)\b/i.test(input))
                return true;
            // Health / biometric / genetic
            if (/\b(?:health\s+(?:data|information|condition)|medical\s+(?:record|condition)|biometric\s+(?:data|information)|genetic\s+data)\b/i.test(input))
                return true;
            // Sexual orientation / racial origin
            if (/\b(?:sexual\s+orientation|gender\s+identity|racial\s+origin|ethnic\s+origin|religious\s+belief|union\s+membership)\b/i.test(input))
                return true;
            // Private communications content
            if (/\b(?:private\s+communication|mail\s+content|email\s+content|text\s+message\s+content)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['CCPA §1798.150 -- data breach; credential exposure triggers statutory damages'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
    CONSUMER_REQUEST_CCPA: {
        references: ['CCPA §1798.100-130 -- consumer rights to know, delete, correct, and port'],
        classifier: (input) => {
            if (/\bccpa\b/i.test(input) && /\b(right\s+to\s+(know|delete|correct|access|portability|data\s+portability)|verifiable\s+consumer\s+request)/i.test(input))
                return true;
            if (/\bcpra\b/i.test(input) && /\b(right\s+to\s+(know|delete|correct|access|portability))/i.test(input))
                return true;
            if (/\bright\s+to\s+(delete|correct)\s+(?:request\s+)?under\s+ccpa\b/i.test(input))
                return true;
            if (/\bverifiable\s+consumer\s+request\b/i.test(input))
                return true;
            if (/\b§\s*1798\.(100|105|106|110|115|130)\b/i.test(input))
                return true;
            if (/\bcalifornia\s+consumer\b/i.test(input) && /\b(request|right|delete|know|correct|portability)\b/i.test(input))
                return true;
            if (/\bright\s+to\s+data\s+portability\b/i.test(input) && /\b(ccpa|cpra)\b/i.test(input))
                return true;
            return false;
        },
    },
    SALE_OPT_OUT: {
        references: ['CCPA §1798.120 / §1798.135 -- right to opt out of sale or sharing of personal information'],
        classifier: (input) => {
            if (/\bdo\s+not\s+sell\s+(?:or\s+share\s+)?my\s+personal\s+information\b/i.test(input))
                return true;
            if (/\bopt[\s-]?out\s+of\s+(sale|sharing)\b/i.test(input))
                return true;
            if (/\b(global\s+privacy\s+control|gpc)\b/i.test(input) && /\b(opt|signal|honored|detected)\b/i.test(input))
                return true;
            if (/\bccpa\s+§\s*1798\.135\b/i.test(input))
                return true;
            if (/\bcpra\s+opt[\s-]?out\b/i.test(input))
                return true;
            if (/\bcross[\s-]context\s+behavioral\s+advertising\b/i.test(input))
                return true;
            if (/\b§\s*1798\.(120|135)\b/i.test(input))
                return true;
            return false;
        },
    },
    ADMT_DECISION: {
        references: ['2026 CPPA rulemaking on Automated Decision-Making Technology (ADMT)'],
        classifier: (input) => {
            if (/\b(automated\s+decision[\s-]making\s+technology|admt)\b/i.test(input))
                return true;
            if (/\bccpa\s+admt\b/i.test(input))
                return true;
            if (/\bcpra\s+admt\b/i.test(input))
                return true;
            if (/\bcppa\s+(rulemaking|admt|automated)/i.test(input))
                return true;
            if (/\bprofiling[\s-]based\s+admt\s+decision\b/i.test(input))
                return true;
            if (/\badmt\s+pre[\s-]?use\s+notice\b/i.test(input))
                return true;
            return false;
        },
    },
};
export const CCPA_PACK = {
    categoryClassifiers: CCPA_CATEGORY_CLASSIFIERS,
    /** P3.5: Personal information and sensitive personal information are subject-keyed per CCPA §1798.100. */
    subjectKeyedCategories: ['PI', 'SPI'],
    id: 'ccpa',
    name: 'CCPA / CPRA',
    version: '1.0.0',
    description: 'California Consumer Privacy Act / California Privacy Rights Act compliance including 2024-2026 CPPA rulemaking on ADMT, cybersecurity audits, risk assessments, universal delete (SB 362), and generative-AI training-data transparency (AB 2013).',
    authority: 'California Attorney General / California Privacy Protection Agency (CPPA)',
    industries: [
        'all-ca',
        'technology',
        'retail',
        'healthcare',
        'finance',
        'insurance',
        'adtech',
        'data-broker',
        'generative-ai',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Deny-by-default access; notice-at-collection enforcement',
            reference: 'Cal. Civ. Code §1798.100 -- Right to Know; notice at collection',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident record of consumer-rights decisions and notices',
            reference: 'Cal. Civ. Code §1798.130(a)(5) -- Record retention',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Stream consumer requests, opt-out signals, and breach events',
            reference: 'Cal. Civ. Code §1798.135 -- Opt-out methods',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect PI (11 categories) and SPI (12 sensitive categories)',
            reference: 'Cal. Civ. Code §1798.140(v),(ae) -- PI/SPI definitions',
        },
        {
            name: 'data-subject-rights',
            required: true,
            reason: 'Know / Delete / Correct / Opt-Out / Limit SPI / ADMT Opt-Out workflow with 45-day deadline',
            reference: 'Cal. Civ. Code §1798.100-135 -- Consumer rights',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'ADMT opt-out gating for significant decisions; human oversight for profiling',
            reference: 'CPPA ADMT Regulations',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Honour opt-out preferences across sessions; GPC signal persistence',
            reference: 'Cal. Civ. Code §1798.135(b) -- Opt-out preference signal',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Service provider / contractor / third-party contract clause verification',
            reference: 'Cal. Civ. Code §1798.140(ag-ai), §1798.100(d) -- Required contract terms',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Annual cybersecurity audit, risk assessment, training-data transparency attestations',
            reference: 'CPPA Cybersecurity Audit / Risk Assessment Regulations; AB 2013',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'PI_IDENTIFIERS',
                'PI_COMMERCIAL',
                'PI_BIOMETRIC',
                'PI_INTERNET_ACTIVITY',
                'PI_GEOLOCATION',
                'PI_SENSORY',
                'PI_PROFESSIONAL',
                'PI_EDUCATION',
                'PI_INFERENCES',
                'SPI_SSN',
                'SPI_DRIVER_LICENCE',
                'SPI_FINANCIAL_ACCOUNT',
                'SPI_PRECISE_GEOLOCATION',
                'SPI_RACE_ETHNICITY',
                'SPI_RELIGION',
                'SPI_UNION',
                'SPI_PRIVATE_COMMS',
                'SPI_GENETIC',
                'SPI_BIOMETRIC_ID',
                'SPI_HEALTH',
                'SPI_SEX_LIFE',
                'SPI_CITIZENSHIP',
                'CREDENTIALS',
            ],
            defaultAction: 'WARN',
            spiAction: 'BLOCK_UNLESS_DISCLOSED',
        },
        'data-subject-rights': {
            responseDeadlineDays: 45,
            extensionDeadlineDays: 45,
            supportedRights: [
                'KNOW',
                'DELETE',
                'CORRECT',
                'OPT_OUT_SALE_SHARE',
                'LIMIT_SPI',
                'OPT_OUT_ADMT',
                'ACCESS_ADMT_LOGIC',
            ],
            honourGPC: true,
        },
        'approval-queue': {
            admtSignificantDecisionRequiresOptOutCheck: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['CCPA-SERVICE-PROVIDER-TERMS'],
        blockReasons: {
            deepseek: 'PRC data handling cannot contractually satisfy CPRA service-provider / third-party requirements (§1798.140(ag-ai)) and creates cross-border government-access risk incompatible with CCPA transparency.',
            baidu: 'PRC jurisdiction. Cannot meet CPRA contract requirements for service providers and third parties handling California consumer PI.',
            alibaba: 'PRC jurisdiction. Cannot meet CPRA contract requirements for service providers and third parties handling California consumer PI.',
        },
    },
    dataPolicy: {
        scanCategories: ['PI', 'SPI', 'CREDENTIALS', 'CONSUMER_REQUEST_CCPA', 'SALE_OPT_OUT', 'ADMT_DECISION'],
        categoryActions: {
            PI: 'WARN',
            SPI: 'BLOCK',
            CREDENTIALS: 'BLOCK',
            CONSUMER_REQUEST_CCPA: 'WARN',
            SALE_OPT_OUT: 'WARN',
            ADMT_DECISION: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US-CA'],
        auditLogRetentionDays: 1095,
        sessionRetentionDays: 365,
        incidentRetentionDays: 1095,
        reference: 'Cal. Civ. Code §1798.130(a)(5) -- Request records retained at least 24 months. Pax1 default 3 years for alignment with multi-state laws.',
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'Cal. Civ. Code §1798.82 -- Breach notification "most expedient time possible and without unreasonable delay". Pax1 defaults to 72h internal notification; same-day escalation for breaches involving SPI.',
        requiredRecipients: [
            'privacy-officer',
            'ca-attorney-general',
            'affected-consumers',
        ],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'ccpa-notice-at-collection',
            description: 'Notice at or before collection present for each PI category',
            reference: '§1798.100(a), §1798.130(a)(5)',
            check: 'notice_at_collection_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ccpa-opt-out-honour',
            description: 'Do Not Sell or Share opt-out honoured including GPC signal',
            reference: '§1798.120, §1798.135',
            check: 'opt_out_honour_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ccpa-spi-restriction',
            description: 'SPI use limited to disclosed purposes; Right to Limit honoured',
            reference: '§1798.121',
            check: 'spi_restriction_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ccpa-dsr-deadline',
            description: 'Consumer request response within 45 days (one 45-day extension permitted)',
            reference: '§1798.130(a)(2)',
            check: 'dsr_deadline_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ccpa-admt-opt-out',
            description: 'ADMT opt-out available for significant decisions; pre-use notice and access to logic provided',
            reference: 'CPPA ADMT Regulations',
            check: 'admt_opt_out_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ccpa-service-provider-contracts',
            description: 'Every service provider / contractor / third party has required CPRA contract clauses',
            reference: '§1798.140(ag-ai), §1798.100(d)',
            check: 'service_provider_contracts_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ccpa-non-discrimination',
            description: 'No discrimination against consumers exercising rights (pricing, quality, service)',
            reference: '§1798.125',
            check: 'non_discrimination_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ccpa-risk-assessment',
            description: 'Written risk assessment exists for AI training, profiling, ADMT, minors, large-scale SPI',
            reference: 'CPPA Risk Assessment Regulations',
            check: 'risk_assessment_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ccpa-cyber-audit',
            description: 'Annual independent cybersecurity audit completed and retained',
            reference: 'CPPA Cybersecurity Audit Regulations',
            check: 'cybersecurity_audit_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ccpa-ai-training-transparency',
            description: 'Generative-AI training-data transparency documented (if GenAI in CA)',
            reference: 'AB 2013 (effective 1 Jan 2026)',
            check: 'ai_training_transparency_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'ccpa-delete-act-participation',
            description: 'Registered and participating in CPPA universal delete mechanism (if data broker)',
            reference: 'SB 362 (Delete Act)',
            check: 'delete_act_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=ccpa.js.map