"use strict";
/**
 * Florida Student Privacy Overlay Compliance Pack
 *
 * Florida state law overlay on top of the FERPA federal floor, governing
 * AI operators serving Florida K-12 students and UF-affiliated K-12
 * programs (particularly P.K. Yonge Developmental Research School).
 *
 * Primary Florida statutes:
 *
 * 1. Florida Statute Chapter 1002.22 (Student and Parental Rights):
 *    Governs education records of public K-12 students. Parallels FERPA
 *    but has Florida-specific provisions on parental inspection rights,
 *    correction of records, and limitations on disclosure. Applies to
 *    public schools and school districts.
 *
 * 2. Florida Statute Section 1002.222 (Student Data Privacy):
 *    Governs operators of websites, online services, and online
 *    applications that have actual knowledge they are collecting personal
 *    information from K-12 students in Florida. Prohibits: targeted
 *    advertising, behavioral profiling for non-educational purposes,
 *    sale of student information. Requires data security and deletion.
 *    (Citation to verify current section number and amendment status;
 *    cited in 2021-2024 Florida legislative sessions.)
 *
 * 3. Florida House Bill 3 (2023) / Parents' Bill of Rights
 *    (Florida Statute Section 1014): Parental consent and notification
 *    for educational services and activities collecting student data.
 *    Schools must notify parents before using AI tools that collect or
 *    process student data; parental opt-out rights.
 *
 * 4. Florida Statute Section 1006.52 (Student Data Governance):
 *    School districts must maintain a data governance plan. AI vendors
 *    must be listed in the district's data governance vendor inventory.
 *
 * 5. Florida SB 262 (2023) / AI Transparency Act (Florida Statute
 *    Section 501.171 et seq.; citation to verify final codification):
 *    Florida's 2023 AI transparency provisions. (Citation to verify:
 *    SB 262 signed May 2023; specific AI provisions and codification
 *    location to confirm.)
 *
 * 6. Florida Statute Section 501.171 (Florida Information Protection
 *    Act, FIPA): Florida's general breach notification law. 30-day
 *    clock from determination of breach; concurrent AG notification
 *    if 500+ Florida residents affected.
 *
 * UF-specific: P.K. Yonge Developmental Research School is a K-12
 * public school operated by UF's College of Education. Any AI system
 * deployed at P.K. Yonge is directly subject to Florida Section 1002.222,
 * Chapter 1002.22, and HB 3. UF bears direct operator liability.
 *
 * Public records: UF as a public institution is subject to Florida
 * Chapter 119 (public records law) for non-exempt records. Student
 * records are exempt under the FERPA exemption (Section 119.07(1)).
 * AI-generated student records must be properly classified to maintain
 * this exemption.
 *
 * Cross-pack interactions:
 *   - Florida Student Privacy + FERPA: Florida law is expressly
 *     consistent with FERPA. FERPA provides the federal floor; Florida
 *     Chapter 1002.22 and Section 1002.222 add operator-level
 *     obligations. Both packs must be active simultaneously for any
 *     Florida K-12 student data. In conflicts, FERPA governs for
 *     federally-funded institutions.
 *   - Florida Student Privacy + COPPA: Florida K-12 students include
 *     children under 13. COPPA applies to any online AI system with
 *     actual knowledge it serves under-13 users; Florida Section
 *     1002.222 adds state-law operator obligations. The school-consent
 *     model under FERPA/COPPA may be satisfied by the parental consent
 *     under Florida HB 3 in some cases; legal counsel should verify
 *     (FTC has not issued specific guidance on Florida HB 3/COPPA
 *     intersection as of August 2025; citation to verify).
 *   - Florida Student Privacy + Title IX: Florida HB 1557 / Parental
 *     Rights in Education Act (eff. July 2022; subsequent amendments)
 *     may conflict with the 2024 Title IX Rule's gender identity
 *     protections in K-12. AI systems must flag this conflict for
 *     human/legal review; cannot autonomously resolve it. For K-12
 *     programs at P.K. Yonge, this is a direct federal/state law
 *     conflict. This pack includes REQUIRE_APPROVAL escalation for
 *     gender-identity-related student records in Florida K-12 contexts.
 *   - Florida Student Privacy + NIH DMS: If UF education researchers
 *     collect K-12 student data under NIH grants, both this pack and
 *     the NIH DMS pack apply. Florida Section 1002.222 may prohibit
 *     certain data sharing that NIH DMS would otherwise require. The
 *     FERPA research exception DUA is the operative instrument; NIH
 *     Program Officer must be notified of state-law sharing
 *     restrictions at grant application stage.
 *
 * Sovereignty: Florida state law. Applies to public K-12 education
 * and ed-tech operators serving Florida K-12 students.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.FLORIDA_STUDENT_PRIVACY_PACK = exports.FLORIDA_STUDENT_PRIVACY_CATEGORY_CLASSIFIERS = void 0;
/**
 * Florida Student Privacy category classifiers for the pack-driven
 * classifier (W1).
 */
exports.FLORIDA_STUDENT_PRIVACY_CATEGORY_CLASSIFIERS = {
    FLORIDA_K12_STUDENT_RECORD: {
        references: ['Florida Statute Chapter 1002.22 -- K-12 education records; FERPA federal floor (34 CFR 99)'],
        classifier: (input) => {
            // Florida school district identifier with K-12 grade indicator
            if (/\b(?:florida.k.?12|florida.school.district|pk.yonge|duval.county.school|hillsborough.school|orange.county.school|miami.dade.school)\b/i.test(input))
                return true;
            if (/\b(?:FLORIDA_K12_STUDENT_RECORD|florida.student.record|fl.k12.student)\b/i.test(input))
                return true;
            // Grade K-12 combined with Florida district marker
            if (/\b(?:grade\s+[k1-9]|grade\s+1[012])\b.*\b(?:florida|fl.district|pk.yonge)\b/i.test(input))
                return true;
            if (/\b(?:florida|fl.district|pk.yonge)\b.*\b(?:grade\s+[k1-9]|grade\s+1[012])\b/i.test(input))
                return true;
            return false;
        },
    },
    FLORIDA_K12_BEHAVIORAL_PROFILE: {
        references: ['Florida Statute Section 1002.222 -- absolute prohibition on behavioral profiling of K-12 students for non-educational purposes'],
        classifier: (input) => {
            if (/\b(?:behavioral.profile.student|student.behavioral.tracking|k12.behavioral.data|FLORIDA_K12_BEHAVIORAL_PROFILE)\b/i.test(input))
                return true;
            // Behavioral profiling combined with student/school context
            if (/\b(?:behavioral.profile|engagement.tracking|student.analytics)\b.*\b(?:florida|k.12|school.district)\b/i.test(input))
                return true;
            return false;
        },
    },
    FLORIDA_PARENTAL_CONSENT_PENDING: {
        references: ['Florida Statute Section 1014 (HB 3 2023) -- parental notification and consent for AI tools collecting student data'],
        classifier: (input) => {
            if (/\b(?:florida.parental.consent.pending|hb3.consent.pending|fl.parent.notification.required|FLORIDA_PARENTAL_CONSENT_PENDING)\b/i.test(input))
                return true;
            return false;
        },
    },
    FLORIDA_STUDENT_PII: {
        references: ['Florida Statute Section 1002.222 -- personal information of Florida K-12 students'],
        classifier: (input) => {
            if (/\b(?:florida.student.pii|fl.k12.personal.information|FLORIDA_STUDENT_PII)\b/i.test(input))
                return true;
            // Student PII markers combined with Florida context
            if (/\b(?:student.name|student.ssn|student.address)\b.*\b(?:florida|fl.school|pk.yonge)\b/i.test(input))
                return true;
            return false;
        },
    },
    FLORIDA_VENDOR_NOT_LISTED: {
        references: ['Florida Statute Section 1002.222; Florida Section 1006.52 -- vendor data governance inventory requirement'],
        classifier: (input) => {
            if (/\b(?:vendor.not.listed|florida.data.governance.not.approved|unlisted.vendor.florida|FLORIDA_VENDOR_NOT_LISTED)\b/i.test(input))
                return true;
            return false;
        },
    },
    FLORIDA_STUDENT_DELETION_REQUEST: {
        references: ['Florida Statute Section 1002.222 -- deletion of student data on service termination'],
        classifier: (input) => {
            if (/\b(?:florida.student.deletion.request|fl.k12.data.deletion|FLORIDA_STUDENT_DELETION_REQUEST)\b/i.test(input))
                return true;
            return false;
        },
    },
    FLORIDA_PUBLIC_RECORDS_RISK: {
        references: ['Florida Statute Chapter 119 -- public records; Section 119.07(1) -- FERPA exemption'],
        classifier: (input) => {
            if (/\b(?:public.records.request.student|chapter.119.student|fl.public.records.risk|FLORIDA_PUBLIC_RECORDS_RISK)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * GAP-7: TARGETED_ADVERTISING_RECIPIENT -- detects indirect routing of Florida
     * K-12 student data to advertising/analytics intermediaries.
     *
     * The classifier inspects input for ad/analytics recipient signals:
     *   advertising, ads, analytics, marketing, retargeting, dmp, adtech, ad-network.
     * When a Florida K-12 student record is being processed AND the recipient
     * matches these signals, fire BLOCK.
     *
     * This category is both subject-keyed AND recipient-keyed: both dataSubjectId
     * and recipientId must be present to fully attribute the enforcement event.
     *
     * Reference: Florida Statute Section 1002.222 (absolute prohibition on
     * targeted advertising using Florida K-12 student data).
     */
    TARGETED_ADVERTISING_RECIPIENT: {
        references: ['Florida Statute Section 1002.222 -- targeted advertising prohibition; GAP-7'],
        classifier: (input) => {
            if (/\bTARGETED_ADVERTISING_RECIPIENT\b/i.test(input))
                return true;
            // Ad/analytics recipient signal in input (may come from recipient metadata)
            const hasAdSignal = /\b(?:advertising|ads?\b|analytics|marketing|retargeting|dmp|adtech|ad.network|tracking.pixel|behavioral.targeting)\b/i.test(input);
            // Florida K-12 student data context
            const hasStudentContext = /\b(?:florida.*k.?12|florida.*student|pk.yonge|k12.*florida|FLORIDA_K12_STUDENT_RECORD|fl.student|florida.school)\b/i.test(input);
            return hasAdSignal && hasStudentContext;
        },
    },
};
exports.FLORIDA_STUDENT_PRIVACY_PACK = {
    categoryClassifiers: exports.FLORIDA_STUDENT_PRIVACY_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: Florida K-12 student records, behavioral profiles, and
     * student PII are inherently subject-keyed. Each event must carry
     * a data subject ID to satisfy Florida Chapter 1002.22 parental
     * rights obligations (right to inspect, review, and request
     * correction) and FERPA federal floor requirements.
     */
    subjectKeyedCategories: [
        'FLORIDA_K12_STUDENT_RECORD',
        'FLORIDA_K12_BEHAVIORAL_PROFILE',
        'FLORIDA_STUDENT_PII',
        'TARGETED_ADVERTISING_RECIPIENT',
    ],
    id: 'florida-student-privacy',
    name: 'Florida Student Privacy (State Overlay)',
    version: '1.0.0',
    description: 'Florida state student privacy law overlay on the FERPA federal floor. Covers Florida Statute Chapter 1002.22 (student and parental rights), Section 1002.222 (operator obligations: no targeted advertising, no behavioral profiling, no data sale), HB 3/Section 1014 (parental notification gate), Section 1006.52 (data governance vendor inventory), and FIPA Section 501.171 (30-day breach notification clock). Applies to AI operators serving Florida public K-12 students, UF P.K. Yonge Developmental Research School, and UF-affiliated programs collecting Florida K-12 student data. Designed to activate alongside the FERPA pack.',
    authority: 'Florida Department of Education (FLDOE); Florida Attorney General; Florida Legislature',
    industries: ['higher-education', 'k12', 'edtech', 'student-information-systems'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Behavioral profiling block; targeted advertising block; parental consent gate; no-data-sale enforcement; FERPA exemption classification',
            reference: 'Florida Statute Section 1002.222 (behavioral profiling, advertising, sale prohibitions); Section 1014 (HB 3 parental consent)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident logs of all Florida K-12 student data processing events; FIPA breach documentation; deletion request audit trail',
            reference: 'Florida Statute Section 501.171 (FIPA breach documentation); Chapter 1002.22 (parental access records)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Reasonable security practices for Florida K-12 student personal information; SOC 2 Type II or equivalent documentation required from provider',
            reference: 'Florida Statute Section 1002.222 (reasonable security procedures); FIPA Section 501.171',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify Florida K-12 student records, behavioral profiles, PII, vendor listing status, and public records risk',
            reference: 'Florida Statute Chapter 1002.22; Section 1002.222; Chapter 119',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-student parental consent status; service termination deletion tracking; vendor listing verification status',
            reference: 'Florida Statute Section 1014 (HB 3 consent); Section 1002.222 (deletion obligations)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Florida vendor data governance listing confirmation; provider no-data-sale attestation; no-advertising attestation; deletion-on-termination agreement',
            reference: 'Florida Statute Section 1002.222 (vendor obligations); Section 1006.52 (data governance inventory)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Parental notification and consent gate for new AI tools; vendor listing human confirmation before deployment; gender identity escalation (HB 1557/Title IX conflict)',
            reference: 'Florida Statute Section 1014 (HB 3); Section 1002.222',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Provider no-sale attestation; FERPA exemption classification documentation; FIPA breach clock configuration evidence',
            reference: 'Florida Statute Section 1002.222; Section 119.07(1) (FERPA exemption); Section 501.171 (FIPA)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'FIPA breach notification stream (30-day AG notification); deletion request events; parental consent revocation events',
            reference: 'Florida Statute Section 501.171 (FIPA -- 30-day breach notification)',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'FERPA exemption classification tagging on AI-generated student records; SB 262 AI transparency disclosure (citation to verify scope)',
            reference: 'Florida Statute Chapter 119 / Section 119.07(1) (FERPA exemption claim); SB 262 (AI transparency; citation to verify codification)',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            behavioralProfilingBlockEnabled: true,
            targetedAdvertisingBlockEnabled: true,
            parentalConsentGateEnabled: true,
            providerNoSaleAttested: true,
            ferpaExemptionClassificationEnabled: true,
        },
        'data-classifier': {
            enabledCategories: [
                'FLORIDA_K12_STUDENT_RECORD',
                'FLORIDA_K12_BEHAVIORAL_PROFILE',
                'FLORIDA_PARENTAL_CONSENT_PENDING',
                'FLORIDA_STUDENT_PII',
                'FLORIDA_VENDOR_NOT_LISTED',
                'FLORIDA_STUDENT_DELETION_REQUEST',
                'FLORIDA_PUBLIC_RECORDS_RISK',
                'TARGETED_ADVERTISING_RECIPIENT',
            ],
        },
        'supply-chain': {
            vendorListingVerificationEnabled: true,
            providerNoSaleAttested: true,
            deletionOnTerminationDays: 30,
        },
        'approval-queue': {
            parentalConsentGateEnabled: true,
            vendorListingConfirmationRequired: true,
        },
        'session-persistence': {
            fipaBreachClockDays: 30,
            breachClockTrackingDays: 30,
        },
        'attestation-manager': {
            fipaBreachClockConfigured: true,
        },
        'event-bus': {
            fipaBreachNotificationStreamActive: true,
        },
        'transparency-injector': {
            ferpaExemptionClassificationTaggingRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'NO-TARGETED-ADVERTISING-K12',
            'NO-BEHAVIORAL-PROFILING-K12',
            'NO-SALE-OF-STUDENT-DATA',
            'DELETION-ON-TERMINATION-30-DAYS',
            'FLORIDA-VENDOR-LISTING-COMPLIANT',
            'SOC2-OR-EQUIVALENT-SECURITY',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'FLORIDA_K12_STUDENT_RECORD',
            'FLORIDA_K12_BEHAVIORAL_PROFILE',
            'FLORIDA_PARENTAL_CONSENT_PENDING',
            'FLORIDA_STUDENT_PII',
            'FLORIDA_VENDOR_NOT_LISTED',
            'FLORIDA_STUDENT_DELETION_REQUEST',
            'FLORIDA_PUBLIC_RECORDS_RISK',
            'TARGETED_ADVERTISING_RECIPIENT',
        ],
        categoryActions: {
            FLORIDA_K12_STUDENT_RECORD: 'BLOCK',
            FLORIDA_K12_BEHAVIORAL_PROFILE: 'BLOCK',
            FLORIDA_PARENTAL_CONSENT_PENDING: 'BLOCK',
            FLORIDA_STUDENT_PII: 'WARN',
            FLORIDA_VENDOR_NOT_LISTED: 'REQUIRE_APPROVAL',
            FLORIDA_STUDENT_DELETION_REQUEST: 'LOG',
            FLORIDA_PUBLIC_RECORDS_RISK: 'WARN',
            TARGETED_ADVERTISING_RECIPIENT: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US-FL'],
        // Florida General Records Schedule GS7 for school districts
        // (citation to verify current schedule version).
        // FERPA federal floor: 5 years for audit logs (DoE guidance).
        // FIPA: breach records retained per reasonable documentation standard.
        // Parental consent records: retained while student is enrolled + 3 years.
        // Post-termination deletion confirmation: 3 years.
        auditLogRetentionDays: 1825, // 5 years (FERPA DoE audit log guidance as federal floor)
        sessionRetentionDays: 1095, // 3 years post-enrollment as minimum
        incidentRetentionDays: 1095, // 3 years (FIPA reasonable documentation)
        reference: 'Florida Statute Chapter 257; FLDOE records schedule GS7 (citation to verify current version); FERPA 34 CFR 99 (federal floor); Florida Statute Section 1002.222 (post-termination deletion confirmation)',
    },
    incidentPolicy: {
        // FIPA Section 501.171: 30 days from determination of breach.
        // Concurrent AG notification if 500+ Florida residents affected.
        // Internal escalation: 72 hours. Provider must notify institution
        // within 10 days to allow institution to meet FIPA 30-day clock.
        notificationDeadlineHours: 720, // 30 days (FIPA Section 501.171(3)(a))
        reference: 'Florida Statute Section 501.171 (FIPA -- 30-day breach notification clock); DoE FERPA guidance (60 days for student/parent -- FIPA 30-day clock is stricter)',
        requiredRecipients: ['affected-parents-students', 'florida-attorney-general', 'institution-privacy-officer', 'school-district'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'fl-student-no-behavioral-profiling',
            description: 'AI does not create behavioral profiles of Florida K-12 students for non-educational purposes',
            reference: 'Florida Statute Section 1002.222 (absolute prohibition on non-educational behavioral profiling)',
            check: 'fl_student_no_behavioral_profiling',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fl-student-no-targeted-advertising',
            description: 'AI does not use Florida K-12 student data for targeted advertising',
            reference: 'Florida Statute Section 1002.222 (targeted advertising prohibition)',
            check: 'fl_student_no_targeted_advertising',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fl-student-parental-consent-gate',
            description: 'Parental notification and consent confirmed before AI processes Florida K-12 student data',
            reference: 'Florida Statute Section 1014 (HB 3 2023 -- parental notification requirement)',
            check: 'fl_student_parental_consent_gate',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fl-student-vendor-listing-check',
            description: 'AI vendor listed in Florida district data governance inventory',
            reference: 'Florida Statute Section 1002.222; Section 1006.52 (data governance vendor inventory)',
            check: 'fl_student_vendor_listing_check',
            failSeverity: 'HIGH',
        },
        {
            id: 'fl-student-no-data-sale',
            description: 'Provider attestation on file: no sale or trade of Florida K-12 student data',
            reference: 'Florida Statute Section 1002.222 (sale prohibition)',
            check: 'fl_student_no_data_sale',
            failSeverity: 'HIGH',
        },
        {
            id: 'fl-student-fipa-breach-clock',
            description: 'Breach notification workflow configured for 30-day FIPA clock',
            reference: 'Florida Statute Section 501.171 (FIPA -- 30-day breach notification)',
            check: 'fl_student_fipa_breach_clock',
            failSeverity: 'HIGH',
        },
        {
            id: 'fl-student-deletion-on-termination',
            description: 'Florida K-12 student data deleted within 30 days of service termination',
            reference: 'Florida Statute Section 1002.222 (deletion obligation on termination)',
            check: 'fl_student_deletion_on_termination',
            failSeverity: 'HIGH',
        },
        {
            id: 'fl-student-behavioral-record-block',
            description: 'Runtime blocks FLORIDA_K12_STUDENT_RECORD category without confirmed parental consent',
            reference: 'Florida Statute Chapter 1002.22; Section 1002.222',
            check: 'behavioralValidator_florida_student_privacy',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fl-student-targeted-advertising-recipient-block',
            description: 'Runtime blocks TARGETED_ADVERTISING_RECIPIENT category when Florida K-12 student data routes to ad/analytics intermediary (GAP-7)',
            reference: 'Florida Statute Section 1002.222 (targeted advertising prohibition)',
            check: 'behavioralValidator_florida_targeted_advertising',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=florida-student-privacy.js.map