/**
 * Illinois BIPA Compliance Pack
 *
 * Illinois Biometric Information Privacy Act (740 ILCS 14/) with 2024
 * SB 2979 amendment (per-person violation counting). Applies to any
 * entity collecting biometric identifiers or biometric information
 * from Illinois residents.
 *
 * Statutory damages:
 *   - $1,000 per negligent violation
 *   - $5,000 per intentional / reckless violation
 *   - Post-SB 2979: per-person (not per-scan) aggregation
 *
 * Rosenbach v. Six Flags (2019 Ill.): plaintiff does not need actual
 * damages; statutory damages alone suffice.
 *
 * @connexum/ai-governance
 */
import { sharedPiiClassifier } from './_base-classifiers.js';
/**
 * BIPA (Illinois Biometric Information Privacy Act, 740 ILCS 14) category classifiers.
 * BIPA restricts collection, use, and storage of biometric identifiers and information.
 */
export const BIPA_CATEGORY_CLASSIFIERS = {
    BIOMETRIC_IDENTIFIER: {
        references: ['740 ILCS 14/10 -- biometric identifier definition'],
        classifier: (input) => {
            if (/\b(?:fingerprint|retinal scan|iris scan|voiceprint|hand geometry|face geometry|biometric[_\s]id)\b/i.test(input))
                return true;
            if (/\bbiometric[_-]?(?:identifier|template|hash|data)[:\s=]*\S+/i.test(input))
                return true;
            return false;
        },
    },
    BIOMETRIC_INFORMATION: {
        references: ['740 ILCS 14/10 -- biometric information definition'],
        classifier: (input) => {
            if (/\b(?:facial recognition|voice recognition|biometric\s+(?:data|information|record|scan|match))\b/i.test(input))
                return true;
            if (/\b(?:face\s+(?:scan|template|vector|embedding|print)|fingerprint\s+hash)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['740 ILCS 14/10 -- personally identifying information associated with biometrics'],
        classifier: sharedPiiClassifier,
    },
    CREDENTIALS: {
        references: ['BIPA §15(e) -- reasonable standard of care; credential protection'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const BIPA_PACK = {
    categoryClassifiers: BIPA_CATEGORY_CLASSIFIERS,
    /** P3.5: Biometric identifiers and information are inherently subject-keyed per BIPA 740 ILCS 14. */
    subjectKeyedCategories: ['BIOMETRIC_IDENTIFIER', 'BIOMETRIC_INFORMATION'],
    id: 'bipa',
    name: 'BIPA',
    version: '1.0.0',
    description: 'Illinois Biometric Information Privacy Act compliance with 2024 SB 2979 amendment. Written consent, public policy, no sale, retention / destruction schedule, private right of action with statutory damages.',
    authority: 'Illinois Courts (private right of action)',
    industries: ['any-collecting-biometric-il', 'retail-facial-recognition', 'access-control-biometric', 'timeclock-biometric', 'fintech-voiceprint', 'healthcare-biometric', 'hr-technology'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Biometric-collection gate: block without per-subject written consent',
            reference: '740 ILCS 14/15(b)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident record of consent capture + destruction + disclosure events',
            reference: '740 ILCS 14/15(a), (d)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect BIOMETRIC_IDENTIFIER + BIOMETRIC_INFORMATION',
            reference: '740 ILCS 14/10 (definitions)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-subject retention schedule enforcement; consent record continuity',
            reference: '740 ILCS 14/15(a), (b)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Vendor terms prohibit sale / lease / trade / profit on biometric data',
            reference: '740 ILCS 14/15(c)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Disclosure requests require subject consent verification',
            reference: '740 ILCS 14/15(d)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Written public policy + retention schedule attestation',
            reference: '740 ILCS 14/15(a)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Reasonable care standard requires encryption at rest + in transit',
            reference: '740 ILCS 14/15(e)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Per-person violation aggregation (post-SB 2979)',
            reference: '740 ILCS 14/20 (as amended)',
        },
        {
            name: 'data-subject-rights',
            required: true,
            reason: 'Subject deletion requests processed per destruction schedule',
            reference: 'Rosenbach v. Six Flags 2019; §15(a)',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            writtenConsentRequired: true,
            extraterritorialIlSubjectCheck: true,
        },
        'data-classifier': {
            enabledCategories: ['BIOMETRIC_IDENTIFIER', 'BIOMETRIC_INFORMATION', 'PII', 'CREDENTIALS'],
            biometricAction: 'BLOCK_WITHOUT_CONSENT',
        },
        'session-persistence': {
            perSubjectRetentionScheduleRequired: true,
            destructionOnScheduleMaturityRequired: true,
        },
        'supply-chain': {
            biometricSaleProhibited: true,
            biometricLeaseProhibited: true,
            biometricTradeProhibited: true,
            biometricProfitProhibited: true,
        },
        'approval-queue': {
            disclosureRequiresSubjectConsent: true,
        },
        'attestation-manager': {
            publicPolicyRequired: true,
            retentionScheduleRequired: true,
            destructionGuidelinesRequired: true,
        },
        'event-bus': {
            perPersonViolationAggregation: true,
        },
        'data-subject-rights': {
            biometricDeletionSupported: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['BIOMETRIC-NO-SALE', 'BIOMETRIC-NO-TRAINING'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['BIOMETRIC_IDENTIFIER', 'BIOMETRIC_INFORMATION', 'PII', 'CREDENTIALS'],
        categoryActions: {
            BIOMETRIC_IDENTIFIER: 'BLOCK',
            BIOMETRIC_INFORMATION: 'BLOCK',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        sovereignty: ['US-IL'],
        // 5 years aligned with statute of limitations + class-action tail
        auditLogRetentionDays: 1825,
        sessionRetentionDays: 1825,
        incidentRetentionDays: 1825,
        reference: 'Illinois statute of limitations + BIPA class-action tail',
    },
    incidentPolicy: {
        // 7-day external notification to affected subjects (Pax1 default; no statutory deadline)
        notificationDeadlineHours: 168,
        reference: 'No statutory deadline. Pax1 default 7-day external + same-day internal to privacy counsel.',
        requiredRecipients: ['affected-subjects', 'privacy-counsel', 'risk-management'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'bipa-consent',
            description: 'Written consent per subject before biometric collection',
            reference: '740 ILCS 14/15(b)',
            check: 'bipa_consent_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'bipa-policy',
            description: 'Publicly available written policy with retention + destruction guidelines',
            reference: '740 ILCS 14/15(a)',
            check: 'bipa_policy_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'bipa-no-sale',
            description: 'Biometric data not sold, leased, traded, or profited from',
            reference: '740 ILCS 14/15(c)',
            check: 'bipa_no_sale_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'bipa-disclosure-consent',
            description: 'Disclosure requires subject consent',
            reference: '740 ILCS 14/15(d)',
            check: 'bipa_disclosure_consent_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'bipa-retention-schedule',
            description: 'Per-subject retention schedule enforced with destruction on maturity',
            reference: '740 ILCS 14/15(a)',
            check: 'bipa_retention_schedule_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'bipa-reasonable-care',
            description: 'Reasonable care standard: encryption + access controls + vendor due diligence',
            reference: '740 ILCS 14/15(e)',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'bipa-per-person-aggregation',
            description: 'Violations aggregated per-person (post-SB 2979)',
            reference: '740 ILCS 14/20 (2024 amendment)',
            check: 'bipa_per_person_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'bipa-extraterritorial',
            description: 'Extraterritorial check: IL resident flag evaluated on collection',
            reference: '740 ILCS 14 (extraterritorial scope)',
            check: 'bipa_extraterritorial_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'bipa-deletion-supported',
            description: 'Subject deletion requests supported via DSR workflow',
            reference: 'Rosenbach v. Six Flags 2019',
            check: 'bipa_deletion_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=bipa.js.map