"use strict";
/**
 * ClassificationRule table for the P4-RET-01 data classifier.
 *
 * Maps write-site signatures (string literals or RegExp patterns) to
 * DataClass values. The `packBindingResolver` and `sovereigntyResolver`
 * are called at classification time with the caller-supplied context.
 *
 * DEFAULT DENY: there is no fallback rule. Any write site not listed here
 * causes DataClassifier.classify() to throw UnclassifiedWriteError
 * synchronously at the storage call site (AC 3, AC 19).
 *
 * Write-site strings must be stable identifiers -- prefer module-path style
 * (e.g. 'audit:chain:append') so they survive refactors without silent
 * reclassification.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.DEFAULT_CLASSIFICATION_RULES = void 0;
const data_class_1 = require("./data-class");
// ---------------------------------------------------------------------------
// Shared resolver helpers
// ---------------------------------------------------------------------------
/** Bind to all active packs for this tenant (most write sites use this). */
const allActivePacks = (ctx) => ctx.activePackIds;
/** Fall back to hint, then 'global'. */
const globalSovereignty = (ctx) => ctx.sovereigntyHint ?? 'global';
// ---------------------------------------------------------------------------
// Default rule table
//
// WRITE SITES COVERED:
//   1.  audit:chain:append            -> AuditEvent
//   2.  audit:wal:append              -> AuditEvent   (WAL is same class)
//   3.  approval-queue:insert         -> ApprovalQueueItem
//   4.  agent-registration:store      -> AgentRegistration
//   5.  policy:snapshot:write         -> PolicySnapshot
//   6.  governance-reporter:wal:event -> AuditEvent   (reporter WAL)
//   7.  session:state:write           -> SessionState
//   8.  compliance-report:write       -> ComplianceReport
//   9.  pii:record:store              -> PiiRecord
//   10. phi:record:store              -> PhiRecord
//   11. financial:record:store        -> FinancialRecord
//   12. discovery:artefact:store      -> DiscoveryArtefact
//   13. backup:index:write            -> BackupIndex
// ---------------------------------------------------------------------------
exports.DEFAULT_CLASSIFICATION_RULES = [
    // ---- 1. Tamper-evident audit chain append (AuditIntegrity.append) ----
    {
        writeSitePattern: 'audit:chain:append',
        dataClass: data_class_1.DataClass.AuditEvent,
        packBindingResolver: allActivePacks,
        sovereigntyResolver: globalSovereignty,
    },
    // ---- 2. GovernanceReporter WAL append (reporter durability layer) ----
    {
        writeSitePattern: 'audit:wal:append',
        dataClass: data_class_1.DataClass.AuditEvent,
        packBindingResolver: allActivePacks,
        sovereigntyResolver: globalSovereignty,
    },
    // ---- 3. ApprovalQueue.submit (approval-queue.ts) ----
    {
        writeSitePattern: 'approval-queue:insert',
        dataClass: data_class_1.DataClass.ApprovalQueueItem,
        packBindingResolver: allActivePacks,
        sovereigntyResolver: globalSovereignty,
    },
    // ---- 4. Agent-registration store (governed-agent config persistence) ----
    {
        writeSitePattern: 'agent-registration:store',
        dataClass: data_class_1.DataClass.AgentRegistration,
        packBindingResolver: allActivePacks,
        sovereigntyResolver: globalSovereignty,
    },
    // ---- 5. Policy snapshot (GovernanceConfig serialise / export) ----
    {
        writeSitePattern: 'policy:snapshot:write',
        dataClass: data_class_1.DataClass.PolicySnapshot,
        packBindingResolver: allActivePacks,
        sovereigntyResolver: globalSovereignty,
    },
    // ---- 6. GovernanceReporter.reportEvent (event queue write-through) ----
    {
        writeSitePattern: 'governance-reporter:wal:event',
        dataClass: data_class_1.DataClass.AuditEvent,
        packBindingResolver: allActivePacks,
        sovereigntyResolver: globalSovereignty,
    },
    // ---- 7. Session state persistence (SessionPersistence / state-manager) ----
    {
        writeSitePattern: 'session:state:write',
        dataClass: data_class_1.DataClass.SessionState,
        packBindingResolver: allActivePacks,
        sovereigntyResolver: globalSovereignty,
    },
    // ---- 8. Compliance report write (ComplianceReporter output) ----
    {
        writeSitePattern: 'compliance-report:write',
        dataClass: data_class_1.DataClass.ComplianceReport,
        packBindingResolver: allActivePacks,
        sovereigntyResolver: globalSovereignty,
    },
    // ---- 9. PII record store (data-classifier detected PII hits) ----
    {
        writeSitePattern: 'pii:record:store',
        dataClass: data_class_1.DataClass.PiiRecord,
        packBindingResolver: allActivePacks,
        sovereigntyResolver: globalSovereignty,
    },
    // ---- 10. PHI record store (HIPAA protected health information) ----
    {
        writeSitePattern: 'phi:record:store',
        dataClass: data_class_1.DataClass.PhiRecord,
        packBindingResolver: (ctx) => {
            // PHI records must always include hipaa in packBinding when available.
            // If hipaa is not an active pack this still returns allActivePacks --
            // the tenant configuration is wrong, not the data class.
            return ctx.activePackIds;
        },
        sovereigntyResolver: globalSovereignty,
    },
    // ---- 11. Financial record store (SOX / PCI DSS write sites) ----
    {
        writeSitePattern: 'financial:record:store',
        dataClass: data_class_1.DataClass.FinancialRecord,
        packBindingResolver: allActivePacks,
        sovereigntyResolver: globalSovereignty,
    },
    // ---- 12. Discovery artefact store (scanner / discovery jobs) ----
    {
        writeSitePattern: 'discovery:artefact:store',
        dataClass: data_class_1.DataClass.DiscoveryArtefact,
        packBindingResolver: allActivePacks,
        sovereigntyResolver: globalSovereignty,
    },
    // ---- 13. Backup index write (backup metadata cataloguing) ----
    {
        writeSitePattern: 'backup:index:write',
        dataClass: data_class_1.DataClass.BackupIndex,
        packBindingResolver: allActivePacks,
        sovereigntyResolver: globalSovereignty,
    },
    // ---- Mortgage-industry write sites (MORTGAGE-PACKS-01, 2026-04-22) ----
    // ---- 14. Mortgage application record store (RESPA / TILA-TRID / ECOA) ----
    {
        writeSitePattern: 'mortgage:application:store',
        dataClass: data_class_1.DataClass.MortgageApplicationRecord,
        packBindingResolver: (ctx) => {
            // Auto-bind to all active mortgage packs when tenant has them enabled.
            // X3 2026-04-24: respa renamed to us-respa; tila-trid split into us-trid + us-tila
            const mortgagePacks = ['us-respa', 'respa', 'hmda', 'us-trid', 'us-tila', 'tila-trid', 'ecoa', 'fcra'];
            const active = ctx.activePackIds.filter(id => mortgagePacks.includes(id));
            // Fall back to all active packs when no mortgage pack is specifically active.
            return active.length > 0 ? active : ctx.activePackIds;
        },
        sovereigntyResolver: (_ctx) => 'us',
    },
    // ---- 15. HMDA LAR entry store (race/ethnicity/sex GMI protected, HMDA/ECOA) ----
    {
        writeSitePattern: 'hmda:lar:store',
        dataClass: data_class_1.DataClass.HmdaLarEntry,
        packBindingResolver: (ctx) => {
            // HMDA LAR entries MUST always include the hmda pack when active;
            // also include ecoa as Reg B §1002.6 governs permitted use.
            const required = ['hmda', 'ecoa'];
            const active = ctx.activePackIds.filter(id => required.includes(id));
            return active.length > 0 ? active : ctx.activePackIds;
        },
        sovereigntyResolver: (_ctx) => 'us',
    },
    // ---- 16. Consumer report record store (FCRA §604 permissible-purpose gated) ----
    {
        writeSitePattern: 'consumer-report:record:store',
        dataClass: data_class_1.DataClass.ConsumerReportRecord,
        packBindingResolver: (ctx) => {
            // Consumer report records must always include fcra when active.
            const required = ['fcra'];
            const active = ctx.activePackIds.filter(id => required.includes(id));
            return active.length > 0 ? active : ctx.activePackIds;
        },
        sovereigntyResolver: (_ctx) => 'us',
    },
];
//# sourceMappingURL=classification-rules.js.map