/**
 * AU Consumer Data Right — CDR Act 2019 + Privacy Safeguards 1-13
 *
 * Primary statutes:
 *   - Competition and Consumer Act 2010 (Cth) Part IVD (CDR Act 2019)
 *   - CDR Rules 2020 (+ Authorisation Amendment Rules)
 *   - CDR Privacy Safeguards (Schedule 2 to Rules)
 *   - Sector-specific designation instruments (banking, energy, telco)
 *
 * Sectors designated: Banking (2019, phased — open product, account, mortgage/
 * investment data); Energy (2023, open product live, consumer rights staged);
 * Telecommunications (designated, implementation timeline active).
 *
 * Entities covered: Data holders; accredited data recipients (ADRs holding ACCC
 * accreditation); affiliates and principal/representative arrangements.
 *
 * Key AI obligations:
 *   - PS 3/6: Consumer consent must be current, active, specific, time-limited.
 *     AI systems acting as ADRs must gate all CDR data access on consent.
 *   - PS 7: CDR data cannot be used for marketing without separate express consent.
 *   - PS 8: Offshore transfers require ACCC accreditation review for equivalent
 *     protections — stricter than APP 8 in practice.
 *   - PS 13: Delete CDR data within 5 business days of consent withdrawal/expiry.
 *   - ASD Essential Eight (or equivalent) as security baseline under PS 10.
 *
 * Cross-pack interactions:
 *   - au-cdr + au-privacy-act: CDR Privacy Safeguards are lex specialis for CDR
 *     data; APPs fill gaps. Dual OAIC + ACCC oversight applies.
 *   - au-cdr + au-aml-ctf: Banking/fintech ADRs are AML reporting entities. CDR
 *     data under consumer consent cannot be used for AML obligations without
 *     separate consent or statutory compulsion.
 *   - au-cdr + gdpr: Independent transfer regimes for cross-border CDR data.
 *     GDPR and CDR PS 8 each impose separate requirements; both must be satisfied.
 *   - au-cdr + au-spam-act: PS 7 marketing prohibition + Spam Act consent
 *     requirements operate independently; both apply to CDR-derived marketing.
 *
 * Authority: Australian Competition and Consumer Commission (ACCC) + OAIC
 * Sovereignty: Australian Federal
 *
 * @connexum/ai-governance
 */
export const AU_CDR_CATEGORY_CLASSIFIERS = {
    AU_CDR_CONSUMER: {
        references: ['CDR Rules 2020 r.1.7 — CDR consumer definition'],
        classifier: (input) => {
            if (/\b(?:cdr\s+consumer|cdr\s+data|consumer\s+data\s+right|open\s+banking\s+(?:data|consumer)|accredited\s+(?:data\s+)?recipient)/i.test(input))
                return true;
            return false;
        },
    },
    AU_CDR_CONSENT_ACTIVE: {
        references: ['CDR Rules 2020 Schedule 2 PS 3 — current and active consent'],
        classifier: (input) => {
            if (/\b(?:cdr\s+consent\s+(?:active|current|valid|granted)|consent\s+(?:reference|token).*cdr|active\s+cdr\s+authorisation)/i.test(input))
                return true;
            return false;
        },
    },
    AU_CDR_CONSENT_EXPIRED: {
        references: ['CDR Rules 2020 Schedule 2 PS 3/6 — expired or withdrawn consent = no lawful basis'],
        classifier: (input) => {
            if (/\b(?:cdr\s+consent\s+(?:expired|withdrawn|revoked|lapsed|cancelled)|consent\s+(?:no\s+longer|not)\s+(?:active|valid).*cdr|expired\s+cdr\s+authorisation)/i.test(input))
                return true;
            return false;
        },
    },
    AU_CDR_DATA_SECONDARY_USE: {
        references: ['CDR Rules 2020 Schedule 2 PS 6 — use limited to authorised purpose'],
        classifier: (input) => {
            if (/\b(?:cdr\s+data.*(?:secondary\s+use|analytics|model\s+training|product\s+development)|secondary\s+(?:use|analytics).*cdr\s+data|using\s+cdr\s+data\s+for\s+(?!the\s+purpose))/i.test(input))
                return true;
            return false;
        },
    },
    AU_CDR_OFFSHORE_TRANSFER: {
        references: ['CDR Rules 2020 Schedule 2 PS 8 — equivalent protections for offshore transfers'],
        classifier: (input) => {
            if (/\b(?:cdr\s+data.*(?:overseas|offshore|outside\s+australia)|offshore.*cdr\s+(?:data|processing)|transfer.*cdr.*overseas)/i.test(input))
                return true;
            return false;
        },
    },
    AU_CDR_DELETION_TRIGGER: {
        references: ['CDR Rules 2020 Schedule 2 PS 13 — deletion within 5 business days'],
        classifier: (input) => {
            if (/\b(?:cdr\s+(?:data\s+)?deletion|delete\s+cdr\s+data|consent\s+(?:withdrawn|expired).*delete|cdr\s+data.*(?:purge|destroy|remove))/i.test(input))
                return true;
            return false;
        },
    },
    AU_CDR_MARKETING_USE: {
        references: ['CDR Rules 2020 Schedule 2 PS 7 — direct marketing prohibited without separate consent'],
        classifier: (input) => {
            if (/\b(?:cdr\s+data.*marketing|marketing.*cdr\s+data|using\s+cdr.*(?:promote|advertise|upsell|market)|cdr\s+(?:transaction|account)\s+data.*campaign)/i.test(input))
                return true;
            return false;
        },
    },
};
export const AU_CDR_PACK = {
    categoryClassifiers: AU_CDR_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: All CDR data is subject-keyed by consumer — every access event must
     * carry a consumer identifier + consent reference to satisfy PS 10 access-log
     * requirements and PS 13 deletion-trigger traceability.
     */
    subjectKeyedCategories: [
        'AU_CDR_CONSUMER',
        'AU_CDR_CONSENT_ACTIVE',
        'AU_CDR_CONSENT_EXPIRED',
        'AU_CDR_DATA_SECONDARY_USE',
        'AU_CDR_OFFSHORE_TRANSFER',
        'AU_CDR_DELETION_TRIGGER',
        'AU_CDR_MARKETING_USE',
    ],
    id: 'au-cdr',
    name: 'AU Consumer Data Right — CDR Act 2019 + Privacy Safeguards 1-13',
    version: '1.0.0',
    contentHash: '3b5543261325c87cce1bc1b70e9ba7ce13532e368dd3296a17810f5e4e29dddc',
    description: 'Consumer Data Right compliance for AI systems operating as or supporting accredited data recipients (ADRs) across banking, energy, and telecommunications. Enforces CDR Privacy Safeguards: consent gate (PS 3/6), secondary-use block (PS 6), marketing prohibition (PS 7), offshore transfer controls (PS 8), 5-business-day deletion SLA (PS 13), and 7-year access-log retention (PS 10).',
    authority: 'Australian Competition and Consumer Commission (ACCC) + Office of the Australian Information Commissioner (OAIC)',
    industries: [
        'banking', 'energy', 'telco', 'fintech',
        'open-banking', 'open-energy', 'saas',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'CDR consent gate enforcement; secondary-use block; marketing prohibition; deletion workflow trigger',
            reference: 'CDR Rules Schedule 2 PS 3, PS 6, PS 7, PS 13',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Consumer-searchable access logs 7 years; consent reference per access event; deletion execution records',
            reference: 'CDR Rules Schedule 2 PS 10 (security + logging)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'ASD Essential Eight security baseline mandated by PS 10; encryption of CDR data in transit and at rest',
            reference: 'CDR Rules Schedule 2 PS 10',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect CDR data categories, expired consent, secondary use, offshore transfer, marketing use',
            reference: 'CDR Rules Schedule 2 PS 3, PS 6-8',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Consent lifecycle tracking per consumer; deletion trigger monitoring; consent expiry detection',
            reference: 'CDR Rules Schedule 2 PS 3 (current consent); PS 13 (deletion)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Offshore ADR arrangements reviewed against ACCC accreditation requirements before onboarding',
            reference: 'CDR Rules Schedule 2 PS 8',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Offshore transfer approval; deletion confirmation; secondary-use gate; consumer dispute resolution',
            reference: 'CDR Rules Schedule 2 PS 8, PS 13',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'CDR breach notification stream (ACCC + OAIC parallel); consent-withdrawal events; deletion completion events',
            reference: 'CDR Rules r.9.3 (ACCC notification); Privacy Act Part IIIC (OAIC)',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'AU_CDR_CONSUMER',
                'AU_CDR_CONSENT_ACTIVE',
                'AU_CDR_CONSENT_EXPIRED',
                'AU_CDR_DATA_SECONDARY_USE',
                'AU_CDR_OFFSHORE_TRANSFER',
                'AU_CDR_DELETION_TRIGGER',
                'AU_CDR_MARKETING_USE',
            ],
            cdrConsentGateEnabled: true,
            cdrSecondaryUseBlockEnabled: true,
            cdrMarketingBlockEnabled: true,
            cdrDeletionSlaBusinessDays: 5,
            cdrOffshoreApprovalRequired: true,
            cdrAccessLoggingActive: true,
        },
        'governance-runtime': {
            cdrConsentGateEnabled: true,
            cdrSecondaryUseBlockEnabled: true,
            cdrMarketingBlockEnabled: true,
            cdrDeletionSlaBusinessDays: 5,
            cdrOffshoreApprovalRequired: true,
            cdrAccessLoggingActive: true,
        },
        'session-persistence': {
            consentExpiryDetectionRequired: true,
            deletionTriggerTrackingRequired: true,
        },
        'supply-chain': {
            acccAccreditationReviewRequired: true,
            offshoreArrangementApprovalRequired: true,
        },
        'approval-queue': {
            offshoreTransferApprovalRequired: true,
            deletionConfirmationRequired: true,
            secondaryUseGateRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'CDR-ACCREDITATION-COMPATIBLE',
            'ZERO-TRAINING-ON-CDR-INPUTS',
            'ASD-ESSENTIAL-EIGHT-ALIGNED',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'AU_CDR_CONSUMER',
            'AU_CDR_CONSENT_ACTIVE',
            'AU_CDR_CONSENT_EXPIRED',
            'AU_CDR_DATA_SECONDARY_USE',
            'AU_CDR_OFFSHORE_TRANSFER',
            'AU_CDR_DELETION_TRIGGER',
            'AU_CDR_MARKETING_USE',
        ],
        categoryActions: {
            AU_CDR_CONSUMER: 'LOG',
            AU_CDR_CONSENT_ACTIVE: 'LOG',
            AU_CDR_CONSENT_EXPIRED: 'BLOCK',
            AU_CDR_DATA_SECONDARY_USE: 'BLOCK',
            AU_CDR_OFFSHORE_TRANSFER: 'REQUIRE_APPROVAL',
            AU_CDR_DELETION_TRIGGER: 'REQUIRE_APPROVAL',
            AU_CDR_MARKETING_USE: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['AU'],
        auditLogRetentionDays: 2555, // 7 years (access logs, deletion records, dispute records)
        sessionRetentionDays: 730, // 2 years (consent records from expiry)
        incidentRetentionDays: 2555,
        reference: 'CDR Rules Schedule 2 PS 10 (access logs 7y); consent records (2y from expiry); deletion records (7y)',
    },
    incidentPolicy: {
        notificationDeadlineHours: 720, // NDB 30-day internal assessment; ACCC "as soon as practicable"
        reference: 'CDR Rules r.9.3 (ACCC notification as soon as practicable); Privacy Act Part IIIC (OAIC 30d)',
        requiredRecipients: ['accc', 'oaic', 'affected-consumer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'au-cdr-consent-gate',
            description: 'CDR data access blocked without current and active consumer consent',
            reference: 'CDR Rules Schedule 2 PS 3, PS 6',
            check: 'au_cdr_consent_gate_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-cdr-secondary-use-block',
            description: 'CDR data use beyond authorised purpose blocked',
            reference: 'CDR Rules Schedule 2 PS 6',
            check: 'au_cdr_secondary_use_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-cdr-marketing-block',
            description: 'CDR data marketing use blocked without separate express marketing consent',
            reference: 'CDR Rules Schedule 2 PS 7',
            check: 'au_cdr_marketing_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-cdr-deletion-sla',
            description: 'CDR data deletion executed within 5 business days of consent withdrawal or expiry',
            reference: 'CDR Rules Schedule 2 PS 13',
            check: 'au_cdr_deletion_sla_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-cdr-offshore-gate',
            description: 'Offshore CDR data transfer requires ACCC accreditation review and approval',
            reference: 'CDR Rules Schedule 2 PS 8',
            check: 'au_cdr_offshore_gate_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-cdr-access-log',
            description: 'All CDR data access logged per consumer with consent reference, retained 7 years',
            reference: 'CDR Rules Schedule 2 PS 10',
            check: 'au_cdr_access_log_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=au-cdr.js.map