"use strict";
/**
 * pii-patterns.ts -- Shared PII/PHI identifier pattern registry.
 *
 * Canonical source for all identifier-class regex patterns used by:
 *   - CrossSessionMemoryStore (was: IDENTIFIER_PATTERNS in cross-session-memory.ts)
 *   - CrossSessionPseudonymizer (was: IDENTIFIER_PATTERNS_INTERNAL in
 *     cross-session-pseudonymizer.ts -- the duplicate marked "This copy is intentional")
 *   - PR-1 SDK strip helpers (pii-shield-sdk)
 *   - PR-3 PostToolUse handler (reads pii_shield block + dispatches to stripAndTag)
 *
 * Covers all 18 HIPAA Safe Harbor identifiers (45 CFR 164.514(b)(2)) plus
 * additional classes required by GDPR, PCI DSS, GLBA, FERPA, COPPA, BIPA,
 * CJIS, ECPA, FINRA-3110, SOX-404, and HMDA.
 *
 * Adding a new class:
 *   1. Add the string literal to IdentifierClass union.
 *   2. Add an entry to IDENTIFIER_PATTERNS.
 *   3. Update the consumer that needs the class.
 *   4. Register the class in the relevant pack's pii_shield.strip_classes[].
 *
 * @connexum/ai-governance PR-2
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.IDENTIFIER_PATTERNS = void 0;
exports.detectIdentifierClasses = detectIdentifierClasses;
// ---------------------------------------------------------------------------
// Pattern registry
// ---------------------------------------------------------------------------
/**
 * Regex patterns per identifier class.
 * Each array entry is tried in order; first match wins for detection.
 * Patterns are intentionally broad for detection -- the strip step
 * applies narrower replacement logic scoped by pack policy.
 */
exports.IDENTIFIER_PATTERNS = {
    // -------------------------------------------------------------------------
    // gdpr-contact: GDPR Art. 4(1) -- name, email, phone, address
    // -------------------------------------------------------------------------
    'gdpr-contact': [
        // email address
        /\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b/,
        // phone (loose -- intl + US)
        /\b(\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/,
        // full name (two capitalised words)
        /\b[A-Z][a-z]+\s[A-Z][a-z]+\b/,
        // postal / zip code
        /\b\d{5}(?:-\d{4})?\b/,
        // UK postcode
        /\b[A-Z]{1,2}\d[A-Z\d]?\s*\d[A-Z]{2}\b/i,
        // UK NINO
        /\b[A-CEGHJ-PR-TW-Z]{2}\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-D]\b/i,
        // IBAN (international bank account)
        /\b[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}(?:[A-Z0-9]?){0,16}\b/,
    ],
    // -------------------------------------------------------------------------
    // gdpr-personal: GDPR Art. 9 special-category sensitive data
    // -------------------------------------------------------------------------
    'gdpr-personal': [
        // Health condition / diagnosis codes (ICD-10)
        /\b[A-Z]\d{2}\.?\d{0,4}\b/,
        // Racial / ethnic origin labels
        /\b(?:ethnicity|race|ethnic[-\s]?group|national[-\s]?origin)[:\s"']*[A-Za-z\-]+/i,
        // Religious affiliation
        /\b(?:religion|faith|denomination|church|mosque|synagogue|temple)[:\s"']*[A-Za-z\-]+/i,
        // Political opinion
        /\b(?:political[-\s]?(?:affiliation|opinion|party|view))[:\s"']*[A-Za-z\-]+/i,
        // Biometric (shared with biometric class)
        /\b(?:fingerprint|retinal|biometric|voiceprint|faceprint)\s*(?:id|hash|template|data)[:\s]*\S+/i,
        // Genetic data
        /\b(?:genetic|genome|dna|rna)\s*(?:data|sequence|profile|test|result)[:\s]*\S+/i,
        // Sexual orientation
        /\b(?:sexual[-\s]?orientation|gender[-\s]?identity)[:\s"']*[A-Za-z\-]+/i,
    ],
    // -------------------------------------------------------------------------
    // phi: HIPAA 18 Safe Harbor identifiers (45 CFR 164.514(b)(2))
    // -------------------------------------------------------------------------
    'phi': [
        // 1. Names (detected via gdpr-contact; listed here for explicit phi scope)
        /\b[A-Z][a-z]+\s[A-Z][a-z]+\b/,
        // 2. Geographic subdivisions (zip codes)
        /\b(?:zip\s*(?:code)?|postal)[:\s]*\d{5}(?:-\d{4})?\b/,
        // 3. Dates (except year) -- DOB, admission date, discharge date
        /\b(?:DOB|Date\s+of\s+Birth|Birth\s*date|Admission\s*Date|Discharge\s*Date)[:\s]*\d{1,2}[\/\-]\d{1,2}[\/\-]\d{2,4}\b/i,
        // Relative date pattern (age disclosure via exact birth year for 90+)
        /\b(?:born\s+in|birth\s+year)[:\s]*(?:19[0-2]\d|18\d{2})\b/i,
        // 4. Phone numbers
        /\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/,
        // 5. Fax numbers (same pattern as phone)
        /\b(?:fax)[:\s]*(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/i,
        // 6. Email addresses
        /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/,
        // 7. Social Security numbers
        /\b\d{3}-\d{2}-\d{4}\b/,
        // 8. Medical record numbers (MRN)
        /\b(?:MRN|mrn|PatientId)[:\s#]*\d{5,12}\b/i,
        // 9. Health plan beneficiary numbers
        /\b(?:member|subscriber|beneficiary|policy)\s*(?:id|#|number)[:\s]*[A-Z0-9]{6,20}\b/i,
        // 10. Account numbers (in health context)
        /\b(?:account|acct)\s*(?:no|number|#)[:\s]*\d{6,20}\b/i,
        // 11. Certificate / license numbers
        /\b(?:license|certificate|licence)\s*(?:no|number|#)[:\s]*[A-Z0-9]{6,20}\b/i,
        // 12. Vehicle identifiers / serial numbers (VIN)
        /\b(?:VIN|vehicle\s+id)[:\s]*[A-HJ-NPR-Z0-9]{17}\b/i,
        // 13. Device identifiers
        /\b(?:device\s*(?:id|serial)|serial\s*(?:number|#))[:\s]*[A-Z0-9\-]{8,30}\b/i,
        // 14. Web URLs (when appearing with PHI context)
        /https?:\/\/(?:patient|ehr|health|phi|medical)\.[A-Za-z0-9\-\.]+/i,
        // 15. IP addresses
        /\b(?:\d{1,3}\.){3}\d{1,3}\b/,
        // 15b. IPv6 addresses
        /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b/,
        // 16. Biometric identifiers
        /\b(?:fingerprint|retinal|biometric|voiceprint|faceprint)\s*(?:id|hash|template|data)[:\s]*\S+/i,
        // 17. Full face photographs (file path or base64 reference)
        /\b(?:face[-_]?photo|patient[-_]?photo|headshot)[-_]?(?:url|path|src|data)[:\s]*\S+/i,
        // 18. Any other unique identifying number (catch-all for NPI, DEA, etc.)
        /\b(?:NPI|DEA|upin|provider[-\s]?id)[:\s#]*[A-Z0-9]{6,15}\b/i,
        // ICD diagnosis/procedure codes
        /\b[A-Z]\d{2}\.?\d{0,4}\b/,
        // Driver license / state ID
        /\b(?:DL|Driver['']?s?\s*License|state\s*ID)[:\s#]*[A-Z0-9]{6,15}\b/i,
        // Passport
        /\b(?:passport)\s*(?:#|number|no\.?)?[:\s]*[A-Z0-9]{6,12}\b/i,
    ],
    // -------------------------------------------------------------------------
    // pci-cardholder: PCI DSS v4.0.1 -- cardholder data
    // -------------------------------------------------------------------------
    'pci-cardholder': [
        // PAN -- 13-19 digit card number (Luhn check applied at runtime)
        /\b(?:4\d{12}(?:\d{3})?|5[1-5]\d{14}|3[47]\d{13}|3(?:0[0-5]|[68]\d)\d{11}|6(?:011|5\d{2})\d{12}|(?:2131|1800|35\d{3})\d{11})\b/,
        // Generic long digit string (fallback PAN detection)
        /\b\d{13,19}\b/,
        // CVV / CVC / CID (3-4 digit security code in context)
        /\b(?:CVV|CVC|CID|CVV2|CVC2|CAV2|card[-\s]?security[-\s]?code)[:\s]*\d{3,4}\b/i,
        // Card expiry MM/YY or MM/YYYY
        /\b(?:exp(?:iry|iration)?|valid\s+(?:thru|through))[:\s]*(?:0[1-9]|1[0-2])[\/\-]\d{2,4}\b/i,
        // Track data (magnetic stripe)
        /(?:Track\s*[12]|TRACK_DATA)[:\s]*[^\s]{20,}/i,
        // Cardholder name (name on card)
        /\b(?:cardholder|card[-\s]?holder)[\s\-]?name[:\s]*[A-Za-z\s]{2,40}/i,
        // ABA routing number (9 digits)
        /\b(?:ABA|routing|transit)\s*(?:number|no|#)?[:\s]*\d{9}\b/i,
    ],
    // -------------------------------------------------------------------------
    // financial-customer: GLBA NPI + FINRA customer financial data
    // -------------------------------------------------------------------------
    'financial-customer': [
        // SSN in financial context
        /\b\d{3}-\d{2}-\d{4}\b/,
        // Account numbers
        /\b(?:account|acct)\s*(?:no|number|#)[:\s]*\d{6,20}\b/i,
        // IBAN
        /\b[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}(?:[A-Z0-9]?){0,16}\b/,
        // ABA routing
        /\b(?:ABA|routing|transit)\s*(?:number|no|#)?[:\s]*\d{9}\b/i,
        // Investment account / brokerage ID
        /\b(?:brokerage|portfolio|investment|account)[-\s]?(?:id|#|number)[:\s]*[A-Z0-9]{5,20}\b/i,
        // Income / salary (in structured data)
        /\b(?:income|salary|wage|earnings|compensation)[:\s"']*\$?[\d,]+(?:\.\d{2})?\b/i,
        // Net worth / asset value
        /\b(?:net[-\s]?worth|assets|liabilities)[:\s"']*\$?[\d,]+(?:\.\d{2})?\b/i,
    ],
    // -------------------------------------------------------------------------
    // financial: SOX 404 -- material non-public information
    // -------------------------------------------------------------------------
    'financial': [
        // Earnings per share (EPS) -- non-public pre-announcement
        /\b(?:EPS|earnings[-\s]?per[-\s]?share)[:\s"']*\$?[\d.]+\b/i,
        // Revenue / profit figures
        /\b(?:revenue|net[-\s]?income|EBITDA|gross[-\s]?profit)[:\s"']*\$?[\d,.]+(?:[MBK])?\b/i,
        // M&A / deal references
        /\b(?:merger|acquisition|M&A|deal|transaction|LOI|term[-\s]?sheet)[:\s"']*[A-Za-z0-9\s\-]+/i,
        // Pending material events
        /\b(?:pending|upcoming|anticipated)\s+(?:earnings|results|announcement|guidance)\b/i,
        // Material non-public classification label
        /\b(?:MNPI|material[-\s]?non[-\s]?public|insider[-\s]?information)\b/i,
    ],
    // -------------------------------------------------------------------------
    // comms: ECPA Title III / FINRA 3110 -- communications content
    // -------------------------------------------------------------------------
    'comms': [
        // Email headers / content
        /\b(?:From|To|CC|BCC|Subject)[:\s]+[^\n]+/i,
        // Instant message / chat reference
        /\b(?:chat|message|IM|text|SMS|DM|direct[-\s]?message)[:\s"']+[^\n]{10,}/i,
        // Phone call recording reference
        /\b(?:call[-\s]?recording|recorded[-\s]?call|call[-\s]?transcript)[:\s]*[^\n]+/i,
        // Wire / intercept keywords
        /\b(?:intercept|wiretap|surveillance|monitor(?:ed)?[-\s]?communication)\b/i,
        // Electronic communication content markers
        /\b(?:communication[-\s]?content|wire[-\s]?communication|electronic[-\s]?communication)\b/i,
    ],
    // -------------------------------------------------------------------------
    // confidential-business: SOX 404 trade secrets / board confidential
    // -------------------------------------------------------------------------
    'confidential-business': [
        // Confidentiality labels
        /\b(?:CONFIDENTIAL|STRICTLY[-\s]?CONFIDENTIAL|ATTORNEY[-\s]?CLIENT|PRIVILEGED|TRADE[-\s]?SECRET)\b/,
        // Board / committee minutes
        /\b(?:board[-\s]?minutes|committee[-\s]?minutes|executive[-\s]?session)\b/i,
        // Strategic plan references
        /\b(?:strategic[-\s]?plan|roadmap|go[-\s]?to[-\s]?market|product[-\s]?roadmap)\b/i,
        // Patent application
        /\b(?:patent[-\s]?application|patent[-\s]?pending|provisional[-\s]?application)\b/i,
    ],
    // -------------------------------------------------------------------------
    // educational-records: FERPA -- student education records
    // -------------------------------------------------------------------------
    'educational-records': [
        // Student ID number
        /\b(?:student[-\s]?id|SID|student[-\s]?number)[:\s#]*[A-Z0-9]{5,15}\b/i,
        // GPA
        /\b(?:GPA|grade[-\s]?point[-\s]?average)[:\s]*\d\.\d{1,2}\b/i,
        // Transcript / grade reference
        /\b(?:transcript|grade[-\s]?report|academic[-\s]?record|enrollment[-\s]?record)\b/i,
        // Course grade in structured form
        /\b(?:grade|score|mark)[:\s]*[A-F][+-]?\b/i,
        // Financial aid
        /\b(?:financial[-\s]?aid|FAFSA|scholarship|grant[-\s]?award)[:\s]*\S+/i,
        // Disciplinary record
        /\b(?:disciplinary[-\s]?record|suspension|expulsion|academic[-\s]?violation)\b/i,
    ],
    // -------------------------------------------------------------------------
    // childrens-pii: COPPA -- PII for users under 13
    // -------------------------------------------------------------------------
    'childrens-pii': [
        // Full name
        /\b[A-Z][a-z]+\s[A-Z][a-z]+\b/,
        // Home address
        /\b\d{1,5}\s[A-Za-z\s]+(?:Street|St|Avenue|Ave|Road|Rd|Drive|Dr|Lane|Ln|Boulevard|Blvd)\b/i,
        // Email
        /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/,
        // Phone
        /\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/,
        // Age under-13 disclosure
        /\b(?:age|years[-\s]?old)[:\s"']*(?:[1-9]|1[0-2])\b/i,
        // Date of birth (minor -- within last 13 years; pattern only, year check at runtime)
        /\b(?:DOB|Date\s+of\s+Birth|Birthday)[:\s]*\d{1,2}[\/\-]\d{1,2}[\/\-]\d{2,4}\b/i,
        // School name
        /\b(?:elementary|middle[-\s]?school|primary[-\s]?school|grade[-\s]?school)\b/i,
        // Geolocation of minor
        /\b(?:location|coordinates|GPS|lat(?:itude)?|lon(?:gitude)?)[:\s]*[-\d.]+\s*[,;]\s*[-\d.]+\b/i,
        // Photo / video of minor
        /\b(?:child[-\s]?photo|student[-\s]?photo|minor[-\s]?image|kids[-\s]?video)\b/i,
        // Online contact info
        /\b(?:username|screen[-\s]?name|handle|gamer[-\s]?tag)[:\s"']*[A-Za-z0-9_\-]{3,30}\b/i,
    ],
    // -------------------------------------------------------------------------
    // biometric: BIPA -- Illinois biometric identifiers
    // -------------------------------------------------------------------------
    'biometric': [
        // Fingerprint (hash, template, data)
        /\b(?:fingerprint|thumbprint)\s*(?:id|hash|template|data|scan)[:\s]*\S+/i,
        // Voiceprint / voice geometry
        /\b(?:voiceprint|voice[-\s]?geometry|voice[-\s]?template)[:\s]*\S+/i,
        // Retina / iris scan
        /\b(?:retina|iris)\s*(?:scan|image|template|data)[:\s]*\S+/i,
        // Face geometry / facial recognition
        /\b(?:face[-\s]?geometry|facial[-\s]?(?:recognition|template|biometric|scan))[:\s]*\S+/i,
        // Hand geometry
        /\b(?:hand[-\s]?geometry|palm[-\s]?print|palm[-\s]?scan)[:\s]*\S+/i,
        // Generic biometric reference
        /\b(?:biometric[-\s]?identifier|biometric[-\s]?data|biometric[-\s]?information)\b/i,
        // Large base64-like blob in biometric context (template storage)
        /biometric[^=]*=[:\s"']*[A-Za-z0-9+/=]{64,}/i,
    ],
    // -------------------------------------------------------------------------
    // criminal-justice: CJIS -- criminal justice information
    // -------------------------------------------------------------------------
    'criminal-justice': [
        // Rap sheet / criminal history
        /\b(?:rap[-\s]?sheet|criminal[-\s]?history|criminal[-\s]?record)\b/i,
        // Arrest record
        /\b(?:arrest[-\s]?record|booking[-\s]?number|mugshot)\b/i,
        // Case / incident number
        /\b(?:case[-\s]?number|incident[-\s]?number|ORI|UCR)[:\s#]*[A-Z0-9\-]{5,20}\b/i,
        // Fingerprint in CJIS context (also covered by biometric)
        /\b(?:AFIS|fingerprint[-\s]?card|ten[-\s]?print)\b/i,
        // Warrant information
        /\b(?:arrest[-\s]?warrant|bench[-\s]?warrant|extradition[-\s]?warrant)\b/i,
        // NCIC / NLETS / III query
        /\b(?:NCIC|NLETS|III|Interstate[-\s]?Identification[-\s]?Index)\b/i,
        // Probation / parole status
        /\b(?:probation|parole|supervised[-\s]?release)\s*(?:status|officer|number)[:\s]*\S+/i,
        // Sex offender registry
        /\b(?:sex[-\s]?offender|SORA|RSO|registered[-\s]?offender)\b/i,
    ],
    // -------------------------------------------------------------------------
    // hmda-demographic: HMDA Reg C -- mortgage demographic fields
    // -------------------------------------------------------------------------
    'hmda-demographic': [
        // Explicit demographic field labels
        /(?:race|ethnicity|sex|gender|national[-\s]?origin)["\s]*[:=]["\s]*\S+/i,
        // Age (HMDA)
        /(?:^|\W)age["\s]*[:=]["\s]*\d+/i,
    ],
};
// ---------------------------------------------------------------------------
// Detection helper
// ---------------------------------------------------------------------------
/**
 * Detect which identifier classes are present in a stringified payload.
 * Returns the set of matching classes.
 */
function detectIdentifierClasses(payload) {
    const text = typeof payload === 'string' ? payload : JSON.stringify(payload);
    const found = new Set();
    for (const [cls, patterns] of Object.entries(exports.IDENTIFIER_PATTERNS)) {
        for (const pattern of patterns) {
            if (pattern.test(text)) {
                found.add(cls);
                break; // first match per class is sufficient
            }
        }
    }
    return found;
}
//# sourceMappingURL=pii-patterns.js.map