"use strict";
/**
 * US RESPA Compliance Pack
 *
 * Renamed from `src/packs/respa.ts` to `src/packs/us-respa.ts` per X3 cycle
 * 2026-04-24 naming consistency directive. Pack ID updated from 'respa' to
 * 'us-respa'. Export updated from RESPA_PACK to US_RESPA_PACK. No behavioral
 * change; rename only for consistency with us-trid, us-tila, us-nih-*, etc.
 *
 * Cross-pack interactions:
 *   - us-respa x us-trid: TRID's Loan Estimate replaced RESPA's old HUD-1;
 *     both packs may apply at closing. Strictest-wins on retention: RESPA
 *     §1024.10 5-year governs over TRID §1026.25 3-year.
 *   - us-respa x us-tila: For mortgage servicing, both apply. RESPA Section 6
 *     QWR and TILA right-of-rescission for modifications run in parallel.
 *     Strictest-wins on retention: RESPA 5-year governs.
 *
 * Real Estate Settlement Procedures Act
 * Authority: HUD + CFPB (12 USC §2601 et seq.; Regulation X, 12 CFR Part 1024)
 *
 * Key statutes enforced by this pack:
 *   - §8 (12 USC §2607): Anti-kickback, prohibition on fee-splitting, referral
 *     fees, and unearned fees in connection with federally related mortgage loans.
 *   - §10 (12 USC §2609): Escrow account limits and disclosures. Aggregate
 *     accounting method; cushion limited to 1/6 of annual escrow charges.
 *   - §6 (12 USC §2605): Qualified Written Request (QWR) acknowledgment within
 *     5 business days; substantive response within 30 business days (extendable
 *     to 45 with notice); 12 CFR §1024.36.
 *   - §4 / §5 (12 USC §2603, 2604): Good Faith Estimate (pre-TRID loans) and
 *     Special Information Booklet requirements.
 *
 * LLM-EGRESS PRIMACY RULES (Thomas directive 2026-04-22):
 *   - BLOCK: settlement-service provider names and referral-steering signals in
 *     LLM prompts. An agent cannot include "prefer Title Co X" or similar
 *     language that constitutes a referral under §8 when sending to an LLM.
 *   - BLOCK: escrow-account balances to any LLM not bound by a
 *     RESPA-compliant Business Associate Agreement (BAA) equivalent.
 *   - ALLOW WITH AUDIT: general loan-process education questions to LLMs
 *     (e.g., what is an escrow account, what is a closing disclosure).
 *   - REQUIRE NAMED HUMAN: any agent-generated Loan Estimate or Closing
 *     Disclosure content. The LLM may draft; a licensed human must sign off.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.US_RESPA_PACK = exports.US_RESPA_CATEGORY_CLASSIFIERS = void 0;
/**
 * RESPA (Real Estate Settlement Procedures Act, 12 U.S.C. §2601) category classifiers.
 * Governs mortgage settlement service fee disclosures, referrals, and escrow accounts.
 */
exports.US_RESPA_CATEGORY_CLASSIFIERS = {
    RESPA_SETTLEMENT_PROVIDER: {
        references: ['RESPA §8 -- prohibition on kickbacks and referral fees; settlement service provider'],
        classifier: (input) => {
            if (/\b(?:title\s+(?:company|agency|insurance)|settlement\s+(?:agent|service|fee)|closing\s+(?:agent|cost|fee))\b/i.test(input))
                return true;
            if (/\b(?:referral\s+fee|kickback|unearned\s+fee|affiliated\s+business\s+arrangement|AfBA)\b/i.test(input))
                return true;
            return false;
        },
    },
    ESCROW_BALANCE: {
        references: ['RESPA §10 -- limits on escrow account requirements; escrow balance data'],
        classifier: (input) => {
            if (/\b(?:escrow\s+(?:account|balance|payment|shortage|surplus|analysis))\b/i.test(input))
                return true;
            if (/\b(?:impound\s+account|reserve\s+account\s+balance)\b/i.test(input))
                return true;
            return false;
        },
    },
    REFERRAL_SIGNAL: {
        references: ['RESPA §8(a) -- prohibition on referral fee arrangements'],
        classifier: (input) => {
            if (/\b(?:referral|refer\s+client|customer\s+referral|referral\s+arrangement|refer\s+to\s+(?:title|attorney|lender))\b/i.test(input))
                return true;
            return false;
        },
    },
    MORTGAGE_APPLICATION_RECORD: {
        references: ['RESPA §4-5 -- GFE/CD disclosures; mortgage application record'],
        classifier: (input) => {
            if (/\b(?:mortgage\s+(?:application|loan|record)|GFE|Good\s+Faith\s+Estimate|Closing\s+Disclosure|Loan\s+Estimate)\b/i.test(input))
                return true;
            if (/\b(?:URLA|1003\s+form|borrower\s+(?:application|information))\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['RESPA -- information security for mortgage systems; credential protection'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.US_RESPA_PACK = {
    categoryClassifiers: exports.US_RESPA_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: Mortgage application records and escrow balances are inherently
     * subject-keyed (each belongs to a specific borrower). Disclosures must
     * carry a data subject ID to satisfy RESPA 12 CFR §1024.10 record retention.
     */
    subjectKeyedCategories: ['MORTGAGE_APPLICATION_RECORD', 'ESCROW_BALANCE'],
    id: 'us-respa',
    /** GAP-S1-01: MT-01 is the site/packs.html public code for this pack. */
    aliases: ['MT-01'],
    name: 'RESPA (Real Estate Settlement Procedures Act)',
    version: '1.0.0',
    contentHash: '81b379a2f4071d8128e6b84eb1796254364bffb39f10cd525a941f524cffe92a',
    description: 'Real Estate Settlement Procedures Act (12 USC §2601, Regulation X 12 CFR Part 1024) LLM-egress policy. Blocks referral-steering signals and escrow balances from reaching LLMs. Requires named-human review on all Loan Estimate / Closing Disclosure content generated by AI agents. Covers §8 anti-kickback, §10 escrow accounting, §6 QWR response clocks, and §4 GFE requirements.',
    authority: 'HUD / Consumer Financial Protection Bureau (CFPB)',
    industries: ['mortgage-lender', 'mortgage-servicer', 'title-company', 'real-estate-settlement', 'bank', 'credit-union', 'fintech-lender'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Referral-steering signal detection; deny-by-default egress on RESPA_SETTLEMENT and ESCROW_BALANCE data classes',
            reference: 'RESPA §8 (12 USC §2607); 12 CFR §1024.14',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect RESPA_SETTLEMENT_PROVIDER, ESCROW_BALANCE, REFERRAL_SIGNAL, and MORTGAGE_APPLICATION_RECORD categories before LLM egress',
            reference: 'RESPA §8 (12 USC §2607); §10 (12 USC §2609)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident record of all RESPA-governed LLM egress decisions, QWR tracking, and settlement service interactions',
            reference: '12 CFR §1024.10 (5-year settlement record retention)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Named-human reviewer required on every AI-generated Loan Estimate, Closing Disclosure, or referral-adjacent communication',
            reference: 'RESPA §4 (12 USC §2603); §6 (12 USC §2605)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'QWR response clock (5 business day acknowledgment; 30 / 45 business day substantive response); kickback-violation incident events',
            reference: '12 CFR §1024.35, §1024.36',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'QWR tracking across service agent restarts; per-loan escrow accounting state',
            reference: '12 CFR §1024.17 (escrow accounting); §1024.36 (QWR response)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party settlement service provider registry; RESPA-compliant agreement attestation for every LLM provider with access to RESPA-governed data',
            reference: 'RESPA §3 (12 USC §2602); §8(c)(4) (bona fide service exception)',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detect §8 referral-pattern anomalies in LLM prompts; flag repetitive steering signals across agent sessions',
            reference: 'RESPA §8 (12 USC §2607)',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Disparate referral patterns across protected-class borrowers may constitute ECOA + RESPA intersection violations',
            reference: 'RESPA §8; ECOA 15 USC §1691',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Required disclosure when AI generates any settlement-service recommendation or closing document summary',
            reference: 'RESPA §5 (12 USC §2604); 12 CFR §1024.6 Special Information Booklet',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Settlement service provider agreement attestation; §8(c) bona-fide-service-exception documentation; 5-year record retention for Loan Estimate and Closing Disclosure audit trail',
            reference: 'RESPA §8(c)(4) (12 USC §2607(c)(4)) bona fide exception; 12 CFR §1024.10 (5-year retention); CFPB TRID record-keeping',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            respaReferralSteeringBlockRequired: true,
            escrowBalanceLlmEgressBlockRequired: true,
            settlementProviderNamesBlockInCreditDecisionContext: true,
            qwrResponseClockRequired: true,
            loEstimateHumanReviewRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'RESPA_SETTLEMENT_PROVIDER',
                'ESCROW_BALANCE',
                'REFERRAL_SIGNAL',
                'MORTGAGE_APPLICATION_RECORD',
                'CREDENTIALS',
            ],
            referralSignalAction: 'BLOCK',
            escrowBalanceAction: 'BLOCK_UNLESS_BAA',
            settlementProviderAction: 'BLOCK_UNLESS_AUDIT_LOGGED',
        },
        'approval-queue': {
            loanEstimateRequiresHumanReview: true,
            closingDisclosureRequiresHumanReview: true,
            settlementServiceReferralRequiresHumanReview: true,
        },
        'event-bus': {
            qwrAcknowledgmentBusinessDays: 5,
            qwrSubstantiveResponseBusinessDays: 30,
            qwrExtendedResponseBusinessDays: 45,
            kickbackViolationAlertActive: true,
        },
        'session-persistence': {
            qwrStatePerLoanRequired: true,
            escrowAccountingStateRequired: true,
        },
        'supply-chain': {
            settlementServiceProviderRegistryRequired: true,
            respaBaaEquivalentRequired: true,
        },
        'anomaly-detector': {
            referralPatternDetectionActive: true,
            steeringSignalFrequencyMonitoringActive: true,
        },
        'attestation-manager': {
            respaBaaEquivalentDocumentationRequired: true,
            escrowAccountAggregateAccountingAttestationRequired: true,
        },
        'transparency-injector': {
            aiSettlementRecommendationDisclosureRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['RESPA-COMPLIANT-EGRESS', 'AUDIT-LOGGING'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'RESPA_SETTLEMENT_PROVIDER',
            'ESCROW_BALANCE',
            'REFERRAL_SIGNAL',
            'MORTGAGE_APPLICATION_RECORD',
            'CREDENTIALS',
        ],
        categoryActions: {
            RESPA_SETTLEMENT_PROVIDER: 'WARN',
            ESCROW_BALANCE: 'BLOCK',
            REFERRAL_SIGNAL: 'BLOCK',
            MORTGAGE_APPLICATION_RECORD: 'LOG',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        // 5 years per 12 CFR §1024.10 for RESPA settlement records.
        auditLogRetentionDays: 1825,
        sessionRetentionDays: 1825,
        incidentRetentionDays: 1825,
        reference: '12 CFR §1024.10 -- settlement records retained for 5 years; HUD policy.',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us'],
    },
    incidentPolicy: {
        // OPERATOR_VERIFICATION_REQUIRED (F-NEW-VERA-PACK-C2-01, 2026-05-03):
        // No standalone federal statutory consumer notification deadline applies to
        // RESPA §8 kickback / referral-fee violations as of pack authoring. Breach
        // notification obligations for any NPI disclosed in settlement data are
        // governed by GLBA (15 USC §6801 et seq.; 12 CFR Part 1016) and applicable
        // state breach laws, not RESPA itself. The 72-hour default is an operational
        // internal-escalation convention to the compliance officer and general counsel.
        // Operators MUST verify with counsel whether any current HUD or CFPB guidance
        // imposes a shorter external notification window before deployment.
        // Authoritative source: RESPA §8 (12 USC §2607); 12 CFR §1024.14; CFPB
        // RESPA Examination Procedures (current edition at consumerfinance.gov).
        notificationDeadlineHours: 72,
        reference: 'RESPA §8 (12 USC §2607); 12 CFR §1024.14 -- suspected kickback violations trigger immediate internal escalation; 72h default.',
        requiredRecipients: ['compliance-officer', 'general-counsel', 'cfpb-if-investigated'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'respa-referral-steering-block',
            description: 'LLM egress of referral-steering signals (settlement-service provider names in credit-context prompts) blocked',
            reference: 'RESPA §8 (12 USC §2607); 12 CFR §1024.14(b)',
            check: 'respa_referral_steering_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'respa-escrow-balance-block',
            description: 'Escrow-account balances blocked from LLMs not covered by a RESPA-compliant BAA equivalent',
            reference: 'RESPA §10 (12 USC §2609); 12 CFR §1024.17',
            check: 'respa_escrow_balance_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'respa-lo-estimate-human-review',
            description: 'Named-human review required on all AI-generated Loan Estimate and Closing Disclosure content',
            reference: 'RESPA §4 (12 USC §2603); 12 CFR §1024.7 (GFE); 12 CFR §1026.19 (TRID)',
            check: 'respa_lo_estimate_human_review_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'respa-qwr-clock',
            description: 'QWR 5-business-day acknowledgment and 30-business-day substantive response clock tracked',
            reference: 'RESPA §6 (12 USC §2605); 12 CFR §1024.35, §1024.36',
            check: 'respa_qwr_clock_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'respa-settlement-provider-registry',
            description: 'Settlement service provider registry maintained; every LLM provider with RESPA-data access attested',
            reference: 'RESPA §3 (12 USC §2602); §8(c)(4)',
            check: 'respa_settlement_provider_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'respa-referral-anomaly-detection',
            description: 'Anomaly detector active for §8 referral-pattern analysis across agent sessions',
            reference: 'RESPA §8 (12 USC §2607)',
            check: 'respa_referral_anomaly_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'respa-escrow-aggregate-accounting',
            description: 'Escrow aggregate accounting method attested; cushion does not exceed 1/6 of annual charges',
            reference: '12 CFR §1024.17(d) aggregate accounting',
            check: 'respa_escrow_aggregate_accounting_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'respa-audit-trail',
            description: 'Tamper-evident audit trail covering all RESPA-governed LLM egress decisions and settlement interactions',
            reference: '12 CFR §1024.10 (5-year retention)',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'respa-disclosure-injection',
            description: 'AI-disclosure injected when agent generates settlement-service recommendation or document summary',
            reference: 'RESPA §5 (12 USC §2604); 12 CFR §1024.6',
            check: 'respa_disclosure_injection_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'respa-bias-monitoring',
            description: 'Disparate referral pattern monitoring across protected-class borrowers',
            reference: 'RESPA §8; ECOA 15 USC §1691',
            check: 'bias_monitor_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=us-respa.js.map