/**
 * CJIS Security Policy Compliance Pack
 *
 * Criminal Justice Information Services Security Policy (CJISD-ITS-DOC-08140).
 * Current version: CJIS Security Policy v5.9.5 (effective October 2024).
 * Authority: FBI CJIS Division.
 *
 * The CJIS Security Policy applies to all entities -- federal, state,
 * local, and tribal agencies and their contractors -- that access or
 * handle Criminal Justice Information (CJI). CJI includes:
 *   - National Crime Information Center (NCIC) data
 *   - Interstate Identification Index (III) fingerprint/criminal history
 *   - National Instant Criminal Background Check System (NICS)
 *   - National Sex Offender Registry (NSOR)
 *   - Biometric data (fingerprint, facial recognition, DNA)
 *   - In-car video and body-worn camera footage flagged as CJI
 *
 * AI systems in criminal justice face additional scrutiny:
 *   - Predictive policing AI, recidivism risk scores, facial recognition,
 *     and gunshot detection are all increasingly regulated at state level
 *     (IL, NY, CA, others) but CJIS sets the federal security floor.
 *   - Any AI model that ingests CJI for training or inference is in scope.
 *   - FBI CJIS v5.9.5 (2024) added explicit AI/ML guidance: AI systems
 *     accessing CJI must maintain full audit logs, apply least-privilege,
 *     and undergo independent security assessment.
 *
 * Key CJIS Security Policy requirements:
 *   - Section 5.1: Information Exchange Agreements (IEA) required.
 *   - Section 5.2: Security awareness training (every 2 years for all
 *     persons with access to CJI).
 *   - Section 5.3: Incident Response -- report CJI breach to FBI CJIS
 *     within 1 hour of discovery; 72-hour formal report.
 *   - Section 5.4: Auditing and Accountability -- log all access; 1-year
 *     online retention; 2.5-year total.
 *   - Section 5.5: Access control -- least privilege; need-to-know.
 *   - Section 5.6: Identification and Authentication -- Advanced
 *     Authentication (AA) policy: MFA for non-physically secure
 *     locations or remote access.
 *   - Section 5.7: Configuration Management.
 *   - Section 5.10: Physical Protection.
 *   - Section 5.11: System and Communications Protection -- FIPS 140-2
 *     encryption of CJI in transit and at rest.
 *   - Section 5.13: Mobile Device Management (when AI runs on mobile).
 *
 * Sovereignty: US Federal / State / Local (universal for CJI access).
 *
 * @connexum/ai-governance
 */
import { sharedPiiClassifier } from './_base-classifiers.js';
/**
 * CJIS (FBI Criminal Justice Information Services Security Policy) category classifiers.
 * Governs Criminal Justice Information (CJI) including NCIC data, biometric CJI,
 * and criminal history records for law enforcement agencies.
 */
export const CJIS_CATEGORY_CLASSIFIERS = {
    CJI: {
        references: ['CJIS Security Policy v5.9 §1.2 -- CJI definition; all criminal justice information'],
        classifier: (input) => {
            if (/\b(?:CJI|criminal\s+justice\s+information|NCIC|III\s+record|NGI)\b/.test(input))
                return true;
            if (/\b(?:rap\s+sheet|criminal\s+history|wanted\s+person|stolen\s+vehicle\s+record)\b/i.test(input))
                return true;
            return false;
        },
    },
    BIOMETRIC_CJI: {
        references: ['CJIS Security Policy §5.10.7 -- biometric data in criminal justice context'],
        classifier: (input) => {
            if (/\b(?:fingerprint\s+(?:card|record|match)|tenprint|latent\s+print|mugshot|face\s+recognition\s+(?:result|hit))\b/i.test(input))
                return true;
            if (/\b(?:biometric\s+CJI|NGI\s+(?:record|result)|iris\s+(?:scan|record))\b/i.test(input))
                return true;
            return false;
        },
    },
    NCIC_DATA: {
        references: ['CJIS Security Policy §3.2 -- NCIC file contents; interstate identification index'],
        classifier: (input) => {
            if (/\b(?:NCIC\s+(?:entry|record|hit|number)|wanted\s+persons\s+file|missing\s+persons\s+file)\b/i.test(input))
                return true;
            return false;
        },
    },
    CRIMINAL_HISTORY: {
        references: ['CJIS Security Policy §4.5 -- criminal history record information (CHRI)'],
        classifier: (input) => {
            if (/\b(?:criminal\s+history\s+(?:record|information)|CHRI|arrest\s+record|conviction\s+record|disposition\s+record)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['CJIS Security Policy §5.6 -- personally identifiable information of subjects'],
        classifier: (input) => {
            if (sharedPiiClassifier(input))
                return true;
            if (/\b(?:date\s+of\s+birth|DOB)[:\s]*\d{1,2}[\/\-]\d{1,2}[\/\-]\d{2,4}\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['CJIS Security Policy §5.5 -- access control; authentication for CJI systems'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const CJIS_PACK = {
    categoryClassifiers: CJIS_CATEGORY_CLASSIFIERS,
    /** P3.5: CJI, biometric CJI, and criminal history are inherently subject-keyed per CJIS Security Policy 5.9. */
    subjectKeyedCategories: ['CJI', 'BIOMETRIC_CJI', 'CRIMINAL_HISTORY'],
    id: 'cjis',
    name: 'CJIS Security Policy v5.9.5',
    version: '1.0.0',
    contentHash: '569e6de896224ffb384289078458771a170b60d8dd63677f6a0dbb4b207c2f7e',
    description: 'FBI Criminal Justice Information Services Security Policy (CJISD-ITS-DOC-08140, v5.9.5 Oct 2024) for AI systems handling Criminal Justice Information (CJI). Covers Information Exchange Agreements, security awareness training (every 2 years), 1-hour incident reporting to FBI CJIS, audit logging (1-year online / 2.5-year total), least-privilege access, Advanced Authentication (MFA) policy, FIPS 140-2 encryption, and 2024 AI/ML guidance on CJI-accessing AI systems.',
    authority: 'FBI CJIS Division',
    industries: ['government', 'law-enforcement', 'criminal-justice', 'public-safety', 'courts', 'corrections'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Least-privilege and need-to-know access enforcement; deny-by-default; CJI access policy',
            reference: 'CJIS SP Section 5.5 (Access Control); v5.9.5 AI guidance',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit log of all CJI access; 1-year online retention; 2.5-year total retention',
            reference: 'CJIS SP Section 5.4 (Auditing and Accountability)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'FIPS 140-2 validated encryption of CJI at rest and in transit; TLS 1.2+ for network transport',
            reference: 'CJIS SP Section 5.11 (System and Communications Protection); FIPS 140-2',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Identify and classify CJI categories; biometric data detection; prevent CJI leakage to unauthorised systems',
            reference: 'CJIS SP Section 1 (CJI definitions); Section 5.11',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Advanced Authentication (AA) -- MFA for non-physically secure / remote CJI access; unique agent identification',
            reference: 'CJIS SP Section 5.6 (Identification and Authentication); AA policy',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Information Exchange Agreements (IEA) with all entities; vendor CJIS audit rights; no-redisclosure',
            reference: 'CJIS SP Section 5.1 (Information Exchange Agreements)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: '1-hour breach notification to FBI CJIS; incident detection and reporting stream; access event monitoring',
            reference: 'CJIS SP Section 5.3 (Incident Response); 1-hour reporting requirement',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Security awareness training (every 2 years); CJIS audit (every 3 years); IEA documentation',
            reference: 'CJIS SP Section 5.2 (Security Awareness Training); Section 5.1.1 (IEA)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human review for AI decisions affecting CJI subjects; configuration change approval (CM gate)',
            reference: 'CJIS SP Section 5.7 (Configuration Management); v5.9.5 AI guidance',
        },
        {
            name: 'circuit-breaker',
            required: true,
            reason: 'Incident isolation; disable CJI access on breach detection; system integrity protection',
            reference: 'CJIS SP Section 5.3 (Incident Response); Section 5.10 (Physical Protection)',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'CJI',
                'BIOMETRIC_CJI',
                'NCIC_DATA',
                'CRIMINAL_HISTORY',
                'PII',
                'CREDENTIALS',
            ],
            cjiAction: 'BLOCK_UNLESS_AUTHORISED_NEED_TO_KNOW',
            biometricCjiAction: 'BLOCK',
        },
        'encryption-layer': {
            fips140ValidatedRequired: true,
            minimumTlsVersion: '1.2',
        },
        'agent-auth': {
            advancedAuthenticationRequired: true,
            mfaForRemoteOrNonPhysicallySecureAccess: true,
            uniqueAgentIdentificationRequired: true,
        },
        'governance-runtime': {
            needToKnowEnforced: true,
            leastPrivilegeEnforced: true,
            cjiAccessPolicyRequired: true,
        },
        'supply-chain': {
            informationExchangeAgreementRequired: true,
            vendorCjisAuditRightsRequired: true,
            noRedisclosureRequired: true,
        },
        'event-bus': {
            cjisBreachOneHourNotificationRequired: true,
            accessEventMonitoringRequired: true,
        },
        'attestation-manager': {
            securityAwarenessTrainingCadenceDays: 730,
            cjisAuditCadenceDays: 1095,
            ieaDocumentationRequired: true,
        },
        'approval-queue': {
            aiCjiDecisionHumanReviewRequired: true,
            configurationChangeApprovalRequired: true,
        },
        'circuit-breaker': {
            cjiAccessDisableOnBreachRequired: true,
        },
        'audit-integrity': {
            cjiAuditOnlineRetentionDays: 365,
            cjiAuditTotalRetentionDays: 912,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['FIPS-140-VALIDATED', 'DATA-RESIDENCY-US', 'CJIS-COMPLIANT'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['CJI', 'BIOMETRIC_CJI', 'NCIC_DATA', 'CRIMINAL_HISTORY', 'PII', 'CREDENTIALS'],
        categoryActions: {
            // Input-side: BLOCK -> DENY verdict before tool executes.
            // Output-side stripping is handled by the pii_shield block below.
            CJI: 'BLOCK', // CJIS SP 5.4: CJI blocked at input boundary
            BIOMETRIC_CJI: 'BLOCK', // CJIS SP 7.11: biometric data in CJI context
            NCIC_DATA: 'BLOCK', // NCIC data absolute restriction -- no AI intermediary
            CRIMINAL_HISTORY: 'BLOCK', // Criminal history record information
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-FIPS',
        minimumClassification: 'RESTRICTED',
        /**
         * PR-2: PII Shield -- CJIS.
         *
         * STRICT mode: criminal justice information (CJI) is stripped and
         * pseudonymised. NCIC data is hard-blocked -- no AI agent is permitted
         * to directly process raw NCIC query results. Criminal history
         * record information (CHRI) is stripped for audit logging.
         *
         * References:
         *   CJIS Security Policy (CJISP) Section 5.4 -- access, use, and dissemination
         *   CJIS Security Policy Section 5.10 -- incident response
         *   28 CFR Part 20 -- criminal justice information systems
         */
        pii_shield: {
            pii_shield_mode: 'STRICT',
            strip_classes: ['criminal-justice', 'biometric'],
            uuid_scope: 'per_session',
            date_handling: 'relative_offset',
            age_aggregation_threshold: 89,
            ner_pre_scan: true,
            pre_send_phi_scan: true,
            auto_remediate_on_register: true,
            provider_memory_disabled_required: true,
        },
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // CJIS SP Section 5.4: 1-year online (actively accessible); 2.5 years total.
        auditLogRetentionDays: 912,
        sessionRetentionDays: 912,
        incidentRetentionDays: 912,
        reference: 'CJIS SP Section 5.4 (1-year online; 2.5-year total retention for audit logs)',
    },
    incidentPolicy: {
        // CJIS SP Section 5.3: notify FBI CJIS within 1 hour of discovery.
        notificationDeadlineHours: 1,
        reference: 'CJIS SP Section 5.3 (Incident Response): report to FBI CJIS within 1 hour; 72-hour formal report',
        requiredRecipients: ['fbi-cjis-division', 'state-cjis-systems-officer', 'agency-security-officer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'cjis-fips-encryption',
            description: 'FIPS 140-2 validated encryption active for all CJI at rest and in transit',
            reference: 'CJIS SP Section 5.11 (System and Communications Protection)',
            check: 'encryption_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cjis-advanced-auth',
            description: 'Advanced Authentication (MFA) active for remote and non-physically secure CJI access',
            reference: 'CJIS SP Section 5.6 (Identification and Authentication); AA policy',
            check: 'cjis_advanced_auth_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cjis-need-to-know',
            description: 'Need-to-know and least-privilege access control enforced for all CJI access',
            reference: 'CJIS SP Section 5.5',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cjis-audit-trail',
            description: 'All CJI access logged in tamper-evident audit trail; 2.5-year retention',
            reference: 'CJIS SP Section 5.4',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cjis-1-hour-incident',
            description: '1-hour incident notification to FBI CJIS Division configured',
            reference: 'CJIS SP Section 5.3',
            check: 'cjis_incident_1hr_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cjis-iea',
            description: 'Information Exchange Agreements on file for all entities handling CJI',
            reference: 'CJIS SP Section 5.1',
            check: 'cjis_iea_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cjis-security-training',
            description: 'Security awareness training every 2 years for all persons with CJI access',
            reference: 'CJIS SP Section 5.2',
            check: 'cjis_security_training_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cjis-data-classifier',
            description: 'CJI categories classified and blocked from unauthorized AI processing',
            reference: 'CJIS SP Section 1 (CJI definitions)',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cjis-human-review',
            description: 'Human review required for AI-driven decisions affecting CJI subjects',
            reference: 'CJIS SP v5.9.5 AI guidance',
            check: 'human_oversight',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=cjis.js.map