"use strict";
/**
 * FOIA Compliance Pack
 *
 * Freedom of Information Act (5 USC 552) as amended. Federal agencies
 * using AI to process, generate, or respond to FOIA requests must
 * comply with:
 *   - Disclosure obligations (5 USC 552(a)(3)): reasonably described
 *     records must be produced within 20 business days.
 *   - Nine statutory exemptions (5 USC 552(b)): AI systems must not
 *     release exempt material (national security, deliberative process,
 *     personal privacy, law enforcement, trade secrets, etc.).
 *   - Proactive disclosure (5 USC 552(a)(2)): frequently requested
 *     records published to agency website.
 *   - Fee schedule and fee waivers (5 USC 552(a)(4)(A)): AI-driven
 *     search cost must be accurately calculated; fee waiver analysis.
 *   - Vaughn index: when withholding, agencies must provide specific
 *     justification per withheld record.
 *
 * AI-specific obligations (DOJ OIP 2023 Guidance + NIST AI RMF):
 *   - AI systems that make withholding decisions must be explainable.
 *   - AI-generated records are themselves subject to FOIA unless exempt.
 *   - Automated redaction tools must be validated against exemptions.
 *   - Records Management Act (44 USC 3101) cross-obligation: AI-generated
 *     federal records must be preserved per agency records schedule.
 *
 * State FOIA equivalents (sunshine laws) follow similar patterns but
 * with different deadlines and exemption sets. This pack models the
 * federal standard; state overlays should be applied per jurisdiction.
 *
 * Sovereignty: US Federal (agencies subject to 5 USC 552). State
 * equivalents require separate jurisdiction-specific overlays.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.FOIA_PACK = exports.FOIA_CATEGORY_CLASSIFIERS = void 0;
/**
 * FOIA (Freedom of Information Act, 5 U.S.C. §552) category classifiers.
 * Governs disclosure exemptions for federal government records.
 * Classifiers surface exemption categories to prevent inadvertent disclosure.
 */
exports.FOIA_CATEGORY_CLASSIFIERS = {
    FOIA_EXEMPT_1_CLASSIFIED: {
        references: ['5 U.S.C. §552(b)(1) -- national security classified information'],
        classifier: (input) => {
            if (/\b(?:classified|top\s+secret|SECRET\/|CONFIDENTIAL\/|SCI|SAP|NOFORN)\b/.test(input))
                return true;
            if (/\b(?:national\s+security|intelligence\s+(?:source|method|activity))\b/i.test(input))
                return true;
            return false;
        },
    },
    FOIA_EXEMPT_2_INTERNAL: {
        references: ['5 U.S.C. §552(b)(2) -- internal personnel rules and practices of an agency'],
        classifier: (input) => {
            if (/\b(?:internal\s+personnel\s+rules?|agency\s+manual|staff\s+procedures?|internal\s+operating\s+procedures?)\b/i.test(input))
                return true;
            if (/\b(?:internal\s+practices?\s+of\s+(?:an\s+)?agency|employee\s+handbook|internal\s+policy\s+manual)\b/i.test(input))
                return true;
            return false;
        },
    },
    FOIA_EXEMPT_3_STATUTE: {
        references: ['5 U.S.C. §552(b)(3) -- specifically exempted from disclosure by statute (e.g., 26 U.S.C. §6103, 50 U.S.C. §3024(i))'],
        classifier: (input) => {
            // Statute-citation patterns that commonly appear in (b)(3) withholding justifications
            if (/\b(?:specifically\s+exempted\s+by\s+statute|statutory\s+(?:protection|exemption|prohibition\s+on\s+disclosure))\b/i.test(input))
                return true;
            if (/\b(?:withheld\s+pursuant\s+to\s+(?:[0-9]+\s+U\.S\.C\.|statute)|statutory\s+bar\s+on\s+disclosure)\b/i.test(input))
                return true;
            if (/\b(?:IRC\s+§?6103|26\s+U\.S\.C\.?\s+§?6103|grand\s+jury\s+material\s+Rule\s+6\(e\)|intelligence\s+sources\s+and\s+methods\s+statute)\b/i.test(input))
                return true;
            return false;
        },
    },
    FOIA_EXEMPT_4_TRADE_SECRET: {
        references: ['5 U.S.C. §552(b)(4) -- trade secrets and commercial or financial information obtained from a person and privileged or confidential'],
        classifier: (input) => {
            if (/\b(?:trade\s+secret|commercial\s+confidential|proprietary\s+business\s+information|competitively\s+sensitive)\b/i.test(input))
                return true;
            if (/\b(?:confidential\s+commercial\s+information|confidential\s+financial\s+information|commercial\s+trade\s+secret)\b/i.test(input))
                return true;
            if (/\b(?:reverse\s+engineering\s+risk|competitive\s+harm|competitive\s+advantage\s+disclosure)\b/i.test(input))
                return true;
            return false;
        },
    },
    FOIA_EXEMPT_5_DELIBERATIVE: {
        references: ['5 U.S.C. §552(b)(5) -- deliberative process privilege; inter-agency communications'],
        classifier: (input) => {
            if (/\b(?:deliberative\s+process|pre.?decisional|draft\s+(?:policy|rule|regulation)|internal\s+deliberation)\b/i.test(input))
                return true;
            if (/\b(?:attorney.?client\s+privilege|work\s+product)\b/i.test(input))
                return true;
            return false;
        },
    },
    FOIA_EXEMPT_5_WORK_PRODUCT: {
        references: ['5 U.S.C. §552(b)(5) -- attorney work product doctrine (distinct from deliberative process); see NLRB v. Sears, Roebuck & Co., 421 U.S. 132 (1975)'],
        classifier: (input) => {
            if (/\b(?:attorney\s+work\s+product|work.product\s+doctrine|mental\s+impressions?)\b/i.test(input))
                return true;
            if (/\b(?:litigation\s+strategy|prepared\s+in\s+anticipation\s+of\s+litigation|trial\s+preparation\s+materials?)\b/i.test(input))
                return true;
            if (/\b(?:counsel(?:'s)?\s+notes?|litigation\s+hold\s+memo|attorney\s+notes?\s+(?:on|re)\s+(?:case|matter|litigation))\b/i.test(input))
                return true;
            return false;
        },
    },
    FOIA_EXEMPT_6_PERSONAL_PRIVACY: {
        references: ['5 U.S.C. §552(b)(6) -- personal privacy; personnel/medical/similar files'],
        classifier: (input) => {
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b(?:personnel\s+(?:file|record)|medical\s+(?:record|file)|home\s+address)\b/i.test(input))
                return true;
            return false;
        },
    },
    FOIA_EXEMPT_7_LAW_ENFORCEMENT: {
        references: ['5 U.S.C. §552(b)(7) -- law enforcement records; ongoing investigation protection'],
        classifier: (input) => {
            if (/\b(?:law\s+enforcement\s+(?:record|file)|ongoing\s+investigation|confidential\s+informant|CI\s+identity)\b/i.test(input))
                return true;
            if (/\b(?:grand\s+jury|undercover\s+(?:operation|officer)|surveillance\s+technique)\b/i.test(input))
                return true;
            return false;
        },
    },
    FOIA_EXEMPT_8_FINANCIAL_INSTITUTION: {
        references: ['5 U.S.C. §552(b)(8) -- contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions'],
        classifier: (input) => {
            if (/\b(?:bank\s+examination\s+report|OCC\s+examination|FDIC\s+examination|Federal\s+Reserve\s+examination)\b/i.test(input))
                return true;
            if (/\b(?:supervisory\s+letter|examination\s+findings?|CAMELS\s+rating|bank\s+safety\s+and\s+soundness\s+exam)\b/i.test(input))
                return true;
            if (/\b(?:NCUA\s+examination|state\s+banking\s+examination|bank\s+examination\s+material)\b/i.test(input))
                return true;
            return false;
        },
    },
    FOIA_EXEMPT_9_GEO_GEOLOGICAL: {
        references: ['5 U.S.C. §552(b)(9) -- geological and geophysical information and data, including maps, concerning wells'],
        classifier: (input) => {
            if (/\b(?:geological\s+data|geophysical\s+data|well\s+log|borehole\s+data)\b/i.test(input))
                return true;
            if (/\b(?:oil\s+and\s+gas\s+exploration|subsurface\s+geological|seismic\s+survey\s+data|geophysical\s+survey)\b/i.test(input))
                return true;
            if (/\b(?:well\s+completion\s+data|reservoir\s+(?:map|data)|drilling\s+log)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['5 U.S.C. §552(b)(6) -- personal privacy; see also Privacy Act 5 U.S.C. §552a'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            return false;
        },
    },
};
exports.FOIA_PACK = {
    categoryClassifiers: exports.FOIA_CATEGORY_CLASSIFIERS,
    id: 'foia',
    name: 'FOIA (5 USC 552)',
    version: '1.0.0',
    contentHash: 'be6e1da813feb862cf108576451a9ff769dd9792844957996572a5eab783773c',
    description: 'Freedom of Information Act (5 USC 552) compliance for federal agency AI systems that process, generate, or respond to FOIA requests. Covers 20-business-day response clock, nine exemption classifications, proactive disclosure obligations, Vaughn index requirements, AI-generated record disclosure, and DOJ OIP 2023 AI guidance on explainable withholding decisions.',
    authority: 'US Department of Justice Office of Information Policy (DOJ OIP); agency heads under 5 USC 552',
    industries: ['government', 'federal-agency', 'legal', 'legal-tech', 'govtech'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: '20-business-day response clock enforcement; exemption enforcement; fee schedule calculation',
            reference: '5 USC 552(a)(3) (response deadline); 5 USC 552(a)(4)(A) (fees)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail of all FOIA request processing, exemption decisions, and AI involvement for Vaughn index support',
            reference: '5 USC 552(a)(4)(B) (court review); Vaughn v. Rosen, 484 F.2d 820 (D.C. Cir. 1973)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify documents against nine FOIA exemptions; detect PII (Exemption 6 and 7(C)); detect national-security markings (Exemption 1)',
            reference: '5 USC 552(b)(1)-(9) (nine exemptions)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-request processing state; 20-day clock tracking; fee waiver status; requester category tracking',
            reference: '5 USC 552(a)(3) (tracking reference number); 5 USC 552(a)(4)(A)(iii) (fee waivers)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human review gate for AI exemption decisions; Vaughn index drafting approval; fee waiver determination review',
            reference: '5 USC 552(a)(4)(B) (agency must justify withholding); DOJ OIP 2023 AI Guidance',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Disclosure that AI was used in request processing; proactive disclosure to agency FOIA reading room',
            reference: '5 USC 552(a)(2) (proactive disclosure); DOJ OIP 2023 AI Guidance (explainability)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Annual FOIA report attestation; AI validation documentation for withholding decisions; records management schedule',
            reference: '5 USC 552(e) (annual report to Congress/DOJ); 44 USC 3101 (records management)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Response deadline event tracking; escalation on approaching deadline; proactive publication triggers',
            reference: '5 USC 552(a)(3)(A) (20-business-day deadline); 5 USC 552(a)(6)(B) (unusual circumstances extension)',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Unique agent identification for processing actions; access control to classified and sensitive records',
            reference: '5 USC 552(b)(1) (Exemption 1 -- national security classification access controls)',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'FOIA_EXEMPT_1_CLASSIFIED',
                'FOIA_EXEMPT_2_INTERNAL',
                'FOIA_EXEMPT_3_STATUTE',
                'FOIA_EXEMPT_4_TRADE_SECRET',
                'FOIA_EXEMPT_5_DELIBERATIVE',
                'FOIA_EXEMPT_5_WORK_PRODUCT',
                'FOIA_EXEMPT_6_PERSONAL_PRIVACY',
                'FOIA_EXEMPT_7_LAW_ENFORCEMENT',
                'FOIA_EXEMPT_8_FINANCIAL_INSTITUTION',
                'FOIA_EXEMPT_9_GEO_GEOLOGICAL',
                'PII',
            ],
            exemptAction: 'BLOCK_UNLESS_VAUGHN_REVIEW',
            personalPrivacyAction: 'REDACT',
        },
        'governance-runtime': {
            foiaResponseDeadlineBusinessDays: 20,
            feeScheduleCalculationRequired: true,
            feeWaiverAnalysisRequired: true,
        },
        'session-persistence': {
            perRequestClockTrackingRequired: true,
            feeWaiverStatusRequired: true,
            requesterCategoryTrackingRequired: true,
        },
        'approval-queue': {
            exemptionDecisionHumanReviewRequired: true,
            vaughnIndexDraftingApprovalRequired: true,
            feeWaiverDeterminationReviewRequired: true,
        },
        'transparency-injector': {
            aiInvolvementDisclosureRequired: true,
            proactiveDisclosureRequired: true,
        },
        'attestation-manager': {
            annualFoiaReportRequired: true,
            aiWithholdingValidationRequired: true,
        },
        'event-bus': {
            responseDeadlineAlertActive: true,
            unusualCircumstancesExtensionTrackingRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['DATA-RESIDENCY-US', 'FEDRAMP-AUTHORISED'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'FOIA_EXEMPT_1_CLASSIFIED',
            'FOIA_EXEMPT_2_INTERNAL',
            'FOIA_EXEMPT_3_STATUTE',
            'FOIA_EXEMPT_4_TRADE_SECRET',
            'FOIA_EXEMPT_5_DELIBERATIVE',
            'FOIA_EXEMPT_5_WORK_PRODUCT',
            'FOIA_EXEMPT_6_PERSONAL_PRIVACY',
            'FOIA_EXEMPT_7_LAW_ENFORCEMENT',
            'FOIA_EXEMPT_8_FINANCIAL_INSTITUTION',
            'FOIA_EXEMPT_9_GEO_GEOLOGICAL',
            'PII',
        ],
        categoryActions: {
            FOIA_EXEMPT_1_CLASSIFIED: 'BLOCK',
            FOIA_EXEMPT_2_INTERNAL: 'BLOCK',
            FOIA_EXEMPT_3_STATUTE: 'BLOCK',
            FOIA_EXEMPT_4_TRADE_SECRET: 'BLOCK',
            FOIA_EXEMPT_5_DELIBERATIVE: 'BLOCK',
            FOIA_EXEMPT_5_WORK_PRODUCT: 'BLOCK',
            FOIA_EXEMPT_6_PERSONAL_PRIVACY: 'BLOCK',
            FOIA_EXEMPT_7_LAW_ENFORCEMENT: 'BLOCK',
            FOIA_EXEMPT_8_FINANCIAL_INSTITUTION: 'BLOCK',
            FOIA_EXEMPT_9_GEO_GEOLOGICAL: 'BLOCK',
            PII: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONTROLLED_UNCLASSIFIED',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // NARA General Records Schedule GRS 4.2 (item 020): FOIA case files retain 6 years.
        //
        // OPERATOR_VERIFICATION_REQUIRED (F-NEW-VERA-PACK-C5-03, 2026-05-03):
        // The default value of 2190 days (6 years) is based on NARA GRS 4.2 item 020
        // as the schedule applicable to FOIA case files at time of pack authoring.
        // NARA revises General Records Schedules periodically. Operators MUST verify
        // the current GRS schedule number and item number with their agency Records
        // Officer or NARA liaison before deployment. If GRS 4.2 item 020 has been
        // superseded, the applicable replacement schedule governs and this value
        // should be overridden in your organisation-specific configuration.
        auditLogRetentionDays: 2190,
        sessionRetentionDays: 2190,
        incidentRetentionDays: 2190,
        reference: 'NARA GRS 4.2 item 020 (FOIA case files, 6 years -- verify current schedule with agency Records Officer); 44 USC 3101',
    },
    incidentPolicy: {
        // No fixed FOIA breach notification statute. DOJ OIP guidance: notify senior agency official promptly.
        notificationDeadlineHours: 24,
        reference: 'DOJ OIP Guidance (prompt notification of inadvertent release of exempt material); agency incident response policy',
        requiredRecipients: ['senior-agency-official', 'agency-foia-officer', 'doj-oip'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'foia-response-clock',
            description: '20-business-day response clock active and tracked per request',
            reference: '5 USC 552(a)(3)(A)',
            check: 'foia_response_clock_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'foia-exemption-screen',
            description: 'Nine-exemption classification screen active before any document release',
            reference: '5 USC 552(b)(1)-(9)',
            check: 'foia_exemption_screen_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'foia-vaughn-review',
            description: 'Human review gate active for AI exemption decisions (Vaughn index support)',
            reference: 'Vaughn v. Rosen, 484 F.2d 820 (D.C. Cir. 1973); DOJ OIP AI Guidance',
            check: 'foia_vaughn_review_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'foia-pii-redaction',
            description: 'PII redaction active for Exemption 6 and 7(C) protection',
            reference: '5 USC 552(b)(6) (personal privacy); 5 USC 552(b)(7)(C)',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'foia-audit-trail',
            description: 'Tamper-evident audit trail of all FOIA processing decisions',
            reference: '5 USC 552(a)(4)(B); Vaughn v. Rosen',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'foia-proactive-disclosure',
            description: 'Proactive disclosure workflow active for frequently requested records',
            reference: '5 USC 552(a)(2)',
            check: 'foia_proactive_disclosure_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'foia-ai-disclosure',
            description: 'Disclosure of AI involvement in FOIA processing when required',
            reference: 'DOJ OIP 2023 AI Guidance; OSTP AI Transparency Principles',
            check: 'transparency_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'foia-annual-report',
            description: 'Annual FOIA report generation and attestation active',
            reference: '5 USC 552(e)',
            check: 'foia_annual_report_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=foia.js.map