"use strict";
/**
 * ISO 20022 Financial Messaging Standard Compliance Pack
 *
 * ISO/IEC 20022:2022 -- Universal financial industry message scheme
 * for electronic data interchange between financial institutions.
 *
 * Regulatory and implementation context:
 *   - ISO 20022 is an ISO standard, not a law. Mandatory migration
 *     is driven by national payment system operators:
 *       - SWIFT CBPR+ MX migration: mandatory for cross-border
 *         payments from November 2025 (coexistence ended 2025)
 *       - EU SEPA: ISO 20022 XML since 2008; full ISO 20022 suite
 *       - US Fedwire Funds Service: ISO 20022 migration deadline
 *         March 2025 (Full Adoption)
 *       - US Clearing House CHIPS: ISO 20022 migration April 2024
 *       - UK CHAPS: Bank of England ISO 20022 migration April 2023
 *       - Hong Kong CHATS: ISO 20022 migration 2023
 *       - Singapore MEPS+: ISO 20022 adoption
 *   - SWIFT MX message types replace MT message types. Coexistence
 *     period ended; MX-only operations now standard.
 *   - ISO 20022 data richness: richer structured remittance data
 *     enables better AML/sanctions screening, reduces misrouting.
 *   - Regulatory intersection:
 *       - FATF Recommendation 16 (wire transfer): ISO 20022
 *         structured data enables full originator/beneficiary capture
 *       - EU Regulation 2015/847 (Funds Transfer Regulation):
 *         requires complete payment information in messages
 *       - OFAC SDN screening: structured ISO 20022 data improves
 *         sanctions screening accuracy
 *
 * AI system relevance:
 *   - AI systems processing payment instructions must validate
 *     ISO 20022 XML schema compliance before routing
 *   - AI models performing payment analytics must handle ISO 20022
 *     structured data natively (not MT-format assumptions)
 *   - AI-assisted sanctions screening must operate on ISO 20022
 *     structured fields (not parsed free-text)
 *   - AI classification of payment purpose (prtry vs structured) must
 *     preserve structured remittance data without degradation
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.ISO20022_PACK = exports.ISO20022_CATEGORY_CLASSIFIERS = void 0;
/**
 * ISO 20022 financial messaging category classifiers.
 * Detects payment message content, financial instructions,
 * account information, and settlement data.
 */
exports.ISO20022_CATEGORY_CLASSIFIERS = {
    PAYMENT_MESSAGE: {
        references: ['ISO 20022 -- pacs.008/pacs.009 customer credit transfer; camt.054 credit notification'],
        classifier: (input) => {
            // ISO 20022 message types
            if (/\b(?:pacs\.\d{3}|camt\.\d{3}|pain\.\d{3}|acmt\.\d{3}|seev\.\d{3}|colr\.\d{3}|admi\.\d{3})\b/i.test(input))
                return true;
            // SWIFT MX references
            if (/\b(?:MX\s+message|ISO\s+20022\s+(?:message|format|XML)|AppHdr|BizMsgIdr)\b/i.test(input))
                return true;
            // IBAN / payment identifiers
            if (/\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b/.test(input))
                return true; // IBAN pattern
            return false;
        },
    },
    FINANCIAL_INSTRUCTION: {
        references: ['ISO 20022 pacs.008 -- FIToFI Customer Credit Transfer; BSA/AML wire transfer reporting'],
        classifier: (input) => {
            if (/\b(?:credit\s+transfer|payment\s+instruction|payment\s+order|wire\s+transfer|funds\s+transfer)\b/i.test(input))
                return true;
            if (/\b(?:debtor|creditor|originator|beneficiary)\s+(?:agent|bank|institution|BIC|IBAN)\b/i.test(input))
                return true;
            return false;
        },
    },
    ACCOUNT_INFORMATION: {
        references: ['ISO 20022 acmt -- account management; camt -- cash management messages'],
        classifier: (input) => {
            if (/\b(?:account\s+(?:number|ID|identifier)|BBAN|IBAN|BBAN|account\s+statement)\b/i.test(input))
                return true;
            if (/\b(?:BIC|SWIFT\s+code|bank\s+identifier|financial\s+institution\s+identification)\b/i.test(input))
                return true;
            return false;
        },
    },
    SETTLEMENT_DATA: {
        references: ['ISO 20022 sese/semt -- securities settlement; colr -- collateral management'],
        classifier: (input) => {
            if (/\b(?:settlement\s+(?:date|amount|instruction|cycle)|DVP|FOP|RVP)\b/i.test(input))
                return true;
            if (/\b(?:clearing\s+system|settlement\s+system|RTGS|ACH|Fedwire|CHAPS|TARGET2)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['ISO 20022 -- natural person as debtor/creditor; GDPR/privacy overlap for retail payments'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['ISO 20022 security context; payment system access credential protection'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.ISO20022_PACK = {
    categoryClassifiers: exports.ISO20022_CATEGORY_CLASSIFIERS,
    id: 'iso20022',
    aliases: ['FS-06'],
    name: 'ISO 20022 Financial Messaging Standard',
    version: '1.0.0',
    contentHash: '4b0b867813b6b614008f0e3cd1fb0a89c8fcd10f52a7667e7cf6431039444642',
    description: 'ISO/IEC 20022:2022 financial messaging standard compliance for AI systems in payment processing and securities settlement workflows. Covers ISO 20022 XML schema validation, MX message format compliance, SWIFT CBPR+ MX migration requirements (mandatory from 2025), structured remittance data preservation, BIC/LEI/IBAN validation, and regulatory intersection with FATF R.16 wire transfer rules and EU Funds Transfer Regulation (2015/847).',
    authority: 'ISO (International Organization for Standardization) + national payment system operators (Federal Reserve, Bank of England, ECB, SWIFT)',
    industries: ['banking', 'payments', 'fintech', 'securities', 'asset-management', 'central-banking', 'insurance', 'treasury', 'corporate-banking', 'trade-finance'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'ISO 20022 XML schema validation gate; MX message format compliance enforcement; structured remittance data preservation rules',
            reference: 'ISO 20022 schema validation requirements; SWIFT CBPR+ mandatory MX adoption 2025; Fedwire ISO 20022 Full Adoption March 2025',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Payment message classification; financial instruction detection; account information and settlement data categorisation for AML screening and sanctions overlap',
            reference: 'ISO 20022 pacs.008/pacs.009/camt -- message classification; FATF R.16 -- complete originator/beneficiary data in wire transfers',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident records of payment instructions processed by AI; audit trail for message format validation decisions and schema compliance checks',
            reference: 'National banking regulation (Federal Reserve, Bank of England): payment message retention 5-7 years; BSA recordkeeping for wire transfers',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Payment misrouting event detection; message format breach alerts; MX-MT coexistence violation alerts during migration; settlement failure notifications',
            reference: 'ISO 20022 -- payment misrouting triggers immediate sender/receiver notification; national RTGS operator rules on payment incident reporting',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detection of payment anomalies, schema violations, structured data degradation, and duplicate payment instructions in AI-processed message flows',
            reference: 'ISO 20022 message integrity; BSA/AML suspicious payment pattern detection; SWIFT payment controls framework',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party payment processing vendors must maintain ISO 20022 schema compliance; vendor AI systems must preserve structured remittance data without degradation',
            reference: 'ISO 20022 -- data richness preservation obligations; SWIFT CBPR+ participant requirements for third-party service providers',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Payment instruction state preservation across multi-leg transactions; MX-MT coexistence state management; settlement lifecycle tracking',
            reference: 'ISO 20022 end-to-end transaction tracking (EndToEndId, TxId); RTGS settlement lifecycle state',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Authentication for payment instruction processing; unique agent identity for payment audit trail; access control for financial messaging systems',
            reference: 'Payment system access controls; SWIFT PKI; Fedwire access authentication; CJIS/PCI-adjacent controls for payment environments',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'BIC validation attestation; LEI verification for legal entity identifiers in ISO 20022 messages; IBAN validation records; SWIFT CBPR+ compliance attestation',
            reference: 'ISO 20022 -- BIC (ISO 9362), LEI (ISO 17442), IBAN (ISO 13616) validation requirements; SWIFT CBPR+ mandatory compliance attestation',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Payment message content encrypted at rest; financial instruction data protected in transit; PII within payment messages (natural person debtor/creditor) requires encryption',
            reference: 'PCI DSS (payments context); SWIFT Customer Security Programme (CSP); national payment system security requirements',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            iso20022SchemaValidationRequired: true,
            mxMessageFormatRequired: true,
            structuredRemittanceDataPreservationRequired: true,
            mtToMxCoexistenceHandlingRequired: true,
            bicLeiValidationRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['PAYMENT_MESSAGE', 'FINANCIAL_INSTRUCTION', 'ACCOUNT_INFORMATION', 'SETTLEMENT_DATA', 'PII', 'CREDENTIALS'],
            paymentMessageAction: 'WARN',
            financialInstructionAction: 'WARN',
        },
        'attestation-manager': {
            bicValidationRequired: true,
            leiValidationRequired: true,
            ibanValidationRequired: true,
            swiftCbprPlusComplianceRequired: true,
        },
        'event-bus': {
            paymentMisroutingAlertActive: true,
            messageFormatBreachAlertActive: true,
            settlementFailureNotificationRequired: true,
        },
        'anomaly-detector': {
            paymentDuplicateDetectionActive: true,
            schemaViolationDetectionActive: true,
            remittanceDataDegradationDetectionActive: true,
        },
        'encryption-layer': {
            algorithm: 'aes-256-gcm',
            encryptionRequiredForPaymentData: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['PAYMENT-DATA-RESIDENCY', 'AUDIT-TRAIL', 'SCHEMA-VALIDATION'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates payment data custody risk incompatible with SWIFT CBPR+ security requirements and national RTGS operator rules.',
            baidu: 'PRC jurisdiction incompatible with payment message confidentiality requirements; no adequate transfer mechanism for financial instruction data.',
            alibaba: 'PRC jurisdiction incompatible with payment message confidentiality requirements; no adequate transfer mechanism for financial instruction data.',
        },
    },
    dataPolicy: {
        scanCategories: ['PAYMENT_MESSAGE', 'FINANCIAL_INSTRUCTION', 'ACCOUNT_INFORMATION', 'SETTLEMENT_DATA', 'PII', 'CREDENTIALS'],
        categoryActions: {
            PAYMENT_MESSAGE: 'WARN',
            FINANCIAL_INSTRUCTION: 'WARN',
            ACCOUNT_INFORMATION: 'WARN',
            SETTLEMENT_DATA: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        // Payment message retention: typically 5-7 years per national banking regulations
        // BSA wire transfer recordkeeping: 5 years (31 CFR 1020.410)
        // EU Funds Transfer Regulation: 5 years
        // UK FCA: 6 years for client communications
        auditLogRetentionDays: 2190, // 6 years (strictest common requirement)
        sessionRetentionDays: 1825, // 5 years (BSA wire transfer floor)
        incidentRetentionDays: 2190,
        reference: 'BSA 31 CFR 1020.410 -- 5-year wire transfer records; EU Regulation 2015/847 -- 5 years funds transfer data; UK FCA SYSC 9.1 -- 6 years financial communications; Fed Regulation J -- Fedwire payment records',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us', 'eu', 'gb'],
    },
    incidentPolicy: {
        // Payment misrouting or format breach: immediate sender/receiver + relevant operator notification
        notificationDeadlineHours: 24,
        reference: 'ISO 20022 -- payment misrouting triggers immediate sender/receiver notification; national RTGS operator rules on payment incident reporting (Federal Reserve Operating Circular 6; Bank of England CHAPS settlement rules)',
        requiredRecipients: ['payment-operations', 'compliance-officer', 'relevant-rtgs-operator', 'counterparty-bank'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'iso20022-schema-validation',
            description: 'ISO 20022 XML schema validation enforced for all payment messages processed by AI systems',
            reference: 'ISO 20022 schema validation requirements; SWIFT CBPR+ mandatory MX adoption',
            check: 'iso20022_schema_validation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iso20022-mx-format',
            description: 'MX message format (not MT) enforced per SWIFT CBPR+ mandatory migration',
            reference: 'SWIFT CBPR+ MX mandatory adoption November 2025; Fedwire Full Adoption March 2025',
            check: 'iso20022_mx_format_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso20022-structured-remittance',
            description: 'Structured remittance data preserved without degradation through AI processing pipeline',
            reference: 'ISO 20022 data richness requirements; EU Funds Transfer Regulation structured data preservation',
            check: 'iso20022_structured_remittance_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso20022-bic-lei-validation',
            description: 'BIC (ISO 9362) and LEI (ISO 17442) validated for all financial institutions in payment messages',
            reference: 'ISO 20022 pacs.008 BIC validation; GLEIF LEI ISO 17442; SWIFT MX mandatory structured agent fields',
            // F-NEW-VERA-PACK-C5-05 (2026-05-03): renamed from borrowed attestation_active check.
            // BIC/LEI validation is a data-classifier config gate (bicLeiValidationRequired), not an
            // attestation-manager concern. attestation_active was semantically incorrect here.
            check: 'iso20022_bic_lei_validation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso20022-payment-misrouting-detection',
            description: 'Payment misrouting and schema violation anomaly detection active',
            reference: 'ISO 20022 message integrity; SWIFT payment controls; national RTGS incident rules',
            // F-NEW-VERA-PACK-C5-05 (2026-05-03): renamed from borrowed post_market_monitoring check.
            // post_market_monitoring is medical-device sector terminology (EU MDR/FDA). ISO 20022 payment
            // misrouting detection is anomaly-detector presence, not a medical post-market concept.
            check: 'iso20022_misrouting_detection_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso20022-duplicate-detection',
            description: 'Duplicate payment instruction detection active in AI-processed message flows',
            reference: 'ISO 20022 end-to-end deduplication (EndToEndId); RTGS idempotency requirements',
            check: 'iso20022_duplicate_detection_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso20022-audit-trail',
            description: 'Tamper-evident audit trail for payment instructions with 6-year retention',
            reference: 'BSA 31 CFR 1020.410 -- 5-year wire records; UK FCA -- 6-year communications; Fed Operating Circular 6',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso20022-encryption',
            description: 'Payment message data encrypted at rest and in transit',
            reference: 'SWIFT Customer Security Programme (CSP); PCI DSS requirement 3/4 (payments context); national RTGS security standards',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso20022-vendor-compliance',
            description: 'Third-party payment processing vendors maintain ISO 20022 schema compliance; structured data not degraded',
            reference: 'SWIFT CBPR+ third-party requirements; ISO 20022 data richness preservation obligations',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso20022-incident-reporting',
            description: 'Payment misrouting and format breach incident reporting wired; 24-hour notification to operators',
            reference: 'National RTGS operator incident rules; SWIFT payment controls framework; Bank of England CHAPS rules',
            check: 'incident_reporting',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=iso20022.js.map