/**
 * ISO/IEC 27701:2019 Privacy Information Management System (PIMS) Pack
 *
 * ISO/IEC 27701:2019 is a privacy extension to ISO/IEC 27001:2013 and
 * ISO/IEC 27002:2013. It establishes requirements and guidance for
 * implementing, maintaining, and improving a Privacy Information Management
 * System (PIMS) as a component of, or integrated with, an Information
 * Security Management System (ISMS) built on ISO 27001.
 *
 * Key regulatory context:
 *   - ISO 27701 is not itself a law; it provides a certifiable privacy
 *     framework that organisations can use to demonstrate GDPR, CCPA, PIPEDA,
 *     or other jurisdiction-specific privacy compliance.
 *   - Accreditation bodies (UKAS in UK, ANAB in US, DAkkS in Germany, etc.)
 *     certify organisations against ISO 27701 under their national schemes.
 *   - ISO 27701 distinguishes PII Controllers (Annex B) from PII Processors
 *     (Annex C); both sets of controls are represented in this pack.
 *
 * Relationship to ISO 27001:
 *   - This pack is structurally independent per the one-country/one-regulation
 *     rule, but implementers should activate iso27001.ts concurrently; the
 *     PIMS extends and cannot replace the underlying ISMS.
 *   - When both packs are active the strictest control wins per standard
 *     cross-pack composition rules.
 *
 * Retention:
 *   - ISO 27701 does not mandate specific retention periods; it defers to the
 *     applicable privacy laws of active jurisdictions (typically GDPR 72-hour
 *     breach notification, 6-year documentation retention, etc.).
 *   - Default auditLogRetentionDays reflects a conservative 6-year period
 *     consistent with EU/UK GDPR guidance and common accreditation practice.
 *
 * Current state (2026):
 *   - ISO 27701:2019 is under revision; ISO/IEC WD 27701 (2nd edition) is in
 *     development to align with ISO 27001:2022. Organisations should monitor
 *     the revision cycle for updated control numbers and Annex structure.
 *   - Pairs with: gdpr.ts, uk-gdpr.ts, ca-pipeda.ts, ccpa.ts (jurisdiction
 *     packs provide the legal teeth that ISO 27701 maps against).
 *
 * @connexum/ai-governance
 */
/**
 * ISO 27701 category classifiers.
 * Focuses on PII Controller and PII Processor data categories per the
 * Annex B / Annex C split in the standard.
 */
export const ISO27701_CATEGORY_CLASSIFIERS = {
    PII_CONTROLLER_DATA: {
        references: ['ISO/IEC 27701:2019 Annex B -- PII controller-specific requirements; clause 7'],
        classifier: (input) => {
            // Identifiable natural person signals
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:name|full name|first name|last name)[:\s]+[A-Z][a-z]+ [A-Z][a-z]+/i.test(input))
                return true;
            // Data subject purpose / lawful basis markers
            if (/\b(?:processing\s+purpose|lawful\s+basis|consent\s+record|legitimate\s+interest|dpia|data\s+subject\s+request)\b/i.test(input))
                return true;
            // Processing records markers
            if (/\b(?:record\s+of\s+processing|ropa|privacy\s+notice|privacy\s+policy)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII_PROCESSOR_DATA: {
        references: ['ISO/IEC 27701:2019 Annex C -- PII processor-specific requirements; clause 8'],
        classifier: (input) => {
            // Sub-processor / vendor PII handling signals
            if (/\b(?:sub-?processor|data\s+processor|processing\s+agreement|DPA|controller\s+instruction)\b/i.test(input))
                return true;
            // Return / deletion / transfer back to controller
            if (/\b(?:return\s+PII|delete\s+PII|PII\s+transfer|processor\s+deletion)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII_SUBJECT_RIGHTS: {
        references: ['ISO/IEC 27701:2019 §7.3 -- obligations to PII principals; Annex B.8'],
        classifier: (input) => {
            if (/\b(?:subject\s+access\s+request|SAR|right\s+to\s+erasure|right\s+to\s+rectification|right\s+to\s+portability|right\s+to\s+object|data\s+subject\s+right)\b/i.test(input))
                return true;
            if (/\b(?:opt.?out|unsubscribe|withdraw\s+consent|revoke\s+consent)\b/i.test(input))
                return true;
            return false;
        },
    },
    DPIA_RECORD: {
        references: ['ISO/IEC 27701:2019 §7.4.1 -- privacy impact assessment; DPIA requirement'],
        classifier: (input) => {
            if (/\b(?:DPIA|PIA|privacy\s+impact\s+assessment|data\s+protection\s+impact\s+assessment|high.risk\s+processing)\b/i.test(input))
                return true;
            return false;
        },
    },
    VENDOR_PII_PROCESSING: {
        references: ['ISO/IEC 27701:2019 §7.5 -- contracts with PII processors; Annex C.2'],
        classifier: (input) => {
            if (/\b(?:vendor\s+privacy|third.party\s+processor|cloud\s+processor|SaaS\s+provider|processor\s+audit|sub.processor\s+register)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['ISO/IEC 27701:2019 §6.8 -- asset management; inherited from ISO 27001 A.9'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const ISO27701_PACK = {
    categoryClassifiers: ISO27701_CATEGORY_CLASSIFIERS,
    id: 'iso27701',
    name: 'ISO/IEC 27701:2019 Privacy Information Management System (PIMS)',
    version: '1.0.0',
    contentHash: '005c36f0902431dc529af87ba8e2435fbb440fc076137f11b6e3b132ce0b4335',
    description: 'ISO/IEC 27701:2019 Privacy Information Management System (PIMS) compliance for AI systems acting as PII Controllers or PII Processors. Extends ISO 27001 ISMS with privacy-specific controls (Annex B for controllers, Annex C for processors). Covers PII inventory, DPIA trigger detection, data subject rights handling, breach notification, and vendor PII processor management. Certifiable framework mapping to GDPR, CCPA, PIPEDA, and other jurisdiction-specific privacy laws. Build as a standalone pack per one-regulation rule; activate alongside iso27001.ts so the PIMS extension has a valid underlying ISMS.',
    authority: 'ISO (International Organization for Standardization) + national accreditation bodies (UKAS, ANAB, DAkkS, etc.)',
    industries: ['technology', 'financial-services', 'healthcare', 'retail', 'hr-employment', 'public-sector', 'legal', 'education', 'cloud-services', 'consulting'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Purpose limitation and lawful basis enforcement per ISO 27701 §7.2 (PII processing conditions); privacy-by-design and by-default controls',
            reference: 'ISO/IEC 27701:2019 §7.2 -- conditions for collection; §7.2.2 -- identify lawful basis; §6.3 -- privacy-by-design and by-default',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'PII inventory and classification per §7.2.8 (PII inventory); distinguishing Controller vs Processor data; special category detection for downstream jurisdiction-pack enforcement',
            reference: 'ISO/IEC 27701:2019 §7.2.8 -- PII inventory; Annex B.8.1 -- PII identification; Annex C.2.2 -- subprocessor PII classification',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident records of processing and DPIA documentation; accountability demonstration for certification audits',
            reference: 'ISO/IEC 27701:2019 §7.2.7 -- records associated with processing PII; §6.12 -- management review (evidence); ISO 27001:2013 Annex A.12.4 -- logging',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Access control limiting PII access to authorised roles; unique agent identity for audit trail per PIMS accountability obligation',
            reference: 'ISO/IEC 27701:2019 §6.8 -- asset management; ISO 27001 A.9 -- access control; §7.2.4 -- accuracy and quality of PII',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Encryption and pseudonymisation as PIMS technical safeguards for PII at rest and in transit',
            reference: 'ISO/IEC 27701:2019 §6.8.1.3 -- return, transfer or disposal of PII; ISO 27001 A.10 -- cryptography; §7.4.6 -- privacy-enhancing technology',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'DPIA authorisation workflow; human-in-the-loop gate for high-risk PII processing decisions; consent collection authorisation for Controller obligations',
            reference: 'ISO/IEC 27701:2019 §7.4.1 -- privacy impact assessment (PIA/DPIA); §7.2.3 -- obtaining and recording consent',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Records of processing activities (ROPA equivalent); DPIA documentation; processor contract register; DPO/privacy officer designation tracking',
            reference: 'ISO/IEC 27701:2019 §7.2.7 -- records associated with PII processing; §7.5.1 -- contracts with processors; §7.2.1 -- identify and document purpose',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Personal data breach notification deferred to applicable jurisdiction pack (GDPR 72 hours, CCPA, etc.); PIMS incident classification and logging',
            reference: 'ISO/IEC 27701:2019 §6.13.1 -- responsibilities and procedures for PII breach; notification timelines inherited from active jurisdiction packs',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Sub-processor register and contractual flow-down obligations; vendor PII processor management; transfer mechanism verification for cross-border flows',
            reference: 'ISO/IEC 27701:2019 §7.5 -- contracts with PII processors; Annex C.2.6 -- engagement of sub-processors; §7.5.3 -- sub-processor register',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Storage limitation enforcement; PII retention schedule per purpose; data subject request (DSR) continuity across sessions',
            reference: 'ISO/IEC 27701:2019 §7.4.4 -- PII minimisation; §7.4.7 -- storage limitation and disposal; §7.3.4 -- objection to processing',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Privacy notice delivery per §7.3.2 (providing information to PII principals); automated AI processing disclosure obligations',
            reference: 'ISO/IEC 27701:2019 §7.3.2 -- providing information to PII principals; §7.3.1 -- determining information for PII principals; §7.3.3 -- right to access',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            lawfulBasisEnforced: true,
            purposeLimitationEnforced: true,
            privacyByDesignRequired: true,
            pimsControllerProcessorSplitRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['PII_CONTROLLER_DATA', 'PII_PROCESSOR_DATA', 'PII_SUBJECT_RIGHTS', 'DPIA_RECORD', 'VENDOR_PII_PROCESSING', 'CREDENTIALS'],
            defaultAction: 'WARN',
            piiAction: 'WARN',
            credentialsAction: 'BLOCK',
        },
        'approval-queue': {
            dpiaAuthorizationRequired: true,
            consentCollectionAuthorizationRequired: true,
            highRiskPiiProcessingApprovalRequired: true,
        },
        'attestation-manager': {
            ropaRequired: true,
            dpiaRequired: true,
            processorContractRegisterRequired: true,
            privacyOfficerOnFileRequired: true,
        },
        'event-bus': {
            // Notification deadline defers to active jurisdiction packs (e.g., 72h for GDPR)
            breachClassificationRequired: true,
            jurisdictionPackDeferralActive: true,
        },
        'supply-chain': {
            subProcessorRegisterRequired: true,
            processorContractFlowDownRequired: true,
            crossBorderTransferMechanismVerificationRequired: true,
        },
        'encryption-layer': {
            algorithm: 'aes-256-gcm',
            encryptionRequiredForPii: true,
            pseudonymisationEncouraged: true,
        },
        'session-persistence': {
            storageLimitationEnforced: true,
            dsrContinuityRequired: true,
            retentionSchedulePerPurposeRequired: true,
        },
        'agent-auth': {
            accessLimitedToAuthorisedRoles: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['PROCESSOR-CONTRACT', 'PRIVACY-BY-DESIGN', 'SUBPROCESSOR-REGISTER'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law incompatible with ISO 27701 sub-processor obligations (§7.5.3) and cross-border transfer controls; no adequate transfer mechanism for PRC.',
            baidu: 'PRC jurisdiction. ISO 27701 §7.5.3 sub-processor register and transfer mechanism requirements cannot be satisfied; no adequate transfer mechanism for PRC.',
            alibaba: 'PRC jurisdiction. ISO 27701 §7.5.3 sub-processor register and transfer mechanism requirements cannot be satisfied; no adequate transfer mechanism for PRC.',
        },
    },
    dataPolicy: {
        scanCategories: ['PII_CONTROLLER_DATA', 'PII_PROCESSOR_DATA', 'PII_SUBJECT_RIGHTS', 'DPIA_RECORD', 'VENDOR_PII_PROCESSING', 'CREDENTIALS'],
        categoryActions: {
            PII_CONTROLLER_DATA: 'WARN',
            PII_PROCESSOR_DATA: 'WARN',
            PII_SUBJECT_RIGHTS: 'WARN',
            DPIA_RECORD: 'WARN',
            VENDOR_PII_PROCESSING: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // ISO 27701 defers retention periods to applicable privacy law.
        // Default 6 years is consistent with GDPR/UK GDPR accountability
        // obligations and the Limitation Act 1980 / EU statutes of limitations.
        // Organisations must override per their active jurisdiction packs.
        auditLogRetentionDays: 2190, // 6 years (GDPR/UK accountability baseline)
        sessionRetentionDays: 2190, // 6 years for processing documentation
        incidentRetentionDays: 2190,
        reference: 'ISO/IEC 27701:2019 §7.2.7 -- records of PII processing (no fixed period; defer to jurisdiction law); GDPR Art. 5(1)(e) storage limitation; ICO recommended 6-year audit retention; PIPEDA 1-year minimum',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['global'], // ISO 27701 is jurisdiction-neutral; sovereignty governed by active jurisdiction packs
    },
    incidentPolicy: {
        // ISO 27701 §6.13.1 defines breach response obligations but does NOT set a
        // specific notification deadline -- that comes from jurisdiction packs.
        // 72 hours used as conservative default (GDPR / UK GDPR standard).
        // Operators with GDPR active will inherit 72h; CCPA/PIPEDA may differ.
        notificationDeadlineHours: 72,
        reference: 'ISO/IEC 27701:2019 §6.13.1 -- management of PII breaches; notification deadline inherited from active jurisdiction packs (GDPR Art. 33 72h default applied); §7.2.9 -- breach notification to PII principals',
        requiredRecipients: ['privacy-officer', 'data-protection-officer', 'affected-jurisdiction-supervisory-authority'],
        formalNotificationRequired: true,
    },
    validators: [
        //
        // CHECK-KEY NAMESPACE NOTE (F-NEW-VERA-PACK-C5-04, 2026-05-03):
        // The check IDs below use the gdpr_* prefix but are NOT GDPR-specific checks.
        // They are SHARED GENERIC INFRASTRUCTURE checks registered in check-registry.ts
        // that read from standard moduleConfig keys present in any privacy pack:
        //   - gdpr_ropa_active    -> reads attestation-manager.ropaRequired (generic)
        //   - gdpr_lawful_basis_active -> reads governance-runtime.lawfulBasisEnforced (generic)
        //   - gdpr_dpia_active    -> reads attestation-manager.dpiaRequired (generic)
        //   - gdpr_purpose_limitation_active -> reads governance-runtime.purposeLimitationEnforced (generic)
        //   - gdpr_breach_72h_active -> reads event-bus module active (generic)
        // ISO 27701 intentionally reuses these checks because it requires the same
        // underlying module configuration regardless of jurisdiction. The gdpr_*
        // naming reflects historical origin only; these checks fire correctly for
        // PIPEDA-only and CCPA-only deployments that have the corresponding
        // moduleConfig keys set. See check-registry.ts BATCH-02 comment block
        // (line ~2926) which explicitly documents this reuse decision.
        // No namespace rename is needed or desirable: renaming would require every
        // other pack that reuses these same checks to be updated simultaneously,
        // and would give false impression that separate check implementations exist.
        //
        {
            id: 'iso27701-pii-inventory',
            description: 'PII inventory maintained per ISO 27701 §7.2.8; all PII processing activities documented',
            reference: 'ISO/IEC 27701:2019 §7.2.8 -- maintaining records associated with PII processing; Annex B.8.1 -- identify PII',
            check: 'gdpr_ropa_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iso27701-lawful-basis',
            description: 'Lawful basis / processing condition identified and documented for all PII processing per §7.2.2',
            reference: 'ISO/IEC 27701:2019 §7.2.2 -- identify lawful basis; Annex B.2.1 -- identify and document purpose',
            check: 'gdpr_lawful_basis_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iso27701-data-classifier',
            description: 'PII classification active distinguishing Controller data, Processor data, and subject rights records',
            reference: 'ISO/IEC 27701:2019 §7.2.8 -- PII identification; Annex B.8.1; Annex C.2.2',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iso27701-encryption',
            description: 'PII encrypted at rest and in transit; pseudonymisation applied as privacy-enhancing technique',
            reference: 'ISO/IEC 27701:2019 §7.4.6 -- privacy-enhancing technology; ISO 27001 A.10 -- cryptography',
            check: 'encryption_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iso27701-dpia-trigger',
            description: 'DPIA trigger detection active for high-risk PII processing; authorisation workflow in place',
            reference: 'ISO/IEC 27701:2019 §7.4.1 -- privacy impact assessment (PIA/DPIA) before high-risk processing',
            check: 'gdpr_dpia_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso27701-subject-rights',
            description: 'Data subject / PII principal rights handling active: access, erasure, portability, objection',
            reference: 'ISO/IEC 27701:2019 §7.3 -- obligations to PII principals; Annex B.4 -- obligations regarding PII principals',
            check: 'gdpr_purpose_limitation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso27701-breach-notification',
            description: 'PII breach notification procedure active; notification to relevant supervisory authority per jurisdiction pack deadlines',
            reference: 'ISO/IEC 27701:2019 §6.13.1 -- management of PII breaches and incidents; §7.2.9 -- notification to supervisory authority',
            check: 'gdpr_breach_72h_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso27701-sub-processor-register',
            description: 'Sub-processor register maintained; processor contracts include required ISO 27701 Annex C flow-down obligations',
            reference: 'ISO/IEC 27701:2019 §7.5 -- contracts with PII processors; §7.5.3 -- sub-processor register; Annex C.2.6',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso27701-access-control',
            description: 'PII access limited to authorised roles; unique agent identity for audit trail',
            reference: 'ISO/IEC 27701:2019 §6.8 -- asset management; ISO 27001 A.9 -- access control; accountability obligation',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso27701-transparency',
            description: 'Privacy notice delivered to PII principals before or at point of PII collection; AI processing disclosed',
            reference: 'ISO/IEC 27701:2019 §7.3.2 -- providing information to PII principals; §7.3.1 -- determine information for PII principals',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iso27701-storage-limitation',
            description: 'PII retained no longer than necessary for stated purpose; deletion / anonymisation schedule enforced',
            reference: 'ISO/IEC 27701:2019 §7.4.7 -- storage limitation; §6.8.1.3 -- return, transfer, or disposal of PII',
            check: 'gdpr_purpose_limitation_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=iso27701.js.map