/**
 * Maryland HB 1202 Facial Recognition Employment Act Compliance Pack
 *
 * Regulation: Maryland Labor and Employment Article §3-717 (HB 1202),
 *             enacted 2020, effective October 1, 2020.
 *
 * Jurisdiction: US-MD (Maryland, United States)
 * Regulator: Maryland Department of Labor (MDL)
 *
 * Alias: EM-02 (Employment AI -- second in employment series)
 *
 * Scope:
 *   Applies to any employer using facial recognition technology (FRT) as
 *   part of the employment application process for positions based in Maryland.
 *   "Facial recognition" means automated identification of an individual
 *   through analysis of facial images.
 *
 * Key obligations:
 *   1. Prohibition on use without consent: Employer MAY NOT use facial
 *      recognition technology during an applicant's interview unless:
 *      (a) The applicant provides affirmative consent; AND
 *      (b) The employer provides a written disclosure of the use of FRT.
 *   2. Consent form: Must be provided before FRT is used in any interview.
 *   3. Vendor disclosure: Employer must disclose the identity of any
 *      third-party vendor whose FRT is used.
 *   4. Retention: FR data should be retained only as long as necessary
 *      for the hiring decision; deletion required after candidate not selected.
 *   5. Consent withdrawal: If applicant withdraws consent, employer must
 *      immediately halt FR processing.
 *
 * Enforcement:
 *   - DENY RULE: The pack's enforcement layer BLOCKS FR processing actions
 *     when the consent flag is absent or revoked.
 *   - Maryland Department of Labor may investigate complaints.
 *   - Civil remedies available to applicants.
 *
 * Relationship to Illinois AIVIA (EM-01):
 *   Maryland HB 1202 is narrower (facial recognition only) vs. AIVIA
 *   which covers broader AI video analysis. For employers conducting
 *   operations in both states, both packs should be active simultaneously.
 *
 * @connexum/ai-governance
 */
/**
 * Maryland HB 1202 category classifiers.
 */
export const MARYLAND_HB1202_CATEGORY_CLASSIFIERS = {
    FACIAL_RECOGNITION_DATA: {
        references: ['Md. Labor & Employment §3-717 -- facial recognition technology definition'],
        classifier: (input) => {
            if (/\b(?:facial\s+recognition|face\s+recognition|FRT|biometric\s+face|face\s+match|face\s+ID|facial\s+identification)\b/i.test(input))
                return true;
            if (/\b(?:facial\s+(?:scan|capture|template|embedding|feature|vector)|face\s+(?:data|scan|template|biometric))\b/i.test(input))
                return true;
            if (/\b(?:face\s+detection|facial\s+analysis\s+(?:software|AI|algorithm))\b/i.test(input))
                return true;
            return false;
        },
    },
    EMPLOYMENT_APPLICATION_DATA: {
        references: ['Md. Labor & Employment §3-717 -- employment application process scope'],
        classifier: (input) => {
            if (/\b(?:job\s+application|employment\s+application|hiring\s+interview|applicant\s+screening|candidate\s+interview)\b/i.test(input))
                return true;
            if (/\b(?:employment\s+(?:interview|screening|decision)|hiring\s+(?:decision|process|workflow))\b/i.test(input))
                return true;
            return false;
        },
    },
    CANDIDATE_CONSENT: {
        references: ['Md. Labor & Employment §3-717(b) -- consent prerequisite for FRT use'],
        classifier: (input) => {
            if (/\b(?:FR(?:T)?\s+consent|facial\s+recognition\s+consent|face\s+recognition\s+consent|biometric\s+consent\s+(?:form|record|Maryland))\b/i.test(input))
                return true;
            if (/\b(?:consent\s+(?:to\s+)?(?:facial|face)\s+recognition|Maryland\s+(?:HB|employment)\s+consent)\b/i.test(input))
                return true;
            if (/\b(?:withdraw\s+(?:FR|facial\s+recognition)\s+consent|revoke\s+(?:FR|biometric)\s+consent)\b/i.test(input))
                return true;
            return false;
        },
    },
    VENDOR_DISCLOSURE_RECORD: {
        references: ['Md. Labor & Employment §3-717(b)(2) -- third-party vendor disclosure obligation'],
        classifier: (input) => {
            if (/\b(?:FRT\s+vendor|facial\s+recognition\s+vendor|face\s+recognition\s+(?:software|provider|vendor)|third.party\s+biometric\s+vendor)\b/i.test(input))
                return true;
            if (/\b(?:Maryland\s+HB\s+1202\s+vendor|biometric\s+vendor\s+disclosure)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['Md. Labor & Employment §3-717 -- applicant personal data in hiring context'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:applicant|candidate)\s+(?:name|email|phone|address)/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Md. Labor & Employment §3-717 -- security obligations for biometric and employment data'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const MARYLAND_HB1202_PACK = {
    categoryClassifiers: MARYLAND_HB1202_CATEGORY_CLASSIFIERS,
    id: 'maryland-hb1202',
    aliases: ['EM-02'],
    name: 'Maryland HB 1202 Facial Recognition Employment Act',
    version: '1.0.0',
    contentHash: '2e6ff93e5c94e6a7ff2fa851e39c383db47645de566e5d6755917bb45f78347b',
    description: 'Maryland Labor and Employment §3-717 (HB 1202, effective October 1, 2020) compliance for AI systems using facial recognition technology (FRT) in employment interviews. Prohibits FRT use in applicant interviews without: (1) affirmative applicant consent, (2) written disclosure of FRT use, and (3) third-party vendor disclosure. DENY RULE: this pack BLOCKS FR processing actions when the candidate consent flag is absent or revoked. FR data must be deleted after the candidate is not selected; consent withdrawal triggers immediate halt of all FR processing. Enforced by Maryland Department of Labor.',
    authority: 'Maryland Department of Labor (MDL)',
    industries: ['hr-employment', 'recruiting', 'staffing', 'technology', 'enterprise-hr', 'ats-vendors'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'BLOCK facial recognition processing actions when candidate consent flag is absent; enforce written disclosure delivery before FRT use; consent withdrawal halts FR processing immediately',
            reference: 'Md. Labor & Employment §3-717(b) -- affirmative consent prerequisite; disclosure requirement before FRT use in employment interview',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify facial recognition data, employment application data, consent records, and vendor disclosure records; trigger BLOCK action on FR data without consent flag',
            reference: 'Md. Labor & Employment §3-717 -- facial recognition technology definition; employment application process scope',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident log of consent collection, FR processing events, vendor disclosures, and deletion actions; required for MDL complaint defence',
            reference: 'Md. Labor & Employment §3-717 -- compliance records; MDL investigation procedures',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Access control for facial recognition data and employment biometric records; access limited to authorised recruiting personnel',
            reference: 'Md. Labor & Employment §3-717 -- implicit security obligations for biometric candidate data',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human-in-the-loop gate: FR processing cannot proceed without human-confirmed consent flag; consent withdrawal escalation to halt FR processing',
            reference: 'Md. Labor & Employment §3-717(b) -- affirmative consent prerequisite; consent withdrawal must immediately halt FR processing',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Consent withdrawal event triggers immediate FR processing halt; deletion event triggered on hiring decision (non-selection)',
            reference: 'Md. Labor & Employment §3-717 -- consent withdrawal effect; FR data deletion after hiring decision',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party FRT vendor identification and disclosure to candidates; vendor contractual obligations for FR data deletion post-hiring-decision',
            reference: 'Md. Labor & Employment §3-717(b)(2) -- third-party vendor disclosure obligation; employer responsibility for vendor FRT compliance',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Consent record continuity across sessions; FR data retention state tracking until deletion trigger (non-selection decision)',
            reference: 'Md. Labor & Employment §3-717 -- consent continuity; FR data lifecycle tracking through hiring decision',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Written consent form attestation; vendor disclosure documentation; FR data deletion confirmation records',
            reference: 'Md. Labor & Employment §3-717(b) -- written disclosure and consent requirements; vendor disclosure record',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Written disclosure of FRT use delivered to applicant before interview; vendor identity disclosed; FR data use explained to applicant',
            reference: 'Md. Labor & Employment §3-717(b)(1) -- written disclosure of FRT use; §3-717(b)(2) -- vendor disclosure',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            facialRecognitionBlockedWithoutConsent: true,
            frtDisclosureRequiredBeforeInterview: true,
            consentWithdrawalImmediateHaltRequired: true,
            vendorDisclosureRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['FACIAL_RECOGNITION_DATA', 'EMPLOYMENT_APPLICATION_DATA', 'CANDIDATE_CONSENT', 'VENDOR_DISCLOSURE_RECORD', 'PII', 'CREDENTIALS'],
            facialRecognitionWithoutConsentAction: 'BLOCK',
            facialRecognitionDataAction: 'WARN',
            credentialsAction: 'BLOCK',
        },
        'approval-queue': {
            frConsentGateRequired: true,
            consentWithdrawalEscalationRequired: true,
            frProcessingHaltOnWithdrawal: true,
        },
        'event-bus': {
            consentWithdrawalImmediateHaltEvent: true,
            frDeletionOnNonSelectionEvent: true,
        },
        'supply-chain': {
            frtVendorDisclosureRequired: true,
            vendorFrDeletionObligationRequired: true,
        },
        'attestation-manager': {
            writtenConsentFormRequired: true,
            vendorDisclosureRecordRequired: true,
            frDeletionConfirmationRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-US', 'BIOMETRIC-CONSENT-GATE', 'FACIAL-RECOGNITION-DELETION-SUPPORT'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law creates facial recognition biometric data custody risk incompatible with Maryland HB 1202 employer control and deletion obligations.',
            baidu: 'PRC jurisdiction. Maryland HB 1202 employer responsibility for third-party FRT vendor compliance cannot be satisfied under PRC intelligence law.',
            alibaba: 'PRC jurisdiction. Maryland HB 1202 employer responsibility for third-party FRT vendor compliance cannot be satisfied under PRC intelligence law.',
        },
    },
    dataPolicy: {
        scanCategories: ['FACIAL_RECOGNITION_DATA', 'EMPLOYMENT_APPLICATION_DATA', 'CANDIDATE_CONSENT', 'VENDOR_DISCLOSURE_RECORD', 'PII', 'CREDENTIALS'],
        categoryActions: {
            FACIAL_RECOGNITION_DATA: 'BLOCK', // Block when consent absent (runtime enforces consent-gate logic)
            EMPLOYMENT_APPLICATION_DATA: 'WARN',
            CANDIDATE_CONSENT: 'WARN',
            VENDOR_DISCLOSURE_RECORD: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        // FR data: retain only as long as necessary for hiring decision; delete after non-selection.
        // Consent records: retain for duration of employment record + applicable limitation period.
        auditLogRetentionDays: 1825, // 5 years for consent and FR processing logs
        sessionRetentionDays: 30, // FR data: delete promptly after hiring decision
        incidentRetentionDays: 1825, // 5 years for complaint records
        reference: 'Md. Labor & Employment §3-717 -- FR data deleted after hiring decision (non-selection); Maryland 3-year employment statute of limitations (Md. Courts & Judicial Proceedings §5-101); consent records retained per standard HR record practices',
        forceDelete: true, // FR data MUST be deleted after non-selection decision
        requiresLegalHoldSupport: true,
        sovereignty: ['us-md', 'us'],
    },
    incidentPolicy: {
        // Consent non-compliance is an immediate incident (FR processed without consent = violation).
        // Consent withdrawal not acted upon within session = high-severity incident.
        // MDL complaint investigation does not have a fixed statutory breach notification deadline.
        notificationDeadlineHours: 72, // 72-hour internal escalation for consent violations
        reference: 'Md. Labor & Employment §3-717(b) -- consent prerequisite violation is immediate; MDL complaint investigation procedures; consent withdrawal must trigger immediate halt per §3-717',
        requiredRecipients: ['chief-compliance-officer', 'hr-legal-counsel', 'mdl-complaint-response-unit'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'md-hb1202-consent-gate-block',
            description: 'FR processing BLOCKED when candidate consent flag is absent or revoked; consent must precede any facial recognition analysis',
            reference: 'Md. Labor & Employment §3-717(b) -- affirmative consent prerequisite; consent withdrawal must immediately halt FR processing',
            check: 'gdpr_lawful_basis_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'md-hb1202-disclosure-delivery',
            description: 'Written disclosure of FRT use delivered to applicant before interview; third-party vendor identity disclosed',
            reference: 'Md. Labor & Employment §3-717(b)(1) -- written disclosure; §3-717(b)(2) -- vendor disclosure',
            check: 'transparency_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'md-hb1202-consent-withdrawal-halt',
            description: 'Consent withdrawal event immediately halts all FR processing; event-bus wired for real-time halt trigger',
            reference: 'Md. Labor & Employment §3-717 -- consent withdrawal effect; FR processing must cease on withdrawal',
            check: 'event_clock_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'md-hb1202-fr-data-deletion',
            description: 'Facial recognition data deleted after non-selection hiring decision; deletion confirmation recorded',
            reference: 'Md. Labor & Employment §3-717 -- FR data retention limited to duration necessary for hiring decision; delete after non-selection',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'md-hb1202-data-classifier',
            description: 'Facial recognition data, consent records, and vendor disclosure records classified; BLOCK action on FR data without consent',
            reference: 'Md. Labor & Employment §3-717 -- FR data classification and handling obligations',
            check: 'data_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'md-hb1202-vendor-oversight',
            description: 'Third-party FRT vendor identified, disclosed to applicants, and contractually required to delete FR data after hiring decision',
            reference: 'Md. Labor & Employment §3-717(b)(2) -- third-party vendor disclosure; employer responsibility for vendor FRT compliance',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'md-hb1202-access-control',
            description: 'Facial recognition data access limited to authorised personnel; audit trail of access events',
            reference: 'Md. Labor & Employment §3-717 -- security obligations for biometric candidate data',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'md-hb1202-encryption',
            description: 'Facial recognition data and employment biometric records encrypted at rest and in transit',
            reference: 'Md. Labor & Employment §3-717 -- implicit security standards for biometric data in employment context',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'md-hb1202-human-review',
            description: 'Human-in-the-loop gate for FR-assisted hiring decisions; final hiring decisions not made solely by automated facial recognition',
            reference: 'Md. Labor & Employment §3-717 -- employer obligations; FRT as a tool, not sole decision maker',
            check: 'gdpr_article22_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'md-hb1202-audit-integrity',
            description: 'Tamper-evident audit log of FRT consent, analysis events, vendor disclosures, and deletion confirmations',
            reference: 'Md. Labor & Employment §3-717 -- compliance record requirements; MDL investigation defence',
            check: 'finra_worm_records_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=maryland-hb1202.js.map