/**
 * ECOA Compliance Pack (Standalone)
 *
 * Equal Credit Opportunity Act -- Statutory Framework
 * Authority: CFPB (Regulation B, 12 CFR Part 1002; ECOA 15 USC §1691 et seq.)
 *
 * Relationship to cfpb-2023-03 pack: the CFPB 2023-03 pack covers the specific
 * Circular 2023-03 interpretation of ECOA adverse-action notices for AI/complex
 * algorithm systems. This pack covers the full ECOA/Reg B statutory framework:
 *   - §1002.4 -- prohibited bases in credit decisions
 *   - §1002.5 -- information collection rules
 *   - §1002.6 -- rules concerning evaluation of creditworthiness
 *   - §1002.9 -- adverse action notification (30-day)
 *   - §1002.10 -- furnishing credit information (joint applicants)
 *   - §1002.12(b) -- record retention (25 months consumer credit)
 *   - §1002.13 -- information for monitoring purposes
 *   - §1002.14 -- rules on providing appraisals (3-business-day rule)
 *   - Appendix C -- sample forms
 *
 * LLM-EGRESS PRIMACY RULES (Thomas directive 2026-04-22):
 *   - BLOCK ABSOLUTELY: any Reg B prohibited basis from entering an LLM that
 *     participates in a credit decision. Prohibited bases: race, color, religion,
 *     national origin, sex, marital status, age (provided applicant has capacity),
 *     receipt of public assistance income, good faith exercise of rights under
 *     the Consumer Credit Protection Act (15 USC §1601 et seq.).
 *   - REQUIRE SPECIFIC REASONS: any AI-generated adverse-action notice must
 *     include the actual top principal reasons; "automated decision" is not a
 *     specific reason (see also cfpb-2023-03 pack).
 *   - REQUIRE NAMED REVIEWER: every adverse-action decision must carry named-
 *     reviewer attribution in the audit log per §1002.9.
 *
 * @connexum/ai-governance
 */
/**
 * ECOA (Equal Credit Opportunity Act, 15 U.S.C. §1691) category classifiers.
 * Prohibits discrimination in credit transactions on prohibited bases.
 * These categories must be blocked from entering credit decision logic.
 */
export const ECOA_CATEGORY_CLASSIFIERS = {
    ECOA_PROHIBITED_BASIS: {
        references: ['ECOA 15 U.S.C. §1691(a) -- prohibited bases for credit discrimination'],
        classifier: (input) => {
            if (/\b(?:prohibited\s+basis|protected\s+class\s+in\s+credit)\b/i.test(input))
                return true;
            if (/\bapplicant\s+race\b/i.test(input))
                return true;
            if (/\b(?:credit|loan|mortgage)\b.*\b(?:race|national\s+origin|sex|gender|religion|color|marital\s+status|public\s+assistance)\b/i.test(input))
                return true;
            if (/\b(?:declined|denied|rejected)\b.*\b(?:based\s+on|due\s+to|because\s+of)\b.*\b(?:race|national\s+origin|sex|religion|color|age|marital\s+status)\b/i.test(input))
                return true;
            return false;
        },
    },
    ECOA_RACE: {
        references: ['Reg B 12 CFR §1002.2(z) -- race as prohibited basis'],
        pattern: /\b(?:race|racial\s+(?:origin|background|group))\b/i,
    },
    ECOA_COLOR: {
        references: ['Reg B 12 CFR §1002.2(z) -- color as prohibited basis'],
        pattern: /\b(?:color\s+(?:of\s+skin|bias|discrimination))\b/i,
    },
    ECOA_RELIGION: {
        references: ['Reg B 12 CFR §1002.2(z) -- religion as prohibited basis'],
        pattern: /\b(?:religion|religious\s+(?:affiliation|belief|denomination))\b/i,
    },
    ECOA_NATIONAL_ORIGIN: {
        references: ['Reg B 12 CFR §1002.2(z) -- national origin as prohibited basis'],
        pattern: /\b(?:national\s+origin|country\s+of\s+origin|place\s+of\s+birth|immigration\s+status)\b/i,
    },
    ECOA_SEX: {
        references: ['Reg B 12 CFR §1002.2(z) -- sex as prohibited basis (includes gender identity per CFPB)'],
        pattern: /\b(?:sex|gender)\s+(?:of\s+applicant|(?:as\s+a\s+)?factor)\b/i,
    },
    ECOA_MARITAL_STATUS: {
        references: ['Reg B 12 CFR §1002.2(z) -- marital status as prohibited basis'],
        pattern: /\b(?:marital\s+status|divorced|married|unmarried|separated)\s+applicant\b/i,
    },
    ECOA_AGE: {
        references: ['Reg B 12 CFR §1002.2(z) -- age as prohibited basis (except proxy for contractual capacity)'],
        pattern: /\b(?:age\s+(?:of\s+applicant|discrimination|factor)|applicant\s+age)\b/i,
    },
    ECOA_PUBLIC_ASSISTANCE: {
        references: ['Reg B 12 CFR §1002.2(z) -- public assistance status as prohibited basis'],
        pattern: /\b(?:public\s+assistance|welfare|SNAP|food\s+stamps?|Medicaid)\s+(?:recipient|status|income)\b/i,
    },
    MORTGAGE_APPLICATION_RECORD: {
        references: ['ECOA/Reg B -- credit application record subject to anti-discrimination review'],
        classifier: (input) => {
            if (/\b(?:mortgage\s+(?:application|loan)|credit\s+application|home\s+loan\s+application|URLA|1003\s+form)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['ECOA -- information security for credit decision systems'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const ECOA_PACK = {
    categoryClassifiers: ECOA_CATEGORY_CLASSIFIERS,
    /** P3.5: Credit applicant data (prohibited basis + application record) are subject-keyed per ECOA 15 USC §1691. */
    subjectKeyedCategories: ['MORTGAGE_APPLICATION_RECORD'],
    id: 'ecoa',
    /** GAP-S1-01: MT-04 is the site/packs.html public code for this pack. */
    aliases: ['MT-04'],
    name: 'ECOA / Regulation B (Equal Credit Opportunity Act)',
    version: '1.0.0',
    contentHash: 'faa808e4269f35d1b5ca97dd4b7e1484ede97d8dbea8cbf4f1160668424992fb',
    description: 'Equal Credit Opportunity Act (15 USC §1691, Regulation B 12 CFR Part 1002) full statutory framework. Absolutely blocks Reg B prohibited bases (race, color, religion, national origin, sex, marital status, age, public assistance income, CCPA rights exercise) from reaching credit-decision LLMs. Requires specific adverse-action reasons, named-reviewer attribution, and 25-month record retention. Companion to cfpb-2023-03 pack (AI-specific adverse-action interpretation).',
    authority: 'Consumer Financial Protection Bureau (CFPB)',
    industries: ['mortgage-lender', 'bank', 'credit-union', 'auto-finance', 'credit-card', 'bnpl', 'fintech-lender', 'small-business-lender'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Prohibited-basis egress block in all credit-decision LLM contexts; deny-by-default for ECOA_PROHIBITED_BASIS data class; spousal-signature rule enforcement',
            reference: 'ECOA 15 USC §1691(a); Reg B 12 CFR §1002.4 (prohibited bases); §1002.7(d) (spousal signature)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect and block all Reg B prohibited-basis fields (race, color, religion, national origin, sex, marital status, age, public-assistance income, CCPA exercise) in LLM prompts',
            reference: 'Reg B 12 CFR §1002.4(b) (list of prohibited bases)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for adverse-action decisions, prohibited-basis block events, and appraisal delivery',
            reference: 'Reg B 12 CFR §1002.12 (25-month retention for consumer credit applications)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Named-reviewer requirement on every adverse action; specific-reasons gate before notice issuance; appraisal delivery queue',
            reference: 'Reg B 12 CFR §1002.9(a)(2) (adverse action notice with specific reasons); §1002.14(a)(1) (appraisal delivery)',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'ECOA disparate impact and disparate treatment monitoring on credit decisions, pricing, and product offers',
            reference: 'ECOA 15 USC §1691(a); Reg B 12 CFR §1002.6(a) (anti-discrimination)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: '30-day adverse action notification clock; prohibited-basis violation alert events; appraisal 3-business-day delivery clock',
            reference: 'Reg B 12 CFR §1002.9(a)(1) (30-day adverse action); §1002.14(a)(1) (3-day appraisal)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-application adverse-action clock state across restarts; 25-month record retention state; joint-applicant information tracking',
            reference: 'Reg B 12 CFR §1002.12(b)(3) (25-month retention)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Creditor-level documentation of AI creditworthiness model factors; reason-derivation methodology; spousal-signature exception documentation',
            reference: 'Reg B 12 CFR §1002.6(b) (creditworthiness criteria); §1002.7(d) (spousal signature limitations)',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detect proxy discrimination in LLM prompts (e.g., zip-code proxy for race); conflicting reason codes for similarly situated applicants',
            reference: 'ECOA 15 USC §1691; Reg B 12 CFR §1002.6; CFPB Circular 2023-03',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party credit model and LLM provider attestation that no Reg B prohibited basis flows into creditworthiness scoring',
            reference: 'Reg B 12 CFR §1002.6(b)(8) (credit scoring system evaluation)',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            // Absolute block on all Reg B prohibited bases in credit-decision LLM context
            ecoaProhibitedBasisLlmBlockRequired: true,
            prohibitedBases: [
                'race',
                'color',
                'religion',
                'national_origin',
                'sex',
                'marital_status',
                'age',
                'public_assistance_income',
                'ccpa_rights_exercise',
            ],
            adverseActionDeadlineDays: 30,
            principalFactorReasonRequired: true,
            genericRationaleBlocked: true,
            spousalSignatureRuleEnforced: true,
            appraisalDeliveryBusinessDays: 3,
        },
        'data-classifier': {
            enabledCategories: [
                'ECOA_PROHIBITED_BASIS',
                'ECOA_RACE',
                'ECOA_COLOR',
                'ECOA_RELIGION',
                'ECOA_NATIONAL_ORIGIN',
                'ECOA_SEX',
                'ECOA_MARITAL_STATUS',
                'ECOA_AGE',
                'ECOA_PUBLIC_ASSISTANCE',
                'MORTGAGE_APPLICATION_RECORD',
                'CREDENTIALS',
            ],
            prohibitedBasisAction: 'BLOCK',
            reasonCodeRequiredOnAdverseAction: true,
        },
        'approval-queue': {
            adverseActionRequiresNamedReviewer: true,
            specificReasonsRequiredBeforeNoticeIssuance: true,
            genericReasonBlocked: true,
            appraisalDeliveryRequiresReview: true,
        },
        'event-bus': {
            adverseAction30DayClockActive: true,
            appraisalThreeBusinessDayClockActive: true,
            prohibitedBasisBlockAlertActive: true,
        },
        'bias-monitor': {
            ecoaDisparateImpactMonitoringRequired: true,
            ecoaDisparateTreatmentMonitoringRequired: true,
            pricingDisparityByProtectedBasisRequired: true,
        },
        'anomaly-detector': {
            proxyDiscriminationDetectionActive: true,
            conflictingReasonCodeDetectionActive: true,
        },
        'attestation-manager': {
            reasonDerivationMethodologyRequired: true,
            creditworthinessModelFactorDocumentationRequired: true,
            spousalSignatureExceptionDocumentationRequired: true,
        },
        'session-persistence': {
            perApplicationAdverseActionClockRequired: true,
            twentyFiveMonthRetentionStateRequired: true,
            jointApplicantInformationTrackingRequired: true,
        },
        'supply-chain': {
            llmProviderProhibitedBasisNonUseAttestation: true,
            creditModelVendorRegBComplianceRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['ECOA-PROHIBITED-BASIS-BLOCK', 'CREDIT-DECISION-EXPLAINABILITY', 'NO-PROHIBITED-BASIS-TRAINING'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'ECOA_PROHIBITED_BASIS',
            'ECOA_RACE',
            'ECOA_COLOR',
            'ECOA_RELIGION',
            'ECOA_NATIONAL_ORIGIN',
            'ECOA_SEX',
            'ECOA_MARITAL_STATUS',
            'ECOA_AGE',
            'ECOA_PUBLIC_ASSISTANCE',
            'MORTGAGE_APPLICATION_RECORD',
            'CREDENTIALS',
        ],
        categoryActions: {
            ECOA_PROHIBITED_BASIS: 'BLOCK',
            ECOA_RACE: 'BLOCK',
            ECOA_COLOR: 'BLOCK',
            ECOA_RELIGION: 'BLOCK',
            ECOA_NATIONAL_ORIGIN: 'BLOCK',
            ECOA_SEX: 'BLOCK',
            ECOA_MARITAL_STATUS: 'BLOCK',
            ECOA_AGE: 'BLOCK',
            ECOA_PUBLIC_ASSISTANCE: 'BLOCK',
            MORTGAGE_APPLICATION_RECORD: 'LOG',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        // 25 months for consumer credit applications per 12 CFR §1002.12(b)(3).
        // Business credit: 12 months (§1002.12(b)(2)). Pack defaults to 25 months
        // (consumer) as the conservative floor; tenants serving only business credit
        // may configure 12-month override.
        auditLogRetentionDays: 760, // 25 months
        sessionRetentionDays: 760,
        incidentRetentionDays: 760,
        reference: 'Reg B 12 CFR §1002.12(b)(3) -- 25 months retention for consumer credit applications from date of action taken. 12 months for business credit per §1002.12(b)(2).',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us'],
    },
    incidentPolicy: {
        // 30-day adverse action notification is the primary statutory clock.
        // 72h internal escalation for prohibited-basis violation discoveries.
        notificationDeadlineHours: 720, // 30 days (applicant notification)
        reference: 'ECOA 15 USC §1691(d); Reg B 12 CFR §1002.9(a)(1) -- adverse action notice within 30 days of completed application or action taken.',
        requiredRecipients: ['applicant', 'creditor-compliance-officer', 'cfpb-if-investigated'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'ecoa-prohibited-basis-block',
            description: 'All Reg B prohibited bases (race, color, religion, national origin, sex, marital status, age, public assistance, CCPA exercise) blocked from credit-decision LLMs',
            reference: 'ECOA 15 USC §1691(a); Reg B 12 CFR §1002.4(b)',
            check: 'ecoa_prohibited_basis_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ecoa-specific-reasons-required',
            description: 'Adverse action notices include specific top principal reasons; generic rationale blocked',
            reference: 'Reg B 12 CFR §1002.9(a)(2); CFPB Circular 2023-03',
            check: 'cfpb_generic_blocked_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ecoa-named-reviewer-required',
            description: 'Named-reviewer attribution logged for every adverse-action credit decision',
            reference: 'Reg B 12 CFR §1002.9 (adverse action); §1002.12 (record keeping)',
            check: 'ecoa_named_reviewer_required_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ecoa-adverse-action-30-day',
            description: '30-day adverse action notification clock tracked per application',
            reference: 'ECOA 15 USC §1691(d); Reg B 12 CFR §1002.9(a)(1)',
            check: 'cfpb_adverse_deadline_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ecoa-disparate-impact-monitoring',
            description: 'Disparate impact and disparate treatment monitoring on credit decisions, pricing, and offers',
            reference: 'ECOA 15 USC §1691; Reg B 12 CFR §1002.6(a)',
            check: 'bias_monitor_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ecoa-proxy-detection',
            description: 'Proxy discrimination detection (zip-code, surname proxies) in LLM credit-decision prompts',
            reference: 'Reg B 12 CFR §1002.6; CFPB Circular 2023-03',
            check: 'ecoa_proxy_detection_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ecoa-appraisal-delivery-clock',
            description: 'Appraisal / home-valuation delivery within 3 business days of receipt tracked',
            reference: 'Reg B 12 CFR §1002.14(a)(1)',
            check: 'ecoa_appraisal_delivery_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ecoa-25-month-retention',
            description: 'Consumer credit application records retained for minimum 25 months',
            reference: 'Reg B 12 CFR §1002.12(b)(3)',
            check: 'ecoa_retention_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'ecoa-creditworthiness-methodology',
            description: 'AI creditworthiness model factor documentation on file; reason-derivation methodology attested',
            reference: 'Reg B 12 CFR §1002.6(b)(8); CFPB Circular 2023-03',
            check: 'cfpb_methodology_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'ecoa-audit-trail',
            description: 'Tamper-evident audit trail for adverse-action decisions and prohibited-basis block events',
            reference: 'Reg B 12 CFR §1002.12 (record keeping)',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=ecoa.js.map