"use strict";
/**
 * StateRAMP Compliance Pack
 *
 * StateRAMP is the state government equivalent of FedRAMP. Established
 * by the StateRAMP PMO (non-profit, founded 2021). As of 2026, 20+
 * US states have adopted or are piloting StateRAMP as their cloud
 * security authorisation framework.
 *
 * StateRAMP mirrors NIST SP 800-53 Rev 5 controls with three impact
 * baselines matching FedRAMP:
 *   - Low: 125 controls
 *   - Moderate: 325 controls (most state AI services land here)
 *   - High: 421 controls (critical state infrastructure, criminal justice)
 *
 * Key differences from FedRAMP:
 *   - StateRAMP Authorized List (vs FedRAMP Marketplace): state
 *     procurement officers check StateRAMP status.
 *   - Reciprocity with FedRAMP: FedRAMP-Authorized products receive
 *     StateRAMP Ready status with reduced review requirements.
 *   - State-specific data residency: many adopting states require
 *     data to remain in-state or within the US.
 *   - CJIS-adjacent: criminal justice AI systems in state government
 *     must also comply with CJIS (separate pack: cjis.ts).
 *   - State privacy laws: state AI systems may also be subject to
 *     state privacy laws (CCPA, Colorado AI Act, etc.).
 *
 * AI-specific considerations:
 *   - OMB state-analog guidance on AI: states that have adopted NIST
 *     AI RMF or ISO 42001 as their AI governance standard (and many
 *     have per EO 14110 state-level implementation guidance) layer
 *     those requirements on top of StateRAMP security controls.
 *   - Model provenance: state procurement increasingly requires
 *     software bill of materials (SBOM) for AI systems.
 *   - Continuous monitoring: StateRAMP ConMon is monthly (same as
 *     FedRAMP Moderate).
 *
 * Sovereignty: US State governments. No single federal statute.
 * Adopting states include: TX, OK, CO, AZ, IN, OH, MI, FL, GA and others.
 *
 * OPERATOR_VERIFICATION_REQUIRED (F-NEW-VERA-PACK-C5-03, 2026-05-03):
 * The list of StateRAMP-adopting states changes quarterly as new states
 * join the program. The enumerated states above reflect the StateRAMP PMO
 * published list at time of pack authoring (2026). Operators MUST verify
 * the current list of adopting states directly with the StateRAMP PMO
 * (stateramp.org/authorized) before deployment and before each renewal
 * cycle. StateRAMP authorisation requirements and reciprocity agreements
 * with individual states are also subject to change. Confirm applicability
 * to your specific state procurement context with counsel.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.STATERAMP_PACK = exports.STATERAMP_CATEGORY_CLASSIFIERS = void 0;
/**
 * StateRAMP (State Risk and Authorization Management Program) category classifiers.
 * State-level cloud security framework mirroring FedRAMP for state/local government.
 */
exports.STATERAMP_CATEGORY_CLASSIFIERS = {
    STATE_SENSITIVE: {
        references: ['StateRAMP Moderate baseline -- state sensitive data handling'],
        classifier: (input) => {
            if (/\b(?:state\s+(?:sensitive|government|agency)\s+(?:data|record|information)|state\s+benefit\s+record)\b/i.test(input))
                return true;
            if (/\b(?:state\s+tax\s+(?:record|return|ID)|state\s+license\s+(?:number|record))\b/i.test(input))
                return true;
            return false;
        },
    },
    CUI: {
        references: ['StateRAMP -- CUI handling requirements mirroring NIST SP 800-171'],
        classifier: (input) => {
            if (/\b(?:CUI|controlled\s+unclassified\s+information|for\s+official\s+use\s+only|FOUO)\b/.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['StateRAMP -- PII of state residents; state privacy law alignment'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:drivers?\s+license\s+(?:number|#)|state\s+ID\s+(?:number|#))\b/i.test(input))
                return true;
            return false;
        },
    },
    CJIS_ADJACENT: {
        references: ['StateRAMP -- Criminal Justice Information adjacent; law enforcement data in state systems'],
        classifier: (input) => {
            if (/\b(?:criminal\s+(?:history|record|justice\s+information)|CJI|NCIC|CJIS)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['StateRAMP -- access management; NIST SP 800-53 IA-5 authenticator management'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.STATERAMP_PACK = {
    categoryClassifiers: exports.STATERAMP_CATEGORY_CLASSIFIERS,
    id: 'stateramp',
    name: 'StateRAMP',
    version: '1.0.0',
    contentHash: 'd3987f57eaee7e5c882fbcc72e652c3e976777e13b7763363616c0d58a12087b',
    description: 'StateRAMP (state government cloud security authorisation) compliance for AI systems serving US state agencies. Mirrors NIST SP 800-53 Rev 5 Moderate baseline (325 controls). Covers StateRAMP Authorized List path, FedRAMP reciprocity, Continuous Monitoring (ConMon), state data-residency requirements, SBOM for AI models, and state-specific AI governance overlays (NIST AI RMF / ISO 42001 as applicable).',
    authority: 'StateRAMP PMO (non-profit); participating state CIOs and CISOs',
    industries: ['government', 'state-agency', 'govtech', 'cloud-services', 'public-safety'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Least-privilege access (AC-6); account management (AC-2); deny-by-default; policy-based access control',
            reference: 'NIST SP 800-53 Rev 5 AC-2, AC-3, AC-6; StateRAMP Moderate baseline',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Audit event logging (AU-2, AU-12); tamper-evident trail; StateRAMP ConMon audit evidence',
            reference: 'NIST SP 800-53 Rev 5 AU-2, AU-12; StateRAMP ConMon requirements',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'FIPS 140-2/3 validated encryption of state data at rest and in transit',
            reference: 'NIST SP 800-53 Rev 5 SC-28, SC-8; StateRAMP encryption requirements',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'State-classified data detection; PII detection; CUI detection; CJIS-adjacent data tagging',
            reference: 'NIST SP 800-53 Rev 5 RA-2; state data classification policies',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'MFA for all state agency user and privileged access; unique agent identification',
            reference: 'NIST SP 800-53 Rev 5 IA-2, IA-5; StateRAMP IA controls',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'AI model SBOM; vendor supply chain risk management (SR-3, SR-5); StateRAMP authorised-list verification',
            reference: 'NIST SP 800-53 Rev 5 SR-3, SR-5; StateRAMP Marketplace verification',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Continuous monitoring event stream; monthly ConMon reporting; incident detection and reporting',
            reference: 'NIST SP 800-53 Rev 5 CA-7; StateRAMP ConMon requirements',
        },
        {
            name: 'circuit-breaker',
            required: true,
            reason: 'Incident isolation; system integrity protection during security events',
            reference: 'NIST SP 800-53 Rev 5 IR-4; StateRAMP incident response',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'StateRAMP authorization evidence package; monthly ConMon reports; annual assessment scheduling',
            reference: 'StateRAMP Authorization Lifecycle; NIST SP 800-53 Rev 5 CA-2, CA-5',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Change management approval (CM-3); significant change notification to state authorizing official',
            reference: 'NIST SP 800-53 Rev 5 CM-3; StateRAMP significant change policy',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'STATE_SENSITIVE',
                'CUI',
                'PII',
                'CJIS_ADJACENT',
                'CREDENTIALS',
            ],
            stateSensitiveAction: 'BLOCK_UNLESS_AUTHORISED',
            cjisAdjacentAction: 'BLOCK',
        },
        'encryption-layer': {
            fips140ValidatedRequired: true,
            stateDataResidencyRequired: true,
        },
        'agent-auth': {
            mfaForAllStateAccess: true,
            uniqueAgentIdentificationRequired: true,
        },
        'governance-runtime': {
            leastPrivilegeEnforced: true,
            denyByDefaultRequired: true,
        },
        'supply-chain': {
            aiModelSbomRequired: true,
            staterampMarketplaceVerificationRequired: true,
            fedrampReciprocityCheckRequired: true,
        },
        'event-bus': {
            continuousMonitoringRequired: true,
            monthlyConMonReportingRequired: true,
        },
        'attestation-manager': {
            staterampAuthorizationEvidenceRequired: true,
            annualPenetrationTestRequired: true,
            penetrationTestCadenceDays: 365,
            vulnerabilityScanCadenceDays: 30,
            poamManagementRequired: true,
        },
        'approval-queue': {
            significantChangeApprovalRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['STATERAMP-AUTHORISED-OR-FEDRAMP', 'FIPS-140-VALIDATED', 'DATA-RESIDENCY-US'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['STATE_SENSITIVE', 'CUI', 'PII', 'CJIS_ADJACENT', 'CREDENTIALS'],
        categoryActions: {
            STATE_SENSITIVE: 'BLOCK',
            CUI: 'BLOCK',
            PII: 'WARN',
            CJIS_ADJACENT: 'BLOCK',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM-FIPS',
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // NIST SP 800-53 Rev 5 AU-11: 3-year minimum for Moderate baseline.
        auditLogRetentionDays: 1095,
        sessionRetentionDays: 1095,
        incidentRetentionDays: 1095,
        reference: 'NIST SP 800-53 Rev 5 AU-11 (3-year retention); StateRAMP Moderate baseline',
    },
    incidentPolicy: {
        // StateRAMP follows FedRAMP incident reporting: US-CERT notification within 1 hour for federal data;
        // state incident response plans typically require notification within 4 hours to state CISO.
        notificationDeadlineHours: 4,
        reference: 'StateRAMP Incident Response requirements; NIST SP 800-53 Rev 5 IR-6; state CISO notification (4-hour typical)',
        requiredRecipients: ['stateramp-pmo', 'state-ciso', 'agency-isso', 'state-authorizing-official'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'stateramp-fips-encryption',
            description: 'FIPS 140-2/3 validated encryption active for state data at rest and in transit',
            reference: 'NIST SP 800-53 Rev 5 SC-28, SC-8; StateRAMP encryption requirements',
            check: 'encryption_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'stateramp-mfa',
            description: 'MFA active for all state agency access',
            reference: 'NIST SP 800-53 Rev 5 IA-2; StateRAMP IA controls',
            check: 'stateramp_mfa_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'stateramp-audit-trail',
            description: 'Tamper-evident audit trail active for AI system events',
            reference: 'NIST SP 800-53 Rev 5 AU-2, AU-12',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'stateramp-conmon',
            description: 'Continuous monitoring stream active; monthly ConMon reporting configured',
            reference: 'NIST SP 800-53 Rev 5 CA-7; StateRAMP ConMon requirements',
            check: 'stateramp_conmon_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'stateramp-supply-chain',
            description: 'StateRAMP/FedRAMP marketplace verification and AI model SBOM active',
            reference: 'NIST SP 800-53 Rev 5 SR-3, SR-5; StateRAMP Marketplace',
            check: 'stateramp_supply_chain_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'stateramp-least-privilege',
            description: 'Least-privilege access enforced for all AI agent identities in state systems',
            reference: 'NIST SP 800-53 Rev 5 AC-6',
            check: 'governance_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'stateramp-change-management',
            description: 'Significant change approval and notification workflow active',
            reference: 'NIST SP 800-53 Rev 5 CM-3; StateRAMP significant change policy',
            check: 'change_management_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'stateramp-annual-pentest',
            description: 'Annual penetration test scheduled',
            reference: 'NIST SP 800-53 Rev 5 CA-8; StateRAMP Annual Assessment',
            check: 'stateramp_annual_pentest_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'stateramp-data-classifier',
            description: 'State-sensitive and CJIS-adjacent data classified and access controlled',
            reference: 'NIST SP 800-53 Rev 5 RA-2; state data classification policies',
            check: 'data_classifier_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=stateramp.js.map