"use strict";
/**
 * PIPEDA -- Federal Canada Privacy Pack
 *
 * Split notice: Quebec Law 25 was previously bundled with PIPEDA in
 * `src/packs/pipeda.ts`. Split per Thomas's 2026-04-24 principle: one
 * country, one regulation, one pack. Federal CA (PIPEDA, OPC-enforced) and
 * provincial QC (Law 25, CAI-enforced) are distinct jurisdictions with
 * distinct enforcers.
 *
 * Cross-pack interaction: when both ca-pipeda and ca-qc-law25 are active
 * (Quebec resident's data held by a federally-regulated organization),
 * strictest-wins applies. Quebec Law 25's enhanced consent requirements
 * (explicit opt-in, high-risk PIA gate, s. 12.1 ADM information disclosure)
 * typically govern the data-handling side because they are stricter than
 * PIPEDA Principles 3-4 defaults. PIPEDA governs inter-provincial transfer
 * obligations and OPC enforcement pathway. Both breach clocks run in
 * parallel; the first deadline governs.
 *
 * Personal Information Protection and Electronic Documents Act
 * (SC 2000, c 5) -- the active federal Canadian privacy law. Bill
 * C-27 (Digital Charter Implementation Act 2022 / CPPA / AIDA /
 * PIDPTA) was WITHDRAWN in January 2025 due to Parliament prorogation.
 *
 * Standards referenced:
 *   - PIPEDA (SC 2000, c 5)
 *   - PIPEDA Schedule 1 (10 Fair Information Principles)
 *   - Breach of Security Safeguards Regulations (SOR/2018-64,
 *     effective 1 Nov 2018)
 *   - Alberta PIPA + BC PIPA (substantially-similar provincial laws)
 *   - OPC 2025 guidance on generative AI
 *   - OPC Accountability Guidelines
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.CA_PIPEDA_PACK = exports.CA_PIPEDA_CATEGORY_CLASSIFIERS = void 0;
/**
 * CA PIPEDA category classifiers.
 * Covers Canadian personal information (federal scope), sensitive personal
 * information (F-NEW-VERA-PACK-C2-05: health/financial/employment at BLOCK
 * per OPC heightened-protection guidance), and credentials.
 */
exports.CA_PIPEDA_CATEGORY_CLASSIFIERS = {
    CA_PIPEDA_PERSONAL_INFO: {
        references: ['PIPEDA Schedule 1 -- personal information; any information about an identifiable individual'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            // Canadian SIN (Social Insurance Number)
            if (/\b\d{3}[-\s]\d{3}[-\s]\d{3}\b/.test(input))
                return true;
            // Canadian postal code
            if (/\b[A-Za-z]\d[A-Za-z]\s?\d[A-Za-z]\d\b/.test(input))
                return true;
            if (/\b(?:social\s+insurance\s+number|SIN|canadian\s+passport|provincial\s+health\s+card|provincial\s+id)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * F-NEW-VERA-PACK-C2-05: Sensitive personal information under OPC guidance.
     * Health records, financial account numbers, and employment records receive
     * heightened protection beyond generic PIPEDA personal information. Action
     * is BLOCK to align with OPC guidance on sensitive data categories.
     */
    SENSITIVE_PERSONAL_INFO_CA: {
        references: [
            'OPC 2025 guidance on generative AI -- heightened protection for health, financial, and employment records',
            'PIPEDA Schedule 1 Principle 4 -- purpose limitation; Principle 7 -- safeguards',
        ],
        classifier: (input) => {
            // Health records -- English (word-boundary safe)
            if (/\b(?:health\s+record|medical\s+record|diagnostic\s+report|patient\s+file|mental\s+health\s+record)\b/i.test(input))
                return true;
            // Health records -- French (accented chars; \b unreliable after non-ASCII, use case-insensitive substring match)
            if (/dossier\s+de\s+sant[eé]/i.test(input))
                return true;
            if (/dossier\s+m[eé]dical/i.test(input))
                return true;
            // Prescription and lab results -- English and French
            if (/\b(?:prescription|lab\s+result)\b/i.test(input))
                return true;
            if (/ordonnance\s+m[eé]dicale?/i.test(input) || /r[eé]sultat\s+de\s+laboratoire/i.test(input))
                return true;
            // Financial account numbers -- English (word-boundary safe)
            if (/\b(?:bank\s+account\s+number|account\s+no\.?\s*\d{6,})\b/i.test(input))
                return true;
            // Financial account numbers -- French (accented)
            if (/num[eé]ro\s+de\s+compte\s+bancaire/i.test(input))
                return true;
            // Canadian credit card pattern (Visa/MC/Amex 13-16 digits)
            if (/\b(?:4\d{12}(?:\d{3})?|5[1-5]\d{14}|3[47]\d{13}|6(?:011|5\d{2})\d{12})\b/.test(input))
                return true;
            if (/\b(?:credit\s+card\s+(?:number|no\.?))\b/i.test(input))
                return true;
            if (/carte\s+de\s+cr[eé]dit/i.test(input))
                return true;
            // Employment records -- English (word-boundary safe)
            if (/\b(?:employment\s+record|employee\s+file|performance\s+review|personnel\s+file|payroll\s+record|compensation\s+(?:data|record))\b/i.test(input))
                return true;
            // Employment records -- French (accented)
            if (/dossier\s+d['']\s*emploi/i.test(input) || /dossier\s+d['']\s*employ[eé]/i.test(input))
                return true;
            if (/salaire\s+donn[eé]es/i.test(input) || /salaire\s+dossier/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['PIPEDA Principle 7 -- safeguards; technical security measures for personal information'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.CA_PIPEDA_PACK = {
    categoryClassifiers: exports.CA_PIPEDA_CATEGORY_CLASSIFIERS,
    /** P3.5: Canadian personal information is subject-keyed per PIPEDA Schedule 1. */
    subjectKeyedCategories: ['CA_PIPEDA_PERSONAL_INFO', 'SENSITIVE_PERSONAL_INFO_CA'],
    id: 'ca-pipeda',
    name: 'PIPEDA (Canada -- Federal)',
    version: '1.0.0',
    contentHash: '3158c900b1ec7f33a19abf07e17f1aa077752f14b94c23ffd8287610c64baea8',
    description: 'Canadian federal PIPEDA (SC 2000, c 5) compliance. OPC-enforced. Bill C-27 (CPPA/AIDA) withdrawn Jan 2025. OPC 2025 guidance on generative AI extended. For Quebec-resident data additionally activate ca-qc-law25.',
    authority: 'Office of the Privacy Commissioner of Canada (OPC)',
    industries: ['all-ca', 'saas', 'fintech', 'healthcare-ca', 'ecommerce', 'federal-works'],
    requiredModules: [
        { name: 'governance-runtime', required: true, reason: 'Meaningful consent per identifiable purpose (PIPEDA Principle 3)', reference: 'PIPEDA Schedule 1 Principle 3' },
        { name: 'audit-integrity', required: true, reason: 'Processing records + breach log retention', reference: 'PIPEDA Principle 1; Breach Regulation s. 6' },
        { name: 'data-classifier', required: true, reason: 'CA_PIPEDA_PERSONAL_INFO classification', reference: 'PIPEDA Principle 4' },
        { name: 'session-persistence', required: true, reason: 'Consent withdrawal continuity + DSR state', reference: 'PIPEDA Principle 3' },
        { name: 'supply-chain', required: true, reason: 'Cross-border transfer contractual safeguards', reference: 'OPC Accountability Guidelines' },
        { name: 'approval-queue', required: true, reason: 'Withdrawn-CPPA/AIDA guard + high-risk processing review', reference: 'Bill C-27 withdrawal Jan 2025' },
        { name: 'attestation-manager', required: true, reason: 'Privacy Management Program + accountable individual', reference: 'PIPEDA Principle 1; OPC Accountability Guidelines' },
        { name: 'data-subject-rights', required: true, reason: 'Access (Principle 9) + correction (Principle 9) + challenge (Principle 10)', reference: 'PIPEDA Principles 9, 10' },
        { name: 'event-bus', required: true, reason: 'RROSH breach notification clock to OPC + individuals', reference: 'PIPEDA + Breach Regulation 2018' },
    ],
    moduleConfig: {
        'governance-runtime': {
            meaningfulConsentRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['CA_PIPEDA_PERSONAL_INFO', 'SENSITIVE_PERSONAL_INFO_CA', 'CREDENTIALS'],
            // F-NEW-VERA-PACK-C2-05: sensitive personal info (health/financial/employment)
            // blocked per OPC heightened-protection guidance.
            sensitivePiiCaAction: 'BLOCK',
        },
        'session-persistence': {
            consentWithdrawalSupportRequired: true,
        },
        'supply-chain': {
            crossBorderSafeguardsRequired: true,
        },
        'approval-queue': {
            withdrawnCppaAidaGuardActive: true,
        },
        'attestation-manager': {
            privacyManagementProgramRequired: true,
            accountableIndividualRequired: true,
            breachLogRetentionDays: 730, // 24 months per Breach Regulation s. 6
        },
        'data-subject-rights': {
            responseDeadlineDays: 30, // PIPEDA guidance
            supportedRights: ['ACCESS', 'CORRECTION', 'CHALLENGE_COMPLIANCE'],
        },
        'event-bus': {
            rroshBreachNotificationActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['PIPEDA-READY'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['CA_PIPEDA_PERSONAL_INFO', 'SENSITIVE_PERSONAL_INFO_CA', 'CREDENTIALS'],
        categoryActions: {
            CA_PIPEDA_PERSONAL_INFO: 'WARN',
            // F-NEW-VERA-PACK-C2-05: OPC guidance treats health, financial account, and employment
            // records as heightened-protection categories requiring BLOCK action.
            SENSITIVE_PERSONAL_INFO_CA: 'BLOCK',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['CA'],
        auditLogRetentionDays: 1095, // 3 years default
        sessionRetentionDays: 365,
        incidentRetentionDays: 730, // 24 months per Breach Regulation
        reference: 'PIPEDA + Breach Regulation s. 6 -- breach records retained 24 months minimum; Pax1 default 3 years',
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'PIPEDA -- "as soon as feasible" breach notification to OPC + affected individuals when RROSH present. Pax1 default 72h.',
        requiredRecipients: ['opc', 'accountable-individual', 'affected-individuals'],
        formalNotificationRequired: true,
    },
    validators: [
        { id: 'ca-pipeda-consent', description: 'Meaningful consent per identifiable purpose', reference: 'PIPEDA Schedule 1 Principle 3', check: 'pipeda_consent_active', failSeverity: 'CRITICAL' },
        { id: 'ca-pipeda-collection-limiting', description: 'Collection limited to identified purposes', reference: 'PIPEDA Principle 4', check: 'pipeda_collection_limiting_active', failSeverity: 'HIGH' },
        { id: 'ca-pipeda-accountability', description: 'Accountable individual designated; Privacy Management Program active', reference: 'PIPEDA Principle 1; OPC Accountability Guidelines', check: 'pipeda_accountability_active', failSeverity: 'CRITICAL' },
        { id: 'ca-pipeda-rrosh-breach', description: 'RROSH breach notification to OPC + affected individuals', reference: 'PIPEDA + Breach Regulation', check: 'pipeda_rrosh_breach_active', failSeverity: 'CRITICAL' },
        { id: 'ca-pipeda-breach-log', description: '24-month breach log retention (Breach Regulation s. 6)', reference: 'Breach Regulation s. 6', check: 'pipeda_breach_log_active', failSeverity: 'HIGH' },
        { id: 'ca-pipeda-dsr', description: 'Access + correction + challenge DSR workflow', reference: 'PIPEDA Principles 9, 10', check: 'pipeda_dsr_active', failSeverity: 'HIGH' },
        { id: 'ca-pipeda-cross-border', description: 'Cross-border transfer contractual safeguards', reference: 'OPC Accountability Guidelines', check: 'pipeda_cross_border_active', failSeverity: 'MEDIUM' },
        { id: 'ca-pipeda-withdrawn-c27-guard', description: 'Workflows guarded against CPPA / AIDA provisions not in force', reference: 'Bill C-27 withdrawal Jan 2025', check: 'pipeda_withdrawn_c27_guard_active', failSeverity: 'MEDIUM' },
    ],
};
//# sourceMappingURL=ca-pipeda.js.map