"use strict";
/**
 * FCRA Compliance Pack
 *
 * Fair Credit Reporting Act
 * Authority: CFPB + FTC (15 USC §1681 et seq.)
 *
 * Key statutes enforced:
 *   - §604 (15 USC §1681b): Permissible purposes for consumer report use
 *   - §606 (15 USC §1681d): Disclosure of investigative consumer reports
 *   - §607 (15 USC §1681e): Furnisher accuracy obligations; reseller duties
 *   - §609 (15 USC §1681g): Consumer right to disclosure
 *   - §610 (15 USC §1681h): Conditions for in-person disclosure
 *   - §611 (15 USC §1681i): Dispute procedure (30-day reinvestigation)
 *   - §615 (15 USC §1681m): Requirements on users of consumer reports
 *     -- adverse action notice when consumer report contributed to a denial
 *        or less favourable terms
 *   - §616-617 (15 USC §1681n-1681o): Civil liability (willful / negligent)
 *   - §623 (15 USC §1681s-2): Furnisher obligations
 *
 * LLM-EGRESS PRIMACY RULES (Thomas directive 2026-04-22):
 *   - REQUIRE PERMISSIBLE PURPOSE: consumer report data (credit report,
 *     background check, tenant screen, employment screen) can only reach an
 *     LLM context if the request context declares a permissible purpose per
 *     §604. The pack refuses LLM egress of consumer report data without a
 *     declared permissible-purpose tag.
 *   - BLOCK: reseller- or vendor-sourced consumer report data to LLMs operated
 *     by a different vendor without a documented chain of permissible purpose.
 *   - ENFORCE ADVERSE ACTION NOTICE: any AI decision resulting in adverse action
 *     (denial, higher price, less favourable terms) based on consumer report data
 *     triggers §615 notice requirements to the consumer.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.FCRA_PACK = exports.FCRA_CATEGORY_CLASSIFIERS = void 0;
/**
 * FCRA (Fair Credit Reporting Act, 15 U.S.C. §1681) category classifiers.
 * Governs use of consumer report information. Consumer reports must only be
 * accessed for permissible purposes. Tradelines, derogatory marks, inquiries,
 * and public records in a consumer report context are FCRA-regulated.
 */
exports.FCRA_CATEGORY_CLASSIFIERS = {
    CONSUMER_REPORT_RECORD: {
        references: ['15 U.S.C. §1681a(d) -- consumer report definition; permissible purpose required'],
        classifier: (input) => {
            if (/\b(?:consumer\s+report|credit\s+report|credit\s+(?:file|record|disclosure))\b/i.test(input))
                return true;
            if (/\b(?:FCRA\s+(?:record|data|disclosure)|permissible\s+purpose)\b/i.test(input))
                return true;
            return false;
        },
    },
    FCRA_TRADELINE: {
        references: ['15 U.S.C. §1681s-2 -- tradeline reporting; furnisher accuracy obligations'],
        classifier: (input) => {
            if (/\b(?:tradeline|trade\s+line|credit\s+account\s+(?:history|status|balance|limit))\b/i.test(input))
                return true;
            if (/\b(?:credit\s+utilization|payment\s+history|account\s+standing)\b/i.test(input))
                return true;
            return false;
        },
    },
    FCRA_DEROGATORY_MARK: {
        references: ['15 U.S.C. §1681c -- obsolete information; 7-year and bankruptcy-10-year limits'],
        classifier: (input) => {
            if (/\b(?:derogatory\s+(?:mark|information)|late\s+payment\s+(?:record|history)|collection\s+(?:account|entry))\b/i.test(input))
                return true;
            if (/\b(?:charge.?off|default\s+(?:record|notation)|bankruptcy\s+(?:record|filing|discharge))\b/i.test(input))
                return true;
            return false;
        },
    },
    FCRA_INQUIRY: {
        references: ['15 U.S.C. §1681b -- permissible purpose; hard/soft inquiry distinction'],
        classifier: (input) => {
            if (/\b(?:hard\s+inquiry|soft\s+inquiry|credit\s+inquiry|FCRA\s+inquiry|credit\s+pull)\b/i.test(input))
                return true;
            return false;
        },
    },
    FCRA_PUBLIC_RECORD: {
        references: ['15 U.S.C. §1681c(a) -- public record information; court judgments, tax liens'],
        classifier: (input) => {
            if (/\b(?:public\s+record\s+(?:entry|data)|civil\s+judgment|tax\s+lien|bankruptcy\s+filing|judgment\s+lien)\b/i.test(input))
                return true;
            return false;
        },
    },
    MORTGAGE_APPLICATION_RECORD: {
        references: ['FCRA/ECOA -- mortgage application record subject to consumer report rules'],
        classifier: (input) => {
            if (/\b(?:mortgage\s+(?:application|loan)|credit\s+application|home\s+loan\s+application)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['FCRA -- information security for consumer reporting systems'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
    ADVERSE_ACTION_NOTICE: {
        references: ['15 USC 1681m -- Adverse action notice; FCRA Section 615'],
        classifier: (input) => {
            if (/\badverse\s+action\b/i.test(input) && /\b(notice|notification|required|taken|owed|sent)\b/i.test(input))
                return true;
            if (/\bfcra\s+section\s+615\b/i.test(input))
                return true;
            if (/\bpre[\s-]?adverse\s+(notice|action)\b/i.test(input))
                return true;
            if (/\b(denied|deny|refus(?:e|ed|al))\b/i.test(input) && /\b(credit|employment|application)\b/i.test(input) && /\b(consumer\s+report|credit[\s-]bureau)\b/i.test(input))
                return true;
            if (/\brate\s+increased\b/i.test(input) && /\b(credit[\s-]bureau|consumer\s+report)\b/i.test(input))
                return true;
            return false;
        },
    },
    IDENTITY_THEFT_INDICATOR: {
        references: ['15 USC 1681c-2 -- Identity theft block; FACT Act red flags'],
        classifier: (input) => {
            if (/\bidentity\s+theft\b/i.test(input))
                return true;
            if (/\bfact\s+act\s+red\s+flags?\b/i.test(input))
                return true;
            if (/\bfcra\s+section\s+605b\b/i.test(input))
                return true;
            if (/\bftc\s+identity\s+theft\s+affidavit\b/i.test(input))
                return true;
            if (/\bfraudulent\s+(tradeline|account|inquiry)/i.test(input))
                return true;
            if (/\bsignature\s+mismatch\b/i.test(input))
                return true;
            return false;
        },
    },
    PERMISSIBLE_PURPOSE_VIOLATION: {
        references: ['15 USC 1681b -- Permissible purpose required for consumer report access'],
        classifier: (input) => {
            if (/\bpermissible\s+purpose\s+(violation|missing|not\s+(?:documented|recorded))/i.test(input))
                return true;
            if (/\bwithout\s+(documented\s+)?permissible\s+purpose\b/i.test(input))
                return true;
            if (/\bcredit\s+pull\b/i.test(input) && /\b(without|no|missing)\b/i.test(input) && /\b(purpose|consent|authorization)\b/i.test(input))
                return true;
            if (/\bconsumer\s+report\b/i.test(input) && /\bwithout\b/i.test(input) && /\b(consent|business\s+need|permissible\s+purpose|authorization)\b/i.test(input))
                return true;
            if (/\bno\s+fcra\s+permissible\s+purpose\b/i.test(input))
                return true;
            if (/\bpulled\s+(?:credit|consumer\s+report)\b/i.test(input) && /\b(non[\s-]applicant|marketing\s+purpose)\b/i.test(input))
                return true;
            return false;
        },
    },
};
exports.FCRA_PACK = {
    categoryClassifiers: exports.FCRA_CATEGORY_CLASSIFIERS,
    /** P3.5: Consumer report records and tradelines are inherently subject-keyed per FCRA 15 USC §1681. */
    subjectKeyedCategories: ['CONSUMER_REPORT_RECORD', 'FCRA_TRADELINE', 'MORTGAGE_APPLICATION_RECORD'],
    id: 'fcra',
    /** GAP-S1-01: MT-05 is the site/packs.html public code for this pack. */
    aliases: ['MT-05'],
    name: 'FCRA (Fair Credit Reporting Act)',
    version: '1.0.0',
    contentHash: '207912a1daa0934ace0adbdd7fb19764ec98181874a4f5c8dbad0a52cd876a2d',
    description: 'Fair Credit Reporting Act (15 USC §1681 et seq.) LLM-egress policy. Requires a declared permissible purpose (§604) before consumer report data reaches any LLM context. Blocks cross-vendor consumer report egress without chain-of-purpose documentation. Enforces §615 adverse-action notice generation when AI decisions based on consumer report data produce adverse outcomes. Covers 7-year consumer report data retention, dispute workflow hook, and §623 furnisher obligations.',
    authority: 'Consumer Financial Protection Bureau (CFPB) / Federal Trade Commission (FTC)',
    industries: ['mortgage-lender', 'bank', 'credit-union', 'auto-finance', 'credit-card', 'bnpl', 'fintech-lender', 'insurance', 'employer', 'tenant-screening', 'consumer-reporting-agency'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Permissible-purpose tag enforcement at LLM egress gate; deny-by-default for CONSUMER_REPORT_RECORD data class without declared purpose',
            reference: 'FCRA §604 (15 USC §1681b) -- permissible purposes enumerated; no disclosure without permissible purpose',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect and tag CONSUMER_REPORT_RECORD data class; identify tradeline data, derogatory marks, inquiries, and public-record items in LLM prompts',
            reference: 'FCRA §603 (15 USC §1681a) -- "consumer report" definition; §604 permissible-purpose gating',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident record of all consumer-report LLM egress events, permissible-purpose declarations, adverse-action notices, and dispute workflows',
            reference: 'FCRA §607(b) (reasonable procedures); CFPB FCRA examination procedures (7-year record standard)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Permissible-purpose review gate before consumer report data enters LLM context; §615 adverse-action notice generation review; dispute reinvestigation gate',
            reference: 'FCRA §604 (15 USC §1681b); §611 (15 USC §1681i) (30-day dispute)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Adverse action notice generation event; §611 30-day dispute reinvestigation clock; §615 consumer notification event; furnisher monthly update events',
            reference: 'FCRA §611 (15 USC §1681i) -- 30-day reinvestigation; §615 (15 USC §1681m) adverse action notice',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-consumer permissible-purpose state; dispute workflow state across agent restarts; adverse-action clock tracking',
            reference: 'FCRA §611 (30-day reinvestigation window); §604 (permissible-purpose context)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Consumer reporting agency (CRA) contract management; reseller chain-of-purpose documentation; vendor CRA agreements per §607(e) and §616-617 liability exposure',
            reference: 'FCRA §607(e) (15 USC §1681e(e)) -- reseller requirements; §616-617 joint liability',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Required consumer disclosure when adverse action is based on consumer report; CRA identity disclosure in adverse-action notice',
            reference: 'FCRA §615(a)(1) (15 USC §1681m(a)(1)) -- adverse action notice with CRA name, address, phone',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detect permissible-purpose evasion in LLM prompts; identify when consumer report data is being accessed without a valid purpose context',
            reference: 'FCRA §604 (15 USC §1681b); §616 civil liability for willful non-compliance',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'CRA agreement attestation; permissible-purpose policy documentation; furnisher accuracy program documentation per §623',
            reference: 'FCRA §607(b) (reasonable procedures); §623 (15 USC §1681s-2) furnisher accuracy obligations',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Detect disparate impact in AI-driven consumer report decisions; monitor for proxy discrimination across protected classes in credit/employment/tenant screening contexts',
            reference: 'FCRA §604(b)(3) (15 USC §1681b) -- employment screening; ECOA/Reg B disparate impact; CFPB guidance on algorithmic credit decisions',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            // Core egress rule: consumer report data requires a declared permissible purpose
            consumerReportPermissiblePurposeRequired: true,
            permissiblePurposes: [
                'credit_transaction_initiated_by_consumer',
                'credit_review',
                'collection_of_account',
                'employment_certification',
                'insurance_underwriting',
                'tenant_screening',
                'child_support_enforcement',
                'legitimate_business_need',
                'consumer_written_consent',
            ],
            crossVendorConsumerReportBlockWithoutPurposeChain: true,
            adverseActionNoticeRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'CONSUMER_REPORT_RECORD',
                'FCRA_TRADELINE',
                'FCRA_DEROGATORY_MARK',
                'FCRA_INQUIRY',
                'FCRA_PUBLIC_RECORD',
                'MORTGAGE_APPLICATION_RECORD',
                'CREDENTIALS',
            ],
            consumerReportAction: 'BLOCK_WITHOUT_PERMISSIBLE_PURPOSE',
            crossVendorConsumerReportAction: 'BLOCK_WITHOUT_PURPOSE_CHAIN',
        },
        'approval-queue': {
            permissiblePurposeReviewRequired: true,
            section615AdverseActionNoticeRequired: true,
            disputeReinvestigationGateRequired: true,
            craIdentityDisclosureOnAdverseAction: true,
        },
        'event-bus': {
            fcra615AdverseActionNoticeEventActive: true,
            fcra611DisputeReinvestigation30DayClockActive: true,
            furnisherMonthlyUpdateActive: true,
        },
        'bias-monitor': {
            consumerReportDecisionDisparityMonitoringRequired: true,
        },
        'anomaly-detector': {
            permissiblePurposeEvasionDetectionActive: true,
            unpurposedConsumerReportAccessDetectionActive: true,
        },
        'attestation-manager': {
            craAgreementAttestationRequired: true,
            permissiblePurposePolicyRequired: true,
            furnisherAccuracyProgramRequired: true,
            section623ComplianceProgramRequired: true,
        },
        'session-persistence': {
            perConsumerPermissiblePurposeStateRequired: true,
            disputeWorkflowStateRequired: true,
            adverseActionClockRequired: true,
        },
        'supply-chain': {
            craContractManagementRequired: true,
            resellerPurposeChainDocumentationRequired: true,
            vendorCraAgreementRequired: true,
        },
        'transparency-injector': {
            section615AdverseActionCraDisclosureRequired: true,
            consumerRightsDisclosureRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['FCRA-PERMISSIBLE-PURPOSE-TAG', 'NO-CONSUMER-REPORT-TRAINING', 'ADVERSE-ACTION-NOTICE'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'CONSUMER_REPORT_RECORD',
            'FCRA_TRADELINE',
            'FCRA_DEROGATORY_MARK',
            'FCRA_INQUIRY',
            'FCRA_PUBLIC_RECORD',
            'MORTGAGE_APPLICATION_RECORD',
            'CREDENTIALS',
            'ADVERSE_ACTION_NOTICE',
            'IDENTITY_THEFT_INDICATOR',
            'PERMISSIBLE_PURPOSE_VIOLATION',
        ],
        categoryActions: {
            CONSUMER_REPORT_RECORD: 'BLOCK',
            FCRA_TRADELINE: 'BLOCK',
            FCRA_DEROGATORY_MARK: 'BLOCK',
            FCRA_INQUIRY: 'BLOCK',
            FCRA_PUBLIC_RECORD: 'BLOCK',
            MORTGAGE_APPLICATION_RECORD: 'LOG',
            CREDENTIALS: 'BLOCK',
            ADVERSE_ACTION_NOTICE: 'WARN',
            IDENTITY_THEFT_INDICATOR: 'BLOCK',
            PERMISSIBLE_PURPOSE_VIOLATION: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // FCRA does not specify a floor for creditor/user retention. The credit
        // bureau standard is 7 years for most negative items (§605, 15 USC §1681c).
        // CFPB examination practice expects user records retained 7 years.
        // TODO verify with Vera: specific user-side retention floor under FCRA vs CFPB guidance.
        auditLogRetentionDays: 2555, // 7 years
        sessionRetentionDays: 2555,
        incidentRetentionDays: 2555,
        reference: 'FCRA §605 (15 USC §1681c) -- 7-year consumer report item retention (bureau standard); CFPB examination procedures align user-side retention to 7 years.',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us'],
    },
    incidentPolicy: {
        // No specific statutory consumer notification for FCRA data breaches; GLBA
        // and state law govern. §615 adverse action notices must go to consumers.
        // 72h internal escalation for permissible-purpose violation discoveries.
        notificationDeadlineHours: 72,
        reference: 'FCRA §615 (15 USC §1681m) -- adverse action notice promptly to consumer; §611 (15 USC §1681i) -- 30-day dispute reinvestigation; 72h internal escalation for permissible-purpose violations.',
        requiredRecipients: ['consumer-if-adverse-action', 'compliance-officer', 'general-counsel', 'cfpb-if-investigated'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'fcra-permissible-purpose-tag',
            description: 'Consumer report data blocked from LLM context without a declared permissible purpose per §604',
            reference: 'FCRA §604 (15 USC §1681b) -- exhaustive list of permissible purposes',
            check: 'fcra_permissible_purpose_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fcra-cross-vendor-block',
            description: 'Cross-vendor consumer report data blocked without documented chain of permissible purpose',
            reference: 'FCRA §607(e) (15 USC §1681e(e)) -- reseller permissible-purpose chain; §616-617 joint liability',
            check: 'fcra_cross_vendor_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fcra-615-adverse-action-notice',
            description: 'AI adverse decisions based on consumer report trigger §615 adverse-action notice to consumer with CRA identity',
            reference: 'FCRA §615(a) (15 USC §1681m(a)) -- adverse action notice with CRA name, address, phone; consumer rights disclosure',
            check: 'fcra_615_adverse_action_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fcra-dispute-workflow',
            description: '§611 30-day consumer dispute reinvestigation workflow hooked into approval queue',
            reference: 'FCRA §611 (15 USC §1681i) -- 30-day reinvestigation deadline',
            check: 'fcra_dispute_workflow_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fcra-furnisher-accuracy',
            description: '§623 furnisher accuracy program documented; monthly update obligations tracked',
            reference: 'FCRA §623 (15 USC §1681s-2) -- furnisher accuracy obligations',
            check: 'fcra_furnisher_accuracy_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fcra-cra-contract',
            description: 'Consumer reporting agency contract attestation on file for every CRA providing data',
            reference: 'FCRA §607(e) (15 USC §1681e(e)); §616-617 (civil liability)',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fcra-permissible-purpose-evasion',
            description: 'Anomaly detection active for permissible-purpose evasion in LLM prompts',
            reference: 'FCRA §604 (15 USC §1681b); §616 (willful non-compliance civil liability)',
            check: 'fcra_purpose_evasion_detection_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fcra-7-year-retention',
            description: 'Consumer report records retained for minimum 7 years; audit trail covers all egress decisions',
            reference: 'FCRA §605 (15 USC §1681c) -- 7-year item retention; CFPB examination standard',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'fcra-consumer-disclosure',
            description: 'Consumer rights disclosure injected on adverse action; CRA identity included per §615',
            reference: 'FCRA §615(a)(1) (15 USC §1681m(a)(1))',
            check: 'fcra_consumer_disclosure_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'fcra-decision-disparity-monitoring',
            description: 'Disparity monitoring on consumer-report-based decisions across protected classes',
            reference: 'ECOA 15 USC §1691; FCRA §616-617 (civil liability); CFPB fair-lending examination',
            check: 'bias_monitor_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=fcra.js.map