/**
 * Colorado AI Act Compliance Pack
 *
 * Colorado Artificial Intelligence Act (SB 24-205), codified at
 * Colo. Rev. Stat. §6-1-1701 et seq. Effective 1 February 2026 --
 * the first comprehensive US state AI law in force.
 *
 * Regulates both DEVELOPERS (organisations that build or substantially
 * modify a high-risk AI system placed on the Colorado market) and
 * DEPLOYERS (organisations using the system to make consequential
 * decisions) when the system makes or is a substantial factor in
 * making a "consequential decision" affecting a Colorado consumer.
 *
 * Consequential decision domains (§6-1-1701(3)):
 *   - education enrolment or educational opportunity
 *   - employment or employment opportunity
 *   - financial or lending service
 *   - essential government service
 *   - healthcare service
 *   - housing
 *   - insurance
 *   - legal service
 *
 * Developer duties (§6-1-1702):
 *   - reasonable care to protect consumers from known or reasonably
 *     foreseeable algorithmic discrimination risks
 *   - statement to deployers covering purpose, intended uses,
 *     benefits/harms, data characterisation, evaluation (incl. bias
 *     testing), and governance measures
 *   - disclose discovered discrimination to Colorado AG and to known
 *     deployers within 90 days
 *
 * Deployer duties (§6-1-1703):
 *   - reasonable care
 *   - risk management policy and program (may follow NIST AI RMF or
 *     ISO/IEC 42001)
 *   - impact assessment annually and within 90 days of material
 *     modification
 *   - notice to consumer when a high-risk system is used for a
 *     consequential decision
 *   - when the outcome is adverse: statement of principal reasons,
 *     opportunity to correct data, opportunity to appeal to a human
 *     reviewer (when not infeasible)
 *   - public statement about high-risk systems in use and risk-
 *     management practices
 *   - disclose discovered discrimination to Colorado AG within 90 days
 *
 * Exemptions (§6-1-1703(6)):
 *   - small deployer (<50 FTE) under limited conditions
 *   - insurance sector (separate CO insurance regulation)
 *   - HIPAA-covered entities for specific healthcare decisions
 *
 * Affirmative defence (§6-1-1706): substantial compliance with a
 * recognised AI risk management framework (NIST AI RMF, ISO/IEC
 * 42001). This pack binds activation to require at least one of
 * those packs also active so the affirmative-defence posture is
 * automatic.
 *
 * Enforcement: Colorado Attorney General only. No private right of
 * action.
 *
 * @connexum/ai-governance
 */
import { sharedPiiClassifier } from './_base-classifiers.js';
/**
 * Colorado AI Act (SB 24-205) category classifiers.
 * The Act governs high-risk AI system consequential decisions affecting
 * Colorado residents. Classification enforces PII/PHI scanning required
 * for impact assessment (§6-1-1703) and credential protection.
 */
export const COLORADO_AI_CATEGORY_CLASSIFIERS = {
    CONSEQUENTIAL_DECISION_CO: {
        references: [
            'Colo. Rev. Stat. §6-1-1701(3) -- consequential decision domains',
            'Colo. Rev. Stat. §6-1-1703 -- deployer obligations for consequential decisions',
        ],
        classifier: (input) => {
            // Colorado marker required: fires only when the text is anchored to Colorado
            // jurisdiction (F-NEW-CRIT-23). Prevents misattribution to California AB 2930.
            const hasColoradoMarker = /\b(?:Colorado|CO\s+resident|Colorado\s+AI\s+Act|SB\s*24[-]?205|Colorado\s+Civil\s+Rights\s+Division|CRS\s+6-1-1701|6-1-170[0-9]|Colorado\s+Attorney\s+General|Colorado\s+AG)\b/i.test(input);
            if (!hasColoradoMarker)
                return false;
            if (/\b(?:consequential\s+decision|high.risk\s+AI|algorithmic\s+discrimination)\b/i.test(input))
                return true;
            if (/\b(?:developer\s+deployer|deployer\s+duty|adverse\s+decision|consumer\s+notice)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['Colo. Rev. Stat. §6-1-1701 -- "personal data" definition; consequential decision protection'],
        classifier: (input) => {
            if (sharedPiiClassifier(input))
                return true;
            if (/\b(?:name|address|phone|date of birth)\b/i.test(input))
                return true;
            return false;
        },
    },
    PHI: {
        references: ['Colo. Rev. Stat. §6-1-1703 -- impact assessment for AI affecting healthcare decisions'],
        classifier: (input) => {
            if (/\b(?:patient|diagnosis|prescription|medical record|health condition)\b/i.test(input))
                return true;
            if (/\bMRN[:\s#]*\d{6,12}\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Colo. Rev. Stat. §6-1-1703(1)(b) -- reasonable care for AI systems; credential exposure'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
    IMPACT_ASSESSMENT_CO: {
        references: ['Colo. Rev. Stat. §6-1-1703(3) -- annual impact assessment for high-risk AI systems'],
        classifier: (input) => {
            // Colorado anchor REQUIRED to prevent California AB 2930 misattribution (per F-NEW-CRIT-23 precedent)
            const hasColoradoMarker = /\b(?:Colorado|CO\s+resident|Colorado\s+AI\s+Act|SB\s*24[-]?205|CRS\s+6-1-1703|6-1-170[0-9])\b/i.test(input);
            if (!hasColoradoMarker)
                return false;
            if (/\b(?:algorithmic\s+)?impact\s+assessment\b/i.test(input))
                return true;
            if (/\b§\s*6-1-1703\(3\)\b/i.test(input))
                return true;
            return false;
        },
    },
    ADVERSE_DECISION_NOTIFICATION_CO: {
        references: ['Colo. Rev. Stat. §6-1-1703(4) -- consumer notice within statutory deadline'],
        classifier: (input) => {
            // Colorado anchor REQUIRED to prevent misattribution to FCRA / California adverse-action workflows
            const hasColoradoMarker = /\b(?:Colorado|CO\s+resident|Colorado\s+AI\s+Act|SB\s*24[-]?205|CRS\s+6-1-1703|6-1-170[0-9])\b/i.test(input);
            if (!hasColoradoMarker)
                return false;
            if (/\badverse\s+decision\s+(notification|notice)\b/i.test(input))
                return true;
            if (/\bconsumer\s+notice\s+required\b/i.test(input) && /\b(consequential|adverse|decision)\b/i.test(input))
                return true;
            if (/\b5[\s-]day\s+(SB\s*24[-]?205\s+)?notification\b/i.test(input))
                return true;
            if (/\b§\s*6-1-1703\(4\)\b/i.test(input))
                return true;
            return false;
        },
    },
};
export const COLORADO_AI_PACK = {
    categoryClassifiers: COLORADO_AI_CATEGORY_CLASSIFIERS,
    /** P3.5: PII and PHI are inherently subject-keyed per Colorado AI Act SB24-205. */
    subjectKeyedCategories: ['CONSEQUENTIAL_DECISION_CO', 'PII', 'PHI'],
    id: 'colorado-ai',
    name: 'Colorado AI Act',
    version: '1.0.0',
    contentHash: 'd01792d108aa67313a1c5015eae82117d69fe0fb102fd7f799a94130f2493cc8',
    description: 'Colorado AI Act (SB 24-205) compliance for developers and deployers of high-risk AI systems making consequential decisions affecting Colorado consumers. Effective 1 February 2026.',
    authority: 'Colorado Attorney General',
    industries: [
        'all-co',
        'education',
        'employment',
        'finance-lending',
        'government',
        'healthcare',
        'housing',
        'insurance',
        'legal',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Block high-risk agent activation without impact assessment; enforce reasonable care',
            reference: '§6-1-1702, §6-1-1703 -- reasonable care',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident log of consequential decisions, notices, and appeals',
            reference: '§6-1-1703(3) -- impact assessment records',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Stream consequential decisions, adverse-decision events, discrimination incidents',
            reference: '§6-1-1703(4)(b) -- adverse decision notification',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect PII and PHI flowing through consequential decisions',
            reference: '§6-1-1701(3) -- consequential decision data',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'Chi-square testing per demographic category; 15% per-group deviation threshold; discrimination detection',
            reference: '§6-1-1702, §6-1-1703 -- algorithmic discrimination prevention',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human-reviewer appeal path for adverse consequential decisions',
            reference: '§6-1-1703(4)(b)(III) -- appeal to human reviewer',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Persist consumer notices, correction opportunities, and appeal status across sessions',
            reference: '§6-1-1703(4) -- consumer notice and rights',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Developer-to-deployer documentation statement verification',
            reference: '§6-1-1702(2) -- developer statement to deployer',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Annual impact assessment attestations; risk management policy attestations; public statement',
            reference: '§6-1-1703(2), (3), (5) -- risk management, impact assessment, public statement',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Pre-decision consumer notice; post-adverse-decision reasons statement',
            reference: '§6-1-1703(4)(a) -- consumer notice',
        },
    ],
    moduleConfig: {
        'bias-monitor': {
            perGroupDeviationThresholdPct: 15,
            chiSquarePValue: 0.05,
            requiredDemographicCategories: ['gender', 'age_group', 'race_ethnicity', 'disability_status'],
        },
        'approval-queue': {
            adverseDecisionRequiresAppealPath: true,
            appealHumanReviewerRequired: true,
        },
        'attestation-manager': {
            impactAssessmentCadenceDays: 365,
            materialModificationReassessmentDays: 90,
            publicStatementRequired: true,
        },
        'supply-chain': {
            developerStatementRequired: true,
            developerStatementFields: [
                'purpose',
                'intended_uses',
                'benefits_harms',
                'data_characterisation',
                'evaluation_incl_bias_testing',
                'governance_measures',
            ],
        },
        'governance-runtime': {
            exemptionRegisterRequired: true,
            affirmativeDefenceFrameworks: ['nist_ai_rmf', 'iso_42001'],
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['CONSEQUENTIAL_DECISION_CO', 'PII', 'PHI', 'CREDENTIALS', 'IMPACT_ASSESSMENT_CO', 'ADVERSE_DECISION_NOTIFICATION_CO'],
        categoryActions: {
            CONSEQUENTIAL_DECISION_CO: 'WARN',
            PII: 'WARN',
            PHI: 'BLOCK', // blocked unless HIPAA-exempt path for healthcare decisions
            CREDENTIALS: 'BLOCK',
            IMPACT_ASSESSMENT_CO: 'WARN',
            ADVERSE_DECISION_NOTIFICATION_CO: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US-CO'],
        auditLogRetentionDays: 1095,
        sessionRetentionDays: 365,
        incidentRetentionDays: 1095,
        reference: 'Colo. Rev. Stat. §6-1-1703(3) -- impact assessment records retained; Pax1 default 3 years aligned with AG statute of limitations and annual impact assessment cadence.',
    },
    incidentPolicy: {
        // 90 days for discrimination disclosure to AG; 72-hour internal escalation
        notificationDeadlineHours: 2160,
        reference: 'Colo. Rev. Stat. §6-1-1702(4) (developer) / §6-1-1703(7) (deployer) -- discover and disclose algorithmic discrimination to Colorado AG within 90 days. Internal escalation within 72 hours.',
        requiredRecipients: ['colorado-attorney-general', 'privacy-officer', 'deployer-or-developer-contact'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'coai-impact-assessment',
            description: 'Impact assessment exists for every high-risk deployer agent; refreshed annually',
            reference: '§6-1-1703(3)',
            check: 'impact_assessment_current',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'coai-material-modification',
            description: 'Material modification triggers reassessment within 90 days',
            reference: '§6-1-1703(3)(b)',
            check: 'material_modification_reassessment_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'coai-bias-monitoring',
            description: 'Bias Monitor active with demographic categories and 15% per-group threshold',
            reference: '§6-1-1702, §6-1-1703',
            check: 'bias_monitor_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'coai-consumer-notice',
            description: 'Consumer notice delivered before high-risk system makes consequential decision',
            reference: '§6-1-1703(4)(a)',
            check: 'consumer_notice_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'coai-adverse-decision-workflow',
            description: 'Adverse decision produces reasons statement, correction opportunity, and appeal to human reviewer',
            reference: '§6-1-1703(4)(b)',
            check: 'adverse_decision_workflow_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'coai-developer-statement',
            description: 'Developer statement on file for every imported high-risk system',
            reference: '§6-1-1702(2)',
            check: 'developer_statement_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'coai-risk-management-program',
            description: 'Risk management policy and program in force; aligned to NIST AI RMF or ISO/IEC 42001 (affirmative defence)',
            reference: '§6-1-1703(2), §6-1-1706 (affirmative defence)',
            check: 'risk_management_program_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'coai-discrimination-disclosure',
            description: 'Discovered algorithmic discrimination disclosed to Colorado AG within 90 days',
            reference: '§6-1-1702(4), §6-1-1703(7)',
            check: 'discrimination_disclosure_on_time',
            failSeverity: 'HIGH',
        },
        {
            id: 'coai-public-statement',
            description: 'Public statement describing high-risk systems in use and risk-management practices',
            reference: '§6-1-1703(5)',
            check: 'public_statement_current',
            failSeverity: 'HIGH',
        },
        {
            id: 'coai-exemption-register',
            description: 'Exemption register accurate: small deployer, insurance sector, HIPAA-covered entity for specific healthcare decisions',
            reference: '§6-1-1703(6)',
            check: 'exemption_register_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=colorado-ai.js.map