"use strict";
/**
 * FTC Act §5 Compliance Pack (Unfair or Deceptive AI Practices)
 *
 * 15 USC §45 interpreted through:
 *   - Operation AI Comply (Sept 2024) -- FTC's enforcement playbook
 *     for deceptive AI marketing, fake reviews, chatbot fraud, and
 *     AI tools used without human oversight.
 *   - 16 CFR Part 465 (effective 21 Aug 2024) -- ban on fake or AI-
 *     generated reviews. Up to ~$51,744 per violation.
 *   - Algorithmic disgorgement doctrine (Everalbum 2021, Rite Aid
 *     2023, WW International 2024) -- delete the model + delete the
 *     data as a structural remedy.
 *   - FTC 2022 Dark Patterns Staff Report -- prohibits AI-driven
 *     dark patterns (consent, cancellation, urgency, nagging).
 *   - COPPA intersection (15 USC §§6501-6506) -- AI collecting data
 *     from under-13 users requires verifiable parental consent.
 *
 * No statutory breach deadline; Pax1 defaults to 7-day external
 * consumer notification for material §5 violations.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.FTC5_PACK = exports.FTC5_CATEGORY_CLASSIFIERS = void 0;
/**
 * FTC Section 5 (15 U.S.C. §45) category classifiers.
 * Covers unfair/deceptive practices, COPPA age gates, dark patterns,
 * payment data protection, and AI-washing/fake review detection.
 */
exports.FTC5_CATEGORY_CLASSIFIERS = {
    PII: {
        references: ['FTC Act §5 -- unfair/deceptive acts; personal data in AI contexts'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            return false;
        },
    },
    PAYMENT_DATA: {
        references: ['FTC Act §5 -- deceptive practices; payment data exposure'],
        classifier: (input) => {
            // Credit/debit card numbers
            if (/\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\b/.test(input))
                return true;
            // Payment-context keywords with amounts
            if (/\b(?:card\s*(?:number|#)|cvv|expiry|billing\s*(?:address|info))\b/i.test(input))
                return true;
            return false;
        },
    },
    UNDER13: {
        references: ['15 U.S.C. §6501 -- COPPA; children under 13 personal information'],
        classifier: (input) => {
            if (/\b(?:child|minor|under\s*13|age\s*gate|parental\s*consent|COPPA)\b/i.test(input))
                return true;
            if (/\bage[:\s]*(?:[0-9]|1[0-2])\b/i.test(input))
                return true;
            return false;
        },
    },
    DECEPTIVE_PATTERNS: {
        references: ['FTC Act §5 -- dark patterns; manipulative design flagged as deceptive'],
        classifier: (input) => {
            if (/\b(?:dark\s*pattern|confirm\s*shaming|hidden\s*(?:fee|cost|charge)|roach\s*motel|bait\s*(?:and\s*switch)?|sludge)\b/i.test(input))
                return true;
            if (/\b(?:fake\s*review|synthetic\s*review|AI.generated\s*review|fabricated\s*testimonial)\b/i.test(input))
                return true;
            return false;
        },
    },
};
exports.FTC5_PACK = {
    categoryClassifiers: exports.FTC5_CATEGORY_CLASSIFIERS,
    /**
     * F-NEW-VERA-PACK-FINAL-003 (2026-05-03): Added subjectKeyedCategories.
     * FTC algorithmic disgorgement doctrine (In re Cambridge Analytica, FTC v. Kurbo,
     * Operation AI Comply 2024) requires per-subject erasure of PII and UNDER13 data
     * when an order issues. subjectKeyedCategories enables the FiveDim identity layer
     * to attribute and erasure-scope records to specific data subjects, satisfying
     * the per-subject erasure requirement of disgorgement orders.
     */
    subjectKeyedCategories: ['PII', 'UNDER13'],
    id: 'ftc5',
    name: 'FTC Act §5',
    version: '1.0.0',
    contentHash: '6eab1929ca2b801fd9c0f754e9c451e2f90e51053040f834ba93610f03195229',
    description: 'FTC Act §5 (15 USC §45) framework for unfair or deceptive AI practices, as enforced through Operation AI Comply (2024), 16 CFR Part 465 fake-review rule, and the algorithmic-disgorgement doctrine.',
    authority: 'Federal Trade Commission',
    industries: [
        'all-us-consumer',
        'retail',
        'ecommerce',
        'ai-saas',
        'chatbot-platform',
        'marketing',
        'social-media',
        'dating',
        'edtech',
        'childrens-products',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Claim-substantiation gate; under-13 age gate; algorithmic-disgorgement readiness',
            reference: '15 USC §45(a); COPPA intersection',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident record of AI claims, substantiation, training data provenance',
            reference: '15 USC §45; FTC structural remedies',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect PAYMENT_DATA (fraud facilitation), UNDER13 signals, DECEPTIVE_PATTERNS',
            reference: '15 USC §45(a); COPPA',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'AI-generation disclosure on synthetic content, endorsements, reviews',
            reference: '16 CFR Part 465; 15 USC §45',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Fake-review velocity / template anomalies; disparate impact detection',
            reference: '16 CFR Part 465; FTC AI Unfairness Doctrine',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Gate AI marketing without substantiation; UX patterns matching dark-pattern taxonomy; high-disparate-impact cases',
            reference: '15 USC §45; FTC 2022 Dark Patterns Staff Report',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Claim registry with substantiation evidence; training-data provenance for disgorgement readiness',
            reference: 'FTC Advertising Substantiation; algorithmic disgorgement',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'AI vendor claims and substantiation propagate to downstream users',
            reference: '15 USC §45 (unfair acts via third parties)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Stream claim events, dark-pattern detections, fraud-pattern alerts',
            reference: '15 USC §45',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: ['PII', 'PAYMENT_DATA', 'UNDER13', 'DECEPTIVE_PATTERNS'],
            paymentDataAction: 'BLOCK',
            under13Action: 'BLOCK_UNLESS_VPC',
            deceptivePatternsAction: 'BLOCK',
        },
        'governance-runtime': {
            claimSubstantiationRequired: true,
            ageGateRequired: true,
            algorithmicDisgorgementReadyRequired: true,
            dataMinimisationRequired: true,
        },
        'transparency-injector': {
            aiGenerationDisclosureRequired: true,
            syntheticEndorsementDisclosureRequired: true,
        },
        'anomaly-detector': {
            fakeReviewDetectionActive: true,
            disparateImpactDetectionActive: true,
        },
        'approval-queue': {
            unsubstantiatedClaimBlocked: true,
            darkPatternDeploymentReview: true,
            highDisparateImpactReview: true,
        },
        'attestation-manager': {
            claimRegistryRequired: true,
            trainingDataProvenanceRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['CLAIM-SUBSTANTIATION'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['PII', 'PAYMENT_DATA', 'UNDER13', 'DECEPTIVE_PATTERNS'],
        categoryActions: {
            PII: 'WARN',
            PAYMENT_DATA: 'BLOCK',
            UNDER13: 'BLOCK',
            DECEPTIVE_PATTERNS: 'BLOCK',
        },
        encryptionRequired: false,
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // 5 years aligned with FTC enforcement statute and reasonable evidence-retention window
        auditLogRetentionDays: 1825,
        sessionRetentionDays: 365,
        incidentRetentionDays: 1825,
        reference: 'FTC enforcement statute of limitations (5 years) + consent-order monitoring windows',
    },
    incidentPolicy: {
        notificationDeadlineHours: 168,
        reference: 'No statutory FTC deadline; Pax1 default 7-day external consumer notification + same-day internal escalation.',
        requiredRecipients: ['affected-consumers', 'ftc', 'legal-counsel'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'ftc5-claim-substantiation',
            description: 'Every AI capability claim has stored substantiation evidence before publication',
            reference: 'FTC Advertising Substantiation; 15 USC §45',
            check: 'ftc5_claim_substantiation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ftc5-fake-review-detection',
            description: 'Fake-review velocity and template patterns monitored on outbound content',
            reference: '16 CFR Part 465',
            check: 'ftc5_fake_review_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ftc5-ai-disclosure',
            description: 'AI-generation disclosure injected on synthetic content and endorsements',
            reference: '16 CFR Part 465; 15 USC §45',
            check: 'ftc5_ai_disclosure_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ftc5-dark-patterns',
            description: 'AI-driven dark-pattern UX blocked; cancellation / consent / urgency / nagging flows gated',
            reference: 'FTC 2022 Dark Patterns Staff Report',
            check: 'ftc5_dark_patterns_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ftc5-fraud-chatbot',
            description: 'Chatbot fraud patterns (payment harvesting, impersonation, romance-scam scripts) detected and blocked',
            reference: '15 USC §45(a) -- unfair acts',
            check: 'ftc5_fraud_chatbot_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ftc5-coppa-age-gate',
            description: 'Under-13 age gate + verifiable parental consent required before data collection',
            reference: 'COPPA 15 USC §§6501-6506 intersecting §5',
            check: 'ftc5_coppa_gate_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ftc5-data-minimisation',
            description: 'Collection limited to declared PI categories; excess blocked',
            reference: '15 USC §45; FTC enforcement',
            check: 'ftc5_data_minimisation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ftc5-disgorgement-readiness',
            description: 'Training-data provenance captured and model-deletion capability demonstrable',
            reference: 'FTC algorithmic disgorgement doctrine',
            check: 'ftc5_disgorgement_readiness_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ftc5-disparate-impact',
            description: 'Consumer-outcome disparate impact monitored; high-disparate-impact cases reviewed',
            reference: 'FTC AI Unfairness Doctrine (2024)',
            check: 'ftc5_disparate_impact_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ftc5-ai-washing',
            description: 'AI-capability labels ("AI-powered") require evidence that the described AI is operative',
            reference: 'FTC Enforcement 2023-2026',
            check: 'ftc5_ai_washing_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=ftc5.js.map