"use strict";
/**
 * FedRAMP Compliance Pack
 *
 * Federal Risk and Authorization Management Program. Established by
 * the FedRAMP Act (44 USC 3607), codified via OMB Memorandum M-11-33
 * (2011) and updated by OMB Memorandum M-23-22 (2023) which increased
 * reciprocity requirements and introduced AI-specific guidance.
 *
 * FedRAMP Rev 5 baseline (aligned to NIST SP 800-53 Rev 5) is the
 * current mandatory baseline as of 2024. Three baselines:
 *   - Low: 125 controls
 *   - Moderate: 325 controls (most cloud AI services land here)
 *   - High: 421 controls (national security / high-impact)
 *
 * AI-specific FedRAMP considerations (2023-2024):
 *   - OMB M-24-10 (2024 AI EO implementation): federal agencies must
 *     ensure AI tools they procure are on the FedRAMP Marketplace or
 *     have an equivalent ATO.
 *   - NIST SP 800-53 Rev 5 SA-11, SA-22: software testing and
 *     unsupported system remediation -- applied to AI/ML models.
 *   - SC-28: protection of information at rest (mandatory for AI
 *     training data and model weights).
 *   - AU-2, AU-12: audit events -- AI inference events are loggable
 *     events under FedRAMP.
 *   - AC-2, AC-3, AC-6: account management, access enforcement,
 *     least privilege -- applied to AI agent identities.
 *   - SI-7: software, firmware, and information integrity -- applied
 *     to model integrity (hash verification).
 *   - SR-3, SR-5: supply chain risk management (vendor/model provenance).
 *   - FedRAMP Ready / In-Process / Authorized: three-stage path.
 *   - Continuous Monitoring (ConMon): monthly vulnerability scanning,
 *     annual penetration testing, ongoing POA&M management.
 *
 * Sovereignty: US Federal (agencies and their cloud service providers).
 * StateRAMP is the state-government equivalent (separate pack: stateramp.ts).
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.FEDRAMP_PACK = exports.FEDRAMP_CATEGORY_CLASSIFIERS = void 0;
/**
 * FedRAMP (Federal Risk and Authorization Management Program) category classifiers.
 * Governs cloud services for US federal government: CUI, FCI, PII, classified data.
 * FIPS 140-2/3 validated encryption required for all categories.
 */
exports.FEDRAMP_CATEGORY_CLASSIFIERS = {
    CUI: {
        references: ['NIST SP 800-53 Rev 5 -- Controlled Unclassified Information handling; FedRAMP Moderate baseline'],
        classifier: (input) => {
            if (/\b(?:CUI|controlled\s+unclassified\s+information|CUI\/\w+)\b/.test(input))
                return true;
            if (/\b(?:for\s+official\s+use\s+only|FOUO|sensitive\s+but\s+unclassified|SBU)\b/i.test(input))
                return true;
            return false;
        },
    },
    FCI: {
        references: ['FAR 52.204-21 -- Federal Contract Information; CMMC/DFARS'],
        classifier: (input) => {
            if (/\b(?:FCI|federal\s+contract\s+information|government\s+contract\s+(?:data|record))\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['OMB Memorandum M-07-16 -- PII in federal systems; E-Government Act §208'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:government\s+employee\s+(?:ID|number)|federal\s+employee\s+ID)\b/i.test(input))
                return true;
            return false;
        },
    },
    CLASSIFIED: {
        references: ['Executive Order 13526 -- classified national security information; not in FedRAMP but blocked if seen'],
        classifier: (input) => {
            if (/\b(?:TOP\s+SECRET|SECRET\/|CONFIDENTIAL\/|SCI|SAP|NOFORN|classified)\b/.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['NIST SP 800-53 Rev 5 IA-5 -- authenticator management; FedRAMP FIPS 140-2 requirement'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.FEDRAMP_PACK = {
    categoryClassifiers: exports.FEDRAMP_CATEGORY_CLASSIFIERS,
    /** P3.5: PII is subject-keyed per FedRAMP NIST 800-53 Privacy Controls. CUI may contain subject data. */
    subjectKeyedCategories: ['PII'],
    id: 'fedramp',
    name: 'FedRAMP (Rev 5)',
    version: '1.0.0',
    contentHash: '73175a2f4900e012c2bd3babda9a1a887887b982f2c399c5df1af6738298c69b',
    description: 'Federal Risk and Authorization Management Program (FedRAMP Act, 44 USC 3607; NIST SP 800-53 Rev 5 baseline). Covers FedRAMP Authorization path (Ready/In-Process/Authorized), Continuous Monitoring (ConMon) requirements, NIST SP 800-53 Rev 5 controls for AI systems (audit logging, access control, encryption, supply chain, integrity verification), and OMB M-24-10 AI procurement guidance for federal agencies.',
    authority: 'FedRAMP PMO (General Services Administration); OMB',
    industries: ['government', 'federal-agency', 'govtech', 'cloud-services', 'defense-adjacent'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Least-privilege enforcement (AC-6); access control (AC-2, AC-3); deny-by-default; account lifecycle management',
            reference: 'NIST SP 800-53 Rev 5 AC-2, AC-3, AC-6; FedRAMP Moderate baseline',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Audit event logging for AI inference (AU-2, AU-12); tamper-evident audit trail; 3-year retention',
            reference: 'NIST SP 800-53 Rev 5 AU-2, AU-12; FedRAMP ConMon requirements',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'FIPS 140-2/3 validated encryption at rest (SC-28) and in transit (SC-8); FIPS-approved cryptographic modules required',
            reference: 'NIST SP 800-53 Rev 5 SC-28, SC-8, SC-13; FedRAMP Rev 5 encryption requirements',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Federal information classification (FIPS 199); CUI/FCI detection; PII detection; information-at-rest labelling',
            reference: 'NIST SP 800-53 Rev 5 RA-2 (security categorisation); FIPS 199; 32 CFR 2002 (CUI)',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'PIV/CAC or equivalent MFA for all privileged access; unique agent identification; IAL/AAL per NIST SP 800-63',
            reference: 'NIST SP 800-53 Rev 5 IA-2, IA-5; NIST SP 800-63; FedRAMP IA controls',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Supply chain risk management for AI models and inference providers; AI vendor provenance; SR-3, SR-5, SR-11',
            reference: 'NIST SP 800-53 Rev 5 SR-3, SR-5, SR-11; OMB M-24-10 AI procurement',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Continuous monitoring event stream; ConMon reporting; incident detection (IR-6); POA&M tracking',
            reference: 'NIST SP 800-53 Rev 5 CA-7 (continuous monitoring); IR-6 (incident reporting)',
        },
        {
            name: 'circuit-breaker',
            required: true,
            reason: 'System integrity protection; incident isolation; ConMon POA&M enforcement',
            reference: 'NIST SP 800-53 Rev 5 IR-4 (incident handling); SA-22 (unsupported system remediation)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'FedRAMP ATO evidence package; ConMon monthly reports; annual penetration test scheduling; POA&M management',
            reference: 'FedRAMP Authorization lifecycle; NIST SP 800-53 Rev 5 CA-5 (POA&M); CA-2 (security assessments)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Change management and change advisory board gate (CM-3); configuration baseline changes require approval',
            reference: 'NIST SP 800-53 Rev 5 CM-3 (configuration change control); FedRAMP significant change policy',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'CUI',
                'FCI',
                'PII',
                'CLASSIFIED',
                'CREDENTIALS',
            ],
            cuiAction: 'BLOCK_UNLESS_AUTHORISED',
            classifiedAction: 'BLOCK',
        },
        'encryption-layer': {
            fips140ValidatedRequired: true,
            fipsApprovedAlgorithmsOnly: true,
        },
        'agent-auth': {
            pivCacOrEquivalentRequired: true,
            mfaForAllPrivilegedAccess: true,
            nistSp80063Compliance: true,
        },
        'governance-runtime': {
            leastPrivilegeEnforced: true,
            accountLifecycleManagementRequired: true,
            denyByDefaultRequired: true,
        },
        'supply-chain': {
            aiVendorProvenanceRequired: true,
            supplyChainRiskManagementRequired: true,
            fedrampMarketplaceVerificationRequired: true,
        },
        'event-bus': {
            continuousMonitoringStreamRequired: true,
            conMonReportingRequired: true,
            monthlyVulnerabilityScanningRequired: true,
        },
        'attestation-manager': {
            fedrampAtoEvidencePackageRequired: true,
            conMonMonthlyReportRequired: true,
            annualPenetrationTestRequired: true,
            poamManagementRequired: true,
            penetrationTestCadenceDays: 365,
            vulnerabilityScanCadenceDays: 30,
        },
        'approval-queue': {
            changeAdvisoryBoardApprovalRequired: true,
            significantChangeNotificationRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['FEDRAMP-AUTHORISED', 'FIPS-140-VALIDATED', 'DATA-RESIDENCY-US'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['CUI', 'FCI', 'PII', 'CLASSIFIED', 'CREDENTIALS'],
        categoryActions: {
            CUI: 'BLOCK',
            FCI: 'WARN',
            PII: 'WARN',
            CLASSIFIED: 'BLOCK',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM-FIPS',
        minimumClassification: 'CUI',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // NIST SP 800-53 Rev 5 AU-11: audit log retention minimum 3 years for Moderate baseline.
        auditLogRetentionDays: 1095,
        sessionRetentionDays: 1095,
        incidentRetentionDays: 1095,
        reference: 'NIST SP 800-53 Rev 5 AU-11 (audit retention); FedRAMP Moderate baseline (3 years)',
    },
    incidentPolicy: {
        // NIST SP 800-53 Rev 5 IR-6: notify US-CERT within 1 hour of discovery of a security incident.
        notificationDeadlineHours: 1,
        reference: 'NIST SP 800-53 Rev 5 IR-6; FedRAMP Incident Communications Procedure; FISMA reporting (1-hour US-CERT notification)',
        requiredRecipients: ['fedramp-pmo', 'us-cert-cisa', 'agency-isso', 'authorizing-official'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'fedramp-fips-encryption',
            description: 'FIPS 140-2/3 validated encryption active for data at rest and in transit',
            reference: 'NIST SP 800-53 Rev 5 SC-28, SC-8, SC-13; FedRAMP encryption requirement',
            check: 'encryption_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fedramp-piv-mfa',
            description: 'PIV/CAC or equivalent MFA active for all privileged access',
            reference: 'NIST SP 800-53 Rev 5 IA-2; FedRAMP IA controls',
            check: 'fedramp_piv_mfa_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fedramp-audit-logging',
            description: 'AI inference events logged in tamper-evident audit trail',
            reference: 'NIST SP 800-53 Rev 5 AU-2, AU-12',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fedramp-continuous-monitoring',
            description: 'Continuous monitoring event stream active; monthly vulnerability scanning configured',
            reference: 'NIST SP 800-53 Rev 5 CA-7; FedRAMP ConMon requirements',
            check: 'fedramp_conmon_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fedramp-supply-chain',
            description: 'AI vendor FedRAMP marketplace verification and supply chain risk management active',
            reference: 'NIST SP 800-53 Rev 5 SR-3, SR-5; OMB M-24-10',
            check: 'fedramp_supply_chain_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fedramp-poam',
            description: 'Plan of Action and Milestones (POA&M) management active',
            reference: 'NIST SP 800-53 Rev 5 CA-5; FedRAMP Authorization lifecycle',
            check: 'fedramp_poam_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fedramp-least-privilege',
            description: 'Least-privilege access control enforced for all AI agent identities',
            reference: 'NIST SP 800-53 Rev 5 AC-6',
            check: 'governance_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fedramp-annual-pentest',
            description: 'Annual penetration test scheduled',
            reference: 'NIST SP 800-53 Rev 5 CA-8; FedRAMP Annual Assessment',
            check: 'fedramp_annual_pentest_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fedramp-change-management',
            description: 'Change advisory board approval required for AI system configuration changes',
            reference: 'NIST SP 800-53 Rev 5 CM-3; FedRAMP significant change policy',
            check: 'change_management_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=fedramp.js.map