@connexum/ai-governance 1.0.0-beta.11

package/dist/packs/mifid2.js

@@ -0,0 +1,384 @@
+"use strict";
+/**
+ * MiFID II Compliance Pack
+ *
+ * Markets in Financial Instruments Directive II (Directive 2014/65/EU)
+ * and its implementing regulation MiFIR (Regulation 600/2014/EU).
+ * Current consolidated state: as amended by the MiFID II Quick Fix
+ * (Directive 2021/338/EU) and the Investment Firms Regulation (IFR/IFD,
+ * effective June 2021). ESMA Guidelines on AI/ML in investment advice
+ * and suitability assessments are in force from 2023.
+ *
+ * Key obligations for AI systems:
+ *   - Best-execution policy (Art. 27): AI routing/trading must document
+ *     and achieve best execution on a consistent basis.
+ *   - Product governance / target market (Arts. 16(3), 24): AI must not
+ *     distribute products outside the manufacturer's identified target
+ *     market.
+ *   - Suitability / appropriateness (Arts. 25, 54-56 MiFID II Delegated
+ *     Reg 2017/565): AI investment advice requires suitability check
+ *     per client; aggregated AI recommendations are non-compliant without
+ *     per-client assessment.
+ *   - Algo trading / HFT (Art. 17): Algorithmic trading systems require
+ *     kill-switch, annual self-assessment, and regulator notification.
+ *   - Record keeping (Art. 16(6), Art. 25(5)): minimum 5 years; ESMA
+ *     may extend to 7 years. All AI interactions on a client matter
+ *     constitute "records of communications".
+ *   - Transparency / reporting: pre- and post-trade transparency
+ *     obligations where AI is involved in price formation.
+ *
+ * Sovereignty: EU (EEA adoption). Equivalent third-country regimes apply
+ * to UK (UK MiFID), Switzerland (FinSA), and others by reference.
+ *
+ * // TODO verify citation with Vera: specific ESMA Guidelines on algo
+ * // trading self-assessment frequency (currently understood as annual).
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIFID2_PACK = exports.MIFID2_CATEGORY_CLASSIFIERS = void 0;
+/**
+ * MiFID II (EU 2014/65) category classifiers.
+ * Markets in Financial Instruments Directive -- covers client financial data,
+ * suitability profiles, order data, and personal data of EU investors.
+ * Note: BEST_EXECUTION_FAILURE is a process-flow category not detectable
+ * via pattern; it is detected at the business-logic layer.
+ */
+exports.MIFID2_CATEGORY_CLASSIFIERS = {
+    CLIENT_FINANCIAL_DATA: {
+        references: ['MiFID II Art. 25 -- suitability and appropriateness; client financial information'],
+        classifier: (input) => {
+            if (/\bclient\s+financial\b/i.test(input))
+                return true;
+            if (/\b(?:portfolio\s+(?:value|data)|investment\s+(?:profile|objective|horizon)|risk\s+tolerance|AUM|assets\s+under\s+management)\b/i.test(input))
+                return true;
+            if (/\b(?:client\s+(?:account|financial|investment)\s+(?:data|record|information))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    SUITABILITY_PROFILE: {
+        references: ['MiFID II Art. 25(2) -- suitability assessment requirements'],
+        classifier: (input) => {
+            if (/\b(?:suitability\s+(?:assessment|profile|report|test|check)|appropriateness\s+test)\b/i.test(input))
+                return true;
+            if (/\b(?:investment\s+knowledge|financial\s+experience|risk\s+profile)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    ORDER_DATA: {
+        references: ['MiFID II Art. 26 -- transaction reporting; order record-keeping'],
+        classifier: (input) => {
+            if (/\b(?:order\s+(?:book|record|execution|ticket|data)|trade\s+(?:ticket|record|execution)|transaction\s+report)\b/i.test(input))
+                return true;
+            if (/\b(?:buy|sell)\s+(?:order|instruction)\s+(?:at\s+(?:market|limit)|ISIN|CUSIP)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PERSONAL_DATA: {
+        references: ['MiFID II Art. 16(6) + GDPR -- personal data of clients in investment context'],
+        classifier: (input) => {
+            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
+                return true;
+            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
+                return true;
+            if (/\b(?:client\s+(?:name|address|date\s+of\s+birth|ID|LEI))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * F-NEW-VERA-PACK-C2-08 fix (CRITICAL)
+     *
+     * MiFID II Art. 24(2) + Delegated Directive 2017/593 Arts. 8-10:
+     * Manufacturers must define a target market; distributors must only
+     * distribute to clients within that target market. AI systems that
+     * distribute investment products to clients outside the manufacturer's
+     * identified target market are in direct violation.
+     *
+     * ESMA product-governance vocabulary detected:
+     *   - "out of target market" / "outside target market" / "out-of-target-market"
+     *   - "negative target market" / "incompatible target market"
+     *   - "target market mismatch"
+     *   - "client outside target market"
+     *   - "distributing to clients outside the manufacturer's target market"
+     *   - References to ESMA Q&As 32/33 on product governance
+     *   - Manufacturer target market + distributor + mismatch signal
+     *
+     * Action (via moduleConfig outOfTargetMarketAction): BLOCK
+     */
+    PRODUCT_GOVERNANCE_TARGET_MARKET: {
+        references: [
+            'MiFID II Art. 24(2) -- product governance; target-market identification',
+            'Delegated Directive 2017/593 Arts. 8-10 -- manufacturer and distributor obligations',
+            'ESMA Q&A on MiFID II investor protection (Q32, Q33) -- product governance',
+        ],
+        classifier: (input) => {
+            // "out of target market" / "outside target market" / "out-of-target-market"
+            if (/\bout[\s-]of[\s-]target[\s-]market\b/i.test(input))
+                return true;
+            if (/\boutside\s+(?:the\s+)?(?:manufacturer['']?s?\s+)?target\s+market\b/i.test(input))
+                return true;
+            // "negative target market"
+            if (/\bnegative\s+target\s+market\b/i.test(input))
+                return true;
+            // "incompatible target market"
+            if (/\bincompatible\s+target\s+market\b/i.test(input))
+                return true;
+            // "target market mismatch"
+            if (/\btarget\s+market\s+mismatch\b/i.test(input))
+                return true;
+            // "client outside target market"
+            if (/\bclient\s+outside\s+(?:the\s+)?(?:manufacturer['']?s?\s+)?target\s+market\b/i.test(input))
+                return true;
+            // ESMA Q&A 32 / 33 on product governance
+            if (/\bESMA\s+Q&?A\s*(?:32|33)\b/i.test(input))
+                return true;
+            if (/\bproduct\s+governance\s+Q&?A\s*(?:32|33)\b/i.test(input))
+                return true;
+            // manufacturer target market + distributor + mismatch signal
+            if (/\bmanufacturer['']?s?\s+target\s+market\b/i.test(input) &&
+                /\bdistribut(?:or|ing|ion|ed)\b/i.test(input) &&
+                /\b(?:mismatch|incompatible|outside|negative|breach|violat|wrong|non[-\s]compliant)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+exports.MIFID2_PACK = {
+    categoryClassifiers: exports.MIFID2_CATEGORY_CLASSIFIERS,
+    id: 'mifid2',
+    name: 'MiFID II / MiFIR',
+    version: '1.0.0',
+    description: 'Markets in Financial Instruments Directive II (2014/65/EU) + MiFIR (600/2014/EU) compliance for AI systems in investment services. Covers best-execution, suitability/appropriateness, product governance, algorithmic trading controls, record-keeping, and investor-protection obligations under ESMA guidelines.',
+    authority: 'European Securities and Markets Authority (ESMA) + national competent authorities (NCAs)',
+    industries: ['fintech', 'investment-management', 'wealth-management', 'trading', 'banking', 'insurance', 'financial-services'],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'Best-execution policy enforcement; kill-switch for algo trading; target-market distribution controls',
+            reference: 'Art. 27 MiFID II (best execution); Art. 17 (algo trading); Art. 24(2) (product governance)',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident records of all AI-driven client interactions and order routing decisions (5-7 year retention)',
+            reference: 'Art. 16(6) MiFID II; Art. 25(5) MiFID II; Arts. 72-76 Delegated Reg 2017/565',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Classify client financial data, suitability profiles, and order data; detect out-of-target-market distribution',
+            reference: 'Art. 25(2) MiFID II (suitability); Art. 16(3) (product governance)',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'Per-client suitability/appropriateness state; informed consent for AI-driven advice; conflict-of-interest tracking',
+            reference: 'Arts. 25, 54-56 Delegated Reg 2017/565; Art. 23 MiFID II (conflicts)',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'Human review gate for suitability decisions outside normal parameters; pre-trade transparency checks; algo trading approval',
+            reference: 'Art. 17(1) MiFID II (annual self-assessment); Art. 54(5) Delegated Reg 2017/565',
+        },
+        {
+            name: 'agent-auth',
+            required: true,
+            reason: 'Unique identification of AI agent as acting on behalf of investment firm; access control for client data',
+            reference: 'Art. 16(2) MiFID II (internal controls); ESMA AI Guidelines',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'Mandatory disclosure to clients when advice is AI-generated; best-execution policy communication',
+            reference: 'Art. 24(3) MiFID II (disclosures); Art. 27(5) (best-execution policy publication)',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'Real-time monitoring of algo trading activity; transaction reporting streams; incident detection',
+            reference: 'Art. 26 MiFIR (transaction reporting); Art. 17(2) MiFID II (real-time monitoring)',
+        },
+        {
+            name: 'circuit-breaker',
+            required: true,
+            reason: 'Kill-switch for algo trading systems to prevent runaway orders; market disruption prevention',
+            reference: 'Art. 17(1) MiFID II (ability to cancel or limit orders; kill-switch)',
+        },
+        {
+            name: 'bias-monitor',
+            required: true,
+            reason: 'Detect systematic bias in suitability assessments and product recommendations; ESMA AI fairness guidelines',
+            reference: 'Art. 25(2) MiFID II; ESMA Guidelines on AI in investment advice (2023)',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'Annual algo-trading self-assessment; product governance target-market sign-off; suitability assessment documentation; 5-year record retention for compliance attestations',
+            reference: 'Art. 17(1) MiFID II (annual self-assessment); Art. 16(3) product governance; Arts. 72-76 Delegated Reg 2017/565 record retention',
+        },
+    ],
+    moduleConfig: {
+        'data-classifier': {
+            enabledCategories: [
+                'CLIENT_FINANCIAL_DATA',
+                'SUITABILITY_PROFILE',
+                'ORDER_DATA',
+                'PRODUCT_GOVERNANCE_TARGET_MARKET',
+            ],
+            outOfTargetMarketAction: 'BLOCK',
+            sensitiveFinancialAction: 'WARN',
+        },
+        'session-persistence': {
+            perClientSuitabilityRequired: true,
+            conflictOfInterestTrackingRequired: true,
+            informedConsentForAiAdviceRequired: true,
+        },
+        'approval-queue': {
+            suitabilityOutOfBoundsReviewRequired: true,
+            algoTradingAnnualSelfAssessmentRequired: true,
+            preTradeTransparencyCheckRequired: true,
+        },
+        'governance-runtime': {
+            bestExecutionPolicyEnforced: true,
+            algoTradingKillSwitchRequired: true,
+            targetMarketDistributionControlRequired: true,
+        },
+        'transparency-injector': {
+            aiAdviceDisclosureRequired: true,
+            bestExecutionPolicyPublicationRequired: true,
+        },
+        'event-bus': {
+            transactionReportingStreamRequired: true,
+            algoTradingRealTimeMonitoringRequired: true,
+        },
+        'circuit-breaker': {
+            killSwitchRequired: true,
+            marketDisruptionPreventionRequired: true,
+        },
+        'bias-monitor': {
+            suitabilityAssessmentBiasMonitoringRequired: true,
+            productRecommendationFairnessRequired: true,
+        },
+        'attestation-manager': {
+            algoTradingAnnualSelfAssessmentRequired: true,
+            bestExecutionAnnualReviewRequired: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: [],
+        requiredCapabilities: ['AUDIT-TRAIL', 'DATA-RESIDENCY-EU'],
+        blockReasons: {},
+    },
+    dataPolicy: {
+        scanCategories: [
+            'CLIENT_FINANCIAL_DATA',
+            'SUITABILITY_PROFILE',
+            'ORDER_DATA',
+            'PERSONAL_DATA',
+            // F-NEW-VERA-PACK-C2-08: product-governance target-market category added
+            'PRODUCT_GOVERNANCE_TARGET_MARKET',
+        ],
+        categoryActions: {
+            CLIENT_FINANCIAL_DATA: 'BLOCK',
+            SUITABILITY_PROFILE: 'BLOCK',
+            ORDER_DATA: 'LOG',
+            PERSONAL_DATA: 'WARN',
+            // F-NEW-VERA-PACK-C2-08: BLOCK matches moduleConfig outOfTargetMarketAction intent
+            // MiFID II Art. 24(2) / Delegated Directive 2017/593 -- out-of-target-market distribution blocked
+            PRODUCT_GOVERNANCE_TARGET_MARKET: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256',
+        minimumClassification: 'CONFIDENTIAL',
+    },
+    // F-NEW-VERA-PACK-C2-09: subject-keyed categories for GDPR Art. 17 erasure + MiFID II Art. 16(6) NCA audit access
+    // CLIENT_FINANCIAL_DATA and SUITABILITY_PROFILE are inherently per-client; data-subject-id attribution required.
+    subjectKeyedCategories: ['CLIENT_FINANCIAL_DATA', 'SUITABILITY_PROFILE'],
+    retentionPolicy: {
+        sovereignty: ['EU'],
+        // Art. 16(6) MiFID II: minimum 5 years; ESMA may extend to 7.
+        auditLogRetentionDays: 2555,
+        sessionRetentionDays: 1825,
+        incidentRetentionDays: 2555,
+        reference: 'Art. 16(6) MiFID II (5 years; ESMA extension to 7 where applicable); Art. 25(5)',
+    },
+    incidentPolicy: {
+        // NCAs require prompt notification of algo trading incidents; ESMA guidance: within 24h for market-disruption events.
+        notificationDeadlineHours: 24,
+        reference: 'Art. 17(2) MiFID II (prompt notification of disorderly trading conditions); NCA-specific incident reporting rules',
+        requiredRecipients: ['compliance-officer', 'national-competent-authority', 'affected-clients'],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'mifid2-best-execution',
+            description: 'Best-execution policy active and enforced for all AI-routed orders',
+            reference: 'Art. 27 MiFID II; Delegated Reg 2017/565 Arts. 64-65',
+            check: 'mifid2_best_execution_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'mifid2-suitability',
+            description: 'Per-client suitability assessment required before AI investment advice',
+            reference: 'Art. 25(2) MiFID II; Delegated Reg 2017/565 Arts. 54-56',
+            check: 'mifid2_suitability_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'mifid2-product-governance',
+            description: 'Target-market distribution controls prevent AI from distributing products outside target market',
+            reference: 'Art. 24(2) MiFID II; Delegated Directive 2017/593 Arts. 8-10',
+            check: 'mifid2_product_governance_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'mifid2-algo-kill-switch',
+            description: 'Kill-switch active for algorithmic trading systems',
+            reference: 'Art. 17(1) MiFID II',
+            check: 'mifid2_algo_kill_switch_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'mifid2-algo-self-assessment',
+            description: 'Annual self-assessment of algorithmic trading system scheduled',
+            reference: 'Art. 17(1) MiFID II; ESMA Guidelines on Algo Trading',
+            check: 'mifid2_algo_self_assessment_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'mifid2-record-retention',
+            description: 'AI interaction records retained for minimum 5 years',
+            reference: 'Art. 16(6) MiFID II',
+            check: 'mifid2_record_retention_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'mifid2-transaction-reporting',
+            description: 'Transaction reporting stream active for AI-involved orders',
+            reference: 'Art. 26 MiFIR',
+            check: 'mifid2_transaction_reporting_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'mifid2-ai-disclosure',
+            description: 'Client disclosure active when advice is AI-generated',
+            reference: 'Art. 24(3) MiFID II; ESMA AI in Investment Advice Guidelines (2023)',
+            check: 'mifid2_ai_disclosure_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'mifid2-suitability-bias',
+            description: 'Bias monitoring active for suitability assessment and product recommendations',
+            reference: 'Art. 25(2) MiFID II; ESMA AI Guidelines',
+            check: 'mifid2_suitability_bias_active',
+            failSeverity: 'MEDIUM',
+        },
+    ],
+};
+//# sourceMappingURL=mifid2.js.map

package/dist/packs/mifid2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mifid2.js","sourceRoot":"","sources":["../../src/packs/mifid2.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;;AAKH;;;;;;GAMG;AACU,QAAA,2BAA2B,GAAwB;IAC9D,qBAAqB,EAAE;QACrB,UAAU,EAAE,CAAC,mFAAmF,CAAC;QACjG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvD,IAAI,iIAAiI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/J,IAAI,kFAAkF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,mBAAmB,EAAE;QACnB,UAAU,EAAE,CAAC,4DAA4D,CAAC;QAC1E,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,wFAAwF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtH,IAAI,uEAAuE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrG,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,UAAU,EAAE;QACV,UAAU,EAAE,CAAC,iEAAiE,CAAC;QAC/E,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,iHAAiH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/I,IAAI,kFAAkF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,aAAa,EAAE;QACb,UAAU,EAAE,CAAC,8EAA8E,CAAC;QAC5F,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnF,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrD,IAAI,6DAA6D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,gCAAgC,EAAE;QAChC,UAAU,EAAE;YACV,yEAAyE;YACzE,qFAAqF;YACrF,2EAA2E;SAC5E;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,4EAA4E;YAC5E,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrE,IAAI,sEAAsE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpG,2BAA2B;YAC3B,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/D,+BAA+B;YAC/B,IAAI,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnE,2BAA2B;YAC3B,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/D,iCAAiC;YACjC,IAAI,+EAA+E,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7G,yCAAyC;YACzC,IAAI,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5D,IAAI,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5E,6DAA6D;YAC7D,IACE,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;gBACxD,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC7C,uFAAuF,CAAC,IAAI,CAAC,KAAK,CAAC;gBACnG,OAAO,IAAI,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEW,QAAA,WAAW,GAAoG;IAC1H,mBAAmB,EAAE,mCAA2B;IAChD,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,qTAAqT;IACvT,SAAS,EAAE,0FAA0F;IACrG,UAAU,EAAE,CAAC,SAAS,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,oBAAoB,CAAC;IAE9H,eAAe,EAAE;QACf;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,sGAAsG;YAC9G,SAAS,EAAE,4FAA4F;SACxG;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8GAA8G;YACtH,SAAS,EAAE,8EAA8E;SAC1F;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,gHAAgH;YACxH,SAAS,EAAE,oEAAoE;SAChF;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,oHAAoH;YAC5H,SAAS,EAAE,sEAAsE;SAClF;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,6HAA6H;YACrI,SAAS,EAAE,iFAAiF;SAC7F;QACD;YACE,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,0GAA0G;YAClH,SAAS,EAAE,6DAA6D;SACzE;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kGAAkG;YAC1G,SAAS,EAAE,mFAAmF;SAC/F;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kGAAkG;YAC1G,SAAS,EAAE,mFAAmF;SAC/F;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8FAA8F;YACtG,SAAS,EAAE,sEAAsE;SAClF;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,4GAA4G;YACpH,SAAS,EAAE,wEAAwE;SACpF;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2KAA2K;YACnL,SAAS,EAAE,kIAAkI;SAC9I;KACF;IAED,YAAY,EAAE;QACZ,iBAAiB,EAAE;YACjB,iBAAiB,EAAE;gBACjB,uBAAuB;gBACvB,qBAAqB;gBACrB,YAAY;gBACZ,kCAAkC;aACnC;YACD,uBAAuB,EAAE,OAAO;YAChC,wBAAwB,EAAE,MAAM;SACjC;QACD,qBAAqB,EAAE;YACrB,4BAA4B,EAAE,IAAI;YAClC,kCAAkC,EAAE,IAAI;YACxC,kCAAkC,EAAE,IAAI;SACzC;QACD,gBAAgB,EAAE;YAChB,oCAAoC,EAAE,IAAI;YAC1C,uCAAuC,EAAE,IAAI;YAC7C,iCAAiC,EAAE,IAAI;SACxC;QACD,oBAAoB,EAAE;YACpB,2BAA2B,EAAE,IAAI;YACjC,6BAA6B,EAAE,IAAI;YACnC,uCAAuC,EAAE,IAAI;SAC9C;QACD,uBAAuB,EAAE;YACvB,0BAA0B,EAAE,IAAI;YAChC,sCAAsC,EAAE,IAAI;SAC7C;QACD,WAAW,EAAE;YACX,kCAAkC,EAAE,IAAI;YACxC,qCAAqC,EAAE,IAAI;SAC5C;QACD,iBAAiB,EAAE;YACjB,kBAAkB,EAAE,IAAI;YACxB,kCAAkC,EAAE,IAAI;SACzC;QACD,cAAc,EAAE;YACd,2CAA2C,EAAE,IAAI;YACjD,qCAAqC,EAAE,IAAI;SAC5C;QACD,qBAAqB,EAAE;YACrB,uCAAuC,EAAE,IAAI;YAC7C,iCAAiC,EAAE,IAAI;SACxC;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE,CAAC,aAAa,EAAE,mBAAmB,CAAC;QAC1D,YAAY,EAAE,EAAE;KACjB;IAED,UAAU,EAAE;QACV,cAAc,EAAE;YACd,uBAAuB;YACvB,qBAAqB;YACrB,YAAY;YACZ,eAAe;YACf,yEAAyE;YACzE,kCAAkC;SACnC;QACD,eAAe,EAAE;YACf,qBAAqB,EAAE,OAAO;YAC9B,mBAAmB,EAAE,OAAO;YAC5B,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,MAAM;YACrB,mFAAmF;YACnF,kGAAkG;YAClG,gCAAgC,EAAE,OAAO;SAC1C;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,SAAS;QAC7B,qBAAqB,EAAE,cAAc;KACtC;IACD,kHAAkH;IAClH,iHAAiH;IACjH,sBAAsB,EAAE,CAAC,uBAAuB,EAAE,qBAAqB,CAAC;IAExE,eAAe,EAAE;QACf,WAAW,EAAE,CAAC,IAAI,CAAC;QACnB,8DAA8D;QAC9D,qBAAqB,EAAE,IAAI;QAC3B,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,iFAAiF;KAC7F;IAED,cAAc,EAAE;QACd,sHAAsH;QACtH,yBAAyB,EAAE,EAAE;QAC7B,SAAS,EAAE,mHAAmH;QAC9H,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,8BAA8B,EAAE,kBAAkB,CAAC;QAC9F,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,uBAAuB;YAC3B,WAAW,EAAE,oEAAoE;YACjF,SAAS,EAAE,sDAAsD;YACjE,KAAK,EAAE,8BAA8B;YACrC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,oBAAoB;YACxB,WAAW,EAAE,wEAAwE;YACrF,SAAS,EAAE,yDAAyD;YACpE,KAAK,EAAE,2BAA2B;YAClC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,WAAW,EAAE,iGAAiG;YAC9G,SAAS,EAAE,8DAA8D;YACzE,KAAK,EAAE,kCAAkC;YACzC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,yBAAyB;YAC7B,WAAW,EAAE,oDAAoD;YACjE,SAAS,EAAE,qBAAqB;YAChC,KAAK,EAAE,gCAAgC;YACvC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,WAAW,EAAE,gEAAgE;YAC7E,SAAS,EAAE,sDAAsD;YACjE,KAAK,EAAE,oCAAoC;YAC3C,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,yBAAyB;YAC7B,WAAW,EAAE,qDAAqD;YAClE,SAAS,EAAE,qBAAqB;YAChC,KAAK,EAAE,gCAAgC;YACvC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,8BAA8B;YAClC,WAAW,EAAE,4DAA4D;YACzE,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,qCAAqC;YAC5C,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,WAAW,EAAE,sDAAsD;YACnE,SAAS,EAAE,qEAAqE;YAChF,KAAK,EAAE,6BAA6B;YACpC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,yBAAyB;YAC7B,WAAW,EAAE,+EAA+E;YAC5F,SAAS,EAAE,yCAAyC;YACpD,KAAK,EAAE,gCAAgC;YACvC,YAAY,EAAE,QAAQ;SACvB;KACF;CACF,CAAC"}

package/dist/packs/migration-manifest.d.ts

@@ -0,0 +1,30 @@
+/**
+ * W3: Pack version migration manifest.
+ *
+ * Declarative list of pack version transitions with deprecation dates and
+ * breaking-change notes. Loaded at boot by MigrationManifest.applyBootChecks().
+ *
+ * Rules:
+ *   - Deprecated pack versions remain enforceable for a minimum of 180 days.
+ *   - Boot-warning at 90 days before deprecation date.
+ *   - Hard-refuse (GovernanceMigrationError) at the declared deprecation date.
+ *
+ * Adding a new deprecation entry:
+ *   1. Set deprecationDate to at least 180 days from the current date.
+ *   2. Document breakingChangeNotes so operators know what to fix.
+ *   3. Set upgradeTo to the recommended successor version.
+ *
+ * @connexum/ai-governance
+ */
+import { MigrationManifest, type PackMigrationEntry } from './index';
+/**
+ * The default migration manifest instance.
+ * Loaded at boot by the governance server via applyBootChecks().
+ */
+export declare const defaultMigrationManifest: MigrationManifest;
+/**
+ * Build a migration manifest with custom entries and/or clock override.
+ * Used in tests to inject a test clock (nowFn) and synthetic entries.
+ */
+export declare function buildMigrationManifest(entries: PackMigrationEntry[], nowFn?: () => Date): MigrationManifest;
+//# sourceMappingURL=migration-manifest.d.ts.map

package/dist/packs/migration-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-manifest.d.ts","sourceRoot":"","sources":["../../src/packs/migration-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,SAAS,CAAC;AA0BrE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,mBAAiC,CAAC;AAEvE;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,kBAAkB,EAAE,EAC7B,KAAK,CAAC,EAAE,MAAM,IAAI,GACjB,iBAAiB,CAEnB"}

package/dist/packs/migration-manifest.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * W3: Pack version migration manifest.
+ *
+ * Declarative list of pack version transitions with deprecation dates and
+ * breaking-change notes. Loaded at boot by MigrationManifest.applyBootChecks().
+ *
+ * Rules:
+ *   - Deprecated pack versions remain enforceable for a minimum of 180 days.
+ *   - Boot-warning at 90 days before deprecation date.
+ *   - Hard-refuse (GovernanceMigrationError) at the declared deprecation date.
+ *
+ * Adding a new deprecation entry:
+ *   1. Set deprecationDate to at least 180 days from the current date.
+ *   2. Document breakingChangeNotes so operators know what to fix.
+ *   3. Set upgradeTo to the recommended successor version.
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultMigrationManifest = void 0;
+exports.buildMigrationManifest = buildMigrationManifest;
+const index_1 = require("./index");
+/**
+ * All known pack deprecation entries.
+ * Currently empty -- all packs are at v1.0.0 and none are deprecated yet.
+ *
+ * This manifest is intentionally forward-looking: entries will be added
+ * when specific pack versions are superseded by newer ones that contain
+ * breaking changes to classifiers, categories, or validator contracts.
+ *
+ * Example entry (DO NOT uncomment -- this is illustrative only):
+ *
+ * {
+ *   packId: 'hipaa',
+ *   deprecatedVersion: '1.0.0',
+ *   deprecationDate: '2027-01-01',
+ *   upgradeTo: '1.1.0',
+ *   breakingChangeNotes:
+ *     'HIPAA 2025 NPRM finalised: mandatory encryption at rest; ' +
+ *     'categoryClassifiers updated for MFA patterns.',
+ * },
+ */
+const ENTRIES = [
+// No deprecated versions yet. Entries will be added as packs evolve.
+];
+/**
+ * The default migration manifest instance.
+ * Loaded at boot by the governance server via applyBootChecks().
+ */
+exports.defaultMigrationManifest = new index_1.MigrationManifest(ENTRIES);
+/**
+ * Build a migration manifest with custom entries and/or clock override.
+ * Used in tests to inject a test clock (nowFn) and synthetic entries.
+ */
+function buildMigrationManifest(entries, nowFn) {
+    return new index_1.MigrationManifest(entries, nowFn);
+}
+//# sourceMappingURL=migration-manifest.js.map

package/dist/packs/migration-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-manifest.js","sourceRoot":"","sources":["../../src/packs/migration-manifest.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAsCH,wDAKC;AAzCD,mCAAqE;AAErE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,GAAyB;AACpC,qEAAqE;CACtE,CAAC;AAEF;;;GAGG;AACU,QAAA,wBAAwB,GAAG,IAAI,yBAAiB,CAAC,OAAO,CAAC,CAAC;AAEvE;;;GAGG;AACH,SAAgB,sBAAsB,CACpC,OAA6B,EAC7B,KAAkB;IAElB,OAAO,IAAI,yBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC"}

package/dist/packs/naic-mdl.d.ts

@@ -0,0 +1,50 @@
+/**
+ * NAIC Model Data Law Compliance Pack
+ *
+ * National Association of Insurance Commissioners (NAIC) Insurance
+ * Data Security Model Law (MDL-668), adopted 2017. As of 2026, 25+
+ * US states have enacted MDL-668 or substantively equivalent statutes.
+ * Key adopting states include: AL, AK, CT, DE, GA, HI, IA, ID, IL,
+ * IN, KY, LA, ME, MI, MN, MS, MT, NH, NJ, NV, OH, OK, OR, RI, SC,
+ * SD, TN, TX, VA, VT, WI.
+ *
+ * AI relevance: insurance AI systems (pricing models, fraud detection,
+ * underwriting, claims processing, telematics) are explicitly in scope
+ * as "information systems" that process nonpublic information (NPI).
+ * The 2024 NAIC Model Bulletin on AI uses in Insurance adds algorithmic
+ * accountability and bias monitoring obligations that layer on top of
+ * MDL-668's data security requirements.
+ *
+ * Key MDL-668 obligations:
+ *   - Section 4: Information Security Program (ISP) with written
+ *     risk assessment
+ *   - Section 5: Board oversight of ISP; annual certification
+ *   - Section 6: Third-party service provider (TPSP) oversight
+ *     with contractual safeguards
+ *   - Section 7: Investigation and notification of cybersecurity events
+ *     (72-hour notification to Commissioner; prompt notification to
+ *     affected consumers where feasible)
+ *   - Section 8: Annual certification to Commissioner by large licensees
+ *   - 2024 Model Bulletin (AI): risk management, bias testing, adverse
+ *     action explanation, vendor AI accountability
+ *
+ * Sovereignty: US (state-by-state adoption; no single federal statute).
+ *
+ * // TODO verify citation with Vera: confirm Section 7 notification
+ * // deadline as 72 hours -- some state enactments vary (e.g., Ohio).
+ *
+ * @connexum/ai-governance
+ */
+import { CompliancePack } from './index';
+import { CategoryClassifiers } from '../classification/pack-driven-classifier';
+/**
+ * NAIC MDL-668 (Insurance Data Security Model Law) category classifiers.
+ * Protects Nonpublic Information (NPI) of insurance customers:
+ * health, financial, and personal NPI; biometric data.
+ */
+export declare const NAIC_MDL_CATEGORY_CLASSIFIERS: CategoryClassifiers;
+export declare const NAIC_MDL_PACK: CompliancePack & {
+    categoryClassifiers: CategoryClassifiers;
+    subjectKeyedCategories: string[];
+};
+//# sourceMappingURL=naic-mdl.d.ts.map

package/dist/packs/naic-mdl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"naic-mdl.d.ts","sourceRoot":"","sources":["../../src/packs/naic-mdl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,mBA2C3C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,cAAc,GAAG;IAAE,mBAAmB,EAAE,mBAAmB,CAAC;IAAC,sBAAsB,EAAE,MAAM,EAAE,CAAA;CA+NxH,CAAC"}