@connexum/ai-governance 1.0.0-beta.11

package/dist/packs/nz-privacy.js

@@ -0,0 +1,468 @@
+"use strict";
+/**
+ * New Zealand Privacy Act 2020 Compliance Pack
+ *
+ * Regulation: Privacy Act 2020 (No 31 of 2020)
+ *             Replaces Privacy Act 1993
+ *
+ * Jurisdiction: NZ (New Zealand / Aotearoa)
+ * Regulator: Office of the Privacy Commissioner (OPC)
+ *             Privacy Commissioner appointed under Privacy Act 2020, s 11
+ *
+ * Effective date: 1 December 2020
+ *
+ * Scope:
+ *   Applies to any "agency" handling personal information about individuals
+ *   who are in New Zealand at the time the information is collected (or
+ *   subsequently transferred). Extra-territorial: applies to overseas agencies
+ *   "carrying on business in New Zealand" -- pack must flag NZ data subject
+ *   presence even when processing happens offshore.
+ *   Does NOT apply to: natural persons acting in purely personal capacity,
+ *   news media in news activities (limited exemption), intelligence agencies,
+ *   Parliament.
+ *
+ * Key obligations (13 Information Privacy Principles -- IPPs):
+ *   IPP 1:  Purpose of collection -- only collect what is necessary for a
+ *            lawful purpose connected to the agency's functions.
+ *   IPP 2:  Collection directly from individual -- unless impracticable or
+ *            expressly authorised by law.
+ *   IPP 3:  Collection of information from individual -- inform before or at
+ *            time of collection (purpose, legal authority, recipients, rights).
+ *   IPP 4:  Manner of collection -- must not collect by unlawful or unfair means.
+ *   IPP 5:  Storage and security -- protect personal information from
+ *            unauthorised access, use, modification, disclosure, and loss.
+ *   IPP 6:  Access -- individuals have right to access their personal information
+ *            held by the agency.
+ *   IPP 7:  Correction -- individuals have right to request correction of
+ *            personal information.
+ *   IPP 8:  Accuracy -- personal information must be accurate, up to date,
+ *            complete, relevant, and not misleading before use.
+ *   IPP 9:  Retention -- personal information not retained longer than necessary
+ *            for purpose; secure disposal required.
+ *   IPP 10: Use limitation -- personal information only used for the purpose
+ *            for which it was collected (limited exceptions).
+ *   IPP 11: Disclosure limitation -- personal information only disclosed for
+ *            collection purpose or with individual's consent (exceptions exist).
+ *   IPP 12: Unique identifiers -- restrictions on assigning or requiring
+ *            unique identifiers.
+ *   IPP 13: Transborder data flows (cross-border disclosure) -- personal
+ *            information may only be disclosed to overseas recipients where
+ *            the recipient is subject to comparable safeguards. Key test:
+ *            destination country's regime must be "not materially lower"
+ *            than the Privacy Act 2020 standard.
+ *
+ * Notifiable Privacy Breach Reporting (NPBR):
+ *   Under the Privacy Act 2020, agencies must notify the Privacy Commissioner
+ *   and affected individuals of a privacy breach that has caused or is likely
+ *   to cause serious harm. The notification must be "as soon as reasonably
+ *   practicable" -- no fixed hour deadline but 72 hours is the operational
+ *   expectation in practice; OPC guidance emphasises promptness.
+ *
+ * Critical IPP 13 (Transborder Flows) rule:
+ *   Pack must flag NZ data subject presence even when processing happens in
+ *   another country. Overseas agencies carrying on business in NZ are subject
+ *   to the Act. The "comparable safeguards" test is outcome-based, not a fixed
+ *   adequacy list like GDPR -- agencies must assess whether the destination
+ *   regime is not materially lower than NZ standards.
+ *
+ * Biometric Code (forthcoming):
+ *   The Privacy Commissioner is developing a Biometric Processing Privacy Code
+ *   under s 202 of the Act. When finalised, biometric data will face additional
+ *   obligations. Pack tracks biometric information for monitoring under any
+ *   future Code requirements.
+ *
+ * Retention:
+ *   IPP 9: only as long as needed for purpose. Secure disposal required.
+ *   No fixed statutory minimum for most data types.
+ *
+ * Penalties:
+ *   Interference with privacy: orders including compensation up to NZD 350,000
+ *   for proceedings before the Human Rights Review Tribunal (HRRT).
+ *   Offences: up to NZD 10,000 for specific statutory offences (e.g., misleading
+ *   OPC, destroying documents after access request).
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NZ_PRIVACY_PACK = exports.NZ_PRIVACY_CATEGORY_CLASSIFIERS = void 0;
+exports.NZ_PRIVACY_CATEGORY_CLASSIFIERS = {
+    PERSONAL_INFORMATION_NZ: {
+        references: ['Privacy Act 2020 s 7 -- personal information defined as information about an identifiable individual; IPP 1-13 scope'],
+        classifier: (input) => {
+            if (/\b(?:personal\s+information\s+nz|new\s+zealand\s+personal\s+information|nz\s+privacy\s+act|privacy\s+act\s+2020\s+nz)\b/i.test(input))
+                return true;
+            if (/\b(?:nz\s+pii|new\s+zealand\s+pii|nz\s+data\s+subject|aotearoa\s+personal\s+data|nz\s+individual\s+information)\b/i.test(input))
+                return true;
+            if (/\b(?:ipp\s+compliance|information\s+privacy\s+principle|new\s+zealand\s+agency\s+data|nz\s+privacy\s+commissioner)\b/i.test(input))
+                return true;
+            if (/\b(?:nz\s+customer\s+data\s+privacy|privacy\s+act\s+nz\s+2020|opc\s+nz\s+data)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    SENSITIVE_PERSONAL_INFORMATION_NZ: {
+        references: ['Privacy Act 2020 -- while NZ Act lacks explicit sensitive categories like GDPR, health, ethnicity, and other sensitive categories receive heightened protection in OPC guidance and sector codes'],
+        classifier: (input) => {
+            if (/\b(?:sensitive\s+personal\s+information\s+nz|nz\s+sensitive\s+data\s+privacy|health\s+information\s+nz\s+privacy|nz\s+ethnicity\s+data)\b/i.test(input))
+                return true;
+            if (/\b(?:nz\s+health\s+data\s+privacy|health\s+information\s+privacy\s+code|hipc\s+nz|new\s+zealand\s+sensitive\s+data)\b/i.test(input))
+                return true;
+            if (/\b(?:nz\s+mental\s+health\s+data|nz\s+financial\s+data\s+privacy\s+act|nz\s+religion\s+data\s+privacy)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    BIOMETRIC_INFORMATION_NZ: {
+        references: ['Privacy Act 2020 + forthcoming Biometric Processing Privacy Code (s 202) -- biometric data faces forthcoming additional obligations; currently treated as personal information'],
+        classifier: (input) => {
+            if (/\b(?:biometric\s+information\s+nz|nz\s+biometric\s+data|new\s+zealand\s+biometric|nz\s+biometric\s+processing)\b/i.test(input))
+                return true;
+            if (/\b(?:biometric\s+code\s+nz|nz\s+facial\s+recognition|nz\s+fingerprint\s+data|nz\s+voice\s+biometric\s+privacy)\b/i.test(input))
+                return true;
+            if (/\b(?:nz\s+biometric\s+privacy\s+code|privacy\s+commissioner\s+nz\s+biometric|nz\s+biometric\s+ai)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CHILD_PERSONAL_INFORMATION_NZ: {
+        references: ['Privacy Act 2020 -- OPC guidance emphasises heightened protection for children\'s personal information; no separate statutory category but OPC expects extra care'],
+        classifier: (input) => {
+            if (/\b(?:child\s+personal\s+information\s+nz|children.s\s+data\s+nz\s+privacy|nz\s+minor\s+data\s+privacy|nz\s+child\s+privacy)\b/i.test(input))
+                return true;
+            if (/\b(?:new\s+zealand\s+children\s+data|nz\s+youth\s+data\s+privacy|nz\s+under.18\s+personal\s+information|child\s+data\s+nz\s+opc)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CROSS_BORDER_DISCLOSURE_NZ: {
+        references: ['Privacy Act 2020 IPP 13 -- transborder data flows: comparable safeguards test; overseas disclosure only where recipient subject to not-materially-lower protections'],
+        classifier: (input) => {
+            if (/\b(?:ipp\s+13|transborder\s+data\s+flow\s+nz|cross.border\s+disclosure\s+nz|nz\s+overseas\s+data\s+transfer)\b/i.test(input))
+                return true;
+            if (/\b(?:comparable\s+safeguards\s+nz|new\s+zealand\s+overseas\s+transfer|nz\s+cross.border\s+data\s+disclosure|privacy\s+act\s+2020\s+ipp\s+13)\b/i.test(input))
+                return true;
+            if (/\b(?:nz\s+data\s+export\s+privacy|nz\s+transborder\s+personal\s+information|overseas\s+agency\s+nz\s+privacy)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    NOTIFIABLE_PRIVACY_BREACH_NZ: {
+        references: ['Privacy Act 2020 ss 113-120 -- notifiable privacy breach reporting (NPBR): notify OPC and individuals of breaches likely to cause serious harm'],
+        classifier: (input) => {
+            if (/\b(?:notifiable\s+privacy\s+breach\s+nz|npbr\s+nz|nz\s+privacy\s+breach\s+notification|privacy\s+act\s+2020\s+breach)\b/i.test(input))
+                return true;
+            if (/\b(?:opc\s+breach\s+notification|nz\s+privacy\s+incident\s+report|serious\s+harm\s+breach\s+nz|new\s+zealand\s+privacy\s+breach)\b/i.test(input))
+                return true;
+            if (/\b(?:nz\s+data\s+breach\s+privacy\s+act|privacy\s+commissioner\s+breach\s+notification\s+nz)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    AGENCY_COMPLIANCE_PROGRAM_NZ: {
+        references: ['Privacy Act 2020 -- agency compliance program; Privacy Commissioner guidance on privacy management frameworks (PMF)'],
+        classifier: (input) => {
+            if (/\b(?:nz\s+privacy\s+compliance\s+program|agency\s+compliance\s+nz\s+privacy|nz\s+privacy\s+management\s+framework|pmf\s+nz)\b/i.test(input))
+                return true;
+            if (/\b(?:new\s+zealand\s+privacy\s+program|opc\s+compliance\s+program|nz\s+privacy\s+governance|privacy\s+act\s+2020\s+compliance\s+program)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PII: {
+        references: ['Privacy Act 2020 s 7 -- personal information; NZ IRD number (Inland Revenue), NHI number (National Health Index), passport number as common identifiers'],
+        classifier: (input) => {
+            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
+                return true;
+            // NZ IRD number format: 8-9 digits
+            if (/\b\d{8,9}\b/.test(input) && /\b(?:ird\s+number|inland\s+revenue|new\s+zealand\s+tax\s+number|nz\s+tax\s+id)\b/i.test(input))
+                return true;
+            // NHI number format: 3 letters + 4 digits (old) or 3 letters + 2 letters + 2 digits (new)
+            if (/\b[A-Za-z]{3}\d{4}\b/.test(input) && /\b(?:nhi|national\s+health\s+index|nz\s+health\s+number)\b/i.test(input))
+                return true;
+            if (/\b(?:nz\s+passport\s+number|new\s+zealand\s+driver.s\s+licence|nz\s+driver.s\s+licence)\b/i.test(input))
+                return true;
+            if (/\b(?:name|address|date\s+of\s+birth)\s*[:=]\s*["']?.{2,}["']?/i.test(input) && /\b(?:nz|new\s+zealand|aotearoa)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CREDENTIALS: {
+        references: ['Privacy Act 2020 IPP 5 -- storage and security; OPC guidance on technical security measures'],
+        classifier: (input) => {
+            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
+                return true;
+            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
+                return true;
+            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
+                return true;
+            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+exports.NZ_PRIVACY_PACK = {
+    categoryClassifiers: exports.NZ_PRIVACY_CATEGORY_CLASSIFIERS,
+    id: 'nz-privacy',
+    aliases: [],
+    name: 'New Zealand Privacy Act 2020',
+    version: '1.0.0',
+    description: 'New Zealand Privacy Act 2020 (No 31 of 2020, effective 1 December 2020 -- replaces 1993 Act). Governed by the Office of the Privacy Commissioner (OPC). Applies to any "agency" handling personal information in New Zealand, and extra-territorially to overseas agencies carrying on business in NZ -- pack flags NZ data subject presence even when processing occurs offshore. Encodes all 13 Information Privacy Principles (IPPs): purpose (IPP1), direct collection (IPP2), collection notice (IPP3), lawful collection (IPP4), security (IPP5), access (IPP6), correction (IPP7), accuracy (IPP8), retention (IPP9), use limitation (IPP10), disclosure limitation (IPP11), unique identifiers (IPP12), transborder flows (IPP13). Key: IPP13 comparable safeguards test is outcome-based (not a fixed adequacy list); destination regime must be "not materially lower" than NZ standards. Notifiable Privacy Breach Reporting (NPBR): notify OPC and affected individuals as soon as reasonably practicable for breaches likely to cause serious harm. Biometric Processing Privacy Code forthcoming under s 202.',
+    authority: 'Office of the Privacy Commissioner (OPC) -- New Zealand / Aotearoa',
+    industries: ['all', 'healthcare', 'financial-services', 'technology', 'public-sector', 'education', 'retail', 'telecommunications'],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'Enforce all 13 IPP compliance gates: purpose limitation (IPP1, IPP10), use limitation, disclosure limitation (IPP11). Extra-territorial flag: detect NZ data subject presence even when processing occurs outside NZ. Comparable safeguards assessment for IPP13 transborder flows.',
+            reference: 'Privacy Act 2020 IPP 1 (purpose), IPP 10 (use limitation), IPP 11 (disclosure limitation), IPP 13 (transborder flows comparable safeguards); s 10 (extra-territorial application to overseas agencies carrying on business in NZ)',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'Human review gate before: (1) transborder data disclosure -- verify comparable safeguards (IPP13); (2) secondary use or disclosure beyond collection purpose -- verify exception applies; (3) biometric processing -- monitor for forthcoming Biometric Code requirements; (4) processing children\'s information -- verify additional safeguards.',
+            reference: 'Privacy Act 2020 IPP 13 -- transborder disclosure gate; IPP 10/11 -- secondary use/disclosure exception review; s 202 -- forthcoming Biometric Code requirements; OPC guidance on high-risk processing review',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Classify: personal information (NZ), sensitive personal information (health, ethnicity -- OPC heightened protection), biometric information (monitoring for forthcoming Code), child personal information, cross-border disclosure records, notifiable breach records.',
+            reference: 'Privacy Act 2020 s 7 -- personal information; IPP 5 -- security classification; Health Information Privacy Code 2020 (HIPC) -- health information; OPC guidance on sensitive categories; s 202 -- biometric information',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident audit trail for: IPP compliance decisions, collection notices issued (IPP3), access and correction request responses (IPP6/7), transborder disclosure records (IPP13), notifiable breach records (NPBR), unique identifier assignments (IPP12). Required for OPC investigation.',
+            reference: 'Privacy Act 2020 IPP 6/7 -- access and correction request audit trail; ss 113-120 -- NPBR records; IPP 13 -- transborder disclosure records; OPC investigation powers (s 67 et seq.); HRRT proceedings evidence',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'Privacy Management Framework documentation; privacy impact assessment (PIA) records for high-risk processing; collection notice templates and issuance records (IPP3); transborder disclosure comparable safeguards assessment; unique identifier assignment register (IPP12).',
+            reference: 'Privacy Act 2020 -- agency compliance program; OPC Privacy Management Framework guide; IPP 3 -- collection notice documentation; IPP 12 -- unique identifier assignment records; IPP 13 -- comparable safeguards assessment documentation',
+        },
+        {
+            name: 'encryption-layer',
+            required: true,
+            reason: 'IPP 5 security obligation: protect personal information from unauthorised access, use, modification, disclosure, and loss. Encryption at rest and in transit for all personal information. Heightened controls for health information (HIPC) and biometric information.',
+            reference: 'Privacy Act 2020 IPP 5 -- storage and security: take reasonable steps to protect personal information; OPC technical security guidance; Health Information Privacy Code 2020 -- health data encryption; OPC guidance on biometric data security',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'Notifiable Privacy Breach Reporting (NPBR): breach detection triggers OPC notification and affected individual notification as soon as reasonably practicable. Serious harm threshold assessment. Breach investigation and containment workflow. HRRT complaint escalation.',
+            reference: 'Privacy Act 2020 ss 113-120 -- NPBR obligation: notify OPC and individuals as soon as reasonably practicable; ss 71-91 -- OPC complaints investigation; ss 92-100 -- HRRT proceedings; serious harm assessment (s 113)',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'Agencies remain responsible for personal information disclosed to processors/third parties. IPP 13 comparable safeguards test applies to overseas processors. Written agreements with processors including security, purpose limitation, and transborder flow controls.',
+            reference: 'Privacy Act 2020 IPP 5 -- security applies to information held by processors; IPP 11 -- disclosure to third parties; IPP 13 -- comparable safeguards for overseas processors; agency accountability for processor actions',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'IPP 9 retention: retain personal information only as long as necessary for purpose. Secure disposal required. Unique identifier lifecycle management (IPP12). Notifiable breach records and access/correction request response records retained per OPC guidance.',
+            reference: 'Privacy Act 2020 IPP 9 -- retention: not longer than necessary; secure disposal; IPP 12 -- unique identifier records; OPC guidance on retention periods; NPBR records per ss 113-120',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'IPP 3 collection notice: inform individuals before or at collection of purpose, legal authority, recipients, and rights. Transborder disclosure notification. Access and correction rights notification. Breach notification to affected individuals. Privacy policy publication.',
+            reference: 'Privacy Act 2020 IPP 3 -- collection notice at or before collection; IPP 6 -- access rights notice; IPP 7 -- correction rights notice; ss 113-120 -- breach notification to affected individuals; OPC privacy notice guidance',
+        },
+        {
+            name: 'bias-monitor',
+            required: true,
+            reason: 'IPP 8 accuracy obligation: personal information must not be misleading before use in decisions affecting individuals. Monitor AI outputs for accuracy and bias that could produce unfair decisions. Heightened monitoring for decisions affecting NZ data subjects based on sensitive categories.',
+            reference: 'Privacy Act 2020 IPP 8 -- accuracy before use: ensure information is accurate, up to date, complete, and not misleading; OPC guidance on AI decision-making accuracy; IPP 10 use limitation and accuracy intersection',
+        },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            ipp13ComparableSafeguardsCheckRequired: true,
+            extraTerritorialNzFlagRequired: true,
+            purposeLimitationIpp1Required: true,
+            useLimitationIpp10Required: true,
+            disclosureLimitationIpp11Required: true,
+            uniqueIdentifierIpp12Required: true,
+        },
+        'approval-queue': {
+            transborderDisclosureGateRequired: true,
+            secondaryUseReviewRequired: true,
+            biometricProcessingMonitoringRequired: true,
+            childDataAdditionalSafeguardsRequired: true,
+        },
+        'data-classifier': {
+            enabledCategories: ['PERSONAL_INFORMATION_NZ', 'SENSITIVE_PERSONAL_INFORMATION_NZ', 'BIOMETRIC_INFORMATION_NZ', 'CHILD_PERSONAL_INFORMATION_NZ', 'CROSS_BORDER_DISCLOSURE_NZ', 'NOTIFIABLE_PRIVACY_BREACH_NZ', 'AGENCY_COMPLIANCE_PROGRAM_NZ', 'PII', 'CREDENTIALS'],
+            personalInformationNzAction: 'WARN',
+            sensitivePersonalInformationNzAction: 'WARN',
+            biometricInformationNzAction: 'WARN',
+            childPersonalInformationNzAction: 'WARN',
+            crossBorderDisclosureNzAction: 'WARN',
+            credentialsAction: 'BLOCK',
+        },
+        'transparency-injector': {
+            ipp3CollectionNoticeRequired: true,
+            accessRightsNotificationRequired: true,
+            correctionRightsNotificationRequired: true,
+            breachNotificationAffectedIndividualsRequired: true,
+            privacyPolicyPublicationRequired: true,
+            aiUseDisclosureRequired: true,
+        },
+        'attestation-manager': {
+            privacyManagementFrameworkRequired: true,
+            privacyImpactAssessmentForHighRiskRequired: true,
+            collectionNoticeTemplateRequired: true,
+            transborderSafeguardsAssessmentRequired: true,
+            uniqueIdentifierAssignmentRegisterRequired: true,
+        },
+        'event-bus': {
+            // F-NEW-VERA-PACK-C3-02: corrected from nprsBranchNotificationOpcRequired (typo);
+            // NPBR = Notifiable Privacy Breach Reporting per NZ Privacy Act 2020 s.114.
+            npbrNotificationOpcRequired: true,
+            seriousHarmThresholdAssessmentRequired: true,
+            affectedIndividualNotificationRequired: true,
+            opcComplaintEscalationRequired: true,
+        },
+        'session-persistence': {
+            ipp9RetentionLimitationEnforced: true,
+            secureDisposalRequired: true,
+            uniqueIdentifierLifecycleManaged: true,
+            breachRecordRetentionRequired: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
+        requiredCapabilities: ['DATA-RESIDENCY-NZ-OR-COMPARABLE', 'IPP13-COMPARABLE-SAFEGUARDS', 'PROCESSOR-CONTRACT'],
+        blockReasons: {
+            deepseek: 'PRC National Intelligence Law. New Zealand OPC\'s IPP 13 comparable safeguards test: PRC regime is not "not materially lower" than NZ Privacy Act 2020 standards given mandatory government access obligations. Transfer to PRC-based providers fails the IPP 13 comparable safeguards test.',
+            baidu: 'PRC jurisdiction. OPC IPP 13 comparable safeguards test: PRC data protection regime does not meet the "not materially lower" standard for NZ personal information. Transfer of NZ personal information to PRC-based providers violates IPP 13.',
+            alibaba: 'PRC jurisdiction. OPC IPP 13 comparable safeguards test: PRC regime fails the NZ "not materially lower" comparable safeguards standard. Transfer of NZ personal information to PRC-based providers is incompatible with IPP 13 requirements.',
+        },
+    },
+    dataPolicy: {
+        scanCategories: ['PERSONAL_INFORMATION_NZ', 'SENSITIVE_PERSONAL_INFORMATION_NZ', 'BIOMETRIC_INFORMATION_NZ', 'CHILD_PERSONAL_INFORMATION_NZ', 'CROSS_BORDER_DISCLOSURE_NZ', 'NOTIFIABLE_PRIVACY_BREACH_NZ', 'AGENCY_COMPLIANCE_PROGRAM_NZ', 'PII', 'CREDENTIALS'],
+        categoryActions: {
+            PERSONAL_INFORMATION_NZ: 'WARN',
+            SENSITIVE_PERSONAL_INFORMATION_NZ: 'WARN',
+            BIOMETRIC_INFORMATION_NZ: 'WARN',
+            CHILD_PERSONAL_INFORMATION_NZ: 'WARN',
+            CROSS_BORDER_DISCLOSURE_NZ: 'WARN',
+            NOTIFIABLE_PRIVACY_BREACH_NZ: 'WARN',
+            AGENCY_COMPLIANCE_PROGRAM_NZ: 'WARN',
+            PII: 'WARN',
+            CREDENTIALS: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256-GCM',
+        minimumClassification: 'INTERNAL',
+    },
+    retentionPolicy: {
+        // IPP 9: retain only as long as necessary for purpose.
+        // No fixed statutory minimum for most data types.
+        // Using 3 years as operational baseline; breach records per OPC guidance.
+        auditLogRetentionDays: 1095, // 3 years
+        sessionRetentionDays: 1095,
+        incidentRetentionDays: 1825, // 5 years for breach records
+        reference: 'Privacy Act 2020 IPP 9 -- not retained longer than necessary for purpose; secure disposal required; NPBR records per ss 113-120 and OPC guidance; access/correction request records per IPP 6/7; OPC investigation retention (s 67 et seq.)',
+        forceDelete: false,
+        requiresLegalHoldSupport: false,
+        sovereignty: ['nz'],
+    },
+    incidentPolicy: {
+        // F-NEW-VERA-PACK-C6-03 (2026-05-03): Clarification on 72h deadline status.
+        // Privacy Act 2020 ss 113-120: the statutory standard is "as soon as reasonably
+        // practicable" after the agency becomes aware of a notifiable privacy breach (NPB).
+        // There is NO fixed 72-hour statutory clock under NZ law.
+        // The 72-hour value here is an OPERATIONAL CONVENTION ONLY -- it mirrors the
+        // GDPR/ISO 27001 industry norm that most NZ entities adopt for internal SLAs.
+        // Operators MUST NOT represent this as a statutory deadline to regulators.
+        // Authoritative source: Privacy Act 2020 ss 113-120; OPC guidance "Notifiable
+        // Privacy Breaches" (privacy.org.nz) -- verify current OPC guidance edition.
+        notificationDeadlineHours: 72,
+        reference: 'Privacy Act 2020 ss 113-120 -- Notifiable Privacy Breach Reporting: notify OPC and affected individuals as soon as reasonably practicable; serious harm threshold (s 113); OPC guidance on prompt notification expectation; ss 71-91 -- OPC investigation on breach complaints',
+        requiredRecipients: ['office-of-the-privacy-commissioner-nz', 'affected-individuals', 'chief-privacy-officer', 'chief-compliance-officer'],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'nz-privacy-ipp-compliance-framework',
+            description: 'All 13 Information Privacy Principles (IPP 1-13) compliance framework ACTIVE: purpose limitation, collection notice, security, access/correction rights, use/disclosure limitation, unique identifier restrictions, and transborder flow controls enforced.',
+            reference: 'Privacy Act 2020 IPP 1-13 -- full suite: purpose (1), direct collection (2), notice (3), lawful collection (4), security (5), access (6), correction (7), accuracy (8), retention (9), use limitation (10), disclosure limitation (11), unique identifiers (12), transborder (13)',
+            check: 'governance_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nz-privacy-ipp13-transborder-gate',
+            description: 'IPP 13 transborder disclosure gate ACTIVE: personal information only disclosed to overseas recipients where destination regime provides safeguards "not materially lower" than NZ Privacy Act 2020. Comparable safeguards assessment required before each cross-border disclosure.',
+            reference: 'Privacy Act 2020 IPP 13 -- transborder data flows: comparable safeguards test; outcome-based standard (not a fixed adequacy list); OPC guidance on assessing destination country regimes against NZ standard',
+            check: 'approval_queue_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nz-privacy-npbr-workflow',
+            description: 'Notifiable Privacy Breach Reporting (NPBR) workflow ACTIVE: privacy breach detection triggers serious harm assessment, OPC notification, and affected individual notification as soon as reasonably practicable. Breach containment and investigation workflow active.',
+            reference: 'Privacy Act 2020 ss 113-120 -- NPBR obligation; s 113 -- serious harm threshold; OPC breach notification guidance; prompt notification expectation; affected individual notification requirements',
+            check: 'event_bus_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nz-privacy-ipp3-collection-notice',
+            description: 'IPP 3 collection notice ACTIVE: individuals informed before or at time of collection of purpose, legal authority, whether supply is voluntary or mandatory, and rights of access/correction. Notice issued for all personal information collection.',
+            reference: 'Privacy Act 2020 IPP 3 -- collection of information from individual: inform of purpose, authority, voluntary/mandatory, access/correction rights; OPC guidance on collection notice content and timing',
+            check: 'transparency_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nz-privacy-ipp5-security',
+            description: 'IPP 5 security measures ACTIVE: personal information protected against unauthorised access, use, modification, disclosure, and loss. Encryption at rest and in transit enforced. Heightened controls for health information (HIPC) and biometric data.',
+            reference: 'Privacy Act 2020 IPP 5 -- storage and security: reasonable steps to protect; OPC technical security guidance; Health Information Privacy Code 2020 -- health data security; forthcoming Biometric Code requirements',
+            check: 'encryption_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nz-privacy-extra-territorial',
+            description: 'Extra-territorial applicability monitor ACTIVE: NZ data subject presence flagged even when processing occurs outside New Zealand. Overseas agencies "carrying on business in NZ" are subject to Privacy Act 2020 -- foreign entity handling NZ individual data is within scope.',
+            reference: 'Privacy Act 2020 s 10 -- extra-territorial application: applies to overseas agencies carrying on business in NZ; OPC guidance on offshore agency obligations; IPP 13 applies to outbound transfers from such agencies',
+            check: 'monitoring_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nz-privacy-agency-compliance-program',
+            description: 'Privacy Management Framework (PMF) documentation ACTIVE: agency compliance program maintained; privacy impact assessments (PIAs) completed for high-risk processing; unique identifier assignment register maintained (IPP 12); comparable safeguards assessments on file.',
+            reference: 'Privacy Act 2020 -- agency compliance obligations; OPC Privacy Management Framework guide; IPP 12 -- unique identifier register; IPP 13 -- safeguards assessment documentation; OPC guidance on PIAs',
+            check: 'attestation_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nz-privacy-ipp6-7-access-correction',
+            description: 'Access and correction rights ACTIVE: individuals can access personal information held about them (IPP 6) and request correction (IPP 7). Request response workflow within required timeframes. Audit trail of all access and correction decisions.',
+            reference: 'Privacy Act 2020 IPP 6 -- right of access to personal information; IPP 7 -- right to request correction; OPC guidance on response timeframes; HRRT remedy for access/correction refusal',
+            check: 'audit_trail_exists',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nz-privacy-processor-contracts',
+            description: 'Processor and third-party disclosure controls ACTIVE: written agreements with overseas processors include IPP13 comparable safeguards obligations; disclosure to third parties limited per IPP 11; agency accountability for processor actions maintained.',
+            reference: 'Privacy Act 2020 IPP 11 -- disclosure limitation; IPP 13 -- comparable safeguards for overseas processors; IPP 5 -- security applies to processors; OPC guidance on third-party disclosure and offshore processing contracts',
+            check: 'subservice_registry_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nz-privacy-ipp8-accuracy',
+            description: 'IPP 8 accuracy monitoring ACTIVE: personal information verified as accurate, up to date, complete, relevant, and not misleading before use in decisions affecting individuals. AI output accuracy monitoring active for NZ data subject decisions.',
+            reference: 'Privacy Act 2020 IPP 8 -- accuracy before use: not misleading; OPC guidance on accuracy obligation for AI-assisted decision-making affecting individuals; IPP 10 use limitation and accuracy intersection',
+            check: 'bias_monitor_active',
+            failSeverity: 'MEDIUM',
+        },
+        {
+            id: 'nz-privacy-biometric-monitoring',
+            description: 'Biometric information monitoring ACTIVE: biometric data flagged for heightened controls in anticipation of forthcoming Biometric Processing Privacy Code (s 202). Current processing treated as personal information with IPP 5 security obligations.',
+            reference: 'Privacy Act 2020 s 202 -- Privacy Commissioner power to issue Biometric Processing Privacy Code; OPC biometric consultation (2023-2024); current: IPP 5 security + Privacy Act 2020 general obligations apply',
+            check: 'data_classifier_active',
+            failSeverity: 'MEDIUM',
+        },
+    ],
+};
+//# sourceMappingURL=nz-privacy.js.map

package/dist/packs/nz-privacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nz-privacy.js","sourceRoot":"","sources":["../../src/packs/nz-privacy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;;;AAKU,QAAA,+BAA+B,GAAwB;IAClE,uBAAuB,EAAE;QACvB,UAAU,EAAE,CAAC,sHAAsH,CAAC;QACpI,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,0HAA0H,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxJ,IAAI,oHAAoH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClJ,IAAI,uHAAuH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrJ,IAAI,mFAAmF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,iCAAiC,EAAE;QACjC,UAAU,EAAE,CAAC,kMAAkM,CAAC;QAChN,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,4IAA4I,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1K,IAAI,wHAAwH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtJ,IAAI,2GAA2G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,wBAAwB,EAAE;QACxB,UAAU,EAAE,CAAC,gLAAgL,CAAC;QAC9L,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,mHAAmH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjJ,IAAI,mHAAmH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjJ,IAAI,sGAAsG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,6BAA6B,EAAE;QAC7B,UAAU,EAAE,CAAC,mKAAmK,CAAC;QACjL,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,gIAAgI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9J,IAAI,qIAAqI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnK,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,0BAA0B,EAAE;QAC1B,UAAU,EAAE,CAAC,qKAAqK,CAAC;QACnL,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,iHAAiH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/I,IAAI,iJAAiJ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/K,IAAI,kHAAkH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChJ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,4BAA4B,EAAE;QAC5B,UAAU,EAAE,CAAC,gJAAgJ,CAAC;QAC9J,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,0HAA0H,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxJ,IAAI,qIAAqI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnK,IAAI,iGAAiG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/H,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,4BAA4B,EAAE;QAC5B,UAAU,EAAE,CAAC,qHAAqH,CAAC;QACnI,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,gIAAgI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9J,IAAI,6IAA6I,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3K,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,yJAAyJ,CAAC;QACvK,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnF,mCAAmC;YACnC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,mFAAmF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9I,0FAA0F;YAC1F,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,6DAA6D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjI,IAAI,4FAA4F,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1H,IAAI,gEAAgE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClJ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,WAAW,EAAE;QACX,UAAU,EAAE,CAAC,6FAA6F,CAAC;QAC3G,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnG,IAAI,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEW,QAAA,eAAe,GAAkE;IAC5F,mBAAmB,EAAE,uCAA+B;IACpD,EAAE,EAAE,YAAY;IAChB,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,8BAA8B;IACpC,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,6jCAA6jC;IAC/jC,SAAS,EAAE,oEAAoE;IAC/E,UAAU,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,QAAQ,EAAE,oBAAoB,CAAC;IAEnI,eAAe,EAAE;QACf;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,qRAAqR;YAC7R,SAAS,EAAE,mOAAmO;SAC/O;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,oVAAoV;YAC5V,SAAS,EAAE,+MAA+M;SAC3N;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,wQAAwQ;YAChR,SAAS,EAAE,yNAAyN;SACrO;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,gSAAgS;YACxS,SAAS,EAAE,iNAAiN;SAC7N;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,gRAAgR;YACxR,SAAS,EAAE,2OAA2O;SACvP;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,yQAAyQ;YACjR,SAAS,EAAE,iPAAiP;SAC7P;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,6QAA6Q;YACrR,SAAS,EAAE,wNAAwN;SACpO;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,yQAAyQ;YACjR,SAAS,EAAE,2NAA2N;SACvO;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,mQAAmQ;YAC3Q,SAAS,EAAE,sLAAsL;SAClM;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,mRAAmR;YAC3R,SAAS,EAAE,+NAA+N;SAC3O;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,mSAAmS;YAC3S,SAAS,EAAE,uNAAuN;SACnO;KACF;IAED,YAAY,EAAE;QACZ,oBAAoB,EAAE;YACpB,sCAAsC,EAAE,IAAI;YAC5C,8BAA8B,EAAE,IAAI;YACpC,6BAA6B,EAAE,IAAI;YACnC,0BAA0B,EAAE,IAAI;YAChC,iCAAiC,EAAE,IAAI;YACvC,6BAA6B,EAAE,IAAI;SACpC;QACD,gBAAgB,EAAE;YAChB,iCAAiC,EAAE,IAAI;YACvC,0BAA0B,EAAE,IAAI;YAChC,qCAAqC,EAAE,IAAI;YAC3C,qCAAqC,EAAE,IAAI;SAC5C;QACD,iBAAiB,EAAE;YACjB,iBAAiB,EAAE,CAAC,yBAAyB,EAAE,mCAAmC,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,KAAK,EAAE,aAAa,CAAC;YACpQ,2BAA2B,EAAE,MAAM;YACnC,oCAAoC,EAAE,MAAM;YAC5C,4BAA4B,EAAE,MAAM;YACpC,gCAAgC,EAAE,MAAM;YACxC,6BAA6B,EAAE,MAAM;YACrC,iBAAiB,EAAE,OAAO;SAC3B;QACD,uBAAuB,EAAE;YACvB,4BAA4B,EAAE,IAAI;YAClC,gCAAgC,EAAE,IAAI;YACtC,oCAAoC,EAAE,IAAI;YAC1C,6CAA6C,EAAE,IAAI;YACnD,gCAAgC,EAAE,IAAI;YACtC,uBAAuB,EAAE,IAAI;SAC9B;QACD,qBAAqB,EAAE;YACrB,kCAAkC,EAAE,IAAI;YACxC,0CAA0C,EAAE,IAAI;YAChD,gCAAgC,EAAE,IAAI;YACtC,uCAAuC,EAAE,IAAI;YAC7C,0CAA0C,EAAE,IAAI;SACjD;QACD,WAAW,EAAE;YACX,kFAAkF;YAClF,4EAA4E;YAC5E,2BAA2B,EAAE,IAAI;YACjC,sCAAsC,EAAE,IAAI;YAC5C,sCAAsC,EAAE,IAAI;YAC5C,8BAA8B,EAAE,IAAI;SACrC;QACD,qBAAqB,EAAE;YACrB,+BAA+B,EAAE,IAAI;YACrC,sBAAsB,EAAE,IAAI;YAC5B,gCAAgC,EAAE,IAAI;YACtC,6BAA6B,EAAE,IAAI;SACpC;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;QAClD,oBAAoB,EAAE,CAAC,iCAAiC,EAAE,6BAA6B,EAAE,oBAAoB,CAAC;QAC9G,YAAY,EAAE;YACZ,QAAQ,EAAE,8RAA8R;YACxS,KAAK,EAAE,gPAAgP;YACvP,OAAO,EAAE,8OAA8O;SACxP;KACF;IAED,UAAU,EAAE;QACV,cAAc,EAAE,CAAC,yBAAyB,EAAE,mCAAmC,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,KAAK,EAAE,aAAa,CAAC;QACjQ,eAAe,EAAE;YACf,uBAAuB,EAAE,MAAM;YAC/B,iCAAiC,EAAE,MAAM;YACzC,wBAAwB,EAAE,MAAM;YAChC,6BAA6B,EAAE,MAAM;YACrC,0BAA0B,EAAE,MAAM;YAClC,4BAA4B,EAAE,MAAM;YACpC,4BAA4B,EAAE,MAAM;YACpC,GAAG,EAAE,MAAM;YACX,WAAW,EAAE,OAAO;SACrB;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,aAAa;QACjC,qBAAqB,EAAE,UAAU;KAClC;IAED,eAAe,EAAE;QACf,uDAAuD;QACvD,kDAAkD;QAClD,0EAA0E;QAC1E,qBAAqB,EAAE,IAAI,EAAE,UAAU;QACvC,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE,IAAI,EAAE,6BAA6B;QAC1D,SAAS,EAAE,6OAA6O;QACxP,WAAW,EAAE,KAAK;QAClB,wBAAwB,EAAE,KAAK;QAC/B,WAAW,EAAE,CAAC,IAAI,CAAC;KACpB;IAED,cAAc,EAAE;QACd,4EAA4E;QAC5E,gFAAgF;QAChF,oFAAoF;QACpF,0DAA0D;QAC1D,6EAA6E;QAC7E,8EAA8E;QAC9E,2EAA2E;QAC3E,8EAA8E;QAC9E,6EAA6E;QAC7E,yBAAyB,EAAE,EAAE;QAC7B,SAAS,EAAE,gRAAgR;QAC3R,kBAAkB,EAAE,CAAC,uCAAuC,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,0BAA0B,CAAC;QAC1I,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,qCAAqC;YACzC,WAAW,EAAE,6PAA6P;YAC1Q,SAAS,EAAE,mRAAmR;YAC9R,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,mCAAmC;YACvC,WAAW,EAAE,oRAAoR;YACjS,SAAS,EAAE,8MAA8M;YACzN,KAAK,EAAE,uBAAuB;YAC9B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,WAAW,EAAE,wQAAwQ;YACrR,SAAS,EAAE,mMAAmM;YAC9M,KAAK,EAAE,kBAAkB;YACzB,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,mCAAmC;YACvC,WAAW,EAAE,qPAAqP;YAClQ,SAAS,EAAE,wMAAwM;YACnN,KAAK,EAAE,qBAAqB;YAC5B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,WAAW,EAAE,wPAAwP;YACrQ,SAAS,EAAE,qNAAqN;YAChO,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,8BAA8B;YAClC,WAAW,EAAE,iRAAiR;YAC9R,SAAS,EAAE,uNAAuN;YAClO,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,sCAAsC;YAC1C,WAAW,EAAE,4QAA4Q;YACzR,SAAS,EAAE,sMAAsM;YACjN,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,qCAAqC;YACzC,WAAW,EAAE,oPAAoP;YACjQ,SAAS,EAAE,yLAAyL;YACpM,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,gCAAgC;YACpC,WAAW,EAAE,4PAA4P;YACzQ,SAAS,EAAE,8NAA8N;YACzO,KAAK,EAAE,4BAA4B;YACnC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,WAAW,EAAE,oPAAoP;YACjQ,SAAS,EAAE,2MAA2M;YACtN,KAAK,EAAE,qBAAqB;YAC5B,YAAY,EAAE,QAAQ;SACvB;QACD;YACE,EAAE,EAAE,iCAAiC;YACrC,WAAW,EAAE,uPAAuP;YACpQ,SAAS,EAAE,+MAA+M;YAC1N,KAAK,EAAE,wBAAwB;YAC/B,YAAY,EAAE,QAAQ;SACvB;KACF;CACF,CAAC"}

package/dist/packs/part11.d.ts

@@ -0,0 +1,31 @@
+/**
+ * 21 CFR Part 11 Compliance Pack
+ *
+ * FDA Electronic Records and Electronic Signatures (1997), under:
+ *   - FDA 2003 Scope & Application Guidance (risk-based enforcement)
+ *   - EU Annex 11 (GMP equivalent for computerised systems)
+ *   - FDA 2024 GenAI guidance for clinical records (AI provenance)
+ *
+ * Applies when AI agents create, modify, maintain, archive, retrieve,
+ * or transmit records required by an FDA predicate rule (21 CFR Part
+ * 211 GMP, Part 58 GLP, Part 312 IND, Part 314 NDA, Part 820 QSR).
+ *
+ * ALCOA+ data integrity principles: Attributable, Legible,
+ * Contemporaneous, Original, Accurate + Complete, Consistent,
+ * Enduring, Available.
+ *
+ * @connexum/ai-governance
+ */
+import { CompliancePack } from './index';
+import { CategoryClassifiers } from '../classification/pack-driven-classifier';
+/**
+ * 21 CFR Part 11 (FDA Electronic Records / Electronic Signatures) category classifiers.
+ * Part 11 governs process flows: validation (IQ/OQ/PQ), e-signature, audit trail,
+ * and ALCOA+ for regulated electronic records. Classification targets regulated records,
+ * PHI in clinical systems, PII, credentials, and AI-generated content in GxP systems.
+ */
+export declare const PART11_CATEGORY_CLASSIFIERS: CategoryClassifiers;
+export declare const PART11_PACK: CompliancePack & {
+    categoryClassifiers: CategoryClassifiers;
+};
+//# sourceMappingURL=part11.d.ts.map

package/dist/packs/part11.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"part11.d.ts","sourceRoot":"","sources":["../../src/packs/part11.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAI/E;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,mBAwCzC,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,cAAc,GAAG;IAAE,mBAAmB,EAAE,mBAAmB,CAAA;CAoQpF,CAAC"}