/**
 * EU Digital Services Act (DSA) Compliance Pack
 *
 * Regulation: Regulation (EU) 2022/2065 of the European Parliament and
 *   of the Council of 19 October 2022 on a Single Market For Digital
 *   Services. Fully applicable from 17 February 2024 for all in-scope
 *   intermediary services; VLOP / VLOSE designations applied earlier.
 *
 * Jurisdiction: EU-wide
 * Authority:
 *   - European Commission — VLOP / VLOSE supervision (very large
 *     online platforms / search engines >45M EU monthly users)
 *   - National Digital Services Coordinators (DSCs) — supervision of
 *     non-VLOP services + cooperation with Commission
 *
 * Why this pack (separate from UK Online Safety Act):
 *   - UK Online Safety Act 2023 (`uk-online-safety-act` pack) and EU
 *     DSA are PARALLEL regimes — distinct statutes, different
 *     regulators, different penalty scales, different VLOP thresholds,
 *     different transparency-report cadences.
 *   - Multi-region online services need BOTH packs registered.
 *   - DSA introduces unique obligations: trusted flaggers, statement
 *     of reasons (SoR), DSA transparency database, researcher access
 *     (Art. 40), risk assessments + mitigation (Art. 34/35).
 *
 * Service tiers (the DSA uses a layered cake of obligations):
 *   - **All intermediary services** (Arts. 11–18) — basic obligations
 *   - **Hosting services** (Arts. 16–18) — notice + action mechanism
 *   - **Online platforms** (Arts. 19–28) — internal complaint, trusted
 *     flaggers, ban on dark patterns, ad transparency, minor protection
 *   - **VLOPs / VLOSEs** (Arts. 33–43) — risk assessments + mitigations
 *     + auditing + crisis response + researcher access + recommender
 *     transparency
 *
 * Penalties:
 *   - Up to 6% of worldwide annual turnover
 *   - Periodic penalty payments up to 5% of worldwide daily turnover
 *   - VLOP / VLOSE supervisory fees
 *
 * Out of scope:
 *   - UK Online Safety Act 2023 (separate pack)
 *   - EU DMA (separate pack — different regime: gatekeeper conduct vs
 *     platform content)
 *   - GDPR personal-data overlays (separate pack)
 *
 * @connexum/ai-governance
 */
export const EU_DSA_CATEGORY_CLASSIFIERS = {
    ILLEGAL_CONTENT_NOTICE: {
        references: ['DSA Art. 16 — notice and action mechanism'],
        classifier: (input) => {
            if (/\b(?:dsa\s+(?:notice|notice\s+and\s+action|art\.?\s*16)|article\s+16\s+dsa|illegal\s+content\s+notice\s+dsa)\b/i.test(input))
                return true;
            if (/\b(?:trusted\s+flagger|art\.?\s*22\s+dsa|notice\s+priority\s+treatment)\b/i.test(input))
                return true;
            return false;
        },
    },
    STATEMENT_OF_REASONS: {
        references: ['DSA Art. 17 — statement of reasons'],
        classifier: (input) => {
            if (/\b(?:statement\s+of\s+reasons|sor\s+dsa|art\.?\s*17\s+dsa|dsa\s+transparency\s+database)\b/i.test(input))
                return true;
            return false;
        },
    },
    RISK_ASSESSMENT_DSA: {
        references: ['DSA Arts. 34, 35 — VLOP/VLOSE systemic risk assessment + mitigation'],
        classifier: (input) => {
            if (/\b(?:dsa\s+risk\s+assessment|art\.?\s*34\s+dsa|art\.?\s*35\s+dsa|systemic\s+risk\s+(?:assessment|mitigation)\s+dsa)\b/i.test(input))
                return true;
            if (/\b(?:vlop\s+risk\s+assessment|vlose\s+risk\s+assessment|crisis\s+response\s+dsa)\b/i.test(input))
                return true;
            return false;
        },
    },
    RECOMMENDER_TRANSPARENCY: {
        references: ['DSA Arts. 27, 38 — recommender system transparency'],
        classifier: (input) => {
            if (/\b(?:recommender\s+(?:transparency|system|parameter)\s+dsa|art\.?\s*27\s+dsa|art\.?\s*38\s+dsa)\b/i.test(input))
                return true;
            if (/\b(?:non[\s-]?profiling\s+option|recommender\s+opt[\s-]?out)\b/i.test(input))
                return true;
            return false;
        },
    },
    AD_TRANSPARENCY: {
        references: ['DSA Arts. 26, 39 — advertising transparency + repository'],
        classifier: (input) => {
            if (/\b(?:dsa\s+ad\s+(?:transparency|repository)|art\.?\s*26\s+dsa|art\.?\s*39\s+dsa|ad\s+repository\s+dsa)\b/i.test(input))
                return true;
            return false;
        },
    },
    RESEARCHER_ACCESS: {
        references: ['DSA Art. 40 — researcher data access'],
        classifier: (input) => {
            if (/\b(?:dsa\s+researcher\s+access|art\.?\s*40\s+dsa|vetted\s+researcher\s+dsa)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const EU_DSA_PACK = {
    categoryClassifiers: EU_DSA_CATEGORY_CLASSIFIERS,
    id: 'eu-dsa',
    aliases: ['dsa', 'digital-services-act', 'regulation-2022-2065', 'eu-digital-services-act'],
    name: 'EU Digital Services Act (Regulation (EU) 2022/2065)',
    version: '1.0.0',
    description: 'EU Digital Services Act — fully applicable 17 Feb 2024. Layered-cake regime: all intermediary services (Arts. 11-18) → hosting services (Arts. 16-18 notice and action) → online platforms (Arts. 19-28: internal complaint, trusted flaggers, dark-pattern ban, ad transparency, minor protection) → VLOPs / VLOSEs (Arts. 33-43: systemic risk assessment + mitigation, auditing, crisis response, researcher access, recommender transparency). EU peer of UK Online Safety Act 2023 (`uk-online-safety-act` pack); multi-region services need BOTH. Penalties up to 6% global turnover; periodic penalty payments up to 5% global daily turnover.',
    authority: 'European Commission (VLOP/VLOSE supervision) + National Digital Services Coordinators',
    industries: ['technology', 'media', 'social-media', 'gaming', 'search', 'cloud-infrastructure', 'adult-content'],
    requiredModules: [
        { name: 'governance-runtime', required: true, reason: 'Notice-and-action gate; trusted-flagger priority treatment; dark-pattern ban (Art. 25); minor-protection gate.', reference: 'DSA Arts. 16, 22, 25, 28' },
        { name: 'data-classifier', required: true, reason: 'Detect illegal-content notices, SoR records, risk assessments, recommender transparency artefacts, ad-repository submissions, researcher-access requests.', reference: 'DSA evidence categorisation' },
        { name: 'attestation-manager', required: true, reason: 'Service-tier designation (intermediary / hosting / platform / VLOP / VLOSE); trusted-flagger registration; risk-assessment cycle (annual for VLOPs); independent-audit attestation (Art. 37).', reference: 'DSA Arts. 33, 37' },
        { name: 'event-bus', required: true, reason: 'SoR routing to DSA transparency database; trusted-flagger priority queue; researcher-access ticket routing; crisis-response trigger (Art. 36).', reference: 'DSA Arts. 17, 22, 36, 40' },
        { name: 'audit-integrity', required: true, reason: 'Tamper-evident audit chain for moderation decisions, SoRs, risk-assessment revisions, audit-report responses — required for Commission / DSC investigation.', reference: 'DSA evidentiary integrity' },
        { name: 'transparency-injector', required: true, reason: 'Terms of service publication (Art. 14); ad-repository visibility; recommender-transparency disclosure + non-profiling option; trusted-flagger surface.', reference: 'DSA Arts. 14, 26, 27, 39' },
        { name: 'approval-queue', required: true, reason: 'Material policy changes routed for senior + legal review (T2); risk-mitigation measure approval; audit-report sign-off.', reference: 'DSA Arts. 35, 37' },
        { name: 'session-persistence', required: true, reason: 'Moderation + SoR records retained at least the limitation period; audit-report archive across the audit cycle.', reference: 'DSA Art. 37 audit cycle; Limitation rules' },
        { name: 'agent-auth', required: true, reason: 'Trusted-flagger identity binding; vetted-researcher identity binding for Art. 40 access.', reference: 'DSA Arts. 22, 40' },
        { name: 'supply-chain', required: true, reason: 'Sub-supplier moderation / hosting / age-assurance attestation; processor flow-down for in-scope services.', reference: 'DSA service-chain accountability' },
    ],
    moduleConfig: {
        'governance-runtime': { dsaNoticeAndActionGateRequired: true, darkPatternBanGateRequired: true, minorProtectionGateRequired: true },
        'data-classifier': { enabledCategories: ['ILLEGAL_CONTENT_NOTICE', 'STATEMENT_OF_REASONS', 'RISK_ASSESSMENT_DSA', 'RECOMMENDER_TRANSPARENCY', 'AD_TRANSPARENCY', 'RESEARCHER_ACCESS', 'CREDENTIALS'], credentialsAction: 'BLOCK' },
        'attestation-manager': { serviceTierDesignationTracked: true, trustedFlaggerRegistrationTracked: true, vlopRiskAssessmentAnnualRequired: true, independentAuditAttestationRequired: true },
        'event-bus': { sorRoutingToDsaTransparencyDbRequired: true, trustedFlaggerPriorityQueueRequired: true, researcherAccessTicketRoutingRequired: true, crisisResponseTriggerRequired: true },
        'audit-integrity': { dsaInvestigationEvidenceTrackingRequired: true },
        'transparency-injector': { termsOfServicePublicationRequired: true, adRepositoryVisibilityRequired: true, recommenderTransparencyRequired: true, nonProfilingOptionRequired: true },
        'approval-queue': { reviewTier: 'T2' },
        'session-persistence': { retentionDaysMinimum: 2190 },
        'agent-auth': { trustedFlaggerIdentityBindingRequired: true, researcherIdentityBindingRequired: true },
        'supply-chain': { processorFlowDownRequired: true },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-EU', 'PROCESSOR-CONTRACT', 'DSA-EVIDENCE-EXPORT'],
        blockReasons: { deepseek: 'PRC jurisdiction. DSA evidence chain (moderation decisions, SoRs, risk assessments) cannot route through PRC.', baidu: 'PRC jurisdiction.', alibaba: 'PRC jurisdiction.' },
    },
    dataPolicy: {
        scanCategories: ['ILLEGAL_CONTENT_NOTICE', 'STATEMENT_OF_REASONS', 'RISK_ASSESSMENT_DSA', 'RECOMMENDER_TRANSPARENCY', 'AD_TRANSPARENCY', 'RESEARCHER_ACCESS', 'CREDENTIALS'],
        categoryActions: { ILLEGAL_CONTENT_NOTICE: 'WARN', STATEMENT_OF_REASONS: 'WARN', RISK_ASSESSMENT_DSA: 'WARN', RECOMMENDER_TRANSPARENCY: 'WARN', AD_TRANSPARENCY: 'WARN', RESEARCHER_ACCESS: 'WARN', CREDENTIALS: 'BLOCK' },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: { auditLogRetentionDays: 2190, sessionRetentionDays: 2190, incidentRetentionDays: 2190, reference: 'DSA Art. 37 audit cycle; civil-claim limitation periods', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['eu'] },
    incidentPolicy: { notificationDeadlineHours: 72, reference: 'DSA Art. 11 single point of contact; Commission information notice timing', requiredRecipients: ['european-commission', 'national-digital-services-coordinator', 'data-protection-officer'], formalNotificationRequired: true },
    validators: [
        { id: 'eu-dsa-service-tier-designated', description: 'Service tier designated (intermediary / hosting / platform / VLOP / VLOSE) with rationale.', reference: 'DSA Arts. 11-43', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'eu-dsa-notice-and-action', description: 'Notice and action mechanism active for hosting services; trusted-flagger priority queue.', reference: 'DSA Arts. 16, 22', check: 'governance_active', failSeverity: 'CRITICAL' },
        { id: 'eu-dsa-statement-of-reasons', description: 'Statement of Reasons issued + submitted to DSA transparency database for every moderation action.', reference: 'DSA Art. 17', check: 'monitoring_active', failSeverity: 'CRITICAL' },
        { id: 'eu-dsa-vlop-risk-assessment', description: 'Annual systemic risk assessment + mitigation plan filed for VLOPs/VLOSEs.', reference: 'DSA Arts. 34, 35', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'eu-dsa-recommender-transparency', description: 'Recommender system parameters disclosed; non-profiling option offered.', reference: 'DSA Arts. 27, 38', check: 'transparency_active', failSeverity: 'HIGH' },
        { id: 'eu-dsa-ad-transparency', description: 'Ad repository visible; ad-targeting parameters disclosed.', reference: 'DSA Arts. 26, 39', check: 'transparency_active', failSeverity: 'HIGH' },
        { id: 'eu-dsa-researcher-access', description: 'Vetted-researcher access pathway available per Art. 40 for VLOPs/VLOSEs.', reference: 'DSA Art. 40', check: 'attestation_active', failSeverity: 'HIGH' },
        { id: 'eu-dsa-independent-audit', description: 'Independent audit (Art. 37) completed annually for VLOPs/VLOSEs; audit-report archived.', reference: 'DSA Art. 37', check: 'attestation_active', failSeverity: 'HIGH' },
        { id: 'eu-dsa-evidence-audit-trail', description: 'Tamper-evident audit chain covers moderation decisions, SoRs, risk assessments, audit reports.', reference: 'DSA evidentiary integrity', check: 'audit_trail_exists', failSeverity: 'HIGH' },
        { id: 'eu-dsa-credential-block', description: 'Plaintext credentials blocked from DSA evidence artefacts.', reference: 'DSA evidence integrity', check: 'data_classifier_active', failSeverity: 'CRITICAL' },
    ],
};
//# sourceMappingURL=eu-dsa.js.map