"use strict";
/**
 * EU Digital Markets Act (DMA) Compliance Pack
 *
 * Regulation: Regulation (EU) 2022/1925 — Digital Markets Act. In force
 *   1 November 2022; gatekeeper designation regime applied from 2 May
 *   2023; gatekeeper conduct obligations applied 6 March 2024.
 *
 * Jurisdiction: EU-wide
 * Authority: European Commission (DG COMP) — primary enforcer; can
 *   designate gatekeepers and impose fines + behavioural / structural
 *   remedies.
 *
 * Why this pack (separate from UK CMA / DMCC):
 *   - UK CMA AI Foundation Models + DMCC Act 2024 (`cma-ai-foundation-models`
 *     pack) and EU DMA are PARALLEL gatekeeper / market-power regimes.
 *   - DMA designates "gatekeepers" providing "core platform services"
 *     (CPS): online intermediation, search, social network, video-sharing,
 *     interpersonal-communications, OS, web browser, virtual assistant,
 *     cloud computing, online advertising.
 *   - Once designated, gatekeepers face per-CPS conduct obligations
 *     (Arts. 5, 6, 7) plus a notification regime for acquisitions (Art. 14).
 *   - Multi-region platforms need both `cma-ai-foundation-models` and
 *     this pack registered.
 *
 * Designated gatekeepers (current Commission list, illustrative):
 *   - Alphabet, Amazon, Apple, ByteDance, Meta, Microsoft, Booking
 *   - Each designated for one or more of the 22 designated CPS
 *
 * Key obligations:
 *   - **Art. 5 dos and don'ts** — cross-CPS data combination prohibited
 *     without explicit consent; fair sign-up to other services; etc.
 *   - **Art. 6 specific conduct rules** — interoperability, sideloading,
 *     business-user access to data, choice screens, etc.
 *   - **Art. 7 interoperability for messaging services** — phased plan
 *     for end-user-to-end-user interoperability
 *   - **Art. 14 acquisition notification** — gatekeeper must notify
 *     concentrations
 *   - **Art. 15 audited compliance report** — annual
 *   - **Compliance officer** — Art. 28 named accountable executive
 *
 * Penalties:
 *   - Up to 10% of total worldwide annual turnover (or 20% for repeat)
 *   - Periodic penalty payments up to 5% of average daily worldwide turnover
 *   - Behavioural / structural remedies for systemic non-compliance
 *
 * Out of scope:
 *   - UK CMA AI Foundation Models + DMCC Act 2024 (separate pack)
 *   - EU DSA (separate pack — content / platform safety, not gatekeeper conduct)
 *   - General Competition Articles 101 / 102 TFEU enforcement
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.EU_DMA_PACK = exports.EU_DMA_CATEGORY_CLASSIFIERS = void 0;
exports.EU_DMA_CATEGORY_CLASSIFIERS = {
    GATEKEEPER_DESIGNATION: {
        references: ['DMA Art. 3 — gatekeeper designation'],
        classifier: (input) => {
            if (/\b(?:gatekeeper\s+designation|dma\s+art\.?\s*3|core\s+platform\s+service\s+designation|cps\s+designation)\b/i.test(input))
                return true;
            return false;
        },
    },
    ARTICLE_5_DOS_DONTS: {
        references: ['DMA Art. 5 — gatekeeper dos and don\'ts'],
        classifier: (input) => {
            if (/\b(?:art\.?\s*5\s+dma|dma\s+art\.?\s*5|cross[\s-]?cps\s+data\s+(?:combination|sharing)\s+dma)\b/i.test(input))
                return true;
            if (/\b(?:explicit\s+consent\s+dma|self[\s-]?preferencing\s+dma|tying\s+dma|fair\s+sign[\s-]?up\s+dma)\b/i.test(input))
                return true;
            return false;
        },
    },
    ARTICLE_6_SPECIFIC_RULES: {
        references: ['DMA Art. 6 — specific conduct rules'],
        classifier: (input) => {
            if (/\b(?:art\.?\s*6\s+dma|dma\s+art\.?\s*6|interoperability\s+(?:dma|gatekeeper)|sideloading\s+dma)\b/i.test(input))
                return true;
            if (/\b(?:choice\s+screen\s+dma|business[\s-]?user\s+(?:data|access)\s+dma|app\s+store\s+dma)\b/i.test(input))
                return true;
            return false;
        },
    },
    ARTICLE_7_MESSAGING_INTEROP: {
        references: ['DMA Art. 7 — messaging interoperability'],
        classifier: (input) => {
            if (/\b(?:art\.?\s*7\s+dma|messaging\s+interoperability\s+dma|interpersonal\s+communications\s+dma)\b/i.test(input))
                return true;
            return false;
        },
    },
    ACQUISITION_NOTIFICATION: {
        references: ['DMA Art. 14 — concentration notification'],
        classifier: (input) => {
            if (/\b(?:art\.?\s*14\s+dma|dma\s+art\.?\s*14|gatekeeper\s+(?:acquisition|concentration)\s+notification)\b/i.test(input))
                return true;
            return false;
        },
    },
    COMPLIANCE_REPORT_DMA: {
        references: ['DMA Art. 15 — audited compliance report'],
        classifier: (input) => {
            if (/\b(?:dma\s+(?:compliance\s+report|art\.?\s*15)|art\.?\s*15\s+dma|annual\s+gatekeeper\s+compliance\s+report)\b/i.test(input))
                return true;
            return false;
        },
    },
    COMPLIANCE_OFFICER_DMA: {
        references: ['DMA Art. 28 — compliance officer'],
        classifier: (input) => {
            if (/\b(?:dma\s+compliance\s+officer|art\.?\s*28\s+dma|gatekeeper\s+compliance\s+officer)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.EU_DMA_PACK = {
    categoryClassifiers: exports.EU_DMA_CATEGORY_CLASSIFIERS,
    id: 'eu-dma',
    aliases: ['dma', 'digital-markets-act', 'regulation-2022-1925', 'eu-digital-markets-act'],
    name: 'EU Digital Markets Act (Regulation (EU) 2022/1925)',
    version: '1.0.0',
    description: 'EU Digital Markets Act — gatekeeper designation + per-CPS conduct obligations (Arts. 5, 6, 7), Art. 14 acquisition notification, Art. 15 annual audited compliance report, Art. 28 compliance officer. EU peer of UK CMA AI Foundation Models + DMCC Act 2024 (`cma-ai-foundation-models` pack); multi-region platforms need both. Penalties up to 10% global turnover (20% repeat); periodic penalty payments up to 5% daily worldwide turnover; behavioural / structural remedies for systemic non-compliance.',
    authority: 'European Commission (DG COMP)',
    industries: ['technology', 'cloud-infrastructure', 'media', 'social-media', 'search', 'mobile', 'advertising'],
    requiredModules: [
        { name: 'attestation-manager', required: true, reason: 'Gatekeeper designation status tracked; per-CPS obligation map; Art. 14 notification log; Art. 15 annual compliance report archived; Art. 28 compliance officer named.', reference: 'DMA Arts. 3, 14, 15, 28' },
        { name: 'governance-runtime', required: true, reason: 'Default-deny on cross-CPS data combinations without explicit consent (Art. 5(2)); self-preferencing / tying / bundling gates; choice-screen + sideloading enforcement when designated.', reference: 'DMA Arts. 5, 6' },
        { name: 'audit-integrity', required: true, reason: 'Tamper-evident audit chain for Art. 15 compliance reports, Art. 14 notifications, conduct-rule evidence — required for DG COMP investigation.', reference: 'DMA investigation evidentiary integrity' },
        { name: 'event-bus', required: true, reason: 'Concentration notification triggers (Art. 14); compliance-report cycle reminders (Art. 15 annual); cross-CPS-data-combination event detection.', reference: 'DMA Arts. 14, 15' },
        { name: 'data-classifier', required: true, reason: 'Surface DMA evidence categories.', reference: 'DMA evidence categorisation' },
        { name: 'transparency-injector', required: true, reason: 'Choice-screen visibility (Art. 6(3)); business-user data access (Art. 6(10)); end-user data portability (Art. 6(9)); compliance-report public version.', reference: 'DMA Arts. 6, 15' },
        { name: 'approval-queue', required: true, reason: 'Art. 14 acquisition decision senior-approval gate; Art. 15 compliance-report sign-off; designated-conduct change approval.', reference: 'DMA Arts. 14, 15' },
        { name: 'session-persistence', required: true, reason: 'DMA evidence retained 6 years (Limitation default; Commission investigation may extend).', reference: 'Limitation rules; Commission practice' },
        { name: 'agent-auth', required: true, reason: 'Art. 28 compliance officer named-role binding; senior-executive accountability for DMA decisions.', reference: 'DMA Art. 28' },
        { name: 'supply-chain', required: true, reason: 'Sub-supplier designation status flow-down; CPS-component vendor accountability.', reference: 'DMA service-chain accountability' },
    ],
    moduleConfig: {
        'attestation-manager': { gatekeeperDesignationTracked: true, perCpsObligationMapTracked: true, art14NotificationLogRequired: true, art15ComplianceReportArchived: true, art28OfficerNamed: true },
        'governance-runtime': { crossCpsDataCombinationGateRequired: true, selfPreferencingGateRequired: true, tyingBundlingGateRequired: true, choiceScreenEnforcementRequired: true },
        'audit-integrity': { dgCompInvestigationEvidenceTrackingRequired: true },
        'event-bus': { art14ConcentrationTriggerRequired: true, art15CycleReminderRequired: true },
        'data-classifier': { enabledCategories: ['GATEKEEPER_DESIGNATION', 'ARTICLE_5_DOS_DONTS', 'ARTICLE_6_SPECIFIC_RULES', 'ARTICLE_7_MESSAGING_INTEROP', 'ACQUISITION_NOTIFICATION', 'COMPLIANCE_REPORT_DMA', 'COMPLIANCE_OFFICER_DMA', 'CREDENTIALS'], credentialsAction: 'BLOCK' },
        'transparency-injector': { choiceScreenVisibleRequired: true, businessUserDataAccessRequired: true, endUserDataPortabilityRequired: true, compliancePublicVersionRequired: true },
        'approval-queue': { reviewTier: 'T2' },
        'session-persistence': { retentionDaysMinimum: 2190 },
        'agent-auth': { complianceOfficerNamedRoleRequired: true },
        'supply-chain': { cpsVendorAccountabilityRequired: true },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['DMA-CR-COMPATIBLE', 'CHOICE-SCREEN-CAPABLE'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['GATEKEEPER_DESIGNATION', 'ARTICLE_5_DOS_DONTS', 'ARTICLE_6_SPECIFIC_RULES', 'ARTICLE_7_MESSAGING_INTEROP', 'ACQUISITION_NOTIFICATION', 'COMPLIANCE_REPORT_DMA', 'COMPLIANCE_OFFICER_DMA', 'CREDENTIALS'],
        categoryActions: { GATEKEEPER_DESIGNATION: 'WARN', ARTICLE_5_DOS_DONTS: 'WARN', ARTICLE_6_SPECIFIC_RULES: 'WARN', ARTICLE_7_MESSAGING_INTEROP: 'WARN', ACQUISITION_NOTIFICATION: 'WARN', COMPLIANCE_REPORT_DMA: 'WARN', COMPLIANCE_OFFICER_DMA: 'WARN', CREDENTIALS: 'BLOCK' },
        encryptionRequired: true, encryptionStandard: 'AES-256-GCM', minimumClassification: 'INTERNAL',
    },
    retentionPolicy: { auditLogRetentionDays: 2190, sessionRetentionDays: 2190, incidentRetentionDays: 2190, reference: 'Limitation defaults; Commission investigation practice', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['eu'] },
    incidentPolicy: { notificationDeadlineHours: 168, reference: 'Commission information-notice cooperation', requiredRecipients: ['european-commission-dg-comp', 'compliance-officer-dma', 'legal-counsel'], formalNotificationRequired: false },
    validators: [
        { id: 'eu-dma-designation-status', description: 'Gatekeeper designation status tracked; per-CPS obligation map current.', reference: 'DMA Art. 3', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'eu-dma-art5-dos-donts', description: 'Cross-CPS data combination requires explicit consent; self-preferencing / tying / bundling default-denied.', reference: 'DMA Art. 5', check: 'governance_active', failSeverity: 'CRITICAL' },
        { id: 'eu-dma-art6-specific-rules', description: 'Choice screens, sideloading, business-user data access, interoperability requirements operative when designated.', reference: 'DMA Art. 6', check: 'transparency_active', failSeverity: 'CRITICAL' },
        { id: 'eu-dma-art7-messaging-interop', description: 'Messaging interoperability phased plan filed if designated for interpersonal communications CPS.', reference: 'DMA Art. 7', check: 'attestation_active', failSeverity: 'HIGH' },
        { id: 'eu-dma-art14-notification', description: 'Concentration notifications filed per Art. 14.', reference: 'DMA Art. 14', check: 'monitoring_active', failSeverity: 'HIGH' },
        { id: 'eu-dma-art15-compliance-report', description: 'Annual audited compliance report filed; public version published.', reference: 'DMA Art. 15', check: 'attestation_active', failSeverity: 'HIGH' },
        { id: 'eu-dma-art28-compliance-officer', description: 'Compliance officer named, recorded, signed off on Art. 15 report.', reference: 'DMA Art. 28', check: 'rbac_active', failSeverity: 'HIGH' },
        { id: 'eu-dma-evidence-audit-trail', description: 'Tamper-evident audit chain covers Art. 15 reports, Art. 14 notifications, conduct-rule evidence.', reference: 'DMA evidentiary integrity', check: 'audit_trail_exists', failSeverity: 'HIGH' },
        { id: 'eu-dma-evidence-retention', description: 'DMA evidence retained 6 years; legal-hold support active for live investigations.', reference: 'Commission investigation practice', check: 'retention_policy_active', failSeverity: 'HIGH' },
        { id: 'eu-dma-credential-block', description: 'Plaintext credentials blocked from DMA evidence artefacts.', reference: 'DMA evidence integrity', check: 'data_classifier_active', failSeverity: 'CRITICAL' },
    ],
};
//# sourceMappingURL=eu-dma.js.map