"use strict";
/**
 * China Data Security Law (DSL) + Cybersecurity Law (CSL) Compliance Pack
 *
 * Statutes:
 *   - Cybersecurity Law of the People's Republic of China (CSL),
 *     effective 1 June 2017
 *   - Data Security Law of the People's Republic of China (DSL),
 *     effective 1 September 2021
 *
 * Jurisdiction: People's Republic of China (mainland)
 * Authority: Cyberspace Administration of China (CAC) primary; Ministry
 *   of Public Security; Ministry of State Security; sectoral regulators
 *
 * Why this pack (separate from `pipl`):
 *   - PIPL (`pipl` pack) covers personal-information protection.
 *   - DSL covers data classification (general / important / core),
 *     security obligations, and data export controls.
 *   - CSL covers network operators' obligations (CIIO designation,
 *     security review, MLPS — Multi-Level Protection Scheme).
 *   - All three statutes apply layered to PRC operators; DSL+CSL is the
 *     non-personal data + network-security layer that PIPL doesn't cover.
 *
 * Key DSL obligations:
 *   - **Data classification** (Art. 21): general / important / core data
 *   - **Important Data Catalogue** — sectoral catalogues being issued
 *     under CAC + sectoral regulator coordination
 *   - **Cross-border transfer security review** for important data
 *   - **National security data review** (Arts. 23-26)
 *
 * Key CSL obligations:
 *   - **CIIO designation** (Critical Information Infrastructure
 *     Operator) — heightened security obligations
 *   - **MLPS 2.0** — five-level cybersecurity grading scheme; level 2+
 *     entities require formal grading + security testing
 *   - **Network product security review** for CIIO procurement
 *   - **Real-name identity registration** for network services
 *   - **Annual self-assessment + security review** for CIIOs
 *
 * Penalties (DSL + CSL):
 *   - DSL: up to RMB 10M for serious violations of important-data
 *     transfer rules; RMB 500K-2M for general violations
 *   - CSL: up to RMB 1M for general; CIIO violations heightened
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.CN_DSL_CSL_PACK = exports.CN_DSL_CSL_CATEGORY_CLASSIFIERS = void 0;
exports.CN_DSL_CSL_CATEGORY_CLASSIFIERS = {
    DATA_CLASSIFICATION_CN: {
        references: ['DSL Art. 21 — data classification general / important / core'],
        classifier: (i) => /\b(?:general\s+data\s+china|important\s+data\s+china|core\s+data\s+china|dsl\s+art\.?\s*21|china\s+data\s+classification)\b/i.test(i),
    },
    CIIO_DESIGNATION: {
        references: ['CSL Art. 31 — Critical Information Infrastructure Operator'],
        classifier: (i) => /\b(?:ciio\s+(?:designation|china|critical\s+information\s+infrastructure)|csl\s+art\.?\s*31|cii\s+china)\b/i.test(i),
    },
    MLPS_GRADING: {
        references: ['CSL — Multi-Level Protection Scheme (MLPS 2.0)'],
        classifier: (i) => /\b(?:mlps\s+(?:2|grading|level|china)|multi[\s-]?level\s+protection\s+scheme|china\s+security\s+grading)\b/i.test(i),
    },
    CROSS_BORDER_DSL: {
        references: ['DSL Arts. 23-26 + CAC cross-border transfer review'],
        classifier: (i) => /\b(?:cac\s+(?:cross[\s-]?border|security\s+review|export\s+approval)|china\s+data\s+export\s+review|dsl\s+cross[\s-]?border)\b/i.test(i),
    },
    CN_INCIDENT_REPORTING: {
        references: ['CSL Art. 25 + DSL Art. 31 — incident reporting to CAC'],
        classifier: (i) => /\b(?:cac\s+(?:incident|notification|breach\s+report)|csl\s+art\.?\s*25|dsl\s+art\.?\s*31|china\s+cyber\s+incident)\b/i.test(i),
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety'],
        classifier: (i) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(i))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(i))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(i))
                return true;
            return false;
        },
    },
};
exports.CN_DSL_CSL_PACK = {
    categoryClassifiers: exports.CN_DSL_CSL_CATEGORY_CLASSIFIERS,
    id: 'cn-dsl-csl',
    aliases: ['china-dsl', 'china-csl', 'china-dsl-csl', 'data-security-law-china', 'cybersecurity-law-china', 'mlps-china'],
    name: 'China Data Security Law + Cybersecurity Law (DSL + CSL)',
    version: '1.0.0',
    description: 'Layered PRC data + network security regime. DSL (effective Sept 2021): data classification (general / important / core), important-data catalogue, cross-border transfer security review, national-security data review. CSL (effective June 2017): CIIO (Critical Information Infrastructure Operator) designation, MLPS 2.0 (Multi-Level Protection Scheme) five-level cybersecurity grading, network product security review, real-name registration. Distinct from `pipl` (which covers personal-information protection); all three apply layered to PRC operators. Penalties up to RMB 10M (DSL serious violations) + RMB 1M (CSL).',
    authority: 'Cyberspace Administration of China (CAC) + Ministry of Public Security + Ministry of State Security + sectoral regulators',
    industries: ['technology', 'cloud-infrastructure', 'critical-national-infrastructure', 'energy', 'telecoms', 'financial-services', 'healthcare', 'transport'],
    requiredModules: [
        { name: 'attestation-manager', required: true, reason: 'Data-classification record (general / important / core); CIIO designation status; MLPS grading; cross-border transfer security review evidence.', reference: 'DSL Art. 21 + CSL Art. 31 + MLPS' },
        { name: 'governance-runtime', required: true, reason: 'Default-deny on important-data export without CAC security review approval; CIIO procurement gate (network product security review).', reference: 'DSL Arts. 23-26 + CSL CIIO procurement' },
        { name: 'event-bus', required: true, reason: 'CAC incident reporting; CIIO annual self-assessment reminders; MLPS re-grading triggers.', reference: 'CSL Art. 25 + DSL Art. 31' },
        { name: 'audit-integrity', required: true, reason: 'Tamper-evident audit chain for data-classification revisions, CAC cross-border review evidence, MLPS audit responses.', reference: 'DSL + CSL evidence integrity' },
        { name: 'data-classifier', required: true, reason: 'Surface DSL + CSL evidence categories.', reference: 'DSL + CSL evidence categorisation' },
        { name: 'transparency-injector', required: true, reason: 'Real-name registration prompts (CSL Art. 24); user-facing cross-border transfer disclosure.', reference: 'CSL Art. 24 + DSL transfer disclosure' },
        { name: 'approval-queue', required: true, reason: 'CAC cross-border transfer approval; MLPS grading sign-off; CIIO procurement approval.', reference: 'DSL Arts. 23-26 + CSL CIIO' },
        { name: 'session-persistence', required: true, reason: 'CAC + MLPS evidence retention; typically 5+ years for security-review records.', reference: 'CSL + DSL retention practice' },
        { name: 'agent-auth', required: true, reason: 'CIIO security officer named-role binding; real-name registration enforcement.', reference: 'CSL Arts. 24, 31' },
        { name: 'supply-chain', required: true, reason: 'Sub-supplier MLPS attestation; CIIO procurement security-review cascade.', reference: 'CSL CIIO procurement' },
    ],
    moduleConfig: {
        'attestation-manager': { dataClassificationTracked: true, ciioDesignationTracked: true, mlpsGradingTracked: true, cacReviewEvidenceTracked: true },
        'governance-runtime': { importantDataExportGateRequired: true, ciioProcurementGateRequired: true },
        'event-bus': { cacIncidentReportingRequired: true, ciioAnnualReviewRemindersRequired: true, mlpsRegradingTriggersRequired: true },
        'audit-integrity': { dslCslEvidenceTrackingRequired: true },
        'data-classifier': { enabledCategories: ['DATA_CLASSIFICATION_CN', 'CIIO_DESIGNATION', 'MLPS_GRADING', 'CROSS_BORDER_DSL', 'CN_INCIDENT_REPORTING', 'CREDENTIALS'], credentialsAction: 'BLOCK' },
        'transparency-injector': { realNameRegistrationPromptsRequired: true, crossBorderTransferDisclosureRequired: true },
        'approval-queue': { reviewTier: 'T2' },
        'session-persistence': { retentionDaysMinimum: 1825 },
        'agent-auth': { ciioSecurityOfficerNamedRoleRequired: true },
        'supply-chain': { mlpsAttestationCascadeRequired: true },
    },
    providerPolicy: { blockedProviders: [], requiredCapabilities: ['CHINA-DATA-RESIDENCY', 'CAC-COMPATIBLE', 'MLPS-COMPATIBLE'], blockReasons: {} },
    dataPolicy: {
        scanCategories: ['DATA_CLASSIFICATION_CN', 'CIIO_DESIGNATION', 'MLPS_GRADING', 'CROSS_BORDER_DSL', 'CN_INCIDENT_REPORTING', 'CREDENTIALS'],
        categoryActions: { DATA_CLASSIFICATION_CN: 'WARN', CIIO_DESIGNATION: 'WARN', MLPS_GRADING: 'WARN', CROSS_BORDER_DSL: 'WARN', CN_INCIDENT_REPORTING: 'WARN', CREDENTIALS: 'BLOCK' },
        encryptionRequired: true, encryptionStandard: 'AES-256-GCM', minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: { auditLogRetentionDays: 1825, sessionRetentionDays: 1825, incidentRetentionDays: 2190, reference: 'CSL + DSL evidence retention practice', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['cn'] },
    incidentPolicy: { notificationDeadlineHours: 24, reference: 'CSL Art. 25 + DSL Art. 31 — CAC incident reporting', requiredRecipients: ['cac', 'mps-china', 'sectoral-regulator-china'], formalNotificationRequired: true },
    validators: [
        { id: 'cn-dsl-data-classification', description: 'Data classified (general / important / core) per DSL Art. 21; classification rationale documented.', reference: 'DSL Art. 21', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'cn-csl-ciio-status', description: 'CIIO designation status tracked; CIIO obligations operative when designated.', reference: 'CSL Art. 31', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'cn-csl-mlps-grading', description: 'MLPS grading completed (Level 2+ requires formal grading + security testing).', reference: 'CSL MLPS 2.0', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'cn-dsl-cross-border', description: 'CAC cross-border transfer approval evidence captured for important data.', reference: 'DSL Arts. 23-26', check: 'governance_active', failSeverity: 'CRITICAL' },
        { id: 'cn-incident-reporting', description: 'CAC incident-reporting path active; CIIO annual self-assessment cycle.', reference: 'CSL Art. 25 + DSL Art. 31', check: 'monitoring_active', failSeverity: 'HIGH' },
        { id: 'cn-supplier-flow-down', description: 'Sub-supplier MLPS attestation captured; CIIO procurement security-review cascade.', reference: 'CSL CIIO procurement', check: 'subservice_registry_active', failSeverity: 'HIGH' },
        { id: 'cn-evidence-audit-trail', description: 'Tamper-evident audit chain over data-classification + CAC review + MLPS evidence.', reference: 'DSL + CSL evidence integrity', check: 'audit_trail_exists', failSeverity: 'HIGH' },
        { id: 'cn-encryption', description: 'Important + core data encrypted at rest and in transit.', reference: 'DSL + CSL security obligations', check: 'encryption_active', failSeverity: 'HIGH' },
        { id: 'cn-real-name-registration', description: 'Real-name registration enforcement for network services per CSL Art. 24.', reference: 'CSL Art. 24', check: 'transparency_active', failSeverity: 'MEDIUM' },
        { id: 'cn-credential-block', description: 'Plaintext credentials blocked.', reference: 'DSL + CSL security obligations', check: 'data_classifier_active', failSeverity: 'CRITICAL' },
    ],
};
//# sourceMappingURL=cn-dsl-csl.js.map