/**
 * EU Data Act Compliance Pack
 *
 * Regulation: Regulation (EU) 2023/2854 — Data Act. In force 11 January
 *   2024; main applicability date 12 September 2025.
 *
 * Jurisdiction: EU-wide
 * Authority: European Commission + national competent authorities
 *
 * Why this pack:
 *   - Distinct from GDPR (personal data) and Data Governance Act
 *     (data intermediation): the Data Act regulates fairness in B2B + B2C
 *     access to data generated by connected products and related services
 *     (IoT data), cloud-switching, and unfair contractual terms.
 *   - Particular relevance for AI: training-data access provisions, cloud
 *     interoperability + portability, fair value sharing.
 *
 * Key obligations (selected):
 *   - **Chapter II — Business-to-consumer + business-to-business data access**
 *     User of a connected product can obtain product/related-service
 *     data; data holder must make data available.
 *   - **Chapter III — Sharing data with third parties at user request**
 *     Free flow of data between parties; no restrictive contracts.
 *   - **Chapter IV — Unfair contractual terms** (Art. 13)
 *     Imposed-on-SME contractual terms regarding data access deemed
 *     unfair under specified conditions are unenforceable.
 *   - **Chapter V — Public-sector access to data in exceptional need**
 *     Public bodies can request data in defined emergencies.
 *   - **Chapter VI — Cloud switching + interoperability** (Arts. 23-31)
 *     Cloud providers must enable customer switching with reduced
 *     fees, transparency on data egress, technical interoperability.
 *   - **Chapter VII — International transfer / non-personal data**
 *     Restrictions on access to non-personal data by non-EU governments.
 *   - **Chapter VIII — Interoperability** (Arts. 33-36)
 *     Smart-contract interoperability requirements.
 *
 * Penalties:
 *   - National competent authorities set fines; for personal data
 *     overlap, GDPR fine ceiling applies (up to 4% global turnover).
 *
 * @connexum/ai-governance
 */
export const EU_DATA_ACT_CATEGORY_CLASSIFIERS = {
    CONNECTED_PRODUCT_DATA: {
        references: ['Data Act Chapter II — connected product + related-service data'],
        classifier: (i) => /\b(?:connected\s+product\s+data|iot\s+data\s+access|data\s+holder\s+data\s+act|product\s+data\s+sharing\s+request)\b/i.test(i),
    },
    USER_DATA_REQUEST: {
        references: ['Data Act Chapter III — third-party data sharing at user request'],
        classifier: (i) => /\b(?:data\s+(?:sharing|access)\s+request\s+user|chapter\s+iii\s+data\s+act|third[\s-]?party\s+data\s+request\s+da)\b/i.test(i),
    },
    CLOUD_SWITCHING: {
        references: ['Data Act Chapter VI — cloud switching + interoperability'],
        classifier: (i) => /\b(?:cloud\s+switching\s+(?:request|notice|plan)|cloud\s+egress\s+(?:fee|charge|notice)|chapter\s+vi\s+data\s+act)\b/i.test(i),
    },
    UNFAIR_TERMS: {
        references: ['Data Act Art. 13 — unfair contractual terms'],
        classifier: (i) => /\b(?:unfair\s+contractual\s+term|art\.?\s*13\s+data\s+act|unfair\s+term\s+sme\s+da)\b/i.test(i),
    },
    PUBLIC_SECTOR_REQUEST: {
        references: ['Data Act Chapter V — exceptional public-sector data access'],
        classifier: (i) => /\b(?:public[\s-]?sector\s+data\s+request\s+(?:da|emergency)|exceptional\s+need\s+data\s+act|chapter\s+v\s+data\s+act)\b/i.test(i),
    },
    INTERNATIONAL_TRANSFER_DA: {
        references: ['Data Act Chapter VII — non-personal data international transfer'],
        classifier: (i) => /\b(?:non[\s-]?personal\s+data\s+transfer\s+da|chapter\s+vii\s+data\s+act|cross[\s-]?border\s+access\s+da)\b/i.test(i),
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety'],
        classifier: (i) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(i))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(i))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(i))
                return true;
            return false;
        },
    },
};
export const EU_DATA_ACT_PACK = {
    categoryClassifiers: EU_DATA_ACT_CATEGORY_CLASSIFIERS,
    id: 'eu-data-act',
    aliases: ['data-act', 'eu-data-act-2023', 'regulation-2023-2854'],
    name: 'EU Data Act (Regulation (EU) 2023/2854)',
    version: '1.0.0',
    description: 'EU Data Act (in force 11 Jan 2024; main applicability 12 Sept 2025). Regulates B2B / B2C access to data generated by connected products + related services (IoT data); cloud switching + interoperability (Chapter VI); unfair contractual terms imposed on SMEs (Art. 13); public-sector exceptional access (Chapter V); restrictions on non-EU government access to non-personal data (Chapter VII); smart-contract interoperability (Chapter VIII). Distinct from GDPR (personal data) and Data Governance Act (data intermediation).',
    authority: 'European Commission + national competent authorities',
    industries: ['technology', 'cloud-infrastructure', 'manufacturing', 'automotive', 'iot', 'energy', 'financial-services'],
    requiredModules: [
        { name: 'governance-runtime', required: true, reason: 'Default-deny on data access requests outside Data Act lawful basis; cloud-egress gate; international-transfer-restriction gate (Chapter VII).', reference: 'Data Act Chapters II, III, VI, VII' },
        { name: 'attestation-manager', required: true, reason: 'Data-holder designation + data inventory; cloud-switching plan; unfair-term review (Art. 13); user data-request log.', reference: 'Data Act Arts. 3-13, 23-31' },
        { name: 'audit-integrity', required: true, reason: 'Tamper-evident audit chain for data-access requests, cloud-switching events, public-sector requests.', reference: 'Data Act Chapter II + V + VI evidence' },
        { name: 'event-bus', required: true, reason: 'User data-request routing; cloud-switching trigger events; public-sector request escalation.', reference: 'Data Act Chapters III, V, VI' },
        { name: 'data-classifier', required: true, reason: 'Surface connected-product data, user data requests, cloud-switching events, unfair terms, public-sector requests.', reference: 'Data Act evidence categorisation' },
        { name: 'transparency-injector', required: true, reason: 'User-facing data-availability disclosure (Art. 4); cloud-egress fee transparency (Art. 25); contract terms transparency.', reference: 'Data Act Arts. 4, 25' },
        { name: 'approval-queue', required: true, reason: 'Public-sector exceptional requests routed for senior + legal approval; cloud-switching senior sign-off.', reference: 'Data Act Chapter V; Chapter VI' },
        { name: 'session-persistence', required: true, reason: 'Data-access logs and cloud-switching evidence retained 6 years.', reference: 'Limitation Act + Commission practice' },
        { name: 'agent-auth', required: true, reason: 'User identity + third-party recipient identity binding for data-sharing requests.', reference: 'Data Act Chapter III' },
        { name: 'supply-chain', required: true, reason: 'Sub-supplier interoperability + portability evidence captured (Arts. 33-36).', reference: 'Data Act Chapter VIII' },
    ],
    moduleConfig: {
        'governance-runtime': { dataAccessLawfulBasisGateRequired: true, cloudEgressGateRequired: true, internationalTransferGateRequired: true },
        'attestation-manager': { dataHolderDesignationTracked: true, cloudSwitchingPlanRequired: true, unfairTermReviewRequired: true, userDataRequestLogRequired: true },
        'audit-integrity': { dataActEvidenceTrackingRequired: true },
        'event-bus': { userDataRequestRoutingRequired: true, cloudSwitchingTriggerRequired: true, publicSectorRequestEscalationRequired: true },
        'data-classifier': { enabledCategories: ['CONNECTED_PRODUCT_DATA', 'USER_DATA_REQUEST', 'CLOUD_SWITCHING', 'UNFAIR_TERMS', 'PUBLIC_SECTOR_REQUEST', 'INTERNATIONAL_TRANSFER_DA', 'CREDENTIALS'], credentialsAction: 'BLOCK' },
        'transparency-injector': { dataAvailabilityDisclosureRequired: true, cloudEgressFeeTransparencyRequired: true },
        'approval-queue': { reviewTier: 'T2' },
        'session-persistence': { retentionDaysMinimum: 2190 },
        'agent-auth': { thirdPartyRecipientIdentityBindingRequired: true },
        'supply-chain': { interoperabilityEvidenceRequired: true },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['CLOUD-SWITCHING-COMPATIBLE', 'DATA-ACT-INTEROP'],
        blockReasons: { deepseek: 'PRC jurisdiction. Chapter VII restricts non-EU government access to non-personal data; PRC routing incompatible.', baidu: 'PRC jurisdiction.', alibaba: 'PRC jurisdiction.' },
    },
    dataPolicy: {
        scanCategories: ['CONNECTED_PRODUCT_DATA', 'USER_DATA_REQUEST', 'CLOUD_SWITCHING', 'UNFAIR_TERMS', 'PUBLIC_SECTOR_REQUEST', 'INTERNATIONAL_TRANSFER_DA', 'CREDENTIALS'],
        categoryActions: { CONNECTED_PRODUCT_DATA: 'WARN', USER_DATA_REQUEST: 'WARN', CLOUD_SWITCHING: 'WARN', UNFAIR_TERMS: 'WARN', PUBLIC_SECTOR_REQUEST: 'WARN', INTERNATIONAL_TRANSFER_DA: 'WARN', CREDENTIALS: 'BLOCK' },
        encryptionRequired: true, encryptionStandard: 'AES-256-GCM', minimumClassification: 'INTERNAL',
    },
    retentionPolicy: { auditLogRetentionDays: 2190, sessionRetentionDays: 2190, incidentRetentionDays: 2190, reference: 'Limitation Act 1980; Data Act enforcement window', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['eu'] },
    incidentPolicy: { notificationDeadlineHours: 168, reference: 'Data Act competent-authority cooperation', requiredRecipients: ['national-competent-authority', 'data-protection-officer', 'legal-counsel'], formalNotificationRequired: false },
    validators: [
        { id: 'eu-data-act-data-holder-designation', description: 'Data-holder role designated; product/related-service data inventory current.', reference: 'Data Act Chapter II', check: 'attestation_active', failSeverity: 'HIGH' },
        { id: 'eu-data-act-user-request', description: 'User data-request workflow active; data made available without undue delay.', reference: 'Data Act Arts. 3-5', check: 'monitoring_active', failSeverity: 'CRITICAL' },
        { id: 'eu-data-act-cloud-switching', description: 'Cloud-switching plan documented; egress fees declining as required by Art. 25; technical interoperability commitments captured.', reference: 'Data Act Arts. 23-31', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'eu-data-act-unfair-terms', description: 'Contract terms reviewed for Art. 13 fairness; SME-imposed terms not unfair-listed.', reference: 'Data Act Art. 13', check: 'attestation_active', failSeverity: 'HIGH' },
        { id: 'eu-data-act-public-sector-request', description: 'Public-sector exceptional-need request workflow available; senior + legal approval gate.', reference: 'Data Act Chapter V', check: 'approval_queue_active', failSeverity: 'HIGH' },
        { id: 'eu-data-act-international-transfer', description: 'Chapter VII restrictions on non-EU government access enforced; transfer-impact assessments captured.', reference: 'Data Act Chapter VII', check: 'governance_active', failSeverity: 'HIGH' },
        { id: 'eu-data-act-evidence-audit-trail', description: 'Tamper-evident audit chain covers data-access events, cloud switches, public-sector requests.', reference: 'Data Act evidence integrity', check: 'audit_trail_exists', failSeverity: 'HIGH' },
        { id: 'eu-data-act-encryption', description: 'Data encrypted at rest and in transit.', reference: 'Data Act + GDPR Art. 32 overlay', check: 'encryption_active', failSeverity: 'MEDIUM' },
        { id: 'eu-data-act-credential-block', description: 'Plaintext credentials blocked from Data Act evidence.', reference: 'Data Act evidence integrity', check: 'data_classifier_active', failSeverity: 'CRITICAL' },
    ],
};
//# sourceMappingURL=eu-data-act.js.map