/**
 * Vietnam Personal Data Protection Decree Compliance Pack
 *
 * Statute: Decree No. 13/2023/ND-CP on Personal Data Protection
 *   (effective 1 July 2023). Vietnam's first comprehensive
 *   data-protection regime; pending Personal Data Protection Law (PDPL)
 *   expected to upgrade decree to full statutory law.
 *
 * Jurisdiction: Vietnam
 * Authority: Department of Cybersecurity and High-Tech Crime Prevention
 *   (A05) under the Ministry of Public Security (MPS)
 *
 * Key obligations:
 *   - 8 principles (lawfulness, transparency, purpose limitation, data
 *     minimisation, accuracy, retention limitation, integrity +
 *     confidentiality, accountability)
 *   - **Sensitive personal data** broader than GDPR special category
 *   - **Cross-border transfer impact assessment (TIA)** + filing with
 *     A05 within 60 days of transfer commencement
 *   - **Data Protection Impact Assessment (DPIA)** for processing
 *     activities; filed with A05
 *   - **Data Protection Officer (DPO)** mandatory for sensitive-data
 *     processors
 *   - **Breach notification** to A05 within 72 hours (admin penalties
 *     for late or absent)
 *   - **Data subject rights** — access, correction, deletion, withdrawal
 *     of consent, right to know about breaches
 *
 * Penalties: administrative fines up to VND 5B (~USD 200K) per breach;
 *   criminal liability for serious / systematic violations.
 *
 * @connexum/ai-governance
 */
export const VN_PDPD_CATEGORY_CLASSIFIERS = {
    VN_SENSITIVE_DATA: {
        references: ['VN PDPD Art. 2 — sensitive personal data definition'],
        classifier: (i) => /\b(?:vietnam\s+sensitive\s+(?:personal\s+)?data|vn\s+pdpd\s+sensitive|vietnam\s+health\s+data\s+pdpd|vietnam\s+financial\s+data\s+pdpd)\b/i.test(i),
    },
    CROSS_BORDER_TIA: {
        references: ['VN PDPD Art. 25-26 — cross-border transfer impact assessment'],
        classifier: (i) => /\b(?:cross[\s-]?border\s+transfer\s+vietnam|vn\s+(?:cbdt|tia|art\.?\s*25|art\.?\s*26)|a05\s+transfer\s+filing)\b/i.test(i),
    },
    VN_DPIA: {
        references: ['VN PDPD Art. 24 — DPIA filing with A05'],
        classifier: (i) => /\b(?:vn\s+dpia|vietnam\s+dpia|art\.?\s*24\s+pdpd|a05\s+dpia\s+filing)\b/i.test(i),
    },
    A05_NOTIFICATION: {
        references: ['VN PDPD Art. 23 — 72-hour breach notification to A05'],
        classifier: (i) => /\b(?:a05\s+(?:notification|filing|breach\s+notice)|72[\s-]?hour\s+vietnam\s+breach|art\.?\s*23\s+pdpd)\b/i.test(i),
    },
    VN_DPO: {
        references: ['VN PDPD Art. 30 — DPO mandatory designation'],
        classifier: (i) => /\b(?:vietnam\s+dpo|vn\s+dpo|art\.?\s*30\s+pdpd\s+dpo|a05\s+dpo\s+designation)\b/i.test(i),
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety'],
        classifier: (i) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(i))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(i))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(i))
                return true;
            return false;
        },
    },
};
export const VN_PDPD_PACK = {
    categoryClassifiers: VN_PDPD_CATEGORY_CLASSIFIERS,
    id: 'vn-pdpd',
    aliases: ['vietnam-pdpd', 'vietnam-personal-data-protection', 'decree-13-2023', 'pdpd-vietnam'],
    name: 'Vietnam Personal Data Protection Decree (Decree 13/2023/ND-CP)',
    version: '1.0.0',
    contentHash: '602fcfc8c5bc2f402e4111893cb306fb10cfd9ba0ce3dc48d25a08616f3ac914',
    description: 'Vietnam\'s first comprehensive data-protection regime, effective 1 July 2023. 8 principles + broader sensitive-data definition than GDPR + cross-border transfer TIA filed with A05 within 60 days + mandatory DPIA + mandatory DPO for sensitive-data processors + 72-hour breach notification to A05. Pending Personal Data Protection Law (PDPL) expected to upgrade decree to full statutory law. Penalties up to VND 5B (~USD 200K) + criminal liability for serious violations.',
    authority: 'Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security (MPS)',
    industries: ['technology', 'financial-services', 'healthcare', 'retail', 'media', 'manufacturing'],
    requiredModules: [
        { name: 'attestation-manager', required: true, reason: 'DPIA filing with A05; cross-border TIA filing; DPO designation; processor + sub-processor record.', reference: 'VN PDPD Arts. 24, 25-26, 30' },
        { name: 'governance-runtime', required: true, reason: 'Default-deny on sensitive-data processing without DPIA; default-deny on cross-border transfer without TIA filing; consent-based default-deny.', reference: 'VN PDPD Arts. 9, 10, 24, 25' },
        { name: 'event-bus', required: true, reason: '72-hour A05 breach notification routing; data-subject request escalation.', reference: 'VN PDPD Art. 23' },
        { name: 'audit-integrity', required: true, reason: 'Tamper-evident audit chain for DPIA + TIA + breach notification + consent records.', reference: 'VN PDPD evidence integrity' },
        { name: 'data-classifier', required: true, reason: 'VN sensitive-data detection; surface DPIA + TIA + A05 notification + DPO records.', reference: 'VN PDPD evidence categorisation' },
        { name: 'transparency-injector', required: true, reason: 'Privacy policy + data-subject rights disclosure + consent prompts.', reference: 'VN PDPD Arts. 8-12' },
        { name: 'approval-queue', required: true, reason: 'Cross-border transfer senior approval; DPIA sign-off; sensitive-data processing approval.', reference: 'VN PDPD Arts. 24-26' },
        { name: 'session-persistence', required: true, reason: 'Retention compliant with PDPD principle 6; A05 evidence retained at least 5 years.', reference: 'VN PDPD principle 6' },
        { name: 'agent-auth', required: true, reason: 'DPO named-role binding; data-subject request identity binding.', reference: 'VN PDPD Art. 30' },
        { name: 'supply-chain', required: true, reason: 'Sub-processor TIA cascade; sub-processor DPIA inheritance.', reference: 'VN PDPD sub-processor accountability' },
    ],
    moduleConfig: {
        'governance-runtime': { sensitiveDataDpiaGateRequired: true, crossBorderTiaGateRequired: true, consentBasedDefaultDenyRequired: true },
        'attestation-manager': { dpiaFilingTracked: true, tiaFilingTracked: true, dpoDesignationTracked: true },
        'event-bus': { a05BreachNotification72hRequired: true, dataSubjectRequestEscalationRequired: true },
        'audit-integrity': { vnPdpdEvidenceTrackingRequired: true },
        'data-classifier': { enabledCategories: ['VN_SENSITIVE_DATA', 'CROSS_BORDER_TIA', 'VN_DPIA', 'A05_NOTIFICATION', 'VN_DPO', 'CREDENTIALS'], vnSensitiveDataAction: 'WARN', credentialsAction: 'BLOCK' },
        'transparency-injector': { privacyPolicyRequired: true, consentPromptsRequired: true },
        'approval-queue': { reviewTier: 'T2' },
        'session-persistence': { retentionDaysMinimum: 1825 },
        'agent-auth': { dpoNamedRoleBindingRequired: true },
        'supply-chain': { subProcessorTiaCascadeRequired: true },
    },
    providerPolicy: { blockedProviders: [], requiredCapabilities: ['VIETNAM-DATA-RESIDENCY', 'PROCESSOR-CONTRACT'], blockReasons: {} },
    dataPolicy: {
        scanCategories: ['VN_SENSITIVE_DATA', 'CROSS_BORDER_TIA', 'VN_DPIA', 'A05_NOTIFICATION', 'VN_DPO', 'CREDENTIALS'],
        categoryActions: { VN_SENSITIVE_DATA: 'WARN', CROSS_BORDER_TIA: 'WARN', VN_DPIA: 'WARN', A05_NOTIFICATION: 'WARN', VN_DPO: 'WARN', CREDENTIALS: 'BLOCK' },
        encryptionRequired: true, encryptionStandard: 'AES-256-GCM', minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: { auditLogRetentionDays: 1825, sessionRetentionDays: 1825, incidentRetentionDays: 1825, reference: 'VN PDPD principle 6 + A05 evidence retention practice', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['vn'] },
    incidentPolicy: { notificationDeadlineHours: 72, reference: 'VN PDPD Art. 23', requiredRecipients: ['a05-mps', 'dpo-vn', 'legal-counsel'], formalNotificationRequired: true },
    validators: [
        { id: 'vn-pdpd-dpia', description: 'DPIA filed with A05 for processing activities.', reference: 'VN PDPD Art. 24', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'vn-pdpd-cross-border-tia', description: 'Cross-border TIA filed with A05 within 60 days of transfer commencement.', reference: 'VN PDPD Arts. 25-26', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'vn-pdpd-dpo-designation', description: 'DPO designated and notified to A05 for sensitive-data processors.', reference: 'VN PDPD Art. 30', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'vn-pdpd-72h-notification', description: '72-hour breach notification path active to A05.', reference: 'VN PDPD Art. 23', check: 'monitoring_active', failSeverity: 'CRITICAL' },
        { id: 'vn-pdpd-consent', description: 'Consent-based processing gates active for sensitive data.', reference: 'VN PDPD Art. 9-10', check: 'governance_active', failSeverity: 'HIGH' },
        { id: 'vn-pdpd-data-subject-rights', description: 'Data-subject rights workflow active (access, correction, deletion, consent withdrawal).', reference: 'VN PDPD Arts. 11-13', check: 'transparency_active', failSeverity: 'HIGH' },
        { id: 'vn-pdpd-supplier-flow-down', description: 'Sub-processor TIA + DPIA cascade attested.', reference: 'VN PDPD sub-processor accountability', check: 'subservice_registry_active', failSeverity: 'HIGH' },
        { id: 'vn-pdpd-evidence-audit-trail', description: 'Tamper-evident audit chain over DPIA + TIA + breach notification.', reference: 'VN PDPD evidence integrity', check: 'audit_trail_exists', failSeverity: 'HIGH' },
        { id: 'vn-pdpd-encryption', description: 'Personal data encrypted at rest and in transit.', reference: 'VN PDPD principle 7 integrity + confidentiality', check: 'encryption_active', failSeverity: 'HIGH' },
        { id: 'vn-pdpd-credential-block', description: 'Plaintext credentials blocked.', reference: 'VN PDPD principle 7', check: 'data_classifier_active', failSeverity: 'CRITICAL' },
    ],
};
//# sourceMappingURL=vn-pdpd.js.map