/**
 * EU AI Liability Compliance Pack
 *
 * Product Liability Directive (EU) 2024/2853 (PLD 2024) covering AI
 * systems + withdrawn AI Liability Directive proposal (2022 COM(2022)
 * 496; withdrawn Feb 2025).
 *
 * Standards referenced:
 *   - Directive (EU) 2024/2853 (PLD 2024) -- entered into force
 *     8 Dec 2024; Member State transposition by 9 Dec 2026
 *   - AI Liability Directive 2022 proposal -- WITHDRAWN Feb 2025
 *   - EU AI Act coupling for post-market monitoring evidence
 *   - ISO/IEC 42001 coupling for AI management system evidence
 *
 * PLD 2024 key provisions for AI:
 *   - Art. 4(6): substantial modification = new product release
 *   - Art. 6: defectiveness definition
 *   - Art. 8: economic operators liability
 *   - Art. 9: court-ordered evidence disclosure
 *   - Art. 10: presumption of defectiveness on disclosure failure
 *   - Art. 14: 10-year latent defect period (extensible to 25)
 *   - Recital 14: SME / open-source exception guidance
 *
 * @connexum/ai-governance
 */
/**
 * EU AI Liability Directive (PLD 2024) category classifiers.
 * Product Liability Directive 2024 + AI Liability Directive (proposed).
 * Governs evidence preservation for AI-related damages claims.
 * AI_PRODUCT_DAMAGE and USER_DATA_DAMAGE are LOG categories (not BLOCK)
 * since the goal is evidence capture rather than blocking.
 */
export const EU_AI_LIABILITY_CATEGORY_CLASSIFIERS = {
    AI_PRODUCT_DAMAGE: {
        references: ['PLD 2024 Art. 5 -- defective AI product; damage to life, body, property'],
        classifier: (input) => {
            if (/\b(?:AI\s+(?:product\s+)?defect|defective\s+AI|AI.caused\s+(?:harm|damage|injury|loss))\b/i.test(input))
                return true;
            if (/\b(?:AI\s+liability\s+claim|product\s+liability.*AI)\b/i.test(input))
                return true;
            return false;
        },
    },
    USER_DATA_DAMAGE: {
        references: ['PLD 2024 Art. 4 -- damage to data; EU AI Liability Directive Art. 3'],
        classifier: (input) => {
            if (/\b(?:data\s+(?:damage|harm|loss|corruption)\s+(?:by|from)\s+AI|AI.caused\s+data\s+(?:loss|breach))\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['PLD 2024 -- damage to property including personal data; GDPR cross-reference'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['EU AI Liability -- information security for evidence preservation systems'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const EU_AI_LIABILITY_PACK = {
    categoryClassifiers: EU_AI_LIABILITY_CATEGORY_CLASSIFIERS,
    id: 'eu-ai-liability',
    name: 'EU AI Liability (PLD 2024)',
    version: '1.0.0',
    contentHash: 'b11ae3c7347cc1bd9ed62d2030460512d8f174c57ac4fd5f75d81f1f87d53d53',
    description: 'EU Product Liability Directive (EU) 2024/2853 covering software + AI as products. Entered into force 8 Dec 2024; Member State transposition by 9 Dec 2026. AI Liability Directive proposal withdrawn Feb 2025.',
    authority: 'European Commission + national courts + national competent authorities',
    industries: ['ai-provider-eu', 'ai-deployer-eu', 'ai-importer-eu', 'ai-distributor-eu', 'ai-fulfilment-service-provider-eu', 'ai-product-manufacturer'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'PLD-ready documentation gate; substantial modification trigger',
            reference: 'PLD 2024 Art. 4(6); Art. 6',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident documentation package ready for Art. 9 disclosure',
            reference: 'PLD 2024 Art. 9 -- Disclosure of Evidence',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'AI_PRODUCT_DAMAGE + USER_DATA_DAMAGE classification',
            reference: 'PLD 2024 Art. 6(1)(c) -- data damage scope',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: '10-year latent defect window tracking (extensible to 25)',
            reference: 'PLD 2024 Art. 14 -- Time Limits',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Economic operator liability position (manufacturer / importer / distributor / fulfilment)',
            reference: 'PLD 2024 Art. 8 -- Economic Operators',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Evidence bundle completeness review before court submission; withdrawn-ALD guard',
            reference: 'PLD 2024 Art. 9, Art. 10',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Ready-to-disclose evidence bundle: design, validation, post-market monitoring',
            reference: 'PLD 2024 Art. 9',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'AI safety incident detection feeding post-market monitoring evidence',
            reference: 'PLD 2024 Art. 10 + EU AI Act Art. 72',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Product information disclosure supporting defectiveness defence',
            reference: 'PLD 2024 Art. 6(2)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'AI safety incident events triggering evidence bundle assembly',
            reference: 'PLD 2024 Art. 9; EU AI Act coupling',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Protect evidence bundle integrity until court disclosure',
            reference: 'PLD 2024 Art. 9',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            pldReadyDocumentationGateRequired: true,
            substantialModificationTrackingRequired: true,
            openSourceExceptionTrackingRequired: true,
        },
        'audit-integrity': {
            disclosureReadyAuditTrailRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['AI_PRODUCT_DAMAGE', 'USER_DATA_DAMAGE', 'PII', 'CREDENTIALS'],
            dataDamageTrackingRequired: true,
        },
        'session-persistence': {
            productPlacementDateTrackingRequired: true,
            tenYearLatentDefectWindowRequired: true,
        },
        'supply-chain': {
            economicOperatorLiabilityPositionRequired: true,
        },
        'approval-queue': {
            evidenceBundleCompletenessReviewRequired: true,
            withdrawnAldGuardActive: true,
        },
        'attestation-manager': {
            pldEvidenceBundleRequired: true,
            designDocumentationRequired: true,
            validationEvidenceRequired: true,
            postMarketMonitoringEvidenceRequired: true,
        },
        'anomaly-detector': {
            aiSafetyIncidentDetectionActive: true,
        },
        'transparency-injector': {
            productInformationDisclosureRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['PLD-2024-READY', 'EVIDENCE-DISCLOSURE-READY'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['AI_PRODUCT_DAMAGE', 'USER_DATA_DAMAGE', 'PII', 'CREDENTIALS'],
        categoryActions: {
            AI_PRODUCT_DAMAGE: 'LOG',
            USER_DATA_DAMAGE: 'LOG',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['EU'],
        auditLogRetentionDays: 3650, // 10 years aligned with PLD 2024 Art. 14 latent defect period
        sessionRetentionDays: 3650,
        incidentRetentionDays: 9125, // 25 years for extended cases
        reference: 'PLD 2024 Art. 14 -- 10-year latent defect period, extensible to 25 years',
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'PLD 2024 has no statutory notification deadline. Pax1 defaults to 72-hour internal escalation + Art. 9 evidence bundle preparation for potential court disclosure.',
        requiredRecipients: ['product-safety-officer', 'legal-counsel', 'quality-leadership'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'pld-documentation',
            description: 'PLD-ready documentation package on file for every AI product',
            reference: 'PLD 2024 Art. 6, 7',
            check: 'pld_documentation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'pld-evidence-disclosure',
            description: 'Evidence bundle ready for Art. 9 court-ordered disclosure',
            reference: 'PLD 2024 Art. 9',
            check: 'pld_evidence_disclosure_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'pld-substantial-modification',
            description: 'Substantial modification treated as new product release',
            reference: 'PLD 2024 Art. 4(6)',
            check: 'pld_substantial_modification_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'pld-post-market',
            description: 'Post-market monitoring evidence captured (EU AI Act Art. 72 coupling)',
            reference: 'PLD 2024 Art. 10 + EU AI Act Art. 72',
            check: 'pld_post_market_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'pld-economic-operator',
            description: 'Economic operator liability position documented per supply-chain entity',
            reference: 'PLD 2024 Art. 8',
            check: 'pld_economic_operator_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'pld-latent-defect-window',
            description: '10-year latent defect window tracked (extensible to 25)',
            reference: 'PLD 2024 Art. 14',
            check: 'pld_latent_defect_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'pld-data-damage',
            description: 'Data damage / loss events tracked within PLD scope',
            reference: 'PLD 2024 Art. 6(1)(c)',
            check: 'pld_data_damage_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'pld-withdrawn-ald-guard',
            description: 'Workflows guarded against referencing withdrawn AI Liability Directive provisions',
            reference: 'AI Liability Directive withdrawal (Feb 2025)',
            check: 'pld_withdrawn_ald_guard_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'pld-product-information',
            description: 'Product information disclosure supports defectiveness defence',
            reference: 'PLD 2024 Art. 6(2)',
            check: 'pld_product_information_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'pld-open-source-exception',
            description: 'Open-source / non-commercial exception tracking',
            reference: 'PLD 2024 Recital 14',
            check: 'pld_open_source_exception_active',
            failSeverity: 'LOW',
        },
        {
            id: 'pld-audit-trail',
            description: 'Tamper-evident audit trail ready for disclosure',
            reference: 'PLD 2024 Art. 9',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=eu-ai-liability.js.map