/**
 * Thailand Personal Data Protection Act Compliance Pack
 *
 * Statute: Personal Data Protection Act B.E. 2562 (2019). Came into
 *   full force 1 June 2022 after multiple deferrals.
 *
 * Jurisdiction: Thailand
 * Authority: Personal Data Protection Committee (PDPC) — established
 *   under Office of the Personal Data Protection Committee
 *
 * Why this pack:
 *   - Major SE Asian privacy regime materially modeled on GDPR but with
 *     Thai-specific overlays.
 *   - Includes CONTROVERSIAL extraterritorial application (offering
 *     goods/services to data subjects in Thailand, monitoring behaviour
 *     in Thailand).
 *
 * Key obligations:
 *   - **Lawful basis** + consent regime (Art. 19) — broader than GDPR
 *     consent emphasis
 *   - **DPO mandatory** for public bodies + large-scale processors
 *     + sensitive-data processors (Art. 41)
 *   - **Cross-border transfer** (Art. 28-29) — adequate-protection
 *     standards or PDPC approval
 *   - **DPIA-equivalent** for high-risk processing
 *   - **Breach notification** to PDPC within 72 hours (Art. 37(4))
 *   - **Data Subject Rights** comprehensive (access, rectification,
 *     erasure, portability, objection, restriction)
 *
 * Penalties:
 *   - Administrative fines up to THB 5M (~USD 140K) per violation
 *   - Criminal penalties up to 1 year imprisonment + THB 1M for
 *     unauthorised disclosure of sensitive data
 *
 * @connexum/ai-governance
 */
export const TH_PDPA_CATEGORY_CLASSIFIERS = {
    TH_LAWFUL_BASIS: {
        references: ['TH PDPA Art. 19 — lawful bases'],
        classifier: (i) => /\b(?:thailand\s+(?:lawful\s+basis|consent|legitimate\s+interest)|art\.?\s*19\s+pdpa\s+thailand|th\s+pdpa\s+lawful)\b/i.test(i),
    },
    TH_DPO: {
        references: ['TH PDPA Art. 41 — DPO designation'],
        classifier: (i) => /\b(?:thailand\s+dpo|art\.?\s*41\s+pdpa\s+thailand|th\s+dpo\s+designation|pdpc\s+thailand\s+dpo)\b/i.test(i),
    },
    TH_CROSS_BORDER: {
        references: ['TH PDPA Arts. 28-29 — cross-border transfer'],
        classifier: (i) => /\b(?:thailand\s+cross[\s-]?border\s+transfer|th\s+pdpc\s+approval|art\.?\s*28\s+pdpa\s+thailand|art\.?\s*29\s+pdpa\s+thailand)\b/i.test(i),
    },
    TH_BREACH_NOTIFICATION: {
        references: ['TH PDPA Art. 37(4) — 72-hour breach notification to PDPC'],
        classifier: (i) => /\b(?:thailand\s+breach\s+notification|72[\s-]?hour\s+pdpc|art\.?\s*37\s+pdpa\s+thailand|pdpc\s+notification)\b/i.test(i),
    },
    TH_SENSITIVE_DATA: {
        references: ['TH PDPA Art. 26 — sensitive personal data'],
        classifier: (i) => /\b(?:thailand\s+sensitive\s+data|art\.?\s*26\s+pdpa\s+thailand|sensitive\s+personal\s+data\s+thailand)\b/i.test(i),
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety'],
        classifier: (i) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(i))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(i))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(i))
                return true;
            return false;
        },
    },
};
export const TH_PDPA_PACK = {
    categoryClassifiers: TH_PDPA_CATEGORY_CLASSIFIERS,
    id: 'th-pdpa',
    aliases: ['thailand-pdpa', 'pdpa-thailand', 'thailand-personal-data-protection-act'],
    name: 'Thailand Personal Data Protection Act B.E. 2562 (2019)',
    version: '1.0.0',
    contentHash: '5f7a6124d730e121d7249797fa29e240543738ec6d5da9911d0ec9af9a56e782',
    description: 'Thailand\'s comprehensive privacy regime in full force from 1 June 2022. GDPR-like with Thai overlays + extraterritorial application (offering goods/services to data subjects in Thailand, monitoring behaviour in Thailand). DPO mandatory for public bodies + large-scale + sensitive-data processors. Cross-border transfer requires adequate-protection standards or PDPC approval. 72-hour breach notification (Art. 37(4)). Penalties up to THB 5M administrative + THB 1M criminal + 1-year imprisonment for unauthorised sensitive-data disclosure.',
    authority: 'Personal Data Protection Committee (PDPC), Office of the PDPC',
    industries: ['technology', 'financial-services', 'healthcare', 'retail', 'media', 'tourism', 'manufacturing'],
    requiredModules: [
        { name: 'attestation-manager', required: true, reason: 'DPO designation + sensitive-data DPIA + cross-border transfer approval; PDPC filing log.', reference: 'TH PDPA Arts. 26, 28-29, 41' },
        { name: 'governance-runtime', required: true, reason: 'Lawful-basis gate (Art. 19); sensitive-data default-deny without explicit consent; cross-border transfer gate.', reference: 'TH PDPA Arts. 19, 26, 28-29' },
        { name: 'event-bus', required: true, reason: '72-hour PDPC breach notification routing.', reference: 'TH PDPA Art. 37(4)' },
        { name: 'audit-integrity', required: true, reason: 'Tamper-evident audit chain; consent record integrity.', reference: 'TH PDPA evidence integrity' },
        { name: 'data-classifier', required: true, reason: 'TH sensitive-data detection; PDPA evidence categorisation.', reference: 'TH PDPA Art. 26' },
        { name: 'transparency-injector', required: true, reason: 'Privacy notice (Art. 23); consent prompts; data-subject rights disclosure.', reference: 'TH PDPA Arts. 23, 30-36' },
        { name: 'approval-queue', required: true, reason: 'Cross-border transfer senior approval; sensitive-data DPIA sign-off.', reference: 'TH PDPA Arts. 28-29' },
        { name: 'session-persistence', required: true, reason: 'PDPA retention principle compliance + PDPC evidence retention.', reference: 'TH PDPA principle compliance' },
        { name: 'agent-auth', required: true, reason: 'DPO named-role binding; data-subject identity binding for requests.', reference: 'TH PDPA Art. 41' },
        { name: 'supply-chain', required: true, reason: 'Sub-processor accountability cascade.', reference: 'TH PDPA processor accountability' },
    ],
    moduleConfig: {
        'governance-runtime': { lawfulBasisGateRequired: true, sensitiveDataConsentGateRequired: true, crossBorderGateRequired: true },
        'attestation-manager': { dpoDesignationTracked: true, dpiaTracked: true, crossBorderApprovalTracked: true },
        'event-bus': { pdpc72hNotificationRequired: true },
        'audit-integrity': { thPdpaEvidenceTrackingRequired: true },
        'data-classifier': { enabledCategories: ['TH_LAWFUL_BASIS', 'TH_DPO', 'TH_CROSS_BORDER', 'TH_BREACH_NOTIFICATION', 'TH_SENSITIVE_DATA', 'CREDENTIALS'], thSensitiveDataAction: 'WARN', credentialsAction: 'BLOCK' },
        'transparency-injector': { privacyNoticeRequired: true, consentPromptsRequired: true },
        'approval-queue': { reviewTier: 'T2' },
        'session-persistence': { retentionDaysMinimum: 1825 },
        'agent-auth': { dpoNamedRoleBindingRequired: true },
        'supply-chain': { subProcessorAccountabilityRequired: true },
    },
    providerPolicy: { blockedProviders: [], requiredCapabilities: ['THAILAND-DATA-RESIDENCY', 'PROCESSOR-CONTRACT'], blockReasons: {} },
    dataPolicy: {
        scanCategories: ['TH_LAWFUL_BASIS', 'TH_DPO', 'TH_CROSS_BORDER', 'TH_BREACH_NOTIFICATION', 'TH_SENSITIVE_DATA', 'CREDENTIALS'],
        categoryActions: { TH_LAWFUL_BASIS: 'WARN', TH_DPO: 'WARN', TH_CROSS_BORDER: 'WARN', TH_BREACH_NOTIFICATION: 'WARN', TH_SENSITIVE_DATA: 'WARN', CREDENTIALS: 'BLOCK' },
        encryptionRequired: true, encryptionStandard: 'AES-256-GCM', minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: { auditLogRetentionDays: 1825, sessionRetentionDays: 1825, incidentRetentionDays: 2190, reference: 'TH PDPA principle compliance + civil-claim limitation', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['th'] },
    incidentPolicy: { notificationDeadlineHours: 72, reference: 'TH PDPA Art. 37(4)', requiredRecipients: ['pdpc-thailand', 'dpo-thailand', 'legal-counsel'], formalNotificationRequired: true },
    validators: [
        { id: 'th-pdpa-lawful-basis', description: 'Lawful-basis gate (Art. 19) active for all personal-data processing.', reference: 'TH PDPA Art. 19', check: 'governance_active', failSeverity: 'CRITICAL' },
        { id: 'th-pdpa-sensitive-data', description: 'Sensitive-data processing requires explicit consent or specific exemption.', reference: 'TH PDPA Art. 26', check: 'governance_active', failSeverity: 'CRITICAL' },
        { id: 'th-pdpa-dpo', description: 'DPO designated for public bodies + large-scale + sensitive processors.', reference: 'TH PDPA Art. 41', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'th-pdpa-cross-border', description: 'Cross-border transfer adequate-protection or PDPC approval evidence captured.', reference: 'TH PDPA Arts. 28-29', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'th-pdpa-72h-notification', description: '72-hour PDPC breach notification path active.', reference: 'TH PDPA Art. 37(4)', check: 'monitoring_active', failSeverity: 'CRITICAL' },
        { id: 'th-pdpa-data-subject-rights', description: 'Data-subject rights workflow active.', reference: 'TH PDPA Arts. 30-36', check: 'transparency_active', failSeverity: 'HIGH' },
        { id: 'th-pdpa-consent-record', description: 'Consent records captured tamper-evidently.', reference: 'TH PDPA Art. 19', check: 'audit_trail_exists', failSeverity: 'HIGH' },
        { id: 'th-pdpa-supplier-flow-down', description: 'Sub-processor accountability cascade.', reference: 'TH PDPA processor accountability', check: 'subservice_registry_active', failSeverity: 'HIGH' },
        { id: 'th-pdpa-encryption', description: 'Personal data encrypted at rest and in transit.', reference: 'TH PDPA security obligation', check: 'encryption_active', failSeverity: 'HIGH' },
        { id: 'th-pdpa-credential-block', description: 'Plaintext credentials blocked.', reference: 'TH PDPA security obligation', check: 'data_classifier_active', failSeverity: 'CRITICAL' },
    ],
};
//# sourceMappingURL=th-pdpa.js.map