"use strict";
/**
 * UK CMA AI Foundation Models Compliance Pack
 *
 * Framework:
 *   Competition and Markets Authority (CMA) AI Foundation Models work
 *   programme. Major outputs:
 *   - Initial Report on AI Foundation Models (Sept 2023)
 *   - AI Foundation Models update paper (April 2024)
 *   - AI Foundation Models update paper (Sept 2024) — full set of seven
 *     CMA principles and risk-monitoring framework
 *
 *   Underpinning legal authority:
 *   - Enterprise Act 2002 + Competition Act 1998 (CMA's general powers)
 *   - Digital Markets, Competition and Consumers Act 2024 (DMCC Act) —
 *     in force from 1 January 2025 — Strategic Market Status (SMS)
 *     designation regime under the new Digital Markets Unit (DMU)
 *
 * Jurisdiction: UK-wide
 * Authority: CMA (Competition and Markets Authority) + DMU (Digital
 *   Markets Unit, within CMA, operational from January 2025)
 *
 * Why this pack:
 *   - Foundation-model providers and downstream AI suppliers must comply
 *     with CMA principles to mitigate competition + consumer-harm risks
 *     in AI markets. CMA guidance carries weight even where it is not
 *     primary legislation because the CMA can investigate and impose
 *     remedies under the Enterprise Act and the DMCC Act.
 *   - DMCC Act SMS designation can apply to firms with substantial and
 *     entrenched market power in a digital activity. Designated firms
 *     face conduct requirements (CRs) and pro-competition interventions
 *     (PCIs). Foundation-model providers above certain thresholds may be
 *     designated.
 *   - Pairs with `uk-ai-framework` (DSIT pro-innovation principles) +
 *     `uk-equality-act` (fairness) + `uk-gdpr` (Article 22 ADM overlap).
 *
 * The seven CMA AI Foundation Model principles (Sept 2024 update):
 *   1. Access — to key inputs (data, compute, expertise) without
 *      exclusionary distortions
 *   2. Diversity — sustained diversity of business models, including
 *      open-source and proprietary
 *   3. Choice — businesses have sufficient choice of foundation-model
 *      provider
 *   4. Flexibility — ability to switch and / or use multiple foundation
 *      models, including without lock-in
 *   5. Fair dealing — no anti-competitive conduct, including
 *      self-preferencing, tying, or bundling
 *   6. Transparency — consumers and businesses have information they
 *      need on foundation-model risks and limitations to make informed
 *      decisions
 *   7. Accountability — accountability for outputs to consumers and
 *      businesses; clear escalation pathway
 *
 * DMCC Act overlay:
 *   - Strategic Market Status (SMS) designation — if applied
 *   - Conduct requirements (CRs) — bespoke per-designated firm
 *   - Pro-competition interventions (PCIs) — bespoke per-designated firm
 *   - Penalties — up to 10% global annual turnover for breach
 *
 * Out of scope:
 *   - General Competition Act 1998 Chapter I / II conduct (separate
 *     regime; CMA enforces via competition law)
 *   - EU Digital Markets Act (separate jurisdiction)
 *   - DSA / Online Safety overlap (separate packs: `online-safety-act`,
 *     EU DSA when added)
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.CMA_AI_FM_PACK = exports.CMA_AI_FM_CATEGORY_CLASSIFIERS = void 0;
exports.CMA_AI_FM_CATEGORY_CLASSIFIERS = {
    CMA_PRINCIPLE_EVIDENCE: {
        references: [
            'CMA AI Foundation Models update paper (Sept 2024) — seven principles',
        ],
        classifier: (input) => {
            if (/\b(?:cma\s+(?:ai\s+foundation\s+models?|fm)\s+(?:principle|evidence|posture)|cma\s+ai\s+report)\b/i.test(input))
                return true;
            if (/\b(?:access\s+principle|diversity\s+principle|choice\s+principle|flexibility\s+principle|fair\s+dealing\s+principle|transparency\s+principle|accountability\s+principle)\s+cma\b/i.test(input))
                return true;
            return false;
        },
    },
    SMS_DESIGNATION_RECORD: {
        references: [
            'Digital Markets, Competition and Consumers Act 2024 (DMCC) — SMS designation',
        ],
        classifier: (input) => {
            if (/\b(?:strategic\s+market\s+status|sms\s+designation|sms\s+investigation|dmu\s+(?:investigation|notice))\b/i.test(input))
                return true;
            if (/\b(?:dmcc\s+act|digital\s+markets\s+unit|conduct\s+requirement|pro[\s-]?competition\s+intervention)\b/i.test(input))
                return true;
            return false;
        },
    },
    MARKET_POWER_RISK: {
        references: [
            'CMA risk-monitoring framework — exclusionary conduct, lock-in, self-preferencing',
        ],
        classifier: (input) => {
            if (/\b(?:self[\s-]?preferencing|tying\s+(?:or\s+)?bundling|exclusivity\s+arrangement|exclusionary\s+conduct)\b/i.test(input))
                return true;
            if (/\b(?:vertical\s+integration\s+ai|exclusive\s+(?:compute|data)\s+access|switching\s+cost\s+ai)\b/i.test(input))
                return true;
            return false;
        },
    },
    MODEL_TRANSPARENCY_RECORD: {
        references: [
            'CMA Principle 6 — Transparency; CMA risk-disclosure expectations',
        ],
        classifier: (input) => {
            if (/\b(?:model\s+(?:card|capabilities\s+statement|risk\s+disclosure|limitation\s+disclosure))\b/i.test(input))
                return true;
            if (/\b(?:foundation\s+model\s+(?:capabilities|limitations|known\s+risks|evaluation\s+report))\b/i.test(input))
                return true;
            return false;
        },
    },
    ACCOUNTABILITY_PATHWAY: {
        references: [
            'CMA Principle 7 — Accountability; user-facing escalation routes',
        ],
        classifier: (input) => {
            if (/\b(?:downstream\s+complaint\s+(?:pathway|escalation)|cma\s+complaint\s+route|fm\s+accountability\s+contact)\b/i.test(input))
                return true;
            if (/\b(?:redress\s+pathway\s+ai|harm\s+escalation\s+ai)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety; CMA evidence artefacts must not embed credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.CMA_AI_FM_PACK = {
    categoryClassifiers: exports.CMA_AI_FM_CATEGORY_CLASSIFIERS,
    id: 'cma-ai-foundation-models',
    aliases: [
        'cma-ai-fm',
        'cma-ai',
        'cma-foundation-models',
        'uk-cma-ai',
        'dmcc-act',
        'digital-markets-competition-consumers-act',
        'sms-designation',
        'dmu',
    ],
    name: 'UK CMA AI Foundation Models + DMCC Act 2024',
    version: '1.0.0',
    contentHash: '2bd90db2dbbc31f1faffb3958280927995be4a405707cfd8ca1c44609ffa7d70',
    description: 'CMA AI Foundation Models work programme (seven principles, Sept 2024) layered with the Digital Markets, Competition and Consumers Act 2024 SMS designation regime (in force Jan 2025). Seven principles: Access / Diversity / Choice / Flexibility / Fair dealing / Transparency / Accountability. SMS designation regime imposes per-designated-firm Conduct Requirements (CRs) and Pro-competition Interventions (PCIs) on firms with substantial and entrenched market power in a digital activity. Penalties up to 10% global annual turnover for DMCC breach. Pairs with `uk-ai-framework` (DSIT principles) + `uk-equality-act` (fairness) + `uk-gdpr` (Art. 22 ADM overlap).',
    authority: 'Competition and Markets Authority (CMA) + Digital Markets Unit (DMU)',
    industries: ['technology', 'cloud-infrastructure', 'media', 'professional-services', 'financial-services'],
    requiredModules: [
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Per-CMA-principle posture (Access / Diversity / Choice / Flexibility / Fair dealing / Transparency / Accountability) tracked over time; SMS designation status tracked when applicable; per-designated-firm Conduct Requirement attestation; per-PCI compliance evidence.',
            reference: 'CMA AI FM seven principles; DMCC Act 2024 SMS regime',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Default-deny on agent actions matching CMA risk patterns (self-preferencing, tying, exclusivity arrangements with foundation-model providers); CR-specific gates when SMS-designated.',
            reference: 'CMA Principle 5 Fair dealing; DMCC Act CR enforcement',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Model capabilities + limitations + known risks disclosed to downstream users (Principle 6); model-switching documentation surfaced (Principle 4); accountability-pathway visibility (Principle 7).',
            reference: 'CMA Principles 4, 6, 7',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain for CMA-principle posture changes, market-conduct evidence, customer-switching events, and CR / PCI compliance evidence — required for CMA / DMU investigation under Enterprise Act and DMCC Act.',
            reference: 'CMA investigation evidentiary requirements; DMCC Act investigation powers',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'CMA / DMU information-notice routing; market-conduct alerts; CR-violation alerts when SMS-designated; downstream complaint routing.',
            reference: 'CMA / DMU information-notice powers',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Surface CMA-specific evidence categories for the audit chain and the dashboard.',
            reference: 'CMA AI FM evidence categorisation',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'CMA / DMCC investigation evidence retained 6 years (Limitation Act 1980 default; CMA case evidence may be longer for active matters).',
            reference: 'Limitation Act 1980; CMA + DMU evidentiary practice',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'High-impact commercial arrangement decisions (exclusive deals, vertical integration with foundation-model providers) routed for senior + legal review (T2) to mitigate Principle 5 risk; SMS-designated firm CR-affecting changes routed for senior approval.',
            reference: 'CMA Principle 5; DMCC Act CR regime',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Sub-supplier foundation-model lineage tracked; switching-readiness evidence captured (Principle 4 Flexibility); diversity-of-supply evidence (Principle 2 Diversity).',
            reference: 'CMA Principles 2, 4',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Identity-bound named accountable executive for CMA / DMU correspondence; downstream-complaint pathway binding to identity.',
            reference: 'CMA Principle 7 Accountability',
        },
    ],
    moduleConfig: {
        'attestation-manager': {
            perPrinciplePostureTracked: true,
            smsDesignationStatusTracked: true,
            conductRequirementAttestationRequired: true, // when SMS-designated
            pciComplianceEvidenceRequired: true,
        },
        'governance-runtime': {
            selfPreferencingGateRequired: true,
            tyingBundlingGateRequired: true,
            exclusivityArrangementGateRequired: true,
            crSpecificGatesRequired: true, // active when SMS-designated
        },
        'transparency-injector': {
            modelCardPublicationRequired: true,
            modelLimitationDisclosureRequired: true,
            switchingDocumentationRequired: true,
            accountabilityPathwayVisibleRequired: true,
        },
        'audit-integrity': {
            cmaInvestigationEvidenceTrackingRequired: true,
            dmuInvestigationEvidenceTrackingRequired: true,
        },
        'event-bus': {
            cmaInformationNoticeRoutingRequired: true,
            dmuInformationNoticeRoutingRequired: true,
            crViolationAlertsRequired: true, // when SMS-designated
            downstreamComplaintRoutingRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'CMA_PRINCIPLE_EVIDENCE',
                'SMS_DESIGNATION_RECORD',
                'MARKET_POWER_RISK',
                'MODEL_TRANSPARENCY_RECORD',
                'ACCOUNTABILITY_PATHWAY',
                'CREDENTIALS',
            ],
            credentialsAction: 'BLOCK',
        },
        'session-persistence': {
            retentionDaysMinimum: 2190, // 6 years
        },
        'approval-queue': {
            commercialArrangementApprovalRequired: true,
            crAffectingChangeApprovalRequired: true, // when SMS-designated
            reviewTier: 'T2',
        },
        'supply-chain': {
            foundationModelLineageRequired: true,
            switchingReadinessEvidenceRequired: true,
            diversityOfSupplyEvidenceRequired: true,
        },
        'agent-auth': {
            namedAccountableExecutiveRequired: true,
            complaintPathwayIdentityBindingRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['MODEL-CARD-PUBLICATION', 'SWITCHING-DOCUMENTATION', 'CMA-CR-COMPATIBLE'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'CMA_PRINCIPLE_EVIDENCE',
            'SMS_DESIGNATION_RECORD',
            'MARKET_POWER_RISK',
            'MODEL_TRANSPARENCY_RECORD',
            'ACCOUNTABILITY_PATHWAY',
            'CREDENTIALS',
        ],
        categoryActions: {
            CMA_PRINCIPLE_EVIDENCE: 'WARN',
            SMS_DESIGNATION_RECORD: 'WARN',
            MARKET_POWER_RISK: 'WARN',
            MODEL_TRANSPARENCY_RECORD: 'WARN',
            ACCOUNTABILITY_PATHWAY: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        auditLogRetentionDays: 2190, // 6 years
        sessionRetentionDays: 2190,
        incidentRetentionDays: 2190,
        reference: 'Limitation Act 1980 6-year window; CMA / DMU evidentiary practice',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb', 'eu'],
    },
    incidentPolicy: {
        notificationDeadlineHours: 168, // 7 days for internal escalation; CMA/DMU notice timing varies
        reference: 'CMA / DMU information-notice cooperation; Enterprise Act 2002 + DMCC Act 2024 investigation powers',
        requiredRecipients: ['legal-counsel', 'named-accountable-executive', 'data-protection-officer'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'cma-ai-fm-principles-posture',
            description: 'Per-principle posture (Access / Diversity / Choice / Flexibility / Fair dealing / Transparency / Accountability) tracked and attested current.',
            reference: 'CMA AI FM update paper (Sept 2024) — seven principles',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cma-ai-fm-self-preferencing-gate',
            description: 'Default-deny on AI agent actions exhibiting self-preferencing / tying / exclusivity patterns.',
            reference: 'CMA Principle 5 Fair dealing',
            check: 'governance_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cma-ai-fm-model-transparency',
            description: 'Model capabilities + limitations + known risks published; downstream-user disclosure path visible.',
            reference: 'CMA Principle 6 Transparency',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cma-ai-fm-switching-flexibility',
            description: 'Model-switching documentation captured; multi-model architecture evidence; lock-in risk mitigations recorded.',
            reference: 'CMA Principle 4 Flexibility',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cma-ai-fm-accountability-pathway',
            description: 'Named accountable executive recorded; downstream complaint + escalation pathway visible to consumers and businesses.',
            reference: 'CMA Principle 7 Accountability',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cma-ai-fm-sms-readiness',
            description: 'SMS designation readiness — Conduct Requirement and PCI templates ready to instantiate per-firm should the DMU designate.',
            reference: 'DMCC Act 2024 SMS designation regime',
            check: 'attestation_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'cma-ai-fm-investigation-evidence',
            description: 'Tamper-evident audit chain captures market-conduct evidence and CMA / DMU information-notice responses.',
            reference: 'CMA + DMU investigation powers',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'cma-ai-fm-supply-chain-diversity',
            description: 'Foundation-model supply-chain diversity evidence captured (Principle 2); single-source dependency flagged for review.',
            reference: 'CMA Principle 2 Diversity',
            check: 'subservice_registry_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'cma-ai-fm-evidence-retention',
            description: 'CMA / DMCC evidence retained 6 years; legal-hold support active for live CMA / DMU investigations.',
            reference: 'Limitation Act 1980; CMA evidentiary practice',
            check: 'retention_policy_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cma-ai-fm-credential-block',
            description: 'Plaintext credentials blocked from CMA evidence artefacts and audit chain entries.',
            reference: 'CMA evidence integrity',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=cma-ai-foundation-models.js.map