"use strict";
/**
 * DORA Compliance Pack
 *
 * Digital Operational Resilience Act (Regulation (EU) 2022/2554) for
 * financial entities. Applicable from 17 January 2025.
 *
 * Standards referenced:
 *   - Regulation (EU) 2022/2554 (DORA)
 *   - Commission Delegated Regulation (EU) 2024/1773 (RTS on ICT risk
 *     management framework)
 *   - Commission Delegated Regulation (EU) 2024/1774 (RTS on simplified
 *     ICT risk management framework)
 *   - Commission Implementing Regulation (EU) 2025/xx (ITS on incident
 *     classification + reporting templates)
 *   - ESA Joint RTS on threat-led penetration testing
 *   - ESA Joint RTS on register of information
 *
 * Current state (2026):
 *   - Entered into force 17 January 2025. All 5 finalised RTS /
 *     technical standards now in force.
 *   - Critical ICT Third-Party Service Providers (CTPP) designations
 *     published by the ESAs; CTPP framework active.
 *   - AI systems deployed by financial entities fall squarely within
 *     the ICT risk management framework (Art. 6-16).
 *   - Major ICT incidents: 4-hour initial notification, 72-hour
 *     interim, 1-month final (intermediate / final).
 *   - DORA pairs with GDPR (personal data), SR 11-7 / CFPB (model
 *     governance), NY DFS 500 (US NY cybersecurity overlap).
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.DORA_PACK = exports.DORA_CATEGORY_CLASSIFIERS = void 0;
/**
 * DORA (EU 2022/2554) category classifiers.
 * DORA governs ICT risk management for financial entities.
 * Scans for credentials and payment card data (PAN) per
 * Art. 5-16 (ICT risk) and Art. 17-23 (incident management).
 *
 * NOTE: PII was removed (F-NEW-CRIT-21). DORA is an operational-resilience
 * framework; it does not independently classify personal data. Activate GDPR
 * alongside DORA when personal data is in scope (DORA Art. 5 preamble).
 */
exports.DORA_CATEGORY_CLASSIFIERS = {
    CREDENTIALS: {
        references: ['DORA Art. 9(2) -- authentication and access control for ICT systems'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            if (/\bbearer\s+[A-Za-z0-9_\-\.]{20,}/i.test(input))
                return true;
            return false;
        },
    },
    PAN: {
        references: ['DORA Art. 10 -- ICT-related incident detection; payment card data'],
        pattern: /\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\b/,
    },
    ICT_INCIDENT: {
        references: ['DORA Art. 17-23 -- Major ICT-related incident reporting'],
        classifier: (input) => {
            const lower = input.toLowerCase();
            if (/\bict[\s-]?(related\s+)?(incident|disruption|event|outage)\b/i.test(input))
                return true;
            if (/\b(cyber|operational)\s+(incident|disruption|event)\b/i.test(input))
                return true;
            if (/\b(payment|trading|clearing|settlement)\s+system\s+(outage|down|unavailable|disruption)\b/i.test(input))
                return true;
            if (/\b(service|system)\s+(outage|unavailability|offline|disruption)\b/i.test(input))
                return true;
            if (/\bservice\s+unavailability\s+declared\b/i.test(input))
                return true;
            if (/\bunauthor[ie]zed\s+access\s+detected\b/i.test(input))
                return true;
            if (/\b(rto|rpo)\s+breach/i.test(input))
                return true;
            if (lower.includes('recovery time objective') && lower.includes('breach'))
                return true;
            if (/\bcustomer-facing\s+service\s+offline\b/i.test(input))
                return true;
            return false;
        },
    },
    THIRD_PARTY_RISK: {
        references: ['DORA Art. 28-30 -- ICT third-party risk management + Register of Information'],
        classifier: (input) => {
            if (/\bict\s+third[\s-]?party\s+(provider|service|arrangement)\b/i.test(input))
                return true;
            if (/\bregister\s+of\s+information\b/i.test(input))
                return true;
            if (/\bctpp\b/i.test(input))
                return true;
            if (/\bcritical\s+third[\s-]?party\s+provider\b/i.test(input))
                return true;
            if (/\bsubcontractor\s+chain\b/i.test(input))
                return true;
            if (/\bict\s+concentration\s+risk\b/i.test(input))
                return true;
            if (/\bhyperscaler\b/i.test(input) && /\b(provider|cloud|depend)\b/i.test(input))
                return true;
            return false;
        },
    },
    OPERATIONAL_RESILIENCE: {
        references: ['DORA Art. 24-27 -- Digital operational resilience testing (incl. TLPT)'],
        classifier: (input) => {
            const lower = input.toLowerCase();
            if (/\btlpt\b/i.test(input))
                return true;
            if (/\bthreat[\s-]?led\s+pen(etration)?\s+test\b/i.test(input))
                return true;
            if (/\brecovery\s+point\s+objective\b/i.test(input))
                return true;
            if (/\brpo\s+(of|not\s+met|breach)/i.test(input))
                return true;
            if (/\bresilience\s+test(ing)?\b/i.test(input))
                return true;
            if (/\bdigital\s+operational\s+resilience\s+test\b/i.test(input))
                return true;
            if (lower.includes('dora art. 24') || lower.includes('dora art 24'))
                return true;
            return false;
        },
    },
};
exports.DORA_PACK = {
    categoryClassifiers: exports.DORA_CATEGORY_CLASSIFIERS,
    id: 'dora',
    name: 'DORA (EU Digital Operational Resilience Act)',
    version: '1.0.0',
    contentHash: '06b8f9f7adf402a227857ea2c5555e3d7faced5340dfd2d5a64f1666a78a5659',
    description: 'EU DORA (Regulation (EU) 2022/2554) compliance for AI systems at EU financial entities. Applicable from 17 January 2025 with all 5 finalised RTS in force. Covers ICT risk management (Art. 6-16), incident reporting (Art. 17-23), resilience testing (Art. 24-27), third-party risk (Art. 28-30), and information sharing (Art. 45).',
    authority: 'European Supervisory Authorities (EBA, EIOPA, ESMA) + national competent authorities',
    industries: ['banking', 'insurance', 'fintech', 'asset-management', 'payments', 'crypto-asset-provider', 'clearing-house', 'credit-rating-agency', 'trading-venue'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'ICT risk management framework with management body responsibility',
            reference: 'DORA Art. 5-6 -- Governance and Organisation; ICT Risk Management Framework',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'ICT-related incident logging + register of information',
            reference: 'DORA Art. 17, Art. 28(3) -- Incident records + Register of Information',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Incident detection + 4-hour / 72-hour / 1-month reporting clocks',
            reference: 'DORA Art. 19 -- Reporting of Major ICT Incidents',
        },
        {
            name: 'circuit-breaker',
            required: true,
            reason: 'Response and recovery; operational resilience',
            reference: 'DORA Art. 11 -- Response and Recovery',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'ICT incident detection',
            reference: 'DORA Art. 10 -- Detection',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'ICT third-party risk + Register of Information + CTPP oversight',
            reference: 'DORA Art. 28-30 -- ICT Third-Party Risk Management',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'ICT protection: encryption and cryptographic controls',
            reference: 'DORA Art. 9 -- Protection and Prevention',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Identity and access management; authentication mechanisms',
            reference: 'DORA Art. 9(4)(c) -- Authentication Mechanisms',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Business continuity state; recovery continuity',
            reference: 'DORA Art. 11-13 -- Response, Recovery, Learning and Evolving',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Threat-led penetration testing (TLPT) + resilience testing attestations + management body attestation',
            reference: 'DORA Art. 24-27 -- Digital Operational Resilience Testing',
        },
    ],
    moduleConfig: {
        'circuit-breaker': {
            maxFailures: 3,
            resetTimeoutMs: 120000, // 2 min production default
            responseAndRecoveryRequired: true,
        },
        'anomaly-detector': {
            thresholdMultiplier: 1.5,
            ictIncidentDetectionActive: true,
        },
        'event-bus': {
            majorIncidentFourHourNotificationHours: 4,
            majorIncidentSeventyTwoHourInterimHours: 72,
            majorIncidentOneMonthFinalHours: 720,
        },
        'supply-chain': {
            registerOfInformationRequired: true,
            ctppFrameworkActive: true,
            concentrationRiskAssessmentRequired: true,
        },
        'attestation-manager': {
            threatLedPenetrationTestingRequired: true,
            managementBodyApprovalRequired: true,
        },
        'governance-runtime': {
            ictRiskFrameworkRequired: true,
            managementBodyResponsibilityActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['SOC2-TYPE2', 'DORA-REGISTER-READY'],
        blockReasons: {
            deepseek: 'DORA Art. 28-30: PRC jurisdiction creates unacceptable ICT third-party risk + CTPP concentration concerns.',
            baidu: 'DORA Art. 28-30: PRC jurisdiction creates systemic risk.',
            alibaba: 'DORA Art. 28-30: PRC jurisdiction creates systemic risk.',
        },
    },
    dataPolicy: {
        scanCategories: ['CREDENTIALS', 'PAN', 'ICT_INCIDENT', 'THIRD_PARTY_RISK', 'OPERATIONAL_RESILIENCE'],
        categoryActions: {
            CREDENTIALS: 'BLOCK',
            PAN: 'BLOCK',
            ICT_INCIDENT: 'LOG',
            THIRD_PARTY_RISK: 'WARN',
            OPERATIONAL_RESILIENCE: 'LOG',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['EU'],
        auditLogRetentionDays: 1825, // 5 years
        sessionRetentionDays: 365,
        incidentRetentionDays: 1825,
        reference: 'DORA Art. 17, Art. 28(3) -- ICT incident records + Register of Information retained for supervisory review (5 years typical)',
    },
    incidentPolicy: {
        notificationDeadlineHours: 4,
        reference: 'DORA Art. 19 -- Major ICT incident reporting: 4-hour initial (upon awareness), 72-hour interim update, 1-month final report',
        requiredRecipients: ['competent-authority', 'management-body', 'clients-affected', 'esa-if-critical'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'dora-risk-framework',
            description: 'ICT risk management framework active with management-body responsibility',
            reference: 'DORA Art. 5-6',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'dora-incident-4hr',
            description: '4-hour major ICT incident notification configured',
            reference: 'DORA Art. 19',
            check: 'dora_incident_4hr_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'dora-incident-cascade',
            description: 'Cascade reporting configured: 4h initial, 72h interim, 1-month final',
            reference: 'DORA Art. 19',
            check: 'dora_incident_cascade_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'dora-resilience',
            description: 'Operational resilience: response and recovery (circuit breaker active)',
            reference: 'DORA Art. 11',
            check: 'dora_resilience_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'dora-detection',
            description: 'ICT anomaly and threat detection active',
            reference: 'DORA Art. 10',
            check: 'post_market_monitoring',
            failSeverity: 'HIGH',
        },
        {
            id: 'dora-third-party',
            description: 'ICT third-party risk management + Register of Information',
            reference: 'DORA Art. 28-30',
            check: 'dora_register_of_information_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'dora-encryption',
            description: 'Data encrypted at rest and in transit',
            reference: 'DORA Art. 9',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'dora-audit-trail',
            description: 'ICT-related incident audit trail (5-year retention)',
            reference: 'DORA Art. 17',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'dora-auth',
            description: 'Authentication mechanisms for ICT access',
            reference: 'DORA Art. 9(4)(c)',
            check: 'agent_auth_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'dora-tlpt',
            description: 'Threat-led penetration testing attestations',
            reference: 'DORA Art. 26-27',
            check: 'dora_tlpt_active',
            failSeverity: 'MEDIUM',
        },
    ],
    /**
     * P3-T1: RAG retrieval audit logging required for this pack.
     * Strict-mode packs require every retrieval to be paired with the
     * subsequent decision so auditors can replay what was retrieved before
     * the decision was made.
     */
    requiresRetrievalAuditLogging: true,
    /**
     * P3-T1: Level 4 autonomy requires explicit operator attestation when this pack
     * is active. Cap is Level 3 -- HITL oversight must be preserved for regulated data.
     */
    maxAutonomyLevelWithoutAttestation: 3,
    /**
     * P3-T1: RAG citations required for this pack. Every claim grounded in
     * retrieval must cite the source for auditor replay.
     */
    requiresCitations: true,
    /** P3-T1: RAG retrieval limited to allowlisted sources. */
    requiresRagSourceAllowlist: true,
    /** P3-T1: hook profile recommendation for this pack. */
    recommendedHookProfile: 'strict',
};
//# sourceMappingURL=dora.js.map