"use strict";
/**
 * EU Cyber Resilience Act (CRA) Compliance Pack
 *
 * Regulation: Regulation (EU) 2024/2847 — Cyber Resilience Act.
 *   Adopted October 2024; main obligations apply from 11 December 2027
 *   (with reporting obligations earlier from September 2026).
 *
 * Jurisdiction: EU-wide
 * Authority: European Commission + ENISA + national market surveillance
 *   authorities
 *
 * Why this pack:
 *   - Imposes essential cybersecurity requirements on Products with
 *     Digital Elements (PDE) placed on the EU market, throughout the
 *     product lifecycle.
 *   - Distinct from EU NIS2 (operator security) and EU DSA / DMA (platform
 *     conduct). CRA targets the product itself.
 *   - Major impact on AI systems supplied as products / SaaS appliances.
 *
 * Key obligations:
 *   - **Annex I — essential cybersecurity requirements** (security by
 *     design + by default; vulnerability handling)
 *   - **Conformity assessment** (self-assessment for default class;
 *     Class I + II products require third-party assessment for some)
 *   - **CE marking** for cyber-resilience attestation
 *   - **Vulnerability handling**:
 *     - 24-hour notification to ENISA + market surveillance for
 *       actively-exploited vulnerabilities
 *     - 72-hour notification of severe incidents
 *   - **Software Bill of Materials (SBOM)** required at least at the
 *     top-level component
 *   - **Support period** declared (default minimum 5 years) — security
 *     updates obligation throughout
 *   - **Conformity declaration** + technical documentation
 *
 * Penalties:
 *   - Up to €15M or 2.5% of worldwide annual turnover for essential-
 *     requirement breaches
 *   - Up to €10M or 2% for other breaches
 *   - Up to €5M or 1% for incorrect / misleading information
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.EU_CRA_PACK = exports.EU_CRA_CATEGORY_CLASSIFIERS = void 0;
exports.EU_CRA_CATEGORY_CLASSIFIERS = {
    PDE_DESIGNATION: {
        references: ['CRA — Product with Digital Elements designation'],
        classifier: (i) => /\b(?:product\s+with\s+digital\s+elements|pde\s+(?:designation|class|category)|cra\s+(?:class\s+i+|default))\b/i.test(i),
    },
    VULNERABILITY_HANDLING: {
        references: ['CRA Annex I — vulnerability handling'],
        classifier: (i) => /\b(?:cra\s+(?:vulnerability|cve)\s+(?:handling|disclosure|notification)|cve-\d{4}-\d{4,7}\s+cra|vulnerability\s+handling\s+process)\b/i.test(i),
    },
    ENISA_NOTIFICATION: {
        references: ['CRA Art. 14 — ENISA notification (24h actively exploited; 72h severe incident)'],
        classifier: (i) => /\b(?:enisa\s+(?:notification|report|advisory)|art\.?\s*14\s+cra|24[\s-]?hour\s+exploited\s+notification|72[\s-]?hour\s+severe\s+incident)\b/i.test(i),
    },
    SBOM_RECORD: {
        references: ['CRA Annex I — Software Bill of Materials'],
        classifier: (i) => /\b(?:sbom|software\s+bill\s+of\s+materials|cyclonedx|spdx\s+sbom)\b/i.test(i),
    },
    CE_MARKING_CRA: {
        references: ['CRA — CE marking for cyber-resilience'],
        classifier: (i) => /\b(?:ce\s+marking\s+cra|cra\s+ce\s+(?:declaration|conformity|attestation)|cra\s+conformity\s+assessment)\b/i.test(i),
    },
    SUPPORT_PERIOD: {
        references: ['CRA — declared support period (default minimum 5 years)'],
        classifier: (i) => /\b(?:cra\s+support\s+period|expected\s+product\s+lifetime\s+cra|security\s+update\s+commitment\s+cra)\b/i.test(i),
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety'],
        classifier: (i) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(i))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(i))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(i))
                return true;
            return false;
        },
    },
};
exports.EU_CRA_PACK = {
    categoryClassifiers: exports.EU_CRA_CATEGORY_CLASSIFIERS,
    id: 'eu-cra',
    aliases: ['cra', 'cyber-resilience-act', 'eu-cyber-resilience-act', 'regulation-2024-2847'],
    name: 'EU Cyber Resilience Act (Regulation (EU) 2024/2847)',
    version: '1.0.0',
    contentHash: '8048fdc3c1aa8983d7dfe2e39aa56b9c9ced2436b02994db279cd779b773db41',
    description: 'EU Cyber Resilience Act — essential cybersecurity requirements on Products with Digital Elements (PDE) placed on EU market. Adopted Oct 2024; main obligations apply 11 Dec 2027 (reporting from Sept 2026). 24-hour ENISA notification for actively-exploited vulnerabilities, 72-hour for severe incidents, SBOM required, declared support period (default 5 years minimum), CE marking for cyber-resilience attestation. Penalties up to €15M / 2.5% global turnover. Distinct from NIS2 (operator security) and DSA/DMA (platform conduct).',
    authority: 'European Commission + ENISA + national market surveillance authorities',
    industries: ['technology', 'iot', 'cloud-infrastructure', 'manufacturing', 'automotive', 'medical-devices', 'consumer-electronics'],
    requiredModules: [
        { name: 'attestation-manager', required: true, reason: 'PDE class designation; conformity assessment; technical documentation; CE marking; declared support period; SBOM archive.', reference: 'CRA Arts. 13, 24-32, 33-34' },
        { name: 'governance-runtime', required: true, reason: 'Default-deny on PDE shipping without conformity assessment + CE marking; Annex I essential-requirements gate.', reference: 'CRA Annex I' },
        { name: 'event-bus', required: true, reason: '24-hour ENISA notification for actively-exploited vulnerabilities; 72-hour severe incident notification; CVE lifecycle telemetry.', reference: 'CRA Art. 14' },
        { name: 'audit-integrity', required: true, reason: 'Tamper-evident audit chain for vulnerability handling, ENISA notifications, SBOM revisions, CE conformity evidence.', reference: 'CRA Art. 14 + Annex I' },
        { name: 'data-classifier', required: true, reason: 'Surface PDE designation, vulnerability handling, ENISA notifications, SBOM records, CE attestations, support-period declarations.', reference: 'CRA evidence categorisation' },
        { name: 'transparency-injector', required: true, reason: 'User-facing security-update commitment + declared support period; CE marking visibility; SBOM disclosure where required.', reference: 'CRA Annex II + Annex III' },
        { name: 'approval-queue', required: true, reason: 'Conformity assessment sign-off; SBOM publication; security-update release approval; ENISA notification approval gate.', reference: 'CRA Arts. 13, 14, 24-32' },
        { name: 'session-persistence', required: true, reason: 'Technical documentation retained for 10 years post-last-placed-on-market (Art. 23).', reference: 'CRA Art. 23' },
        { name: 'agent-auth', required: true, reason: 'Manufacturer + importer + distributor identity binding; conformity-assessment body identity binding.', reference: 'CRA Arts. 12-21' },
        { name: 'supply-chain', required: true, reason: 'Component supplier SBOM flow-down; sub-supplier conformity inheritance.', reference: 'CRA Annex I + supply-chain accountability' },
    ],
    moduleConfig: {
        'governance-runtime': { pdeShippingGateRequired: true, annexIEssentialRequirementsGateRequired: true },
        'attestation-manager': { pdeClassDesignationTracked: true, conformityAssessmentTracked: true, technicalDocumentationRequired: true, ceMarkingTracked: true, supportPeriodDeclared: true, sbomArchived: true, supportPeriodMinDays: 1825 },
        'event-bus': { enisaNotification24hRequired: true, enisaSevereIncident72hRequired: true, cveLifecycleTelemetryRequired: true },
        'audit-integrity': { craEvidenceTrackingRequired: true },
        'data-classifier': { enabledCategories: ['PDE_DESIGNATION', 'VULNERABILITY_HANDLING', 'ENISA_NOTIFICATION', 'SBOM_RECORD', 'CE_MARKING_CRA', 'SUPPORT_PERIOD', 'CREDENTIALS'], credentialsAction: 'BLOCK' },
        'transparency-injector': { supportPeriodDisclosureRequired: true, ceMarkingVisibleRequired: true },
        'approval-queue': { reviewTier: 'T2' },
        'session-persistence': { retentionDaysAfterLastPlacedOnMarket: 3650 },
        'agent-auth': { manufacturerIdentityBindingRequired: true },
        'supply-chain': { sbomFlowDownRequired: true, conformityInheritanceRequired: true },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['CRA-COMPATIBLE', 'SBOM-EXPORT', 'CVE-LIFECYCLE'],
        blockReasons: { deepseek: 'PRC jurisdiction. CRA technical-file evidence chain must be EU-resident.', baidu: 'PRC jurisdiction.', alibaba: 'PRC jurisdiction.' },
    },
    dataPolicy: {
        scanCategories: ['PDE_DESIGNATION', 'VULNERABILITY_HANDLING', 'ENISA_NOTIFICATION', 'SBOM_RECORD', 'CE_MARKING_CRA', 'SUPPORT_PERIOD', 'CREDENTIALS'],
        categoryActions: { PDE_DESIGNATION: 'WARN', VULNERABILITY_HANDLING: 'WARN', ENISA_NOTIFICATION: 'WARN', SBOM_RECORD: 'WARN', CE_MARKING_CRA: 'WARN', SUPPORT_PERIOD: 'WARN', CREDENTIALS: 'BLOCK' },
        encryptionRequired: true, encryptionStandard: 'AES-256-GCM', minimumClassification: 'INTERNAL',
    },
    retentionPolicy: { auditLogRetentionDays: 3650, sessionRetentionDays: 3650, incidentRetentionDays: 3650, reference: 'CRA Art. 23 — 10-year retention post-last-placed-on-market', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['eu'] },
    incidentPolicy: { notificationDeadlineHours: 24, reference: 'CRA Art. 14 — 24h actively-exploited; 72h severe incident', requiredRecipients: ['enisa', 'national-market-surveillance', 'compliance-officer', 'data-protection-officer'], formalNotificationRequired: true },
    validators: [
        { id: 'eu-cra-pde-designation', description: 'PDE class designation captured (default / Class I / Class II); conformity assessment route documented.', reference: 'CRA Arts. 7, 24-32', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'eu-cra-essential-requirements', description: 'Annex I essential cybersecurity requirements attested for all in-scope PDEs.', reference: 'CRA Annex I', check: 'governance_active', failSeverity: 'CRITICAL' },
        { id: 'eu-cra-vulnerability-handling', description: 'Vulnerability-handling process active; CVE intake + remediation + disclosure cadence captured.', reference: 'CRA Annex I §2', check: 'monitoring_active', failSeverity: 'CRITICAL' },
        { id: 'eu-cra-enisa-24h', description: '24-hour ENISA notification path active for actively-exploited vulnerabilities.', reference: 'CRA Art. 14(1)', check: 'monitoring_active', failSeverity: 'CRITICAL' },
        { id: 'eu-cra-enisa-72h', description: '72-hour ENISA + market-surveillance notification for severe incidents.', reference: 'CRA Art. 14(3)', check: 'monitoring_active', failSeverity: 'CRITICAL' },
        { id: 'eu-cra-sbom', description: 'Top-level SBOM generated, archived, and made available per CRA Annex I.', reference: 'CRA Annex I', check: 'attestation_active', failSeverity: 'HIGH' },
        { id: 'eu-cra-ce-marking', description: 'CE marking for cyber-resilience applied; declaration of conformity issued.', reference: 'CRA Arts. 22, 23', check: 'attestation_active', failSeverity: 'CRITICAL' },
        { id: 'eu-cra-support-period', description: 'Support period declared (minimum 5 years default) and security-update commitment captured.', reference: 'CRA Art. 13(8)', check: 'attestation_active', failSeverity: 'HIGH' },
        { id: 'eu-cra-evidence-retention', description: 'Technical documentation retained 10 years post-last-placed-on-market.', reference: 'CRA Art. 23', check: 'retention_policy_active', failSeverity: 'HIGH' },
        { id: 'eu-cra-supply-chain-sbom', description: 'Sub-supplier SBOM flow-down captured; component-level conformity inheritance.', reference: 'CRA Annex I + supply-chain accountability', check: 'subservice_registry_active', failSeverity: 'HIGH' },
    ],
};
//# sourceMappingURL=eu-cra.js.map