/**
 * UK Procurement Act 2023 Compliance Pack
 *
 * Statute: Procurement Act 2023 (c.54). Came into force 24 February 2025
 *   under SI 2024/1019. Replaces the four pre-Brexit procurement
 *   regulations (Public Contracts Regulations 2015, Utilities Contracts
 *   Regulations 2016, Concession Contracts Regulations 2016, Defence and
 *   Security Public Contracts Regulations 2011) for England, Wales, and
 *   Northern Ireland. Scotland has its own parallel regime under the
 *   Procurement Reform (Scotland) Act 2014 (separate pack scope).
 *
 * Jurisdiction: England, Wales, Northern Ireland (the Procurement Act
 *   does not apply in Scotland — Procurement Reform (Scotland) Act 2014
 *   applies there with similar but distinct rules).
 * Authority: Cabinet Office (Procurement Review Unit / PRU) + sector
 *   contracting authorities + Procurement Service Centre (PSC) +
 *   National Audit Office.
 *
 * Why this pack:
 *   - Anyone supplying AI to UK central / local government must operate
 *     within Procurement Act 2023 obligations.
 *   - The Act introduces new regimes for transparency, supplier
 *     debarment, and "national security exclusion grounds" that
 *     specifically affect AI suppliers (data residency, model lineage,
 *     foreign-state ownership disclosure).
 *   - Public-sector AI suppliers also need `uk-ai-framework` (DSIT) and
 *     in many cases `cyber-essentials` and `ncsc-caf`. This pack
 *     captures the procurement-specific obligations.
 *
 * Key obligations (selected):
 *   - **Notice regime** (Part 4): tender notice, contract award notice,
 *     contract details notice (>£5M), contract performance notice (>£5M),
 *     payments compliance notice (annual, contracting authorities >£100M).
 *   - **Exclusions and debarment** (Part 5): mandatory exclusion grounds
 *     (Schedule 6), discretionary exclusion grounds (Schedule 7),
 *     debarment list maintained by Cabinet Office (s.59); national-
 *     security debarment (s.62).
 *   - **Conflicts of interest** (Part 5 + Schedule 5): mitigation register
 *     for staff with material interest in suppliers.
 *   - **Most Advantageous Tender (MAT)** (s.19): replaces MEAT, expands
 *     beyond price + quality to "social value" + environmental factors.
 *   - **Transparency** (Part 8): publish award decisions + contract
 *     details on the Central Digital Platform (CDP).
 *   - **30-day payment terms** (s.68): contracting authorities pay
 *     suppliers within 30 days of valid invoice; flow-down required.
 *   - **Modifications** (s.74): tightly controlled in-life contract
 *     changes; published modification notices.
 *   - **Direct award** (Schedule 5): narrow grounds; published rationale.
 *
 * Penalties:
 *   - Standstill period challenge (Cabinet Office)
 *   - Debarment (s.59) — mandatory or discretionary placement on UK
 *     debarment list (5-year maximum)
 *   - Termination for breach of contract conditions
 *   - Investigation by Procurement Review Unit (s.93)
 *
 * AI-specific obligations gathered into this pack:
 *   - Disclosure of foreign-state involvement / ownership (national-
 *     security exclusion ground)
 *   - Data-residency disclosure for AI services routing UK government
 *     data
 *   - Model lineage + provenance documentation for AI products supplied
 *   - Transparency on AI-driven decisions in supplier evaluation when
 *     contracting authorities use AI in award processes
 *
 * Out of scope:
 *   - Scotland: Procurement Reform (Scotland) Act 2014 — separate pack
 *   - Pre-2025 PCR2015 contracts: legacy regulation regime (separate)
 *   - Defence "in-scope of the Defence and Security Public Contracts
 *     Regulations": parallel regime preserved post-Act for some defence
 *     procurements
 *
 * @connexum/ai-governance
 */
export const UK_PROCUREMENT_CATEGORY_CLASSIFIERS = {
    PROCUREMENT_NOTICE: {
        references: [
            'Procurement Act 2023 Part 4 — notice regime',
        ],
        classifier: (input) => {
            if (/\b(?:tender\s+notice|contract\s+award\s+notice|contract\s+details\s+notice|contract\s+performance\s+notice|payments\s+compliance\s+notice)\b/i.test(input))
                return true;
            if (/\b(?:central\s+digital\s+platform|cdp\s+publication|find\s+a\s+tender)\b/i.test(input))
                return true;
            return false;
        },
    },
    EXCLUSION_DEBARMENT_RECORD: {
        references: [
            'Procurement Act 2023 Part 5 + Schedule 6 + Schedule 7; s.59 debarment list; s.62 national-security debarment',
        ],
        classifier: (input) => {
            if (/\b(?:mandatory\s+exclusion\s+ground|discretionary\s+exclusion\s+ground|exclusion\s+register)\b/i.test(input))
                return true;
            if (/\b(?:debarment\s+(?:list|notice|decision)|s\.?\s*59\s+debarment|national[\s-]?security\s+debarment|s\.?\s*62\s+procurement)\b/i.test(input))
                return true;
            return false;
        },
    },
    CONFLICTS_REGISTER: {
        references: [
            'Procurement Act 2023 Part 5 + Schedule 5 — conflicts of interest mitigation',
        ],
        classifier: (input) => {
            if (/\b(?:conflicts?\s+of\s+interest\s+(?:register|disclosure|mitigation\s+plan)|coi\s+register)\b/i.test(input))
                return true;
            if (/\b(?:material\s+interest\s+disclosure|procurement\s+conflict)\b/i.test(input))
                return true;
            return false;
        },
    },
    MAT_EVALUATION: {
        references: [
            'Procurement Act 2023 s.19 — Most Advantageous Tender (MAT)',
        ],
        classifier: (input) => {
            if (/\b(?:most\s+advantageous\s+tender|mat\s+(?:scoring|evaluation|criteria)|s\.?\s*19\s+procurement)\b/i.test(input))
                return true;
            if (/\b(?:social\s+value\s+(?:score|evaluation|tender)|environmental\s+factor\s+score)\b/i.test(input))
                return true;
            return false;
        },
    },
    CONTRACT_MODIFICATION: {
        references: [
            'Procurement Act 2023 s.74 — modifications',
        ],
        classifier: (input) => {
            if (/\b(?:contract\s+modification\s+(?:notice|rationale|register)|s\.?\s*74\s+modification|in[\s-]?life\s+change\s+procurement)\b/i.test(input))
                return true;
            return false;
        },
    },
    DIRECT_AWARD_RATIONALE: {
        references: [
            'Procurement Act 2023 Schedule 5 — direct award grounds',
        ],
        classifier: (input) => {
            if (/\b(?:direct\s+award\s+(?:rationale|justification|notice)|schedule\s+5\s+direct\s+award)\b/i.test(input))
                return true;
            return false;
        },
    },
    AI_LINEAGE_DISCLOSURE: {
        references: [
            'Procurement Act 2023 + DSIT public-sector AI procurement guidance — AI lineage and data-residency disclosure',
        ],
        classifier: (input) => {
            if (/\b(?:ai\s+model\s+(?:lineage|provenance|origin)|model\s+card\s+procurement|data\s+residency\s+disclosure)\b/i.test(input))
                return true;
            if (/\b(?:foreign[\s-]?state\s+(?:ownership|involvement)\s+disclosure|fsi\s+disclosure\s+procurement)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety; procurement evidence artefacts must not embed credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const UK_PROCUREMENT_PACK = {
    categoryClassifiers: UK_PROCUREMENT_CATEGORY_CLASSIFIERS,
    id: 'uk-procurement-act',
    aliases: [
        'procurement-act',
        'procurement-act-2023',
        'uk-procurement-act-2023',
        'pa-2023',
        'procurement-review-unit',
        'pru',
    ],
    name: 'UK Procurement Act 2023',
    version: '1.0.0',
    description: 'Procurement Act 2023 (in force 24 Feb 2025). Replaces the pre-Brexit procurement regulations (PCR2015, UCR2016, CCR2016, DSPCR2011) for England, Wales, and Northern Ireland. Notice regime (Part 4) + exclusions and debarment incl. national-security ground (Part 5) + conflicts register (Schedule 5) + Most Advantageous Tender (s.19) replacing MEAT + Central Digital Platform transparency (Part 8) + 30-day payment terms (s.68) + modifications gate (s.74). AI-specific overlays: foreign-state involvement disclosure, model lineage + provenance, data-residency disclosure. Pairs with `uk-ai-framework` (DSIT public-sector AI guidance) + `cyber-essentials` + `ncsc-caf`. Scotland uses Procurement Reform (Scotland) Act 2014 — separate pack.',
    authority: 'Cabinet Office (Procurement Review Unit / PRU) + Procurement Service Centre + sector contracting authorities + National Audit Office',
    industries: ['public-sector', 'defense', 'technology', 'professional-services', 'critical-national-infrastructure'],
    requiredModules: [
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Notice publication tracking (tender / contract award / contract details / contract performance / payments compliance); CDP publication evidence; debarment-list cross-check on supplier onboarding; conflicts-of-interest register; foreign-state involvement disclosure; AI model-lineage attestation.',
            reference: 'Procurement Act 2023 Parts 4, 5, 8',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Default-deny on contract award where (a) supplier is on the debarment list, (b) mandatory exclusion ground met, (c) MAT evaluation incomplete, (d) AI-lineage disclosure absent for AI-supplied components.',
            reference: 'Procurement Act 2023 Schedule 6 mandatory exclusion grounds',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Direct-award rationale (Schedule 5) requires senior approval + published rationale; conflicts-mitigation plan approval; modification notices (s.74) reviewed; national-security exclusion (s.62) escalated to Cabinet Office.',
            reference: 'Procurement Act 2023 Schedule 5; s.62 national-security exclusion',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain for tender evaluations, MAT scoring, exclusion decisions, conflict declarations, contract modifications, payment compliance — required for PRU investigation (s.93) + NAO audit + standstill challenge.',
            reference: 'Procurement Act 2023 s.93 PRU investigation; NAO audit powers',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'CDP publication routing per notice type; payment-deadline tracking (30-day rule s.68); supplier-debarment subscription (alerts on supplier suddenly on debarment list).',
            reference: 'Procurement Act 2023 s.68 payment terms; s.59 debarment',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Surface procurement-specific evidence categories for the audit chain and the dashboard.',
            reference: 'Procurement Act 2023 evidence categorisation',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Procurement evidence retained 6 years (Limitation Act 1980 + standard Cabinet Office retention) + contract performance retained for the contract life + 6 years.',
            reference: 'Limitation Act 1980; Cabinet Office procurement retention practice',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Sub-contractor flow-down of payment terms (s.68 30-day rule), debarment status, conflicts disclosure, AI-lineage disclosure cascade.',
            reference: 'Procurement Act 2023 s.68 payment flow-down; sub-contractor accountability',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'CDP publication of award decisions + contract details + modifications; supplier-facing notice publication; standstill-period communication.',
            reference: 'Procurement Act 2023 Part 8',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Conflicts-of-interest disclosure binds to staff identity; named contracting officer accountability for award decisions.',
            reference: 'Procurement Act 2023 Schedule 5 conflicts; contracting officer accountability',
        },
    ],
    moduleConfig: {
        'attestation-manager': {
            noticePublicationTracked: true,
            cdpPublicationEvidenceRequired: true,
            debarmentListCrossCheckRequired: true,
            conflictsOfInterestRegisterRequired: true,
            foreignStateInvolvementDisclosureRequired: true,
            aiModelLineageAttestationRequired: true,
            paymentsComplianceNoticeAnnual: true,
        },
        'governance-runtime': {
            defaultDenyOnDebarredSupplier: true,
            mandatoryExclusionGroundGateRequired: true,
            matEvaluationCompleteGateRequired: true,
            aiLineageDisclosureGateRequired: true,
        },
        'approval-queue': {
            directAwardRationaleApprovalRequired: true,
            conflictMitigationApprovalRequired: true,
            modificationApprovalRequired: true,
            nationalSecurityExclusionEscalationRequired: true,
            reviewTier: 'T2',
        },
        'audit-integrity': {
            pruInvestigationEvidenceTrackingRequired: true,
            naoAuditEvidenceTrackingRequired: true,
        },
        'event-bus': {
            cdpPublicationRoutingRequired: true,
            paymentDeadlineDays: 30,
            supplierDebarmentSubscriptionRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'PROCUREMENT_NOTICE',
                'EXCLUSION_DEBARMENT_RECORD',
                'CONFLICTS_REGISTER',
                'MAT_EVALUATION',
                'CONTRACT_MODIFICATION',
                'DIRECT_AWARD_RATIONALE',
                'AI_LINEAGE_DISCLOSURE',
                'CREDENTIALS',
            ],
            credentialsAction: 'BLOCK',
        },
        'session-persistence': {
            retentionDaysMinimum: 2190, // 6 years post-contract-end
        },
        'supply-chain': {
            subContractorFlowDownRequired: true,
            paymentFlowDownDays: 30,
            aiLineageCascadeRequired: true,
        },
        'transparency-injector': {
            cdpPublicationRequired: true,
            standstillCommunicationRequired: true,
        },
        'agent-auth': {
            conflictDisclosureIdentityBindingRequired: true,
            contractingOfficerAccountabilityRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK', 'PROCESSOR-CONTRACT', 'FOREIGN-STATE-DISCLOSURE-COMPATIBLE'],
        blockReasons: {
            deepseek: 'PRC jurisdiction. Procurement Act 2023 s.62 national-security exclusion ground + foreign-state involvement disclosure framework typically excludes PRC routing for UK public-sector AI procurement.',
            baidu: 'PRC jurisdiction. Procurement Act 2023 national-security exclusion ground applies.',
            alibaba: 'PRC jurisdiction. Procurement Act 2023 national-security exclusion ground applies.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'PROCUREMENT_NOTICE',
            'EXCLUSION_DEBARMENT_RECORD',
            'CONFLICTS_REGISTER',
            'MAT_EVALUATION',
            'CONTRACT_MODIFICATION',
            'DIRECT_AWARD_RATIONALE',
            'AI_LINEAGE_DISCLOSURE',
            'CREDENTIALS',
        ],
        categoryActions: {
            PROCUREMENT_NOTICE: 'WARN',
            EXCLUSION_DEBARMENT_RECORD: 'WARN',
            CONFLICTS_REGISTER: 'WARN',
            MAT_EVALUATION: 'WARN',
            CONTRACT_MODIFICATION: 'WARN',
            DIRECT_AWARD_RATIONALE: 'WARN',
            AI_LINEAGE_DISCLOSURE: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        auditLogRetentionDays: 2190, // 6 years
        sessionRetentionDays: 2190,
        incidentRetentionDays: 2190,
        reference: 'Limitation Act 1980 6-year claim window; Cabinet Office procurement retention practice',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb'],
    },
    incidentPolicy: {
        notificationDeadlineHours: 168, // 7 days for internal escalation; PRU notice timing varies
        reference: 'Procurement Act 2023 s.93 PRU investigation; NAO audit cooperation',
        requiredRecipients: ['cabinet-office-pru', 'contracting-authority-sponsor', 'legal-counsel', 'data-protection-officer'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'uk-procurement-notice-regime',
            description: 'All required notices (tender, award, contract details, contract performance, payments compliance) published on the Central Digital Platform within statutory timelines.',
            reference: 'Procurement Act 2023 Part 4 + Part 8',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-procurement-debarment-cross-check',
            description: 'Supplier debarment-list cross-check active on award + at supplier-renewal events; mandatory + discretionary exclusion grounds gate triggered.',
            reference: 'Procurement Act 2023 s.59; Schedules 6 and 7',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-procurement-mat-evaluation',
            description: 'Most Advantageous Tender evaluation complete with social-value + environmental factors documented; MAT scoring rationale tamper-evident.',
            reference: 'Procurement Act 2023 s.19',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-procurement-conflicts-register',
            description: 'Conflicts-of-interest register active for staff with material interest; mitigation plan attested per Schedule 5.',
            reference: 'Procurement Act 2023 Schedule 5',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-procurement-30-day-payment',
            description: '30-day payment terms enforced (s.68); flow-down to sub-contractors recorded; payments compliance notice annual.',
            reference: 'Procurement Act 2023 s.68',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-procurement-direct-award-rationale',
            description: 'Direct-award rationale documented and published per Schedule 5; senior-level approval captured.',
            reference: 'Procurement Act 2023 Schedule 5',
            check: 'approval_queue_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-procurement-modification-notice',
            description: 'Contract modifications (s.74) reviewed and notices published; in-life change rationale captured.',
            reference: 'Procurement Act 2023 s.74',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-procurement-ai-lineage-disclosure',
            description: 'AI products supplied include model lineage + provenance + data-residency disclosure; foreign-state involvement disclosure captured.',
            reference: 'Procurement Act 2023 + DSIT public-sector AI procurement guidance',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-procurement-evidence-retention',
            description: 'Procurement evidence retained 6 years post-contract; legal-hold support active for live PRU / NAO investigations.',
            reference: 'Limitation Act 1980; Cabinet Office retention practice',
            check: 'retention_policy_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-procurement-credential-block',
            description: 'Plaintext credentials blocked from procurement evidence artefacts and audit chain entries.',
            reference: 'Procurement Act 2023 evidence integrity',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=uk-procurement-act.js.map