/**
 * AU Spam Act 2003 — Commercial Electronic Messaging
 *
 * Primary statute: Spam Act 2003 (Cth). Spam (E-marketing) Code 2021
 * (registered code). Telecommunications (Telemarketing and Research Calls)
 * Industry Standard 2017 (SMS/voice overlap).
 *
 * What is covered: Commercial electronic messages (CEMs) — email, SMS, instant
 * message, or similar with an Australian link (originates in AU, sent to AU
 * address, or sender is AU entity) that have a commercial purpose.
 *
 * AI relevance: AI systems that generate, personalise, schedule, or send CEMs
 * are directly subject. Three core rules: consent before sending; accurate
 * sender identification; functional unsubscribe.
 *
 * Key AI obligations:
 *   - Schedule 2 Consent: Express or inferred consent per recipient. AI must
 *     not send to contacts without verified consent. AI-generated marketing
 *     lists need verified consent status per recipient.
 *   - Schedule 1 Sender ID: Every CEM must identify the actual entity — AI
 *     persona name alone is insufficient.
 *   - Schedule 3 Unsubscribe: Functional unsubscribe in every CEM; requests
 *     honoured within 5 business days.
 *   - s.20-22 No Harvesting: Address harvesting and use of harvested lists
 *     prohibited. AI scraping for marketing lists captured.
 *   - Penalty: AUD 2.22 million per day per contravention for body corporates.
 *
 * Note: Political/government messages have specific exemptions (citation to
 * verify post-2024 review scope — verify any scope changes with ACMA).
 *
 * Cross-pack interactions:
 *   - au-spam-act + au-privacy-act: Consent records are personal info under
 *     Privacy Act; APP 11 security + APP 12/13 access apply. Marketing consent
 *     and privacy consent records may be co-managed but are distinct.
 *   - au-spam-act + gdpr: GDPR consent (Art. 6+7) more prescriptive than AU.
 *     Strictest-wins: GDPR governs for EU recipients; AU Spam Act for AU
 *     recipients; GDPR higher standard governs overlap.
 *   - au-spam-act + au-cdr: CDR Privacy Safeguard PS 7 marketing prohibition
 *     operates alongside Spam Act consent. Both apply independently to CDR-
 *     derived marketing.
 *
 * Authority: Australian Communications and Media Authority (ACMA)
 * Sovereignty: Australian Federal
 *
 * @connexum/ai-governance
 */
export const AU_SPAM_ACT_CATEGORY_CLASSIFIERS = {
    AU_CEM_RECIPIENT: {
        references: ['Spam Act 2003 s.6 — commercial electronic message definition; Australian link'],
        classifier: (input) => {
            if (/\b(?:cem\s+recipient|commercial\s+electronic\s+(?:message|messaging|mail)|spam\s+act\s+(?:recipient|contact|list))/i.test(input))
                return true;
            return false;
        },
    },
    AU_CEM_CONSENT_STATUS: {
        references: ['Spam Act 2003 Schedule 2 — consent requirement for CEM send'],
        classifier: (input) => {
            // Absent consent detected
            if (/\b(?:no\s+consent.*(?:cem|marketing\s+email|sms)|consent\s+(?:absent|missing|not\s+verified).*(?:send|email|sms|cem)|unverified\s+consent.*(?:campaign|outbound|message))/i.test(input))
                return true;
            return false;
        },
    },
    AU_CEM_UNSUBSCRIBED: {
        references: ['Spam Act 2003 Schedule 3 — unsubscribe must be honoured within 5 BD'],
        classifier: (input) => {
            if (/\b(?:unsubscrib(?:ed|e\s+request)|opt[_\-\s]?out.*(?:email|sms|cem|contact)|email.*(?:unsubscribe|opted\s+out)|do\s+not\s+(?:email|contact|send))/i.test(input))
                return true;
            return false;
        },
    },
    AU_CEM_HARVESTED_ADDRESS: {
        references: ['Spam Act 2003 s.20-22 — address harvesting prohibition'],
        classifier: (input) => {
            if (/\b(?:harvested\s+(?:address|email\s+list|contact\s+list)|web\s+scraping.*(?:email|contact)|scraped\s+(?:email|address).*(?:campaign|list|marketing))/i.test(input))
                return true;
            return false;
        },
    },
    AU_CEM_SENDER_ID: {
        references: ['Spam Act 2003 Schedule 1 — accurate sender identification in every CEM'],
        classifier: (input) => {
            if (/\b(?:sender\s+(?:identification|identity|id).*(?:cem|email|sms)|from\s+(?:field|address).*(?:missing|absent|ai\s+persona\s+only))/i.test(input))
                return true;
            return false;
        },
    },
};
export const AU_SPAM_ACT_PACK = {
    categoryClassifiers: AU_SPAM_ACT_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: CEM recipients, consent status, and unsubscribe status are
     * subject-keyed by recipient address. Each send-audit event carries the
     * recipient identifier and consent basis to satisfy 3-year retention
     * and ACMA investigation readiness. Sender-ID check is non-subject-keyed
     * (template-level).
     */
    subjectKeyedCategories: [
        'AU_CEM_RECIPIENT',
        'AU_CEM_CONSENT_STATUS',
        'AU_CEM_UNSUBSCRIBED',
        'AU_CEM_HARVESTED_ADDRESS',
    ],
    id: 'au-spam-act',
    name: 'AU Spam Act 2003 — Commercial Electronic Messaging',
    version: '1.0.0',
    contentHash: 'c743360a64f6d5fdaa1acb2327d1d179442d1605173c39e70f50851d48cf4a3a',
    description: 'Spam Act 2003 (Cth) compliance for AI systems generating, personalising, or sending commercial electronic messages to Australian recipients. Enforces consent gate (Schedule 2), unsubscribe block and 5-business-day processing SLA (Schedule 3), harvested-address prohibition (s.20-22), and sender identification check (Schedule 1). Penalty: AUD 2.22M per day per contravention for body corporates.',
    authority: 'Australian Communications and Media Authority (ACMA)',
    industries: [
        'all-au', 'marketing', 'fintech', 'edtech',
        'retail', 'saas', 'media', 'healthcare',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Consent gate before each CEM send; unsubscribe block; harvested-list block; 5-BD unsubscribe processing SLA',
            reference: 'Spam Act 2003 Schedule 2 (consent); Schedule 3 (unsubscribe); s.20-22 (harvesting)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: '3-year retention for consent records, unsubscribe records, CEM send logs',
            reference: 'ACMA investigation readiness; Spam Act enforceable undertaking framework',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect CEM recipients, absent consent, unsubscribed contacts, harvested addresses, sender-ID issues',
            reference: 'Spam Act 2003 Schedule 1-3; s.20-22',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Consent status per recipient; unsubscribe status; 5-BD processing countdown',
            reference: 'Spam Act 2003 Schedule 2 (consent); Schedule 3 (5 BD)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Consent-absent event stream; unsubscribe-received events; harvested-list detection events',
            reference: 'Spam Act 2003',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'AU_CEM_RECIPIENT',
                'AU_CEM_CONSENT_STATUS',
                'AU_CEM_UNSUBSCRIBED',
                'AU_CEM_HARVESTED_ADDRESS',
                'AU_CEM_SENDER_ID',
            ],
            cemConsentGateEnabled: true,
            unsubscribeBlockEnabled: true,
            harvestedAddressBlockEnabled: true,
            unsubscribeSlaBusinessDays: 5,
            senderIdCheckEnabled: true,
            cemConsentLoggingActive: true,
        },
        'governance-runtime': {
            cemConsentGateEnabled: true,
            unsubscribeBlockEnabled: true,
            harvestedAddressBlockEnabled: true,
            unsubscribeSlaBusinessDays: 5,
            senderIdCheckEnabled: true,
            cemConsentLoggingActive: true,
            //
            // DUAL-JURISDICTION CONSENT OVERRIDE (F-NEW-VERA-PACK-C6-01, 2026-05-03):
            // When AI sends CEMs to mixed AU/EU recipient lists the AU Spam Act consent
            // standard (express or inferred consent per Schedule 2) may be LESS
            // prescriptive than GDPR Art. 7 explicit consent for EU data subjects.
            //
            // gdprConsentRequiredOverride: false (default)
            //   -- AU Spam Act Schedule 2 consent standard applies.
            //
            // gdprConsentRequiredOverride: true
            //   -- Consent gate switches to GDPR Art. 7 explicit consent standard for
            //      all recipients where recipientJurisdiction === 'EU' is present in
            //      the send-event metadata, OR where the gdpr pack is co-active in
            //      the pack binding. Strictest-wins: GDPR Art. 7 governs for EU
            //      recipients; AU Schedule 2 governs for AU-only recipients.
            //
            // Implementation note: the runtime behaviour switch (recipientJurisdiction
            // routing + GDPR Art. 7 consent re-check) is a future slice. This flag
            // scaffolds the config contract so operators can declare intent now and
            // the runtime can honour it once the dual-jurisdiction consent gate is
            // built. See cross-pack interactions in the pack header comment.
            //
            gdprConsentRequiredOverride: false,
        },
        'session-persistence': {
            consentStatusPerRecipientRequired: true,
            unsubscribeSlaTrackingRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'CONSENT-VERIFICATION-BEFORE-SEND',
            'UNSUBSCRIBE-5BD-SLA',
            'NO-HARVESTED-LIST-USE',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'AU_CEM_RECIPIENT',
            'AU_CEM_CONSENT_STATUS',
            'AU_CEM_UNSUBSCRIBED',
            'AU_CEM_HARVESTED_ADDRESS',
            'AU_CEM_SENDER_ID',
        ],
        categoryActions: {
            AU_CEM_RECIPIENT: 'LOG',
            AU_CEM_CONSENT_STATUS: 'BLOCK',
            AU_CEM_UNSUBSCRIBED: 'BLOCK',
            AU_CEM_HARVESTED_ADDRESS: 'BLOCK',
            AU_CEM_SENDER_ID: 'WARN',
        },
        encryptionRequired: false,
        encryptionStandard: 'AES-256',
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        sovereignty: ['AU'],
        auditLogRetentionDays: 1095, // 3 years (consent + unsubscribe + send logs)
        sessionRetentionDays: 1095,
        incidentRetentionDays: 1095,
        reference: 'ACMA Spam Act guidance: consent records 3y; unsubscribe records 3y; CEM send logs 3y',
    },
    incidentPolicy: {
        notificationDeadlineHours: 0, // No mandatory breach notification; ACMA investigation-based
        reference: 'Spam Act 2003 — no mandatory breach notification; ACMA enforcement is investigation-based; voluntary disclosure available',
        requiredRecipients: [],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'au-spam-act-consent-gate',
            description: 'CEM send blocked without verified recipient consent',
            reference: 'Spam Act 2003 Schedule 2',
            check: 'au_spam_act_consent_gate_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-spam-act-unsubscribe-block',
            description: 'CEM send blocked to recipients who have submitted unsubscribe requests',
            reference: 'Spam Act 2003 Schedule 3',
            check: 'au_spam_act_unsubscribe_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-spam-act-harvested-block',
            description: 'Use of harvested address lists blocked',
            reference: 'Spam Act 2003 s.20-22',
            check: 'au_spam_act_harvested_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-spam-act-unsubscribe-5bd',
            description: 'Unsubscribe requests processed within 5 business days',
            reference: 'Spam Act 2003 Schedule 3',
            check: 'au_spam_act_unsubscribe_5bd_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-spam-act-sender-id-check',
            description: 'Sender identification field present and accurate in every outbound CEM template',
            reference: 'Spam Act 2003 Schedule 1',
            check: 'au_spam_act_sender_id_check_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-spam-act-consent-logging',
            description: 'Consent basis logged per CEM send event with recipient identifier',
            reference: 'ACMA Spam Act guidance',
            check: 'au_spam_act_consent_logging_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=au-spam-act.js.map