"use strict";
/**
 * Scotland Specific Duties (PSED Scotland) Compliance Pack
 *
 * Statute: Equality Act 2010 (Specific Duties) (Scotland) Regulations
 *   2012 (SSI 2012/162) + amendments. Layered on top of the GB
 *   Equality Act 2010 PSED (s.149) which DOES apply in Scotland —
 *   Scotland adds the "specific duties" Scottish ministers can require
 *   under s.153 of the Act.
 *
 * Jurisdiction: Scotland
 * Authority:
 *   - Scottish Government (specific-duty regulations + ministerial
 *     guidance)
 *   - Equality and Human Rights Commission (EHRC) — UK-wide regulator
 *     including Scotland
 *   - Audit Scotland — public-body audit
 *
 * Why this pack (separate from `uk-equality-act`):
 *   - GB Equality Act 2010 PSED applies UK-wide except NI; the Scottish
 *     Specific Duties layer adds DISTINCTIVE reporting + mainstreaming
 *     + equality-outcomes obligations not present in England.
 *   - The English Specific Duties Regulations 2011 are LIGHTER than the
 *     Scottish ones — Scotland requires more.
 *   - Scotland-deployed AI by public bodies (Scottish Government,
 *     NHS Scotland, councils, fire/police, integration joint boards)
 *     must satisfy this layer.
 *
 * Distinctive Scottish specific duties (SSI 2012/162):
 *   1. **Equality outcomes** (Reg 4) — every 4 years publish at least one
 *      equality outcome that the body considers will result in furthering
 *      the equality needs in s.149(1)
 *   2. **Mainstreaming reports** (Reg 3) — every 2 years publish a
 *      "mainstreaming report" describing how equality is mainstreamed
 *      across the body's functions
 *   3. **Pay gap reporting** (Reg 6A as amended) — gender pay gap
 *      reporting; Scottish-specific bands and methodology
 *   4. **Equal pay statement** (Reg 6) — every 4 years publish an
 *      equal pay statement and occupational segregation analysis
 *   5. **Procurement award criteria** (Reg 9) — equality criteria in
 *      procurement (distinct from the GB Procurement Act 2023 layer
 *      and from English equivalent — Scotland imposes more)
 *   6. **Employee information collection** (Reg 6B) — collect
 *      protected-characteristic information from employees
 *
 * AI-specific overlays:
 *   - Equality outcomes mapped to AI deployments (which deployment
 *     contributes to which outcome)
 *   - Mainstreaming evidence: AI fairness monitoring captured as
 *     mainstreaming evidence
 *   - Procurement criteria: AI supplier selection scored against
 *     equality criteria per Reg 9
 *
 * Out of scope:
 *   - GB Equality Act 2010 PSED (covered by `uk-equality-act` pack —
 *     this pack STACKS on top of that pack)
 *   - English Specific Duties Regulations 2011 (different jurisdiction)
 *   - NI Equality (separate pack: `ni-equality`)
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.SCOTLAND_PSED_PACK = exports.SCOTLAND_PSED_CATEGORY_CLASSIFIERS = void 0;
exports.SCOTLAND_PSED_CATEGORY_CLASSIFIERS = {
    EQUALITY_OUTCOME: {
        references: [
            'SSI 2012/162 Reg 4 — equality outcomes',
        ],
        classifier: (input) => {
            if (/\b(?:equality\s+outcome\s+(?:scotland|psed|reg\s+4)|scottish\s+specific\s+duties\s+outcome)\b/i.test(input))
                return true;
            return false;
        },
    },
    MAINSTREAMING_REPORT: {
        references: [
            'SSI 2012/162 Reg 3 — mainstreaming report',
        ],
        classifier: (input) => {
            if (/\b(?:mainstreaming\s+report\s+(?:scotland|psed|equality)|equality\s+mainstreaming\s+(?:report|biennial))\b/i.test(input))
                return true;
            return false;
        },
    },
    PAY_GAP_REPORT: {
        references: [
            'SSI 2012/162 Reg 6A — pay gap reporting',
        ],
        classifier: (input) => {
            if (/\b(?:pay\s+gap\s+(?:report|reporting)\s+(?:scotland|psed|reg\s+6a)|scottish\s+gender\s+pay\s+gap\s+report)\b/i.test(input))
                return true;
            if (/\b(?:occupational\s+segregation\s+analysis|equal\s+pay\s+statement\s+(?:scotland|reg\s+6))\b/i.test(input))
                return true;
            return false;
        },
    },
    PROCUREMENT_EQUALITY_CRITERIA: {
        references: [
            'SSI 2012/162 Reg 9 — procurement award equality criteria',
        ],
        classifier: (input) => {
            if (/\b(?:procurement\s+equality\s+criteria\s+(?:scotland|psed|reg\s+9)|scottish\s+procurement\s+equality)\b/i.test(input))
                return true;
            return false;
        },
    },
    EMPLOYEE_PROTECTED_CHAR_DATA: {
        references: [
            'SSI 2012/162 Reg 6B — employee protected-characteristic information',
        ],
        classifier: (input) => {
            if (/\b(?:employee\s+(?:protected\s+characteristic|equality\s+monitoring)\s+(?:scotland|psed|reg\s+6b))\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety; Scotland PSED artefacts must not embed credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.SCOTLAND_PSED_PACK = {
    categoryClassifiers: exports.SCOTLAND_PSED_CATEGORY_CLASSIFIERS,
    id: 'scotland-psed',
    aliases: [
        'scotland-specific-duties',
        'psed-scotland',
        'ssi-2012-162',
        'scottish-equality-specific-duties',
    ],
    name: 'Scotland Specific Duties (PSED Scotland — SSI 2012/162)',
    version: '1.0.0',
    contentHash: 'd5ac2244c47af28a09ce2101d09aa8421ce082242eb826c49801d65752b0b1c5',
    description: 'Scottish Specific Duties Regulations 2012 (SSI 2012/162) layered on top of the GB Equality Act 2010 PSED. Scotland-distinctive obligations: equality outcomes (every 4 years), mainstreaming reports (every 2 years), pay gap reporting, equal pay statement + occupational segregation analysis, procurement award equality criteria (Reg 9), employee protected-characteristic data collection. Stacks alongside `uk-equality-act` (which covers the underlying GB Equality Act 2010); this pack adds the Scotland-specific layer that English Specific Duties Regulations 2011 do not impose.',
    authority: 'Scottish Government + Equality and Human Rights Commission (EHRC) + Audit Scotland',
    industries: ['public-sector', 'healthcare', 'social-care', 'education', 'fire-rescue', 'police', 'transport', 'environment'],
    requiredModules: [
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Equality outcomes (Reg 4 — 4-yearly), mainstreaming reports (Reg 3 — 2-yearly), pay gap reports (Reg 6A), equal pay statements (Reg 6 — 4-yearly), procurement equality criteria (Reg 9), employee protected-characteristic data collection (Reg 6B) all tracked.',
            reference: 'SSI 2012/162 Regs 3, 4, 6, 6A, 6B, 9',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Default-deny on public-body AI deployments touching equality-outcome scope without mapping to a published equality outcome; procurement-criteria gate on AI supplier selection (Reg 9).',
            reference: 'SSI 2012/162 Regs 4, 9',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain for equality-outcome publications, mainstreaming-report revisions, pay-gap reports, procurement-criteria scoring — required for Audit Scotland public-body audit.',
            reference: 'SSI 2012/162 evidence integrity',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Surface Scotland PSED evidence categories (equality outcome, mainstreaming, pay gap, procurement criteria, employee data) for the audit chain and the dashboard.',
            reference: 'SSI 2012/162 evidence categorisation',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Statutory publication: equality outcomes + mainstreaming reports + pay-gap reports must be published on public-body website; consultation evidence captured.',
            reference: 'SSI 2012/162 publication requirements',
        },
        {
            name: 'event-bus',
            required: true,
            reason: '4-year equality outcome cycle reminders; 2-year mainstreaming-report cycle reminders; pay-gap reporting deadlines; procurement-criteria scoring events.',
            reference: 'SSI 2012/162 reporting cadences',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: '6-year retention (Limitation Act default) for equality evidence; legal-hold support for live tribunal claims.',
            reference: 'SSI 2012/162 + Limitation Act 1980',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Procurement-equality criteria flow-down to sub-suppliers (Reg 9); sub-supplier equality posture captured.',
            reference: 'SSI 2012/162 Reg 9',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: 'AI fairness monitoring captured as mainstreaming evidence; equality-outcome contribution measured per AI deployment.',
            reference: 'SSI 2012/162 mainstreaming + outcomes evidence',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Reg 6B employee protected-characteristic data heightened access controls; named equality officer for monitoring data access.',
            reference: 'SSI 2012/162 Reg 6B',
        },
    ],
    moduleConfig: {
        'attestation-manager': {
            equalityOutcomesPublishedRequired: true,
            mainstreamingReportPublishedRequired: true,
            payGapReportPublishedRequired: true,
            equalPayStatementPublishedRequired: true,
            procurementEqualityCriteriaTracked: true,
            employeeProtectedCharDataRecorded: true,
        },
        'governance-runtime': {
            equalityOutcomeMappingGateRequired: true,
            procurementCriteriaGateRequired: true,
        },
        'audit-integrity': {
            auditScotlandEvidenceTrackingRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'EQUALITY_OUTCOME',
                'MAINSTREAMING_REPORT',
                'PAY_GAP_REPORT',
                'PROCUREMENT_EQUALITY_CRITERIA',
                'EMPLOYEE_PROTECTED_CHAR_DATA',
                'CREDENTIALS',
            ],
            credentialsAction: 'BLOCK',
        },
        'transparency-injector': {
            statutoryPublicationRequired: true,
        },
        'event-bus': {
            cycleReminderRequired: true,
        },
        'session-persistence': {
            retentionDaysMinimum: 2190, // 6 years
        },
        'supply-chain': {
            procurementEqualityFlowDownRequired: true,
        },
        'bias-monitor': {
            mainstreamingEvidenceCaptureRequired: true,
            outcomeContributionMeasurementRequired: true,
        },
        'agent-auth': {
            reg6bDataAccessControlsRequired: true,
            namedEqualityOfficerRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK-OR-EU', 'PROCESSOR-CONTRACT', 'SCOTLAND-PSED-COMPATIBLE'],
        blockReasons: {
            deepseek: 'PRC jurisdiction. Scotland PSED procurement criteria (Reg 9) and Audit Scotland evidence chain exclude PRC routing.',
            baidu: 'PRC jurisdiction. Inadequate evidence chain for Audit Scotland.',
            alibaba: 'PRC jurisdiction. Inadequate evidence chain for Audit Scotland.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'EQUALITY_OUTCOME',
            'MAINSTREAMING_REPORT',
            'PAY_GAP_REPORT',
            'PROCUREMENT_EQUALITY_CRITERIA',
            'EMPLOYEE_PROTECTED_CHAR_DATA',
            'CREDENTIALS',
        ],
        categoryActions: {
            EQUALITY_OUTCOME: 'WARN',
            MAINSTREAMING_REPORT: 'WARN',
            PAY_GAP_REPORT: 'WARN',
            PROCUREMENT_EQUALITY_CRITERIA: 'WARN',
            EMPLOYEE_PROTECTED_CHAR_DATA: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        auditLogRetentionDays: 2190, // 6 years
        sessionRetentionDays: 2190,
        incidentRetentionDays: 2190,
        reference: 'SSI 2012/162 + Limitation Act 1980',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb-sct', 'gb', 'eu'],
    },
    incidentPolicy: {
        notificationDeadlineHours: 168, // 7 days for internal escalation
        reference: 'EHRC investigation cooperation; Audit Scotland audit cooperation',
        requiredRecipients: ['equality-officer', 'audit-scotland-sponsor', 'data-protection-officer', 'legal-counsel'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'scotland-psed-equality-outcomes',
            description: '4-yearly equality outcomes published on public-body website; AI deployments mapped to outcomes.',
            reference: 'SSI 2012/162 Reg 4',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'scotland-psed-mainstreaming-report',
            description: '2-yearly mainstreaming report published; AI fairness monitoring evidence captured.',
            reference: 'SSI 2012/162 Reg 3',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'scotland-psed-pay-gap-report',
            description: 'Pay gap report and equal pay statement published per Scottish-specific bands; occupational segregation analysis current.',
            reference: 'SSI 2012/162 Regs 6, 6A',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'scotland-psed-procurement-criteria',
            description: 'Procurement award equality criteria captured per Reg 9; sub-supplier flow-down recorded.',
            reference: 'SSI 2012/162 Reg 9',
            check: 'governance_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'scotland-psed-employee-data',
            description: 'Reg 6B employee protected-characteristic information collected with restricted-access controls; named equality officer.',
            reference: 'SSI 2012/162 Reg 6B',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'scotland-psed-mainstreaming-evidence',
            description: 'AI fairness monitoring captured as mainstreaming evidence; outcome contribution measured.',
            reference: 'SSI 2012/162 mainstreaming evidence',
            check: 'bias_monitor_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'scotland-psed-cycle-reminders',
            description: '4-year equality-outcome cycle and 2-year mainstreaming-report cycle reminders configured.',
            reference: 'SSI 2012/162 reporting cadences',
            check: 'monitoring_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'scotland-psed-evidence-audit-trail',
            description: 'Tamper-evident audit chain covers equality-outcome publications, mainstreaming-report revisions, pay-gap reports, procurement-criteria scoring.',
            reference: 'SSI 2012/162 evidence integrity',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'scotland-psed-supplier-flow-down',
            description: 'Procurement equality flow-down captured for sub-suppliers; sub-supplier equality posture recorded.',
            reference: 'SSI 2012/162 Reg 9',
            check: 'subservice_registry_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'scotland-psed-encryption',
            description: 'Reg 6B employee data encrypted at rest and in transit.',
            reference: 'SSI 2012/162 Reg 6B; UK GDPR Art. 32',
            check: 'encryption_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=scotland-psed.js.map