/**
 * UK Online Safety Act 2023 Compliance Pack
 *
 * Statute: Online Safety Act 2023 (c.50). Phased commencement; Ofcom is
 *   the regulator. Major regulator-published codes (Illegal Content
 *   Codes, Children's Safety Codes) entered enforcement in 2025.
 *
 * Jurisdiction: UK-wide (England, Wales, Scotland, Northern Ireland).
 * Authority: Ofcom (Office of Communications) — primary regulator.
 *
 * Why this pack:
 *   - The Online Safety Act is the UK's first comprehensive statute
 *     regulating user-generated content (UGC), search services, and
 *     pornography services online. Any AI-driven product that hosts,
 *     ranks, surfaces, recommends, generates, or moderates content for
 *     UK users may be in scope.
 *   - AI systems that generate or distribute content directly are
 *     captured (per Ofcom 2025 guidance updates) where the AI output is
 *     accessed by UK users. This includes generative AI assistants
 *     surfaced through user-facing apps.
 *   - Pairs with: `uk-equality-act` (anti-discrimination overlap),
 *     `uk-gdpr` (personal-data overlay), `uk-ai-framework` (DSIT
 *     fairness + transparency principles).
 *
 * Service categorisation (s.3 + Schedule 11):
 *   - Category 1: largest user-to-user services with high reach
 *   - Category 2A: largest search services
 *   - Category 2B: services targeting children at risk
 *   - Other regulated user-to-user / search / pornography services
 *
 * Key duties (varies by category):
 *   - Illegal content duties (Part 3, Chapter 2): risk-assess illegal
 *     content; prevent users encountering CSEA, terrorism, fraud, hate,
 *     and other priority offences; remove and report
 *   - Children's safety duties (Part 3, Chapter 3): risk-assess for
 *     children; protect children from primary priority content
 *     (pornography, suicide / self-harm / eating disorder content);
 *     prevent encountering priority content; age-assurance where
 *     children likely to access
 *   - User empowerment (s.14, Cat 1): adults able to filter abusive /
 *     hate / suicide / self-harm content; verified-user filtering
 *   - Transparency reporting (s.77, Cat 1, 2A): annual reports to Ofcom
 *   - Fraudulent advertising (s.38–s.40): Cat 1 + 2A
 *   - User reporting + complaints (Part 3, all in scope)
 *   - Senior manager accountability (s.103): named person responsible
 *     for compliance
 *
 * Penalties:
 *   - Up to 10% of qualifying worldwide revenue OR £18 million
 *     (whichever is greater)
 *   - Service-restriction orders + business-disruption measures
 *   - Senior-manager criminal liability (s.110, certain offences)
 *
 * Out of scope:
 *   - Northern Ireland separate online safety provisions (NI applies
 *     same Act; no separate pack)
 *   - General copyright / IP enforcement (separate regime)
 *   - General consumer protection (separate regime)
 *
 * @connexum/ai-governance
 */
export const UK_ONLINE_SAFETY_CATEGORY_CLASSIFIERS = {
    ILLEGAL_CONTENT_DECISION: {
        references: [
            'Online Safety Act 2023 Part 3 Chapter 2 — illegal content duties; priority illegal content list',
        ],
        classifier: (input) => {
            if (/\b(?:illegal\s+content\s+(?:risk\s+assessment|takedown|removal|report)|priority\s+illegal\s+(?:content|offence))\b/i.test(input))
                return true;
            if (/\b(?:csea|csam|child\s+sexual\s+(?:exploitation|abuse)|terrorism\s+content|fraud\s+content|hate\s+offence)\b/i.test(input))
                return true;
            if (/\b(?:nctf|national\s+counter\s+terrorism|secrec\s+counter\s+fraud)\b/i.test(input))
                return true;
            return false;
        },
    },
    CHILDRENS_SAFETY_RECORD: {
        references: [
            'Online Safety Act 2023 Part 3 Chapter 3 — children\'s safety duties; primary priority content',
        ],
        classifier: (input) => {
            if (/\b(?:children'?s\s+(?:safety|risk\s+assessment|access\s+assessment|access)\s+osa|primary\s+priority\s+content)\b/i.test(input))
                return true;
            if (/\b(?:age\s+(?:assurance|verification|estimation)\s+(?:osa|ofcom)|child\s+access\s+likely)\b/i.test(input))
                return true;
            if (/\b(?:suicide\s+content|self[\s-]?harm\s+content|eating\s+disorder\s+content)\b/i.test(input))
                return true;
            return false;
        },
    },
    USER_EMPOWERMENT_TOOL: {
        references: [
            'Online Safety Act 2023 s.14 — adult-user empowerment (Category 1)',
        ],
        classifier: (input) => {
            if (/\b(?:user\s+empowerment\s+(?:tool|filter|setting)|s\.?\s*14\s+osa|verified[\s-]?user\s+filter)\b/i.test(input))
                return true;
            if (/\b(?:abusive\s+content\s+filter|hate\s+content\s+filter|self[\s-]?harm\s+filter\s+osa)\b/i.test(input))
                return true;
            return false;
        },
    },
    TRANSPARENCY_REPORT: {
        references: [
            'Online Safety Act 2023 s.77 — transparency reporting (Cat 1, 2A)',
        ],
        classifier: (input) => {
            if (/\b(?:transparency\s+report\s+(?:ofcom|osa|s\.?\s*77)|annual\s+osa\s+report)\b/i.test(input))
                return true;
            return false;
        },
    },
    RISK_ASSESSMENT_RECORD: {
        references: [
            'Online Safety Act 2023 — illegal content risk assessment, children\'s risk assessment, children\'s access assessment',
        ],
        classifier: (input) => {
            if (/\b(?:illegal\s+content\s+risk\s+assessment|icra|children'?s\s+risk\s+assessment)\b/i.test(input))
                return true;
            if (/\b(?:children'?s\s+access\s+assessment|caa\s+osa)\b/i.test(input))
                return true;
            return false;
        },
    },
    USER_COMPLAINT: {
        references: [
            'Online Safety Act 2023 — user reporting and complaints duty',
        ],
        classifier: (input) => {
            if (/\b(?:user\s+(?:report|complaint)\s+(?:osa|online\s+safety)|content\s+complaint\s+ticket)\b/i.test(input))
                return true;
            if (/\b(?:appeal\s+against\s+(?:moderation|takedown)|takedown\s+appeal)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety; OSA evidence artefacts must not embed credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const UK_ONLINE_SAFETY_PACK = {
    categoryClassifiers: UK_ONLINE_SAFETY_CATEGORY_CLASSIFIERS,
    id: 'uk-online-safety-act',
    aliases: [
        'online-safety-act',
        'online-safety-act-2023',
        'osa',
        'ofcom-osa',
        'uk-osa',
    ],
    name: 'UK Online Safety Act 2023',
    version: '1.0.0',
    contentHash: 'a92b356991d5a34698e5d62dcff53c420ef5cf712f337e93a6c5442a20eb5251',
    description: 'UK\'s comprehensive statute regulating user-generated content (UGC), search services, and pornography services. Any AI-driven product hosting, ranking, surfacing, recommending, generating, or moderating content for UK users may be in scope. Service categorisation (Cat 1, 2A, 2B + other regulated). Illegal content + children\'s safety duties. User empowerment (s.14, Cat 1). Transparency reporting (s.77, Cat 1, 2A). Senior manager accountability (s.103). Penalties up to 10% of qualifying worldwide revenue or £18M (whichever greater); senior-manager criminal liability (s.110). Pairs with `uk-equality-act` (anti-discrimination overlap on moderation), `uk-gdpr` (personal-data overlay on age-assurance), `uk-ai-framework` (DSIT fairness + transparency).',
    authority: 'Ofcom (Office of Communications)',
    industries: ['technology', 'media', 'social-media', 'gaming', 'search', 'cloud-infrastructure', 'adult-content', 'public-sector'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Default-deny on AI generation / surfacing of priority illegal content (CSEA, terrorism, fraud, hate); illegal-content gate active before content is published or surfaced to users.',
            reference: 'OSA Part 3 Chapter 2 — illegal content duties',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect illegal content categories, primary priority content (children), risk-assessment artefacts, user-empowerment tool configurations, transparency reports, user complaints.',
            reference: 'OSA priority content lists; risk assessment evidence',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Service category designation (Cat 1, 2A, 2B, other) tracked; named senior manager (s.103) recorded; illegal-content + children\'s risk assessments registered; transparency-report cadence captured.',
            reference: 'OSA s.103 senior manager; s.77 transparency; risk assessment requirements',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'CSEA + terrorism content reporting routing (mandatory referral pathways); user-complaint detection + escalation; takedown-appeal workflow.',
            reference: 'OSA mandatory referral pathways; user reporting duty',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain for moderation decisions, takedown actions, age-assurance outcomes, risk-assessment revisions, transparency-report revisions, senior-manager sign-off events — required for Ofcom enforcement evidence.',
            reference: 'OSA evidentiary requirements; Ofcom information notices',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Senior manager (s.103) sign-off on risk assessments + transparency reports + material policy changes; T2 review on borderline-illegal content decisions where the AI moderator confidence is low.',
            reference: 'OSA s.103; s.110 senior-manager criminal liability',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Terms of service + content-policy publication; user-empowerment tool exposure + default settings; age-assurance prompts + alternative-access pathways; complaint-pathway visibility.',
            reference: 'OSA terms of service requirements; user empowerment s.14',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Moderation decisions + takedown records + risk-assessment revisions retained ≥6 years (Limitation Act 1980 default for civil claims; Ofcom information-notice power has no statutory limit).',
            reference: 'Limitation Act 1980; Ofcom information-notice retention practice',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Verified-user filtering (s.14) requires identity + verification chain; age-assurance integration; senior-manager named-role binding to access privileges.',
            reference: 'OSA s.14 verified-user empowerment; s.103 senior manager',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party content moderators / age-assurance providers / hosting providers attested; processor flow-down for OSA in-scope content.',
            reference: 'OSA Schedule 4 — content provider obligations',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            illegalContentGateRequired: true,
            defaultDenyOnPriorityIllegalContent: true,
            childrensPrimaryPriorityGateRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'ILLEGAL_CONTENT_DECISION',
                'CHILDRENS_SAFETY_RECORD',
                'USER_EMPOWERMENT_TOOL',
                'TRANSPARENCY_REPORT',
                'RISK_ASSESSMENT_RECORD',
                'USER_COMPLAINT',
                'CREDENTIALS',
            ],
            illegalContentAction: 'BLOCK',
            childrensSafetyAction: 'WARN',
            credentialsAction: 'BLOCK',
        },
        'attestation-manager': {
            serviceCategoryDesignationTracked: true,
            seniorManagerS103Tracked: true,
            illegalContentRiskAssessmentRequired: true,
            childrensRiskAssessmentRequired: true,
            childrensAccessAssessmentRequired: true,
            transparencyReportCadenceRequired: true,
        },
        'event-bus': {
            cseaReferralRoutingRequired: true,
            terrorismContentReferralRoutingRequired: true,
            userComplaintEscalationRequired: true,
            takedownAppealWorkflowRequired: true,
        },
        'audit-integrity': {
            moderationAuditTrailRequired: true,
            ofcomEvidenceTrackingRequired: true,
        },
        'approval-queue': {
            seniorManagerRiskAssessmentSignOffRequired: true,
            seniorManagerTransparencyReportSignOffRequired: true,
            borderlineIllegalContentReviewRequired: true,
            reviewTier: 'T2',
            reviewerCompetence: 'OSA_SENIOR_MANAGER',
        },
        'transparency-injector': {
            termsOfServicePublicationRequired: true,
            userEmpowermentToolsVisibleRequired: true,
            ageAssurancePromptsRequired: true,
            complaintPathwayVisibleRequired: true,
        },
        'session-persistence': {
            retentionDaysMinimum: 2190, // 6 years
        },
        'agent-auth': {
            verifiedUserSupportRequired: true,
            ageAssuranceIntegrationRequired: true,
        },
        'supply-chain': {
            moderatorFlowDownRequired: true,
            ageAssuranceProviderAttestationRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK-OR-EU', 'PROCESSOR-CONTRACT', 'OSA-EVIDENCE-EXPORT', 'CSEA-REFERRAL-COMPATIBLE'],
        blockReasons: {
            deepseek: 'PRC jurisdiction. OSA evidence chain (moderation decisions, CSEA referrals) cannot route through PRC; Ofcom information-notice powers expect UK-resident chain-of-custody.',
            baidu: 'PRC jurisdiction. Inadequate evidence chain for Ofcom enforcement.',
            alibaba: 'PRC jurisdiction. Inadequate evidence chain for Ofcom enforcement.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'ILLEGAL_CONTENT_DECISION',
            'CHILDRENS_SAFETY_RECORD',
            'USER_EMPOWERMENT_TOOL',
            'TRANSPARENCY_REPORT',
            'RISK_ASSESSMENT_RECORD',
            'USER_COMPLAINT',
            'CREDENTIALS',
        ],
        categoryActions: {
            ILLEGAL_CONTENT_DECISION: 'WARN',
            CHILDRENS_SAFETY_RECORD: 'WARN',
            USER_EMPOWERMENT_TOOL: 'WARN',
            TRANSPARENCY_REPORT: 'WARN',
            RISK_ASSESSMENT_RECORD: 'WARN',
            USER_COMPLAINT: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        auditLogRetentionDays: 2190, // 6 years
        sessionRetentionDays: 2190,
        incidentRetentionDays: 2190,
        reference: 'Limitation Act 1980 6-year claim window; Ofcom information-notice practical retention',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb', 'eu'],
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'OSA Ofcom information-notice + sectoral incident reporting; CSEA mandatory referral immediate; UK GDPR Art. 33 overlay where personal-data breach',
        requiredRecipients: ['ofcom', 'senior-manager-osa', 'data-protection-officer', 'csea-referral-body'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'uk-osa-service-category-designated',
            description: 'Service category (Cat 1 / 2A / 2B / other regulated) designated with Ofcom; designation correspondence captured.',
            reference: 'OSA s.3 + Schedule 11',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-osa-illegal-content-gate',
            description: 'Default-deny on AI-generated or AI-surfaced priority illegal content; CSEA / terrorism / fraud / hate filters active.',
            reference: 'OSA Part 3 Chapter 2',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-osa-childrens-risk-assessment',
            description: 'Children\'s access assessment + children\'s risk assessment current; primary priority content (pornography, suicide / self-harm / eating disorder) blocked or age-gated.',
            reference: 'OSA Part 3 Chapter 3',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-osa-user-empowerment',
            description: 'User-empowerment tools (s.14) exposed for adults on Category 1 services; verified-user filtering operative.',
            reference: 'OSA s.14',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-osa-transparency-reporting',
            description: 'Transparency report cadence active for Cat 1 + 2A services; Ofcom annual reporting deadlines tracked.',
            reference: 'OSA s.77',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-osa-senior-manager-named',
            description: 'Senior manager (s.103) named, captured, and signed off on risk assessments + transparency reports.',
            reference: 'OSA s.103; s.110 criminal liability',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-osa-csea-referral-pathway',
            description: 'CSEA referral pathway wired to mandated body; referral evidence chain captured tamper-evidently.',
            reference: 'OSA mandatory CSEA referral pathways',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'uk-osa-user-reporting',
            description: 'User-reporting + complaints workflow available; takedown-appeal pathway active; complaint resolution tracked.',
            reference: 'OSA Part 3 user reporting duty',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-osa-evidence-retention',
            description: 'Moderation + takedown + risk-assessment + transparency-report evidence retained 6 years; legal-hold for live Ofcom enforcement.',
            reference: 'Limitation Act 1980; Ofcom information-notice practice',
            check: 'retention_policy_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'uk-osa-supplier-flow-down',
            description: 'Third-party content-moderation + age-assurance + hosting providers attested; OSA in-scope flow-down captured.',
            reference: 'OSA Schedule 4 content provider obligations',
            check: 'subservice_registry_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=uk-online-safety-act.js.map