import type { Metadata } from 'next';
import Link from 'next/link';
import { PageHeader, Section } from '@/components/ui/section';
import { ClaimBadge } from '@/components/ui/badge';
import { CONTACT_EMAIL, DISCLAIMER } from '@/lib/site';

export const metadata: Metadata = { title: 'Trust & policies', description: 'Provenance, methodology, AI policy, privacy, security, source policy and corrections.' };

export default function TrustPage() {
  return (
    <div className="ci-prose max-w-3xl">
      <PageHeader kicker="Trust" title="Trust & policies" lede={DISCLAIMER} />
      <Section id="provenance" kicker="§2" title="Provenance">
        <p>Every imported fact carries a provenance row: source, dataset, version, retrieval date, evidence type, license and — where relevant — PMID or DOI. Raw payloads are archived unchanged. Hover any source badge to see the chain; administrators can trace any value to its raw record.</p>
      </Section>
      <Section id="methodology" kicker="§250" title="Methodology">
        <p>
          Derived values reference a versioned formula from the public <Link className="ci-link" href="/methodology">metric catalog</Link>. Snapshots store their inputs hash; identical inputs yield identical ranks.
        </p>
      </Section>
      <Section id="labels" kicker="§3" title="Scientific safety labels">
        <p className="flex flex-wrap items-center gap-1.5">
          <ClaimBadge kind="observed" /> <ClaimBadge kind="published" /> <ClaimBadge kind="curated" /> <ClaimBadge kind="regulatory" /> <ClaimBadge kind="guideline" /> <ClaimBadge kind="computed" /> <ClaimBadge kind="ai" />
        </p>
        <p className="mt-2">Labels are never merged. Regulatory status is always tied to a jurisdiction and an indication. Population survival is never presented as an individual prognosis.</p>
      </Section>
      <Section id="ai" kicker="AI policy" title="AI-generated content: not enabled">
        <p>Phase 1 contains no AI-generated text. When AI synthesis is introduced, it will be database-grounded only (answers must cite records present in the index), cached with the model name, prompt version and record snapshot, and always labelled "AI-generated". Language models are never used to map source labels to entities; at most they propose candidates that a curator reviews.</p>
      </Section>
      <Section id="privacy" kicker="Privacy" title="Privacy">
        <p>CancerIndex holds no patient-level data: all statistics are aggregate and published by their sources. The site sets no tracking cookies; the only cookie is the administrator session. Server logs retain IP addresses for a short period for abuse prevention.</p>
      </Section>
      <Section id="security" kicker="Security" title="Security">
        <p>Read-only public access; administrative actions require a token and are written to an audit log. Connectors run with rate limits, idempotent writes and an anomaly guard that refuses destructive updates when a source shrinks unexpectedly. Report vulnerabilities to {CONTACT_EMAIL}.</p>
      </Section>
      <Section id="sources" kicker="Source policy" title="Source policy">
        <p>
          A connector goes live only after its license is reviewed; sources under review are listed with no public records. Attribution requirements are honoured on every page and in exports. See the <Link className="ci-link" href="/sources">source registry</Link>.
        </p>
      </Section>
      <Section id="corrections" kicker="Corrections" title="Corrections and takedowns">
        <p>
          Found an error, a mis-mapped label or a licensing concern? Write to <a className="ci-link" href={`mailto:${CONTACT_EMAIL}`}>{CONTACT_EMAIL}</a> with the page URL and the identifier (CI-…). Corrections are recorded as change events on the affected entity.
        </p>
      </Section>
    </div>
  );
}