"use strict";
/**
 * GxP Compliance Pack
 *
 * Good Practice Quality Guidelines covering Good Manufacturing
 * Practice (GMP), Good Laboratory Practice (GLP), and Good Clinical
 * Practice (GCP). Applied when AI/ML operates in any regulated
 * pharma / biotech / medical-device / clinical-trial function.
 *
 * Standards referenced:
 *   - 21 CFR Parts 210-211 (US GMP)
 *   - 21 CFR Part 58 (US GLP)
 *   - 21 CFR Part 312 (US IND / GCP)
 *   - EU GMP Guide (EudraLex Vol 4) + Annex 11 (Computerised Systems)
 *   - ICH E6(R3) Good Clinical Practice (2024 revision)
 *   - ICH Q7 GMP for APIs; ICH Q9 Quality Risk Management; ICH Q10
 *     Pharmaceutical Quality System
 *   - OECD GLP Principles
 *   - 2022 EMA Reflection Paper on AI; 2023 EMA AI Guidance
 *   - ALCOA+ data integrity principles
 *
 * Current state (2026):
 *   - ICH E6(R3) GCP revision finalised 2024; implements "fit for
 *     purpose" modernisation for digital technologies including AI.
 *   - EU GMP Annex 11 governs computerised systems including AI-
 *     driven manufacturing QC and batch release.
 *   - GxP pairs with 21 CFR Part 11 (always).
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.GXP_PACK = exports.GXP_CATEGORY_CLASSIFIERS = void 0;
/**
 * GxP (Good Practice - GMP/GLP/GCP) category classifiers.
 * Covers pharmaceutical manufacturing (GMP), laboratory studies (GLP),
 * and clinical trials (GCP) under FDA 21 CFR Parts 210/211/58/312.
 * REGULATED_RECORD and BATCH_DATA are LOG categories for evidence capture.
 */
exports.GXP_CATEGORY_CLASSIFIERS = {
    REGULATED_RECORD: {
        references: ['21 CFR 211.180 -- GMP record retention; 21 CFR 58.195 -- GLP records'],
        classifier: (input) => {
            if (/\b(?:GMP|GLP|GCP|batch\s+record|master\s+batch\s+record|NDA|IND|ANDA)\b/.test(input))
                return true;
            if (/\b(?:predicate\s+rule|electronic\s+batch\s+record|regulated\s+(?:record|document)|regulated\s+electronic\s+record)\b/i.test(input))
                return true;
            return false;
        },
    },
    BATCH_DATA: {
        references: ['21 CFR 211.188 -- batch production and control records'],
        classifier: (input) => {
            if (/\b(?:batch\s+(?:number|record|production|release|status)|lot\s+(?:number|record|release))\b/i.test(input))
                return true;
            return false;
        },
    },
    STUDY_DATA: {
        references: ['21 CFR 58 -- GLP study data; OECD GLP principles'],
        classifier: (input) => {
            if (/\b(?:study\s+(?:director|record|report|protocol|raw\s+data)|GLP\s+study|non.?clinical\s+study)\b/i.test(input))
                return true;
            return false;
        },
    },
    CLINICAL_TRIAL_DATA: {
        references: ['21 CFR Part 312 -- IND safety reports; GCP clinical trial data'],
        classifier: (input) => {
            if (/\b(?:clinical\s+trial\s+(?:data|record|protocol)|IND\s+(?:safety|report)|SAE\s+(?:report|record)|SUSAR)\b/i.test(input))
                return true;
            if (/\b(?:CRF|case\s+report\s+form|subject\s+data|investigator\s+brochure)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['21 CFR Part 11 -- access controls for GxP electronic systems'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.GXP_PACK = {
    categoryClassifiers: exports.GXP_CATEGORY_CLASSIFIERS,
    /** P3.5: Clinical trial data and study data are inherently subject-keyed per GxP regulations (21 CFR Part 11). */
    subjectKeyedCategories: ['STUDY_DATA', 'CLINICAL_TRIAL_DATA'],
    id: 'gxp',
    name: 'GxP (GMP/GLP/GCP)',
    version: '1.0.0',
    description: 'GxP Good Practice covering GMP (21 CFR 210-211 + EU GMP Annex 11), GLP (21 CFR 58), and GCP (21 CFR 312 + ICH E6(R3) 2024). ALCOA+ data integrity enforced across all three branches.',
    authority: 'FDA + EMA + ICH + national competent authorities',
    industries: ['pharma', 'biotech', 'medical-devices', 'clinical-trials', 'contract-research-organisation', 'contract-manufacturing', 'laboratory-services'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'AI validation gate per GxP branch; GxP scope identification',
            reference: '21 CFR 211.22; EU GMP Annex 11; ICH E6(R3)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail with ALCOA+ enforcement',
            reference: 'EU GMP Annex 11; 21 CFR 11; ALCOA+',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'REGULATED_RECORD + BATCH_DATA + STUDY_DATA + CLINICAL_TRIAL_DATA classification',
            reference: '21 CFR 210-211, 58, 312',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Raw data preservation (GLP); contemporaneous capture; study lifetime continuity',
            reference: '21 CFR 58.195 raw data; ALCOA+',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Quality Assurance Agreement (QAA) + supplier GxP audit evidence',
            reference: '21 CFR 211.84; EU GMP Ch. 7',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Batch release QA gate; clinical trial eligibility + consent; protocol deviation review',
            reference: '21 CFR 211.22; ICH E6(R3); 21 CFR 312.62',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'IQ/OQ/PQ validation; GMP batch records; GLP study protocols; GCP informed consent; ALCOA+ attestations',
            reference: '21 CFR 210-211, 58, 312; ICH E6(R3)',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'GMP OOS detection; GLP protocol deviation; GCP adverse event signal',
            reference: '21 CFR 211.192 OOS; ICH E2A',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'IND safety report clocks (7-day / 15-day); FAR clock (3-day); GxP incident streams',
            reference: '21 CFR 312.32; 21 CFR 314.81 FAR',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Unique agent identity for audit trail + e-signature attribution',
            reference: '21 CFR Part 11; EU GMP Annex 11',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'GxP record protection at rest and in transit',
            reference: 'EU GMP Annex 11 data integrity',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            gxpBranchTracking: true, // GMP | GLP | GCP
            aiValidationGateRequired: true,
            alcoaPlusEnforced: true,
        },
        'audit-integrity': {
            gxpAuditTrailRequired: true,
            contemporaneousCaptureRequired: true,
        },
        // TWO-LAYER ARCHITECTURE NOTE (F-NEW-VERA-PACK-FINAL-005):
        // This 'data-classifier' block is read by the data-classifier module, NOT by
        // PackDrivenClassifier. PackDrivenClassifier reads dataPolicy.categoryActions
        // only (see pack-driven-classifier.ts loadFromPacks()). These two surfaces
        // serve different consumers:
        //
        //   Layer 1 -- PackDrivenClassifier:
        //     dataPolicy.categoryActions.REGULATED_RECORD = 'BLOCK'
        //     Fires unconditionally on any input matching the REGULATED_RECORD classifier.
        //     No conditional logic -- any match is blocked.
        //
        //   Layer 2 -- data-classifier module:
        //     moduleConfig['data-classifier'].regulatedRecordAction = 'BLOCK_WITHOUT_SIGNATURE'
        //     This is the CONDITIONAL policy: downstream data-classifier can allow a
        //     validly-signed record through (EU GMP Annex 11 / 21 CFR Part 11 e-signature
        //     mandate). The data-classifier module implements the "pass if signed" logic.
        //
        // There is NO runtime bug: PackDrivenClassifier intentionally blocks all
        // REGULATED_RECORD matches (strictest-wins). The data-classifier module then
        // applies the signature check to determine whether to unlock the record.
        // Without a valid GxP e-signature, the record stays blocked at both layers.
        'data-classifier': {
            enabledCategories: ['REGULATED_RECORD', 'BATCH_DATA', 'STUDY_DATA', 'CLINICAL_TRIAL_DATA', 'CREDENTIALS'],
            regulatedRecordAction: 'BLOCK_WITHOUT_SIGNATURE',
        },
        'session-persistence': {
            rawDataPreservationRequired: true, // GLP
            studyLifetimeContinuityRequired: true,
        },
        'supply-chain': {
            qaaRequired: true,
            supplierGxpAuditRequired: true,
        },
        'approval-queue': {
            batchReleaseQaGateRequired: true, // GMP
            clinicalEligibilityConsentGateRequired: true, // GCP
            protocolDeviationReviewRequired: true,
        },
        'attestation-manager': {
            iqOqPqValidationRequired: true,
            gmpBatchRecordAttestationRequired: true,
            glpStudyProtocolAttestationRequired: true,
            gcpInformedConsentAttestationRequired: true,
        },
        'anomaly-detector': {
            gmpOosDetectionActive: true,
            gcpAdverseEventSignalActive: true,
        },
        'event-bus': {
            indSafetyReportSevenDayClockActive: true, // serious + unexpected
            indSafetyReportFifteenDayClockActive: true, // non-serious
            farThreeDayClockActive: true, // Field Alert Report
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['GXP-VALIDATED', 'AI-PROVENANCE'],
        blockReasons: {},
    },
    // TWO-LAYER ARCHITECTURE NOTE (continued, F-NEW-VERA-PACK-FINAL-005):
    // categoryActions is the PackDrivenClassifier surface (Layer 1 -- classification engine).
    // REGULATED_RECORD: 'BLOCK' is unconditional -- any match blocks regardless of signature.
    // The data-classifier module (Layer 2) applies 'BLOCK_WITHOUT_SIGNATURE' logic after
    // PackDrivenClassifier fires, allowing validly GxP e-signed records to pass through.
    // Validly-signed records: PackDrivenClassifier blocks -> data-classifier unlocks if signed.
    // Unsigned records: blocked at both layers (correct default for GMP/GLP/GCP regulated records).
    dataPolicy: {
        scanCategories: ['REGULATED_RECORD', 'BATCH_DATA', 'STUDY_DATA', 'CLINICAL_TRIAL_DATA', 'CREDENTIALS'],
        categoryActions: {
            REGULATED_RECORD: 'BLOCK',
            BATCH_DATA: 'LOG',
            STUDY_DATA: 'LOG',
            CLINICAL_TRIAL_DATA: 'LOG',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // 25 years default covers GCP trial end + 15-25 years; GLP lifetime + 10; GMP batch record 3 years
        auditLogRetentionDays: 9125,
        sessionRetentionDays: 9125,
        incidentRetentionDays: 9125,
        reference: 'GCP: trial end + 15-25 years; GLP: lifetime of study + 10 years; GMP: batch record retention per 21 CFR 211.180. Default 25 years.',
    },
    incidentPolicy: {
        // 7 days (GCP IND serious + unexpected)
        notificationDeadlineHours: 168,
        reference: 'GCP IND safety: 7 days serious + unexpected fatal/life-threatening; 15 days non-serious. GMP FAR 3 days. Pax1 defaults to 7-day external + same-day internal escalation.',
        requiredRecipients: ['fda', 'ema-if-eu', 'sponsor', 'ethics-committee-irb', 'qa-leadership'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'gxp-validation-gate',
            description: 'AI validation gate: IQ/OQ/PQ attestation per GxP branch',
            reference: '21 CFR 210-211, 58, 312; EU GMP Annex 11',
            check: 'gxp_validation_gate_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'gxp-alcoa-plus',
            description: 'ALCOA+ data integrity enforced',
            reference: 'EU GMP Annex 11; ALCOA+',
            check: 'gxp_alcoa_plus_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'gxp-batch-release',
            description: 'GMP batch release QA gate active',
            reference: '21 CFR 211.22',
            check: 'gxp_batch_release_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'gxp-raw-data',
            description: 'GLP raw data preservation active',
            reference: '21 CFR 58.195',
            check: 'gxp_raw_data_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'gxp-eligibility-consent',
            description: 'GCP eligibility + informed consent gate active',
            reference: 'ICH E6(R3); 21 CFR 312.62',
            check: 'gxp_eligibility_consent_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'gxp-ind-safety-reports',
            description: 'IND safety report clocks configured (7-day + 15-day)',
            reference: '21 CFR 312.32; ICH E2A',
            check: 'gxp_ind_safety_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'gxp-protocol-deviation',
            description: 'Protocol deviation review required',
            reference: 'ICH E6(R3); EU CTR',
            check: 'gxp_protocol_deviation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'gxp-oos',
            description: 'GMP out-of-specification investigation triggered',
            reference: '21 CFR 211.192',
            check: 'gxp_oos_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'gxp-qaa',
            description: 'Quality Assurance Agreement on file per supplier',
            reference: '21 CFR 211.84; EU GMP Ch. 7',
            check: 'gxp_qaa_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'gxp-far',
            description: 'Field Alert Report 3-day clock configured',
            reference: '21 CFR 314.81',
            check: 'gxp_far_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'gxp-audit-trail',
            description: 'Tamper-evident audit trail with contemporaneous capture',
            reference: 'EU GMP Annex 11; 21 CFR Part 11 coupling',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=gxp.js.map