"use strict";
/**
 * NHS Innovation Service / Digital Technology Assessment Criteria (DTAC)
 * Compliance Pack
 *
 * Framework:
 *   NHS Innovation Service — Digital Technology Assessment Criteria (DTAC)
 *   v1.0 + subsequent revisions, owned by NHS England.
 *
 *   DTAC is the composite assessment framework health-tech vendors must
 *   pass to be recommended through the NHS Innovation Service. It is NOT a
 *   single regulation — it is a meta-checklist that aggregates evidence
 *   from FIVE underlying domains:
 *
 *     1. Clinical Safety   → DCB0129 / DCB0160 (covered by
 *                            `nhs-clinical-safety` pack, PR #400)
 *     2. Data Protection   → UK GDPR + DPA 2018 (covered by `uk-gdpr`
 *                            pack)
 *     3. Technical Security → Cyber Essentials / CE+ (covered by
 *                            `cyber-essentials` pack, PR #397)
 *     4. Interoperability   → NHS Digital interoperability standards
 *                            (FHIR R4, SNOMED CT, ICD-10, NHS Number)
 *     5. Usability + Accessibility → WCAG 2.2 AA + NHS Service Manual
 *                            content + accessibility statement
 *
 *   Patient-data sharing across the framework is additionally governed by
 *   the Caldicott Principles (eight, 2020 revision). The Caldicott
 *   Guardian role is referenced here but is owned by a future Wave 2
 *   pack. For now we surface the dependency and capture the named-role
 *   attestation in this pack until Caldicott ships standalone.
 *
 * Jurisdiction: GB — England-led; equivalent assessment frameworks exist
 *   in Scotland (DHI Digital Health Standards), Wales, and Northern
 *   Ireland.
 * Authority: NHS England (DTAC publisher) + NHS Innovation Service
 *
 * Why this pack:
 *   - DTAC is the assessment framework an NHS-target customer asks about
 *     first ("can you pass DTAC?"). The composite pack lets us answer
 *     YES with a single attestation that surfaces all five dependent
 *     pack readiness states in one report.
 *   - Surfaces a single "DTAC compliance" badge on the customer
 *     dashboard so a CISO conversation becomes one screen rather than
 *     five.
 *   - Ships with Caldicott Guardian named-role attestation as a
 *     transitional capture point. Wave 2 Caldicott pack will own the
 *     full Caldicott principle enforcement; this pack downgrades its
 *     Caldicott validators when the standalone pack is registered.
 *
 * Dependencies (soft — composite pack does NOT enforce sub-pack
 * registration; it surfaces sub-pack readiness):
 *   - nhs-clinical-safety  (DCB0129 / DCB0160) — PR #400
 *   - uk-gdpr             (UK GDPR + DPA 2018) — already shipped
 *   - cyber-essentials    (CE / CE+) — PR #397
 *   - nhs-dspt           (NHS Data Security and Protection Toolkit) — PR #395
 *   - mhra-samd-ukca     (when the system is also a SaMD) — PR #401
 *   - caldicott-principles (Wave 2, future)
 *
 * Out of scope:
 *   - The five underlying packs themselves — register them alongside.
 *   - Scottish DHI / Welsh / NI equivalents — separate composite packs
 *     when those markets are addressed.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.NHS_DTAC_PACK = exports.NHS_DTAC_CATEGORY_CLASSIFIERS = void 0;
/**
 * DTAC category classifiers.
 *
 * Pack scope is the DTAC composite-evidence layer. Personal-data and
 * clinical-data classification is delegated to the underlying packs.
 * What this pack flags is the aggregate evidence: DTAC submission
 * artefacts, interoperability conformance attestations, accessibility
 * statements, Caldicott Guardian designation records.
 */
exports.NHS_DTAC_CATEGORY_CLASSIFIERS = {
    DTAC_SUBMISSION: {
        references: [
            'NHS Innovation Service — DTAC submission portal artefacts',
        ],
        classifier: (input) => {
            if (/\b(?:dtac\s+(?:submission|attestation|self[\s-]?assessment|evidence)|nhs\s+innovation\s+service\s+submission)\b/i.test(input))
                return true;
            if (/\b(?:digital\s+technology\s+assessment\s+criteria|dtac\s+v\d|dtac\s+badge)\b/i.test(input))
                return true;
            return false;
        },
    },
    INTEROPERABILITY_CONFORMANCE: {
        references: [
            'NHS Digital interoperability standards — FHIR R4, SNOMED CT, NHS Number, ICD-10',
        ],
        classifier: (input) => {
            if (/\b(?:fhir\s+r4|fhir\s+conformance|fhir\s+capability\s+statement|nhs\s+digital\s+interop)\b/i.test(input))
                return true;
            if (/\b(?:hl7\s+v\d|cda\s+document|interoperability\s+test\s+report)\b/i.test(input))
                return true;
            return false;
        },
    },
    ACCESSIBILITY_STATEMENT: {
        references: [
            'WCAG 2.2 AA conformance; NHS Service Manual accessibility',
        ],
        classifier: (input) => {
            if (/\b(?:wcag\s*2\.2\s*aa|accessibility\s+(?:statement|conformance|audit))\b/i.test(input))
                return true;
            if (/\b(?:nhs\s+service\s+manual|axe\s+(?:scan|report)|accessibility\s+regression\s+test)\b/i.test(input))
                return true;
            return false;
        },
    },
    CALDICOTT_GUARDIAN_DESIGNATION: {
        references: [
            'Caldicott Principles 2020 — principle 8: a duty to share information for individual care is as important as the duty to protect patient confidentiality',
            'Caldicott Guardian Manual (NHS England)',
        ],
        classifier: (input) => {
            if (/\b(?:caldicott\s+guardian\s+(?:designated|named|appointed|delegation)|cg\s+sign[\s-]?off)\b/i.test(input))
                return true;
            if (/\b(?:caldicott\s+principle\s+\d|ucl\s+caldicott|caldicott\s+log)\b/i.test(input))
                return true;
            return false;
        },
    },
    USABILITY_EVIDENCE: {
        references: [
            'NHS Service Manual usability research; DTAC usability section',
        ],
        classifier: (input) => {
            if (/\b(?:usability\s+(?:study|research|test\s+report|evidence)|user\s+research\s+report)\b/i.test(input))
                return true;
            if (/\b(?:sus\s+score|nps\s+score\s+nhs|usability\s+regression\s+test)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety; DTAC submission artefacts must not embed credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.NHS_DTAC_PACK = {
    categoryClassifiers: exports.NHS_DTAC_CATEGORY_CLASSIFIERS,
    id: 'nhs-dtac',
    aliases: [
        'dtac',
        'nhs-innovation-service',
        'nhs-innovation-service-dtac',
        'digital-technology-assessment-criteria',
    ],
    name: 'NHS Innovation Service — Digital Technology Assessment Criteria (DTAC)',
    version: '1.0.0',
    description: 'Composite assessment framework owned by NHS England. Aggregates evidence from five domains: clinical safety (DCB0129/0160 — see nhs-clinical-safety pack), data protection (UK GDPR + DPA 2018 — see uk-gdpr pack), technical security (Cyber Essentials — see cyber-essentials pack), interoperability (NHS Digital FHIR R4 / SNOMED CT / NHS Number / ICD-10), and usability + accessibility (WCAG 2.2 AA + NHS Service Manual). Patient-data sharing additionally governed by the Caldicott Principles (transitional Caldicott Guardian named-role attestation captured here until Wave 2 standalone pack ships). Surfaces a single DTAC compliance badge on the customer dashboard. Composite by design: this pack does not duplicate sub-pack enforcement — it tracks aggregate readiness.',
    authority: 'NHS England (DTAC publisher) + NHS Innovation Service',
    industries: ['healthcare', 'pharma', 'public-sector', 'digital-health', 'clinical-research', 'medical-devices'],
    requiredModules: [
        {
            name: 'attestation-manager',
            required: true,
            reason: 'DTAC submission attestation (current); per-domain readiness state (clinical safety / data protection / technical security / interoperability / usability + accessibility); Caldicott Guardian designation record (transitional until Wave 2 Caldicott pack); WCAG 2.2 AA accessibility statement.',
            reference: 'NHS Innovation Service DTAC submission requirements',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Composite-readiness gate: AI agent must not declare DTAC compliance unless all five sub-domains are attested. Default-deny on DTAC-claim emission when any domain is missing.',
            reference: 'DTAC composite-evidence integrity',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain for DTAC submission revisions, accessibility regression results, interoperability conformance test outcomes, and Caldicott Guardian sign-off events.',
            reference: 'DTAC submission evidence retention; NHS England audit expectations',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Surface DTAC submission artefacts, interoperability conformance reports, accessibility statements, Caldicott Guardian designation records, and usability evidence for the composite report.',
            reference: 'DTAC submission artefact categorisation',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Sub-pack readiness state changes (DSPT / clinical safety / cyber essentials / UK GDPR / MHRA SaMD) emit aggregate-readiness recompute events; DTAC badge state lifts/falls accordingly.',
            reference: 'Composite-pack readiness aggregation',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'DTAC submission evidence retention (3-year baseline; longer if the underlying pack mandates) and longitudinal accessibility / interoperability conformance timeline for re-submission.',
            reference: 'NHS Innovation Service evidence expectations',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Public-facing accessibility statement publication; DTAC badge surfacing on the customer-facing surface where the AI agent is integrated.',
            reference: 'WCAG 2.2 AA accessibility statement publication; DTAC badge requirements',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'DTAC composite explicitly references sub-supplier evidence chains for each of the five domains; aggregate sub-supplier readiness recorded.',
            reference: 'DTAC sub-supplier evidence propagation',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Caldicott Guardian sign-off gate (T2 named-role) on patient-data sharing claims surfaced in DTAC submissions; transitional until Wave 2 Caldicott standalone pack ships.',
            reference: 'Caldicott Principles 2020 — duty to share + duty to protect',
        },
    ],
    moduleConfig: {
        'attestation-manager': {
            dtacSubmissionTracked: true,
            perDomainReadinessTracked: true,
            caldicottGuardianDesignationTracked: true,
            wcagAttestationRequired: true,
            // Caldicott handling now defers to the standalone caldicott-principles
            // pack (shipped). DTAC tracks Caldicott Guardian designation as evidence
            // for the composite badge, but enforcement of the Caldicott principles
            // themselves lives in caldicott-principles.
            caldicottHandlingMode: 'DEFERRED_TO_CALDICOTT_PACK',
        },
        'governance-runtime': {
            dtacBadgeRequiresAllDomains: true,
            defaultDenyOnDtacClaimWhenIncomplete: true,
        },
        'audit-integrity': {
            dtacEvidenceTrackingRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'DTAC_SUBMISSION',
                'INTEROPERABILITY_CONFORMANCE',
                'ACCESSIBILITY_STATEMENT',
                'CALDICOTT_GUARDIAN_DESIGNATION',
                'USABILITY_EVIDENCE',
                'CREDENTIALS',
            ],
            credentialsAction: 'BLOCK',
        },
        'event-bus': {
            subPackReadinessEventsSubscribed: true,
        },
        'session-persistence': {
            retentionDaysMinimum: 1095, // 3 years; sub-pack mandates take precedence
        },
        'transparency-injector': {
            accessibilityStatementPublicationRequired: true,
            dtacBadgeRenderingRequired: true,
        },
        'supply-chain': {
            subSupplierDtacEvidenceRequired: true,
        },
        'approval-queue': {
            caldicottGuardianSignOffRequired: true,
            reviewTier: 'T2',
            reviewerCompetence: 'CALDICOTT_GUARDIAN',
            transitionalUntilCaldicottPack: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK', 'PROCESSOR-CONTRACT', 'NHS-DSPT-SUBSCRIBED'],
        blockReasons: {
            deepseek: 'PRC jurisdiction. DTAC composite includes data-protection + technical-security domains that exclude PRC routing for NHS data partners.',
            baidu: 'PRC jurisdiction. NHS DTAC composite cannot route through PRC infrastructure.',
            alibaba: 'PRC jurisdiction. NHS DTAC composite cannot route through PRC infrastructure.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'DTAC_SUBMISSION',
            'INTEROPERABILITY_CONFORMANCE',
            'ACCESSIBILITY_STATEMENT',
            'CALDICOTT_GUARDIAN_DESIGNATION',
            'USABILITY_EVIDENCE',
            'CREDENTIALS',
        ],
        categoryActions: {
            DTAC_SUBMISSION: 'WARN',
            INTEROPERABILITY_CONFORMANCE: 'WARN',
            ACCESSIBILITY_STATEMENT: 'WARN',
            CALDICOTT_GUARDIAN_DESIGNATION: 'WARN',
            USABILITY_EVIDENCE: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // 3-year DTAC baseline. When the sub-pack mandates a longer window
        // (e.g. nhs-clinical-safety 10-year-post-EoL, mhra-samd-ukca 10-year /
        // 15-year implantable, nhs-dspt 8-year clinical), the longer window
        // wins via session-persistence per-record metadata.
        auditLogRetentionDays: 1095, // 3 years
        sessionRetentionDays: 1095,
        incidentRetentionDays: 1095,
        reference: 'NHS Innovation Service evidence retention (3-year baseline; sub-pack overrides take precedence)',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb'],
    },
    incidentPolicy: {
        // DTAC itself does not mandate a notification window. Incidents
        // surface through the underlying packs (clinical safety, DSPT, UK
        // GDPR, MHRA SaMD). 72 hours is the harmonised baseline.
        notificationDeadlineHours: 72,
        reference: 'DTAC incident response inherited from sub-packs: NHS DSPT CareCERT, DCB0129/0160 PSIRF, MHRA Yellow Card / FSN, UK GDPR Art. 33 ICO',
        requiredRecipients: [
            'caldicott-guardian',
            'clinical-safety-officer',
            'data-protection-officer',
            'senior-information-risk-owner',
        ],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'nhs-dtac-submission-current',
            description: 'DTAC submission registered, current, and signed off; submission timestamp within the renewal window.',
            reference: 'NHS Innovation Service DTAC submission requirements',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nhs-dtac-clinical-safety-readiness',
            description: 'Clinical safety domain readiness: nhs-clinical-safety pack registered and CSCR + hazard log + CSO sign-off attested.',
            reference: 'DTAC domain 1 — Clinical Safety; DCB0129 / DCB0160',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nhs-dtac-data-protection-readiness',
            description: 'Data protection domain readiness: uk-gdpr pack registered and DPIA + lawful basis + ROPA captured for NHS data flows.',
            reference: 'DTAC domain 2 — Data Protection; UK GDPR + DPA 2018',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nhs-dtac-technical-security-readiness',
            description: 'Technical security domain readiness: cyber-essentials pack attested current; nhs-dspt pack attested current.',
            reference: 'DTAC domain 3 — Technical Security; Cyber Essentials + NHS DSPT',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nhs-dtac-interoperability-readiness',
            description: 'Interoperability domain readiness: FHIR R4 capability statement + SNOMED CT + NHS Number + ICD-10 conformance test reports captured.',
            reference: 'DTAC domain 4 — Interoperability; NHS Digital interoperability standards',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nhs-dtac-accessibility-readiness',
            description: 'WCAG 2.2 AA conformance statement published; NHS Service Manual accessibility audit captured; accessibility regression tests scheduled.',
            reference: 'DTAC domain 5 — Usability + Accessibility; WCAG 2.2 AA; NHS Service Manual',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nhs-dtac-caldicott-guardian-designated',
            description: 'Caldicott Guardian named-role designation captured; sign-off path wired into approval-queue. (Transitional — owned by Wave 2 Caldicott pack when shipped.)',
            reference: 'Caldicott Principles 2020; Caldicott Guardian Manual',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nhs-dtac-badge-integrity',
            description: 'DTAC compliance badge displayed only when all five domains are attested; default-deny on incomplete claim emission.',
            reference: 'DTAC composite-evidence integrity',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nhs-dtac-evidence-audit-trail',
            description: 'Tamper-evident audit chain covers DTAC submission revisions, accessibility regression results, and interoperability conformance test outcomes.',
            reference: 'DTAC submission evidence integrity',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'nhs-dtac-encryption',
            description: 'DTAC submission evidence encrypted at rest and in transit; consistent with NHS DSPT Section 7 and UK GDPR Art. 32.',
            reference: 'NHS DSPT Section 7; UK GDPR Art. 32(1)(a)',
            check: 'encryption_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=nhs-dtac.js.map