"use strict";
/**
 * NIH 2023 Data Management and Sharing Policy -- Pack
 *
 * Split notice: All four NIH policy instruments were previously bundled in
 * `src/packs/nih-data-sharing.ts`. Split per Thomas's 2026-04-24 principle:
 * one country, one regulation, one pack. The four NIH instruments have
 * different effective dates, different scope triggers, and different
 * compliance obligations. Reference the original Vera brief at
 * `docs/compliance-research/2026-04-24-pack-brief-nih-data-sharing.md`
 * which documented all four instruments.
 *
 * Cross-pack interactions (all 4 NIH packs typically activate together):
 *   - us-nih-dms requires data sharing to the maximum extent possible.
 *   - us-nih-coc may RESTRICT sharing of CoC-protected identifiable data.
 *     Resolution: CoC governs the disclosure side; DMS governs the deposit
 *     side. When both apply, CoC-protected data goes to controlled-access
 *     repositories (not public), satisfying DMS deposit while respecting CoC.
 *   - us-nih-gds governs the controlled-access repository deposit workflow
 *     (dbGaP). DMS and GDS run simultaneously for genomic NIH research.
 *   - us-nih-it-security provides the FISMA Moderate baseline required for
 *     systems processing controlled-access data under both DMS and GDS.
 *   - When all 4 packs are active, strictest-wins resolves conflicts. CoC
 *     blocking typically governs over DMS sharing obligations.
 *
 * NIH 2023 Data Management and Sharing (DMS) Policy (NOT-OD-21-013):
 * Effective January 25, 2023. Applies to all NIH-funded research generating
 * scientific data. Requires a Data Management and Sharing Plan (DMSP)
 * submitted with grant application; requires sharing of scientific data to
 * the maximum extent possible.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.NIH_DMS_PACK = exports.NIH_DMS_CATEGORY_CLASSIFIERS = void 0;
/**
 * NIH DMS category classifiers.
 */
exports.NIH_DMS_CATEGORY_CLASSIFIERS = {
    NIH_SCIENTIFIC_DATA: {
        references: ['NOT-OD-21-013 -- NIH DMS Policy; definition of scientific data'],
        classifier: (input) => {
            if (/\b(?:nih.award|nih.grant|r01|r21|u01|t32|nih.scientific.data|NIH_SCIENTIFIC_DATA)\b/i.test(input))
                return true;
            // Award number pattern (standard NIH grant identifier format)
            if (/\b[1-9][A-Z]\d{2}[A-Z]{2}\d{6}-\d{2}\b/i.test(input))
                return true;
            return false;
        },
    },
    DMSP_RESTRICTED_DATA: {
        references: ['NOT-OD-21-013 -- Data Management and Sharing Plan scope'],
        classifier: (input) => {
            if (/\b(?:DMSP.restricted|dmsp.approved.scope|data.management.sharing.plan.limit|outside.dmsp|DMSP_RESTRICTED_DATA)\b/i.test(input))
                return true;
            return false;
        },
    },
    PRE_PUBLICATION_RESEARCH_DATA: {
        references: ['NOT-OD-21-013 -- timely sharing; pre-publication sensitivity'],
        classifier: (input) => {
            if (/\b(?:pre.publication|unpublished.research|embargo.period.data|pre-pub.data|PRE_PUBLICATION_RESEARCH_DATA)\b/i.test(input))
                return true;
            return false;
        },
    },
};
exports.NIH_DMS_PACK = {
    categoryClassifiers: exports.NIH_DMS_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: Scientific data bound to a DMSP is subject-keyed to satisfy
     * NOT-OD-21-013 audit trail requirements (NIH award number linkage).
     */
    subjectKeyedCategories: ['NIH_SCIENTIFIC_DATA'],
    id: 'us-nih-dms',
    name: 'NIH Data Management and Sharing Policy (2023)',
    version: '1.0.0',
    description: 'NIH Data Management and Sharing Policy (NOT-OD-21-013, effective January 25, 2023). Applies to all NIH-funded research generating scientific data. Requires DMSP submission with grant; data sharing to maximum extent possible; AI must operate within DMSP-approved scope. Activate alongside us-nih-gds, us-nih-coc, and us-nih-it-security for complete NIH research compliance.',
    authority: 'National Institutes of Health (NIH), HHS; enforced through NIH Program Officers and Grants Policy',
    industries: ['clinical-research', 'academic-research', 'higher-education', 'biotech', 'federal-grantee'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'DMSP scope enforcement gate; de-identification-for-avoidance prohibition; consent-scope enforcement before sharing',
            reference: 'NOT-OD-21-013 (DMSP scope)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Per-access tamper-evident log with NIH award number and timestamp; DMSP compliance audit trail for NIH and institution',
            // OPERATOR_VERIFICATION_REQUIRED (F-NEW-VERA-PACK-C2-03, 2026-05-03):
            // NIH GPS is updated periodically; verify current section at grants.nih.gov
            reference: 'NOT-OD-21-013; NIH GPS Section 8.4.1 -- audit trail and records retention (verify current GPS edition at grants.nih.gov)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify NIH scientific data, DMSP-restricted data, and pre-publication research data',
            reference: 'NOT-OD-21-013 (scientific data definition)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-session DMSP approval status; NIH award number context persistence',
            reference: 'NOT-OD-21-013',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'No-training-on-research-data attestation; US data residency commitment',
            reference: 'NOT-OD-21-013',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'DMSP scope deviation escalation; human confirmation before sharing outside DMSP terms',
            reference: 'NOT-OD-21-013 (DMSP scope gate)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'DMSP documentation; NIH audit rights acknowledgment',
            // OPERATOR_VERIFICATION_REQUIRED (F-NEW-VERA-PACK-C2-03, 2026-05-03):
            // 45 CFR 74.53 redesignated under 2 CFR Part 200 (Uniform Guidance).
            // Current citation: 2 CFR §200.334. Verify applicable CFR for your award type.
            reference: '2 CFR §200.334 (Uniform Guidance record retention); NIH GPS (verify current edition at grants.nih.gov); NOT-OD-21-013',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'DMSP scope deviation events; NIH Program Officer notification stream',
            reference: 'NOT-OD-21-013',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detection of AI processing outside DMSP-approved scope; format incompatibility with repository submission requirements',
            reference: 'NOT-OD-21-013 (AI must not impede sharing compliance)',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            dmspApprovalRequired: true,
            dataSharingComplianceMonitored: true,
            retentionPolicyBoundToNihGps: true,
        },
        'data-classifier': {
            enabledCategories: ['NIH_SCIENTIFIC_DATA', 'DMSP_RESTRICTED_DATA', 'PRE_PUBLICATION_RESEARCH_DATA'],
        },
        'supply-chain': {
            providerTrainingProhibitionAttested: true,
            dataResidencyUSRequired: true,
        },
        'approval-queue': {
            dmspScopeDeviationEscalationRequired: true,
        },
        'attestation-manager': {
            dmspDocumentationRequired: true,
            nihAuditRightsAcknowledged: true,
        },
        'event-bus': {
            researchDataAuditEnabled: true,
            nihAwardNumberRequiredInEvents: true,
        },
        'anomaly-detector': {
            dmspScopeDeviationDetectionActive: true,
            repositoryFormatCompatibilityMonitoringActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'DATA-RESIDENCY-US',
            'ZERO-TRAINING-ON-NIH-RESEARCH-DATA',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['NIH_SCIENTIFIC_DATA', 'DMSP_RESTRICTED_DATA', 'PRE_PUBLICATION_RESEARCH_DATA'],
        categoryActions: {
            NIH_SCIENTIFIC_DATA: 'LOG',
            DMSP_RESTRICTED_DATA: 'BLOCK',
            PRE_PUBLICATION_RESEARCH_DATA: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        auditLogRetentionDays: 2555, // 7 years (NIH clinical research standard)
        sessionRetentionDays: 2555,
        incidentRetentionDays: 2555,
        // OPERATOR_VERIFICATION_REQUIRED (F-NEW-VERA-PACK-C2-03, 2026-05-03):
        // NIH GPS is updated annually. Verify current section at grants.nih.gov.
        reference: 'NOT-OD-21-013 (DMS Policy); NIH GPS Section 8.4.1 (verify current edition at grants.nih.gov); retain until published/deposited per DMSP; institution policy typically 3-7 years post-publication',
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'NOT-OD-21-013; NIH Program Officer notification required promptly for DMSP compliance failures',
        requiredRecipients: ['nih-program-officer', 'institution-research-compliance'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'nih-dms-dmsp-scope-check',
            description: 'AI processing within scope of approved DMSP',
            reference: 'NOT-OD-21-013 (DMSP compliance requirement)',
            check: 'nih_dms_dmsp_scope_check',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nih-dms-no-training-on-research-data',
            description: 'Provider attestation: no model training on NIH scientific data',
            reference: 'NOT-OD-21-013; FTC guidance on research data training prohibition',
            check: 'nih_dms_no_training_on_research_data',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nih-dms-audit-log-per-access',
            description: 'Every access to NIH scientific data logged with award number and timestamp',
            // OPERATOR_VERIFICATION_REQUIRED (F-NEW-VERA-PACK-C2-03): verify GPS section at grants.nih.gov
            reference: 'NOT-OD-21-013; NIH GPS Section 8.4.1 (verify current edition at grants.nih.gov)',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'nih-dms-behavioral-dmsp-scope',
            description: 'Runtime blocks DMSP_RESTRICTED_DATA category outside approved scope',
            reference: 'NOT-OD-21-013 (DMSP scope)',
            check: 'behavioralValidator_us_nih_dms',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nih-dms-dmsp-documentation',
            description: 'DMSP documentation and NIH audit rights acknowledged',
            reference: '45 CFR 74.53; NIH GPS; NOT-OD-21-013',
            check: 'nih_dms_no_training_on_research_data',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=us-nih-dms.js.map