/**
 * IEC 62304 Medical Device Software Compliance Pack
 *
 * IEC 62304:2006+A1:2015 -- "Medical device software -- Software life cycle
 * processes." International Electrotechnical Commission (IEC) standard that
 * specifies life cycle requirements for the development and maintenance of
 * medical device software.
 *
 * Standards referenced (citations only; no verbatim text from the standard):
 *   - IEC 62304:2006+A1:2015 -- core software life cycle processes
 *   - IEC 62304 Annex B -- software safety classification rationale guidance
 *   - ISO 14971:2019 -- risk management for medical devices (required input
 *     to IEC 62304 software safety classification)
 *   - IEC 82304-1:2016 -- health software; complements IEC 62304 for
 *     standalone health software
 *   - FDA Guidance "Content of Premarket Submissions for Device Software
 *     Functions" (2023) -- cites IEC 62304 as the referenced standard
 *   - EU MDR 2017/745 + MDCG 2022-2 -- reference IEC 62304 for EU CE marking
 *   - IMDRF SaMD Framework -- references IEC 62304 processes for SaMD QMS
 *
 * Software Safety Classes (IEC 62304 §4.3):
 *   - Class A: No injury or damage to health is possible from failure
 *   - Class B: Non-serious injury is possible from failure
 *   - Class C: Death or serious injury is possible from failure
 *
 * Process requirements scale with class:
 *   - Class A: Basic documentation, maintenance process, anomaly resolution
 *   - Class B: Class A + detailed unit-level architecture, integration testing
 *   - Class C: Class B + detailed design, unit verification, full traceability
 *
 * SOUP (Software of Unknown Provenance -- IEC 62304 §3.1.17):
 *   Any software item that is already developed and generally available,
 *   and that has not been developed for the purpose of being incorporated
 *   into the medical device. Third-party libraries, OS components, LLM
 *   inference libraries, and AI framework packages all qualify as SOUP.
 *   Class C SOUP introduction without documented evaluation is BLOCKED.
 *
 * Retention:
 *   IEC 62304 §5.1.1 requires software development plan records to be
 *   retained "for the expected lifetime of the medical device." Combined
 *   with FDA 21 CFR 820 (QMSR), EU MDR PMS, and MHRA guidance, the
 *   effective minimum retention is 10 years (device lifetime + post-market
 *   surveillance period).
 *
 * @connexum/ai-governance
 */
/**
 * IEC 62304 category classifiers.
 *
 * Covers SOUP identification, software safety class declarations,
 * risk management file data, anomaly reports, configuration items,
 * and software safety classification artefacts.
 */
export const IEC_62304_CATEGORY_CLASSIFIERS = {
    /**
     * SOUP -- Software of Unknown Provenance (IEC 62304 §3.1.17 + §8).
     * Detects introduction of third-party or external software items
     * that must be evaluated and documented per the SOUP process.
     * Class C SOUP introduction without documented evaluation is BLOCKED.
     */
    SOUP: {
        references: [
            'IEC 62304:2006+A1:2015 §3.1.17 -- SOUP definition',
            'IEC 62304:2006+A1:2015 §8 -- software items of unknown provenance',
        ],
        classifier: (input) => {
            // Direct SOUP terminology
            if (/\b(?:SOUP|software\s+of\s+unknown\s+provenance)\b/i.test(input))
                return true;
            // Third-party library / package introduction signals
            if (/\b(?:npm\s+install|pip\s+install|yarn\s+add|cargo\s+add)\s+[^\s]+/i.test(input))
                return true;
            // Third-party component references in medical context
            if (/\b(?:third.?party\s+(?:library|package|component|module|framework)|external\s+(?:library|dependency|component))\b/i.test(input))
                return true;
            // SOUP evaluation artefacts
            if (/\b(?:SOUP\s+(?:list|evaluation|assessment|register|record)|SOUP_LIST|soup_eval)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * MEDICAL_DEVICE_SOFTWARE_CLASS_A -- Software safety class A artefacts.
     * No injury or damage to health is possible from a software failure.
     * Lowest process requirements; basic documentation + maintenance sufficient.
     */
    MEDICAL_DEVICE_SOFTWARE_CLASS_A: {
        references: [
            'IEC 62304:2006+A1:2015 §4.3 -- Software safety classification',
            'IEC 62304 Annex B -- classification rationale',
        ],
        classifier: (input) => {
            if (/\b(?:Class\s+A\s+(?:software|SaMD|device\s+software)|software\s+(?:safety\s+)?class\s+A|IEC.?62304\s+Class\s+A)\b/i.test(input))
                return true;
            if (/\b(?:class_a_software|CLASS_A_SAMD|safety.?class.?a)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * MEDICAL_DEVICE_SOFTWARE_CLASS_B -- Software safety class B artefacts.
     * Non-serious injury is possible from a software failure.
     * Class A requirements + unit-level architecture + integration testing.
     */
    MEDICAL_DEVICE_SOFTWARE_CLASS_B: {
        references: [
            'IEC 62304:2006+A1:2015 §4.3 -- Software safety classification',
            'IEC 62304 Annex B -- classification rationale',
        ],
        classifier: (input) => {
            if (/\b(?:Class\s+B\s+(?:software|SaMD|device\s+software)|software\s+(?:safety\s+)?class\s+B|IEC.?62304\s+Class\s+B)\b/i.test(input))
                return true;
            if (/\b(?:class_b_software|CLASS_B_SAMD|safety.?class.?b)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * MEDICAL_DEVICE_SOFTWARE_CLASS_C -- Software safety class C artefacts.
     * Death or serious injury is possible from a software failure.
     * Highest process burden: detailed design, unit verification, full traceability.
     * SOUP introduction without evaluation is BLOCKED at this class.
     */
    MEDICAL_DEVICE_SOFTWARE_CLASS_C: {
        references: [
            'IEC 62304:2006+A1:2015 §4.3 -- Software safety classification',
            'IEC 62304 Annex B -- classification rationale',
            'IEC 62304:2006+A1:2015 §8 -- SOUP requirements for Class C',
        ],
        classifier: (input) => {
            if (/\b(?:Class\s+C\s+(?:software|SaMD|device\s+software)|software\s+(?:safety\s+)?class\s+C|IEC.?62304\s+Class\s+C)\b/i.test(input))
                return true;
            if (/\b(?:class_c_software|CLASS_C_SAMD|safety.?class.?c)\b/i.test(input))
                return true;
            // Critical safety function references in device software context
            if (/\b(?:life.?sustaining|life.?supporting|life.?critical)\s+(?:software|function|device)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * RISK_MANAGEMENT_FILE -- ISO 14971 risk management records.
     * IEC 62304 §4.2 requires software safety classification to be based
     * on risk management (ISO 14971). Risk management file data is LOG.
     */
    RISK_MANAGEMENT_FILE: {
        references: [
            'IEC 62304:2006+A1:2015 §4.2 -- risk management requirements',
            'ISO 14971:2019 -- medical device risk management (cross-reference)',
        ],
        classifier: (input) => {
            if (/\b(?:risk\s+management\s+file|RMF\s+(?:record|entry|update)|ISO.?14971\s+(?:record|analysis))\b/i.test(input))
                return true;
            if (/\b(?:hazard\s+(?:log|analysis|identification)|FMEA\s+(?:record|update)|FTA\s+(?:record|update))\b/i.test(input))
                return true;
            if (/\b(?:residual\s+risk\s+(?:evaluation|record|acceptability)|risk.?benefit\s+analysis)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * SOFTWARE_SAFETY_CLASSIFICATION -- formal classification artefacts.
     * The classification decision record itself (not the class-specific data
     * above). Covers classification rationale documents, classification
     * review records, and reclassification events.
     */
    SOFTWARE_SAFETY_CLASSIFICATION: {
        references: [
            'IEC 62304:2006+A1:2015 §4.3 -- classification decision and rationale',
        ],
        classifier: (input) => {
            if (/\b(?:software\s+safety\s+class(?:ification)?|safety\s+class(?:ification)?\s+(?:decision|rationale|record|review))\b/i.test(input))
                return true;
            if (/\b(?:classification\s+(?:rationale|justification|review)\s+(?:document|record)|reclassif(?:y|ication))\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * ANOMALY_REPORT -- software anomaly records (IEC 62304 §9).
     * Any condition in software that may be a defect. Anomaly reports
     * must be evaluated, tracked, and resolved per class requirements.
     * Class B anomaly reports are REVIEWED (approval queue).
     */
    ANOMALY_REPORT: {
        references: [
            'IEC 62304:2006+A1:2015 §9 -- software problem and change resolution',
        ],
        classifier: (input) => {
            if (/\b(?:software\s+anomaly|anomaly\s+report|anomaly\s+(?:log|record|evaluation|resolution))\b/i.test(input))
                return true;
            if (/\b(?:problem\s+(?:report|record)\s+(?:software|device\s+software)|defect\s+(?:report|record)\s+(?:IEC|62304|device))\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * CONFIGURATION_ITEM -- controlled software configuration items (IEC 62304 §8.1).
     * Software items placed under configuration management. Includes all
     * software deliverables: source code, object code, tools, records.
     */
    CONFIGURATION_ITEM: {
        references: [
            'IEC 62304:2006+A1:2015 §8.1 -- software configuration management planning',
            'IEC 62304:2006+A1:2015 §8.2 -- change control',
        ],
        classifier: (input) => {
            if (/\b(?:configuration\s+item|CI\s+(?:record|identifier|baseline)|software\s+(?:baseline|version\s+record))\b/i.test(input))
                return true;
            if (/\b(?:software\s+configuration\s+(?:management|control|record)|SCM\s+(?:record|plan|baseline))\b/i.test(input))
                return true;
            return false;
        },
    },
};
/**
 * IEC 62304 Medical Device Software Compliance Pack.
 *
 * Pack ID: 'iec-62304'
 * Jurisdiction: International (IEC standard; adopted globally by
 *   FDA, EU MDR/IVDR, MHRA, TGA, Health Canada, and others as the
 *   referenced software life cycle standard).
 *
 * Guard-layer wiring:
 *   - G1-G4 (audit, logging, classification, session): always active
 *   - G5-G6 (supply-chain, approval-queue): Class B and C only
 *   - G7-G9 (attestation, anomaly-detection, transparency): Class C only
 *   - Approval Queue: always active (mandatory for anomaly triage)
 *
 * Human-in-loop tier:
 *   - T1: Class A (basic human review for anomaly closure + SOUP approval)
 *   - T2: Class B + C (specialist clinical safety review required)
 */
export const IEC_62304_PACK = {
    categoryClassifiers: IEC_62304_CATEGORY_CLASSIFIERS,
    /**
     * SOUP and anomaly records may be linked to specific software items
     * (configuration items) that are subject-keyed per device component.
     */
    subjectKeyedCategories: ['SOUP', 'ANOMALY_REPORT', 'CONFIGURATION_ITEM'],
    id: 'iec-62304',
    name: 'IEC 62304 Medical Device Software',
    version: '1.0.0',
    description: 'IEC 62304:2006+A1:2015 medical device software life cycle processes. ' +
        'Mandates software safety classification (Class A / B / C), SOUP evaluation ' +
        'and documentation, risk-management integration (ISO 14971), configuration ' +
        'management, anomaly resolution, and traceability. Adopted by FDA, EU MDR, ' +
        'MHRA UKCA, TGA, and Health Canada as the baseline software QMS standard.',
    authority: 'International Electrotechnical Commission (IEC)',
    industries: [
        'medical-devices',
        'digital-health',
        'clinical-decision-support',
        'diagnostic-ai',
        'therapeutic-ai',
        'medical-device-firmware',
        'embedded-medical-software',
        'software-as-medical-device',
        'in-vitro-diagnostics',
        'wearable-health',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Software safety class (A/B/C) tracking; mandatory for every IEC 62304 process gate. ' +
                'Class C requires verification at every development phase.',
            reference: 'IEC 62304:2006+A1:2015 §4.3 -- safety classification; §5 -- software development planning',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident records for software life cycle artefacts (design records, ' +
                'verification records, anomaly reports, SOUP evaluations). ' +
                'Immutability required for regulatory submission evidence packages.',
            reference: 'IEC 62304:2006+A1:2015 §5.1.1 -- development plan; §9 -- problem and change resolution',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'SOUP detection and classification; software safety class signal detection; ' +
                'anomaly report categorisation; configuration item tracking.',
            reference: 'IEC 62304:2006+A1:2015 §3.1.17 -- SOUP; §4.3 -- classification',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'SOUP inventory and evaluation tracking. IEC 62304 §8 requires a comprehensive ' +
                'list of all SOUP items with known anomaly records and published errata evaluated. ' +
                'AI frameworks, LLM inference libraries, and OS components all qualify as SOUP.',
            reference: 'IEC 62304:2006+A1:2015 §8 -- software items of unknown provenance (SOUP)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Anomaly triage and closure approval routing per class. Class C anomaly closure ' +
                'requires documented evaluation of patient safety impact before resolution. ' +
                'SOUP introduction approval gate for Class B + C.',
            reference: 'IEC 62304:2006+A1:2015 §9 -- software problem resolution; §8 -- SOUP',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Software release attestations; Class C unit verification evidence; ' +
                'SOUP evaluation attestations; software safety classification rationale sign-off.',
            reference: 'IEC 62304:2006+A1:2015 §5.8 -- software release; §8 -- SOUP evaluation',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Software development plan records must persist for device lifetime. ' +
                'Continuity of audit trail across sessions is mandatory.',
            reference: 'IEC 62304:2006+A1:2015 §5.1.1 -- software development records retention',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Real-time detection of software anomaly signals in AI-generated code output. ' +
                'Flags conditions that may require anomaly report initiation under §9.',
            reference: 'IEC 62304:2006+A1:2015 §9.1 -- prepare software problem report',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Software item intended use disclosure; AI-generated code provenance disclosure ' +
                'to clinical engineering and regulatory affairs teams.',
            reference: 'IEC 62304:2006+A1:2015 §5.2 -- software requirements analysis (intended use)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Anomaly report lifecycle event routing; SOUP evaluation status events; ' +
                'software release event tracking.',
            reference: 'IEC 62304:2006+A1:2015 §9 -- problem resolution lifecycle',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            softwareSafetyClassTrackingRequired: true,
            iec62304ClassAProcessRequired: true,
            iec62304ClassBProcessRequired: true,
            iec62304ClassCProcessRequired: true,
            classificationRationaleRequired: true,
        },
        'approval-queue': {
            soupIntroductionApprovalRequired: true,
            classCAnomályClosureApprovalRequired: true,
            classBAnomályClosureApprovalRequired: true,
            humanInLoopTierClassA: 'T1',
            humanInLoopTierClassBC: 'T2',
        },
        'attestation-manager': {
            softwareReleaseAttestationRequired: true,
            soupEvaluationAttestationRequired: true,
            classificationRationaleSignOffRequired: true,
            classCUnitVerificationEvidenceRequired: true,
        },
        'supply-chain': {
            soupInventoryRequired: true,
            soupPublishedErrataEvaluationRequired: true,
            soupKnownAnomalyEvaluationRequired: true,
            aiFrameworkSoupClassificationRequired: true,
        },
        'anomaly-detector': {
            softwareAnomalySignalDetectionActive: true,
            classCAnomályImmediateEscalationRequired: true,
        },
        'transparency-injector': {
            intendedUseDisclosureRequired: true,
            aiGeneratedCodeProvenanceDisclosureRequired: true,
        },
        'event-bus': {
            anomalyReportLifecycleEventsActive: true,
            soupEvaluationStatusEventsActive: true,
            softwareReleaseEventsActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['IEC-62304-READY', 'MEDICAL-DEVICE-SW-LIFECYCLE'],
        blockReasons: {
            deepseek: 'PRC jurisdiction; cannot support IEC 62304 SOUP audit trail or ' +
                'medical device software life cycle records under PRC data law constraints.',
            baidu: 'PRC jurisdiction; medical device software provenance and SOUP evaluation ' +
                'records incompatible with PRC data residency obligations.',
            alibaba: 'PRC jurisdiction; Class C SOUP and safety classification records must ' +
                'remain under verifiable non-PRC jurisdiction control.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'SOUP',
            'MEDICAL_DEVICE_SOFTWARE_CLASS_A',
            'MEDICAL_DEVICE_SOFTWARE_CLASS_B',
            'MEDICAL_DEVICE_SOFTWARE_CLASS_C',
            'RISK_MANAGEMENT_FILE',
            'SOFTWARE_SAFETY_CLASSIFICATION',
            'ANOMALY_REPORT',
            'CONFIGURATION_ITEM',
        ],
        categoryActions: {
            // Class A: logging is sufficient for audit; no blocking required
            MEDICAL_DEVICE_SOFTWARE_CLASS_A: 'LOG',
            // Class B: anomaly reports go to approval queue (REVIEWED)
            MEDICAL_DEVICE_SOFTWARE_CLASS_B: 'LOG',
            // Class C: SOUP introduction without documented evaluation is BLOCKED
            MEDICAL_DEVICE_SOFTWARE_CLASS_C: 'LOG',
            // SOUP: blocked at Class C (enforced via guard-layer config), logged otherwise
            SOUP: 'BLOCK',
            // Risk management file data always logged for traceability
            RISK_MANAGEMENT_FILE: 'LOG',
            // Classification artefacts require human sign-off (REVIEWED)
            SOFTWARE_SAFETY_CLASSIFICATION: 'REVIEWED',
            // Anomaly reports: trigger review workflow
            ANOMALY_REPORT: 'REVIEWED',
            // Configuration items: logged for traceability
            CONFIGURATION_ITEM: 'LOG',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        /**
         * IEC 62304 §5.1.1: records for the expected lifetime of the medical device.
         * Cross-referencing FDA 21 CFR 820.180 (min 2 years, device lifetime typical),
         * EU MDR PMS obligations (device lifetime + post-market period), and MHRA
         * guidance: effective industry practice is 10 years minimum (3650 days).
         * AI-generated code artefacts and SOUP evaluations are device-lifetime records.
         */
        sovereignty: ['international'],
        auditLogRetentionDays: 3650, // 10 years -- device lifetime + post-market
        sessionRetentionDays: 3650,
        incidentRetentionDays: 3650,
        reference: 'IEC 62304:2006+A1:2015 §5.1.1 -- records retained for device lifetime. ' +
            'Cross-reference: FDA 21 CFR 820.180 (QMSR records); EU MDR 2017/745 ' +
            'post-market surveillance obligations. Effective minimum: 10 years.',
    },
    incidentPolicy: {
        /**
         * IEC 62304 §9 anomaly resolution: no calendar deadline for anomaly closure,
         * but risk-proportionate urgency is required. For regulatorily-reportable
         * incidents (MDR, FSCA, MAUDE): the relevant jurisdiction's reporting deadline
         * applies (15-30 days per applicable regulation). Using 360 hours (15 days)
         * as the most restrictive cross-jurisdictional baseline (MHRA serious incident).
         */
        notificationDeadlineHours: 360, // 15 days -- MHRA serious incident baseline
        reference: 'IEC 62304:2006+A1:2015 §9 -- software problem resolution; risk-proportionate ' +
            'urgency required. Jurisdictional incident reporting deadlines apply separately ' +
            '(MHRA 15 days; FDA MDR 30 days; EU MDR 15 days for serious incidents).',
        requiredRecipients: [
            'clinical-safety-officer',
            'quality-management',
            'regulatory-affairs',
            'risk-management',
        ],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'iec62304-safety-class',
            description: 'Software safety class (A, B, or C) assigned and documented with rationale ' +
                'derived from ISO 14971 risk management analysis',
            reference: 'IEC 62304:2006+A1:2015 §4.3; ISO 14971:2019 risk management cross-reference',
            check: 'iec62304_safety_class_assigned',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iec62304-soup-inventory',
            description: 'SOUP inventory on file; all software items of unknown provenance identified, ' +
                'published errata evaluated, known anomaly lists reviewed per class requirements',
            reference: 'IEC 62304:2006+A1:2015 §8 -- SOUP requirements',
            check: 'iec62304_soup_inventory_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iec62304-development-plan',
            description: 'Software development plan established; scope, standards, tools, and ' +
                'deliverables defined; class-appropriate life cycle model selected',
            reference: 'IEC 62304:2006+A1:2015 §5.1 -- software development planning',
            check: 'iec62304_development_plan_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62304-requirements-analysis',
            description: 'Software requirements documented with functional, performance, interface, ' +
                'and safety requirements including constraints derived from risk management',
            reference: 'IEC 62304:2006+A1:2015 §5.2 -- software requirements analysis',
            check: 'iec62304_requirements_analysis_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62304-architecture',
            description: 'Software architecture documented; software items identified; ' +
                'Class B + C: separate software unit identification required',
            reference: 'IEC 62304:2006+A1:2015 §5.3 -- software architectural design',
            check: 'iec62304_architecture_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62304-class-c-unit-verification',
            description: 'Class C: software unit verification procedures executed; acceptance ' +
                'criteria defined and results documented for every software unit',
            reference: 'IEC 62304:2006+A1:2015 §5.5 -- software unit verification (Class C)',
            check: 'iec62304_class_c_unit_verification_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iec62304-integration-testing',
            description: 'Software integration testing executed; Class B + C: integration test ' +
                'plan, procedures, and results documented per integrated software item',
            reference: 'IEC 62304:2006+A1:2015 §5.6 -- software integration and integration testing',
            check: 'iec62304_integration_testing_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62304-system-testing',
            description: 'Software system testing executed; test plan, procedures, and results ' +
                'documented; regression testing for changes',
            reference: 'IEC 62304:2006+A1:2015 §5.7 -- software system testing',
            check: 'iec62304_system_testing_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62304-release-records',
            description: 'Software release records on file; software version label, list of ' +
                'software items, known residual anomalies documented prior to release',
            reference: 'IEC 62304:2006+A1:2015 §5.8 -- software release',
            check: 'iec62304_release_records_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62304-config-management',
            description: 'Software configuration management plan active; all software items ' +
                'placed under configuration control; change control procedures enforced',
            reference: 'IEC 62304:2006+A1:2015 §8.1-§8.4 -- configuration management',
            check: 'iec62304_config_management_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62304-anomaly-resolution',
            description: 'Software anomaly resolution process active; anomaly reports evaluated ' +
                'for patient safety impact; Class C closure requires documented safety review',
            reference: 'IEC 62304:2006+A1:2015 §9 -- software problem and change resolution',
            check: 'iec62304_anomaly_resolution_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iec62304-class-c-soup-block',
            description: 'Class C: unauthorised SOUP introduction blocked; every SOUP addition ' +
                'requires documented evaluation of published anomalies and errata before ' +
                'use in safety-critical software paths',
            reference: 'IEC 62304:2006+A1:2015 §8 -- SOUP (Class C strictest requirements)',
            check: 'iec62304_class_c_soup_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iec62304-behavioral-validator-class-c-change',
            description: 'Behavioral validator: detects unverified software changes to Class C items. ' +
                'Any AI-generated modification to a Class C software unit must be blocked ' +
                'pending unit verification and safety impact evaluation.',
            reference: 'IEC 62304:2006+A1:2015 §5.5 + §6.1 -- unit verification; maintenance planning',
            check: 'behavioralValidator_iec62304_class_c_unverified_change',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'iec62304-behavioral-validator-class-b-anomaly',
            description: 'Behavioral validator: Class B anomaly reports enter approval queue for ' +
                'clinical safety officer review before closure. Non-serious injury risk ' +
                'requires documented evaluation prior to anomaly resolution.',
            reference: 'IEC 62304:2006+A1:2015 §9 -- anomaly evaluation and resolution (Class B)',
            check: 'behavioralValidator_iec62304_class_b_anomaly_reviewed',
            failSeverity: 'HIGH',
        },
        {
            id: 'iec62304-maintenance-plan',
            description: 'Software maintenance plan established; problem reporting, change evaluation, ' +
                'and modification processes defined for post-release phase',
            reference: 'IEC 62304:2006+A1:2015 §6 -- software maintenance plan',
            check: 'iec62304_maintenance_plan_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=iec-62304.js.map