/**
 * Common Rule (45 CFR 46) Compliance Pack
 *
 * HHS Protection of Human Subjects regulations (45 CFR Part 46).
 * 2018 Revised Common Rule effective January 21, 2019. Subparts:
 *   A: Basic HHS Policy (all federally funded research on human subjects).
 *   B: Additional protections for pregnant women, human fetuses, neonates
 *      (45 CFR 46.201-207).
 *   C: Additional protections for prisoners (45 CFR 46.301-306).
 *   D: Additional protections for children (45 CFR 46.401-409).
 *
 * NIH overlay: NIH Grants Policy Statement Section 3.1; NIH Single IRB
 * Policy (effective January 25, 2018); NIH 2023 Data Management and
 * Sharing Policy (intersects when research data is shared -- see NIH
 * DMS pack).
 *
 * AI systems that process, analyze, summarize, or generate outputs
 * from identifiable human subjects research data operate as instruments
 * of research and are subject to Common Rule through the covered
 * institution's Federalwide Assurance (FWA).
 *
 * Key obligations for AI systems:
 *
 *   - 45 CFR 46.109: IRB review and approval required before research
 *     commences. AI systems used in research must be within scope of
 *     an approved IRB protocol.
 *   - 45 CFR 46.116: Informed consent required from each subject or
 *     legally authorized representative. AI must not process subject
 *     data without evidence that consent was obtained.
 *   - 45 CFR 46.116(b)(8): Right to withdraw consent without penalty.
 *     Data from withdrawn-consent subjects must not be processed by AI.
 *   - 45 CFR 46.116(d): Broad consent option for secondary research.
 *     AI use of broad-consent data requires scope confirmation.
 *   - 45 CFR 46.408 (Subpart D): Parental permission + child assent
 *     for pediatric research. Dual gate required.
 *   - 45 CFR 46.305 (Subpart C): Prisoner research requires IRB
 *     Prisoner Advocate review. Restricted permissible categories.
 *   - 42 USC 241(d); NOT-OD-17-109: NIH Certificate of Confidentiality
 *     prohibits disclosure of identifiable research data in any
 *     federal, state, or local proceeding. AI vendors receiving CoC-
 *     protected data must acknowledge this obligation.
 *   - 45 CFR 46.116; HHS DUA guidance (2004): Data use agreements
 *     required for sharing limited datasets with AI vendors.
 *   - 45 CFR 46.115(b): IRB and consent records retained 3 years
 *     after research ends; NIH may require longer per grant terms
 *     (citation to verify current NIH GPS section).
 *
 * Cross-pack interactions:
 *   - Common Rule + HIPAA: When research data contains PHI, both
 *     packs are active. HIPAA Privacy Rule 45 CFR 164.512(i) provides
 *     a research exception requiring authorization or IRB waiver.
 *     Common Rule IRB approval does not automatically satisfy HIPAA
 *     authorization. Both packs run; HIPAA governs breach notification
 *     clock; Common Rule governs OHRP reporting.
 *   - Common Rule + FERPA: Student records in education research are
 *     simultaneously FERPA-protected and potentially Common Rule-
 *     covered. FERPA 34 CFR 99.35 requires DUA; Common Rule requires
 *     IRB approval. More restrictive controls apply; cross-check DUA.
 *   - Common Rule + NIH DMS: Research data from Common Rule studies
 *     subject to 2023 NIH Data Management and Sharing Policy. Both
 *     packs active for NIH-funded human subjects research. Common Rule
 *     consent terms determine whether AI can access data for DMS-
 *     required sharing. Consent scope limits override DMS obligations.
 *   - Common Rule + COPPA: Pediatric research subjects covered by
 *     both Subpart D (parental permission) and COPPA (parental consent
 *     for online collection). Both packs must be active. In combination
 *     with HIPAA on pediatric clinical research, triggers
 *     TRIPLE_COVERAGE_ALERT.
 *
 * UF Health exposure: Loss of NIH funding (historically exceeding
 * $200M annually at UF; citation to verify current year total) is
 * the primary institutional risk. Even a temporary restriction during
 * OHRP investigation would constitute existential risk.
 *
 * Sovereignty: US Federal (HHS/NIH). FWA-covered institutions are
 * subject to Common Rule regardless of funding source for activities
 * covered by the assurance.
 *
 * @connexum/ai-governance
 */
/**
 * Common Rule category classifiers for the pack-driven classifier (W1).
 */
export const COMMON_RULE_CATEGORY_CLASSIFIERS = {
    RESEARCH_SUBJECT_ID: {
        references: ['45 CFR 46.102(e) -- identifiable private information or biospecimen'],
        classifier: (input) => {
            // Subject/participant ID patterns common in research contexts
            if (/\b(?:subject[_\-\s]?(?:id|number|#)|participant[_\-\s]?(?:id|number|#)|study[_\-\s]?(?:id|number|#))\s*[=:]\s*\w+/i.test(input))
                return true;
            // Research subject identifier with sequential or formatted pattern
            if (/\b(?:SUBJ|PART|RES)-?\d{3,12}\b/i.test(input))
                return true;
            if (/\bRESEARCH_SUBJECT_ID\b/i.test(input))
                return true;
            return false;
        },
    },
    IRB_PROTOCOL_DATA: {
        references: ['45 CFR 46.109 -- IRB review; 45 CFR 46.102(l) -- research definition'],
        classifier: (input) => {
            if (/\b(?:irb.?protocol|irb.?approval|irb.?number|protocol.?id|ufirb|irb.?\d{4,})\b/i.test(input))
                return true;
            if (/\bIRB_PROTOCOL_DATA\b/i.test(input))
                return true;
            return false;
        },
    },
    WITHDRAWN_CONSENT_SUBJECT: {
        references: ['45 CFR 46.116(b)(8) -- right to withdraw consent without penalty'],
        classifier: (input) => {
            if (/\b(?:withdrawn.consent|consent.withdrawn|revoked.consent|withdrew.from.study|WITHDRAWN_CONSENT_SUBJECT)\b/i.test(input))
                return true;
            return false;
        },
    },
    VULNERABLE_POPULATION_CHILD: {
        references: ['45 CFR 46 Subpart D (46.401-409) -- additional protections for children in research'],
        classifier: (input) => {
            if (/\b(?:pediatric.subject|child.participant|minor.research.subject|child.assent|parental.permission.research|VULNERABLE_POPULATION_CHILD)\b/i.test(input))
                return true;
            return false;
        },
    },
    VULNERABLE_POPULATION_PRISONER: {
        references: ['45 CFR 46 Subpart C (46.301-306) -- additional protections for prisoners'],
        classifier: (input) => {
            if (/\b(?:prisoner.research|incarcerated.participant|correctional.research.subject|prisoner.advocate|Subpart.C|VULNERABLE_POPULATION_PRISONER)\b/i.test(input))
                return true;
            return false;
        },
    },
    VULNERABLE_POPULATION_PREGNANT: {
        references: ['45 CFR 46 Subpart B (46.201-207) -- protections for pregnant women, fetuses, neonates'],
        classifier: (input) => {
            if (/\b(?:pregnant.research.subject|fetal.research|neonatal.research.subject|Subpart.B.participant|VULNERABLE_POPULATION_PREGNANT)\b/i.test(input))
                return true;
            return false;
        },
    },
    BIOSPECIMEN_LINKED_TO_SUBJECT: {
        references: ['45 CFR 46.102(e) -- identifiable biospecimen = human subject data'],
        classifier: (input) => {
            if (/\b(?:biospecimen.linked|tissue.sample.id|blood.sample.subject|biological.specimen.identifier|BIOSPECIMEN_LINKED_TO_SUBJECT)\b/i.test(input))
                return true;
            // Biospecimen pattern with linkage indicator
            if (/\b(?:sample|specimen|biopsy|blood|tissue)\b.*\b(?:subject[_\-\s]?id|participant[_\-\s]?id|linked|identifiable)\b/i.test(input))
                return true;
            return false;
        },
    },
    BROAD_CONSENT_FUTURE_USE: {
        references: ['45 CFR 46.116(d) -- broad consent for future unspecified research'],
        classifier: (input) => {
            if (/\b(?:broad.consent|future.use.consent|unspecified.research.consent|secondary.research.use|BROAD_CONSENT_FUTURE_USE)\b/i.test(input))
                return true;
            return false;
        },
    },
    COC_PROTECTED_DATA: {
        references: ['42 USC 241(d) -- Certificate of Confidentiality; NOT-OD-17-109'],
        classifier: (input) => {
            if (/\b(?:certificate.of.confidentiality|CoC.protected|coc.data|not.od.17.109|PROTECTED_RESEARCH_CoC|COC_PROTECTED_DATA)\b/i.test(input))
                return true;
            return false;
        },
    },
    DUA_REQUIRED_DATASET: {
        references: ['45 CFR 46.116; HHS DUA guidance 2004 -- data use agreements for limited datasets'],
        classifier: (input) => {
            if (/\b(?:data.use.agreement|DUA.required|limited.dataset.dua|dua.dataset|DUA_REQUIRED_DATASET)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * GAP-5: IRB_APPROVAL_EXPIRED -- detects expired IRB approvals.
     * Pattern: IRB/protocol language in proximity to a past-date string or
     * the word "expired". Action: BLOCK.
     * Reference: 45 CFR 46.109 (IRB review required before research commences).
     */
    IRB_APPROVAL_EXPIRED: {
        references: ['45 CFR 46.109 -- IRB approval required; expired approval is non-compliance; GAP-5'],
        classifier: (input, _ctx) => {
            if (/\bIRB_APPROVAL_EXPIRED\b/i.test(input))
                return true;
            // Explicit "expired" keyword near IRB language
            if (/\b(?:irb|protocol)\b.*\bexpir(?:ed|es|ation|y)\b/i.test(input))
                return true;
            if (/\bexpir(?:ed|es|ation|y)\b.*\b(?:irb|protocol)\b/i.test(input))
                return true;
            // Date heuristic: past year (before 2026) in proximity to IRB language
            const hasIRBContext = /\b(?:irb.?approval|irb.?protocol|irb.?number|protocol.?id|ufirb|irb.?\d{4,})\b/i.test(input);
            if (!hasIRBContext)
                return false;
            // Match 4-digit years 2000-2025 (clearly past dates as of 2026)
            const pastYearMatch = /\b(200\d|201\d|202[0-5])\b/.exec(input);
            if (pastYearMatch)
                return true;
            return false;
        },
    },
};
export const COMMON_RULE_PACK = {
    categoryClassifiers: COMMON_RULE_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: Research subject identifiers, vulnerable population data,
     * biospecimens linked to subjects, CoC-protected data, and withdrawn-
     * consent subject data are inherently subject-keyed. Each event must
     * carry a data subject ID to satisfy OHRP accountability requirements
     * under 45 CFR 46.115 and IRB protocol audit obligations.
     */
    subjectKeyedCategories: [
        'RESEARCH_SUBJECT_ID',
        'VULNERABLE_POPULATION_CHILD',
        'VULNERABLE_POPULATION_PRISONER',
        'VULNERABLE_POPULATION_PREGNANT',
        'BIOSPECIMEN_LINKED_TO_SUBJECT',
        'COC_PROTECTED_DATA',
        'WITHDRAWN_CONSENT_SUBJECT',
    ],
    id: 'common-rule',
    name: 'Common Rule (Human Subjects Research Protection)',
    version: '1.0.0',
    description: 'HHS Protection of Human Subjects (45 CFR Part 46) compliance for AI systems processing identifiable human subjects research data. Covers IRB approval gate, informed consent verification, withdrawn-consent subject exclusion, Subpart D (children) dual-consent gate, Subpart C (prisoners) Prisoner Advocate gate, Subpart B (pregnant women) risk threshold, Certificate of Confidentiality (42 USC 241(d)) block, and Data Use Agreement enforcement before AI access to research datasets. Applies to all NIH-funded and FWA-covered research at federally-supported institutions.',
    authority: 'HHS Office for Human Research Protections (OHRP); NIH Office of Research Integrity',
    industries: ['clinical-research', 'academic-research', 'higher-education', 'health-it', 'biotech', 'federal-grantee'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'IRB approval gate enforcement; withdrawn-consent subject exclusion; vulnerable population dual-gate logic',
            reference: '45 CFR 46.109 (IRB review); 45 CFR 46.116(b)(8) (withdrawal right); 45 CFR 46.408 (Subpart D dual gate)',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident research processing logs with IRB protocol ID; OHRP accountability chain',
            reference: '45 CFR 46.115 (IRB recordkeeping); OHRP audit guidance',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'NIST SP 800-171 / FedRAMP Moderate equivalent security for identifiable research data (NIH IT Security Policy; citation to verify current policy number)',
            reference: 'NIH IT Security Policy (NIH Manual Chapter 2800 series; citation to verify); 45 CFR 46 FWA obligations',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect research subject IDs, IRB protocol markers, vulnerable population flags, CoC-protected data, and DUA-required datasets',
            reference: '45 CFR 46.102(e) (human subject definition); 42 USC 241(d) (CoC)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-subject consent status tracking; withdrawn-consent list maintenance; IRB protocol ID context persistence',
            reference: '45 CFR 46.116 (informed consent); 45 CFR 46.116(b)(8) (withdrawal)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'IRB-approved Data Use Agreement on file before AI vendor receives research subject data; CoC obligations acknowledgment',
            reference: '45 CFR 46.116; HHS DUA guidance (2004); 42 USC 241(d) (CoC provider obligation)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'IRB protocol scope confirmation gate; broad-consent secondary-use scope check; Subpart D parental permission + child assent dual gate',
            reference: '45 CFR 46.109; 45 CFR 46.116(d) (broad consent scope); 45 CFR 46.408 (Subpart D)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Research AI tool documentation in IRB protocol; DUA execution records; CoC provider acknowledgment documentation',
            reference: '45 CFR 46.115(b) (recordkeeping); NIH GPS Section 8.4.1 (citation to verify)',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'UPIRTSO (unanticipated problem involving risk) reporting stream; consent-withdrawal events; OHRP escalation stream',
            reference: '45 CFR 46.108(a)(3) (prompt reporting of problems); OHRP guidance on UPIRTSOs',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Data minimization monitoring; detection of AI use outside approved IRB protocol scope',
            reference: '45 CFR 46 (minimum necessary principle); OHRP serious non-compliance detection',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            irbApprovalRequired: true,
            consentVerificationEnabled: true,
            withdrawnConsentExclusionActive: true,
            subpartDGateEnabled: true,
            subpartCGateEnabled: true,
            dataMinimizationEnforced: true,
        },
        'data-classifier': {
            enabledCategories: [
                'RESEARCH_SUBJECT_ID',
                'IRB_PROTOCOL_DATA',
                'WITHDRAWN_CONSENT_SUBJECT',
                'VULNERABLE_POPULATION_CHILD',
                'VULNERABLE_POPULATION_PRISONER',
                'VULNERABLE_POPULATION_PREGNANT',
                'BIOSPECIMEN_LINKED_TO_SUBJECT',
                'BROAD_CONSENT_FUTURE_USE',
                'COC_PROTECTED_DATA',
                'DUA_REQUIRED_DATASET',
                'IRB_APPROVAL_EXPIRED',
            ],
        },
        'supply-chain': {
            duaRequired: true,
            cocProtectionEnabled: true,
            vendorNoTrainingOnResearchDataRequired: true,
            vendorDataResidencyUSRequired: true,
        },
        'approval-queue': {
            irbApprovalGateRequired: true,
            broadConsentScopeCheckEnabled: true,
            subpartDDualConsentGateRequired: true,
        },
        'attestation-manager': {
            researchAuditEnabled: true,
        },
        'event-bus': {
            upirtsoReportingActive: true,
        },
        'anomaly-detector': {
            researchScopeDeviationDetectionActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'DATA-RESIDENCY-US',
            'ZERO-TRAINING-ON-RESEARCH-DATA',
            'IRB-DUA-ACCEPTANCE',
            'COC-OBLIGATIONS-ACKNOWLEDGED',
            'NIST-800-171-OR-FEDRAMP-MODERATE',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'RESEARCH_SUBJECT_ID',
            'IRB_PROTOCOL_DATA',
            'WITHDRAWN_CONSENT_SUBJECT',
            'VULNERABLE_POPULATION_CHILD',
            'VULNERABLE_POPULATION_PRISONER',
            'VULNERABLE_POPULATION_PREGNANT',
            'BIOSPECIMEN_LINKED_TO_SUBJECT',
            'BROAD_CONSENT_FUTURE_USE',
            'COC_PROTECTED_DATA',
            'DUA_REQUIRED_DATASET',
            'IRB_APPROVAL_EXPIRED',
        ],
        categoryActions: {
            RESEARCH_SUBJECT_ID: 'BLOCK',
            IRB_PROTOCOL_DATA: 'REQUIRE_APPROVAL',
            WITHDRAWN_CONSENT_SUBJECT: 'BLOCK',
            VULNERABLE_POPULATION_CHILD: 'BLOCK',
            VULNERABLE_POPULATION_PRISONER: 'BLOCK',
            VULNERABLE_POPULATION_PREGNANT: 'WARN',
            BIOSPECIMEN_LINKED_TO_SUBJECT: 'BLOCK',
            BROAD_CONSENT_FUTURE_USE: 'REQUIRE_APPROVAL',
            COC_PROTECTED_DATA: 'BLOCK',
            DUA_REQUIRED_DATASET: 'BLOCK',
            IRB_APPROVAL_EXPIRED: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // 45 CFR 46.115(b): consent + IRB records 3 years after research ends.
        // NIH GPS Section 8.4.1 (citation to verify): generally 3 years after
        // final grant report; NIH clinical research may require 7+ years.
        // Runtime default: 7 years to cover NIH clinical research maximum.
        auditLogRetentionDays: 2555, // 7 years (NIH clinical research standard)
        sessionRetentionDays: 2555,
        incidentRetentionDays: 2555,
        reference: '45 CFR 46.115(b) (3 years post-study); NIH GPS Section 8.4.1 (citation to verify; 3-7 years post-grant); HHS/NIH grant terms for clinical research (7 years)',
    },
    incidentPolicy: {
        // OHRP prompt reporting standard: commonly 5-10 business days for
        // UPIRTSOs. HIPAA breach clock (60 days) triggers in parallel if PHI
        // is involved. Internal escalation: 72 hours.
        notificationDeadlineHours: 72,
        reference: '45 CFR 46.108(a)(3) (prompt reporting to IRB and OHRP); OHRP UPIRTSO guidance (5-10 business days); HIPAA 45 CFR 164.400-414 if PHI involved',
        requiredRecipients: ['irb', 'ohrp', 'nih-program-officer', 'affected-research-subjects'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'common-rule-irb-approval-gate',
            description: 'IRB approval on file before AI processes protocol data',
            reference: '45 CFR 46.109 (IRB review and approval)',
            check: 'common_rule_irb_approval_gate',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'common-rule-consent-verification',
            description: 'Informed consent verified for each subject before data processing',
            reference: '45 CFR 46.116 (informed consent requirements)',
            check: 'common_rule_consent_verification',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'common-rule-withdrawn-consent-block',
            description: 'Data from withdrawn-consent subjects excluded from AI processing',
            reference: '45 CFR 46.116(b)(8) (right to withdraw without penalty)',
            check: 'common_rule_withdrawn_consent_block',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'common-rule-dua-required',
            description: 'DUA on file before research data shared with AI provider',
            reference: '45 CFR 46.116; HHS DUA guidance (2004)',
            check: 'common_rule_dua_required',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'common-rule-subpart-d-gate',
            description: 'Parental permission + child assent confirmed for pediatric research subjects',
            reference: '45 CFR 46.408 (Subpart D dual-consent requirement)',
            check: 'common_rule_subpart_d_gate',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'common-rule-coc-block',
            description: 'CoC-protected data not disclosed to AI provider without DUA CoC terms',
            reference: '42 USC 241(d) (Certificate of Confidentiality); NOT-OD-17-109',
            check: 'common_rule_coc_block',
            failSeverity: 'HIGH',
        },
        {
            id: 'common-rule-subpart-c-gate',
            description: 'Prisoner research requires IRB Subpart C approval confirmation',
            reference: '45 CFR 46.305 (Subpart C requirements for prisoner research)',
            check: 'common_rule_subpart_c_gate',
            failSeverity: 'HIGH',
        },
        {
            id: 'common-rule-audit-trail',
            description: 'Research processing events logged with IRB protocol ID for OHRP accountability',
            reference: '45 CFR 46.115 (IRB recordkeeping); OHRP guidance',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'common-rule-behavioral-subject-id-block',
            description: 'Runtime blocks RESEARCH_SUBJECT_ID category without confirmed IRB approval and consent',
            reference: '45 CFR 46.109; 45 CFR 46.116',
            check: 'behavioralValidator_common_rule',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'common-rule-irb-expiry-block',
            description: 'Runtime blocks IRB_APPROVAL_EXPIRED category (GAP-5): expired protocol data must be blocked',
            reference: '45 CFR 46.109 (IRB approval required before research commences)',
            check: 'behavioralValidator_common_rule_irb_expiry',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=common-rule.js.map