/**
 * FDA 21 CFR Part 820 — Quality System Regulation (QSR) Compliance Pack
 *
 * Quality System Regulation for finished medical device manufacturers
 * selling in the United States. Effective since 1996; superseded the
 * 1978 GMP (Good Manufacturing Practices) requirements.
 *
 * Standards referenced:
 *   - 21 CFR Part 820 (QSR) — subparts B through O
 *   - 21 CFR Part 820 Subpart B: Management Responsibility (§ 820.20–820.25)
 *   - 21 CFR Part 820 Subpart C: Design Controls (§ 820.30)
 *   - 21 CFR Part 820 Subpart D: Document Controls (§ 820.40)
 *   - 21 CFR Part 820 Subpart E: Purchasing Controls (§ 820.50)
 *   - 21 CFR Part 820 Subpart F: Identification & Traceability (§ 820.60–820.65)
 *   - 21 CFR Part 820 Subpart G: Production & Process Controls (§ 820.70–820.75)
 *   - 21 CFR Part 820 Subpart J: Corrective & Preventive Action (CAPA) (§ 820.100)
 *   - 21 CFR Part 820 Subpart L: Handling/Storage/Distribution/Installation (§ 820.140–820.170)
 *   - 21 CFR Part 820 Subpart M: Records (§ 820.180–820.198)
 *   - 21 CFR Part 820 Subpart N: Servicing (§ 820.200)
 *   - 21 CFR Part 820 Subpart O: Statistical Techniques (§ 820.250)
 *   - 21 CFR Part 803 (Medical Device Reporting — MDR): 30-day / 5-day clocks
 *   - QMSR (FDA Quality Management System Regulation, Feb 2024): harmonises
 *     21 CFR Part 820 with ISO 13485:2016. Compliance deadline: 6 Feb 2026.
 *     Legacy QSR systems still valid under transition; this pack supports BOTH.
 *
 * Key data records:
 *   DHF  — Design History File (§ 820.30(j))
 *   DMR  — Device Master Record (§ 820.181)
 *   DHR  — Device History Record (§ 820.184)
 *   CAPA — Corrective and Preventive Action record (§ 820.100)
 *
 * Retention: device lifetime + 2 years per § 820.180(b). This pack uses
 * 10,950 days (≈ 30 years) as a conservative representative lifetime + buffer,
 * consistent with FDA industry practice for long-lifetime implantable devices.
 * Implementers MUST configure actual device lifetime for their product class.
 *
 * @connexum/ai-governance
 */
import { sharedPhiClassifier } from './_base-classifiers.js';
// ---------------------------------------------------------------------------
// Category classifiers
// ---------------------------------------------------------------------------
/**
 * FDA 21 CFR Part 820 / QSR category classifiers.
 *
 * Records are classified by their regulatory role under the QSR.
 * Unauthorised modification of controlled records is BLOCKED.
 * Regulated quality records carry mandatory audit trails.
 */
export const FDA_21_CFR_820_CATEGORY_CLASSIFIERS = {
    /**
     * DESIGN_HISTORY_FILE — § 820.30(j)
     * Contains the compiled documentation for a finished device design.
     * Unauthorised modifications are a BLOCK (records must be authorised,
     * dated, and reviewed per § 820.40 document-control procedures).
     */
    DESIGN_HISTORY_FILE: {
        references: ['21 CFR 820.30(j) -- DHF must demonstrate that the design was developed in accordance with the approved design plan'],
        classifier: (input) => {
            if (/\b(?:design\s+history\s+file|DHF)\b/i.test(input))
                return true;
            if (/\bDHF[-_\s]+(?:record|entry|update|modification|draft)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * DEVICE_MASTER_RECORD — § 820.181
     * Contains the procedures and specifications for a finished device.
     * Must be maintained to ensure reproducibility.
     */
    DEVICE_MASTER_RECORD: {
        references: ['21 CFR 820.181 -- DMR: procedures and specifications needed to manufacture a finished device'],
        classifier: (input) => {
            if (/\b(?:device\s+master\s+record|DMR)\b/i.test(input))
                return true;
            if (/\bDMR[-_\s]+(?:record|spec|specification|update|modification)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * DEVICE_HISTORY_RECORD — § 820.184
     * Contains the production history for each manufactured unit or lot.
     * Evidence that the device was manufactured according to the DMR.
     */
    DEVICE_HISTORY_RECORD: {
        references: ['21 CFR 820.184 -- DHR: production history demonstrating device manufactured in conformance with DMR'],
        classifier: (input) => {
            if (/\b(?:device\s+history\s+record|DHR)\b/i.test(input))
                return true;
            if (/\bDHR[-_\s]+(?:record|lot|batch|update|modification)\b/i.test(input))
                return true;
            if (/\b(?:production\s+history|manufacturing\s+lot\s+record)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * CORRECTIVE_ACTION — § 820.100(a)
     * CAPA initiation record. AI agents must route CAPA initiation for human
     * review — this is a quality-management gateway event.
     */
    CORRECTIVE_ACTION: {
        references: ['21 CFR 820.100(a) -- CAPA: identify and implement corrective action to prevent recurrence'],
        classifier: (input) => {
            if (/\b(?:corrective\s+action|CAPA\s+initiation|CAPA[-_\s]+record)\b/i.test(input))
                return true;
            if (/\b(?:root\s+cause\s+analysis|nonconformance\s+investigation|deviation\s+report)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * PREVENTIVE_ACTION — § 820.100(a)(7)
     * Preventive action record — distinct from corrective action; addresses
     * potential (not yet observed) quality failures.
     */
    PREVENTIVE_ACTION: {
        references: ['21 CFR 820.100(a)(7) -- preventive action: identify action to prevent occurrence of nonconformities'],
        classifier: (input) => {
            if (/\b(?:preventive\s+action|preventative\s+action)\b/i.test(input))
                return true;
            if (/\b(?:risk\s+assessment\s+action|quality\s+improvement\s+action)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * MANAGEMENT_REVIEW_RECORD — § 820.20(c)
     * Records of management reviews of the quality system.
     * Must include dates, attendees, results, and actions.
     */
    MANAGEMENT_REVIEW_RECORD: {
        references: ['21 CFR 820.20(c) -- management review: periodic review of quality system suitability and effectiveness'],
        classifier: (input) => {
            if (/\b(?:management\s+review|QMS\s+review\s+record)\b/i.test(input))
                return true;
            if (/\b(?:executive\s+quality\s+review|annual\s+quality\s+review)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * DESIGN_INPUT — § 820.30(c)
     * Physical and performance requirements for the device.
     */
    DESIGN_INPUT: {
        references: ['21 CFR 820.30(c) -- design input: physical and performance requirements for the device'],
        classifier: (input) => {
            if (/\b(?:design\s+input|design\s+requirement|device\s+specification\s+requirement)\b/i.test(input))
                return true;
            if (/\b(?:user\s+need\s+specification|intended\s+use\s+requirement)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * DESIGN_OUTPUT — § 820.30(d)
     * Results of a design phase; must be reviewed and approved.
     */
    DESIGN_OUTPUT: {
        references: ['21 CFR 820.30(d) -- design output: results that meet design input requirements'],
        classifier: (input) => {
            if (/\b(?:design\s+output|design\s+specification|device\s+design\s+output)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * DESIGN_VERIFICATION — § 820.30(f)
     * Confirmation that design output meets design input requirements.
     */
    DESIGN_VERIFICATION: {
        references: ['21 CFR 820.30(f) -- design verification: confirm design output meets design input requirements'],
        classifier: (input) => {
            if (/\b(?:design\s+verification|verification\s+protocol|verification\s+report)\b/i.test(input))
                return true;
            if (/\b(?:OQ|IQ|PQ)\s+(?:protocol|report|record)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * DESIGN_VALIDATION — § 820.30(g)
     * Ensures devices conform to defined user needs and intended uses.
     * Must include risk analysis and clinical or simulated-use testing.
     */
    DESIGN_VALIDATION: {
        references: ['21 CFR 820.30(g) -- design validation: confirm device conforms to defined user needs and intended uses'],
        classifier: (input) => {
            if (/\b(?:design\s+validation|clinical\s+validation\s+record|simulated\s+use\s+test)\b/i.test(input))
                return true;
            if (/\b(?:usability\s+validation|human\s+factors\s+validation)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * DESIGN_CHANGE — § 820.30(i)
     * Design changes must be verified, validated, reviewed, and approved
     * before implementation. AI agents must BLOCK unapproved design changes.
     */
    DESIGN_CHANGE: {
        references: ['21 CFR 820.30(i) -- design changes: verify, validate, review, and approve before implementation'],
        classifier: (input) => {
            if (/\b(?:design\s+change|design\s+change\s+request|DCR|ECO|engineering\s+change\s+order)\b/i.test(input))
                return true;
            if (/\b(?:design\s+modification|design\s+amendment)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * NONCONFORMING_PRODUCT — § 820.90
     * Procedures for controlling product that does not conform to specifications.
     */
    NONCONFORMING_PRODUCT: {
        references: ['21 CFR 820.90 -- nonconforming product: control procedures for non-specification product'],
        classifier: (input) => {
            if (/\b(?:nonconform(?:ing|ance)|non-conform(?:ing|ance)|NCR)\b/i.test(input))
                return true;
            if (/\b(?:rejected\s+(?:product|device|component)|disposition\s+record|MRB\s+record)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * COMPLAINT_RECORD — § 820.198
     * Every complaint received must be evaluated and, if it concerns a
     * malfunction, injury, or death, an MDR may be required.
     */
    COMPLAINT_RECORD: {
        references: ['21 CFR 820.198 -- complaint files: evaluate all complaints; investigate MDR-reportable events'],
        classifier: (input) => {
            if (/\b(?:complaint\s+(?:file|record|report)|customer\s+complaint)\b/i.test(input))
                return true;
            if (/\b(?:adverse\s+event\s+complaint|product\s+complaint)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * MDR_REPORT — § 820.198 + 21 CFR Part 803
     * Medical Device Report — mandatory adverse-event report to FDA.
     * 30-day deadline for death/serious injury; 5-day for unplanned
     * corrective actions to prevent substantial risk (§ 803.53).
     * AI agents must BLOCK delays beyond the 5-day threshold.
     */
    MDR_REPORT: {
        references: [
            '21 CFR 820.198 -- complaint: determine if MDR filing required',
            '21 CFR Part 803 -- MDR: report to FDA within 30 days (death/serious injury) or 5 days (corrective action)',
        ],
        classifier: (input) => {
            if (/\b(?:medical\s+device\s+report|MDR\s+(?:filing|submission|report))\b/i.test(input))
                return true;
            if (/\b(?:adverse\s+event\s+report|MAUDE\s+report|MDR\s+30.?day|MDR\s+5.?day)\b/i.test(input))
                return true;
            if (/\b(?:serious\s+injury\s+report|death\s+report\s+device|device\s+malfunction\s+report)\b/i.test(input))
                return true;
            return false;
        },
    },
    /**
     * PHI — shared classifier (§ 820 QMSR may intersect HIPAA when device
     * processes patient health information).
     */
    PHI: {
        references: ['21 CFR 820 QMSR -- intersection with HIPAA when device or AI system processes patient data'],
        classifier: (input) => {
            return sharedPhiClassifier(input);
        },
    },
    /**
     * CREDENTIALS — access controls per § 820.20 + § 820.40
     */
    CREDENTIALS: {
        references: ['21 CFR 820.20 / 820.40 -- access controls; document control authorisation'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
// ---------------------------------------------------------------------------
// Pack definition
// ---------------------------------------------------------------------------
export const FDA_21_CFR_820_PACK = {
    categoryClassifiers: FDA_21_CFR_820_CATEGORY_CLASSIFIERS,
    /** PHI in a device context is subject-keyed to the patient record. */
    subjectKeyedCategories: ['PHI', 'COMPLAINT_RECORD', 'MDR_REPORT'],
    id: 'fda-21-cfr-820',
    name: 'FDA 21 CFR Part 820 Quality System Regulation (QSR)',
    version: '1.0.0',
    contentHash: 'd82a3a389b99ee92eab2b65b7633d31f9b40a4720ff4ea7b05bee607daa8ddf8',
    description: 'FDA Quality System Regulation (21 CFR Part 820) for finished medical device manufacturers. ' +
        'Covers design controls (DHF/DMR/DHR), CAPA, document controls, complaint files, and MDR ' +
        'reporting (30-day / 5-day clocks). Supports both legacy QSR and the Feb 2026 QMSR ' +
        'transition (harmonised with ISO 13485:2016). Retention: device lifetime + 2 years (§ 820.180).',
    authority: 'US Food and Drug Administration (FDA) — Center for Devices and Radiological Health (CDRH)',
    industries: [
        'medical-devices',
        'digital-health',
        'diagnostic-devices',
        'therapeutic-devices',
        'combination-products',
        'in-vitro-diagnostics',
        'implantable-devices',
        'medical-device-manufacturing',
        'contract-manufacturing-device',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'QSR design-control gate; CAPA workflow management; management review scheduling (§ 820.20 / § 820.30 / § 820.100)',
            reference: '21 CFR 820.20, 820.30, 820.100',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'DHF / DMR / DHR tamper-evident audit trail; § 820.180 records integrity; QMSR audit-chain alignment',
            reference: '21 CFR 820.180 -- records; 21 CFR 820.30(j) DHF; 21 CFR 820.181 DMR; 21 CFR 820.184 DHR',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'QSR data-element classification (DHF / DMR / DHR / CAPA / MDR / complaint); PHI detection at HIPAA intersection',
            reference: '21 CFR 820.30, 820.100, 820.180, 820.198; HIPAA when PHI processed',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human review gate for CAPA initiation; design-change T2 approval; MDR filing authorisation; document-control sign-off (§ 820.40)',
            reference: '21 CFR 820.30(i) design change; 21 CFR 820.40 document control; 21 CFR 820.100 CAPA',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'MDR 30-day and 5-day reporting clocks (21 CFR Part 803); CAPA due-date enforcement; complaint-file SLA alerts',
            reference: '21 CFR Part 803 MDR; 21 CFR 820.100 CAPA; 21 CFR 820.198 complaints',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Design verification / validation attestations (IQ/OQ/PQ); management review attestation; QMSR ISO 13485 alignment evidence',
            reference: '21 CFR 820.30(f)(g) verification and validation; 21 CFR 820.20(c) management review; QMSR 2024',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Purchasing controls (§ 820.50): supplier qualification, approved supplier list, incoming acceptance; component traceability (§ 820.60)',
            reference: '21 CFR 820.50 purchasing controls; 21 CFR 820.60 identification; 21 CFR 820.65 traceability',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Production process monitoring for out-of-control conditions (§ 820.70); complaint trend analysis for MDR signal detection',
            reference: '21 CFR 820.70 production controls; 21 CFR 820.198 complaint files',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Labelling and intended-use disclosure (§ 820.120); design-change disclosure to stakeholders',
            reference: '21 CFR 820.120 device labelling; 21 CFR 820.30(i) design change notification',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Continuous design-history and CAPA continuity across sessions; § 820.180 record availability across device lifetime',
            reference: '21 CFR 820.180 records -- availability throughout device lifetime + 2 years',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            qaSystemValidationRequired: true,
            designControlWorkflowRequired: true,
            capaWorkflowRequired: true,
            managementReviewSchedulingRequired: true,
            documentControlAuthorizationRequired: true,
        },
        'audit-integrity': {
            dhfAuditChainRequired: true,
            dmrAuditChainRequired: true,
            dhrAuditChainRequired: true,
            capaAuditTrailRequired: true,
            qmsrAlignmentRequired: true,
        },
        'approval-queue': {
            capaInitiationReviewRequired: true,
            designChangeT2ReviewRequired: true,
            mdrFilingAuthorizationRequired: true,
            documentControlSignOffRequired: true,
            designOutputReviewRequired: true,
        },
        'event-bus': {
            mdrThirtyDayClockActive: true,
            mdrFiveDayCorrectiveActionClockActive: true,
            capaClosureDueDateEnforcementActive: true,
            complaintFileSlaAlertsActive: true,
        },
        'attestation-manager': {
            designVerificationAttestationRequired: true,
            designValidationAttestationRequired: true,
            managementReviewAttestationRequired: true,
            qmsrIso13485AlignmentEvidenceRequired: true,
        },
        'supply-chain': {
            approvedSupplierListRequired: true,
            supplierQualificationRequired: true,
            incomingAcceptanceRecordRequired: true,
            componentTraceabilityRequired: true,
        },
        'anomaly-detector': {
            productionProcessMonitoringActive: true,
            complaintTrendAnalysisActive: true,
            mdrSignalDetectionActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['FDA-QSR-READY', 'HIPAA-COMPLIANT'],
        blockReasons: {
            deepseek: 'PRC jurisdiction; cannot support FDA QSR supplier oversight, DHF/DMR/DHR controls, or patient-data protection.',
            baidu: 'PRC jurisdiction; clinical and quality-system data protection risk under QSR.',
            alibaba: 'PRC jurisdiction; quality-record and patient-data protection risk under QSR.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'DESIGN_HISTORY_FILE',
            'DEVICE_MASTER_RECORD',
            'DEVICE_HISTORY_RECORD',
            'CORRECTIVE_ACTION',
            'PREVENTIVE_ACTION',
            'MANAGEMENT_REVIEW_RECORD',
            'DESIGN_INPUT',
            'DESIGN_OUTPUT',
            'DESIGN_VERIFICATION',
            'DESIGN_VALIDATION',
            'DESIGN_CHANGE',
            'NONCONFORMING_PRODUCT',
            'COMPLAINT_RECORD',
            'MDR_REPORT',
            'PHI',
            'CREDENTIALS',
        ],
        categoryActions: {
            // Core QSR controlled records — unauthorised modifications are BLOCKED
            DESIGN_HISTORY_FILE: 'BLOCK',
            DEVICE_MASTER_RECORD: 'BLOCK',
            DEVICE_HISTORY_RECORD: 'BLOCK',
            // CAPA initiation goes to human REVIEW (quality gateway event)
            CORRECTIVE_ACTION: 'REVIEW',
            PREVENTIVE_ACTION: 'REVIEW',
            // Management review records — log for audit trail
            MANAGEMENT_REVIEW_RECORD: 'LOG',
            // Design control records — LOG for evidence capture; DESIGN_CHANGE BLOCKED (§ 820.30(i))
            DESIGN_INPUT: 'LOG',
            DESIGN_OUTPUT: 'LOG',
            DESIGN_VERIFICATION: 'LOG',
            DESIGN_VALIDATION: 'LOG',
            DESIGN_CHANGE: 'BLOCK',
            // Quality records — REVIEW for nonconformances; BLOCK for complaint without MDR evaluation
            NONCONFORMING_PRODUCT: 'REVIEW',
            COMPLAINT_RECORD: 'REVIEW',
            // MDR — BLOCK on late-filing detection (> 5 days for corrective-action reports)
            MDR_REPORT: 'BLOCK',
            PHI: 'BLOCK',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // § 820.180(b): records must be retained for the lifetime of the device
        // but no less than 2 years from the date of release for commercial distribution.
        // 10,950 days ≈ 30 years; implementers MUST adjust for actual device class.
        auditLogRetentionDays: 10950,
        sessionRetentionDays: 730,
        incidentRetentionDays: 10950,
        reference: '21 CFR 820.180(b) -- records retained for device lifetime + 2 years (minimum 2 years from commercial release); 10,950 days used as conservative long-lifetime implantable device representative',
    },
    incidentPolicy: {
        // MDR 5-day clock for unplanned corrective actions (21 CFR 803.53)
        notificationDeadlineHours: 120, // 5 days × 24 hours
        reference: '21 CFR Part 803 MDR: 30 days for death/serious injury (§ 803.50); 5 days for unplanned corrective action to prevent substantial risk (§ 803.53). Filed via FDA MAUDE system.',
        requiredRecipients: ['fda-maude', 'quality-leadership', 'regulatory-affairs', 'risk-management', 'medical-affairs'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'fda-820-dhf-controls',
            description: 'Design History File (DHF) maintained per § 820.30(j) with authorised, dated entries',
            reference: '21 CFR 820.30(j)',
            check: 'fda_820_dhf_controls_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fda-820-dmr-controls',
            description: 'Device Master Record (DMR) maintained per § 820.181 — procedures and specifications current',
            reference: '21 CFR 820.181',
            check: 'fda_820_dmr_controls_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fda-820-dhr-controls',
            description: 'Device History Record (DHR) maintained per § 820.184 — production history complete for each lot',
            reference: '21 CFR 820.184',
            check: 'fda_820_dhr_controls_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fda-820-capa',
            description: 'CAPA system active: corrective and preventive actions routed for human review (§ 820.100)',
            reference: '21 CFR 820.100',
            check: 'fda_820_capa_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fda-820-mdr-clock',
            description: 'MDR 30-day / 5-day reporting clocks configured and enforced (21 CFR Part 803)',
            reference: '21 CFR Part 803 (MDR)',
            check: 'fda_820_mdr_clock_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fda-820-design-change-review',
            description: 'Design changes gated by T2 human review before implementation (§ 820.30(i))',
            reference: '21 CFR 820.30(i)',
            check: 'fda_820_design_change_review_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fda-820-document-control',
            description: 'Document control procedures in place: authorisation, dating, and change control (§ 820.40)',
            reference: '21 CFR 820.40',
            check: 'fda_820_document_control_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fda-820-management-review',
            description: 'Management review scheduled and attested at defined intervals (§ 820.20(c))',
            reference: '21 CFR 820.20(c)',
            check: 'fda_820_management_review_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fda-820-design-verification-validation',
            description: 'Design verification (§ 820.30(f)) and validation (§ 820.30(g)) attestations on file',
            reference: '21 CFR 820.30(f)(g)',
            check: 'fda_820_design_vv_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'fda-820-purchasing-controls',
            description: 'Purchasing controls active: approved supplier list, supplier qualification, incoming acceptance (§ 820.50)',
            reference: '21 CFR 820.50',
            check: 'fda_820_purchasing_controls_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fda-820-complaint-files',
            description: 'Complaint file procedures active: evaluation, investigation, MDR determination (§ 820.198)',
            reference: '21 CFR 820.198',
            check: 'fda_820_complaint_files_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fda-820-nonconforming-product',
            description: 'Nonconforming product control procedures active: identification, disposition, MRB (§ 820.90)',
            reference: '21 CFR 820.90',
            check: 'fda_820_nonconforming_product_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fda-820-production-controls',
            description: 'Production and process controls active: monitoring, process validation records (§ 820.70)',
            reference: '21 CFR 820.70',
            check: 'fda_820_production_controls_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fda-820-traceability',
            description: 'Identification and traceability procedures active for all device components and lots (§ 820.60–820.65)',
            reference: '21 CFR 820.60 / 820.65',
            check: 'fda_820_traceability_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'fda-820-records-retention',
            description: 'Records retained for device lifetime + 2 years minimum; audit log configured >= 730 days (§ 820.180)',
            reference: '21 CFR 820.180(b)',
            check: 'fda_820_records_retention_active',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=fda-21-cfr-820.js.map