/**
 * 42 CFR Part 2 Compliance Pack
 *
 * Confidentiality of Substance Use Disorder (SUD) Patient Records
 * under 42 CFR Part 2 with 2024 Final Rule (HHS/SAMHSA/OCR, effective
 * 25 March 2024; compliance by 16 February 2026). Stricter than HIPAA
 * for SUD data.
 *
 * Standards referenced:
 *   - 42 CFR Part 2 (original SAMHSA regulation)
 *   - 2024 Final Rule (HHS/SAMHSA/OCR)
 *   - CARES Act §3221 (2020) -- broadened permitted disclosures
 *   - HIPAA Breach Notification Rule (adopted by 2024 Final Rule)
 *   - §2.11 Part 2 Program definition
 *   - §2.31-2.33 Consent requirements
 *   - §2.32 Prohibition on Redisclosure Notice
 *   - §2.52 Research exception
 *   - §2.55 Breach notification
 *   - §2.63-2.67 Legal proceedings restrictions
 *
 * Current state (2026):
 *   - Compliance deadline: 16 Feb 2026 (coincides with this pack's
 *     release to clients).
 *   - Part 2 always activates alongside HIPAA + HITECH.
 *   - Legal-proceedings restrictions remain stricter than HIPAA even
 *     after 2024 alignment.
 *
 * @connexum/ai-governance
 */
import { sharedPiiClassifier } from './_base-classifiers.js';
import { sharedPhiClassifier } from './_base-classifiers.js';
/**
 * 42 CFR Part 2 (SUD Confidentiality) category classifiers.
 * Substance Use Disorder records receive stricter-than-HIPAA protection.
 * This pack always activates alongside HIPAA + HITECH.
 */
export const PART2_CATEGORY_CLASSIFIERS = {
    SUD_RECORD: {
        references: ['42 CFR Part 2 §2.11 -- Part 2 program records; substance use disorder patient records'],
        classifier: (input) => {
            if (/\b(?:substance\s+use\s+disorder|SUD\s+(?:record|treatment|patient)|opioid\s+(?:treatment|use\s+disorder|record))\b/i.test(input))
                return true;
            if (/\b(?:methadone\s+(?:clinic|program|patient)|buprenorphine\s+(?:treatment|record)|MAT\s+(?:patient|record|program))\b/i.test(input))
                return true;
            if (/\b(?:Part\s+2\s+(?:record|patient|program)|42\s+CFR\s+Part\s+2|confidentiality\s+of\s+SUD|alcohol\s+abuse\s+(?:record|treatment))\b/i.test(input))
                return true;
            if (/\b(?:drug\s+(?:rehabilitation|abuse\s+treatment|counseling)\s+record|addiction\s+treatment\s+record)\b/i.test(input))
                return true;
            return false;
        },
    },
    PHI: {
        references: ['42 CFR Part 2 §2.55 -- breach notification; PHI in Part 2 programs'],
        // 2024 Final Rule aligns Part 2 breach notification with HIPAA §13402.
        // sharedPhiClassifier implements the HIPAA 18 Safe Harbor identifiers.
        // SUD-specific clinical markers are added here for Part 2 scope.
        classifier: (input) => {
            if (sharedPhiClassifier(input))
                return true;
            if (/\b(?:patient|subject\s+id)[:\s]+\d{6,12}\b/i.test(input))
                return true;
            if (/\b(?:diagnosis|treatment\s+plan|prescription|clinical\s+note|discharge\s+summary)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['42 CFR Part 2 -- personally identifiable information in SUD treatment context'],
        classifier: (input) => {
            if (sharedPiiClassifier(input))
                return true;
            if (/\b(?:full\s+name|home\s+address|phone\s+number|date\s+of\s+birth)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['42 CFR Part 2 -- access controls for Part 2 program systems; 2024 Final Rule security requirements'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const PART2_PACK = {
    categoryClassifiers: PART2_CATEGORY_CLASSIFIERS,
    /** P3.5: SUD records and PHI are inherently subject-keyed per 42 CFR Part 2 (Substance Use Disorder). */
    subjectKeyedCategories: ['SUD_RECORD', 'PHI'],
    id: 'part2',
    name: '42 CFR Part 2 (SUD Records)',
    version: '1.0.0',
    contentHash: '4dcde446f5d1e43c01011920790b7b5a0dd639598029d95e9608bb0de1583ce8',
    description: '42 CFR Part 2 Confidentiality of Substance Use Disorder Patient Records with 2024 Final Rule (compliance deadline 16 Feb 2026). Stricter than HIPAA for SUD data; single-consent TPO model aligned with HIPAA but legal-proceedings restrictions preserved.',
    authority: 'Substance Abuse and Mental Health Services Administration (SAMHSA) + HHS Office for Civil Rights (OCR)',
    industries: ['substance-use-disorder-program', 'behavioral-health', 'healthcare-serving-sud', 'health-information-exchange', 'qualified-service-organization'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Consent gate for every SUD record access; Part 2 Program identification',
            reference: '42 CFR §2.11, §2.31',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit of SUD record access and consent captures',
            reference: '42 CFR §2.32 redisclosure notice + HIPAA-aligned audit',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'SUD record detection + Part 2 segmentation tagging',
            reference: '42 CFR §2.12 applicability; 2024 Final Rule segmentation',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Consent revocation continuity; per-patient access state',
            reference: '42 CFR §2.31(c) revocation',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'QSO agreement verification; HIE oversight',
            reference: '42 CFR §2.11 QSO; Part 2 contractor chain',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Legal proceedings use requires court order + consent review; research IRB review',
            reference: '42 CFR §2.63-2.67 legal proceedings; §2.52 research',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Consent on file, QSO agreement attestation, Part 2 Program self-identification',
            reference: '42 CFR §2.11, §2.31-2.33',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Prohibition on Redisclosure notice injected on every outgoing record',
            reference: '42 CFR §2.32',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detect redisclosure patterns; unusual SUD-record access patterns',
            reference: '42 CFR §2.32',
        },
        {
            name: 'bias-monitor',
            required: true,
            reason: '2024 Final Rule anti-discrimination monitoring for SUD patients',
            reference: '2024 Final Rule anti-discrimination',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Breach notification clock (HIPAA-aligned 60-day per 2024 Final Rule)',
            reference: '42 CFR §2.55 (as amended 2024)',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            consentGateRequired: true,
            part2ProgramIdentificationRequired: true,
            minimumNecessaryEnforcedForSud: true, // stricter than HIPAA
        },
        // TWO-LAYER ARCHITECTURE NOTE (F-NEW-VERA-PACK-C7-03):
        // This 'data-classifier' block is read by the data-classifier module, NOT by
        // PackDrivenClassifier. PackDrivenClassifier reads dataPolicy.categoryActions
        // only (see pack-driven-classifier.ts loadFromPacks()). These two surfaces
        // serve different consumers:
        //
        //   Layer 1 -- PackDrivenClassifier:
        //     dataPolicy.categoryActions.SUD_RECORD = 'BLOCK'
        //     Fires unconditionally on any input matching the SUD_RECORD classifier.
        //     No conditional logic -- any match is blocked.
        //
        //   Layer 2 -- data-classifier module:
        //     moduleConfig['data-classifier'].sudRecordAction = 'BLOCK_WITHOUT_CONSENT'
        //     This is the CONDITIONAL policy: downstream data-classifier can allow a
        //     record through when valid 42 CFR Part 2 consent exists (§2.31-2.33).
        //     The data-classifier module is responsible for implementing the
        //     "pass if consented" logic using this configuration flag.
        //
        // There is NO runtime bug: PackDrivenClassifier intentionally blocks all
        // SUD_RECORD matches (strictest-wins, and unconditional BLOCK is the safer
        // SUD default). The data-classifier module then applies the consent check
        // to determine whether to unlock the record.
        // Note: operational risk here is lower than part11 because unconditional BLOCK
        // is the correct default for SUD records absent verified consent (§2.13(b)).
        'data-classifier': {
            enabledCategories: ['SUD_RECORD', 'PHI', 'PII', 'CREDENTIALS'],
            part2SegmentationRequired: true,
            sudRecordAction: 'BLOCK_WITHOUT_CONSENT',
        },
        'session-persistence': {
            consentRevocationContinuityRequired: true,
            perPatientAccessStateRequired: true,
        },
        'supply-chain': {
            qsoAgreementRequired: true,
            hieOversightRequired: true,
        },
        'approval-queue': {
            legalProceedingsCourtOrderRequired: true,
            researchIrbConsentRequired: true,
        },
        'attestation-manager': {
            consentOnFileRequired: true,
            qsoAgreementAttestationRequired: true,
            part2ProgramSelfIdentificationRequired: true,
        },
        'transparency-injector': {
            prohibitionOnRedisclosureNoticeRequired: true,
        },
        'bias-monitor': {
            sudAntiDiscriminationMonitoringRequired: true,
        },
        'event-bus': {
            breachNotificationSixtyDayClockActive: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba', 'meta', 'mistral'],
        requiredCapabilities: ['BAA', 'PART-2-QSO-READY'],
        blockReasons: {
            deepseek: 'No BAA. PRC jurisdiction incompatible with Part 2 consent requirements.',
            baidu: 'No BAA. PRC jurisdiction.',
            alibaba: 'No BAA. PRC jurisdiction.',
            meta: 'No BAA for self-hosted Llama with SUD records.',
            mistral: 'No standard BAA for Part 2 use.',
        },
    },
    // TWO-LAYER ARCHITECTURE NOTE (continued, F-NEW-VERA-PACK-C7-03):
    // categoryActions is the PackDrivenClassifier surface (Layer 1 -- classification engine).
    // SUD_RECORD: 'BLOCK' is unconditional -- any match blocks regardless of consent status.
    // The data-classifier module (Layer 2) applies 'BLOCK_WITHOUT_CONSENT' logic after
    // PackDrivenClassifier fires, allowing records with valid Part 2 consent to pass through.
    // Consented records: PackDrivenClassifier blocks -> data-classifier unlocks if consented.
    // Non-consented records: blocked at both layers (correct default per §2.13(b)).
    dataPolicy: {
        scanCategories: ['SUD_RECORD', 'PHI', 'PII', 'CREDENTIALS'],
        categoryActions: {
            SUD_RECORD: 'BLOCK',
            PHI: 'BLOCK',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        auditLogRetentionDays: 2190, // 6 years aligned with HIPAA post-2024 Final Rule
        sessionRetentionDays: 2190,
        incidentRetentionDays: 2190,
        reference: '2024 Final Rule alignment with HIPAA 45 CFR 164.530(j) 6-year retention',
    },
    incidentPolicy: {
        notificationDeadlineHours: 1440, // 60 days (HIPAA-aligned per 2024 Final Rule)
        reference: '42 CFR §2.55 (2024 Final Rule) -- 60-day breach notification aligned with HIPAA BNR; 500+ records triggers HHS + media notification.',
        requiredRecipients: ['affected-individuals', 'hhs-ocr', 'samhsa', 'privacy-officer', 'part-2-program-director'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'part2-consent-gate',
            description: 'Consent required for every SUD record access (§2.31)',
            reference: '42 CFR §2.31',
            check: 'part2_consent_gate_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'part2-legal-proceedings',
            description: 'Legal-proceedings use gated on court order + consent (§2.63-2.67)',
            reference: '42 CFR §2.63-2.67',
            check: 'part2_legal_proceedings_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'part2-segmentation',
            description: 'Part 2 segmentation active in combined EHR environments',
            reference: '42 CFR §2.12; 2024 Final Rule',
            check: 'part2_segmentation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'part2-redisclosure-notice',
            description: 'Prohibition on Redisclosure notice injected on outgoing records (§2.32)',
            reference: '42 CFR §2.32',
            check: 'part2_redisclosure_notice_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'part2-revocation',
            description: 'Consent revocation continuity enforced',
            reference: '42 CFR §2.31(c)',
            check: 'part2_revocation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'part2-qso-agreement',
            description: 'QSO agreement on file for every contractor handling SUD records',
            reference: '42 CFR §2.11 QSO',
            check: 'part2_qso_agreement_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'part2-minimum-necessary',
            description: 'Minimum-necessary standard enforced (stricter than HIPAA)',
            reference: '42 CFR §2.13(d)',
            check: 'part2_minimum_necessary_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'part2-research',
            description: 'Research disclosures gated on IRB approval + patient consent',
            reference: '42 CFR §2.52',
            check: 'part2_research_gate_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'part2-breach-notification',
            description: 'HIPAA-aligned 60-day breach notification (2024 Final Rule)',
            reference: '42 CFR §2.55 (2024)',
            check: 'part2_breach_60d_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'part2-anti-discrimination',
            description: 'SUD patient anti-discrimination monitoring (2024 Final Rule)',
            reference: '2024 Final Rule anti-discrimination',
            check: 'part2_anti_discrimination_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'part2-audit-trail',
            description: 'Tamper-evident audit trail of SUD record access',
            reference: '42 CFR §2.32 + HIPAA-aligned',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=part2.js.map