/**
 * Health and Social Care Northern Ireland (HSCNI) Compliance Pack
 *
 * Framework: Health and Social Care system in Northern Ireland —
 *   structurally distinct from NHS England + NHS Scotland + NHS Wales.
 *   In NI, health and adult social care are integrated under the same
 *   delivery body (Health and Social Care Trusts), unlike GB.
 *
 *   Statutory basis: Health and Personal Social Services (Northern
 *   Ireland) Order 1972 + 1991, Health and Social Care (Reform) Act
 *   (NI) 2009, Health and Social Care Act (NI) 2022.
 *
 * Jurisdiction: Northern Ireland
 * Authority:
 *   - Department of Health (DoH) — policy
 *   - Strategic Planning and Performance Group (SPPG) — system
 *     management; took over functions of the now-dissolved Health and
 *     Social Care Board (HSCB)
 *   - Six Health and Social Care Trusts: Belfast, Northern, Southern,
 *     South Eastern, Western, NI Ambulance Service
 *   - Public Health Agency (PHA)
 *   - Business Services Organisation (BSO) — shared services + IT
 *   - Northern Ireland Social Care Council (NISCC) — workforce
 *   - Regulation and Quality Improvement Authority (RQIA) — inspector
 *     (NI equivalent of CQC)
 *
 * Why this pack (separate from `nhs-dspt`, `nhs-dtac`, etc.):
 *   - HSCNI is NOT NHS England. NI has its own information-governance
 *     toolkit, its own clinical-safety standards, its own Caldicott
 *     Guardian network, its own incident-response practice.
 *   - HSC IG Toolkit (NI) is the equivalent of NHS DSPT but with
 *     different submission portal, different mandatory questions,
 *     different governance reporting line (DoH not NHS England).
 *   - HSC Intervention and Prevention Recovery Plan + RQIA inspections
 *     have no GB equivalent.
 *   - AI agents handling HSC NI data must satisfy the NI regime.
 *
 * Distinctive HSCNI obligations:
 *   - **HSC IG Toolkit submission** — annual submission to HSC NI
 *     Information Governance Office; equivalent to but distinct from
 *     NHS DSPT
 *   - **Caldicott Guardian (NI)** — each HSC Trust appoints a Caldicott
 *     Guardian under DoH HSC framework
 *   - **HSC encryption standard** — HSC NI cryptographic guidance
 *   - **RQIA inspection evidence** — well-led / safe / effective
 *     inspection (NI equivalent of CQC)
 *   - **Adverse Incident Reporting** — DoH NI adverse-incident pathway
 *     (replaces SAI Strategic Health Authority Investigation framework
 *     used historically; updated 2022)
 *   - **HSC Health and Care Number** — NI patient identifier (similar
 *     to NHS Number but distinct format and registry)
 *
 * AI-specific overlays:
 *   - HSC Health and Care Number detection in inputs / outputs
 *     (10-digit, distinct from NHS Number registry)
 *   - HSC IG Toolkit submission attestation
 *   - Caldicott Guardian (NI) sign-off on cross-trust transfers
 *   - RQIA evidence chain captured for inspection-readiness
 *
 * Out of scope:
 *   - NHS England DSPT / DTAC / Clinical Safety / Caldicott (separate
 *     packs `nhs-dspt`, `nhs-dtac`, `nhs-clinical-safety`,
 *     `caldicott-principles` — those are England-led)
 *   - NHS Scotland / NHS Wales equivalents (separate packs to follow if
 *     needed)
 *   - GB MHRA SaMD UKCA (separate pack; applies UK-wide)
 *
 * @connexum/ai-governance
 */
export const NI_HSCNI_CATEGORY_CLASSIFIERS = {
    HSC_HEALTH_CARE_NUMBER: {
        references: [
            'NI HSC Health and Care Number — patient identifier (10-digit)',
        ],
        classifier: (input) => {
            if (/\b(?:hsc\s+(?:health\s+(?:and\s+)?care\s+number|patient\s+number)|h\s*[\&\+]?\s*c\s+number\s+ni)\b/i.test(input))
                return true;
            if (/\b(?:hcn[:\s]+\d{10}|hcn\s+\d{3}\s\d{3}\s\d{4})\b/i.test(input))
                return true;
            return false;
        },
    },
    HSC_IG_TOOLKIT: {
        references: [
            'HSC NI Information Governance Toolkit submission',
        ],
        classifier: (input) => {
            if (/\b(?:hsc\s+ig\s+toolkit|hscni\s+ig|hsc\s+information\s+governance\s+toolkit)\b/i.test(input))
                return true;
            if (/\b(?:hscni\s+(?:ig|toolkit|submission)|doh\s+ni\s+ig)\b/i.test(input))
                return true;
            return false;
        },
    },
    CALDICOTT_GUARDIAN_NI: {
        references: [
            'DoH NI Caldicott Guardian framework',
        ],
        classifier: (input) => {
            if (/\b(?:caldicott\s+guardian\s+(?:ni|hscni|northern\s+ireland)|hsc\s+caldicott)\b/i.test(input))
                return true;
            return false;
        },
    },
    RQIA_EVIDENCE: {
        references: [
            'Regulation and Quality Improvement Authority (RQIA) inspection',
        ],
        classifier: (input) => {
            if (/\b(?:rqia\s+(?:inspection|notice|report|recommendation)|rqia\s+(?:ni|northern\s+ireland))\b/i.test(input))
                return true;
            if (/\b(?:regulation\s+and\s+quality\s+improvement\s+authority|well[\s-]?led\s+rqia|safe\s+rqia)\b/i.test(input))
                return true;
            return false;
        },
    },
    ADVERSE_INCIDENT_NI: {
        references: [
            'DoH NI adverse-incident reporting (SAI replacement, 2022)',
        ],
        classifier: (input) => {
            if (/\b(?:adverse\s+incident\s+(?:ni|hsc|northern\s+ireland)|sai\s+investigation|serious\s+adverse\s+incident)\b/i.test(input))
                return true;
            if (/\b(?:level\s+(?:1|2|3)\s+adverse\s+incident\s+ni|doh\s+ni\s+adverse\s+report)\b/i.test(input))
                return true;
            return false;
        },
    },
    HSC_TRUST_TRANSFER: {
        references: [
            'Cross-Trust transfer (Belfast / Northern / Southern / South Eastern / Western / NIAS)',
        ],
        classifier: (input) => {
            if (/\b(?:cross[\s-]?trust\s+transfer\s+ni|hsc\s+trust\s+transfer|inter[\s-]?trust\s+share)\b/i.test(input))
                return true;
            if (/\b(?:belfast\s+trust|northern\s+trust\s+ni|southern\s+trust\s+ni|south\s+eastern\s+trust|western\s+trust\s+ni|nias\s+ambulance)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety; HSCNI artefacts must not embed credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const NI_HSCNI_PACK = {
    categoryClassifiers: NI_HSCNI_CATEGORY_CLASSIFIERS,
    id: 'ni-hscni',
    aliases: [
        'hscni',
        'hsc-ni',
        'health-and-social-care-northern-ireland',
        'doh-ni',
        'rqia',
    ],
    name: 'Health and Social Care Northern Ireland (HSCNI)',
    version: '1.0.0',
    contentHash: '617827f22bfa8613e6d61808a672240b39e9d308d9df0a10a2d123c89388a4bf',
    description: 'Northern Ireland Health and Social Care system — structurally distinct from NHS England / NHS Scotland / NHS Wales. Integrated health + adult social care under six HSC Trusts (Belfast, Northern, Southern, South Eastern, Western, NIAS). Distinctive obligations: HSC IG Toolkit (NI equivalent of NHS DSPT), Caldicott Guardian (NI) framework, RQIA inspection evidence, DoH NI adverse-incident reporting (SAI replacement, 2022), HSC Health and Care Number (NI patient identifier). Pairs with `uk-gdpr` (UK-wide personal data); does NOT pair with `nhs-dspt` / `nhs-dtac` / `nhs-clinical-safety` / `caldicott-principles` (those are England-led, separate jurisdiction).',
    authority: 'Department of Health (NI) + Strategic Planning and Performance Group + Six HSC Trusts + Public Health Agency + Business Services Organisation + Northern Ireland Social Care Council + Regulation and Quality Improvement Authority (RQIA)',
    industries: ['healthcare', 'social-care', 'public-sector', 'pharma', 'digital-health'],
    requiredModules: [
        {
            name: 'data-classifier',
            required: true,
            reason: 'HSC Health and Care Number detection (distinct from NHS Number registry); HSC IG Toolkit artefact detection; Caldicott Guardian (NI) sign-off detection; RQIA evidence categorisation.',
            reference: 'NI HSC patient identifier; HSC IG Toolkit',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Default-deny on cross-Trust transfers without Caldicott Guardian (NI) sign-off; HSC IG Toolkit submission gate before HSC data is processed.',
            reference: 'DoH NI Caldicott framework; HSC IG',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'HSC IG Toolkit annual submission; Caldicott Guardian (NI) designation per Trust; RQIA inspection-readiness evidence; HSC Trust-specific attestation.',
            reference: 'HSC IG submission cycle; DoH NI Caldicott framework; RQIA inspection',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'T2 Caldicott Guardian (NI) sign-off on cross-Trust transfers; AI clinical-decision review by HSC clinician; adverse-incident classification approval.',
            reference: 'DoH NI Caldicott framework; DoH NI adverse-incident pathway',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain for HSC IG submissions, Caldicott Guardian sign-offs, RQIA evidence, adverse-incident records — required for RQIA inspection + DoH oversight.',
            reference: 'RQIA inspection evidence requirements',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'DoH NI adverse-incident routing (Level 1 / 2 / 3); RQIA notification pathway; HSC IG Toolkit deadline reminders; cross-Trust transfer events.',
            reference: 'DoH NI adverse-incident pathway',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'HSC smartcard (HSCNI) integration; HSC role-based access; named Caldicott Guardian (NI) per Trust binding.',
            reference: 'HSC NI Identity and Access Management',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'HSC NI cryptographic guidance; HSC data encrypted at rest and in transit per HSC IG Toolkit Section 7 equivalent.',
            reference: 'HSC IG Toolkit cryptographic standards; UK GDPR Art. 32',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'NI Records Management practice — clinical record retention typically aligns with NHS Records Management Code of Practice (8 years adult clinical, 25 paediatric, 30 maternity), with NI-specific overlays.',
            reference: 'DoH NI Records Management practice',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Patient-facing AI use disclosure; HSC NI privacy-notice publication; Welsh-language not applicable (Irish-language considerations under New Decade, New Approach 2020).',
            reference: 'DoH NI patient-facing transparency',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'HSC_HEALTH_CARE_NUMBER',
                'HSC_IG_TOOLKIT',
                'CALDICOTT_GUARDIAN_NI',
                'RQIA_EVIDENCE',
                'ADVERSE_INCIDENT_NI',
                'HSC_TRUST_TRANSFER',
                'CREDENTIALS',
            ],
            hscHealthCareNumberAction: 'BLOCK',
            credentialsAction: 'BLOCK',
        },
        'governance-runtime': {
            crossTrustTransferGateRequired: true,
            hscIgToolkitSubmissionGateRequired: true,
        },
        'attestation-manager': {
            hscIgToolkitAnnualSubmissionTracked: true,
            caldicottGuardianNiPerTrustTracked: true,
            rqiaInspectionEvidenceTracked: true,
        },
        'approval-queue': {
            caldicottGuardianNiSignOffRequired: true,
            adverseIncidentClassificationApprovalRequired: true,
            reviewTier: 'T2',
            reviewerCompetence: 'CALDICOTT_GUARDIAN_NI',
        },
        'audit-integrity': {
            rqiaEvidenceTrackingRequired: true,
            adverseIncidentEvidenceTrackingRequired: true,
        },
        'event-bus': {
            dohNiAdverseIncidentRoutingRequired: true,
            rqiaNotificationPathwayRequired: true,
            hscIgDeadlineRemindersRequired: true,
            crossTrustTransferEventsRequired: true,
        },
        'agent-auth': {
            hscSmartcardIntegrationRequired: true,
            caldicottGuardianNiNamedRoleBindingRequired: true,
        },
        'encryption-layer': {
            algorithm: 'aes-256-gcm',
            hscIgToolkitCryptoStandardRequired: true,
        },
        'session-persistence': {
            retentionDaysAdultClinical: 2920, // 8 years (aligned with GB practice)
            retentionDaysPaediatric: 9125,
            retentionDaysMaternity: 10950,
        },
        'transparency-injector': {
            patientFacingAiDisclosureRequired: true,
            hscNiPrivacyNoticePublicationRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK', 'PROCESSOR-CONTRACT', 'HSCNI-IG-COMPATIBLE'],
        blockReasons: {
            deepseek: 'PRC jurisdiction. HSCNI patient confidential information must reside in UK; PRC routing incompatible with HSC IG Toolkit and DoH NI Caldicott framework.',
            baidu: 'PRC jurisdiction. NI HSC data cannot route through PRC infrastructure.',
            alibaba: 'PRC jurisdiction. NI HSC data cannot route through PRC infrastructure.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'HSC_HEALTH_CARE_NUMBER',
            'HSC_IG_TOOLKIT',
            'CALDICOTT_GUARDIAN_NI',
            'RQIA_EVIDENCE',
            'ADVERSE_INCIDENT_NI',
            'HSC_TRUST_TRANSFER',
            'CREDENTIALS',
        ],
        categoryActions: {
            HSC_HEALTH_CARE_NUMBER: 'BLOCK',
            HSC_IG_TOOLKIT: 'WARN',
            CALDICOTT_GUARDIAN_NI: 'WARN',
            RQIA_EVIDENCE: 'WARN',
            ADVERSE_INCIDENT_NI: 'WARN',
            HSC_TRUST_TRANSFER: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        auditLogRetentionDays: 2920, // 8 years aligned with NI clinical record practice
        sessionRetentionDays: 2920,
        incidentRetentionDays: 2920,
        reference: 'DoH NI Records Management practice; aligned with GB NHS Records Management Code of Practice 2021 + NI overlays',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb-nir', 'gb'],
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'DoH NI adverse-incident reporting; UK GDPR Art. 33 overlay; RQIA notification practice',
        requiredRecipients: [
            'caldicott-guardian-ni',
            'hsc-trust-medical-director',
            'doh-ni-adverse-incident-team',
            'rqia-when-applicable',
            'data-protection-officer',
            'ico',
        ],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'ni-hscni-ig-toolkit-current',
            description: 'HSC IG Toolkit annual submission current; submission evidence captured tamper-evidently.',
            reference: 'HSC IG Toolkit submission cycle',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ni-hscni-caldicott-guardian-named',
            description: 'Caldicott Guardian (NI) named per HSC Trust under engagement; sign-off path wired into approval-queue.',
            reference: 'DoH NI Caldicott framework',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ni-hscni-cross-trust-hitl',
            description: 'Cross-HSC-Trust transfers gated on Caldicott Guardian (NI) sign-off; T2 review.',
            reference: 'DoH NI Caldicott framework',
            check: 'approval_queue_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ni-hscni-data-classifier-active',
            description: 'HSC Health and Care Number detection active with BLOCK action; HSC IG / Caldicott / RQIA / adverse-incident categories surfaced.',
            reference: 'NI HSC patient identifier; HSC IG Toolkit',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ni-hscni-rqia-inspection-readiness',
            description: 'RQIA inspection-readiness evidence current; well-led / safe / effective domain evidence captured.',
            reference: 'RQIA inspection requirements',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ni-hscni-adverse-incident',
            description: 'DoH NI adverse-incident pathway wired; Level 1 / 2 / 3 classification approval triggered.',
            reference: 'DoH NI adverse-incident reporting (SAI replacement 2022)',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ni-hscni-encryption',
            description: 'HSC NI cryptographic guidance applied; HSC data encrypted at rest and in transit.',
            reference: 'HSC IG Toolkit cryptographic standards',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ni-hscni-audit-trail',
            description: 'Tamper-evident audit chain covers HSC IG submissions, Caldicott Guardian sign-offs, RQIA evidence, adverse-incident records.',
            reference: 'RQIA inspection evidence integrity',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'ni-hscni-retention-8yr',
            description: '8-year adult clinical retention (aligned with GB) plus paediatric / maternity overrides.',
            reference: 'DoH NI Records Management practice',
            check: 'retention_policy_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'ni-hscni-credential-block',
            description: 'Plaintext credentials blocked from HSC NI artefacts and audit chain entries.',
            reference: 'HSC IG Toolkit secrets management',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
    ],
};
//# sourceMappingURL=ni-hscni.js.map