"use strict";
/**
 * AI in Clinical Decision Support Compliance Pack
 *
 * 21 U.S.C. §360(h) — FDA SaMD definition
 * 21 U.S.C. §360j(o) — 21st Century Cures Act §3060 CDS exclusion
 * FDA September 2022 Clinical Decision Support Guidance
 * FDA AI/ML Action Plan (2021) and AI/ML SaMD Action Plan
 * TX SB 1188 (effective Sept. 1, 2025) + TX HB 149 / TRAIGA (effective Jan. 1, 2026)
 * CA SB 1120 (effective Jan. 1, 2025)
 *
 * Enforces 5 of 7 rules from rules.md:
 *   BLOCK: AICDS-001 (SaMD FDA authorization), AICDS-003 (physician review checkpoint),
 *          AICDS-005 (direct-to-patient without clinician review)
 *   WARN:  AICDS-002 (CDS transparency), AICDS-004 (algorithm version tracking)
 *   INFO:  AICDS-006 (performance monitoring)
 *   SKIP:  AICDS-007 — human-attestation (bias assessment requires review of validation data)
 *
 * @connexum/ai-governance | Kai (CXNI-005) | 2026-05-24
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.AI_CDS_PACK = exports.AI_CDS_CATEGORY_CLASSIFIERS = void 0;
exports.AI_CDS_CATEGORY_CLASSIFIERS = {
    /**
     * AICDS-001 — BLOCK
     * AI functions processing medical images or IVD data to generate patient-specific
     * clinical findings are SaMD and require FDA marketing authorization.
     * 21 U.S.C. §360(h)
     *
     * enforcement_pattern: semantic:samd-function-profile
     * Structural signal: output contains both (a) medical imaging/IVD modality reference
     * AND (b) patient-specific clinical conclusion without FDA authorization reference.
     */
    SAMD_WITHOUT_FDA_AUTHORIZATION: {
        references: ['21 U.S.C. §360(h) — SaMD definition; FDA AI/ML Action Plan 2021'],
        classifier: (input) => {
            // Must contain a medical imaging or IVD modality
            const hasMedicalImaging = /(x.?ray|CT\s+scan|MRI|ultrasound|ECG|EEG|pathology\s+slide|fundus|OCT|optical\s+coherence|in\s+vitro\s+diagnostic|IVD|mammogram|PET\s+scan|DEXA|echocardiogram)/i.test(input);
            if (!hasMedicalImaging)
                return false;
            // Must contain a patient-specific clinical conclusion
            const hasPatientSpecificConclusion = /(diagnosis|finding|classification|probability[_\s]of[_\s]disease|disease\s+probability|risk[_\s]score|clinical\s+conclusion|diagnostic\s+impression|impression\s*[:]\s*[A-Z])/i.test(input);
            if (!hasPatientSpecificConclusion)
                return false;
            // Flag if there is no valid FDA authorization reference value
            // A field containing just null/None is NOT a valid authorization reference
            const hasFDAAuthorizationNull = /(fda[_\s]authorization[_\s]reference["']?\s*:\s*null|fda[_\s]authorization\s*=\s*None)/i.test(input);
            if (hasFDAAuthorizationNull)
                return true;
            const hasFDAAuthorization = /(510\s*\(k\)|510k\s+(cleared?|number|clearance)|De[_\s]Novo\s+(order|cleared?|authorization_type)|PMA\s+(approved?|number)|fda[_\s]cleared?|FDA\s+marketing\s+authorization|authorization[_\s]type|fda[_\s]number["']\s*:\s*["'][A-Z0-9]+)/i.test(input);
            return !hasFDAAuthorization;
        },
    },
    /**
     * AICDS-002 — WARN
     * Non-device CDS claiming §3060 exclusion must include transparent reasoning
     * that a licensed clinician can evaluate independently.
     * 21 U.S.C. §360j(o)(1)(D); FDA September 2022 CDS guidance
     *
     * enforcement_pattern: semantic:cds-transparency-check
     */
    CDS_TRANSPARENCY_MISSING: {
        references: ['21 U.S.C. §360j(o)(1)(D) — CDS exclusion criterion D (independent review basis); FDA Sept 2022 CDS guidance'],
        classifier: (input) => {
            // Must be a clinical decision support output (JSON cds_output field or natural language)
            const isCDS = /\b(clinical\s+decision\s+support|CDS\s+(output|recommendation|alert|suggestion)|clinical\s+(recommendation|suggestion|alert))\b|cds[_\s]output|cds[_\s]type|section[_\s]3060/i.test(input);
            if (!isCDS)
                return false;
            // Flag if evidence_basis is explicitly null (JSON: "evidence_basis":null)
            const evidenceBasisNull = /(evidence[_\s]basis["']?\s*:\s*null)/i.test(input);
            if (evidenceBasisNull)
                return true;
            // Flag if no evidence basis or reasoning summary content is present
            const hasReasoningBasis = /(reasoning[_\s]summary|clinical\s+(rationale|basis|evidence)|based\s+on[:\s]+(evidence|guidelines?|literature|clinical\s+data)|supporting\s+(evidence|rationale)|recommendation\s+basis|basis[_\s]summary|guideline["']?\s*:\s*["'][A-Z])/i.test(input);
            return !hasReasoningBasis;
        },
    },
    /**
     * AICDS-003 — BLOCK
     * AI CDS outputs must not record clinical actions without a documented physician
     * review checkpoint.
     * FDA AI/ML SaMD Action Plan; state medical practice acts
     *
     * enforcement_pattern: semantic:physician-review-checkpoint
     */
    PHYSICIAN_REVIEW_CHECKPOINT_MISSING: {
        references: ['FDA AI/ML SaMD Action Plan — physician review checkpoint for clinical actions'],
        classifier: (input) => {
            // Must show a clinical action was taken or is being automatically placed
            const hasActionTaken = /(order[_\s](placed?|submitted?|created?)|prescription[_\s](generated?|created?|submitted?)|treatment[_\s](initiated?|started?|ordered?)|result[_\s](transmitted?|sent|released?\s+to\s+patient)|ehr\.place_order|place_order\(|auto.?initiated|orders?\s+auto|automatically\s+place|auto\s+order)/i.test(input);
            if (!hasActionTaken)
                return false;
            // Check for physician review checkpoint (required flag, blocked auto-orders, or documented review)
            const hasReviewCheckpoint = /(clinician[_\s]review[_\s](timestamp|completed?|documented?)|physician[_\s](review|approval|sign.?off)[_\s](timestamp|completed?|documented?|npi)|reviewed[_\s]by[_\s](clinician|physician)\s+on|clinician[_\s]npi[:\s]+\d{10}|physician[_\s]review[_\s]required\s*=\s*(True|true|1|yes)|auto[_\s]order[_\s]blocked\s*=\s*(True|true|1|yes))/i.test(input);
            return !hasReviewCheckpoint;
        },
    },
    /**
     * AICDS-004 — WARN
     * Adaptive AI/ML models must track algorithm version and flag changes exceeding
     * the approved Algorithm Change Protocol (ACP) for FDA-cleared SaMD.
     * FDA AI/ML Action Plan — Algorithm Change Protocol
     *
     * enforcement_pattern: semantic:algorithm-version-tracking
     */
    ALGORITHM_VERSION_NOT_TRACKED: {
        references: ['FDA AI/ML Action Plan — Algorithm Change Protocol (ACP) for SaMD'],
        classifier: (input) => {
            // Must be output from an adaptive/ML clinical model
            const isAdaptiveModel = /\b(adaptive\s+(AI|ML|model|algorithm)|machine\s+learning\s+(model|algorithm)|AI\s+(model|algorithm)[_\s](update|change|version)|model\s+(version|update|retrain))\b/i.test(input);
            if (!isAdaptiveModel)
                return false;
            // Check for algorithm version tracking
            const hasVersionTracking = /(algorithm[_\s]version[:\s]+\S+|model[_\s]version[:\s]+\S+|version[_\s](number|id|string)[:\s]+\S+|current[_\s]algorithm[_\s]version)/i.test(input);
            return !hasVersionTracking;
        },
    },
    /**
     * AICDS-005 — BLOCK
     * AI clinical recommendations must not be transmitted directly to patients without
     * licensed clinician review and patient AI-use disclosure.
     * TX SB 1188, TX HB 149 / TRAIGA (Jan. 1, 2026), CA SB 1120; state medical practice acts
     *
     * enforcement_pattern: semantic:patient-direct-clinical-output
     */
    DIRECT_TO_PATIENT_WITHOUT_CLINICIAN_REVIEW: {
        references: ['TX SB 1188 (Sept. 1, 2025); TX HB 149/TRAIGA (Jan. 1, 2026); CA SB 1120 (Jan. 1, 2025); state medical practice acts'],
        classifier: (input) => {
            // Must be a clinical recommendation output
            const hasClinicalRecommendation = /(diagnosis|treatment[_\s]recommendation|medication[_\s](suggestion|recommendation)|test[_\s]order|clinical\s+(recommendation|suggestion|advice))/i.test(input);
            if (!hasClinicalRecommendation)
                return false;
            // Must be routed directly to patient
            const isDirectToPatient = /(recipient\s*[:=]\s*(patient|end.user|consumer)|delivered\s+to\s+patient|patient.facing\s+(output|delivery|result)|direct.to.patient)/i.test(input);
            if (!isDirectToPatient)
                return false;
            // Check for clinician review documentation
            const hasClinicianReview = /(clinician[_\s]review[_\s]completed\s*[:=]\s*(true|yes)|physician[_\s]review[_\s]completed\s*[:=]\s*(true|yes)|reviewed\s+by[_\s](clinician|physician|NPI)|clinician[_\s]npi[:\s]+\d{10})/i.test(input);
            // Check for patient AI disclosure documentation
            const hasAIDisclosure = /(patient[_\s]ai[_\s]disclosure[_\s]provided\s*[:=]\s*(true|yes)|ai[_\s](use\s+)?disclosure\s+(provided?|documented?|confirmed?)|ai\s+(tool|system|assistant)\s+disclosure)/i.test(input);
            return !hasClinicianReview || !hasAIDisclosure;
        },
    },
    /**
     * AICDS-006 — INFO
     * Performance monitoring: AI CDS tools must have performance monitoring configured
     * and reviewed within the past 90 days.
     * FDA AI/ML SaMD framework; ONC clinical AI governance standards
     *
     * enforcement_pattern: semantic:performance-monitoring-active
     */
    PERFORMANCE_MONITORING_NOT_CONFIGURED: {
        references: ['FDA AI/ML SaMD framework — real-world performance monitoring; ONC clinical AI governance'],
        classifier: (input) => {
            // Must be output from an AI clinical decision support tool
            const isAICDSTool = /\b(AI\s+(clinical|CDS|diagnostic)\s+(tool|system|model)|clinical\s+AI\s+(tool|system|model)|CDS\s+(system|tool|model|output))\b/i.test(input);
            if (!isAICDSTool)
                return false;
            // Check for performance monitoring configuration
            const hasPerformanceMonitoring = /(performance[_\s]monitoring[_\s]enabled\s*[:=]\s*(true|yes|1)|performance[_\s]monitoring\s+(active|configured?|enabled?)|last[_\s]performance[_\s]review[_\s]date)/i.test(input);
            return !hasPerformanceMonitoring;
        },
    },
};
exports.AI_CDS_PACK = {
    categoryClassifiers: exports.AI_CDS_CATEGORY_CLASSIFIERS,
    id: 'ai-clinical-decision-support',
    name: 'AI in Clinical Decision Support',
    version: '1.0.0',
    contentHash: 'e84b9e2444ed9a6c83b4011a7d611a564b0195069070935feeab35328584f4a8',
    description: 'FDA SaMD and 21st Century Cures Act §3060 CDS exclusion compliance for AI tools in clinical settings. Covers FDA classification, §3060 four-criteria exclusion test, physician review checkpoint enforcement, adaptive algorithm version tracking (ACP), direct-to-patient clinical output prohibition, and performance monitoring. Includes TX SB 1188, TX HB 149/TRAIGA, CA SB 1120 state telehealth AI supervision compliance.',
    authority: 'FDA (SaMD / CDS); TX Legislature (SB 1188, HB 149/TRAIGA); CA Legislature (SB 1120)',
    industries: ['healthcare', 'health-it', 'clinical-ai', 'medical-device', 'telehealth', 'hospital'],
    requiredModules: [
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Physician review checkpoint audit trail for clinical AI actions',
            reference: 'FDA AI/ML SaMD Action Plan; state medical practice acts',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Block clinical AI outputs missing FDA authorization or physician review',
            reference: '21 U.S.C. §360(h); 21 U.S.C. §360j(o)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Route AI clinical outputs to licensed clinician review queue',
            reference: 'TX SB 1188; TX HB 149/TRAIGA; CA SB 1120',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'SaMD function profile detection and direct-to-patient output classification',
            reference: '21 U.S.C. §360(h)',
        },
    ],
    moduleConfig: {
        'audit-integrity': {
            retentionDays: 1825, // 5 years
        },
        'governance-runtime': {
            denyByDefaultRequired: true,
            minimumNecessaryEnforced: true,
        },
        'approval-queue': {
            clinicianReviewRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'SAMD_WITHOUT_FDA_AUTHORIZATION',
            'CDS_TRANSPARENCY_MISSING',
            'PHYSICIAN_REVIEW_CHECKPOINT_MISSING',
            'ALGORITHM_VERSION_NOT_TRACKED',
            'DIRECT_TO_PATIENT_WITHOUT_CLINICIAN_REVIEW',
            'PERFORMANCE_MONITORING_NOT_CONFIGURED',
        ],
        categoryActions: {
            SAMD_WITHOUT_FDA_AUTHORIZATION: 'BLOCK',
            CDS_TRANSPARENCY_MISSING: 'WARN',
            PHYSICIAN_REVIEW_CHECKPOINT_MISSING: 'BLOCK',
            ALGORITHM_VERSION_NOT_TRACKED: 'WARN',
            DIRECT_TO_PATIENT_WITHOUT_CLINICIAN_REVIEW: 'BLOCK',
            PERFORMANCE_MONITORING_NOT_CONFIGURED: 'LOG',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        auditLogRetentionDays: 1825,
        sessionRetentionDays: 1825,
        incidentRetentionDays: 1825,
        reference: 'FDA SaMD post-market surveillance records; state medical board records',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us'],
    },
    incidentPolicy: {
        notificationDeadlineHours: 24,
        reference: '21 CFR Part 803 — Medical Device Reporting (MDR); TX SB 1188; CA SB 1120',
        requiredRecipients: ['cmo', 'compliance-officer', 'regulatory-affairs', 'legal-counsel'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'ai-cds-fda-authorization',
            description: 'SaMD FDA authorization check classifier active',
            reference: '21 U.S.C. §360(h)',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ai-cds-physician-review',
            description: 'Physician review checkpoint classifier active',
            reference: 'TX SB 1188; TX HB 149/TRAIGA; CA SB 1120',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'ai-cds-direct-to-patient',
            description: 'Direct-to-patient clinical output without clinician review classifier active',
            reference: 'TX SB 1188; TX HB 149/TRAIGA; CA SB 1120; state medical practice acts',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
    ],
    requiresRetrievalAuditLogging: true,
    requiresCitations: true,
    maxAutonomyLevelWithoutAttestation: 1, // highest-risk: autonomy severely restricted
    recommendedHookProfile: 'strict',
    requiresActionIsolation: 'sourced-only',
};
//# sourceMappingURL=ai-clinical-decision-support.js.map