/**
 * MHRA UK Software as a Medical Device (SaMD) + UKCA marking Compliance Pack
 *
 * Regulation:
 *   - UK Medical Devices Regulations 2002 (as amended) — primary statute
 *   - MHRA Software and AI as a Medical Device Change Programme (active
 *     2021–present), including the AI Airlock pilot pathway (2024+).
 *   - MHRA SaMD guidance (IMDRF-aligned: SaMD risk class I, IIa, IIb, III)
 *   - UKCA marking (UK Conformity Assessed) — replacing CE marking for
 *     Great Britain post-Brexit (Northern Ireland still uses CE/UKCA-NI
 *     under the Windsor Framework)
 *
 * Jurisdiction: GB (Great Britain) primary; UKCA marking applies in
 *   England, Scotland, Wales. Northern Ireland operates a parallel
 *   CE/UKNI regime.
 * Authority: MHRA (Medicines and Healthcare products Regulatory Agency)
 *
 * Why this pack:
 *   - Required for any AI-based or software-based product placed on the
 *     UK market that meets the medical-device definition. Distinct from
 *     EU MDR / IVDR (separate pack: eu-mdr-ivdr).
 *   - SaMD AI products are increasingly the customer profile for UK
 *     Wave 1 NHS sales. MHRA reform is fast-moving (UKCA timelines,
 *     Future Regulations, AI Airlock); this pack tracks the operational
 *     evidence customers need.
 *   - Depends on Pack 7 (NHS Clinical Safety DCB0129/0160, shipped PR #400)
 *     for the clinical-safety-case spine — MHRA SaMD evidence inherits
 *     the DCB0129 hazard log + CSCR.
 *
 * Key obligations encoded in this pack:
 *   1. SaMD risk classification (I, IIa, IIb, III) recorded; classification
 *      rationale documented and reviewed at every product change.
 *   2. UKCA marking attestation — Declaration of Conformity, Technical
 *      Documentation file, applicable harmonised standards (ISO 13485,
 *      ISO 14971, IEC 62304, IEC 82304, ISO 14155 where clinical
 *      investigation applies).
 *   3. Clinical evaluation evidence (per UK MDR Schedule 2A) and
 *      clinical investigation records where required by class.
 *   4. Post-market surveillance plan (active for the device lifetime),
 *      Periodic Safety Update Report (PSUR) cadence by class:
 *      Class I — every 5 years; IIa — every 2 years; IIb / III — annually.
 *   5. Vigilance / incident reporting:
 *      - Serious incidents: report to MHRA within 15 days (10 days for
 *        immediate threat to life)
 *      - Field Safety Corrective Actions (FSCA) + Field Safety Notices
 *        (FSN) workflow
 *   6. UK Responsible Person (UKRP) designation for non-UK manufacturers.
 *   7. Device registration with MHRA before placing on UK market.
 *   8. AI-specific overlays (MHRA SaMD change programme + AI Airlock):
 *      - Algorithm change protocol (ACP) where applicable
 *      - Pre-determined Change Control Plan (PCCP) for "learning" models
 *      - Locked-vs-adaptive declaration
 *      - Real-world performance monitoring
 *
 * Out of scope:
 *   - EU MDR / IVDR (separate pack: eu-mdr-ivdr)
 *   - DCB0129 / DCB0160 NHS clinical-safety case (separate pack:
 *     nhs-clinical-safety, shipped PR #400) — MHRA evidence layers on top
 *   - NHS DSPT (separate pack: nhs-dspt)
 *   - FDA SaMD (separate pack: fda-samd)
 *
 * @connexum/ai-governance
 */
/**
 * MHRA SaMD / UKCA category classifiers.
 *
 * Pack scope is MHRA-specific evidence: device registration, risk class,
 * UKCA technical documentation, clinical evaluation, post-market
 * surveillance, vigilance / incident reporting, and AI-specific change-
 * control artefacts (ACP / PCCP). Personal-data classification is
 * delegated to nhs-dspt + uk-gdpr packs.
 */
export const MHRA_SAMD_UKCA_CATEGORY_CLASSIFIERS = {
    SAMD_CLASSIFICATION: {
        references: [
            'MHRA SaMD guidance — IMDRF-aligned class I/IIa/IIb/III',
            'UK MDR 2002 Annex IX — classification rules',
        ],
        classifier: (input) => {
            if (/\b(?:samd\s+(?:class|classification)|software\s+as\s+a\s+medical\s+device)\b/i.test(input))
                return true;
            if (/\b(?:class\s*(?:i|ii\s*a|ii\s*b|iii)\s+(?:device|samd))\b/i.test(input))
                return true;
            if (/\b(?:imdrf\s+samd|risk\s+classification\s+rationale)\b/i.test(input))
                return true;
            return false;
        },
    },
    UKCA_TECHNICAL_DOC: {
        references: [
            'UK MDR 2002 Annex II — technical documentation',
            'MHRA UKCA marking technical file requirements',
        ],
        classifier: (input) => {
            if (/\b(?:ukca\s+(?:mark|marking|certificate|attestation)|declaration\s+of\s+conformity)\b/i.test(input))
                return true;
            if (/\b(?:technical\s+(?:documentation|file)\s+(?:ukca|samd)|harmonised\s+standards?\s+list)\b/i.test(input))
                return true;
            if (/\b(?:iso\s*13485|iso\s*14971|iec\s*62304|iec\s*82304|iso\s*14155)\b/i.test(input))
                return true;
            return false;
        },
    },
    CLINICAL_EVALUATION: {
        references: [
            'UK MDR 2002 Schedule 2A — clinical evaluation',
            'MHRA clinical investigation guidance',
        ],
        classifier: (input) => {
            if (/\b(?:clinical\s+(?:evaluation|investigation)\s+(?:report|plan|record)|cer\s+v\d|cip\s+v\d)\b/i.test(input))
                return true;
            if (/\b(?:literature\s+search\s+protocol|equivalence\s+rationale|sufficient\s+clinical\s+evidence)\b/i.test(input))
                return true;
            return false;
        },
    },
    POST_MARKET_SURVEILLANCE: {
        references: [
            'UK MDR 2002 — post-market surveillance plan + Periodic Safety Update Report (PSUR)',
        ],
        classifier: (input) => {
            if (/\b(?:post[\s-]?market\s+surveillance|pms\s+plan|psur\s+(?:cadence|due|filed))\b/i.test(input))
                return true;
            if (/\b(?:periodic\s+safety\s+update\s+report|trend\s+report\s+samd|real[\s-]?world\s+performance\s+monitoring)\b/i.test(input))
                return true;
            return false;
        },
    },
    VIGILANCE_INCIDENT: {
        references: [
            'MHRA serious incident reporting (15 days; 10 days immediate-threat-to-life)',
            'Field Safety Corrective Action (FSCA) + Field Safety Notice (FSN)',
        ],
        classifier: (input) => {
            if (/\b(?:mhra\s+(?:serious\s+incident|reportable\s+event|vigilance\s+report))\b/i.test(input))
                return true;
            if (/\b(?:fsca|field\s+safety\s+corrective\s+action|fsn|field\s+safety\s+notice)\b/i.test(input))
                return true;
            if (/\b(?:yellow\s+card\s+samd|adverse\s+event\s+samd)\b/i.test(input))
                return true;
            return false;
        },
    },
    AI_CHANGE_CONTROL_PLAN: {
        references: [
            'MHRA SaMD AI Change Programme — Algorithm Change Protocol (ACP)',
            'Pre-determined Change Control Plan (PCCP) for adaptive AI models',
        ],
        classifier: (input) => {
            if (/\b(?:algorithm\s+change\s+protocol|acp\s+v\d)\b/i.test(input))
                return true;
            if (/\b(?:pre[\s-]?determined\s+change\s+control\s+plan|pccp\s+v\d|locked\s+(?:vs|versus)\s+adaptive)\b/i.test(input))
                return true;
            if (/\b(?:ai\s+airlock|samd\s+ai\s+pilot|adaptive\s+model\s+declaration)\b/i.test(input))
                return true;
            return false;
        },
    },
    DEVICE_REGISTRATION: {
        references: [
            'UK MDR 2002 — device registration with MHRA before UK placement',
        ],
        classifier: (input) => {
            if (/\b(?:mhra\s+(?:registration|device\s+registration|grn|grns)|gmdn\s+code)\b/i.test(input))
                return true;
            if (/\b(?:uk\s+responsible\s+person|ukrp\s+designation|ukrp\s+contract)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety; UKCA technical file artefacts must not embed credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
export const MHRA_SAMD_UKCA_PACK = {
    categoryClassifiers: MHRA_SAMD_UKCA_CATEGORY_CLASSIFIERS,
    id: 'mhra-samd-ukca',
    aliases: [
        'mhra-samd',
        'uk-samd',
        'ukca-medical-device',
        'mhra-ai-as-medical-device',
        'mhra-aimd',
        'uk-mdr-2002',
    ],
    name: 'MHRA UK SaMD / UKCA marking',
    version: '1.0.0',
    contentHash: '4523f907d20bc5800477a0f68654f1f0f67a9e1318135092d3d4f0c1d865c4ba',
    description: 'MHRA UK Software as a Medical Device + UKCA marking pack covering risk classification (IMDRF I/IIa/IIb/III), UKCA Declaration of Conformity, harmonised standards (ISO 13485, ISO 14971, IEC 62304, IEC 82304, ISO 14155), clinical evaluation evidence per UK MDR 2002 Schedule 2A, post-market surveillance + Periodic Safety Update Report (class-banded cadence), vigilance / serious-incident reporting (15-day MHRA / 10-day immediate-threat-to-life), Field Safety Corrective Action + Field Safety Notice workflows, MHRA SaMD AI Change Programme overlays (Algorithm Change Protocol, Pre-determined Change Control Plan, AI Airlock), device registration + UK Responsible Person designation. Distinct from EU MDR/IVDR (eu-mdr-ivdr pack); inherits DCB0129/0160 clinical-safety-case spine (nhs-clinical-safety pack).',
    authority: 'MHRA (Medicines and Healthcare products Regulatory Agency) + UK Approved Body (for Class IIa/IIb/III conformity assessment)',
    industries: ['healthcare', 'pharma', 'medical-devices', 'digital-health', 'clinical-research'],
    requiredModules: [
        {
            name: 'attestation-manager',
            required: true,
            reason: 'SaMD risk classification, UKCA Declaration of Conformity, Technical Documentation, Clinical Evaluation Report, PSUR cadence tracking, MHRA device registration, UK Responsible Person designation.',
            reference: 'UK MDR 2002 Annex II + Schedule 2A; MHRA UKCA technical file requirements',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Default-deny on SaMD actions outside the declared intended use; risk-class-aware gate (Class III highest scrutiny); locked-vs-adaptive declaration enforcement.',
            reference: 'MHRA SaMD intended-use scope; UK MDR 2002 conformity gate',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Risk-class change approval (Class I → II requires Approved Body re-assessment); ACP / PCCP change-control approval; clinical investigation amendment approval; vigilance incident classification.',
            reference: 'UK MDR 2002 conformity assessment; MHRA SaMD AI change programme',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain for technical documentation revisions, conformity declarations, clinical evaluation updates, PSUR submissions, vigilance incident records — required as MHRA inspection evidence.',
            reference: 'UK MDR 2002 Annex II — technical documentation maintenance',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Vigilance incident detection + 15-day / 10-day MHRA escalation; FSCA + FSN workflow routing; PSUR cadence reminders by risk class; real-world performance drift alerts.',
            reference: 'MHRA serious incident reporting; FSCA + FSN workflow',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Technical documentation + clinical evaluation + post-market surveillance evidence retained for at least 10 years after last-placed-on-market date (15 years for implantable devices — UK MDR 2002 Schedule 2 Part II).',
            reference: 'UK MDR 2002 Schedule 2 Part II — 10-year (15-year implantable) retention',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Surface SaMD-specific evidence categories (classification, UKCA technical doc, clinical evaluation, PMS, vigilance, AI change-control plans, device registration) for evidence collection.',
            reference: 'UK MDR 2002 Annex II — technical documentation contents',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Per-version Algorithm Change Protocol (ACP) + Pre-determined Change Control Plan (PCCP) registration; locked-vs-adaptive declaration tracking.',
            reference: 'MHRA SaMD AI Change Programme; AI Airlock pilot pathway',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'UK Responsible Person (UKRP) designation for non-UK manufacturers; sub-supplier flow-down for ISO 13485 quality management overlap.',
            reference: 'UK MDR 2002 — UK Responsible Person obligations',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Patient-facing AI use disclosure for SaMD outputs; uncertainty / confidence display; intended-use disclaimer; UKCA marking visibility.',
            reference: 'MHRA AI transparency guidance; UK MDR 2002 Schedule 2A — labelling',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Technical documentation + clinical evaluation evidence encrypted; consistent with NHS DSPT and UK GDPR Art. 32 expectations.',
            reference: 'NHS DSPT Section 7; UK GDPR Art. 32(1)(a)',
        },
    ],
    moduleConfig: {
        'attestation-manager': {
            samdRiskClassRecorded: true,
            ukcaDeclarationOfConformityRequired: true,
            technicalDocumentationRequired: true,
            clinicalEvaluationReportRequired: true,
            pmsPlanRequired: true,
            psurCadenceClassI: 1825, // 5 years
            psurCadenceClassIIa: 730, // 2 years
            psurCadenceClassIIb: 365, // annual
            psurCadenceClassIII: 365, // annual
            acpRegistrationRequired: true,
            pccpRegistrationRequired: true,
            lockedVsAdaptiveDeclarationRequired: true,
            mhraDeviceRegistrationRequired: true,
            ukrpDesignationRequired: true,
        },
        'governance-runtime': {
            defaultDenyOutsideIntendedUse: true,
            riskClassAwareGateRequired: true,
            lockedVsAdaptiveEnforced: true,
        },
        'approval-queue': {
            riskClassChangeApprovalRequired: true,
            acpPccpChangeApprovalRequired: true,
            clinicalInvestigationAmendmentApprovalRequired: true,
            vigilanceClassificationApprovalRequired: true,
            reviewTier: 'T2',
        },
        'event-bus': {
            vigilanceIncidentDetectionRequired: true,
            mhraSeriousIncidentDays: 15,
            mhraImmediateThreatDays: 10,
            fscaWorkflowRequired: true,
            fsnWorkflowRequired: true,
            psurCadenceRemindersRequired: true,
            realWorldPerformanceDriftAlertsRequired: true,
        },
        'session-persistence': {
            retentionDaysAfterLastPlacedOnMarket: 3650, // 10 years
            retentionDaysImplantable: 5475, // 15 years
        },
        'data-classifier': {
            enabledCategories: [
                'SAMD_CLASSIFICATION',
                'UKCA_TECHNICAL_DOC',
                'CLINICAL_EVALUATION',
                'POST_MARKET_SURVEILLANCE',
                'VIGILANCE_INCIDENT',
                'AI_CHANGE_CONTROL_PLAN',
                'DEVICE_REGISTRATION',
                'CREDENTIALS',
            ],
            credentialsAction: 'BLOCK',
        },
        'supply-chain': {
            ukrpDesignationRequired: true,
            iso13485SubSupplierFlowDownRequired: true,
        },
        'transparency-injector': {
            patientFacingAiDisclosureRequired: true,
            intendedUseDisclaimerRequired: true,
            ukcaMarkingVisibilityRequired: true,
            confidenceDisplayRequired: true,
        },
        'encryption-layer': {
            algorithm: 'aes-256-gcm',
            encryptionRequiredForTechnicalDocumentation: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK-OR-EU', 'PROCESSOR-CONTRACT', 'ISO-13485-SUBPROCESSOR'],
        blockReasons: {
            deepseek: 'PRC jurisdiction. UK MDR + UKCA technical-file evidence chain must be UK-resident; ISO 13485 sub-supplier flow-down expectation excludes PRC routing.',
            baidu: 'PRC jurisdiction. MHRA technical-file evidence cannot route through PRC infrastructure.',
            alibaba: 'PRC jurisdiction. MHRA technical-file evidence cannot route through PRC infrastructure.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'SAMD_CLASSIFICATION',
            'UKCA_TECHNICAL_DOC',
            'CLINICAL_EVALUATION',
            'POST_MARKET_SURVEILLANCE',
            'VIGILANCE_INCIDENT',
            'AI_CHANGE_CONTROL_PLAN',
            'DEVICE_REGISTRATION',
            'CREDENTIALS',
        ],
        categoryActions: {
            SAMD_CLASSIFICATION: 'WARN',
            UKCA_TECHNICAL_DOC: 'WARN',
            CLINICAL_EVALUATION: 'WARN',
            POST_MARKET_SURVEILLANCE: 'WARN',
            VIGILANCE_INCIDENT: 'WARN',
            AI_CHANGE_CONTROL_PLAN: 'WARN',
            DEVICE_REGISTRATION: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        auditLogRetentionDays: 3650, // 10 years (15-year implantable handled per-record)
        sessionRetentionDays: 3650,
        incidentRetentionDays: 3650,
        reference: 'UK MDR 2002 Schedule 2 Part II — 10-year retention (15 years for implantable devices) after last-placed-on-market',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb', 'eu'],
    },
    incidentPolicy: {
        notificationDeadlineHours: 360, // 15 days = 360 hours; immediate-threat-to-life override is 10 days = 240 hours
        reference: 'MHRA serious incident reporting — 15 days from awareness; 10 days for immediate threat to life; FSCA + FSN workflows',
        requiredRecipients: [
            'mhra-vigilance',
            'clinical-safety-officer',
            'uk-responsible-person',
            'medical-director',
            'data-protection-officer',
        ],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'mhra-samd-classification-recorded',
            description: 'SaMD risk classification (I, IIa, IIb, III) recorded with rationale; reviewed at every product change.',
            reference: 'MHRA SaMD guidance; UK MDR 2002 Annex IX classification rules',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'mhra-ukca-declaration-of-conformity',
            description: 'UKCA Declaration of Conformity issued; harmonised standards list documented; technical file complete.',
            reference: 'UK MDR 2002 Annex II — technical documentation; UKCA marking requirements',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'mhra-clinical-evaluation-current',
            description: 'Clinical Evaluation Report current; clinical investigation evidence captured where required by class.',
            reference: 'UK MDR 2002 Schedule 2A — clinical evaluation',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'mhra-pms-psur-cadence',
            description: 'Post-market surveillance plan active; PSUR filed at class-banded cadence (5y / 2y / annual).',
            reference: 'UK MDR 2002 — post-market surveillance and PSUR requirements',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'mhra-vigilance-15-day',
            description: 'MHRA serious incident reporting workflow active (15-day default; 10-day immediate-threat-to-life override).',
            reference: 'MHRA serious incident reporting requirements',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'mhra-fsca-fsn-workflow',
            description: 'Field Safety Corrective Action + Field Safety Notice workflow wired; recipient list captured.',
            reference: 'MHRA FSCA + FSN guidance',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'mhra-ai-change-control-plan',
            description: 'Algorithm Change Protocol + Pre-determined Change Control Plan registered for adaptive AI; locked-vs-adaptive declaration current.',
            reference: 'MHRA SaMD AI Change Programme; AI Airlock pilot pathway',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'mhra-device-registration',
            description: 'Device registered with MHRA before UK placement; GMDN code recorded; UK Responsible Person designated for non-UK manufacturers.',
            reference: 'UK MDR 2002 — device registration + UK Responsible Person',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'mhra-evidence-retention',
            description: 'Technical documentation + clinical evaluation + PMS evidence retained 10 years (15 years implantable) after last-placed-on-market.',
            reference: 'UK MDR 2002 Schedule 2 Part II — retention windows',
            check: 'retention_policy_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'mhra-default-deny-outside-intended-use',
            description: 'Governance runtime denies SaMD actions outside the declared intended use; intended-use scope enforced.',
            reference: 'MHRA SaMD intended-use scope; UK MDR 2002 conformity gate',
            check: 'governance_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'mhra-encryption-active',
            description: 'Technical-file + clinical-evaluation evidence encrypted at rest and in transit.',
            reference: 'NHS DSPT Section 7; UK GDPR Art. 32(1)(a)',
            check: 'encryption_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=mhra-samd-ukca.js.map