@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/packs/cms-interoperability.js

@@ -0,0 +1,387 @@
+/**
+ * CMS Interoperability and Patient Access Compliance Pack
+ *
+ * Regulation: CMS Interoperability and Patient Access Final Rule
+ *             CMS-9115-F (85 FR 25510, May 1, 2020)
+ *             45 CFR Part 170 (ONC Health IT Certification);
+ *             42 CFR Parts 422 (MA), 431 (Medicaid), 438 (Medicaid MCO),
+ *             457 (CHIP), 156 (FFE QHP Issuers)
+ *
+ * Jurisdiction: US (United States -- Federal)
+ * Regulators: CMS (Centers for Medicare & Medicaid Services) +
+ *             ONC (Office of the National Coordinator for Health IT)
+ *
+ * Alias: HC-06
+ *
+ * Key effective dates:
+ *   - 1 July 2021: Patient Access API mandate (FHIR R4)
+ *   - 1 January 2022: Provider Directory API
+ *   - 1 January 2023: Payer-to-Payer Data Exchange (exchange on request)
+ *   - 2026+: Prior Authorization API (CMS-0057-F, Advancing Interoperability
+ *     and Improving Prior Authorization Processes Final Rule, 2024)
+ *
+ * Scope:
+ *   Applies to: MA plans (Part C), Medicaid FFS, Medicaid MCOs, CHIP,
+ *   Qualified Health Plan (QHP) issuers on FFEs. Requires covered payers
+ *   to implement FHIR R4-based APIs for patient access, provider directories,
+ *   payer-to-payer data exchange, and (under CMS-0057-F) prior authorization.
+ *
+ * Distinction from HIPAA:
+ *   HIPAA restricts unauthorized disclosure of PHI. CMS Interoperability
+ *   REQUIRES payers to MAKE data accessible to patients (and other payers)
+ *   via standardized APIs. An AI system that blocks legitimate FHIR API
+ *   responses violates CMS Interoperability; an AI system that discloses PHI
+ *   without authorization violates HIPAA. Both packs may be active
+ *   simultaneously; CMS Interoperability takes precedence for FHIR
+ *   patient-access requests.
+ *
+ * Information Blocking:
+ *   ONC 21st Century Cures Act information blocking rules (45 CFR Part 171)
+ *   prohibit practices that unreasonably interfere with access, exchange,
+ *   or use of electronic health information (EHI). AI systems MUST NOT
+ *   block FHIR API access for legitimate patient requests. Only the eight
+ *   enumerated exceptions apply (preventing harm, privacy, security,
+ *   infeasibility, health IT performance, content and manner, fees,
+ *   licensing exceptions).
+ *
+ * @connexum/ai-governance
+ */
+export const CMS_INTEROPERABILITY_CATEGORY_CLASSIFIERS = {
+    PATIENT_CLINICAL_DATA_FHIR: {
+        references: ['45 CFR §170.315(g)(10) -- FHIR R4 Patient Access API; US Core Implementation Guide'],
+        classifier: (input) => {
+            if (/\b(?:fhir\s+r4|fhir\s+resource|patient\s+access\s+api|us\s+core|smart\s+on\s+fhir|uscdi)\b/i.test(input))
+                return true;
+            if (/\b(?:patient\s+clinical\s+record|clinical\s+data\s+fhir|fhir\s+bundle|fhir\s+observation|fhir\s+condition|fhir\s+medication)\b/i.test(input))
+                return true;
+            if (/\b(?:claim\s+response\s+fhir|explanation\s+of\s+benefits\s+fhir|eob\s+fhir|coverage\s+fhir)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PATIENT_CLAIMS_DATA: {
+        references: ['42 CFR §422.119(b)(1) -- claims and encounter data; CMS-9115-F Patient Access API scope'],
+        classifier: (input) => {
+            if (/\b(?:claims\s+data|encounter\s+data|adjudicated\s+claims|explanation\s+of\s+benefits|eob\s+data|remittance\s+advice)\b/i.test(input))
+                return true;
+            if (/\b(?:medicare\s+claims|medicaid\s+claims|chip\s+claims|prior\s+authorization\s+record|pa\s+record)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PAYER_TO_PAYER_DATA_EXCHANGE: {
+        references: ['42 CFR §422.119(e) -- payer-to-payer data exchange; CMS-0057-F 2024 payer-to-payer'],
+        classifier: (input) => {
+            if (/\b(?:payer.to.payer|p2p\s+data|payer\s+exchange|payer\s+api\s+exchange|member\s+switching\s+payer)\b/i.test(input))
+                return true;
+            if (/\b(?:attribution\s+list|enrollee\s+data\s+exchange|concurrent\s+enrollment\s+data)\b/i.test(input))
+                return true;
+            if (/\b(?:cms.0057|advancing\s+interoperability|prior\s+auth\s+exchange)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PROVIDER_DIRECTORY_DATA: {
+        references: ['42 CFR §422.120 -- provider directory API; CMS-9115-F Provider Directory'],
+        classifier: (input) => {
+            if (/\b(?:provider\s+directory|npi\s+directory|practitioner\s+directory|provider\s+api|provider\s+network\s+data)\b/i.test(input))
+                return true;
+            if (/\b(?:pdex\s+plan\s+net|provider\s+network\s+fhir|organization\s+fhir|location\s+fhir\s+provider)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PRIOR_AUTHORIZATION_DATA: {
+        references: ['42 CFR §422.122 -- prior authorization API; CMS-0057-F 2024 prior authorization transparency'],
+        classifier: (input) => {
+            if (/\b(?:prior\s+authorization|pa\s+decision|pa\s+request|prior\s+auth\s+api|prior\s+authorization\s+fhir)\b/i.test(input))
+                return true;
+            if (/\b(?:medical\s+necessity\s+determination|pa\s+denial|pa\s+approval|gold\s+carding|step\s+therapy\s+pa)\b/i.test(input))
+                return true;
+            if (/\b(?:cms.0057|pa\s+transparency|prior\s+auth\s+reason\s+code)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PII: {
+        references: ['HIPAA §164.514 -- PHI; 45 CFR §170.215 -- FHIR API security; CMS-9115-F security requirements'],
+        classifier: (input) => {
+            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
+                return true;
+            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
+                return true;
+            if (/\b(?:medicare\s+id|beneficiary\s+id|medicaid\s+id|member\s+id|hicn|mbi)\b/i.test(input))
+                return true;
+            if (/\b(?:patient\s+name|patient\s+dob|date\s+of\s+birth\s+patient)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CREDENTIALS: {
+        references: ['45 CFR §170.215 -- FHIR API authentication; SMART on FHIR authorization; OAuth 2.0 PKCE'],
+        classifier: (input) => {
+            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
+                return true;
+            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
+                return true;
+            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
+                return true;
+            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
+                return true;
+            if (/\b(?:client_secret|bearer\s+token|oauth\s+token|access_token)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+.]{16,}["']?/i.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+export const CMS_INTEROPERABILITY_PACK = {
+    categoryClassifiers: CMS_INTEROPERABILITY_CATEGORY_CLASSIFIERS,
+    id: 'cms-interoperability',
+    aliases: ['HC-06'],
+    name: 'CMS Interoperability and Patient Access (CMS-9115-F)',
+    version: '1.0.0',
+    description: 'CMS Interoperability and Patient Access Final Rule (CMS-9115-F, 85 FR 25510) -- requires Medicare Advantage, Medicaid, CHIP, and FFE QHP payer plans to implement FHIR R4 APIs for patient clinical and claims data access, payer-to-payer data exchange (90-day window), provider directory APIs, and prior authorization APIs (CMS-0057-F, effective 2026). Enforces ONC information blocking prohibition: AI systems MUST NOT block legitimate FHIR patient access requests. Distinct from HIPAA: CMS Interoperability REQUIRES data accessibility; HIPAA restricts unauthorized disclosure. Both may be simultaneously active; CMS Interoperability governs affirmative access obligations.',
+    authority: 'CMS (Centers for Medicare & Medicaid Services) + ONC (Office of the National Coordinator for Health IT)',
+    industries: ['healthcare', 'health-insurance', 'managed-care', 'medicare-advantage', 'medicaid', 'chip', 'health-it'],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'Enforce FHIR Patient Access API availability requirement; block AI actions that would constitute information blocking under 21st Century Cures Act 45 CFR Part 171; ensure prior authorization API responses comply with CMS-0057-F timelines',
+            reference: '42 CFR §422.119 -- Patient Access API requirement; 45 CFR Part 171 -- information blocking prohibition; CMS-0057-F §422.122 -- prior authorization API compliance',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Classify patient clinical FHIR data, claims data, payer-to-payer exchange data, provider directory data, and prior authorization data for appropriate access and handling',
+            reference: '45 CFR §170.315(g)(10) -- FHIR R4 data categories; 42 CFR §422.119(b)(1) -- claims data scope; USCDI -- US Core Data for Interoperability data classes',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident log of FHIR API access events, payer-to-payer exchange events, prior authorization decisions, and information blocking incidents; required for ONC and CMS audit response',
+            reference: '45 CFR §170.210 -- audit log requirements for health IT; HIPAA Security Rule 45 CFR §164.312(b) -- audit controls; ONC information blocking investigation requirements',
+        },
+        {
+            name: 'agent-auth',
+            required: true,
+            reason: 'SMART on FHIR OAuth 2.0 PKCE authentication for Patient Access API; access control for payer-to-payer data exchange; provider directory API access management',
+            reference: '45 CFR §170.215(b) -- SMART on FHIR authorization; 45 CFR §170.315(g)(10) -- API authentication requirement; ONC HTI-1 SMART 2.0 requirements',
+        },
+        {
+            name: 'encryption-layer',
+            required: true,
+            reason: 'Patient PHI encrypted in transit (TLS 1.2+) and at rest per HIPAA Security Rule, which runs in parallel with CMS Interoperability requirements; FHIR API endpoints secured with TLS',
+            reference: 'HIPAA Security Rule 45 CFR §164.312(a)(2)(iv) -- encryption and decryption; 45 CFR §170.210(h) -- encrypted audit log; CMS-9115-F security requirements',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'Human review gate for AI-generated prior authorization decisions per CMS-0057-F; payer-to-payer exchange authorization workflow; information blocking exception determination review',
+            reference: 'CMS-0057-F §422.122 -- prior authorization API and human review; 45 CFR Part 171 -- information blocking exception evaluation requires human determination',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'FHIR R4 API conformance attestation to CMS/ONC; US Core Implementation Guide conformance documentation; information blocking attestation under 21st Century Cures Act; annual API availability attestation',
+            reference: '45 CFR §170.315(g)(10) -- FHIR certification; ONC Health IT Certification Program -- US Core conformance; 21st Century Cures Act §4004 -- information blocking attestation',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'API outage event notification to CMS; payer-to-payer data exchange failure tracking with 30-day cure period; prior authorization decision timeline clock management (CMS-0057-F)',
+            reference: 'CMS-9115-F -- API availability requirements; 42 CFR §422.119(e) -- payer-to-payer exchange failure notification; CMS-0057-F -- prior authorization response timelines',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'Third-party health IT vendor FHIR conformance verification; SMART app (third-party application) registration and security review; information blocking supply chain accountability',
+            reference: '45 CFR §170.315(g)(10) -- third-party application API; ONC app registration requirements; 21st Century Cures Act information blocking -- developer obligations',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'FHIR API session state management for 90-day payer-to-payer data exchange window; prior authorization status continuity; patient access token persistence within SMART scope',
+            reference: '42 CFR §422.119(e) -- 90-day payer-to-payer exchange window; SMART on FHIR session management; CMS-0057-F prior authorization status continuity',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'Patient notification of data access rights under FHIR API; prior authorization denial reason transparency (CMS-0057-F specific reason codes); information blocking exception disclosure',
+            reference: 'CMS-0057-F §422.122 -- PA denial reason transparency; 45 CFR Part 171 -- information blocking exceptions require transparent documentation; Patient Access API notice requirements',
+        },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            fhirR4ApiAvailabilityRequired: true,
+            informationBlockingProhibitionEnforced: true,
+            priorAuthorizationApiRequired: true,
+            patientAccessApiBlockProhibited: true,
+        },
+        'data-classifier': {
+            enabledCategories: ['PATIENT_CLINICAL_DATA_FHIR', 'PATIENT_CLAIMS_DATA', 'PAYER_TO_PAYER_DATA_EXCHANGE', 'PROVIDER_DIRECTORY_DATA', 'PRIOR_AUTHORIZATION_DATA', 'PII', 'CREDENTIALS'],
+            patientClinicalDataAction: 'WARN',
+            priorAuthorizationDataAction: 'WARN',
+            credentialsAction: 'BLOCK',
+        },
+        'agent-auth': {
+            smartOnFhirOAuth2PkceRequired: true,
+            fhirApiAuthenticationRequired: true,
+        },
+        'approval-queue': {
+            article22HumanReviewRequired: true,
+            priorAuthorizationHumanReviewRequired: true,
+            informationBlockingExceptionDeterminationRequired: true,
+        },
+        'attestation-manager': {
+            fhirR4ConformanceAttestationRequired: true,
+            usCoreImplementationGuideConformanceRequired: true,
+            informationBlockingAttestationRequired: true,
+        },
+        'event-bus': {
+            apiOutageNotificationRequired: true,
+            payerToPayerExchangeFailureTrackingRequired: true,
+            payerToPayerCurePeriodDays: 30,
+        },
+        'supply-chain': {
+            thirdPartySmartAppRegistrationRequired: true,
+            fhirConformanceVerificationRequired: true,
+        },
+        'session-persistence': {
+            payerToPayerExchangeWindowDays: 90,
+            priorAuthorizationStatusContinuityRequired: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
+        requiredCapabilities: ['HIPAA-BAA', 'FHIR-R4-CAPABLE', 'DATA-RESIDENCY-US', 'SOC2-TYPE-II'],
+        blockReasons: {
+            deepseek: 'PRC National Intelligence Law incompatible with HIPAA BAA requirements and PHI data sovereignty for Medicare/Medicaid beneficiary data under CMS Interoperability Rule.',
+            baidu: 'PRC jurisdiction. Transfer of Medicare/Medicaid beneficiary PHI to PRC violates HIPAA 45 CFR §164.502 and CMS data residency expectations for CMS-9115-F compliance.',
+            alibaba: 'PRC jurisdiction. Medicare/Medicaid beneficiary health data (FHIR bundles, claims, prior auth) must not transit PRC infrastructure due to HIPAA and CMS Interoperability sovereignty requirements.',
+        },
+    },
+    dataPolicy: {
+        scanCategories: ['PATIENT_CLINICAL_DATA_FHIR', 'PATIENT_CLAIMS_DATA', 'PAYER_TO_PAYER_DATA_EXCHANGE', 'PROVIDER_DIRECTORY_DATA', 'PRIOR_AUTHORIZATION_DATA', 'PII', 'CREDENTIALS'],
+        categoryActions: {
+            PATIENT_CLINICAL_DATA_FHIR: 'WARN',
+            PATIENT_CLAIMS_DATA: 'WARN',
+            PAYER_TO_PAYER_DATA_EXCHANGE: 'WARN',
+            PROVIDER_DIRECTORY_DATA: 'WARN',
+            PRIOR_AUTHORIZATION_DATA: 'WARN',
+            PII: 'WARN',
+            CREDENTIALS: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256-GCM',
+        minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: {
+        // HIPAA general retention: 6 years from creation or last use.
+        // CMS does not extend beyond HIPAA. FHIR API audit logs: HIPAA Security Rule minimum 6 years.
+        auditLogRetentionDays: 2190, // 6 years (HIPAA Security Rule 45 CFR §164.316(b)(2)(i))
+        sessionRetentionDays: 2190, // 6 years general PHI retention
+        incidentRetentionDays: 2190, // 6 years for information blocking incidents and API audit logs
+        reference: 'HIPAA 45 CFR §164.316(b)(2)(i) -- 6-year general retention; HIPAA Security Rule audit log retention; ONC information blocking investigation records; CMS-9115-F API availability audit requirements',
+        forceDelete: false,
+        requiresLegalHoldSupport: true,
+        sovereignty: ['us'], // PHI must remain in US jurisdiction
+    },
+    incidentPolicy: {
+        // Information blocking complaint to ONC: reported immediately to OIG/ONC.
+        // API outage: CMS notification expectation within operational SLA window.
+        // Payer-to-payer exchange failure: 30-day cure period per CMS-0057-F.
+        // Using 72 hours as the operational notification standard (aligns with HIPAA breach notification).
+        notificationDeadlineHours: 72,
+        reference: 'CMS-9115-F -- API outage notification requirements; 45 CFR Part 171 -- ONC information blocking complaint process; HIPAA 45 CFR §164.410 -- 60-day breach notification; CMS-0057-F -- prior authorization API outage response',
+        requiredRecipients: ['cms-supervisory-contact', 'onc-information-blocking-complaint-desk', 'chief-compliance-officer', 'hipaa-privacy-officer'],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'cms-interop-fhir-r4-api-availability',
+            description: 'FHIR R4 Patient Access API availability enforced; AI systems prohibited from blocking legitimate patient access requests; US Core Implementation Guide conformance required',
+            reference: '42 CFR §422.119 -- Patient Access API; 45 CFR §170.315(g)(10) -- FHIR R4 certification; ONC HTI-1 SMART 2.0',
+            check: 'governance_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'cms-interop-information-blocking-prohibition',
+            description: 'Information blocking prohibition active: AI must not block, filter, or delay FHIR API responses for legitimate patient requests; only 21st Century Cures Act exceptions permitted',
+            reference: '21st Century Cures Act §3022; 45 CFR Part 171 -- information blocking prohibition; ONC information blocking enforcement',
+            check: 'governance_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'cms-interop-smart-fhir-auth',
+            description: 'SMART on FHIR OAuth 2.0 PKCE authentication active for Patient Access API; third-party application authentication enforced',
+            reference: '45 CFR §170.315(g)(10)(ii) -- SMART on FHIR authorization; ONC HTI-1 SMART 2.0 requirements; SMART App Launch v2.0',
+            check: 'agent_auth_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'cms-interop-data-classifier',
+            description: 'Patient clinical FHIR data, claims data, payer-to-payer exchange data, and prior authorization data classified for appropriate access control',
+            reference: '45 CFR §170.315(g)(10) -- FHIR data categories; USCDI -- data classes; 42 CFR §422.119 -- data scope',
+            check: 'data_classifier_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'cms-interop-audit-trail',
+            description: 'Tamper-evident audit log of FHIR API access, payer-to-payer exchange events, and prior authorization decisions active',
+            reference: '45 CFR §170.210 -- audit log requirements; HIPAA Security Rule 45 CFR §164.312(b) -- audit controls; ONC information blocking investigation',
+            check: 'audit_trail_exists',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'cms-interop-payer-to-payer-exchange',
+            description: 'Payer-to-payer data exchange event bus active; 90-day exchange window tracking; 30-day cure period for exchange failures',
+            reference: '42 CFR §422.119(e) -- payer-to-payer data exchange; CMS-0057-F -- payer-to-payer exchange obligations',
+            check: 'monitoring_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'cms-interop-prior-auth-api',
+            description: 'Prior authorization API human review gate active; PA denial reason transparency enforced per CMS-0057-F',
+            reference: 'CMS-0057-F §422.122 -- prior authorization API; PA denial reason code transparency; PA response timeline requirements',
+            check: 'approval_queue_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'cms-interop-conformance-attestation',
+            description: 'FHIR R4 conformance attestation maintained; US Core Implementation Guide conformance documented; information blocking attestation on file',
+            reference: '45 CFR §170.315(g)(10) -- ONC certification; ONC Health IT Certification Program; 21st Century Cures Act §4004 -- information blocking attestation',
+            check: 'attestation_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'cms-interop-encryption',
+            description: 'PHI in FHIR API payloads encrypted in transit (TLS 1.2+) and at rest; FHIR endpoint security enforced',
+            reference: 'HIPAA Security Rule 45 CFR §164.312(a)(2)(iv); 45 CFR §170.210(h) -- encrypted audit log; CMS-9115-F security baseline',
+            check: 'encryption_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'cms-interop-access-control',
+            description: 'Access to patient FHIR data, payer-to-payer exchange data, and prior authorization records limited to authorised personnel and authenticated applications',
+            reference: 'HIPAA Security Rule 45 CFR §164.312(a)(1) -- access control; SMART on FHIR scopes; CMS-9115-F third-party app access management',
+            check: 'rbac_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'cms-interop-transparency',
+            description: 'Patient notification of FHIR API data access rights active; prior authorization denial reason transparency injected into API responses',
+            reference: 'CMS-0057-F -- PA denial reason codes; Patient Access API notice requirements; 45 CFR Part 171 -- information blocking exception disclosure',
+            check: 'transparency_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'cms-interop-supply-chain',
+            description: 'Third-party SMART app registration and security review active; FHIR vendor conformance verified; information blocking supply chain accountability enforced',
+            reference: 'ONC third-party app registration requirements; 45 CFR §170.315(g)(10) -- developer obligations; 21st Century Cures Act -- developer information blocking duties',
+            check: 'subservice_registry_active',
+            failSeverity: 'HIGH',
+        },
+    ],
+};
+//# sourceMappingURL=cms-interoperability.js.map

package/dist/esm/packs/cms-interoperability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cms-interoperability.js","sourceRoot":"","sources":["../../../src/packs/cms-interoperability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAKH,MAAM,CAAC,MAAM,yCAAyC,GAAwB;IAC5E,0BAA0B,EAAE;QAC1B,UAAU,EAAE,CAAC,oFAAoF,CAAC;QAClG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,6FAA6F,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3H,IAAI,iIAAiI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/J,IAAI,gGAAgG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9H,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,mBAAmB,EAAE;QACnB,UAAU,EAAE,CAAC,yFAAyF,CAAC;QACvG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,yHAAyH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvJ,IAAI,uGAAuG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,4BAA4B,EAAE;QAC5B,UAAU,EAAE,CAAC,oFAAoF,CAAC;QAClG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,uGAAuG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrI,IAAI,uFAAuF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrH,IAAI,wEAAwE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtG,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,uBAAuB,EAAE;QACvB,UAAU,EAAE,CAAC,0EAA0E,CAAC;QACxF,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,iHAAiH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/I,IAAI,qGAAqG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,wBAAwB,EAAE;QACxB,UAAU,EAAE,CAAC,8FAA8F,CAAC;QAC5G,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,2GAA2G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzI,IAAI,2GAA2G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzI,IAAI,kEAAkE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChG,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,+FAA+F,CAAC;QAC7G,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnF,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrD,IAAI,4EAA4E,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1G,IAAI,mEAAmE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjG,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,WAAW,EAAE;QACX,UAAU,EAAE,CAAC,yFAAyF,CAAC;QACvG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnG,IAAI,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,IAAI,2GAA2G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAkE;IACtG,mBAAmB,EAAE,yCAAyC;IAC9D,EAAE,EAAE,sBAAsB;IAC1B,OAAO,EAAE,CAAC,OAAO,CAAC;IAClB,IAAI,EAAE,sDAAsD;IAC5D,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,iqBAAiqB;IACnqB,SAAS,EAAE,yGAAyG;IACpH,UAAU,EAAE,CAAC,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC;IAErH,eAAe,EAAE;QACf;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,+OAA+O;YACvP,SAAS,EAAE,mKAAmK;SAC/K;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2KAA2K;YACnL,SAAS,EAAE,wJAAwJ;SACpK;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,0LAA0L;YAClM,SAAS,EAAE,wKAAwK;SACpL;QACD;YACE,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,+JAA+J;YACvK,SAAS,EAAE,+IAA+I;SAC3J;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,qLAAqL;YAC7L,SAAS,EAAE,yJAAyJ;SACrK;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,sLAAsL;YAC9L,SAAS,EAAE,4JAA4J;SACxK;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,4MAA4M;YACpN,SAAS,EAAE,4KAA4K;SACxL;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kLAAkL;YAC1L,SAAS,EAAE,uKAAuK;SACnL;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,oLAAoL;YAC5L,SAAS,EAAE,gKAAgK;SAC5K;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8KAA8K;YACtL,SAAS,EAAE,iJAAiJ;SAC7J;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,yLAAyL;YACjM,SAAS,EAAE,oLAAoL;SAChM;KACF;IAED,YAAY,EAAE;QACZ,oBAAoB,EAAE;YACpB,6BAA6B,EAAE,IAAI;YACnC,sCAAsC,EAAE,IAAI;YAC5C,6BAA6B,EAAE,IAAI;YACnC,+BAA+B,EAAE,IAAI;SACtC;QACD,iBAAiB,EAAE;YACjB,iBAAiB,EAAE,CAAC,4BAA4B,EAAE,qBAAqB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,KAAK,EAAE,aAAa,CAAC;YACrL,yBAAyB,EAAE,MAAM;YACjC,4BAA4B,EAAE,MAAM;YACpC,iBAAiB,EAAE,OAAO;SAC3B;QACD,YAAY,EAAE;YACZ,6BAA6B,EAAE,IAAI;YACnC,6BAA6B,EAAE,IAAI;SACpC;QACD,gBAAgB,EAAE;YAChB,4BAA4B,EAAE,IAAI;YAClC,qCAAqC,EAAE,IAAI;YAC3C,iDAAiD,EAAE,IAAI;SACxD;QACD,qBAAqB,EAAE;YACrB,oCAAoC,EAAE,IAAI;YAC1C,4CAA4C,EAAE,IAAI;YAClD,sCAAsC,EAAE,IAAI;SAC7C;QACD,WAAW,EAAE;YACX,6BAA6B,EAAE,IAAI;YACnC,2CAA2C,EAAE,IAAI;YACjD,0BAA0B,EAAE,EAAE;SAC/B;QACD,cAAc,EAAE;YACd,sCAAsC,EAAE,IAAI;YAC5C,mCAAmC,EAAE,IAAI;SAC1C;QACD,qBAAqB,EAAE;YACrB,8BAA8B,EAAE,EAAE;YAClC,0CAA0C,EAAE,IAAI;SACjD;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;QAClD,oBAAoB,EAAE,CAAC,WAAW,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,CAAC;QAC3F,YAAY,EAAE;YACZ,QAAQ,EAAE,yKAAyK;YACnL,KAAK,EAAE,sKAAsK;YAC7K,OAAO,EAAE,oMAAoM;SAC9M;KACF;IAED,UAAU,EAAE;QACV,cAAc,EAAE,CAAC,4BAA4B,EAAE,qBAAqB,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,KAAK,EAAE,aAAa,CAAC;QAClL,eAAe,EAAE;YACf,0BAA0B,EAAE,MAAM;YAClC,mBAAmB,EAAE,MAAM;YAC3B,4BAA4B,EAAE,MAAM;YACpC,uBAAuB,EAAE,MAAM;YAC/B,wBAAwB,EAAE,MAAM;YAChC,GAAG,EAAE,MAAM;YACX,WAAW,EAAE,OAAO;SACrB;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,aAAa;QACjC,qBAAqB,EAAE,YAAY;KACpC;IAED,eAAe,EAAE;QACf,8DAA8D;QAC9D,8FAA8F;QAC9F,qBAAqB,EAAE,IAAI,EAAE,yDAAyD;QACtF,oBAAoB,EAAE,IAAI,EAAE,gCAAgC;QAC5D,qBAAqB,EAAE,IAAI,EAAE,gEAAgE;QAC7F,SAAS,EAAE,qMAAqM;QAChN,WAAW,EAAE,KAAK;QAClB,wBAAwB,EAAE,IAAI;QAC9B,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,qCAAqC;KAC3D;IAED,cAAc,EAAE;QACd,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,mGAAmG;QACnG,yBAAyB,EAAE,EAAE;QAC7B,SAAS,EAAE,+NAA+N;QAC1O,kBAAkB,EAAE,CAAC,yBAAyB,EAAE,yCAAyC,EAAE,0BAA0B,EAAE,uBAAuB,CAAC;QAC/I,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,sCAAsC;YAC1C,WAAW,EAAE,6KAA6K;YAC1L,SAAS,EAAE,6GAA6G;YACxH,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,8CAA8C;YAClD,WAAW,EAAE,mLAAmL;YAChM,SAAS,EAAE,yHAAyH;YACpI,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,WAAW,EAAE,4HAA4H;YACzI,SAAS,EAAE,oHAAoH;YAC/H,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,WAAW,EAAE,+IAA+I;YAC5J,SAAS,EAAE,sGAAsG;YACjH,KAAK,EAAE,wBAAwB;YAC/B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,yBAAyB;YAC7B,WAAW,EAAE,uHAAuH;YACpI,SAAS,EAAE,6IAA6I;YACxJ,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,qCAAqC;YACzC,WAAW,EAAE,0HAA0H;YACvI,SAAS,EAAE,uGAAuG;YAClH,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,yGAAyG;YACtH,SAAS,EAAE,uHAAuH;YAClI,KAAK,EAAE,uBAAuB;YAC9B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,qCAAqC;YACzC,WAAW,EAAE,2IAA2I;YACxJ,SAAS,EAAE,oJAAoJ;YAC/J,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,WAAW,EAAE,uGAAuG;YACpH,SAAS,EAAE,wHAAwH;YACnI,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,2JAA2J;YACxK,SAAS,EAAE,iIAAiI;YAC5I,KAAK,EAAE,aAAa;YACpB,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,WAAW,EAAE,wIAAwI;YACrJ,SAAS,EAAE,4IAA4I;YACvJ,KAAK,EAAE,qBAAqB;YAC5B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,WAAW,EAAE,4JAA4J;YACzK,SAAS,EAAE,iKAAiK;YAC5K,KAAK,EAAE,4BAA4B;YACnC,YAAY,EAAE,MAAM;SACrB;KACF;CACF,CAAC"}

package/dist/esm/packs/cn-dsl-csl.js

@@ -0,0 +1,134 @@
+/**
+ * China Data Security Law (DSL) + Cybersecurity Law (CSL) Compliance Pack
+ *
+ * Statutes:
+ *   - Cybersecurity Law of the People's Republic of China (CSL),
+ *     effective 1 June 2017
+ *   - Data Security Law of the People's Republic of China (DSL),
+ *     effective 1 September 2021
+ *
+ * Jurisdiction: People's Republic of China (mainland)
+ * Authority: Cyberspace Administration of China (CAC) primary; Ministry
+ *   of Public Security; Ministry of State Security; sectoral regulators
+ *
+ * Why this pack (separate from `pipl`):
+ *   - PIPL (`pipl` pack) covers personal-information protection.
+ *   - DSL covers data classification (general / important / core),
+ *     security obligations, and data export controls.
+ *   - CSL covers network operators' obligations (CIIO designation,
+ *     security review, MLPS — Multi-Level Protection Scheme).
+ *   - All three statutes apply layered to PRC operators; DSL+CSL is the
+ *     non-personal data + network-security layer that PIPL doesn't cover.
+ *
+ * Key DSL obligations:
+ *   - **Data classification** (Art. 21): general / important / core data
+ *   - **Important Data Catalogue** — sectoral catalogues being issued
+ *     under CAC + sectoral regulator coordination
+ *   - **Cross-border transfer security review** for important data
+ *   - **National security data review** (Arts. 23-26)
+ *
+ * Key CSL obligations:
+ *   - **CIIO designation** (Critical Information Infrastructure
+ *     Operator) — heightened security obligations
+ *   - **MLPS 2.0** — five-level cybersecurity grading scheme; level 2+
+ *     entities require formal grading + security testing
+ *   - **Network product security review** for CIIO procurement
+ *   - **Real-name identity registration** for network services
+ *   - **Annual self-assessment + security review** for CIIOs
+ *
+ * Penalties (DSL + CSL):
+ *   - DSL: up to RMB 10M for serious violations of important-data
+ *     transfer rules; RMB 500K-2M for general violations
+ *   - CSL: up to RMB 1M for general; CIIO violations heightened
+ *
+ * @connexum/ai-governance
+ */
+export const CN_DSL_CSL_CATEGORY_CLASSIFIERS = {
+    DATA_CLASSIFICATION_CN: {
+        references: ['DSL Art. 21 — data classification general / important / core'],
+        classifier: (i) => /\b(?:general\s+data\s+china|important\s+data\s+china|core\s+data\s+china|dsl\s+art\.?\s*21|china\s+data\s+classification)\b/i.test(i),
+    },
+    CIIO_DESIGNATION: {
+        references: ['CSL Art. 31 — Critical Information Infrastructure Operator'],
+        classifier: (i) => /\b(?:ciio\s+(?:designation|china|critical\s+information\s+infrastructure)|csl\s+art\.?\s*31|cii\s+china)\b/i.test(i),
+    },
+    MLPS_GRADING: {
+        references: ['CSL — Multi-Level Protection Scheme (MLPS 2.0)'],
+        classifier: (i) => /\b(?:mlps\s+(?:2|grading|level|china)|multi[\s-]?level\s+protection\s+scheme|china\s+security\s+grading)\b/i.test(i),
+    },
+    CROSS_BORDER_DSL: {
+        references: ['DSL Arts. 23-26 + CAC cross-border transfer review'],
+        classifier: (i) => /\b(?:cac\s+(?:cross[\s-]?border|security\s+review|export\s+approval)|china\s+data\s+export\s+review|dsl\s+cross[\s-]?border)\b/i.test(i),
+    },
+    CN_INCIDENT_REPORTING: {
+        references: ['CSL Art. 25 + DSL Art. 31 — incident reporting to CAC'],
+        classifier: (i) => /\b(?:cac\s+(?:incident|notification|breach\s+report)|csl\s+art\.?\s*25|dsl\s+art\.?\s*31|china\s+cyber\s+incident)\b/i.test(i),
+    },
+    CREDENTIALS: {
+        references: ['Cross-pack secrets safety'],
+        classifier: (i) => {
+            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(i))
+                return true;
+            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(i))
+                return true;
+            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(i))
+                return true;
+            return false;
+        },
+    },
+};
+export const CN_DSL_CSL_PACK = {
+    categoryClassifiers: CN_DSL_CSL_CATEGORY_CLASSIFIERS,
+    id: 'cn-dsl-csl',
+    aliases: ['china-dsl', 'china-csl', 'china-dsl-csl', 'data-security-law-china', 'cybersecurity-law-china', 'mlps-china'],
+    name: 'China Data Security Law + Cybersecurity Law (DSL + CSL)',
+    version: '1.0.0',
+    description: 'Layered PRC data + network security regime. DSL (effective Sept 2021): data classification (general / important / core), important-data catalogue, cross-border transfer security review, national-security data review. CSL (effective June 2017): CIIO (Critical Information Infrastructure Operator) designation, MLPS 2.0 (Multi-Level Protection Scheme) five-level cybersecurity grading, network product security review, real-name registration. Distinct from `pipl` (which covers personal-information protection); all three apply layered to PRC operators. Penalties up to RMB 10M (DSL serious violations) + RMB 1M (CSL).',
+    authority: 'Cyberspace Administration of China (CAC) + Ministry of Public Security + Ministry of State Security + sectoral regulators',
+    industries: ['technology', 'cloud-infrastructure', 'critical-national-infrastructure', 'energy', 'telecoms', 'financial-services', 'healthcare', 'transport'],
+    requiredModules: [
+        { name: 'attestation-manager', required: true, reason: 'Data-classification record (general / important / core); CIIO designation status; MLPS grading; cross-border transfer security review evidence.', reference: 'DSL Art. 21 + CSL Art. 31 + MLPS' },
+        { name: 'governance-runtime', required: true, reason: 'Default-deny on important-data export without CAC security review approval; CIIO procurement gate (network product security review).', reference: 'DSL Arts. 23-26 + CSL CIIO procurement' },
+        { name: 'event-bus', required: true, reason: 'CAC incident reporting; CIIO annual self-assessment reminders; MLPS re-grading triggers.', reference: 'CSL Art. 25 + DSL Art. 31' },
+        { name: 'audit-integrity', required: true, reason: 'Tamper-evident audit chain for data-classification revisions, CAC cross-border review evidence, MLPS audit responses.', reference: 'DSL + CSL evidence integrity' },
+        { name: 'data-classifier', required: true, reason: 'Surface DSL + CSL evidence categories.', reference: 'DSL + CSL evidence categorisation' },
+        { name: 'transparency-injector', required: true, reason: 'Real-name registration prompts (CSL Art. 24); user-facing cross-border transfer disclosure.', reference: 'CSL Art. 24 + DSL transfer disclosure' },
+        { name: 'approval-queue', required: true, reason: 'CAC cross-border transfer approval; MLPS grading sign-off; CIIO procurement approval.', reference: 'DSL Arts. 23-26 + CSL CIIO' },
+        { name: 'session-persistence', required: true, reason: 'CAC + MLPS evidence retention; typically 5+ years for security-review records.', reference: 'CSL + DSL retention practice' },
+        { name: 'agent-auth', required: true, reason: 'CIIO security officer named-role binding; real-name registration enforcement.', reference: 'CSL Arts. 24, 31' },
+        { name: 'supply-chain', required: true, reason: 'Sub-supplier MLPS attestation; CIIO procurement security-review cascade.', reference: 'CSL CIIO procurement' },
+    ],
+    moduleConfig: {
+        'attestation-manager': { dataClassificationTracked: true, ciioDesignationTracked: true, mlpsGradingTracked: true, cacReviewEvidenceTracked: true },
+        'governance-runtime': { importantDataExportGateRequired: true, ciioProcurementGateRequired: true },
+        'event-bus': { cacIncidentReportingRequired: true, ciioAnnualReviewRemindersRequired: true, mlpsRegradingTriggersRequired: true },
+        'audit-integrity': { dslCslEvidenceTrackingRequired: true },
+        'data-classifier': { enabledCategories: ['DATA_CLASSIFICATION_CN', 'CIIO_DESIGNATION', 'MLPS_GRADING', 'CROSS_BORDER_DSL', 'CN_INCIDENT_REPORTING', 'CREDENTIALS'], credentialsAction: 'BLOCK' },
+        'transparency-injector': { realNameRegistrationPromptsRequired: true, crossBorderTransferDisclosureRequired: true },
+        'approval-queue': { reviewTier: 'T2' },
+        'session-persistence': { retentionDaysMinimum: 1825 },
+        'agent-auth': { ciioSecurityOfficerNamedRoleRequired: true },
+        'supply-chain': { mlpsAttestationCascadeRequired: true },
+    },
+    providerPolicy: { blockedProviders: [], requiredCapabilities: ['CHINA-DATA-RESIDENCY', 'CAC-COMPATIBLE', 'MLPS-COMPATIBLE'], blockReasons: {} },
+    dataPolicy: {
+        scanCategories: ['DATA_CLASSIFICATION_CN', 'CIIO_DESIGNATION', 'MLPS_GRADING', 'CROSS_BORDER_DSL', 'CN_INCIDENT_REPORTING', 'CREDENTIALS'],
+        categoryActions: { DATA_CLASSIFICATION_CN: 'WARN', CIIO_DESIGNATION: 'WARN', MLPS_GRADING: 'WARN', CROSS_BORDER_DSL: 'WARN', CN_INCIDENT_REPORTING: 'WARN', CREDENTIALS: 'BLOCK' },
+        encryptionRequired: true, encryptionStandard: 'AES-256-GCM', minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: { auditLogRetentionDays: 1825, sessionRetentionDays: 1825, incidentRetentionDays: 2190, reference: 'CSL + DSL evidence retention practice', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['cn'] },
+    incidentPolicy: { notificationDeadlineHours: 24, reference: 'CSL Art. 25 + DSL Art. 31 — CAC incident reporting', requiredRecipients: ['cac', 'mps-china', 'sectoral-regulator-china'], formalNotificationRequired: true },
+    validators: [
+        { id: 'cn-dsl-data-classification', description: 'Data classified (general / important / core) per DSL Art. 21; classification rationale documented.', reference: 'DSL Art. 21', check: 'attestation_active', failSeverity: 'CRITICAL' },
+        { id: 'cn-csl-ciio-status', description: 'CIIO designation status tracked; CIIO obligations operative when designated.', reference: 'CSL Art. 31', check: 'attestation_active', failSeverity: 'CRITICAL' },
+        { id: 'cn-csl-mlps-grading', description: 'MLPS grading completed (Level 2+ requires formal grading + security testing).', reference: 'CSL MLPS 2.0', check: 'attestation_active', failSeverity: 'CRITICAL' },
+        { id: 'cn-dsl-cross-border', description: 'CAC cross-border transfer approval evidence captured for important data.', reference: 'DSL Arts. 23-26', check: 'governance_active', failSeverity: 'CRITICAL' },
+        { id: 'cn-incident-reporting', description: 'CAC incident-reporting path active; CIIO annual self-assessment cycle.', reference: 'CSL Art. 25 + DSL Art. 31', check: 'monitoring_active', failSeverity: 'HIGH' },
+        { id: 'cn-supplier-flow-down', description: 'Sub-supplier MLPS attestation captured; CIIO procurement security-review cascade.', reference: 'CSL CIIO procurement', check: 'subservice_registry_active', failSeverity: 'HIGH' },
+        { id: 'cn-evidence-audit-trail', description: 'Tamper-evident audit chain over data-classification + CAC review + MLPS evidence.', reference: 'DSL + CSL evidence integrity', check: 'audit_trail_exists', failSeverity: 'HIGH' },
+        { id: 'cn-encryption', description: 'Important + core data encrypted at rest and in transit.', reference: 'DSL + CSL security obligations', check: 'encryption_active', failSeverity: 'HIGH' },
+        { id: 'cn-real-name-registration', description: 'Real-name registration enforcement for network services per CSL Art. 24.', reference: 'CSL Art. 24', check: 'transparency_active', failSeverity: 'MEDIUM' },
+        { id: 'cn-credential-block', description: 'Plaintext credentials blocked.', reference: 'DSL + CSL security obligations', check: 'data_classifier_active', failSeverity: 'CRITICAL' },
+    ],
+};
+//# sourceMappingURL=cn-dsl-csl.js.map

package/dist/esm/packs/cn-dsl-csl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cn-dsl-csl.js","sourceRoot":"","sources":["../../../src/packs/cn-dsl-csl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAKH,MAAM,CAAC,MAAM,+BAA+B,GAAwB;IAClE,sBAAsB,EAAE;QACtB,UAAU,EAAE,CAAC,8DAA8D,CAAC;QAC5E,UAAU,EAAE,CAAC,CAAS,EAAW,EAAE,CAAC,8HAA8H,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3K;IACD,gBAAgB,EAAE;QAChB,UAAU,EAAE,CAAC,4DAA4D,CAAC;QAC1E,UAAU,EAAE,CAAC,CAAS,EAAW,EAAE,CAAC,6GAA6G,CAAC,IAAI,CAAC,CAAC,CAAC;KAC1J;IACD,YAAY,EAAE;QACZ,UAAU,EAAE,CAAC,gDAAgD,CAAC;QAC9D,UAAU,EAAE,CAAC,CAAS,EAAW,EAAE,CAAC,6GAA6G,CAAC,IAAI,CAAC,CAAC,CAAC;KAC1J;IACD,gBAAgB,EAAE;QAChB,UAAU,EAAE,CAAC,oDAAoD,CAAC;QAClE,UAAU,EAAE,CAAC,CAAS,EAAW,EAAE,CAAC,iIAAiI,CAAC,IAAI,CAAC,CAAC,CAAC;KAC9K;IACD,qBAAqB,EAAE;QACrB,UAAU,EAAE,CAAC,uDAAuD,CAAC;QACrE,UAAU,EAAE,CAAC,CAAS,EAAW,EAAE,CAAC,uHAAuH,CAAC,IAAI,CAAC,CAAC,CAAC;KACpK;IACD,WAAW,EAAE;QACX,UAAU,EAAE,CAAC,2BAA2B,CAAC;QACzC,UAAU,EAAE,CAAC,CAAS,EAAW,EAAE;YACjC,IAAI,qEAAqE,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/F,IAAI,2DAA2D,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrF,IAAI,4CAA4C,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAkE;IAC5F,mBAAmB,EAAE,+BAA+B;IACpD,EAAE,EAAE,YAAY;IAChB,OAAO,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,YAAY,CAAC;IACxH,IAAI,EAAE,yDAAyD;IAC/D,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,0mBAA0mB;IAC5mB,SAAS,EAAE,2HAA2H;IACtI,UAAU,EAAE,CAAC,YAAY,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,QAAQ,EAAE,UAAU,EAAE,oBAAoB,EAAE,YAAY,EAAE,WAAW,CAAC;IAC7J,eAAe,EAAE;QACf,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iJAAiJ,EAAE,SAAS,EAAE,kCAAkC,EAAE;QACzP,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,sIAAsI,EAAE,SAAS,EAAE,wCAAwC,EAAE;QACnP,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,0FAA0F,EAAE,SAAS,EAAE,2BAA2B,EAAE;QACjL,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,uHAAuH,EAAE,SAAS,EAAE,8BAA8B,EAAE;QACvN,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,wCAAwC,EAAE,SAAS,EAAE,mCAAmC,EAAE;QAC7I,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,6FAA6F,EAAE,SAAS,EAAE,uCAAuC,EAAE;QAC5M,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,uFAAuF,EAAE,SAAS,EAAE,4BAA4B,EAAE;QACpL,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,gFAAgF,EAAE,SAAS,EAAE,8BAA8B,EAAE;QACpL,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,+EAA+E,EAAE,SAAS,EAAE,kBAAkB,EAAE;QAC9J,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,0EAA0E,EAAE,SAAS,EAAE,sBAAsB,EAAE;KAChK;IACD,YAAY,EAAE;QACZ,qBAAqB,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE;QAClJ,oBAAoB,EAAE,EAAE,+BAA+B,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE;QAClG,WAAW,EAAE,EAAE,4BAA4B,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE;QACjI,iBAAiB,EAAE,EAAE,8BAA8B,EAAE,IAAI,EAAE;QAC3D,iBAAiB,EAAE,EAAE,iBAAiB,EAAE,CAAC,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,aAAa,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE;QAChM,uBAAuB,EAAE,EAAE,mCAAmC,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE;QACnH,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;QACtC,qBAAqB,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE;QACrD,YAAY,EAAE,EAAE,oCAAoC,EAAE,IAAI,EAAE;QAC5D,cAAc,EAAE,EAAE,8BAA8B,EAAE,IAAI,EAAE;KACzD;IACD,cAAc,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,sBAAsB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE;IAC/I,UAAU,EAAE;QACV,cAAc,EAAE,CAAC,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,aAAa,CAAC;QAC1I,eAAe,EAAE,EAAE,sBAAsB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE;QAClL,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,qBAAqB,EAAE,YAAY;KACjG;IACD,eAAe,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,EAAE,uCAAuC,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE;IACtO,cAAc,EAAE,EAAE,yBAAyB,EAAE,EAAE,EAAE,SAAS,EAAE,oDAAoD,EAAE,kBAAkB,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,0BAA0B,CAAC,EAAE,0BAA0B,EAAE,IAAI,EAAE;IAC1N,UAAU,EAAE;QACV,EAAE,EAAE,EAAE,4BAA4B,EAAE,WAAW,EAAE,oGAAoG,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,UAAU,EAAE;QACxO,EAAE,EAAE,EAAE,oBAAoB,EAAE,WAAW,EAAE,8EAA8E,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,UAAU,EAAE;QAC1M,EAAE,EAAE,EAAE,qBAAqB,EAAE,WAAW,EAAE,+EAA+E,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,UAAU,EAAE;QAC7M,EAAE,EAAE,EAAE,qBAAqB,EAAE,WAAW,EAAE,0EAA0E,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,UAAU,EAAE;QAC1M,EAAE,EAAE,EAAE,uBAAuB,EAAE,WAAW,EAAE,wEAAwE,EAAE,SAAS,EAAE,2BAA2B,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,EAAE;QAChN,EAAE,EAAE,EAAE,uBAAuB,EAAE,WAAW,EAAE,mFAAmF,EAAE,SAAS,EAAE,sBAAsB,EAAE,KAAK,EAAE,4BAA4B,EAAE,YAAY,EAAE,MAAM,EAAE;QAC/N,EAAE,EAAE,EAAE,yBAAyB,EAAE,WAAW,EAAE,mFAAmF,EAAE,SAAS,EAAE,8BAA8B,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,EAAE;QACjO,EAAE,EAAE,EAAE,eAAe,EAAE,WAAW,EAAE,yDAAyD,EAAE,SAAS,EAAE,gCAAgC,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,EAAE;QAC9L,EAAE,EAAE,EAAE,2BAA2B,EAAE,WAAW,EAAE,0EAA0E,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,QAAQ,EAAE;QAC5M,EAAE,EAAE,EAAE,qBAAqB,EAAE,WAAW,EAAE,gCAAgC,EAAE,SAAS,EAAE,gCAAgC,EAAE,KAAK,EAAE,wBAAwB,EAAE,YAAY,EAAE,UAAU,EAAE;KACrL;CACF,CAAC"}