@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/packs/iec-62304.js

@@ -0,0 +1,585 @@
+/**
+ * IEC 62304 Medical Device Software Compliance Pack
+ *
+ * IEC 62304:2006+A1:2015 -- "Medical device software -- Software life cycle
+ * processes." International Electrotechnical Commission (IEC) standard that
+ * specifies life cycle requirements for the development and maintenance of
+ * medical device software.
+ *
+ * Standards referenced (citations only; no verbatim text from the standard):
+ *   - IEC 62304:2006+A1:2015 -- core software life cycle processes
+ *   - IEC 62304 Annex B -- software safety classification rationale guidance
+ *   - ISO 14971:2019 -- risk management for medical devices (required input
+ *     to IEC 62304 software safety classification)
+ *   - IEC 82304-1:2016 -- health software; complements IEC 62304 for
+ *     standalone health software
+ *   - FDA Guidance "Content of Premarket Submissions for Device Software
+ *     Functions" (2023) -- cites IEC 62304 as the referenced standard
+ *   - EU MDR 2017/745 + MDCG 2022-2 -- reference IEC 62304 for EU CE marking
+ *   - IMDRF SaMD Framework -- references IEC 62304 processes for SaMD QMS
+ *
+ * Software Safety Classes (IEC 62304 §4.3):
+ *   - Class A: No injury or damage to health is possible from failure
+ *   - Class B: Non-serious injury is possible from failure
+ *   - Class C: Death or serious injury is possible from failure
+ *
+ * Process requirements scale with class:
+ *   - Class A: Basic documentation, maintenance process, anomaly resolution
+ *   - Class B: Class A + detailed unit-level architecture, integration testing
+ *   - Class C: Class B + detailed design, unit verification, full traceability
+ *
+ * SOUP (Software of Unknown Provenance -- IEC 62304 §3.1.17):
+ *   Any software item that is already developed and generally available,
+ *   and that has not been developed for the purpose of being incorporated
+ *   into the medical device. Third-party libraries, OS components, LLM
+ *   inference libraries, and AI framework packages all qualify as SOUP.
+ *   Class C SOUP introduction without documented evaluation is BLOCKED.
+ *
+ * Retention:
+ *   IEC 62304 §5.1.1 requires software development plan records to be
+ *   retained "for the expected lifetime of the medical device." Combined
+ *   with FDA 21 CFR 820 (QMSR), EU MDR PMS, and MHRA guidance, the
+ *   effective minimum retention is 10 years (device lifetime + post-market
+ *   surveillance period).
+ *
+ * @connexum/ai-governance
+ */
+/**
+ * IEC 62304 category classifiers.
+ *
+ * Covers SOUP identification, software safety class declarations,
+ * risk management file data, anomaly reports, configuration items,
+ * and software safety classification artefacts.
+ */
+export const IEC_62304_CATEGORY_CLASSIFIERS = {
+    /**
+     * SOUP -- Software of Unknown Provenance (IEC 62304 §3.1.17 + §8).
+     * Detects introduction of third-party or external software items
+     * that must be evaluated and documented per the SOUP process.
+     * Class C SOUP introduction without documented evaluation is BLOCKED.
+     */
+    SOUP: {
+        references: [
+            'IEC 62304:2006+A1:2015 §3.1.17 -- SOUP definition',
+            'IEC 62304:2006+A1:2015 §8 -- software items of unknown provenance',
+        ],
+        classifier: (input) => {
+            // Direct SOUP terminology
+            if (/\b(?:SOUP|software\s+of\s+unknown\s+provenance)\b/i.test(input))
+                return true;
+            // Third-party library / package introduction signals
+            if (/\b(?:npm\s+install|pip\s+install|yarn\s+add|cargo\s+add)\s+[^\s]+/i.test(input))
+                return true;
+            // Third-party component references in medical context
+            if (/\b(?:third.?party\s+(?:library|package|component|module|framework)|external\s+(?:library|dependency|component))\b/i.test(input))
+                return true;
+            // SOUP evaluation artefacts
+            if (/\b(?:SOUP\s+(?:list|evaluation|assessment|register|record)|SOUP_LIST|soup_eval)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * MEDICAL_DEVICE_SOFTWARE_CLASS_A -- Software safety class A artefacts.
+     * No injury or damage to health is possible from a software failure.
+     * Lowest process requirements; basic documentation + maintenance sufficient.
+     */
+    MEDICAL_DEVICE_SOFTWARE_CLASS_A: {
+        references: [
+            'IEC 62304:2006+A1:2015 §4.3 -- Software safety classification',
+            'IEC 62304 Annex B -- classification rationale',
+        ],
+        classifier: (input) => {
+            if (/\b(?:Class\s+A\s+(?:software|SaMD|device\s+software)|software\s+(?:safety\s+)?class\s+A|IEC.?62304\s+Class\s+A)\b/i.test(input))
+                return true;
+            if (/\b(?:class_a_software|CLASS_A_SAMD|safety.?class.?a)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * MEDICAL_DEVICE_SOFTWARE_CLASS_B -- Software safety class B artefacts.
+     * Non-serious injury is possible from a software failure.
+     * Class A requirements + unit-level architecture + integration testing.
+     */
+    MEDICAL_DEVICE_SOFTWARE_CLASS_B: {
+        references: [
+            'IEC 62304:2006+A1:2015 §4.3 -- Software safety classification',
+            'IEC 62304 Annex B -- classification rationale',
+        ],
+        classifier: (input) => {
+            if (/\b(?:Class\s+B\s+(?:software|SaMD|device\s+software)|software\s+(?:safety\s+)?class\s+B|IEC.?62304\s+Class\s+B)\b/i.test(input))
+                return true;
+            if (/\b(?:class_b_software|CLASS_B_SAMD|safety.?class.?b)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * MEDICAL_DEVICE_SOFTWARE_CLASS_C -- Software safety class C artefacts.
+     * Death or serious injury is possible from a software failure.
+     * Highest process burden: detailed design, unit verification, full traceability.
+     * SOUP introduction without evaluation is BLOCKED at this class.
+     */
+    MEDICAL_DEVICE_SOFTWARE_CLASS_C: {
+        references: [
+            'IEC 62304:2006+A1:2015 §4.3 -- Software safety classification',
+            'IEC 62304 Annex B -- classification rationale',
+            'IEC 62304:2006+A1:2015 §8 -- SOUP requirements for Class C',
+        ],
+        classifier: (input) => {
+            if (/\b(?:Class\s+C\s+(?:software|SaMD|device\s+software)|software\s+(?:safety\s+)?class\s+C|IEC.?62304\s+Class\s+C)\b/i.test(input))
+                return true;
+            if (/\b(?:class_c_software|CLASS_C_SAMD|safety.?class.?c)\b/i.test(input))
+                return true;
+            // Critical safety function references in device software context
+            if (/\b(?:life.?sustaining|life.?supporting|life.?critical)\s+(?:software|function|device)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * RISK_MANAGEMENT_FILE -- ISO 14971 risk management records.
+     * IEC 62304 §4.2 requires software safety classification to be based
+     * on risk management (ISO 14971). Risk management file data is LOG.
+     */
+    RISK_MANAGEMENT_FILE: {
+        references: [
+            'IEC 62304:2006+A1:2015 §4.2 -- risk management requirements',
+            'ISO 14971:2019 -- medical device risk management (cross-reference)',
+        ],
+        classifier: (input) => {
+            if (/\b(?:risk\s+management\s+file|RMF\s+(?:record|entry|update)|ISO.?14971\s+(?:record|analysis))\b/i.test(input))
+                return true;
+            if (/\b(?:hazard\s+(?:log|analysis|identification)|FMEA\s+(?:record|update)|FTA\s+(?:record|update))\b/i.test(input))
+                return true;
+            if (/\b(?:residual\s+risk\s+(?:evaluation|record|acceptability)|risk.?benefit\s+analysis)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * SOFTWARE_SAFETY_CLASSIFICATION -- formal classification artefacts.
+     * The classification decision record itself (not the class-specific data
+     * above). Covers classification rationale documents, classification
+     * review records, and reclassification events.
+     */
+    SOFTWARE_SAFETY_CLASSIFICATION: {
+        references: [
+            'IEC 62304:2006+A1:2015 §4.3 -- classification decision and rationale',
+        ],
+        classifier: (input) => {
+            if (/\b(?:software\s+safety\s+class(?:ification)?|safety\s+class(?:ification)?\s+(?:decision|rationale|record|review))\b/i.test(input))
+                return true;
+            if (/\b(?:classification\s+(?:rationale|justification|review)\s+(?:document|record)|reclassif(?:y|ication))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * ANOMALY_REPORT -- software anomaly records (IEC 62304 §9).
+     * Any condition in software that may be a defect. Anomaly reports
+     * must be evaluated, tracked, and resolved per class requirements.
+     * Class B anomaly reports are REVIEWED (approval queue).
+     */
+    ANOMALY_REPORT: {
+        references: [
+            'IEC 62304:2006+A1:2015 §9 -- software problem and change resolution',
+        ],
+        classifier: (input) => {
+            if (/\b(?:software\s+anomaly|anomaly\s+report|anomaly\s+(?:log|record|evaluation|resolution))\b/i.test(input))
+                return true;
+            if (/\b(?:problem\s+(?:report|record)\s+(?:software|device\s+software)|defect\s+(?:report|record)\s+(?:IEC|62304|device))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * CONFIGURATION_ITEM -- controlled software configuration items (IEC 62304 §8.1).
+     * Software items placed under configuration management. Includes all
+     * software deliverables: source code, object code, tools, records.
+     */
+    CONFIGURATION_ITEM: {
+        references: [
+            'IEC 62304:2006+A1:2015 §8.1 -- software configuration management planning',
+            'IEC 62304:2006+A1:2015 §8.2 -- change control',
+        ],
+        classifier: (input) => {
+            if (/\b(?:configuration\s+item|CI\s+(?:record|identifier|baseline)|software\s+(?:baseline|version\s+record))\b/i.test(input))
+                return true;
+            if (/\b(?:software\s+configuration\s+(?:management|control|record)|SCM\s+(?:record|plan|baseline))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+/**
+ * IEC 62304 Medical Device Software Compliance Pack.
+ *
+ * Pack ID: 'iec-62304'
+ * Jurisdiction: International (IEC standard; adopted globally by
+ *   FDA, EU MDR/IVDR, MHRA, TGA, Health Canada, and others as the
+ *   referenced software life cycle standard).
+ *
+ * Guard-layer wiring:
+ *   - G1-G4 (audit, logging, classification, session): always active
+ *   - G5-G6 (supply-chain, approval-queue): Class B and C only
+ *   - G7-G9 (attestation, anomaly-detection, transparency): Class C only
+ *   - Approval Queue: always active (mandatory for anomaly triage)
+ *
+ * Human-in-loop tier:
+ *   - T1: Class A (basic human review for anomaly closure + SOUP approval)
+ *   - T2: Class B + C (specialist clinical safety review required)
+ */
+export const IEC_62304_PACK = {
+    categoryClassifiers: IEC_62304_CATEGORY_CLASSIFIERS,
+    /**
+     * SOUP and anomaly records may be linked to specific software items
+     * (configuration items) that are subject-keyed per device component.
+     */
+    subjectKeyedCategories: ['SOUP', 'ANOMALY_REPORT', 'CONFIGURATION_ITEM'],
+    id: 'iec-62304',
+    name: 'IEC 62304 Medical Device Software',
+    version: '1.0.0',
+    description: 'IEC 62304:2006+A1:2015 medical device software life cycle processes. ' +
+        'Mandates software safety classification (Class A / B / C), SOUP evaluation ' +
+        'and documentation, risk-management integration (ISO 14971), configuration ' +
+        'management, anomaly resolution, and traceability. Adopted by FDA, EU MDR, ' +
+        'MHRA UKCA, TGA, and Health Canada as the baseline software QMS standard.',
+    authority: 'International Electrotechnical Commission (IEC)',
+    industries: [
+        'medical-devices',
+        'digital-health',
+        'clinical-decision-support',
+        'diagnostic-ai',
+        'therapeutic-ai',
+        'medical-device-firmware',
+        'embedded-medical-software',
+        'software-as-medical-device',
+        'in-vitro-diagnostics',
+        'wearable-health',
+    ],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'Software safety class (A/B/C) tracking; mandatory for every IEC 62304 process gate. ' +
+                'Class C requires verification at every development phase.',
+            reference: 'IEC 62304:2006+A1:2015 §4.3 -- safety classification; §5 -- software development planning',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident records for software life cycle artefacts (design records, ' +
+                'verification records, anomaly reports, SOUP evaluations). ' +
+                'Immutability required for regulatory submission evidence packages.',
+            reference: 'IEC 62304:2006+A1:2015 §5.1.1 -- development plan; §9 -- problem and change resolution',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'SOUP detection and classification; software safety class signal detection; ' +
+                'anomaly report categorisation; configuration item tracking.',
+            reference: 'IEC 62304:2006+A1:2015 §3.1.17 -- SOUP; §4.3 -- classification',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'SOUP inventory and evaluation tracking. IEC 62304 §8 requires a comprehensive ' +
+                'list of all SOUP items with known anomaly records and published errata evaluated. ' +
+                'AI frameworks, LLM inference libraries, and OS components all qualify as SOUP.',
+            reference: 'IEC 62304:2006+A1:2015 §8 -- software items of unknown provenance (SOUP)',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'Anomaly triage and closure approval routing per class. Class C anomaly closure ' +
+                'requires documented evaluation of patient safety impact before resolution. ' +
+                'SOUP introduction approval gate for Class B + C.',
+            reference: 'IEC 62304:2006+A1:2015 §9 -- software problem resolution; §8 -- SOUP',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'Software release attestations; Class C unit verification evidence; ' +
+                'SOUP evaluation attestations; software safety classification rationale sign-off.',
+            reference: 'IEC 62304:2006+A1:2015 §5.8 -- software release; §8 -- SOUP evaluation',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'Software development plan records must persist for device lifetime. ' +
+                'Continuity of audit trail across sessions is mandatory.',
+            reference: 'IEC 62304:2006+A1:2015 §5.1.1 -- software development records retention',
+        },
+        {
+            name: 'anomaly-detector',
+            required: true,
+            reason: 'Real-time detection of software anomaly signals in AI-generated code output. ' +
+                'Flags conditions that may require anomaly report initiation under §9.',
+            reference: 'IEC 62304:2006+A1:2015 §9.1 -- prepare software problem report',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'Software item intended use disclosure; AI-generated code provenance disclosure ' +
+                'to clinical engineering and regulatory affairs teams.',
+            reference: 'IEC 62304:2006+A1:2015 §5.2 -- software requirements analysis (intended use)',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'Anomaly report lifecycle event routing; SOUP evaluation status events; ' +
+                'software release event tracking.',
+            reference: 'IEC 62304:2006+A1:2015 §9 -- problem resolution lifecycle',
+        },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            softwareSafetyClassTrackingRequired: true,
+            iec62304ClassAProcessRequired: true,
+            iec62304ClassBProcessRequired: true,
+            iec62304ClassCProcessRequired: true,
+            classificationRationaleRequired: true,
+        },
+        'approval-queue': {
+            soupIntroductionApprovalRequired: true,
+            classCAnomályClosureApprovalRequired: true,
+            classBAnomályClosureApprovalRequired: true,
+            humanInLoopTierClassA: 'T1',
+            humanInLoopTierClassBC: 'T2',
+        },
+        'attestation-manager': {
+            softwareReleaseAttestationRequired: true,
+            soupEvaluationAttestationRequired: true,
+            classificationRationaleSignOffRequired: true,
+            classCUnitVerificationEvidenceRequired: true,
+        },
+        'supply-chain': {
+            soupInventoryRequired: true,
+            soupPublishedErrataEvaluationRequired: true,
+            soupKnownAnomalyEvaluationRequired: true,
+            aiFrameworkSoupClassificationRequired: true,
+        },
+        'anomaly-detector': {
+            softwareAnomalySignalDetectionActive: true,
+            classCAnomályImmediateEscalationRequired: true,
+        },
+        'transparency-injector': {
+            intendedUseDisclosureRequired: true,
+            aiGeneratedCodeProvenanceDisclosureRequired: true,
+        },
+        'event-bus': {
+            anomalyReportLifecycleEventsActive: true,
+            soupEvaluationStatusEventsActive: true,
+            softwareReleaseEventsActive: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
+        requiredCapabilities: ['IEC-62304-READY', 'MEDICAL-DEVICE-SW-LIFECYCLE'],
+        blockReasons: {
+            deepseek: 'PRC jurisdiction; cannot support IEC 62304 SOUP audit trail or ' +
+                'medical device software life cycle records under PRC data law constraints.',
+            baidu: 'PRC jurisdiction; medical device software provenance and SOUP evaluation ' +
+                'records incompatible with PRC data residency obligations.',
+            alibaba: 'PRC jurisdiction; Class C SOUP and safety classification records must ' +
+                'remain under verifiable non-PRC jurisdiction control.',
+        },
+    },
+    dataPolicy: {
+        scanCategories: [
+            'SOUP',
+            'MEDICAL_DEVICE_SOFTWARE_CLASS_A',
+            'MEDICAL_DEVICE_SOFTWARE_CLASS_B',
+            'MEDICAL_DEVICE_SOFTWARE_CLASS_C',
+            'RISK_MANAGEMENT_FILE',
+            'SOFTWARE_SAFETY_CLASSIFICATION',
+            'ANOMALY_REPORT',
+            'CONFIGURATION_ITEM',
+        ],
+        categoryActions: {
+            // Class A: logging is sufficient for audit; no blocking required
+            MEDICAL_DEVICE_SOFTWARE_CLASS_A: 'LOG',
+            // Class B: anomaly reports go to approval queue (REVIEWED)
+            MEDICAL_DEVICE_SOFTWARE_CLASS_B: 'LOG',
+            // Class C: SOUP introduction without documented evaluation is BLOCKED
+            MEDICAL_DEVICE_SOFTWARE_CLASS_C: 'LOG',
+            // SOUP: blocked at Class C (enforced via guard-layer config), logged otherwise
+            SOUP: 'BLOCK',
+            // Risk management file data always logged for traceability
+            RISK_MANAGEMENT_FILE: 'LOG',
+            // Classification artefacts require human sign-off (REVIEWED)
+            SOFTWARE_SAFETY_CLASSIFICATION: 'REVIEWED',
+            // Anomaly reports: trigger review workflow
+            ANOMALY_REPORT: 'REVIEWED',
+            // Configuration items: logged for traceability
+            CONFIGURATION_ITEM: 'LOG',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256-GCM',
+        minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: {
+        /**
+         * IEC 62304 §5.1.1: records for the expected lifetime of the medical device.
+         * Cross-referencing FDA 21 CFR 820.180 (min 2 years, device lifetime typical),
+         * EU MDR PMS obligations (device lifetime + post-market period), and MHRA
+         * guidance: effective industry practice is 10 years minimum (3650 days).
+         * AI-generated code artefacts and SOUP evaluations are device-lifetime records.
+         */
+        sovereignty: ['international'],
+        auditLogRetentionDays: 3650, // 10 years -- device lifetime + post-market
+        sessionRetentionDays: 3650,
+        incidentRetentionDays: 3650,
+        reference: 'IEC 62304:2006+A1:2015 §5.1.1 -- records retained for device lifetime. ' +
+            'Cross-reference: FDA 21 CFR 820.180 (QMSR records); EU MDR 2017/745 ' +
+            'post-market surveillance obligations. Effective minimum: 10 years.',
+    },
+    incidentPolicy: {
+        /**
+         * IEC 62304 §9 anomaly resolution: no calendar deadline for anomaly closure,
+         * but risk-proportionate urgency is required. For regulatorily-reportable
+         * incidents (MDR, FSCA, MAUDE): the relevant jurisdiction's reporting deadline
+         * applies (15-30 days per applicable regulation). Using 360 hours (15 days)
+         * as the most restrictive cross-jurisdictional baseline (MHRA serious incident).
+         */
+        notificationDeadlineHours: 360, // 15 days -- MHRA serious incident baseline
+        reference: 'IEC 62304:2006+A1:2015 §9 -- software problem resolution; risk-proportionate ' +
+            'urgency required. Jurisdictional incident reporting deadlines apply separately ' +
+            '(MHRA 15 days; FDA MDR 30 days; EU MDR 15 days for serious incidents).',
+        requiredRecipients: [
+            'clinical-safety-officer',
+            'quality-management',
+            'regulatory-affairs',
+            'risk-management',
+        ],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'iec62304-safety-class',
+            description: 'Software safety class (A, B, or C) assigned and documented with rationale ' +
+                'derived from ISO 14971 risk management analysis',
+            reference: 'IEC 62304:2006+A1:2015 §4.3; ISO 14971:2019 risk management cross-reference',
+            check: 'iec62304_safety_class_assigned',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'iec62304-soup-inventory',
+            description: 'SOUP inventory on file; all software items of unknown provenance identified, ' +
+                'published errata evaluated, known anomaly lists reviewed per class requirements',
+            reference: 'IEC 62304:2006+A1:2015 §8 -- SOUP requirements',
+            check: 'iec62304_soup_inventory_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'iec62304-development-plan',
+            description: 'Software development plan established; scope, standards, tools, and ' +
+                'deliverables defined; class-appropriate life cycle model selected',
+            reference: 'IEC 62304:2006+A1:2015 §5.1 -- software development planning',
+            check: 'iec62304_development_plan_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62304-requirements-analysis',
+            description: 'Software requirements documented with functional, performance, interface, ' +
+                'and safety requirements including constraints derived from risk management',
+            reference: 'IEC 62304:2006+A1:2015 §5.2 -- software requirements analysis',
+            check: 'iec62304_requirements_analysis_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62304-architecture',
+            description: 'Software architecture documented; software items identified; ' +
+                'Class B + C: separate software unit identification required',
+            reference: 'IEC 62304:2006+A1:2015 §5.3 -- software architectural design',
+            check: 'iec62304_architecture_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62304-class-c-unit-verification',
+            description: 'Class C: software unit verification procedures executed; acceptance ' +
+                'criteria defined and results documented for every software unit',
+            reference: 'IEC 62304:2006+A1:2015 §5.5 -- software unit verification (Class C)',
+            check: 'iec62304_class_c_unit_verification_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'iec62304-integration-testing',
+            description: 'Software integration testing executed; Class B + C: integration test ' +
+                'plan, procedures, and results documented per integrated software item',
+            reference: 'IEC 62304:2006+A1:2015 §5.6 -- software integration and integration testing',
+            check: 'iec62304_integration_testing_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62304-system-testing',
+            description: 'Software system testing executed; test plan, procedures, and results ' +
+                'documented; regression testing for changes',
+            reference: 'IEC 62304:2006+A1:2015 §5.7 -- software system testing',
+            check: 'iec62304_system_testing_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62304-release-records',
+            description: 'Software release records on file; software version label, list of ' +
+                'software items, known residual anomalies documented prior to release',
+            reference: 'IEC 62304:2006+A1:2015 §5.8 -- software release',
+            check: 'iec62304_release_records_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62304-config-management',
+            description: 'Software configuration management plan active; all software items ' +
+                'placed under configuration control; change control procedures enforced',
+            reference: 'IEC 62304:2006+A1:2015 §8.1-§8.4 -- configuration management',
+            check: 'iec62304_config_management_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62304-anomaly-resolution',
+            description: 'Software anomaly resolution process active; anomaly reports evaluated ' +
+                'for patient safety impact; Class C closure requires documented safety review',
+            reference: 'IEC 62304:2006+A1:2015 §9 -- software problem and change resolution',
+            check: 'iec62304_anomaly_resolution_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'iec62304-class-c-soup-block',
+            description: 'Class C: unauthorised SOUP introduction blocked; every SOUP addition ' +
+                'requires documented evaluation of published anomalies and errata before ' +
+                'use in safety-critical software paths',
+            reference: 'IEC 62304:2006+A1:2015 §8 -- SOUP (Class C strictest requirements)',
+            check: 'iec62304_class_c_soup_block_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'iec62304-behavioral-validator-class-c-change',
+            description: 'Behavioral validator: detects unverified software changes to Class C items. ' +
+                'Any AI-generated modification to a Class C software unit must be blocked ' +
+                'pending unit verification and safety impact evaluation.',
+            reference: 'IEC 62304:2006+A1:2015 §5.5 + §6.1 -- unit verification; maintenance planning',
+            check: 'behavioralValidator_iec62304_class_c_unverified_change',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'iec62304-behavioral-validator-class-b-anomaly',
+            description: 'Behavioral validator: Class B anomaly reports enter approval queue for ' +
+                'clinical safety officer review before closure. Non-serious injury risk ' +
+                'requires documented evaluation prior to anomaly resolution.',
+            reference: 'IEC 62304:2006+A1:2015 §9 -- anomaly evaluation and resolution (Class B)',
+            check: 'behavioralValidator_iec62304_class_b_anomaly_reviewed',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'iec62304-maintenance-plan',
+            description: 'Software maintenance plan established; problem reporting, change evaluation, ' +
+                'and modification processes defined for post-release phase',
+            reference: 'IEC 62304:2006+A1:2015 §6 -- software maintenance plan',
+            check: 'iec62304_maintenance_plan_active',
+            failSeverity: 'MEDIUM',
+        },
+    ],
+};
+//# sourceMappingURL=iec-62304.js.map

package/dist/esm/packs/iec-62304.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iec-62304.js","sourceRoot":"","sources":["../../../src/packs/iec-62304.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB;IACjE;;;;;OAKG;IACH,IAAI,EAAE;QACJ,UAAU,EAAE;YACV,mDAAmD;YACnD,mEAAmE;SACpE;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,0BAA0B;YAC1B,IAAI,oDAAoD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClF,qDAAqD;YACrD,IAAI,oEAAoE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClG,sDAAsD;YACtD,IAAI,oHAAoH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClJ,4BAA4B;YAC5B,IAAI,oFAAoF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IAED;;;;OAIG;IACH,+BAA+B,EAAE;QAC/B,UAAU,EAAE;YACV,+DAA+D;YAC/D,+CAA+C;SAChD;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,oHAAoH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClJ,IAAI,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvF,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IAED;;;;OAIG;IACH,+BAA+B,EAAE;QAC/B,UAAU,EAAE;YACV,+DAA+D;YAC/D,+CAA+C;SAChD;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,oHAAoH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClJ,IAAI,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvF,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IAED;;;;;OAKG;IACH,+BAA+B,EAAE;QAC/B,UAAU,EAAE;YACV,+DAA+D;YAC/D,+CAA+C;YAC/C,4DAA4D;SAC7D;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,oHAAoH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClJ,IAAI,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvF,iEAAiE;YACjE,IAAI,0FAA0F,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IAED;;;;OAIG;IACH,oBAAoB,EAAE;QACpB,UAAU,EAAE;YACV,6DAA6D;YAC7D,oEAAoE;SACrE;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,kGAAkG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChI,IAAI,oGAAoG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClI,IAAI,yFAAyF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IAED;;;;;OAKG;IACH,8BAA8B,EAAE;QAC9B,UAAU,EAAE;YACV,sEAAsE;SACvE;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,sHAAsH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpJ,IAAI,2GAA2G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IAED;;;;;OAKG;IACH,cAAc,EAAE;QACd,UAAU,EAAE;YACV,qEAAqE;SACtE;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,6FAA6F,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3H,IAAI,yHAAyH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvJ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IAED;;;;OAIG;IACH,kBAAkB,EAAE;QAClB,UAAU,EAAE;YACV,2EAA2E;YAC3E,+CAA+C;SAChD;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,4GAA4G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1I,IAAI,kGAAkG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,cAAc,GAGvB;IACF,mBAAmB,EAAE,8BAA8B;IACnD;;;OAGG;IACH,sBAAsB,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,CAAC;IAExE,EAAE,EAAE,WAAW;IACf,IAAI,EAAE,mCAAmC;IACzC,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,uEAAuE;QACvE,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,0EAA0E;IAC5E,SAAS,EAAE,iDAAiD;IAC5D,UAAU,EAAE;QACV,iBAAiB;QACjB,gBAAgB;QAChB,2BAA2B;QAC3B,eAAe;QACf,gBAAgB;QAChB,yBAAyB;QACzB,2BAA2B;QAC3B,4BAA4B;QAC5B,sBAAsB;QACtB,iBAAiB;KAClB;IAED,eAAe,EAAE;QACf;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EACJ,sFAAsF;gBACtF,2DAA2D;YAC7D,SAAS,EAAE,2FAA2F;SACvG;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EACJ,4EAA4E;gBAC5E,4DAA4D;gBAC5D,oEAAoE;YACtE,SAAS,EAAE,wFAAwF;SACpG;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EACJ,6EAA6E;gBAC7E,6DAA6D;YAC/D,SAAS,EAAE,gEAAgE;SAC5E;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EACJ,gFAAgF;gBAChF,oFAAoF;gBACpF,gFAAgF;YAClF,SAAS,EAAE,0EAA0E;SACtF;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EACJ,iFAAiF;gBACjF,6EAA6E;gBAC7E,kDAAkD;YACpD,SAAS,EAAE,sEAAsE;SAClF;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EACJ,qEAAqE;gBACrE,kFAAkF;YACpF,SAAS,EAAE,wEAAwE;SACpF;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EACJ,sEAAsE;gBACtE,yDAAyD;YAC3D,SAAS,EAAE,yEAAyE;SACrF;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EACJ,+EAA+E;gBAC/E,uEAAuE;YACzE,SAAS,EAAE,gEAAgE;SAC5E;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,IAAI;YACd,MAAM,EACJ,iFAAiF;gBACjF,uDAAuD;YACzD,SAAS,EAAE,8EAA8E;SAC1F;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EACJ,yEAAyE;gBACzE,kCAAkC;YACpC,SAAS,EAAE,2DAA2D;SACvE;KACF;IAED,YAAY,EAAE;QACZ,oBAAoB,EAAE;YACpB,mCAAmC,EAAE,IAAI;YACzC,6BAA6B,EAAE,IAAI;YACnC,6BAA6B,EAAE,IAAI;YACnC,6BAA6B,EAAE,IAAI;YACnC,+BAA+B,EAAE,IAAI;SACtC;QACD,gBAAgB,EAAE;YAChB,gCAAgC,EAAE,IAAI;YACtC,oCAAoC,EAAE,IAAI;YAC1C,oCAAoC,EAAE,IAAI;YAC1C,qBAAqB,EAAE,IAAI;YAC3B,sBAAsB,EAAE,IAAI;SAC7B;QACD,qBAAqB,EAAE;YACrB,kCAAkC,EAAE,IAAI;YACxC,iCAAiC,EAAE,IAAI;YACvC,sCAAsC,EAAE,IAAI;YAC5C,sCAAsC,EAAE,IAAI;SAC7C;QACD,cAAc,EAAE;YACd,qBAAqB,EAAE,IAAI;YAC3B,qCAAqC,EAAE,IAAI;YAC3C,kCAAkC,EAAE,IAAI;YACxC,qCAAqC,EAAE,IAAI;SAC5C;QACD,kBAAkB,EAAE;YAClB,oCAAoC,EAAE,IAAI;YAC1C,wCAAwC,EAAE,IAAI;SAC/C;QACD,uBAAuB,EAAE;YACvB,6BAA6B,EAAE,IAAI;YACnC,2CAA2C,EAAE,IAAI;SAClD;QACD,WAAW,EAAE;YACX,kCAAkC,EAAE,IAAI;YACxC,gCAAgC,EAAE,IAAI;YACtC,2BAA2B,EAAE,IAAI;SAClC;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;QAClD,oBAAoB,EAAE,CAAC,iBAAiB,EAAE,6BAA6B,CAAC;QACxE,YAAY,EAAE;YACZ,QAAQ,EACN,iEAAiE;gBACjE,4EAA4E;YAC9E,KAAK,EACH,2EAA2E;gBAC3E,2DAA2D;YAC7D,OAAO,EACL,wEAAwE;gBACxE,uDAAuD;SAC1D;KACF;IAED,UAAU,EAAE;QACV,cAAc,EAAE;YACd,MAAM;YACN,iCAAiC;YACjC,iCAAiC;YACjC,iCAAiC;YACjC,sBAAsB;YACtB,gCAAgC;YAChC,gBAAgB;YAChB,oBAAoB;SACrB;QACD,eAAe,EAAE;YACf,iEAAiE;YACjE,+BAA+B,EAAE,KAAK;YACtC,2DAA2D;YAC3D,+BAA+B,EAAE,KAAK;YACtC,sEAAsE;YACtE,+BAA+B,EAAE,KAAK;YACtC,+EAA+E;YAC/E,IAAI,EAAE,OAAO;YACb,2DAA2D;YAC3D,oBAAoB,EAAE,KAAK;YAC3B,6DAA6D;YAC7D,8BAA8B,EAAE,UAAU;YAC1C,2CAA2C;YAC3C,cAAc,EAAE,UAAU;YAC1B,+CAA+C;YAC/C,kBAAkB,EAAE,KAAK;SAC1B;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,aAAa;QACjC,qBAAqB,EAAE,YAAY;KACpC;IAED,eAAe,EAAE;QACf;;;;;;WAMG;QACH,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,qBAAqB,EAAE,IAAI,EAAE,4CAA4C;QACzE,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EACP,yEAAyE;YACzE,sEAAsE;YACtE,oEAAoE;KACvE;IAED,cAAc,EAAE;QACd;;;;;;WAMG;QACH,yBAAyB,EAAE,GAAG,EAAE,4CAA4C;QAC5E,SAAS,EACP,+EAA+E;YAC/E,iFAAiF;YACjF,wEAAwE;QAC1E,kBAAkB,EAAE;YAClB,yBAAyB;YACzB,oBAAoB;YACpB,oBAAoB;YACpB,iBAAiB;SAClB;QACD,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,uBAAuB;YAC3B,WAAW,EACT,4EAA4E;gBAC5E,iDAAiD;YACnD,SAAS,EAAE,6EAA6E;YACxF,KAAK,EAAE,gCAAgC;YACvC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,yBAAyB;YAC7B,WAAW,EACT,+EAA+E;gBAC/E,iFAAiF;YACnF,SAAS,EAAE,gDAAgD;YAC3D,KAAK,EAAE,gCAAgC;YACvC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,WAAW,EACT,sEAAsE;gBACtE,mEAAmE;YACrE,SAAS,EAAE,8DAA8D;YACzE,KAAK,EAAE,kCAAkC;YACzC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,gCAAgC;YACpC,WAAW,EACT,4EAA4E;gBAC5E,4EAA4E;YAC9E,SAAS,EAAE,+DAA+D;YAC1E,KAAK,EAAE,uCAAuC;YAC9C,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,WAAW,EACT,+DAA+D;gBAC/D,6DAA6D;YAC/D,SAAS,EAAE,8DAA8D;YACzE,KAAK,EAAE,8BAA8B;YACrC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,oCAAoC;YACxC,WAAW,EACT,sEAAsE;gBACtE,iEAAiE;YACnE,SAAS,EAAE,qEAAqE;YAChF,KAAK,EAAE,2CAA2C;YAClD,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,8BAA8B;YAClC,WAAW,EACT,uEAAuE;gBACvE,uEAAuE;YACzE,SAAS,EAAE,6EAA6E;YACxF,KAAK,EAAE,qCAAqC;YAC5C,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,yBAAyB;YAC7B,WAAW,EACT,uEAAuE;gBACvE,4CAA4C;YAC9C,SAAS,EAAE,wDAAwD;YACnE,KAAK,EAAE,gCAAgC;YACvC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,WAAW,EACT,oEAAoE;gBACpE,sEAAsE;YACxE,SAAS,EAAE,iDAAiD;YAC5D,KAAK,EAAE,iCAAiC;YACxC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EACT,oEAAoE;gBACpE,wEAAwE;YAC1E,SAAS,EAAE,8DAA8D;YACzE,KAAK,EAAE,mCAAmC;YAC1C,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,WAAW,EACT,wEAAwE;gBACxE,8EAA8E;YAChF,SAAS,EAAE,qEAAqE;YAChF,KAAK,EAAE,oCAAoC;YAC3C,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,WAAW,EACT,uEAAuE;gBACvE,0EAA0E;gBAC1E,uCAAuC;YACzC,SAAS,EAAE,oEAAoE;YAC/E,KAAK,EAAE,oCAAoC;YAC3C,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,8CAA8C;YAClD,WAAW,EACT,8EAA8E;gBAC9E,2EAA2E;gBAC3E,yDAAyD;YAC3D,SAAS,EAAE,+EAA+E;YAC1F,KAAK,EAAE,wDAAwD;YAC/D,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,+CAA+C;YACnD,WAAW,EACT,yEAAyE;gBACzE,yEAAyE;gBACzE,6DAA6D;YAC/D,SAAS,EAAE,0EAA0E;YACrF,KAAK,EAAE,uDAAuD;YAC9D,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,WAAW,EACT,+EAA+E;gBAC/E,2DAA2D;YAC7D,SAAS,EAAE,wDAAwD;YACnE,KAAK,EAAE,kCAAkC;YACzC,YAAY,EAAE,QAAQ;SACvB;KACF;CACF,CAAC"}