@connexum/ai-governance 1.0.0-beta.11

package/dist/packs/common-rule.js

@@ -0,0 +1,473 @@
+"use strict";
+/**
+ * Common Rule (45 CFR 46) Compliance Pack
+ *
+ * HHS Protection of Human Subjects regulations (45 CFR Part 46).
+ * 2018 Revised Common Rule effective January 21, 2019. Subparts:
+ *   A: Basic HHS Policy (all federally funded research on human subjects).
+ *   B: Additional protections for pregnant women, human fetuses, neonates
+ *      (45 CFR 46.201-207).
+ *   C: Additional protections for prisoners (45 CFR 46.301-306).
+ *   D: Additional protections for children (45 CFR 46.401-409).
+ *
+ * NIH overlay: NIH Grants Policy Statement Section 3.1; NIH Single IRB
+ * Policy (effective January 25, 2018); NIH 2023 Data Management and
+ * Sharing Policy (intersects when research data is shared -- see NIH
+ * DMS pack).
+ *
+ * AI systems that process, analyze, summarize, or generate outputs
+ * from identifiable human subjects research data operate as instruments
+ * of research and are subject to Common Rule through the covered
+ * institution's Federalwide Assurance (FWA).
+ *
+ * Key obligations for AI systems:
+ *
+ *   - 45 CFR 46.109: IRB review and approval required before research
+ *     commences. AI systems used in research must be within scope of
+ *     an approved IRB protocol.
+ *   - 45 CFR 46.116: Informed consent required from each subject or
+ *     legally authorized representative. AI must not process subject
+ *     data without evidence that consent was obtained.
+ *   - 45 CFR 46.116(b)(8): Right to withdraw consent without penalty.
+ *     Data from withdrawn-consent subjects must not be processed by AI.
+ *   - 45 CFR 46.116(d): Broad consent option for secondary research.
+ *     AI use of broad-consent data requires scope confirmation.
+ *   - 45 CFR 46.408 (Subpart D): Parental permission + child assent
+ *     for pediatric research. Dual gate required.
+ *   - 45 CFR 46.305 (Subpart C): Prisoner research requires IRB
+ *     Prisoner Advocate review. Restricted permissible categories.
+ *   - 42 USC 241(d); NOT-OD-17-109: NIH Certificate of Confidentiality
+ *     prohibits disclosure of identifiable research data in any
+ *     federal, state, or local proceeding. AI vendors receiving CoC-
+ *     protected data must acknowledge this obligation.
+ *   - 45 CFR 46.116; HHS DUA guidance (2004): Data use agreements
+ *     required for sharing limited datasets with AI vendors.
+ *   - 45 CFR 46.115(b): IRB and consent records retained 3 years
+ *     after research ends; NIH may require longer per grant terms
+ *     (citation to verify current NIH GPS section).
+ *
+ * Cross-pack interactions:
+ *   - Common Rule + HIPAA: When research data contains PHI, both
+ *     packs are active. HIPAA Privacy Rule 45 CFR 164.512(i) provides
+ *     a research exception requiring authorization or IRB waiver.
+ *     Common Rule IRB approval does not automatically satisfy HIPAA
+ *     authorization. Both packs run; HIPAA governs breach notification
+ *     clock; Common Rule governs OHRP reporting.
+ *   - Common Rule + FERPA: Student records in education research are
+ *     simultaneously FERPA-protected and potentially Common Rule-
+ *     covered. FERPA 34 CFR 99.35 requires DUA; Common Rule requires
+ *     IRB approval. More restrictive controls apply; cross-check DUA.
+ *   - Common Rule + NIH DMS: Research data from Common Rule studies
+ *     subject to 2023 NIH Data Management and Sharing Policy. Both
+ *     packs active for NIH-funded human subjects research. Common Rule
+ *     consent terms determine whether AI can access data for DMS-
+ *     required sharing. Consent scope limits override DMS obligations.
+ *   - Common Rule + COPPA: Pediatric research subjects covered by
+ *     both Subpart D (parental permission) and COPPA (parental consent
+ *     for online collection). Both packs must be active. In combination
+ *     with HIPAA on pediatric clinical research, triggers
+ *     TRIPLE_COVERAGE_ALERT.
+ *
+ * UF Health exposure: Loss of NIH funding (historically exceeding
+ * $200M annually at UF; citation to verify current year total) is
+ * the primary institutional risk. Even a temporary restriction during
+ * OHRP investigation would constitute existential risk.
+ *
+ * Sovereignty: US Federal (HHS/NIH). FWA-covered institutions are
+ * subject to Common Rule regardless of funding source for activities
+ * covered by the assurance.
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMMON_RULE_PACK = exports.COMMON_RULE_CATEGORY_CLASSIFIERS = void 0;
+/**
+ * Common Rule category classifiers for the pack-driven classifier (W1).
+ */
+exports.COMMON_RULE_CATEGORY_CLASSIFIERS = {
+    RESEARCH_SUBJECT_ID: {
+        references: ['45 CFR 46.102(e) -- identifiable private information or biospecimen'],
+        classifier: (input) => {
+            // Subject/participant ID patterns common in research contexts
+            if (/\b(?:subject[_\-\s]?(?:id|number|#)|participant[_\-\s]?(?:id|number|#)|study[_\-\s]?(?:id|number|#))\s*[=:]\s*\w+/i.test(input))
+                return true;
+            // Research subject identifier with sequential or formatted pattern
+            if (/\b(?:SUBJ|PART|RES)-?\d{3,12}\b/i.test(input))
+                return true;
+            if (/\bRESEARCH_SUBJECT_ID\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    IRB_PROTOCOL_DATA: {
+        references: ['45 CFR 46.109 -- IRB review; 45 CFR 46.102(l) -- research definition'],
+        classifier: (input) => {
+            if (/\b(?:irb.?protocol|irb.?approval|irb.?number|protocol.?id|ufirb|irb.?\d{4,})\b/i.test(input))
+                return true;
+            if (/\bIRB_PROTOCOL_DATA\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    WITHDRAWN_CONSENT_SUBJECT: {
+        references: ['45 CFR 46.116(b)(8) -- right to withdraw consent without penalty'],
+        classifier: (input) => {
+            if (/\b(?:withdrawn.consent|consent.withdrawn|revoked.consent|withdrew.from.study|WITHDRAWN_CONSENT_SUBJECT)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    VULNERABLE_POPULATION_CHILD: {
+        references: ['45 CFR 46 Subpart D (46.401-409) -- additional protections for children in research'],
+        classifier: (input) => {
+            if (/\b(?:pediatric.subject|child.participant|minor.research.subject|child.assent|parental.permission.research|VULNERABLE_POPULATION_CHILD)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    VULNERABLE_POPULATION_PRISONER: {
+        references: ['45 CFR 46 Subpart C (46.301-306) -- additional protections for prisoners'],
+        classifier: (input) => {
+            if (/\b(?:prisoner.research|incarcerated.participant|correctional.research.subject|prisoner.advocate|Subpart.C|VULNERABLE_POPULATION_PRISONER)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    VULNERABLE_POPULATION_PREGNANT: {
+        references: ['45 CFR 46 Subpart B (46.201-207) -- protections for pregnant women, fetuses, neonates'],
+        classifier: (input) => {
+            if (/\b(?:pregnant.research.subject|fetal.research|neonatal.research.subject|Subpart.B.participant|VULNERABLE_POPULATION_PREGNANT)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    BIOSPECIMEN_LINKED_TO_SUBJECT: {
+        references: ['45 CFR 46.102(e) -- identifiable biospecimen = human subject data'],
+        classifier: (input) => {
+            if (/\b(?:biospecimen.linked|tissue.sample.id|blood.sample.subject|biological.specimen.identifier|BIOSPECIMEN_LINKED_TO_SUBJECT)\b/i.test(input))
+                return true;
+            // Biospecimen pattern with linkage indicator
+            if (/\b(?:sample|specimen|biopsy|blood|tissue)\b.*\b(?:subject[_\-\s]?id|participant[_\-\s]?id|linked|identifiable)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    BROAD_CONSENT_FUTURE_USE: {
+        references: ['45 CFR 46.116(d) -- broad consent for future unspecified research'],
+        classifier: (input) => {
+            if (/\b(?:broad.consent|future.use.consent|unspecified.research.consent|secondary.research.use|BROAD_CONSENT_FUTURE_USE)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    COC_PROTECTED_DATA: {
+        references: ['42 USC 241(d) -- Certificate of Confidentiality; NOT-OD-17-109'],
+        classifier: (input) => {
+            if (/\b(?:certificate.of.confidentiality|CoC.protected|coc.data|not.od.17.109|PROTECTED_RESEARCH_CoC|COC_PROTECTED_DATA)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    DUA_REQUIRED_DATASET: {
+        references: ['45 CFR 46.116; HHS DUA guidance 2004 -- data use agreements for limited datasets'],
+        classifier: (input) => {
+            if (/\b(?:data.use.agreement|DUA.required|limited.dataset.dua|dua.dataset|DUA_REQUIRED_DATASET)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * GAP-5: IRB_APPROVAL_EXPIRED -- detects expired IRB approvals.
+     * Pattern: IRB/protocol language in proximity to a past-date string or
+     * the word "expired". Action: BLOCK.
+     * Reference: 45 CFR 46.109 (IRB review required before research commences).
+     */
+    IRB_APPROVAL_EXPIRED: {
+        references: ['45 CFR 46.109 -- IRB approval required; expired approval is non-compliance; GAP-5'],
+        classifier: (input, _ctx) => {
+            if (/\bIRB_APPROVAL_EXPIRED\b/i.test(input))
+                return true;
+            // Explicit "expired" keyword near IRB language
+            if (/\b(?:irb|protocol)\b.*\bexpir(?:ed|es|ation|y)\b/i.test(input))
+                return true;
+            if (/\bexpir(?:ed|es|ation|y)\b.*\b(?:irb|protocol)\b/i.test(input))
+                return true;
+            // Date heuristic: past year (before 2026) in proximity to IRB language
+            const hasIRBContext = /\b(?:irb.?approval|irb.?protocol|irb.?number|protocol.?id|ufirb|irb.?\d{4,})\b/i.test(input);
+            if (!hasIRBContext)
+                return false;
+            // Match 4-digit years 2000-2025 (clearly past dates as of 2026)
+            const pastYearMatch = /\b(200\d|201\d|202[0-5])\b/.exec(input);
+            if (pastYearMatch)
+                return true;
+            return false;
+        },
+    },
+};
+exports.COMMON_RULE_PACK = {
+    categoryClassifiers: exports.COMMON_RULE_CATEGORY_CLASSIFIERS,
+    /**
+     * P3.5: Research subject identifiers, vulnerable population data,
+     * biospecimens linked to subjects, CoC-protected data, and withdrawn-
+     * consent subject data are inherently subject-keyed. Each event must
+     * carry a data subject ID to satisfy OHRP accountability requirements
+     * under 45 CFR 46.115 and IRB protocol audit obligations.
+     */
+    subjectKeyedCategories: [
+        'RESEARCH_SUBJECT_ID',
+        'VULNERABLE_POPULATION_CHILD',
+        'VULNERABLE_POPULATION_PRISONER',
+        'VULNERABLE_POPULATION_PREGNANT',
+        'BIOSPECIMEN_LINKED_TO_SUBJECT',
+        'COC_PROTECTED_DATA',
+        'WITHDRAWN_CONSENT_SUBJECT',
+    ],
+    id: 'common-rule',
+    name: 'Common Rule (Human Subjects Research Protection)',
+    version: '1.0.0',
+    description: 'HHS Protection of Human Subjects (45 CFR Part 46) compliance for AI systems processing identifiable human subjects research data. Covers IRB approval gate, informed consent verification, withdrawn-consent subject exclusion, Subpart D (children) dual-consent gate, Subpart C (prisoners) Prisoner Advocate gate, Subpart B (pregnant women) risk threshold, Certificate of Confidentiality (42 USC 241(d)) block, and Data Use Agreement enforcement before AI access to research datasets. Applies to all NIH-funded and FWA-covered research at federally-supported institutions.',
+    authority: 'HHS Office for Human Research Protections (OHRP); NIH Office of Research Integrity',
+    industries: ['clinical-research', 'academic-research', 'higher-education', 'health-it', 'biotech', 'federal-grantee'],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'IRB approval gate enforcement; withdrawn-consent subject exclusion; vulnerable population dual-gate logic',
+            reference: '45 CFR 46.109 (IRB review); 45 CFR 46.116(b)(8) (withdrawal right); 45 CFR 46.408 (Subpart D dual gate)',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident research processing logs with IRB protocol ID; OHRP accountability chain',
+            reference: '45 CFR 46.115 (IRB recordkeeping); OHRP audit guidance',
+        },
+        {
+            name: 'encryption-layer',
+            required: true,
+            reason: 'NIST SP 800-171 / FedRAMP Moderate equivalent security for identifiable research data (NIH IT Security Policy; citation to verify current policy number)',
+            reference: 'NIH IT Security Policy (NIH Manual Chapter 2800 series; citation to verify); 45 CFR 46 FWA obligations',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Detect research subject IDs, IRB protocol markers, vulnerable population flags, CoC-protected data, and DUA-required datasets',
+            reference: '45 CFR 46.102(e) (human subject definition); 42 USC 241(d) (CoC)',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'Per-subject consent status tracking; withdrawn-consent list maintenance; IRB protocol ID context persistence',
+            reference: '45 CFR 46.116 (informed consent); 45 CFR 46.116(b)(8) (withdrawal)',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'IRB-approved Data Use Agreement on file before AI vendor receives research subject data; CoC obligations acknowledgment',
+            reference: '45 CFR 46.116; HHS DUA guidance (2004); 42 USC 241(d) (CoC provider obligation)',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'IRB protocol scope confirmation gate; broad-consent secondary-use scope check; Subpart D parental permission + child assent dual gate',
+            reference: '45 CFR 46.109; 45 CFR 46.116(d) (broad consent scope); 45 CFR 46.408 (Subpart D)',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'Research AI tool documentation in IRB protocol; DUA execution records; CoC provider acknowledgment documentation',
+            reference: '45 CFR 46.115(b) (recordkeeping); NIH GPS Section 8.4.1 (citation to verify)',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'UPIRTSO (unanticipated problem involving risk) reporting stream; consent-withdrawal events; OHRP escalation stream',
+            reference: '45 CFR 46.108(a)(3) (prompt reporting of problems); OHRP guidance on UPIRTSOs',
+        },
+        {
+            name: 'anomaly-detector',
+            required: true,
+            reason: 'Data minimization monitoring; detection of AI use outside approved IRB protocol scope',
+            reference: '45 CFR 46 (minimum necessary principle); OHRP serious non-compliance detection',
+        },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            irbApprovalRequired: true,
+            consentVerificationEnabled: true,
+            withdrawnConsentExclusionActive: true,
+            subpartDGateEnabled: true,
+            subpartCGateEnabled: true,
+            dataMinimizationEnforced: true,
+        },
+        'data-classifier': {
+            enabledCategories: [
+                'RESEARCH_SUBJECT_ID',
+                'IRB_PROTOCOL_DATA',
+                'WITHDRAWN_CONSENT_SUBJECT',
+                'VULNERABLE_POPULATION_CHILD',
+                'VULNERABLE_POPULATION_PRISONER',
+                'VULNERABLE_POPULATION_PREGNANT',
+                'BIOSPECIMEN_LINKED_TO_SUBJECT',
+                'BROAD_CONSENT_FUTURE_USE',
+                'COC_PROTECTED_DATA',
+                'DUA_REQUIRED_DATASET',
+                'IRB_APPROVAL_EXPIRED',
+            ],
+        },
+        'supply-chain': {
+            duaRequired: true,
+            cocProtectionEnabled: true,
+            vendorNoTrainingOnResearchDataRequired: true,
+            vendorDataResidencyUSRequired: true,
+        },
+        'approval-queue': {
+            irbApprovalGateRequired: true,
+            broadConsentScopeCheckEnabled: true,
+            subpartDDualConsentGateRequired: true,
+        },
+        'attestation-manager': {
+            researchAuditEnabled: true,
+        },
+        'event-bus': {
+            upirtsoReportingActive: true,
+        },
+        'anomaly-detector': {
+            researchScopeDeviationDetectionActive: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: [],
+        requiredCapabilities: [
+            'DATA-RESIDENCY-US',
+            'ZERO-TRAINING-ON-RESEARCH-DATA',
+            'IRB-DUA-ACCEPTANCE',
+            'COC-OBLIGATIONS-ACKNOWLEDGED',
+            'NIST-800-171-OR-FEDRAMP-MODERATE',
+        ],
+        blockReasons: {},
+    },
+    dataPolicy: {
+        scanCategories: [
+            'RESEARCH_SUBJECT_ID',
+            'IRB_PROTOCOL_DATA',
+            'WITHDRAWN_CONSENT_SUBJECT',
+            'VULNERABLE_POPULATION_CHILD',
+            'VULNERABLE_POPULATION_PRISONER',
+            'VULNERABLE_POPULATION_PREGNANT',
+            'BIOSPECIMEN_LINKED_TO_SUBJECT',
+            'BROAD_CONSENT_FUTURE_USE',
+            'COC_PROTECTED_DATA',
+            'DUA_REQUIRED_DATASET',
+            'IRB_APPROVAL_EXPIRED',
+        ],
+        categoryActions: {
+            RESEARCH_SUBJECT_ID: 'BLOCK',
+            IRB_PROTOCOL_DATA: 'REQUIRE_APPROVAL',
+            WITHDRAWN_CONSENT_SUBJECT: 'BLOCK',
+            VULNERABLE_POPULATION_CHILD: 'BLOCK',
+            VULNERABLE_POPULATION_PRISONER: 'BLOCK',
+            VULNERABLE_POPULATION_PREGNANT: 'WARN',
+            BIOSPECIMEN_LINKED_TO_SUBJECT: 'BLOCK',
+            BROAD_CONSENT_FUTURE_USE: 'REQUIRE_APPROVAL',
+            COC_PROTECTED_DATA: 'BLOCK',
+            DUA_REQUIRED_DATASET: 'BLOCK',
+            IRB_APPROVAL_EXPIRED: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256',
+        minimumClassification: 'CONFIDENTIAL',
+    },
+    retentionPolicy: {
+        sovereignty: ['US'],
+        // 45 CFR 46.115(b): consent + IRB records 3 years after research ends.
+        // NIH GPS Section 8.4.1 (citation to verify): generally 3 years after
+        // final grant report; NIH clinical research may require 7+ years.
+        // Runtime default: 7 years to cover NIH clinical research maximum.
+        auditLogRetentionDays: 2555, // 7 years (NIH clinical research standard)
+        sessionRetentionDays: 2555,
+        incidentRetentionDays: 2555,
+        reference: '45 CFR 46.115(b) (3 years post-study); NIH GPS Section 8.4.1 (citation to verify; 3-7 years post-grant); HHS/NIH grant terms for clinical research (7 years)',
+    },
+    incidentPolicy: {
+        // OHRP prompt reporting standard: commonly 5-10 business days for
+        // UPIRTSOs. HIPAA breach clock (60 days) triggers in parallel if PHI
+        // is involved. Internal escalation: 72 hours.
+        notificationDeadlineHours: 72,
+        reference: '45 CFR 46.108(a)(3) (prompt reporting to IRB and OHRP); OHRP UPIRTSO guidance (5-10 business days); HIPAA 45 CFR 164.400-414 if PHI involved',
+        requiredRecipients: ['irb', 'ohrp', 'nih-program-officer', 'affected-research-subjects'],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'common-rule-irb-approval-gate',
+            description: 'IRB approval on file before AI processes protocol data',
+            reference: '45 CFR 46.109 (IRB review and approval)',
+            check: 'common_rule_irb_approval_gate',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'common-rule-consent-verification',
+            description: 'Informed consent verified for each subject before data processing',
+            reference: '45 CFR 46.116 (informed consent requirements)',
+            check: 'common_rule_consent_verification',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'common-rule-withdrawn-consent-block',
+            description: 'Data from withdrawn-consent subjects excluded from AI processing',
+            reference: '45 CFR 46.116(b)(8) (right to withdraw without penalty)',
+            check: 'common_rule_withdrawn_consent_block',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'common-rule-dua-required',
+            description: 'DUA on file before research data shared with AI provider',
+            reference: '45 CFR 46.116; HHS DUA guidance (2004)',
+            check: 'common_rule_dua_required',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'common-rule-subpart-d-gate',
+            description: 'Parental permission + child assent confirmed for pediatric research subjects',
+            reference: '45 CFR 46.408 (Subpart D dual-consent requirement)',
+            check: 'common_rule_subpart_d_gate',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'common-rule-coc-block',
+            description: 'CoC-protected data not disclosed to AI provider without DUA CoC terms',
+            reference: '42 USC 241(d) (Certificate of Confidentiality); NOT-OD-17-109',
+            check: 'common_rule_coc_block',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'common-rule-subpart-c-gate',
+            description: 'Prisoner research requires IRB Subpart C approval confirmation',
+            reference: '45 CFR 46.305 (Subpart C requirements for prisoner research)',
+            check: 'common_rule_subpart_c_gate',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'common-rule-audit-trail',
+            description: 'Research processing events logged with IRB protocol ID for OHRP accountability',
+            reference: '45 CFR 46.115 (IRB recordkeeping); OHRP guidance',
+            check: 'audit_trail_exists',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'common-rule-behavioral-subject-id-block',
+            description: 'Runtime blocks RESEARCH_SUBJECT_ID category without confirmed IRB approval and consent',
+            reference: '45 CFR 46.109; 45 CFR 46.116',
+            check: 'behavioralValidator_common_rule',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'common-rule-irb-expiry-block',
+            description: 'Runtime blocks IRB_APPROVAL_EXPIRED category (GAP-5): expired protocol data must be blocked',
+            reference: '45 CFR 46.109 (IRB approval required before research commences)',
+            check: 'behavioralValidator_common_rule_irb_expiry',
+            failSeverity: 'CRITICAL',
+        },
+    ],
+};
+//# sourceMappingURL=common-rule.js.map

package/dist/packs/common-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common-rule.js","sourceRoot":"","sources":["../../src/packs/common-rule.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;;;AAKH;;GAEG;AACU,QAAA,gCAAgC,GAAwB;IACnE,mBAAmB,EAAE;QACnB,UAAU,EAAE,CAAC,qEAAqE,CAAC;QACnF,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,8DAA8D;YAC9D,IAAI,oHAAoH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClJ,mEAAmE;YACnE,IAAI,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChE,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,iBAAiB,EAAE;QACjB,UAAU,EAAE,CAAC,sEAAsE,CAAC;QACpF,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,iFAAiF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/G,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,yBAAyB,EAAE;QACzB,UAAU,EAAE,CAAC,kEAAkE,CAAC;QAChF,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,4GAA4G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1I,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,2BAA2B,EAAE;QAC3B,UAAU,EAAE,CAAC,qFAAqF,CAAC;QACnG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,2IAA2I,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzK,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,8BAA8B,EAAE;QAC9B,UAAU,EAAE,CAAC,0EAA0E,CAAC;QACxF,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,8IAA8I,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5K,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,8BAA8B,EAAE;QAC9B,UAAU,EAAE,CAAC,uFAAuF,CAAC;QACrG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,kIAAkI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChK,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,6BAA6B,EAAE;QAC7B,UAAU,EAAE,CAAC,mEAAmE,CAAC;QACjF,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,gIAAgI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9J,6CAA6C;YAC7C,IAAI,mHAAmH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjJ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,wBAAwB,EAAE;QACxB,UAAU,EAAE,CAAC,mEAAmE,CAAC;QACjF,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,wHAAwH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtJ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,kBAAkB,EAAE;QAClB,UAAU,EAAE,CAAC,gEAAgE,CAAC;QAC9E,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,wHAAwH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtJ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,oBAAoB,EAAE;QACpB,UAAU,EAAE,CAAC,kFAAkF,CAAC;QAChG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,+FAA+F,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7H,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD;;;;;OAKG;IACH,oBAAoB,EAAE;QACpB,UAAU,EAAE,CAAC,mFAAmF,CAAC;QACjG,UAAU,EAAE,CAAC,KAAa,EAAE,IAAc,EAAW,EAAE;YACrD,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzD,+CAA+C;YAC/C,IAAI,mDAAmD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjF,IAAI,mDAAmD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjF,uEAAuE;YACvE,MAAM,aAAa,GAAG,iFAAiF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpH,IAAI,CAAC,aAAa;gBAAE,OAAO,KAAK,CAAC;YACjC,gEAAgE;YAChE,MAAM,aAAa,GAAG,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/D,IAAI,aAAa;gBAAE,OAAO,IAAI,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEW,QAAA,gBAAgB,GAAoG;IAC/H,mBAAmB,EAAE,wCAAgC;IACrD;;;;;;OAMG;IACH,sBAAsB,EAAE;QACtB,qBAAqB;QACrB,6BAA6B;QAC7B,gCAAgC;QAChC,gCAAgC;QAChC,+BAA+B;QAC/B,oBAAoB;QACpB,2BAA2B;KAC5B;IACD,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,kDAAkD;IACxD,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,0jBAA0jB;IAC5jB,SAAS,EAAE,oFAAoF;IAC/F,UAAU,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC;IAErH,eAAe,EAAE;QACf;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2GAA2G;YACnH,SAAS,EAAE,yGAAyG;SACrH;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,yFAAyF;YACjG,SAAS,EAAE,wDAAwD;SACpE;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,0JAA0J;YAClK,SAAS,EAAE,wGAAwG;SACpH;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,+HAA+H;YACvI,SAAS,EAAE,kEAAkE;SAC9E;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8GAA8G;YACtH,SAAS,EAAE,oEAAoE;SAChF;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,yHAAyH;YACjI,SAAS,EAAE,iFAAiF;SAC7F;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,uIAAuI;YAC/I,SAAS,EAAE,kFAAkF;SAC9F;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kHAAkH;YAC1H,SAAS,EAAE,8EAA8E;SAC1F;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,oHAAoH;YAC5H,SAAS,EAAE,+EAA+E;SAC3F;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,uFAAuF;YAC/F,SAAS,EAAE,gFAAgF;SAC5F;KACF;IAED,YAAY,EAAE;QACZ,oBAAoB,EAAE;YACpB,mBAAmB,EAAE,IAAI;YACzB,0BAA0B,EAAE,IAAI;YAChC,+BAA+B,EAAE,IAAI;YACrC,mBAAmB,EAAE,IAAI;YACzB,mBAAmB,EAAE,IAAI;YACzB,wBAAwB,EAAE,IAAI;SAC/B;QACD,iBAAiB,EAAE;YACjB,iBAAiB,EAAE;gBACjB,qBAAqB;gBACrB,mBAAmB;gBACnB,2BAA2B;gBAC3B,6BAA6B;gBAC7B,gCAAgC;gBAChC,gCAAgC;gBAChC,+BAA+B;gBAC/B,0BAA0B;gBAC1B,oBAAoB;gBACpB,sBAAsB;gBACtB,sBAAsB;aACvB;SACF;QACD,cAAc,EAAE;YACd,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,IAAI;YAC1B,sCAAsC,EAAE,IAAI;YAC5C,6BAA6B,EAAE,IAAI;SACpC;QACD,gBAAgB,EAAE;YAChB,uBAAuB,EAAE,IAAI;YAC7B,6BAA6B,EAAE,IAAI;YACnC,+BAA+B,EAAE,IAAI;SACtC;QACD,qBAAqB,EAAE;YACrB,oBAAoB,EAAE,IAAI;SAC3B;QACD,WAAW,EAAE;YACX,sBAAsB,EAAE,IAAI;SAC7B;QACD,kBAAkB,EAAE;YAClB,qCAAqC,EAAE,IAAI;SAC5C;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE;YACpB,mBAAmB;YACnB,gCAAgC;YAChC,oBAAoB;YACpB,8BAA8B;YAC9B,kCAAkC;SACnC;QACD,YAAY,EAAE,EAAE;KACjB;IAED,UAAU,EAAE;QACV,cAAc,EAAE;YACd,qBAAqB;YACrB,mBAAmB;YACnB,2BAA2B;YAC3B,6BAA6B;YAC7B,gCAAgC;YAChC,gCAAgC;YAChC,+BAA+B;YAC/B,0BAA0B;YAC1B,oBAAoB;YACpB,sBAAsB;YACtB,sBAAsB;SACvB;QACD,eAAe,EAAE;YACf,mBAAmB,EAAE,OAAO;YAC5B,iBAAiB,EAAE,kBAAkB;YACrC,yBAAyB,EAAE,OAAO;YAClC,2BAA2B,EAAE,OAAO;YACpC,8BAA8B,EAAE,OAAO;YACvC,8BAA8B,EAAE,MAAM;YACtC,6BAA6B,EAAE,OAAO;YACtC,wBAAwB,EAAE,kBAAkB;YAC5C,kBAAkB,EAAE,OAAO;YAC3B,oBAAoB,EAAE,OAAO;YAC7B,oBAAoB,EAAE,OAAO;SAC9B;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,SAAS;QAC7B,qBAAqB,EAAE,cAAc;KACtC;IAED,eAAe,EAAE;QACf,WAAW,EAAE,CAAC,IAAI,CAAC;QACnB,uEAAuE;QACvE,sEAAsE;QACtE,kEAAkE;QAClE,mEAAmE;QACnE,qBAAqB,EAAE,IAAI,EAAI,2CAA2C;QAC1E,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,8JAA8J;KAC1K;IAED,cAAc,EAAE;QACd,kEAAkE;QAClE,qEAAqE;QACrE,8CAA8C;QAC9C,yBAAyB,EAAE,EAAE;QAC7B,SAAS,EAAE,8IAA8I;QACzJ,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,4BAA4B,CAAC;QACxF,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,+BAA+B;YACnC,WAAW,EAAE,wDAAwD;YACrE,SAAS,EAAE,yCAAyC;YACpD,KAAK,EAAE,+BAA+B;YACtC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,kCAAkC;YACtC,WAAW,EAAE,mEAAmE;YAChF,SAAS,EAAE,+CAA+C;YAC1D,KAAK,EAAE,kCAAkC;YACzC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,qCAAqC;YACzC,WAAW,EAAE,kEAAkE;YAC/E,SAAS,EAAE,yDAAyD;YACpE,KAAK,EAAE,qCAAqC;YAC5C,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,WAAW,EAAE,0DAA0D;YACvE,SAAS,EAAE,wCAAwC;YACnD,KAAK,EAAE,0BAA0B;YACjC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,8EAA8E;YAC3F,SAAS,EAAE,oDAAoD;YAC/D,KAAK,EAAE,4BAA4B;YACnC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,WAAW,EAAE,uEAAuE;YACpF,SAAS,EAAE,+DAA+D;YAC1E,KAAK,EAAE,uBAAuB;YAC9B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,gEAAgE;YAC7E,SAAS,EAAE,8DAA8D;YACzE,KAAK,EAAE,4BAA4B;YACnC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,yBAAyB;YAC7B,WAAW,EAAE,gFAAgF;YAC7F,SAAS,EAAE,kDAAkD;YAC7D,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,yCAAyC;YAC7C,WAAW,EAAE,wFAAwF;YACrG,SAAS,EAAE,8BAA8B;YACzC,KAAK,EAAE,iCAAiC;YACxC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,8BAA8B;YAClC,WAAW,EAAE,6FAA6F;YAC1G,SAAS,EAAE,iEAAiE;YAC5E,KAAK,EAAE,4CAA4C;YACnD,YAAY,EAAE,UAAU;SACzB;KACF;CACF,CAAC"}

package/dist/packs/coppa.d.ts

@@ -0,0 +1,84 @@
+/**
+ * COPPA Compliance Pack
+ *
+ * Children's Online Privacy Protection Act (15 USC 6501-6506).
+ * Enacted 1998; FTC implementing regulation 16 CFR Part 312, amended
+ * effective July 1, 2013 (2013 COPPA Rule). 2024 NPRM pending final
+ * rule as of August 2025 (citation to verify on final effective date).
+ *
+ * COPPA governs the collection, use, and disclosure of personal
+ * information from children under 13 by operators of websites and
+ * online services directed to children, or by operators with actual
+ * knowledge they are collecting from children under 13.
+ *
+ * Key obligations for AI systems:
+ *
+ *   - 16 CFR 312.5: Verifiable parental consent required before
+ *     collecting any personal information from children under 13.
+ *     AI systems must not collect, use, or disclose child personal
+ *     information before consent is obtained. Fail-closed default.
+ *   - 16 CFR 312.2 (definition of personal information): Name,
+ *     address, online contact info, screen name, phone, SSN,
+ *     persistent identifier (cookie, IP, device ID, customer number),
+ *     photo/video/audio containing child's image or voice, geolocation,
+ *     and any information combined with the above.
+ *   - 16 CFR 312.4: Privacy notice to parents before collection.
+ *   - 16 CFR 312.6: Parental access and deletion rights.
+ *   - 16 CFR 312.7: No conditioning of participation on excessive
+ *     data disclosure.
+ *   - 16 CFR 312.8: Confidentiality and security of child data.
+ *   - 16 CFR 312.10: Retention limited to reasonably necessary period.
+ *   - 16 CFR 312.12: Operators responsible for COPPA compliance of
+ *     third-party AI services used to collect child data.
+ *   - FTC enforcement position (2024 NPRM, citation to verify on
+ *     final rule): AI providers must not use personal information
+ *     from child-flagged sessions to train or fine-tune models.
+ *
+ * School-consent model: Under 34 CFR 99.30 (FERPA), a school may
+ * provide consent on behalf of parents for educational purposes.
+ * This pack covers commercial COPPA consent outside the school-
+ * official exception. For in-school use, the FERPA pack governs
+ * and this pack's consent gate defers to FERPA school consent.
+ *
+ * Cross-pack interactions:
+ *   - FERPA + COPPA: For under-13 students in school context, FERPA
+ *     school-consent model satisfies COPPA parental consent (34 CFR
+ *     99.30 + 16 CFR 312.5). Both packs must be active; COPPA is
+ *     the enforcement baseline outside the school-official exception.
+ *   - HIPAA + COPPA: In pediatric clinical settings, PHI from
+ *     under-13 patients is double-covered. HIPAA governs the PHI;
+ *     COPPA governs any online collection. Both packs must be active.
+ *   - Common Rule + COPPA: Research involving under-13 subjects
+ *     requires both parental permission (45 CFR 46 Subpart D) and
+ *     COPPA parental consent (16 CFR 312.5). Neither satisfies the
+ *     other; both gates must fire. A pediatric research + online
+ *     collection context triggers COPPA + Common Rule + HIPAA
+ *     simultaneously (TRIPLE_COVERAGE_ALERT).
+ *   - Florida Student Privacy + COPPA: Florida K-12 students include
+ *     children under 13. COPPA applies to any online AI system with
+ *     actual knowledge it serves under-13 users; Florida Statute
+ *     Section 1002.222 adds state-law operator obligations.
+ *
+ * UF Health exposure: UF Health Shands Children's Hospital patient
+ * portal AI and UF-affiliated K-12 research programs create direct
+ * COPPA exposure. At $51,744/day per violation (FTC civil penalty
+ * as of 2024; citation to verify current inflation-adjusted figure
+ * per 15 USC 6502(c) and 16 CFR 1.98), a 30-day undetected
+ * exposure in a pediatric portal equals roughly $1.55M before state
+ * AG action.
+ *
+ * Sovereignty: US Federal.
+ *
+ * @connexum/ai-governance
+ */
+import { CompliancePack } from './index';
+import { CategoryClassifiers } from '../classification/pack-driven-classifier';
+/**
+ * COPPA category classifiers for the pack-driven classifier (W1).
+ */
+export declare const COPPA_CATEGORY_CLASSIFIERS: CategoryClassifiers;
+export declare const COPPA_PACK: CompliancePack & {
+    categoryClassifiers: CategoryClassifiers;
+    subjectKeyedCategories: string[];
+};
+//# sourceMappingURL=coppa.d.ts.map

package/dist/packs/coppa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coppa.d.ts","sourceRoot":"","sources":["../../src/packs/coppa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE,mBAwExC,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,cAAc,GAAG;IAAE,mBAAmB,EAAE,mBAAmB,CAAC;IAAC,sBAAsB,EAAE,MAAM,EAAE,CAAA;CAuPrH,CAAC"}