@connexum/ai-governance 1.0.0-beta.11

package/dist/packs/part11.js

@@ -0,0 +1,332 @@
+"use strict";
+/**
+ * 21 CFR Part 11 Compliance Pack
+ *
+ * FDA Electronic Records and Electronic Signatures (1997), under:
+ *   - FDA 2003 Scope & Application Guidance (risk-based enforcement)
+ *   - EU Annex 11 (GMP equivalent for computerised systems)
+ *   - FDA 2024 GenAI guidance for clinical records (AI provenance)
+ *
+ * Applies when AI agents create, modify, maintain, archive, retrieve,
+ * or transmit records required by an FDA predicate rule (21 CFR Part
+ * 211 GMP, Part 58 GLP, Part 312 IND, Part 314 NDA, Part 820 QSR).
+ *
+ * ALCOA+ data integrity principles: Attributable, Legible,
+ * Contemporaneous, Original, Accurate + Complete, Consistent,
+ * Enduring, Available.
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PART11_PACK = exports.PART11_CATEGORY_CLASSIFIERS = void 0;
+const _base_classifiers_1 = require("./_base-classifiers");
+const _base_classifiers_2 = require("./_base-classifiers");
+/**
+ * 21 CFR Part 11 (FDA Electronic Records / Electronic Signatures) category classifiers.
+ * Part 11 governs process flows: validation (IQ/OQ/PQ), e-signature, audit trail,
+ * and ALCOA+ for regulated electronic records. Classification targets regulated records,
+ * PHI in clinical systems, PII, credentials, and AI-generated content in GxP systems.
+ */
+exports.PART11_CATEGORY_CLASSIFIERS = {
+    REGULATED_RECORD: {
+        references: ['21 CFR 11.10 -- controls for closed systems; electronic records in FDA-regulated environment'],
+        classifier: (input) => {
+            if (/\b(?:21\s*CFR|GMP|GLP|GCP|Part\s*11|predicate\s*rule|batch\s*record|DHR|device\s*history\s*record)\b/i.test(input))
+                return true;
+            if (/\b(?:regulated\s+(?:record|document)|electronic\s+record|audit\s+trail\s+entry)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PHI: {
+        references: ['21 CFR Part 11 -- clinical electronic records may contain PHI; 45 CFR 164.312 applies'],
+        // 21 CFR Part 11 cross-references 45 CFR 164.312 when clinical records contain PHI.
+        // Use sharedPhiClassifier as the base (HIPAA 18 identifiers) plus clinical context markers.
+        classifier: (input) => {
+            if ((0, _base_classifiers_2.sharedPhiClassifier)(input))
+                return true;
+            if (/\b(?:patient|subject\s+id|clinical\s+data|trial\s+subject|participant\s+id)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PII: {
+        references: ['21 CFR 11.10(d) -- limiting access to authorised individuals; PII in regulated records'],
+        classifier: _base_classifiers_1.sharedPiiClassifier,
+    },
+    CREDENTIALS: {
+        references: ['21 CFR 11.10(d) -- limiting system access; authentication credential protection'],
+        classifier: (input) => {
+            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
+                return true;
+            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
+                return true;
+            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
+                return true;
+            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
+                return true;
+            return false;
+        },
+    },
+    AI_GENERATED_CONTENT: {
+        references: ['21 CFR 11.10 -- AI-generated records must satisfy Part 11 audit trail and signature requirements'],
+        classifier: (input) => {
+            if (/\b(?:AI.generated|LLM.generated|generated\s+by\s+AI|synthetic\s+(?:record|report|result))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+exports.PART11_PACK = {
+    categoryClassifiers: exports.PART11_CATEGORY_CLASSIFIERS,
+    id: 'part11',
+    name: '21 CFR Part 11',
+    version: '1.0.0',
+    description: '21 CFR Part 11 Electronic Records and Electronic Signatures for FDA-regulated predicate records. Includes ALCOA+ data integrity, qualified e-signature enforcement, append-only audit trail, authority-to-sign matrix, and AI provenance for AI-generated content in regulated records (2024 FDA GenAI guidance).',
+    authority: 'US FDA (21 CFR Part 11); EU Annex 11 alignment for global GxP operations',
+    industries: ['pharma', 'biotech', 'medical-devices', 'lab-services', 'contract-research', 'clinical-trial-sites'],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'Validation gate; authority-to-sign matrix; ALCOA+ enforcement',
+            reference: '21 CFR 11.10(a), 11.200, 11.300',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Append-only tamper-evident audit trail for every record change',
+            reference: '21 CFR 11.10(e)',
+        },
+        {
+            name: 'encryption-layer',
+            required: true,
+            reason: 'Record protection at rest and in transit',
+            reference: '21 CFR 11.10(d)',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Detect REGULATED_RECORD and AI-generated content; enforce provenance for AI output',
+            reference: '21 CFR 11.10(b); FDA 2024 GenAI Guidance',
+        },
+        {
+            name: 'agent-auth',
+            required: true,
+            reason: 'Unique signer identity; authority check before signature',
+            reference: '21 CFR 11.200(a)(1)',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'Contemporaneous capture; offline-buffer original timestamps; sequencing survival',
+            reference: '21 CFR 11.10(d), 11.10(e); ALCOA+ contemporaneous',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'Sequencing enforcement; timestamp drift alerts; signature events',
+            reference: '21 CFR 11.10(d), 11.10(e)',
+        },
+        {
+            name: 'anomaly-detector',
+            required: true,
+            reason: 'Timestamp drift; backdating attempts; out-of-order writes',
+            reference: '21 CFR 11.10(e); ALCOA+ contemporaneous',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'Predicate-rule retention alignment; sub-system validation status propagation',
+            reference: '21 CFR 11.10(c)',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'E-signature capture for every regulated-record modification; authority-mismatch blocking',
+            reference: '21 CFR 11.50, 11.70, 11.200',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'IQ/OQ/PQ validation attestations; signer authority matrix; AI provenance',
+            reference: '21 CFR 11.10(a); FDA 2024 GenAI Guidance',
+        },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            validationGateRequired: true,
+            authorityMatrixEnforced: true,
+            alcoaPlusEnforced: true,
+        },
+        'approval-queue': {
+            eSignatureOnRecordModificationRequired: true,
+            authorityMismatchBlocked: true,
+            signatureBoundToRecordHash: true,
+        },
+        'audit-integrity': {
+            appendOnlyAuditTrailRequired: true,
+            noDeleteNoModify: true,
+        },
+        'session-persistence': {
+            contemporaneousCaptureRequired: true,
+            offlineBufferPreservesOriginalTimestamp: true,
+        },
+        'event-bus': {
+            sequenceIdEnforced: true,
+            ntpTimestampRequired: true,
+            outOfOrderPersistBlocked: true,
+        },
+        // TWO-LAYER ARCHITECTURE NOTE (F-NEW-VERA-PACK-C7-02):
+        // This 'data-classifier' block is read by the data-classifier module, NOT by
+        // PackDrivenClassifier. PackDrivenClassifier reads dataPolicy.categoryActions
+        // only (see pack-driven-classifier.ts loadFromPacks()). These two surfaces
+        // serve different consumers:
+        //
+        //   Layer 1 -- PackDrivenClassifier:
+        //     dataPolicy.categoryActions.REGULATED_RECORD = 'BLOCK'
+        //     Fires unconditionally on any input matching the REGULATED_RECORD classifier.
+        //     No conditional logic -- any match is blocked.
+        //
+        //   Layer 2 -- data-classifier module:
+        //     moduleConfig['data-classifier'].regulatedRecordAction = 'BLOCK_WITHOUT_SIGNATURE'
+        //     This is the CONDITIONAL policy: downstream data-classifier can allow a
+        //     validly-signed record through (21 CFR 11.10(b) e-signature mandate).
+        //     The data-classifier module is responsible for implementing the
+        //     "pass if signed" logic using this configuration flag.
+        //
+        // There is NO runtime bug: PackDrivenClassifier intentionally blocks all
+        // REGULATED_RECORD matches (strictest-wins). The data-classifier module then
+        // applies the signature check to determine whether to unlock the record.
+        // Without a valid e-signature, the record stays blocked at both layers.
+        'data-classifier': {
+            enabledCategories: ['REGULATED_RECORD', 'PHI', 'PII', 'CREDENTIALS', 'AI_GENERATED_CONTENT'],
+            regulatedRecordAction: 'BLOCK_WITHOUT_SIGNATURE',
+            aiGeneratedContentAction: 'REQUIRES_PROVENANCE',
+        },
+        'attestation-manager': {
+            iqOqPqValidationRequired: true,
+            aiProvenanceAttestationRequired: true,
+            retentionLockedToPredicateRule: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: [],
+        requiredCapabilities: ['GXP-VALIDATED', 'AI-PROVENANCE'],
+        blockReasons: {},
+    },
+    // TWO-LAYER ARCHITECTURE NOTE (continued, F-NEW-VERA-PACK-C7-02):
+    // categoryActions is the PackDrivenClassifier surface (Layer 1 -- classification engine).
+    // REGULATED_RECORD: 'BLOCK' is unconditional -- any match blocks regardless of signature.
+    // The data-classifier module (Layer 2) applies 'BLOCK_WITHOUT_SIGNATURE' logic after
+    // PackDrivenClassifier fires, allowing validly e-signed records to pass through.
+    // Validly-signed records: PackDrivenClassifier blocks -> data-classifier unlocks if signed.
+    // Unsigned records: blocked at both layers.
+    dataPolicy: {
+        scanCategories: ['REGULATED_RECORD', 'PHI', 'PII', 'CREDENTIALS', 'AI_GENERATED_CONTENT'],
+        categoryActions: {
+            REGULATED_RECORD: 'BLOCK',
+            PHI: 'BLOCK',
+            PII: 'WARN',
+            CREDENTIALS: 'BLOCK',
+            AI_GENERATED_CONTENT: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256',
+        minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: {
+        sovereignty: ['US'],
+        // 10-year default; actual retention locked to predicate-rule minimum
+        auditLogRetentionDays: 3650,
+        sessionRetentionDays: 730,
+        incidentRetentionDays: 3650,
+        reference: '21 CFR 11.10(c) + predicate rule (e.g., 21 CFR 211.180 -- records retained at least 1 year after expiry). Default 10 years.',
+    },
+    incidentPolicy: {
+        notificationDeadlineHours: 72,
+        reference: 'No statutory Part 11 deadline. Pax1 default 72h external to sponsor / quality leadership / applicable IRB, 24h internal escalation.',
+        requiredRecipients: ['sponsor', 'quality-leadership', 'irb-if-applicable'],
+        formalNotificationRequired: false,
+    },
+    validators: [
+        {
+            id: 'part11-validation-gate',
+            description: 'Unvalidated systems cannot produce regulated records (IQ/OQ/PQ on file)',
+            reference: '21 CFR 11.10(a)',
+            check: 'part11_validation_gate_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'part11-esignature',
+            description: 'Every regulated-record modification carries qualified e-signature',
+            reference: '21 CFR 11.10(b), 11.50',
+            check: 'part11_esignature_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'part11-audit-trail',
+            description: 'Append-only audit trail; no delete, no modify',
+            reference: '21 CFR 11.10(e)',
+            check: 'part11_append_only_audit_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'part11-authority-matrix',
+            description: 'Signer authority matrix enforced before signature accepted',
+            reference: '21 CFR 11.200, 11.300',
+            check: 'part11_authority_matrix_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'part11-signature-binding',
+            description: 'Signatures bound to record hash; rehash on read detects tampering',
+            reference: '21 CFR 11.70',
+            check: 'part11_signature_binding_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'part11-timestamps',
+            description: 'NTP-synced timestamps enforced; local clock overrides rejected',
+            reference: '21 CFR 11.10(e); ALCOA+ contemporaneous',
+            check: 'part11_timestamps_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'part11-ai-provenance',
+            description: 'AI-generated content in regulated records carries provenance attestation',
+            reference: 'FDA 2024 GenAI Guidance',
+            check: 'part11_ai_provenance_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'part11-contemporaneous',
+            description: 'Contemporaneous capture enforced; backdating rejected',
+            reference: 'ALCOA+; 21 CFR 11.10(e)',
+            check: 'part11_contemporaneous_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'part11-sequencing',
+            description: 'Event sequencing enforced; out-of-order writes rejected',
+            reference: '21 CFR 11.10(d)',
+            check: 'part11_sequencing_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'part11-retention',
+            description: 'Retention locked to predicate-rule minimum; delete-before-expiry blocked',
+            reference: '21 CFR 11.10(c); predicate rule',
+            check: 'part11_retention_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'part11-alcoa-plus',
+            description: 'ALCOA+ principles enforced across the regulated-record workflow',
+            reference: 'FDA + EU Annex 11',
+            check: 'part11_alcoa_plus_active',
+            failSeverity: 'HIGH',
+        },
+    ],
+};
+//# sourceMappingURL=part11.js.map

package/dist/packs/part11.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"part11.js","sourceRoot":"","sources":["../../src/packs/part11.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAIH,2DAA0D;AAC1D,2DAA0D;AAE1D;;;;;GAKG;AACU,QAAA,2BAA2B,GAAwB;IAC9D,gBAAgB,EAAE;QAChB,UAAU,EAAE,CAAC,8FAA8F,CAAC;QAC5G,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,uGAAuG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrI,IAAI,oFAAoF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,uFAAuF,CAAC;QACrG,oFAAoF;QACpF,4FAA4F;QAC5F,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,IAAA,uCAAmB,EAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5C,IAAI,gFAAgF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9G,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,wFAAwF,CAAC;QACtG,UAAU,EAAE,uCAAmB;KAChC;IACD,WAAW,EAAE;QACX,UAAU,EAAE,CAAC,iFAAiF,CAAC;QAC/F,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnG,IAAI,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,oBAAoB,EAAE;QACpB,UAAU,EAAE,CAAC,kGAAkG,CAAC;QAChH,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,8FAA8F,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5H,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEW,QAAA,WAAW,GAAkE;IACxF,mBAAmB,EAAE,mCAA2B;IAChD,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,gBAAgB;IACtB,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,mTAAmT;IACrT,SAAS,EAAE,0EAA0E;IACrF,UAAU,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,CAAC;IAEjH,eAAe,EAAE;QACf;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,+DAA+D;YACvE,SAAS,EAAE,iCAAiC;SAC7C;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,gEAAgE;YACxE,SAAS,EAAE,iBAAiB;SAC7B;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,0CAA0C;YAClD,SAAS,EAAE,iBAAiB;SAC7B;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,oFAAoF;YAC5F,SAAS,EAAE,0CAA0C;SACtD;QACD;YACE,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,0DAA0D;YAClE,SAAS,EAAE,qBAAqB;SACjC;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kFAAkF;YAC1F,SAAS,EAAE,mDAAmD;SAC/D;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kEAAkE;YAC1E,SAAS,EAAE,2BAA2B;SACvC;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2DAA2D;YACnE,SAAS,EAAE,yCAAyC;SACrD;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8EAA8E;YACtF,SAAS,EAAE,iBAAiB;SAC7B;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,0FAA0F;YAClG,SAAS,EAAE,6BAA6B;SACzC;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,0EAA0E;YAClF,SAAS,EAAE,0CAA0C;SACtD;KACF;IAED,YAAY,EAAE;QACZ,oBAAoB,EAAE;YACpB,sBAAsB,EAAE,IAAI;YAC5B,uBAAuB,EAAE,IAAI;YAC7B,iBAAiB,EAAE,IAAI;SACxB;QACD,gBAAgB,EAAE;YAChB,sCAAsC,EAAE,IAAI;YAC5C,wBAAwB,EAAE,IAAI;YAC9B,0BAA0B,EAAE,IAAI;SACjC;QACD,iBAAiB,EAAE;YACjB,4BAA4B,EAAE,IAAI;YAClC,gBAAgB,EAAE,IAAI;SACvB;QACD,qBAAqB,EAAE;YACrB,8BAA8B,EAAE,IAAI;YACpC,uCAAuC,EAAE,IAAI;SAC9C;QACD,WAAW,EAAE;YACX,kBAAkB,EAAE,IAAI;YACxB,oBAAoB,EAAE,IAAI;YAC1B,wBAAwB,EAAE,IAAI;SAC/B;QACD,uDAAuD;QACvD,6EAA6E;QAC7E,8EAA8E;QAC9E,2EAA2E;QAC3E,6BAA6B;QAC7B,EAAE;QACF,qCAAqC;QACrC,4DAA4D;QAC5D,mFAAmF;QACnF,oDAAoD;QACpD,EAAE;QACF,uCAAuC;QACvC,wFAAwF;QACxF,6EAA6E;QAC7E,2EAA2E;QAC3E,qEAAqE;QACrE,4DAA4D;QAC5D,EAAE;QACF,yEAAyE;QACzE,6EAA6E;QAC7E,yEAAyE;QACzE,wEAAwE;QACxE,iBAAiB,EAAE;YACjB,iBAAiB,EAAE,CAAC,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,sBAAsB,CAAC;YAC5F,qBAAqB,EAAE,yBAAyB;YAChD,wBAAwB,EAAE,qBAAqB;SAChD;QACD,qBAAqB,EAAE;YACrB,wBAAwB,EAAE,IAAI;YAC9B,+BAA+B,EAAE,IAAI;YACrC,8BAA8B,EAAE,IAAI;SACrC;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;QACxD,YAAY,EAAE,EAAE;KACjB;IAED,kEAAkE;IAClE,0FAA0F;IAC1F,0FAA0F;IAC1F,qFAAqF;IACrF,iFAAiF;IACjF,4FAA4F;IAC5F,4CAA4C;IAC5C,UAAU,EAAE;QACV,cAAc,EAAE,CAAC,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,sBAAsB,CAAC;QACzF,eAAe,EAAE;YACf,gBAAgB,EAAE,OAAO;YACzB,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,MAAM;YACX,WAAW,EAAE,OAAO;YACpB,oBAAoB,EAAE,OAAO;SAC9B;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,SAAS;QAC7B,qBAAqB,EAAE,YAAY;KACpC;IAED,eAAe,EAAE;QACf,WAAW,EAAE,CAAC,IAAI,CAAC;QACnB,qEAAqE;QACrE,qBAAqB,EAAE,IAAI;QAC3B,oBAAoB,EAAE,GAAG;QACzB,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,6HAA6H;KACzI;IAED,cAAc,EAAE;QACd,yBAAyB,EAAE,EAAE;QAC7B,SAAS,EACP,qIAAqI;QACvI,kBAAkB,EAAE,CAAC,SAAS,EAAE,oBAAoB,EAAE,mBAAmB,CAAC;QAC1E,0BAA0B,EAAE,KAAK;KAClC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,wBAAwB;YAC5B,WAAW,EAAE,yEAAyE;YACtF,SAAS,EAAE,iBAAiB;YAC5B,KAAK,EAAE,+BAA+B;YACtC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,WAAW,EAAE,mEAAmE;YAChF,SAAS,EAAE,wBAAwB;YACnC,KAAK,EAAE,0BAA0B;YACjC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,oBAAoB;YACxB,WAAW,EAAE,+CAA+C;YAC5D,SAAS,EAAE,iBAAiB;YAC5B,KAAK,EAAE,iCAAiC;YACxC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,yBAAyB;YAC7B,WAAW,EAAE,4DAA4D;YACzE,SAAS,EAAE,uBAAuB;YAClC,KAAK,EAAE,gCAAgC;YACvC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,WAAW,EAAE,mEAAmE;YAChF,SAAS,EAAE,cAAc;YACzB,KAAK,EAAE,iCAAiC;YACxC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,WAAW,EAAE,gEAAgE;YAC7E,SAAS,EAAE,yCAAyC;YACpD,KAAK,EAAE,0BAA0B;YACjC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,WAAW,EAAE,0EAA0E;YACvF,SAAS,EAAE,yBAAyB;YACpC,KAAK,EAAE,6BAA6B;YACpC,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,WAAW,EAAE,uDAAuD;YACpE,SAAS,EAAE,yBAAyB;YACpC,KAAK,EAAE,+BAA+B;YACtC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,WAAW,EAAE,yDAAyD;YACtE,SAAS,EAAE,iBAAiB;YAC5B,KAAK,EAAE,0BAA0B;YACjC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,WAAW,EAAE,0EAA0E;YACvF,SAAS,EAAE,iCAAiC;YAC5C,KAAK,EAAE,yBAAyB;YAChC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,mBAAmB;YACvB,WAAW,EAAE,iEAAiE;YAC9E,SAAS,EAAE,mBAAmB;YAC9B,KAAK,EAAE,0BAA0B;YACjC,YAAY,EAAE,MAAM;SACrB;KACF;CACF,CAAC"}

package/dist/packs/part2.d.ts

@@ -0,0 +1,42 @@
+/**
+ * 42 CFR Part 2 Compliance Pack
+ *
+ * Confidentiality of Substance Use Disorder (SUD) Patient Records
+ * under 42 CFR Part 2 with 2024 Final Rule (HHS/SAMHSA/OCR, effective
+ * 25 March 2024; compliance by 16 February 2026). Stricter than HIPAA
+ * for SUD data.
+ *
+ * Standards referenced:
+ *   - 42 CFR Part 2 (original SAMHSA regulation)
+ *   - 2024 Final Rule (HHS/SAMHSA/OCR)
+ *   - CARES Act §3221 (2020) -- broadened permitted disclosures
+ *   - HIPAA Breach Notification Rule (adopted by 2024 Final Rule)
+ *   - §2.11 Part 2 Program definition
+ *   - §2.31-2.33 Consent requirements
+ *   - §2.32 Prohibition on Redisclosure Notice
+ *   - §2.52 Research exception
+ *   - §2.55 Breach notification
+ *   - §2.63-2.67 Legal proceedings restrictions
+ *
+ * Current state (2026):
+ *   - Compliance deadline: 16 Feb 2026 (coincides with this pack's
+ *     release to clients).
+ *   - Part 2 always activates alongside HIPAA + HITECH.
+ *   - Legal-proceedings restrictions remain stricter than HIPAA even
+ *     after 2024 alignment.
+ *
+ * @connexum/ai-governance
+ */
+import { CompliancePack } from './index';
+import { CategoryClassifiers } from '../classification/pack-driven-classifier';
+/**
+ * 42 CFR Part 2 (SUD Confidentiality) category classifiers.
+ * Substance Use Disorder records receive stricter-than-HIPAA protection.
+ * This pack always activates alongside HIPAA + HITECH.
+ */
+export declare const PART2_CATEGORY_CLASSIFIERS: CategoryClassifiers;
+export declare const PART2_PACK: CompliancePack & {
+    categoryClassifiers: CategoryClassifiers;
+    subjectKeyedCategories: string[];
+};
+//# sourceMappingURL=part2.d.ts.map

package/dist/packs/part2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"part2.d.ts","sourceRoot":"","sources":["../../src/packs/part2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAI/E;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,mBAyCxC,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,cAAc,GAAG;IAAE,mBAAmB,EAAE,mBAAmB,CAAC;IAAC,sBAAsB,EAAE,MAAM,EAAE,CAAA;CA8QrH,CAAC"}