Healthcare Agent (HIPAA)

import {
  TealEngineV12,
  TealGuard,
  TealSecrets,
  TealMemory,
  TealAudit,
  BundleExporter,
  PolicyMode,
  RedactionLevel,
} from 'tealtiger';

// --- Initialize modules with HIPAA configuration ---

const guard = new TealGuard({
  promptInjection: { enabled: true, mode: PolicyMode.ENFORCE },
  contentModeration: { enabled: true, mode: PolicyMode.ENFORCE },
  piiDetection: {
    enabled: true,
    mode: PolicyMode.ENFORCE,
    action: 'REDACT',
    patterns: ['NAME', 'DOB', 'SSN', 'MRN', 'PHONE', 'EMAIL', 'ADDRESS'],
  },
  phiDetection: {
    enabled: true,
    mode: PolicyMode.ENFORCE,
    action: 'REDACT',
  },
});

const secrets = new TealSecrets({
  patterns: 'all',
  customPatterns: [
    { name: 'MRN', regex: /MRN-\d{5,}/, confidence: 'HIGH' },
    { name: 'NPI', regex: /\d{10}/, confidence: 'MEDIUM', context: 'npi' },
  ],
  confidence: { minimum: 'MEDIUM' },
  action: 'REDACT',
});

const memory = new TealMemory({
  defaultScope: 'request',
  classification: {
    enforceReadGovernance: true,
    levels: ['PUBLIC', 'INTERNAL', 'CONFIDENTIAL', 'RESTRICTED'],
    defaultLevel: 'RESTRICTED', // HIPAA: default to most restrictive
  },
  encryption: {
    atRest: true,
    algorithm: 'AES-256-GCM',
  },
});

const audit = new TealAudit({
  enabled: true,
  redactPII: true,
  redactionLevel: RedactionLevel.HASH, // Hash PHI, don't just mask
  detectPHI: true,
  outputs: ['file', 'syslog'],
  retention: { days: 2555 }, // 7 years for HIPAA
  evidenceEnvelope: {
    enabled: true,
    includeModuleResults: true,
    includeRedactionMap: true,
  },
});

const exporter = new BundleExporter({
  format: 'sarif',
  version: '2.1.0',
  outputDir: './compliance-exports',
  includeEvidence: true,
});

const engine = new TealEngineV12({
  modules: [guard, secrets, memory, audit],
  mode: PolicyMode.ENFORCE, // HIPAA: always ENFORCE
  failClosed: true, // If any module errors, DENY the request
});

// --- Orchestration flow ---

async function handlePatientQuery(
  patientQuery: string,
  patientId: string,
  sessionToken: string
) {
  const context = engine.createContext({
    patientId,
    sessionToken,
    agentId: 'healthcare-agent',
    environment: 'production',
    complianceMode: 'HIPAA',
  });

  // Step 1: TealGuard detects and redacts PHI in input
  const inputScan = await guard.scan({
    content: patientQuery,
    direction: 'input',
    context,
  });

  if (inputScan.action === 'DENY') {
    await audit.log({
      type: 'input_blocked',
      reason: inputScan.reasonCodes,
      correlationId: context.correlationId,
    });
    return { blocked: true, reason: inputScan.reasonCodes };
  }

  const redactedQuery = inputScan.redactedContent || patientQuery;
  const phiDetected = inputScan.findings?.filter((f) => f.category === 'PHI') || [];

  // Step 2: TealEngine evaluates under HIPAA ENFORCE mode
  const policyDecision = await engine.evaluate({
    action: 'patient_data_access',
    patientId,
    classification: 'RESTRICTED',
    context,
  });

  if (policyDecision.action === 'DENY') {
    await audit.log({
      type: 'access_denied',
      reason: policyDecision.reasonCodes,
      correlationId: context.correlationId,
    });
    return { blocked: true, reason: policyDecision.reasonCodes };
  }

  // Step 3: TealMemory — read patient records with classification check
  const labResults = await memory.read({
    key: `patient:${patientId}:lab-results`,
    requiredClassification: 'RESTRICTED',
    requestorId: patientId,
    context,
  });

  if (labResults.action === 'DENY_READ') {
    await audit.log({
      type: 'memory_access_denied',
      reason: ['CLASSIFICATION_INSUFFICIENT'],
      correlationId: context.correlationId,
    });
    return { blocked: true, reason: ['CLASSIFICATION_INSUFFICIENT'] };
  }

  // Step 4: Generate response from lab data
  const llmResponse = await generateClinicalSummary(redactedQuery, labResults.data);

  // Step 5: TealSecrets scans output for PHI leakage
  const secretsScan = await secrets.scan({
    content: llmResponse,
    direction: 'output',
    context,
  });

  let finalResponse = llmResponse;
  if (secretsScan.findings.length > 0) {
    finalResponse = secretsScan.redactedContent;
  }

  // Step 6: TealGuard output moderation
  const outputScan = await guard.scan({
    content: finalResponse,
    direction: 'output',
    context,
  });

  if (outputScan.action === 'DENY') {
    await audit.log({
      type: 'output_blocked',
      reason: outputScan.reasonCodes,
      correlationId: context.correlationId,
    });
    return { blocked: true, reason: ['OUTPUT_MODERATION_FAILED'] };
  }

  // Step 7: TealAudit creates HIPAA evidence envelope
  const evidenceEnvelope = await audit.createEvidenceEnvelope({
    correlationId: context.correlationId,
    complianceFramework: 'HIPAA',
    accessType: 'patient_data_read',
    patientId, // Hashed in the envelope, not plaintext
    phiDetected: phiDetected.length,
    phiRedacted: phiDetected.length,
    moduleResults: {
      guard: { input: inputScan.action, output: outputScan.action },
      secrets: { findings: secretsScan.findings.length },
      memory: { action: labResults.action, classification: 'RESTRICTED' },
      engine: { action: policyDecision.action, mode: 'ENFORCE' },
    },
  });

  // Step 8: Export to SARIF for compliance tooling
  await exporter.export({
    envelope: evidenceEnvelope,
    correlationId: context.correlationId,
    format: 'sarif',
  });

  return {
    response: finalResponse,
    phiRedacted: phiDetected.length,
    complianceMode: 'HIPAA',
    evidenceId: evidenceEnvelope.id,
    correlationId: context.correlationId,
  };
}