"use strict";
/**
 * SOC 2 Type II Compliance Pack
 *
 * AICPA SOC 2 Type II Trust Services Criteria compliance for AI agent
 * systems. Based on the AICPA Trust Services Criteria (2017 TSC,
 * revised 2022) with 2024 AICPA Supplemental Criteria for AI.
 *
 * Standards referenced:
 *   - AICPA Trust Services Criteria (TSC): CC1-CC9, A1, C1, PI1, P1-P8
 *   - AT-C §105 (Attestation engagements)
 *   - AT-C §205 (Examination engagements)
 *   - AICPA 2024 AI Supplemental Criteria (experimental AI-specific
 *     trust service criteria for SOC 2 Type II examinations)
 *   - SOC for AI (2024): separate engagement framework for AI-specific
 *     controls; SOC 2 prerequisite
 *
 * Current state (2026):
 *   - CC6 Logical + Physical Access Controls: 2024 revisions clarified
 *     MFA, password complexity, session timeout expectations.
 *   - CC7 System Operations: 2024 revisions tightened monitoring,
 *     incident detection, and change-management criteria.
 *   - AI Supplemental Criteria: when a service org's AI affects service
 *     commitments, auditor may include AI-specific criteria (model
 *     development, training-data governance, model monitoring, bias).
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.SOC2_PACK = exports.SOC2_CATEGORY_CLASSIFIERS = void 0;
/**
 * SOC 2 category classifiers for the pack-driven classifier.
 * SOC 2 governs logical access controls (CC6) and data handling.
 * Primary concerns: credential exposure and API key leakage.
 *
 * This pack governs process flows (change management, monitoring,
 * availability, processing integrity). Classification targets
 * credential/API-key exposure, which is the category the behavioral
 * validator tests.
 */
exports.SOC2_CATEGORY_CLASSIFIERS = {
    CREDENTIALS: {
        references: ['AICPA TSC CC6.1 -- Logical and Physical Access Controls'],
        classifier: (input) => {
            // API keys and secrets
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            // Password in plaintext
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            // AWS access keys
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            // Bearer tokens
            if (/\bbearer\s+[A-Za-z0-9_\-\.]{20,}/i.test(input))
                return true;
            // Private key headers
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            // secret_key / access_token / client_secret patterns
            if (/\b(?:secret[_-]?key|access[_-]?token|client[_-]?secret|private[_-]?key)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            return false;
        },
    },
    API_KEY: {
        references: ['AICPA TSC CC6.1 -- API authentication credentials'],
        classifier: (input) => {
            // sk- prefixed keys (OpenAI-style)
            if (/\bsk-[A-Za-z0-9_\-]{20,}\b/.test(input))
                return true;
            // Generic API key markers
            if (/\b(?:x-api-key|api[_-]?key)[:\s=]+[A-Za-z0-9_\-]{16,}/i.test(input))
                return true;
            // Token patterns
            if (/\b(?:token|auth[_-]?token)\s*[=:]\s*["']?[A-Za-z0-9_\-\.]{20,}["']?/i.test(input))
                return true;
            return false;
        },
    },
    ACCESS_CONTROL_EVENT: {
        references: ['AICPA TSC CC6.1 -- Logical and Physical Access Controls'],
        classifier: (input) => {
            if (/\bmfa\s+bypass\b/i.test(input))
                return true;
            if (/\bprivilege\s+escalation\b/i.test(input))
                return true;
            if (/\bprivileged\s+access\s+granted\b/i.test(input))
                return true;
            if (/\bgranted\s+(root|admin)\s+role\b/i.test(input))
                return true;
            if (/\bfailed\s+login\s+attempts?\b/i.test(input))
                return true;
            if (/\bsession\s+timeout\s+(policy\s+)?not\s+enforced\b/i.test(input))
                return true;
            if (/\borphaned\s+account\b/i.test(input))
                return true;
            if (/\baccess\s+review\s+evidence\b/i.test(input))
                return true;
            if (/\bterminated\s+employee\s+(account|access)\b/i.test(input))
                return true;
            return false;
        },
    },
    CHANGE_MGMT_EVENT: {
        references: ['AICPA TSC CC8.1 -- Change Management'],
        classifier: (input) => {
            if (/\b(production|prod)\s+deployment\s+without\s+(change\s+)?(request\s+)?approval\b/i.test(input))
                return true;
            if (/\bemergency\s+change\s+deployed\b/i.test(input))
                return true;
            if (/\bchange[\s-]?management\s+(window|process|gate)\b/i.test(input))
                return true;
            if (/\bconfiguration\s+change\b/i.test(input) && /\bproduction\b/i.test(input))
                return true;
            if (/\buntracked\s+deployment\b/i.test(input))
                return true;
            if (/\bpushed\s+directly\s+to\s+(main|master|prod)\b/i.test(input))
                return true;
            if (/\b(cab|change\s+advisory\s+board)\s+approval\b/i.test(input))
                return true;
            if (/\bchange\s+ticket\s+(chg|change)[-\s][a-z0-9]+/i.test(input))
                return true;
            return false;
        },
    },
    MONITORING_INCIDENT: {
        references: ['AICPA TSC CC7.2/CC7.3 -- System Monitoring + Incident Response'],
        classifier: (input) => {
            if (/\banomaly\s+detected\b/i.test(input))
                return true;
            if (/\bsecurity\s+incident\b/i.test(input))
                return true;
            if (/\bcredential\s+compromise\b/i.test(input))
                return true;
            if (/\bmonitoring\s+alert\b/i.test(input))
                return true;
            if (/\bincident\s+response\s+triggered\b/i.test(input))
                return true;
            if (/\bintrusion\s+detection\s+alert\b/i.test(input))
                return true;
            if (/\bcustomer[\s-]impacting\s+outage\b/i.test(input))
                return true;
            if (/\bbrute[\s-]force\b/i.test(input))
                return true;
            return false;
        },
    },
    VENDOR_RISK: {
        references: ['AICPA TSC CC9.2 -- Vendor and Sub-Service Organization Risk Management'],
        classifier: (input) => {
            if (/\bsub[\s-]?service\s+organization\b/i.test(input))
                return true;
            if (/\bsubservice\s+(provider|organization|organisation)\b/i.test(input))
                return true;
            if (/\bvendor\s+risk\s+assessment\b/i.test(input))
                return true;
            if (/\b(third[\s-]?party|3rd[\s-]?party)\s+(processor|vendor|provider|breach|risk)\b/i.test(input))
                return true;
            if (/\bcarve[\s-]out\s+(sub[\s-]?service|controls?)\b/i.test(input))
                return true;
            if (/\bcontractual\s+sla\b/i.test(input))
                return true;
            if (/\bsoc\s*2\s+report\s+not\s+received\b/i.test(input))
                return true;
            return false;
        },
    },
};
exports.SOC2_PACK = {
    categoryClassifiers: exports.SOC2_CATEGORY_CLASSIFIERS,
    id: 'soc2',
    name: 'SOC 2 Type II',
    version: '1.0.0',
    description: 'AICPA SOC 2 Type II Trust Services Criteria compliance with 2022 TSC revisions and 2024 AI Supplemental Criteria. Covers Security (CC1-CC9), Availability (A1), Confidentiality (C1), Processing Integrity (PI1), and Privacy (P1-P8) where scope selects them.',
    authority: 'AICPA Auditing Standards Board',
    industries: ['technology', 'saas', 'fintech', 'healthcare-it', 'legal-tech', 'consulting', 'data-analytics'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Deny-by-default access control; change-management gate',
            reference: 'AICPA TSC CC6.1, CC6.3, CC8.1',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for TSC monitoring evidence',
            reference: 'AICPA TSC CC7.2, CC7.3',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'System monitoring; incident detection; anomaly stream',
            reference: 'AICPA TSC CC7.2',
        },
        {
            name: 'circuit-breaker',
            required: true,
            reason: 'System availability; incident-response isolation',
            reference: 'AICPA TSC A1.2',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Continuous anomaly detection against baseline',
            reference: 'AICPA TSC CC7.2',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Change management state across sessions',
            reference: 'AICPA TSC CC8.1',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Vendor management, third-party risk assessment',
            reference: 'AICPA TSC CC9.2',
        },
        {
            name: 'encryption-layer',
            required: false,
            reason: 'Encryption at rest / in transit (recommended; required when Confidentiality or Privacy TSCs selected)',
            reference: 'AICPA TSC CC6.7, C1.1',
        },
        {
            name: 'data-classifier',
            required: false,
            reason: 'Data classification (recommended; required when Confidentiality TSCs selected)',
            reference: 'AICPA TSC CC6.1, C1.1',
        },
        {
            name: 'agent-registration-integrity',
            required: true,
            reason: 'Named actors on audit records must be verified identities; change-management gate for agent lifecycle',
            reference: 'AICPA TSC CC1.4 (Competence), CC8.1 (Change Management)',
        },
    ],
    moduleConfig: {
        'audit-integrity': {
            maxEntriesPerFile: 10000,
            tscEvidenceRetentionRequired: true,
        },
        'circuit-breaker': {
            maxFailures: 5,
            resetTimeoutMs: 60000,
            availabilityCriterionActive: true,
        },
        'anomaly-detector': {
            thresholdMultiplier: 2.0,
            continuousMonitoringRequired: true,
        },
        'supply-chain': {
            vendorRiskAssessmentRequired: true,
            subserviceOrganisationRegisterRequired: true,
        },
        'governance-runtime': {
            denyByDefaultRequired: true,
            aiSupplementalCriteriaSupported: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['SOC2-TYPE2'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['CREDENTIALS', 'API_KEY', 'ACCESS_CONTROL_EVENT', 'CHANGE_MGMT_EVENT', 'MONITORING_INCIDENT', 'VENDOR_RISK'],
        categoryActions: {
            CREDENTIALS: 'BLOCK',
            API_KEY: 'BLOCK',
            ACCESS_CONTROL_EVENT: 'WARN',
            CHANGE_MGMT_EVENT: 'WARN',
            MONITORING_INCIDENT: 'LOG',
            VENDOR_RISK: 'LOG',
        },
        encryptionRequired: false,
        encryptionStandard: 'AES-256',
        minimumClassification: 'INTERNAL',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        auditLogRetentionDays: 365,
        sessionRetentionDays: 90,
        incidentRetentionDays: 365,
        reference: 'AICPA TSC CC7.4 -- audit logs retained for the examination review period (typically 12 months for Type II)',
    },
    incidentPolicy: {
        notificationDeadlineHours: 24,
        reference: 'AICPA TSC CC7.3, CC7.4 -- timely communication of incidents to affected parties',
        requiredRecipients: ['security-team', 'management', 'affected-customers-if-material'],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'soc2-audit-trail',
            description: 'Audit trail exists and is tamper-evident',
            reference: 'AICPA TSC CC7.2',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'soc2-access-control',
            description: 'Agent permissions enforced (deny-by-default)',
            reference: 'AICPA TSC CC6.1',
            check: 'rbac_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'soc2-change-mgmt',
            description: 'Change management tracking active',
            reference: 'AICPA TSC CC8.1',
            check: 'change_management_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'soc2-monitoring',
            description: 'System monitoring and anomaly detection active',
            reference: 'AICPA TSC CC7.2',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'soc2-vendor-mgmt',
            description: 'Third-party tool and sub-service registry maintained',
            reference: 'AICPA TSC CC9.2',
            check: 'subservice_registry_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'soc2-incident-response',
            description: 'Incident response process defined and executable',
            reference: 'AICPA TSC CC7.3',
            check: 'incident_reporting',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=soc2.js.map