/**
 * SOC 1 / SSAE 18 Compliance Pack
 *
 * Service Organisation Control over Internal Control over Financial
 * Reporting (ICFR). Applies when the service organisation's controls
 * affect user entities' financial statements -- payroll processors,
 * SaaS handling financial data, managed financial hosting, transaction
 * processors, fund administrators, benefits administrators.
 *
 * Maps AICPA SSAE 18 (AT-C 320) control objectives to governance
 * modules. International equivalent: ISAE 3402.
 *
 * Type I vs Type II:
 *   - Type I validates control DESIGN at a point in time.
 *   - Type II validates operating EFFECTIVENESS over 6-12 months.
 * Pax1 produces continuous evidence suitable for both. Type II
 * requires a minimum 6 months of evidence from audit-integrity and
 * attestation-manager.
 *
 * @connexum/ai-governance
 */
import { sharedPiiClassifier } from './_base-classifiers.js';
/**
 * SOC 1 / SSAE 18 (ICFR) category classifiers.
 * SOC 1 governs controls over financial reporting at service organisations.
 * CREDENTIALS protects access to financial control systems; PII covers
 * personal data appearing in financial records (payroll, benefits, etc.).
 */
export const SOC1_CATEGORY_CLASSIFIERS = {
    CREDENTIALS: {
        references: ['SSAE 18 AT-C 320 -- logical access controls; service organisation credential protection'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            if (/\b(?:bearer\s+token|access_token|refresh_token)\s*[=:]\s*["']?[A-Za-z0-9._\-]{20,}["']?/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['SSAE 18 -- personal data in payroll, benefits administration, and financial reporting systems'],
        classifier: (input) => {
            if (sharedPiiClassifier(input))
                return true;
            if (/\b(?:employee\s+(?:id|name|record)|payroll\s+(?:data|record)|benefits\s+(?:data|record))\b/i.test(input))
                return true;
            return false;
        },
    },
    CONTROL_DEFICIENCY: {
        references: ['SSAE 18 AT-C 320 -- control deficiency / significant deficiency / material weakness'],
        classifier: (input) => {
            if (/\bmaterial\s+weakness\b/i.test(input))
                return true;
            if (/\bsignificant\s+deficiency\b/i.test(input))
                return true;
            if (/\bcontrol\s+(deficiency|gap)\b/i.test(input))
                return true;
            if (/\bicfr\s+(?:control\s+)?(deficiency|gap|weakness)\b/i.test(input))
                return true;
            if (/\binternal\s+control\s+over\s+financial\s+reporting\s+(deficiency|gap|weakness)/i.test(input))
                return true;
            if (/\bsegregation\s+of\s+duties\b/i.test(input) && /\b(not\s+enforced|missing|violated|gap)\b/i.test(input))
                return true;
            if (/\bjournal[\s-]entry\s+approval\s+missing\b/i.test(input))
                return true;
            return false;
        },
    },
    ICFR_TEST_FAILURE: {
        references: ['SSAE 18 AT-C 320 -- test of operating effectiveness'],
        classifier: (input) => {
            if (/\btest\s+of\s+operating\s+effectiveness\s+(failed|exception)/i.test(input))
                return true;
            if (/\btoe\s+(failure|exception)\b/i.test(input))
                return true;
            if (/\boperating\s+effectiveness\s+exception\b/i.test(input))
                return true;
            if (/\bcontrol\s+test\s+exception\b/i.test(input))
                return true;
            if (/\bicfr\s+test\s+failure\b/i.test(input))
                return true;
            if (/\bsample\s+items?\s+did\s+not\s+meet\s+control\s+criteria\b/i.test(input))
                return true;
            if (/\bevidence\s+of\s+approval\s+missing\b/i.test(input))
                return true;
            return false;
        },
    },
    SOX_404_EVIDENCE: {
        references: ['Sarbanes-Oxley Section 404 -- ICFR attestation evidence'],
        classifier: (input) => {
            if (/\bsox\s+(?:section\s+)?404\b/i.test(input))
                return true;
            if (/\bsarbanes[\s-]oxley\s+(?:section\s+)?404\b/i.test(input))
                return true;
            if (/\b404\(b\)\s+attestation\b/i.test(input))
                return true;
            if (/\bpcaob\s+sox\s+404\b/i.test(input))
                return true;
            if (/\b(?:management\s+)?assertion\s+on\s+icfr\s+effectiveness\b/i.test(input))
                return true;
            return false;
        },
    },
};
export const SOC1_PACK = {
    categoryClassifiers: SOC1_CATEGORY_CLASSIFIERS,
    id: 'soc1',
    name: 'SOC 1 / SSAE 18',
    version: '1.0.0',
    description: 'Service Organisation Control over Internal Control over Financial Reporting (ICFR). AICPA SSAE 18 AT-C 320 and ISAE 3402.',
    authority: 'AICPA / Auditing Standards Board',
    industries: [
        'payroll',
        'saas-financial',
        'managed-hosting-financial',
        'transaction-processing',
        'fund-administration',
        'benefits-administration',
        'fintech-service-provider',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Access control, change gating, segregation of duties enforcement',
            reference: 'AT-C 320.15 -- Control environment and activities',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail anchored to SHA-256 hash chain',
            reference: 'AT-C 320.24 -- Integrity of data affecting user entity financial reporting',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Log every financial-impact decision and access event',
            reference: 'AT-C 320.18 -- Monitoring of controls',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Enforce segregation of duties; same agent cannot create and approve a transaction',
            reference: 'AT-C 320.15 -- Segregation of duties',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detect deviation from baseline transaction or processing patterns',
            reference: 'AT-C 320.18 -- Monitoring controls for detection of anomalies',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Unique agent identification for every access to financial systems',
            reference: 'AT-C 320.15 -- Identification and authentication',
        },
        {
            name: 'circuit-breaker',
            required: true,
            reason: 'Prevent cascading failures in financial-processing agents',
            reference: 'AT-C 320.15 -- Operational continuity of controls',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Sub-service organisation register (inclusive vs carve-out method)',
            reference: 'AT-C 320.34 -- Sub-service organisations',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Control owners attest to design and operation of controls',
            reference: 'AT-C 320.10 -- Management assertions',
        },
    ],
    moduleConfig: {
        'approval-queue': {
            // SOC 1 segregation: requestor must not equal approver
            requireDistinctRequestorApprover: true,
            // Financial impact decisions require formal approval, not just allow/deny
            formalApprovalForFinancialImpact: true,
        },
        'audit-integrity': {
            // ICFR relies on tamper-evident records; hash chain must be persisted
            hashChainPersistenceRequired: true,
        },
        'anomaly-detector': {
            // Baseline set per financial-processing agent; 2.5x multiplier (tighter than SOC 2)
            thresholdMultiplier: 2.5,
        },
    },
    providerPolicy: {
        // SOC 1 does not block providers per se; it requires sub-service disclosure.
        blockedProviders: [],
        requiredCapabilities: ['SOC2-TYPE2'], // Preferred: sub-service orgs with SOC 2/SOC 1 of their own
        blockReasons: {},
    },
    dataPolicy: {
        // Financial context: protect credentials; warn on PII that may include financial identifiers
        scanCategories: ['CREDENTIALS', 'PII', 'CONTROL_DEFICIENCY', 'ICFR_TEST_FAILURE', 'SOX_404_EVIDENCE'],
        categoryActions: {
            CREDENTIALS: 'BLOCK',
            PII: 'WARN',
            CONTROL_DEFICIENCY: 'WARN',
            ICFR_TEST_FAILURE: 'WARN',
            SOX_404_EVIDENCE: 'LOG',
        },
        encryptionRequired: false, // SOC 1 focus is ICFR, not data-at-rest; SOC 2 covers encryption
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        // Aligned with SOX / financial records retention (7 years)
        auditLogRetentionDays: 2555,
        sessionRetentionDays: 365,
        incidentRetentionDays: 2555,
        sovereignty: ['US'],
        reference: 'SOX / SSAE 18 financial records retention -- evidence supporting user entity financial statements retained 7 years',
    },
    incidentPolicy: {
        // 24-hour notification for financial-impact incidents
        notificationDeadlineHours: 24,
        reference: 'AT-C 320.32 -- Timely communication of control failures to management',
        requiredRecipients: [
            'service-delivery-manager',
            'client-relationship-manager',
            'external-auditor-contact',
        ],
        formalNotificationRequired: false,
    },
    validators: [
        {
            id: 'soc1-change-mgmt',
            description: 'Change management gating on financial-impact agents',
            reference: 'AT-C 320.15',
            check: 'change_management_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'soc1-sod',
            description: 'Segregation of duties enforced via approval queue (requestor != approver)',
            reference: 'AT-C 320.15',
            check: 'segregation_of_duties_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'soc1-integrity',
            description: 'Hash chain persisted and verified for financial-impact decisions',
            reference: 'AT-C 320.24',
            check: 'hash_chain_persisted',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'soc1-access-control',
            description: 'Deny-by-default access provisioning on financial tools',
            reference: 'AT-C 320.15',
            check: 'rbac_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'soc1-unique-id',
            description: 'Unique agent identification for financial-system access',
            reference: 'AT-C 320.15',
            check: 'agent_auth_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'soc1-subservice',
            description: 'Sub-service organisation register maintained with inclusive/carve-out method',
            reference: 'AT-C 320.34',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'soc1-cuec',
            description: 'Complementary User Entity Control (CUEC) register maintained',
            reference: 'AT-C 320.45',
            check: 'cuec_register_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'soc1-attestation',
            description: 'Control owner attestations captured and tracked for expiry',
            reference: 'AT-C 320.10',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'soc1-monitoring',
            description: 'Continuous monitoring of control operation via event bus and anomaly detector',
            reference: 'AT-C 320.18',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=soc1.js.map