"use strict";
/**
 * SOX 404 Compliance Pack
 *
 * Sarbanes-Oxley Act §404 (15 USC §7262): Internal Control over
 * Financial Reporting (ICFR). Applies to SEC-registered public
 * companies and foreign private issuers with US listings.
 *
 * Standards referenced:
 *   - SEC Rule 13a-15 / 15d-15
 *   - PCAOB AS 2201 (auditor attestation under §404(b))
 *   - COSO 2013 Integrated Framework (5 components, 17 principles)
 *   - 17 CFR 210.2-06 (7-year workpaper retention)
 *
 * Note: §404(b) auditor attestation is exempt for non-accelerated
 * filers (Dodd-Frank §989G). Pax1 still enforces §404(a) for all
 * filers.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.SOX404_PACK = exports.SOX404_CATEGORY_CLASSIFIERS = void 0;
/**
 * SOX Section 404 (Sarbanes-Oxley Act) category classifiers.
 * SOX 404 governs ICFR (Internal Control over Financial Reporting) process flows.
 * This pack governs process flows (management assessment, ITGC, SOD, change management).
 * Classification targets financial records, material figures, PII, and credentials.
 */
exports.SOX404_CATEGORY_CLASSIFIERS = {
    FINANCIAL_RECORD: {
        references: ['SOX §404(a) -- management assessment of ICFR; financial record integrity'],
        classifier: (input) => {
            if (/\b(?:general\s+ledger|GL\s+entry|journal\s+entry|trial\s+balance|balance\s+sheet|income\s+statement|P&L|financial\s+statement)\b/i.test(input))
                return true;
            if (/\b(?:accounts\s+(?:payable|receivable)|revenue\s+recognition|GAAP|IFRS|10-K|10-Q)\b/i.test(input))
                return true;
            return false;
        },
    },
    MATERIAL_FIGURE: {
        references: ['SOX §302/404 -- material financial figure requiring CEO/CFO certification'],
        classifier: (input) => {
            if (/\b(?:material\s+(?:weakness|misstatement|deficiency)|restatement|earnings\s+per\s+share|EPS)\b/i.test(input))
                return true;
            if (/\$[\d,]{7,}(?:\.\d{2})?(?:\s*(?:million|billion|M|B))?\b/.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['SOX §404 -- employee financial data in ICFR systems; PII protection'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['SOX §404 -- ITGC logical access controls; credential protection'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.SOX404_PACK = {
    categoryClassifiers: exports.SOX404_CATEGORY_CLASSIFIERS,
    id: 'sox404',
    name: 'SOX 404',
    version: '1.0.0',
    contentHash: 'b065c4a1ff83905d100cd993fa036167b0951b30d820e5e5b911f3746bb43fba',
    description: 'Sarbanes-Oxley §404 Internal Control over Financial Reporting (ICFR) under SEC Rule 13a-15/15d-15, PCAOB AS 2201, and COSO 2013. Includes 2024-2026 PCAOB focus on AI/ML in financial reporting.',
    authority: 'SEC, PCAOB',
    industries: ['public-company', 'foreign-private-issuer', 'sec-registrant', 'accelerated-filer', 'large-accelerated-filer'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'ICFR control-inventory gate; material-change reassessment',
            reference: '15 USC §7262; COSO 2013 Principle 10',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident change management and control testing evidence',
            reference: 'PCAOB AS 2201 §B8',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Stream financial-impact decisions, material-weakness escalations',
            reference: 'PCAOB AS 2201 §34',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Segregation of duties; human review of AI output hitting GL; material-change approvals',
            reference: 'COSO 2013 Principle 10; PCAOB AS 2201 §39',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'ITGC operations monitoring; unusual financial-data patterns',
            reference: 'COSO 2013 Principle 11',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Unique identity for segregation-of-duties enforcement',
            reference: 'PCAOB AS 2201 §B8',
        },
        {
            name: 'circuit-breaker',
            required: true,
            reason: 'Prevent cascading failures in financial-reporting agents',
            reference: 'COSO 2013 Principle 11',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Sub-service providers (SOC 1 report incorporation) via CUEC register',
            reference: 'PCAOB AS 2201 §34; AU-C 402',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Annual §404(a) management assertion; quarterly control testing; deficiency register',
            reference: '15 USC §7262(a); PCAOB AS 2201 §64-70',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Financial records at rest and in transit',
            reference: 'COSO 2013 Principle 11 (ITGC)',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Detect FINANCIAL_RECORD and MATERIAL_FIGURE for governance routing',
            reference: 'COSO 2013 Principle 10',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Audit evidence and change-management state across sessions',
            reference: 'PCAOB AS 2201 §B8',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            icfrControlMappingRequired: true,
            materialChangeReassessmentRequired: true,
            cosoFrameworkAlignmentRequired: 'COSO 2013',
        },
        'approval-queue': {
            sodEnforced: true,
            aiOutputToGeneralLedgerRequiresHumanReview: true,
            materialChangeApprovalRequired: true,
        },
        'attestation-manager': {
            annualManagementAssessmentRequired: true,
            quarterlyControlTestingCadenceDays: 90,
            deficiencyRegisterRequired: true,
            classificationTaxonomy: ['deficiency', 'significant-deficiency', 'material-weakness'],
        },
        'supply-chain': {
            socOneCuecRegistrationRequired: true,
        },
        'data-classifier': {
            enabledCategories: ['FINANCIAL_RECORD', 'MATERIAL_FIGURE', 'PII', 'CREDENTIALS'],
            financialRecordAction: 'BLOCK_WITHOUT_APPROVAL',
            materialFigureAction: 'BLOCK_WITHOUT_HUMAN_REVIEW',
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: ['SOC1-OR-SOC2-TYPE2'],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: ['FINANCIAL_RECORD', 'MATERIAL_FIGURE', 'PII', 'CREDENTIALS'],
        categoryActions: {
            // Input-side: BLOCK -> DENY verdict before tool executes.
            // Output-side stripping is handled by the pii_shield block below.
            FINANCIAL_RECORD: 'BLOCK', // MNPI blocked at input boundary
            MATERIAL_FIGURE: 'BLOCK', // Pre-announcement earnings/revenue blocked
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
        /**
         * PR-2: PII Shield -- SOX 404.
         *
         * STRICT mode: material non-public information (MNPI) and confidential
         * business information are stripped before the agent processes them.
         * Prevents AI agents from inadvertent MNPI disclosure or insider-trading
         * risk via model fine-tuning / logging.
         *
         * References:
         *   SOX Section 404 -- management assessment of internal controls
         *   SEC Rule 10b-5 -- material non-public information restrictions
         *   17 CFR 240.10b-5 -- insider trading prohibition
         */
        pii_shield: {
            pii_shield_mode: 'STRICT',
            strip_classes: ['financial', 'confidential-business'],
            uuid_scope: 'per_session',
            date_handling: 'relative_offset',
            age_aggregation_threshold: 89,
            ner_pre_scan: true,
            pre_send_phi_scan: true,
            auto_remediate_on_register: true,
            provider_memory_disabled_required: true,
        },
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // 7-year workpaper retention per 17 CFR 210.2-06
        auditLogRetentionDays: 2555,
        sessionRetentionDays: 730,
        incidentRetentionDays: 2555,
        reference: '17 CFR 210.2-06 auditor workpaper retention + SEC filing evidence retention',
    },
    incidentPolicy: {
        // 72 hours internal escalation to disclosure committee for material weaknesses
        notificationDeadlineHours: 72,
        reference: '15 USC §7262 + SEC Rule 13a-15. Material weaknesses disclosed in the 10-K / 10-Q; Pax1 default 72-hour internal escalation to disclosure committee.',
        requiredRecipients: ['disclosure-committee', 'cfo', 'chief-accounting-officer', 'audit-committee', 'external-auditor'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'sox404-management-assessment',
            description: 'Annual §404(a) management ICFR assessment attested (COSO 2013)',
            reference: '15 USC §7262(a); SEC Rule 13a-15',
            check: 'sox404_management_assessment_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'sox404-control-mapping',
            description: 'AI models affecting financial statements mapped to ICFR controls',
            reference: 'COSO 2013 Principle 10; PCAOB AS 2201 §34',
            check: 'sox404_control_mapping_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'sox404-material-change',
            description: 'Material changes trigger control-design reassessment',
            reference: 'PCAOB AS 2201 §39',
            check: 'sox404_material_change_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sox404-sod',
            description: 'Segregation of duties enforced on financial-impact decisions',
            reference: 'COSO 2013 Principle 10',
            check: 'sox404_sod_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'sox404-ai-gl-gate',
            description: 'AI output hitting GL requires human review',
            reference: 'PCAOB 2024-2026 AI focus; COSO 2013 Principle 10',
            check: 'sox404_ai_gl_gate_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'sox404-deficiency-register',
            description: 'Deficiencies classified (deficiency / significant / material weakness) with remediation plan',
            reference: 'PCAOB AS 2201 §64-70',
            check: 'sox404_deficiency_register_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sox404-testing-cadence',
            description: 'Quarterly control testing cadence enforced',
            reference: 'PCAOB AS 2201 §B26',
            check: 'sox404_testing_cadence_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sox404-change-management',
            description: 'Change management log complete for financial-impact systems',
            reference: 'COSO 2013 Principle 11',
            check: 'sox404_change_management_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'sox404-cuec-register',
            description: 'Complementary User Entity Controls register populated from SOC 1 reports',
            reference: 'PCAOB AS 2201 §34; AU-C 402',
            check: 'sox404_cuec_register_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'sox404-itgc-matrix',
            description: 'IT General Controls matrix (access, change, operations) current',
            reference: 'PCAOB AS 2201 §B8',
            check: 'sox404_itgc_matrix_active',
            failSeverity: 'HIGH',
        },
        {
            // F-NEW-VERA-PACK-C2-07 (LOW): COSO 2013 framework version validator.
            // PCAOB AS 2201 §.03 explicitly references the COSO 2013 Integrated
            // Framework. The superseded 1992 COSO framework does not satisfy AS 2201.
            id: 'sox404-coso-2013-framework',
            description: 'COSO 2013 Integrated Framework (5 components, 17 principles) required per PCAOB AS 2201 -- superseded 1992 framework is not acceptable',
            reference: 'PCAOB AS 2201 §.03 -- COSO 2013 Integrated Framework; SEC Release 33-8809 reaffirmed COSO alignment',
            check: 'sox404_coso_2013_framework_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=sox404.js.map