// Planu — Compliance framework catalog (SPEC-402)
export const COMPLIANCE_CATALOG = [
    // SOC2 Type II controls
    {
        id: 'SOC2-CC6.1',
        framework: 'soc2-type2',
        name: 'Logical Access Controls',
        description: 'The entity implements logical access security software, infrastructure, and architectures',
        specPatterns: ['auth', 'login', 'access control', 'rbac', 'permission', 'role'],
        requiredCriteria: [
            'Role-based access control implemented',
            'Principle of least privilege enforced',
            'Access logs maintained',
        ],
    },
    {
        id: 'SOC2-CC6.2',
        framework: 'soc2-type2',
        name: 'User Registration & Authorization',
        description: 'Prior to issuing system credentials, entity registers authorized users',
        specPatterns: ['user registration', 'signup', 'onboarding', 'invite'],
        requiredCriteria: [
            'Email verification required',
            'Account approval workflow defined',
            'Deactivation process documented',
        ],
    },
    {
        id: 'SOC2-CC6.6',
        framework: 'soc2-type2',
        name: 'Logical Access Restrictions',
        description: 'The entity implements controls to prevent or detect unauthorized access',
        specPatterns: ['authentication', 'mfa', 'multi-factor', 'password', 'session'],
        requiredCriteria: [
            'MFA available for all users',
            'Session timeout configured',
            'Password complexity requirements enforced',
        ],
    },
    {
        id: 'SOC2-CC7.1',
        framework: 'soc2-type2',
        name: 'System Monitoring',
        description: 'The entity uses detection and monitoring procedures',
        specPatterns: ['monitoring', 'logging', 'alerting', 'observability', 'metrics'],
        requiredCriteria: [
            'All system events logged',
            'Alerting configured for anomalies',
            'Log retention ≥90 days',
        ],
    },
    {
        id: 'SOC2-CC8.1',
        framework: 'soc2-type2',
        name: 'Change Management',
        description: 'The entity authorizes, designs, develops or acquires system changes',
        specPatterns: ['deployment', 'release', 'change', 'migration', 'upgrade'],
        requiredCriteria: [
            'Change reviewed and approved before deployment',
            'Rollback plan documented',
            'Testing required before production',
        ],
    },
    // GDPR controls
    {
        id: 'GDPR-Art5',
        framework: 'gdpr',
        name: 'Data Processing Principles',
        description: 'Personal data shall be processed lawfully, fairly and transparently',
        specPatterns: ['user data', 'personal data', 'pii', 'privacy', 'profile'],
        requiredCriteria: [
            'Legal basis for data processing documented',
            'Data minimization applied',
            'Retention period defined',
        ],
    },
    {
        id: 'GDPR-Art17',
        framework: 'gdpr',
        name: 'Right to Erasure',
        description: 'Data subjects have the right to obtain erasure of personal data',
        specPatterns: ['delete account', 'data deletion', 'erasure', 'forget me', 'gdpr'],
        requiredCriteria: [
            'Account deletion removes all PII',
            'Deletion confirmed within 30 days',
            'Cascading deletion across all data stores',
        ],
    },
    {
        id: 'GDPR-Art32',
        framework: 'gdpr',
        name: 'Security of Processing',
        description: 'Appropriate technical and organisational measures to ensure data security',
        specPatterns: ['encryption', 'security', 'data protection'],
        requiredCriteria: [
            'PII encrypted at rest',
            'PII encrypted in transit (TLS 1.2+)',
            'Access to PII logged and audited',
        ],
    },
    // HIPAA controls
    {
        id: 'HIPAA-164.312a',
        framework: 'hipaa',
        name: 'Access Control',
        description: 'Implement technical policies and procedures for accessing ePHI',
        specPatterns: ['patient', 'health', 'phi', 'medical', 'clinical', 'hipaa'],
        requiredCriteria: [
            'Unique user ID required',
            'Automatic logoff after inactivity',
            'PHI access logged with user ID and timestamp',
        ],
    },
    {
        id: 'HIPAA-164.312b',
        framework: 'hipaa',
        name: 'Audit Controls',
        description: 'Implement hardware, software, and procedural mechanisms to record access to ePHI',
        specPatterns: ['audit', 'logging', 'access log', 'hipaa'],
        requiredCriteria: [
            'All PHI access events recorded',
            'Audit logs tamper-evident',
            'Log retention ≥6 years',
        ],
    },
];
export function getControlsForFramework(framework) {
    return COMPLIANCE_CATALOG.filter((c) => c.framework === framework);
}
export function findMatchingControls(framework, specTitle, specDescription) {
    const text = (specTitle + ' ' + specDescription).toLowerCase();
    return COMPLIANCE_CATALOG.filter((c) => c.framework === framework).filter((c) => c.specPatterns.some((p) => text.includes(p)));
}
//# sourceMappingURL=framework-catalog.js.map