vaspera 2.5.0

package/dist/compliance/report.test.js

@@ -0,0 +1,128 @@
+/**
+ * Tests for compliance report generator
+ */
+import { describe, it, expect } from "vitest";
+import { formatComplianceReportAsMarkdown, formatMultiFrameworkReportAsMarkdown, formatComplianceReportAsJson, generateCompactComplianceSummary, } from "./report.js";
+import { generateComplianceReport, generateMultiFrameworkReport } from "./mapper.js";
+describe("compliance report", () => {
+    const mockFindings = [
+        {
+            id: "sec-001",
+            severity: "critical",
+            category: "sql-injection",
+            description: "SQL injection vulnerability in user query",
+            evidence: "Test evidence",
+            confidence: 90,
+            file: "db/queries.ts",
+            line: 42,
+            verifications: [],
+            created_at: new Date().toISOString(),
+        },
+        {
+            id: "sec-002",
+            severity: "high",
+            category: "xss",
+            description: "Cross-site scripting in user input",
+            evidence: "Test evidence",
+            confidence: 85,
+            file: "components/Form.tsx",
+            line: 15,
+            verifications: [],
+            created_at: new Date().toISOString(),
+        },
+    ];
+    describe("formatComplianceReportAsMarkdown", () => {
+        it("generates markdown with header", () => {
+            const report = generateComplianceReport(mockFindings, "SOC2", "/test/path");
+            const markdown = formatComplianceReportAsMarkdown(report);
+            expect(markdown).toContain("# SOC2 Compliance Report");
+            expect(markdown).toContain("## Compliance Status");
+        });
+        it("includes compliance status table", () => {
+            const report = generateComplianceReport(mockFindings, "SOC2", "/test/path");
+            const markdown = formatComplianceReportAsMarkdown(report);
+            expect(markdown).toContain("**Compliance Score**");
+            expect(markdown).toContain("**Risk Score**");
+            expect(markdown).toContain("Total Controls");
+        });
+        it("includes non-compliant controls section", () => {
+            const report = generateComplianceReport(mockFindings, "SOC2", "/test/path");
+            const markdown = formatComplianceReportAsMarkdown(report);
+            expect(markdown).toContain("## Non-Compliant Controls");
+        });
+        it("includes recommendations section", () => {
+            const report = generateComplianceReport(mockFindings, "SOC2", "/test/path");
+            const markdown = formatComplianceReportAsMarkdown(report);
+            expect(markdown).toContain("## Recommendations");
+        });
+        it("includes footer", () => {
+            const report = generateComplianceReport(mockFindings, "SOC2", "/test/path");
+            const markdown = formatComplianceReportAsMarkdown(report);
+            expect(markdown).toContain("Vaspera Hardening");
+        });
+        it("includes certification ID when provided", () => {
+            const report = generateComplianceReport(mockFindings, "SOC2", "/test/path", "cert-123");
+            const markdown = formatComplianceReportAsMarkdown(report);
+            expect(markdown).toContain("cert-123");
+        });
+    });
+    describe("formatMultiFrameworkReportAsMarkdown", () => {
+        it("generates markdown for multiple frameworks", () => {
+            const report = generateMultiFrameworkReport(mockFindings, ["SOC2", "ISO27001"], "/test/path");
+            const markdown = formatMultiFrameworkReportAsMarkdown(report);
+            expect(markdown).toContain("# Multi-Framework Compliance Report");
+            expect(markdown).toContain("## Framework Summary");
+            expect(markdown).toContain("SOC2");
+            expect(markdown).toContain("ISO27001");
+        });
+        it("includes framework summary table", () => {
+            const report = generateMultiFrameworkReport(mockFindings, ["SOC2", "ISO27001"], "/test/path");
+            const markdown = formatMultiFrameworkReportAsMarkdown(report);
+            expect(markdown).toContain("| Framework | Compliance | Risk |");
+        });
+        it("includes prioritized recommendations", () => {
+            const report = generateMultiFrameworkReport(mockFindings, ["SOC2", "ISO27001"], "/test/path");
+            const markdown = formatMultiFrameworkReportAsMarkdown(report);
+            expect(markdown).toContain("## Prioritized Recommendations");
+        });
+    });
+    describe("formatComplianceReportAsJson", () => {
+        it("returns valid JSON", () => {
+            const report = generateComplianceReport(mockFindings, "SOC2", "/test/path");
+            const json = formatComplianceReportAsJson(report);
+            expect(() => JSON.parse(json)).not.toThrow();
+        });
+        it("contains all report fields", () => {
+            const report = generateComplianceReport(mockFindings, "SOC2", "/test/path");
+            const json = formatComplianceReportAsJson(report);
+            const parsed = JSON.parse(json);
+            expect(parsed.id).toBeDefined();
+            expect(parsed.framework).toBe("SOC2");
+            expect(parsed.status).toBeDefined();
+            expect(parsed.controls).toBeDefined();
+            expect(parsed.recommendations).toBeDefined();
+        });
+    });
+    describe("generateCompactComplianceSummary", () => {
+        it("generates single-line summary", () => {
+            const report = generateComplianceReport(mockFindings, "SOC2", "/test/path");
+            const summary = generateCompactComplianceSummary(report);
+            expect(summary).toContain("SOC2 Compliance:");
+            expect(summary).toContain("Score:");
+            expect(summary).toContain("Risk:");
+        });
+        it("shows correct status based on score", () => {
+            // With critical findings, should not be compliant
+            const report = generateComplianceReport(mockFindings, "SOC2", "/test/path");
+            const summary = generateCompactComplianceSummary(report);
+            // Score should be less than 100 due to findings
+            expect(summary).not.toContain("100%");
+        });
+        it("shows COMPLIANT for perfect score", () => {
+            const report = generateComplianceReport([], "SOC2", "/test/path");
+            const summary = generateCompactComplianceSummary(report);
+            expect(summary).toContain("COMPLIANT");
+        });
+    });
+});
+//# sourceMappingURL=report.test.js.map

package/dist/compliance/report.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.test.js","sourceRoot":"","sources":["../../src/compliance/report.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,gCAAgC,EAChC,oCAAoC,EACpC,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAGrF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,MAAM,YAAY,GAAc;QAC9B;YACE,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,eAAe;YACzB,WAAW,EAAE,2CAA2C;YACxD,QAAQ,EAAE,eAAe;YACzB,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,EAAE;YACR,aAAa,EAAE,EAAE;YACjB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC;QACD;YACE,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,oCAAoC;YACjD,QAAQ,EAAE,eAAe;YACzB,UAAU,EAAE,EAAE;YACd,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,EAAE;YACR,aAAa,EAAE,EAAE;YACjB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC;KACF,CAAC;IAEF,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,MAAM,GAAG,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAC5E,MAAM,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;YAE1D,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACvD,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,MAAM,GAAG,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAC5E,MAAM,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;YAE1D,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;YACnD,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAC7C,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,MAAM,GAAG,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAC5E,MAAM,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;YAE1D,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,MAAM,GAAG,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAC5E,MAAM,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;YAE1D,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;YACzB,MAAM,MAAM,GAAG,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAC5E,MAAM,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;YAE1D,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,MAAM,GAAG,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YACxF,MAAM,QAAQ,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;YAE1D,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;QACpD,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,MAAM,GAAG,4BAA4B,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;YAC9F,MAAM,QAAQ,GAAG,oCAAoC,CAAC,MAAM,CAAC,CAAC;YAE9D,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;YAClE,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;YACnD,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,MAAM,GAAG,4BAA4B,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;YAC9F,MAAM,QAAQ,GAAG,oCAAoC,CAAC,MAAM,CAAC,CAAC;YAE9D,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,MAAM,GAAG,4BAA4B,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;YAC9F,MAAM,QAAQ,GAAG,oCAAoC,CAAC,MAAM,CAAC,CAAC;YAE9D,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;QAC5C,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAC5B,MAAM,MAAM,GAAG,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;YAElD,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,MAAM,GAAG,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAEhC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAChD,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;YAEzD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,kDAAkD;YAClD,MAAM,MAAM,GAAG,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;YAEzD,gDAAgD;YAChD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,MAAM,GAAG,wBAAwB,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC;YAEzD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/compliance/soc2.d.ts

@@ -0,0 +1,30 @@
+/**
+ * SOC 2 Trust Services Criteria Controls
+ *
+ * SOC 2 Common Criteria (CC) controls mapped to security finding categories.
+ * Based on AICPA Trust Services Criteria 2017.
+ *
+ * @module compliance/soc2
+ */
+import type { ComplianceControl } from "./types.js";
+/**
+ * SOC 2 Common Criteria Controls relevant to code security
+ */
+export declare const SOC2_CONTROLS: ComplianceControl[];
+/**
+ * Get all SOC 2 controls
+ */
+export declare function getSOC2Controls(): ComplianceControl[];
+/**
+ * Get SOC 2 controls by category
+ */
+export declare function getSOC2ControlsByCategory(category: string): ComplianceControl[];
+/**
+ * Get SOC 2 control by ID
+ */
+export declare function getSOC2ControlById(id: string): ComplianceControl | undefined;
+/**
+ * Get SOC 2 categories
+ */
+export declare function getSOC2Categories(): string[];
+//# sourceMappingURL=soc2.d.ts.map

package/dist/compliance/soc2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"soc2.d.ts","sourceRoot":"","sources":["../../src/compliance/soc2.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,iBAAiB,EA2P5C,CAAC;AAEF;;GAEG;AACH,wBAAgB,eAAe,IAAI,iBAAiB,EAAE,CAErD;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAE/E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAE5E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAE5C"}

package/dist/compliance/soc2.js

@@ -0,0 +1,262 @@
+/**
+ * SOC 2 Trust Services Criteria Controls
+ *
+ * SOC 2 Common Criteria (CC) controls mapped to security finding categories.
+ * Based on AICPA Trust Services Criteria 2017.
+ *
+ * @module compliance/soc2
+ */
+/**
+ * SOC 2 Common Criteria Controls relevant to code security
+ */
+export const SOC2_CONTROLS = [
+    // CC6: Logical and Physical Access Controls
+    {
+        id: "CC6.1",
+        framework: "SOC2",
+        category: "Logical and Physical Access",
+        title: "Logical Access Security Software",
+        description: "The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events.",
+        keywords: ["authentication", "authorization", "access control", "login", "session"],
+        findingCategories: ["auth-bypass", "broken-access-control", "session-management"],
+        cweIds: ["CWE-287", "CWE-862", "CWE-863", "CWE-384"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "CC6.2",
+        framework: "SOC2",
+        category: "Logical and Physical Access",
+        title: "User Authentication",
+        description: "Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users.",
+        keywords: ["registration", "credential", "password", "user management"],
+        findingCategories: ["auth-bypass", "weak-password"],
+        cweIds: ["CWE-521", "CWE-620", "CWE-640"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "CC6.3",
+        framework: "SOC2",
+        category: "Logical and Physical Access",
+        title: "Access Removal",
+        description: "The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes.",
+        keywords: ["deprovisioning", "access removal", "role-based access"],
+        findingCategories: ["broken-access-control", "auth-bypass"],
+        cweIds: ["CWE-269", "CWE-266"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "CC6.6",
+        framework: "SOC2",
+        category: "Logical and Physical Access",
+        title: "Security Boundaries",
+        description: "The entity implements logical access security measures to protect against threats from sources outside its system boundaries.",
+        keywords: ["firewall", "network security", "boundary", "external threat"],
+        findingCategories: ["ssrf", "path-traversal", "command-injection"],
+        cweIds: ["CWE-918", "CWE-22", "CWE-78"],
+        severityThreshold: "high",
+    },
+    {
+        id: "CC6.7",
+        framework: "SOC2",
+        category: "Logical and Physical Access",
+        title: "Transmission Protection",
+        description: "The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes.",
+        keywords: ["encryption", "TLS", "data transmission", "data leakage"],
+        findingCategories: ["insecure-transmission", "data-exposure"],
+        cweIds: ["CWE-319", "CWE-523"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "CC6.8",
+        framework: "SOC2",
+        category: "Logical and Physical Access",
+        title: "Malicious Software Prevention",
+        description: "The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software.",
+        keywords: ["malware", "injection", "code execution", "xss"],
+        findingCategories: ["xss", "sql-injection", "command-injection", "code-injection"],
+        cweIds: ["CWE-79", "CWE-89", "CWE-78", "CWE-94"],
+        severityThreshold: "high",
+    },
+    // CC7: System Operations
+    {
+        id: "CC7.1",
+        framework: "SOC2",
+        category: "System Operations",
+        title: "Security Event Detection",
+        description: "To meet its objectives, the entity uses detection and monitoring procedures to identify anomalies that could represent security events.",
+        keywords: ["logging", "monitoring", "detection", "audit trail"],
+        findingCategories: ["insufficient-logging", "security-misconfiguration"],
+        cweIds: ["CWE-778", "CWE-223"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "CC7.2",
+        framework: "SOC2",
+        category: "System Operations",
+        title: "Security Incident Response",
+        description: "The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts.",
+        keywords: ["incident response", "anomaly detection", "security monitoring"],
+        findingCategories: ["insufficient-logging"],
+        cweIds: ["CWE-778"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "CC7.3",
+        framework: "SOC2",
+        category: "System Operations",
+        title: "Security Event Analysis",
+        description: "The entity evaluates security events to determine whether they could or have resulted in a failure to meet objectives.",
+        keywords: ["event analysis", "security assessment", "threat analysis"],
+        findingCategories: ["security-misconfiguration"],
+        severityThreshold: "low",
+    },
+    {
+        id: "CC7.4",
+        framework: "SOC2",
+        category: "System Operations",
+        title: "Security Event Response",
+        description: "The entity responds to identified security incidents by executing a defined incident response program.",
+        keywords: ["incident response", "remediation", "recovery"],
+        findingCategories: [],
+        severityThreshold: "medium",
+    },
+    // CC8: Change Management
+    {
+        id: "CC8.1",
+        framework: "SOC2",
+        category: "Change Management",
+        title: "Change Authorization",
+        description: "The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures.",
+        keywords: ["change management", "code review", "testing", "deployment"],
+        findingCategories: ["security-misconfiguration", "type-safety"],
+        cweIds: ["CWE-1188"],
+        severityThreshold: "medium",
+    },
+    // CC9: Risk Mitigation
+    {
+        id: "CC9.1",
+        framework: "SOC2",
+        category: "Risk Mitigation",
+        title: "Risk Identification and Assessment",
+        description: "The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.",
+        keywords: ["risk assessment", "vulnerability", "threat modeling"],
+        findingCategories: ["dependency-vuln"],
+        cweIds: ["CWE-1035"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "CC9.2",
+        framework: "SOC2",
+        category: "Risk Mitigation",
+        title: "Vendor Risk Management",
+        description: "The entity assesses and manages risks associated with vendors and business partners.",
+        keywords: ["vendor", "third-party", "supply chain", "dependency"],
+        findingCategories: ["dependency-vuln"],
+        cweIds: ["CWE-1035", "CWE-829"],
+        severityThreshold: "medium",
+    },
+    // Confidentiality Controls (C Series)
+    {
+        id: "C1.1",
+        framework: "SOC2",
+        category: "Confidentiality",
+        title: "Confidential Information Identification",
+        description: "The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality.",
+        keywords: ["confidential", "sensitive data", "PII", "secrets"],
+        findingCategories: ["secrets", "data-exposure"],
+        cweIds: ["CWE-200", "CWE-359"],
+        severityThreshold: "high",
+    },
+    {
+        id: "C1.2",
+        framework: "SOC2",
+        category: "Confidentiality",
+        title: "Confidential Information Disposal",
+        description: "The entity disposes of confidential information to meet the entity's objectives related to confidentiality.",
+        keywords: ["data disposal", "secure delete", "data retention"],
+        findingCategories: ["data-exposure"],
+        cweIds: ["CWE-226", "CWE-212"],
+        severityThreshold: "medium",
+    },
+    // Availability Controls (A Series)
+    {
+        id: "A1.1",
+        framework: "SOC2",
+        category: "Availability",
+        title: "Capacity Management",
+        description: "The entity maintains, monitors, and evaluates current processing capacity and use of system components.",
+        keywords: ["capacity", "performance", "resource exhaustion", "DoS"],
+        findingCategories: ["resource-exhaustion", "denial-of-service"],
+        cweIds: ["CWE-400", "CWE-770"],
+        severityThreshold: "medium",
+    },
+    {
+        id: "A1.2",
+        framework: "SOC2",
+        category: "Availability",
+        title: "Recovery Planning",
+        description: "The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure.",
+        keywords: ["backup", "disaster recovery", "business continuity"],
+        findingCategories: [],
+        severityThreshold: "medium",
+    },
+    // Processing Integrity (PI Series)
+    {
+        id: "PI1.1",
+        framework: "SOC2",
+        category: "Processing Integrity",
+        title: "Processing Accuracy",
+        description: "The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.",
+        keywords: ["data validation", "input validation", "data integrity"],
+        findingCategories: ["sql-injection", "xss", "insecure-deserialization"],
+        cweIds: ["CWE-20", "CWE-89", "CWE-79", "CWE-502"],
+        severityThreshold: "high",
+    },
+    {
+        id: "PI1.2",
+        framework: "SOC2",
+        category: "Processing Integrity",
+        title: "System Input Controls",
+        description: "The entity implements policies and procedures over system inputs that result in products, services, and reporting to meet the entity's objectives.",
+        keywords: ["input validation", "sanitization", "encoding"],
+        findingCategories: ["sql-injection", "xss", "command-injection", "path-traversal"],
+        cweIds: ["CWE-20", "CWE-89", "CWE-79", "CWE-78", "CWE-22"],
+        severityThreshold: "high",
+    },
+    {
+        id: "PI1.3",
+        framework: "SOC2",
+        category: "Processing Integrity",
+        title: "System Processing Controls",
+        description: "The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.",
+        keywords: ["data processing", "transaction integrity", "error handling"],
+        findingCategories: ["type-safety", "error-handling"],
+        cweIds: ["CWE-754", "CWE-755"],
+        severityThreshold: "medium",
+    },
+];
+/**
+ * Get all SOC 2 controls
+ */
+export function getSOC2Controls() {
+    return SOC2_CONTROLS;
+}
+/**
+ * Get SOC 2 controls by category
+ */
+export function getSOC2ControlsByCategory(category) {
+    return SOC2_CONTROLS.filter((c) => c.category === category);
+}
+/**
+ * Get SOC 2 control by ID
+ */
+export function getSOC2ControlById(id) {
+    return SOC2_CONTROLS.find((c) => c.id === id);
+}
+/**
+ * Get SOC 2 categories
+ */
+export function getSOC2Categories() {
+    return [...new Set(SOC2_CONTROLS.map((c) => c.category))];
+}
+//# sourceMappingURL=soc2.js.map

package/dist/compliance/soc2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"soc2.js","sourceRoot":"","sources":["../../src/compliance/soc2.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB;IAChD,4CAA4C;IAC5C;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,6BAA6B;QACvC,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,mKAAmK;QACrK,QAAQ,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC;QACnF,iBAAiB,EAAE,CAAC,aAAa,EAAE,uBAAuB,EAAE,oBAAoB,CAAC;QACjF,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;QACpD,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,6BAA6B;QACvC,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,sIAAsI;QACxI,QAAQ,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,CAAC;QACvE,iBAAiB,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;QACnD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;QACzC,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,6BAA6B;QACvC,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,6LAA6L;QAC/L,QAAQ,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB,CAAC;QACnE,iBAAiB,EAAE,CAAC,uBAAuB,EAAE,aAAa,CAAC;QAC3D,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,6BAA6B;QACvC,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,+HAA+H;QACjI,QAAQ,EAAE,CAAC,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,iBAAiB,CAAC;QACzE,iBAAiB,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,CAAC;QAClE,MAAM,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACvC,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,6BAA6B;QACvC,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,sIAAsI;QACxI,QAAQ,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,mBAAmB,EAAE,cAAc,CAAC;QACpE,iBAAiB,EAAE,CAAC,uBAAuB,EAAE,eAAe,CAAC;QAC7D,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,6BAA6B;QACvC,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,0HAA0H;QAC5H,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC;QAC3D,iBAAiB,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QAClF,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChD,iBAAiB,EAAE,MAAM;KAC1B;IAED,yBAAyB;IACzB;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,yIAAyI;QAC3I,QAAQ,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,CAAC;QAC/D,iBAAiB,EAAE,CAAC,sBAAsB,EAAE,2BAA2B,CAAC;QACxE,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,kIAAkI;QACpI,QAAQ,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,qBAAqB,CAAC;QAC3E,iBAAiB,EAAE,CAAC,sBAAsB,CAAC;QAC3C,MAAM,EAAE,CAAC,SAAS,CAAC;QACnB,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,wHAAwH;QAC1H,QAAQ,EAAE,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,iBAAiB,CAAC;QACtE,iBAAiB,EAAE,CAAC,2BAA2B,CAAC;QAChD,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,wGAAwG;QAC1G,QAAQ,EAAE,CAAC,mBAAmB,EAAE,aAAa,EAAE,UAAU,CAAC;QAC1D,iBAAiB,EAAE,EAAE;QACrB,iBAAiB,EAAE,QAAQ;KAC5B;IAED,yBAAyB;IACzB;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,yKAAyK;QAC3K,QAAQ,EAAE,CAAC,mBAAmB,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,CAAC;QACvE,iBAAiB,EAAE,CAAC,2BAA2B,EAAE,aAAa,CAAC;QAC/D,MAAM,EAAE,CAAC,UAAU,CAAC;QACpB,iBAAiB,EAAE,QAAQ;KAC5B;IAED,uBAAuB;IACvB;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,iBAAiB;QAC3B,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,gIAAgI;QAClI,QAAQ,EAAE,CAAC,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,CAAC;QACjE,iBAAiB,EAAE,CAAC,iBAAiB,CAAC;QACtC,MAAM,EAAE,CAAC,UAAU,CAAC;QACpB,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,iBAAiB;QAC3B,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,sFAAsF;QACxF,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,CAAC;QACjE,iBAAiB,EAAE,CAAC,iBAAiB,CAAC;QACtC,MAAM,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC;QAC/B,iBAAiB,EAAE,QAAQ;KAC5B;IAED,sCAAsC;IACtC;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,iBAAiB;QAC3B,KAAK,EAAE,yCAAyC;QAChD,WAAW,EACT,0HAA0H;QAC5H,QAAQ,EAAE,CAAC,cAAc,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,CAAC;QAC9D,iBAAiB,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,iBAAiB;QAC3B,KAAK,EAAE,mCAAmC;QAC1C,WAAW,EACT,6GAA6G;QAC/G,QAAQ,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,gBAAgB,CAAC;QAC9D,iBAAiB,EAAE,CAAC,eAAe,CAAC;QACpC,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,QAAQ;KAC5B;IAED,mCAAmC;IACnC;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,yGAAyG;QAC3G,QAAQ,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,KAAK,CAAC;QACnE,iBAAiB,EAAE,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;QAC/D,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,QAAQ;KAC5B;IACD;QACE,EAAE,EAAE,MAAM;QACV,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,cAAc;QACxB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,wMAAwM;QAC1M,QAAQ,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,qBAAqB,CAAC;QAChE,iBAAiB,EAAE,EAAE;QACrB,iBAAiB,EAAE,QAAQ;KAC5B;IAED,mCAAmC;IACnC;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,sBAAsB;QAChC,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,sJAAsJ;QACxJ,QAAQ,EAAE,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;QACnE,iBAAiB,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,0BAA0B,CAAC;QACvE,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC;QACjD,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,sBAAsB;QAChC,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,oJAAoJ;QACtJ,QAAQ,EAAE,CAAC,kBAAkB,EAAE,cAAc,EAAE,UAAU,CAAC;QAC1D,iBAAiB,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QAClF,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAC1D,iBAAiB,EAAE,MAAM;KAC1B;IACD;QACE,EAAE,EAAE,OAAO;QACX,SAAS,EAAE,MAAM;QACjB,QAAQ,EAAE,sBAAsB;QAChC,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,sJAAsJ;QACxJ,QAAQ,EAAE,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,gBAAgB,CAAC;QACxE,iBAAiB,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC;QACpD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,iBAAiB,EAAE,QAAQ;KAC5B;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/compliance/soc2.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Tests for SOC 2 controls
+ */
+export {};
+//# sourceMappingURL=soc2.test.d.ts.map

package/dist/compliance/soc2.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"soc2.test.d.ts","sourceRoot":"","sources":["../../src/compliance/soc2.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/compliance/soc2.test.js

@@ -0,0 +1,86 @@
+/**
+ * Tests for SOC 2 controls
+ */
+import { describe, it, expect } from "vitest";
+import { SOC2_CONTROLS, getSOC2Controls, getSOC2ControlsByCategory, getSOC2ControlById, getSOC2Categories, } from "./soc2.js";
+describe("SOC 2 controls", () => {
+    describe("SOC2_CONTROLS", () => {
+        it("has controls defined", () => {
+            expect(SOC2_CONTROLS.length).toBeGreaterThan(0);
+        });
+        it("all controls have required fields", () => {
+            for (const control of SOC2_CONTROLS) {
+                expect(control.id).toBeDefined();
+                expect(control.framework).toBe("SOC2");
+                expect(control.category).toBeDefined();
+                expect(control.title).toBeDefined();
+                expect(control.description).toBeDefined();
+                expect(control.keywords).toBeInstanceOf(Array);
+                expect(control.findingCategories).toBeInstanceOf(Array);
+            }
+        });
+        it("has unique control IDs", () => {
+            const ids = SOC2_CONTROLS.map((c) => c.id);
+            const uniqueIds = new Set(ids);
+            expect(uniqueIds.size).toBe(ids.length);
+        });
+        it("includes Common Criteria controls (CC)", () => {
+            const ccControls = SOC2_CONTROLS.filter((c) => c.id.startsWith("CC"));
+            expect(ccControls.length).toBeGreaterThan(0);
+        });
+        it("includes Confidentiality controls (C)", () => {
+            const cControls = SOC2_CONTROLS.filter((c) => c.id.startsWith("C1"));
+            expect(cControls.length).toBeGreaterThan(0);
+        });
+        it("includes Availability controls (A)", () => {
+            const aControls = SOC2_CONTROLS.filter((c) => c.id.startsWith("A1"));
+            expect(aControls.length).toBeGreaterThan(0);
+        });
+        it("includes Processing Integrity controls (PI)", () => {
+            const piControls = SOC2_CONTROLS.filter((c) => c.id.startsWith("PI"));
+            expect(piControls.length).toBeGreaterThan(0);
+        });
+    });
+    describe("getSOC2Controls", () => {
+        it("returns all controls", () => {
+            const controls = getSOC2Controls();
+            expect(controls).toEqual(SOC2_CONTROLS);
+        });
+    });
+    describe("getSOC2ControlsByCategory", () => {
+        it("returns controls for valid category", () => {
+            const controls = getSOC2ControlsByCategory("Logical and Physical Access");
+            expect(controls.length).toBeGreaterThan(0);
+            expect(controls.every((c) => c.category === "Logical and Physical Access")).toBe(true);
+        });
+        it("returns empty array for invalid category", () => {
+            const controls = getSOC2ControlsByCategory("Invalid Category");
+            expect(controls).toEqual([]);
+        });
+    });
+    describe("getSOC2ControlById", () => {
+        it("returns control for valid ID", () => {
+            const control = getSOC2ControlById("CC6.1");
+            expect(control).toBeDefined();
+            expect(control.id).toBe("CC6.1");
+        });
+        it("returns undefined for invalid ID", () => {
+            const control = getSOC2ControlById("INVALID");
+            expect(control).toBeUndefined();
+        });
+    });
+    describe("getSOC2Categories", () => {
+        it("returns unique categories", () => {
+            const categories = getSOC2Categories();
+            expect(categories.length).toBeGreaterThan(0);
+            const uniqueCategories = new Set(categories);
+            expect(uniqueCategories.size).toBe(categories.length);
+        });
+        it("includes expected categories", () => {
+            const categories = getSOC2Categories();
+            expect(categories).toContain("Logical and Physical Access");
+            expect(categories).toContain("System Operations");
+        });
+    });
+});
+//# sourceMappingURL=soc2.test.js.map

package/dist/compliance/soc2.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"soc2.test.js","sourceRoot":"","sources":["../../src/compliance/soc2.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,eAAe,EACf,yBAAyB,EACzB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AAEnB,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;gBACpC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACjC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;gBACvC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC1C,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBAC/C,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAChC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACtE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACtE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;YACnC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,6BAA6B,CAAC,CAAC;YAC1E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,kBAAkB,CAAC,CAAC;YAC/D,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9B,MAAM,CAAC,OAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;YACvC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAE7C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7C,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;YACvC,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;YAC5D,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}