@avi770/testteam 2.0.0 → 3.2.0

package/dist/core/compliance/auditor.js

@@ -0,0 +1,577 @@
+/**
+ * ComplianceAuditor (#18 — "The Inspector") — implementation.
+ *
+ * Continuous/composite operational layer that REUSES engine-agent output (agents
+ * #65/#66/#67/#84) as control evidence. It never re-scans and never changes the
+ * system (read-only, assess+evidence+flag only).
+ *
+ * Key design decisions (all 16 improvements):
+ *  #1  — event-driven; maps controls to existing findings, no re-scan.
+ *  #2  — every control links to live evidence + last-verified stamp.
+ *  #4  — continuous monitoring: re-evaluates on each `evaluate()` call.
+ *  #7  — tamper-evident vault: SHA-256 hash chain; detects any post-hoc change.
+ *  #8  — audit-ready export per framework.
+ *  #9  — gap analysis + remediation hints.
+ *  #10 — drift alerts fire ONLY on passing→failing TRANSITIONS (prior-state compare).
+ *  #16 — honesty guardrail: never "compliant" without positive proof; never rounds up;
+ *         "not legal advice" disclaimer on every evidence pack.
+ *
+ * DISCLAIMER: Produces engineering compliance evidence. NOT legal advice.
+ */
+import * as crypto from 'node:crypto';
+/**
+ * The real engine agents this auditor composes as control evidence. These ids are
+ * registered engine agents (bridge/agent-registry); an integration test asserts they
+ * still exist, so an engine renumber breaks the build. The auditor ingests their
+ * Finding[] output by agentId (ComplianceControl.provedByAgentIds) — it never re-scans.
+ */
+export const COMPOSED_ENGINE_AGENTS = {
+    gdprComplianceTester: 65,
+    soc2ControlValidator: 66,
+    wcagAuditor: 67,
+    governanceSecurity: 84,
+};
+// ---------------------------------------------------------------------------
+// Internal safety + canonicalisation helpers
+// ---------------------------------------------------------------------------
+/** Cap on the input length matched by a control regex — bounds backtracking time. */
+const MAX_MATCH_INPUT = 4096;
+/**
+ * Conservative ReDoS heuristic: flag a VALID pattern prone to catastrophic backtracking —
+ * a quantified group whose body itself contains an unbounded quantifier, e.g. (a+)+, (a*)*,
+ * (\d+)*. Control patterns are operator-supplied, so this is defense-in-depth; a flagged
+ * pattern fails closed (treated as a compile error → no-evidence).
+ */
+function isCatastrophicRegex(pattern) {
+    return /\([^()]*[+*][^()]*\)\s*[+*{]/.test(pattern);
+}
+/** Deterministic key-sorted JSON — hash stability must not depend on key insertion order. */
+function stableStringify(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return '[' + value.map(stableStringify).join(',') + ']';
+    const record = value;
+    return ('{' +
+        Object.keys(record)
+            .sort()
+            .map((k) => JSON.stringify(k) + ':' + stableStringify(record[k]))
+            .join(',') +
+        '}');
+}
+/**
+ * Attempt to compile both regex patterns for a control.
+ * Returns the compiled control OR a typed error — never throws.
+ */
+function compileControl(control) {
+    let breachRegex;
+    try {
+        breachRegex = new RegExp(control.breachedByFindingPattern, 'i');
+    }
+    catch (err) {
+        return {
+            kind: 'pattern-compile-error',
+            controlId: control.id,
+            field: 'breachedByFindingPattern',
+            rawPattern: control.breachedByFindingPattern,
+            message: err instanceof Error ? err.message : String(err),
+        };
+    }
+    let proofRegex;
+    try {
+        proofRegex = new RegExp(control.provedByFindingPattern, 'i');
+    }
+    catch (err) {
+        return {
+            kind: 'pattern-compile-error',
+            controlId: control.id,
+            field: 'provedByFindingPattern',
+            rawPattern: control.provedByFindingPattern,
+            message: err instanceof Error ? err.message : String(err),
+        };
+    }
+    // Defense-in-depth: reject valid-but-catastrophic patterns (ReDoS) — fail closed.
+    for (const [field, pattern] of [
+        ['breachedByFindingPattern', control.breachedByFindingPattern],
+        ['provedByFindingPattern', control.provedByFindingPattern],
+    ]) {
+        if (isCatastrophicRegex(pattern)) {
+            return {
+                kind: 'pattern-compile-error',
+                controlId: control.id,
+                field,
+                rawPattern: pattern,
+                message: 'pattern rejected: prone to catastrophic backtracking (ReDoS)',
+            };
+        }
+    }
+    return { control, breachRegex, proofRegex };
+}
+// ---------------------------------------------------------------------------
+// Built-in control catalogue
+// Multi-framework mapping (improvement #6): one control entry covers many
+// frameworks where the same requirement applies.
+// ---------------------------------------------------------------------------
+/** The default control catalogue shipped with the module. */
+export const DEFAULT_CONTROLS = [
+    // ── GDPR / Privacy ──────────────────────────────────────────────────────
+    {
+        id: 'GDPR-CONSENT',
+        title: 'Cookie & tracking consent obtained before processing',
+        frameworks: ['GDPR'],
+        provedByAgentIds: [65],
+        provedByFindingPattern: 'consent|cookie-consent|gdpr-ok',
+        breachedByFindingPattern: 'no-cookie-consent|no-consent-button',
+    },
+    {
+        id: 'GDPR-PRIVACY-POLICY',
+        title: 'Privacy policy accessible to users',
+        frameworks: ['GDPR'],
+        provedByAgentIds: [65],
+        provedByFindingPattern: 'privacy-policy|privacy-link',
+        breachedByFindingPattern: 'no-privacy-policy',
+    },
+    {
+        id: 'GDPR-RIGHT-TO-ERASURE',
+        title: 'Right to erasure (delete account) accessible in-product',
+        frameworks: ['GDPR', 'HIPAA'],
+        provedByAgentIds: [65],
+        provedByFindingPattern: 'delete-account|erasure|right-to-erasure',
+        breachedByFindingPattern: 'no-delete-account',
+    },
+    // ── SOC 2 ────────────────────────────────────────────────────────────────
+    // Each control has a CONTROL-SPECIFIC proof pattern (no shared catch-all token like
+    // 'soc2-ok'): a single finding can prove only the one control it actually evidences,
+    // never flip multiple controls to 'passing' at once (evidence-forgery guard).
+    {
+        id: 'SOC2-CC6.2-MFA',
+        title: 'Multi-factor authentication available for user accounts',
+        frameworks: ['SOC2', 'ISO27001'],
+        provedByAgentIds: [66],
+        provedByFindingPattern: 'mfa|multi-factor',
+        breachedByFindingPattern: 'no-mfa',
+    },
+    {
+        id: 'SOC2-CC6.1-AUDIT-LOG',
+        title: 'Audit logging in place for security-relevant events',
+        frameworks: ['SOC2', 'ISO27001', 'PCI-DSS', 'HIPAA'],
+        provedByAgentIds: [66],
+        provedByFindingPattern: 'audit-log|audit-logging',
+        breachedByFindingPattern: 'no-audit-logging',
+    },
+    {
+        id: 'SOC2-CC6.6-SESSION',
+        title: 'Session timeout configured to limit exposure from inactive sessions',
+        frameworks: ['SOC2', 'ISO27001'],
+        provedByAgentIds: [66],
+        provedByFindingPattern: 'session-timeout|session-ok',
+        breachedByFindingPattern: 'no-session-timeout',
+    },
+    {
+        id: 'SOC2-CC6.3-RBAC',
+        title: 'Role-based access control enforced on protected resources',
+        frameworks: ['SOC2', 'ISO27001', 'PCI-DSS'],
+        provedByAgentIds: [66],
+        provedByFindingPattern: 'rbac|role-based|access-control',
+        breachedByFindingPattern: 'no-rbac',
+    },
+    // ── WCAG / Accessibility ────────────────────────────────────────────────
+    {
+        id: 'WCAG-AAA-CONTRAST',
+        title: 'Text contrast ratio meets WCAG AAA (≥7:1)',
+        frameworks: ['WCAG-AAA'],
+        provedByAgentIds: [67],
+        provedByFindingPattern: 'contrast-ok|contrast-pass',
+        breachedByFindingPattern: 'low-contrast',
+    },
+    {
+        id: 'WCAG-AAA-KEYBOARD',
+        title: 'All interactive elements reachable and operable by keyboard',
+        frameworks: ['WCAG-AAA'],
+        provedByAgentIds: [67],
+        provedByFindingPattern: 'keyboard-ok|focusable|focus-ok',
+        breachedByFindingPattern: 'no-focusable|no-focus-indicator',
+    },
+    // ── Governance / Security ────────────────────────────────────────────────
+    {
+        id: 'GOV-SEC-SECRETS',
+        title: 'No hard-coded secrets detected in source code',
+        frameworks: ['SOC2', 'ISO27001', 'PCI-DSS'],
+        provedByAgentIds: [84],
+        provedByFindingPattern: 'secrets-clean|no-secrets',
+        breachedByFindingPattern: 'SEC-001',
+    },
+    {
+        id: 'GOV-SEC-SAST',
+        title: 'No high-severity SAST patterns (eval, innerHTML, dynamic functions) present',
+        frameworks: ['SOC2', 'ISO27001'],
+        provedByAgentIds: [84],
+        provedByFindingPattern: 'sast-clean|no-sast',
+        breachedByFindingPattern: 'SEC-002',
+    },
+    {
+        id: 'GOV-STD-TYPESCRIPT-STRICT',
+        title: 'TypeScript strict mode enabled (prevents a class of runtime errors)',
+        frameworks: ['SOC2'],
+        provedByAgentIds: [84],
+        provedByFindingPattern: 'typescript-strict|ts-strict',
+        breachedByFindingPattern: 'STD-005',
+    },
+    {
+        id: 'GOV-CMP-DATA-RETENTION',
+        title: 'Data retention / cleanup logic present in codebase',
+        frameworks: ['GDPR', 'HIPAA'],
+        provedByAgentIds: [84],
+        provedByFindingPattern: 'data-retention|retention-ok',
+        breachedByFindingPattern: 'CMP-002',
+    },
+];
+// ---------------------------------------------------------------------------
+// Evidence vault (tamper-evident, improvement #7)
+// ---------------------------------------------------------------------------
+const NOT_LEGAL_ADVICE_DISCLAIMER = 'DISCLAIMER: This evidence pack is produced by automated tooling for engineering ' +
+    'teams. It is NOT legal advice. Always consult qualified legal counsel for your ' +
+    'actual regulatory obligations.';
+function hashEntry(seq, capturedAt, controlId, payload, prevHash) {
+    // Canonical array serialization (not a `|`-delimited string) so no field's content can be
+    // crafted to spoof the boundary between fields (delimiter-injection guard).
+    const data = stableStringify([seq, capturedAt, controlId, payload, prevHash]);
+    return crypto.createHash('sha256').update(data, 'utf8').digest('hex');
+}
+/** Append-only, hash-chained evidence vault. Tampering with any past entry
+ *  makes `verifyChain()` return false. */
+export class EvidenceVault {
+    entries = [];
+    clock;
+    constructor(options) {
+        this.clock = options?.clock ?? (() => new Date().toISOString());
+    }
+    /** Append a new entry and return the sealed record. */
+    append(controlId, payload) {
+        const seq = this.entries.length;
+        const capturedAt = this.clock();
+        const prevHash = seq === 0 ? 'GENESIS' : (this.entries[seq - 1]?.hash ?? 'GENESIS');
+        const hash = hashEntry(seq, capturedAt, controlId, payload, prevHash);
+        const entry = { seq, capturedAt, controlId, payload, hash };
+        this.entries.push(entry);
+        return entry;
+    }
+    get all() {
+        return this.entries.slice();
+    }
+    /**
+     * Verifies the entire hash chain is intact.
+     * Returns true when no entry has been modified since it was appended.
+     * Returns false if ANY entry's hash no longer matches (tampering detected).
+     */
+    verifyChain() {
+        for (let i = 0; i < this.entries.length; i++) {
+            const entry = this.entries[i];
+            if (!entry)
+                return false;
+            const prevHash = i === 0 ? 'GENESIS' : (this.entries[i - 1]?.hash ?? 'GENESIS');
+            const expected = hashEntry(entry.seq, entry.capturedAt, entry.controlId, entry.payload, prevHash);
+            if (entry.hash !== expected)
+                return false;
+        }
+        return true;
+    }
+    /** Hash of the latest entry (transitively commits to the whole chain), or GENESIS if empty. */
+    get headHash() {
+        return this.entries.length === 0
+            ? 'GENESIS'
+            : (this.entries[this.entries.length - 1]?.hash ?? 'GENESIS');
+    }
+    /**
+     * Detect tampering INCLUDING tail-truncation/reordering by comparing against a previously
+     * captured anchor {length, headHash}. verifyChain() alone cannot detect deletion of the
+     * newest entries (a shorter chain still verifies); an external anchor can.
+     */
+    verifyAgainstAnchor(anchor) {
+        return (this.verifyChain() &&
+            this.entries.length === anchor.length &&
+            this.headHash === anchor.headHash);
+    }
+}
+/**
+ * Call `evaluate()` on every new batch of engine findings. The returned
+ * posture reflects the current moment. Drift alerts fire ONLY on
+ * passing→failing transitions (prior-state compare, improvement #10).
+ * History lives in the vault; caller persists it across invocations for a
+ * full audit trail.
+ *
+ * Controls with malformed regex patterns are surfaced as `patternErrors`
+ * and evaluated as `no-evidence` (fail-closed, never silently pass).
+ */
+export class ComplianceAuditor {
+    compiled;
+    vault;
+    clock;
+    /**
+     * Prior evaluation statuses — used for passing→failing drift detection.
+     * Keyed by controlId. Populated after the first `evaluate()` call.
+     */
+    lastEvaluations = new Map();
+    /** Pattern-compile errors discovered at construction time. */
+    patternErrors;
+    constructor(options) {
+        const controls = options?.controls ?? DEFAULT_CONTROLS;
+        this.clock = options?.clock ?? (() => new Date().toISOString());
+        this.vault = new EvidenceVault({ clock: this.clock });
+        // Compile all patterns once — never throw in the hot path.
+        const compiled = [];
+        const errors = [];
+        for (const control of controls) {
+            const result = compileControl(control);
+            compiled.push(result);
+            if ('kind' in result)
+                errors.push(result);
+        }
+        this.compiled = compiled;
+        this.patternErrors = errors;
+    }
+    // -------------------------------------------------------------------------
+    // Public API
+    // -------------------------------------------------------------------------
+    /**
+     * Ingest a fresh batch of engine-agent findings and return the current
+     * compliance posture. Event-driven: called whenever agent findings change
+     * (improvement #1/#4).
+     *
+     * Honesty rule (improvement #16): a control is NEVER reported "passing"
+     * unless at least one relevant finding from the correct engine agent is
+     * present AND it MATCHES provedByFindingPattern AND no breach pattern
+     * matches. Absence of positive proof = no-evidence.
+     *
+     * Drift alerts (improvement #10): fired ONLY when a control transitions
+     * from 'passing' to 'failing' — not on the first-ever breach evaluation.
+     */
+    evaluate(batch) {
+        const now = this.clock();
+        // Snapshot prior statuses for transition detection BEFORE overwriting.
+        const priorStatuses = this.lastEvaluations;
+        // --- Evaluate each control ---
+        const evaluations = [];
+        const driftAlerts = [];
+        for (const compiledOrError of this.compiled) {
+            // Malformed pattern → fail-closed: treat as no-evidence.
+            if ('kind' in compiledOrError) {
+                const err = compiledOrError;
+                evaluations.push({
+                    controlId: err.controlId,
+                    status: 'no-evidence',
+                    confidence: 0,
+                    linkedEvidence: [],
+                    lastVerifiedAt: now,
+                });
+                continue;
+            }
+            const { control, breachRegex, proofRegex } = compiledOrError;
+            const evaluation = this.evaluateControl(control, breachRegex, proofRegex, batch, now);
+            evaluations.push(evaluation);
+            // Drift detection (improvement #10): alert ONLY on passing→failing transition.
+            if (evaluation.status === 'failing' &&
+                evaluation.breachFinding !== undefined &&
+                priorStatuses.get(control.id) === 'passing') {
+                driftAlerts.push(buildDriftAlert(control, evaluation.breachFinding, now));
+            }
+        }
+        // --- Gap analysis (improvement #9) ---
+        const gaps = buildGaps(this.compiled
+            .filter((c) => !('kind' in c))
+            .map((c) => c.control), evaluations);
+        // --- Per-framework summary ---
+        const frameworkSummary = buildFrameworkSummary(this.compiled
+            .filter((c) => !('kind' in c))
+            .map((c) => c.control), evaluations);
+        // --- Update prior-state map for next call's drift comparison ---
+        this.lastEvaluations = new Map(evaluations.map((e) => [e.controlId, e.status]));
+        return {
+            evaluatedAt: now,
+            controlEvaluations: evaluations,
+            driftAlerts,
+            gaps,
+            frameworkSummary,
+        };
+    }
+    /**
+     * Generate an audit-ready evidence pack for a single target framework
+     * (improvement #8). Only controls relevant to that framework are included.
+     * Never reports a framework as fully compliant when gaps remain (improvement #16).
+     */
+    auditPack(framework, posture) {
+        const validControls = this.compiled
+            .filter((c) => !('kind' in c))
+            .map((c) => c.control);
+        const relevantControlIds = new Set(validControls
+            .filter((c) => c.frameworks.includes(framework))
+            .map((c) => c.id));
+        const controls = posture.controlEvaluations.filter((e) => relevantControlIds.has(e.controlId));
+        const gaps = posture.gaps.filter((g) => g.frameworks.includes(framework));
+        const relevantVaultEntries = this.vault.all.filter((e) => relevantControlIds.has(e.controlId));
+        const passing = controls.filter((c) => c.status === 'passing').length;
+        // Never round up (Avi's QA rule + improvement #16).
+        const passingPct = controls.length > 0
+            ? Math.floor((passing / controls.length) * 10000) / 100
+            : 0;
+        return {
+            framework,
+            generatedAt: this.clock(),
+            disclaimer: NOT_LEGAL_ADVICE_DISCLAIMER,
+            controls,
+            gaps,
+            vaultEntries: relevantVaultEntries,
+            passingPct,
+        };
+    }
+    // -------------------------------------------------------------------------
+    // Private helpers
+    // -------------------------------------------------------------------------
+    evaluateControl(control, breachRegex, proofRegex, batch, now) {
+        // Collect all findings from the control's provedByAgentIds only.
+        const agentFindings = [];
+        for (const agentId of control.provedByAgentIds) {
+            const findings = batch[agentId];
+            if (findings)
+                agentFindings.push(...findings);
+        }
+        // Check for breach first (takes precedence): any finding whose id OR
+        // description matches the breach pattern means the control is actively failing.
+        let breachFinding;
+        for (const finding of agentFindings) {
+            if (breachRegex.test(finding.id.slice(0, MAX_MATCH_INPUT)) ||
+                breachRegex.test(finding.description.slice(0, MAX_MATCH_INPUT))) {
+                breachFinding = finding;
+                break;
+            }
+        }
+        // Look for positive proof: a finding that MATCHES provedByFindingPattern.
+        // Must not be the breach finding. Absence of positive proof = no-evidence.
+        let proofFinding;
+        if (!breachFinding) {
+            for (const finding of agentFindings) {
+                if (proofRegex.test(finding.id.slice(0, MAX_MATCH_INPUT)) ||
+                    proofRegex.test(finding.description.slice(0, MAX_MATCH_INPUT))) {
+                    proofFinding = finding;
+                    break;
+                }
+            }
+        }
+        // Determine status — honesty guardrail (improvement #16):
+        // - failing:     breach finding present
+        // - passing:     no breach + positive proof finding matches provedByFindingPattern
+        // - no-evidence: no breach AND no positive proof (includes "non-matching" findings)
+        let status;
+        let confidence;
+        if (breachFinding) {
+            status = 'failing';
+            // 'confidence' = evidence completeness; a breach is direct, complete evidence of failure.
+            confidence = 1.0;
+        }
+        else if (proofFinding) {
+            // Coverage = fraction of provedByAgentIds that returned ≥1 finding. Never rounded up.
+            const agentsWithData = control.provedByAgentIds.filter((id) => (batch[id]?.length ?? 0) > 0).length;
+            confidence = Math.floor((agentsWithData / control.provedByAgentIds.length) * 100) / 100;
+            // FAIL-CLOSED: 'passing' requires proof AND full agent coverage. Proof from only SOME
+            // responsible agents is 'partial-evidence' — a gap, never counted as compliant.
+            status = agentsWithData === control.provedByAgentIds.length ? 'passing' : 'partial-evidence';
+        }
+        else {
+            // No positive proof (may have findings from right agents that don't match
+            // the proof pattern, or no findings at all).
+            status = 'no-evidence';
+            confidence = 0;
+        }
+        // Vault evidence for BOTH breach AND proof findings (improvement #4/#7).
+        // Passing controls must have their backing evidence in the vault so the
+        // audit pack is non-vacuous.
+        const linkedEvidence = [];
+        const evidenceFinding = breachFinding ?? proofFinding;
+        if (evidenceFinding) {
+            const entry = this.vault.append(control.id, evidenceFinding);
+            linkedEvidence.push(toLinkedEvidence(entry));
+        }
+        return {
+            controlId: control.id,
+            status,
+            confidence,
+            linkedEvidence,
+            ...(breachFinding !== undefined ? { breachFinding } : {}),
+            lastVerifiedAt: now,
+        };
+    }
+}
+// ---------------------------------------------------------------------------
+// Pure helpers (exported for testing)
+// ---------------------------------------------------------------------------
+export function buildDriftAlert(control, breachFinding, now) {
+    return {
+        controlId: control.id,
+        frameworks: control.frameworks,
+        triggeringFindingId: breachFinding.id,
+        triggeringAgentId: breachFinding.agentId,
+        detectedAt: now,
+        description: `Control ${control.id} ("${control.title}") breached by finding ` +
+            `"${breachFinding.id}" from agent #${breachFinding.agentId}: ` +
+            `${breachFinding.description}`,
+    };
+}
+export function buildGaps(controls, evaluations) {
+    const evalMap = new Map(evaluations.map((e) => [e.controlId, e]));
+    const gaps = [];
+    for (const control of controls) {
+        const evaluation = evalMap.get(control.id);
+        if (!evaluation)
+            continue;
+        if (evaluation.status === 'no-evidence' ||
+            evaluation.status === 'failing' ||
+            evaluation.status === 'partial-evidence') {
+            gaps.push({
+                controlId: control.id,
+                controlTitle: control.title,
+                frameworks: control.frameworks,
+                reason: evaluation.status,
+                remediationHint: evaluation.status === 'failing'
+                    ? `Fix the failing finding (${evaluation.breachFinding?.id ?? 'unknown'}) ` +
+                        `reported by agent #${evaluation.breachFinding?.agentId ?? '?'} to restore control.`
+                    : evaluation.status === 'partial-evidence'
+                        ? `Partial evidence: not all responsible agents ` +
+                            `(#${control.provedByAgentIds.join(', #')}) returned data. Run the missing agents ` +
+                            `to obtain full coverage before this control can pass.`
+                        : `Run the responsible engine agents ` +
+                            `(#${control.provedByAgentIds.join(', #')}) and resolve any findings. ` +
+                            `Ensure a finding matching provedByFindingPattern ("${control.provedByFindingPattern}") ` +
+                            `is produced to demonstrate compliance.`,
+            });
+        }
+    }
+    return gaps;
+}
+export function buildFrameworkSummary(controls, evaluations) {
+    const evalMap = new Map(evaluations.map((e) => [e.controlId, e]));
+    // Collect distinct frameworks across all controls.
+    const allFrameworks = new Set();
+    for (const c of controls) {
+        for (const f of c.frameworks)
+            allFrameworks.add(f);
+    }
+    const result = {};
+    for (const framework of allFrameworks) {
+        const frameworkControls = controls.filter((c) => c.frameworks.includes(framework));
+        const passing = frameworkControls.filter((c) => evalMap.get(c.id)?.status === 'passing').length;
+        const total = frameworkControls.length;
+        // Never round up.
+        const passingPct = total > 0 ? Math.floor((passing / total) * 10000) / 100 : 0;
+        result[framework] = { framework, totalControls: total, passingControls: passing, passingPct };
+    }
+    return result;
+}
+function toLinkedEvidence(entry) {
+    return {
+        vaultSeq: entry.seq,
+        controlId: entry.controlId,
+        capturedAt: entry.capturedAt,
+        payload: entry.payload,
+    };
+}
+//# sourceMappingURL=auditor.js.map

package/dist/core/compliance/auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditor.js","sourceRoot":"","sources":["../../../core/compliance/auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAiBtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,oBAAoB,EAAE,EAAE;IACxB,oBAAoB,EAAE,EAAE;IACxB,WAAW,EAAE,EAAE;IACf,kBAAkB,EAAE,EAAE;CACd,CAAC;AAEX,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E,qFAAqF;AACrF,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,6FAA6F;AAC7F,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAClF,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,CACL,GAAG;QACH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAChB,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;aAChE,IAAI,CAAC,GAAG,CAAC;QACZ,GAAG,CACJ,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACH,SAAS,cAAc,CACrB,OAA0B;IAE1B,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,0BAA0B;YACjC,UAAU,EAAE,OAAO,CAAC,wBAAwB;YAC5C,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,uBAAuB;YAC7B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,wBAAwB;YAC/B,UAAU,EAAE,OAAO,CAAC,sBAAsB;YAC1C,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI;QAC7B,CAAC,0BAA0B,EAAE,OAAO,CAAC,wBAAwB,CAAC;QAC9D,CAAC,wBAAwB,EAAE,OAAO,CAAC,sBAAsB,CAAC;KAClD,EAAE,CAAC;QACX,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,IAAI,EAAE,uBAAuB;gBAC7B,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,KAAK;gBACL,UAAU,EAAE,OAAO;gBACnB,OAAO,EAAE,8DAA8D;aACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,0EAA0E;AAC1E,iDAAiD;AACjD,8EAA8E;AAE9E,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAiC;IAC5D,2EAA2E;IAC3E;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,sDAAsD;QAC7D,UAAU,EAAE,CAAC,MAAM,CAAC;QACpB,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,gCAAgC;QACxD,wBAAwB,EAAE,qCAAqC;KAChE;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,oCAAoC;QAC3C,UAAU,EAAE,CAAC,MAAM,CAAC;QACpB,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,6BAA6B;QACrD,wBAAwB,EAAE,mBAAmB;KAC9C;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,KAAK,EAAE,yDAAyD;QAChE,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC7B,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,yCAAyC;QACjE,wBAAwB,EAAE,mBAAmB;KAC9C;IAED,4EAA4E;IAC5E,oFAAoF;IACpF,qFAAqF;IACrF,8EAA8E;IAC9E;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,yDAAyD;QAChE,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;QAChC,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,kBAAkB;QAC1C,wBAAwB,EAAE,QAAQ;KACnC;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,KAAK,EAAE,qDAAqD;QAC5D,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC;QACpD,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,yBAAyB;QACjD,wBAAwB,EAAE,kBAAkB;KAC7C;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,KAAK,EAAE,qEAAqE;QAC5E,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;QAChC,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,4BAA4B;QACpD,wBAAwB,EAAE,oBAAoB;KAC/C;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,2DAA2D;QAClE,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;QAC3C,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,gCAAgC;QACxD,wBAAwB,EAAE,SAAS;KACpC;IAED,2EAA2E;IAC3E;QACE,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,2CAA2C;QAClD,UAAU,EAAE,CAAC,UAAU,CAAC;QACxB,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,2BAA2B;QACnD,wBAAwB,EAAE,cAAc;KACzC;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,KAAK,EAAE,6DAA6D;QACpE,UAAU,EAAE,CAAC,UAAU,CAAC;QACxB,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,gCAAgC;QACxD,wBAAwB,EAAE,iCAAiC;KAC5D;IAED,4EAA4E;IAC5E;QACE,EAAE,EAAE,iBAAiB;QACrB,KAAK,EAAE,+CAA+C;QACtD,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC;QAC3C,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,0BAA0B;QAClD,wBAAwB,EAAE,SAAS;KACpC;IACD;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,6EAA6E;QACpF,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;QAChC,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,oBAAoB;QAC5C,wBAAwB,EAAE,SAAS;KACpC;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,qEAAqE;QAC5E,UAAU,EAAE,CAAC,MAAM,CAAC;QACpB,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,6BAA6B;QACrD,wBAAwB,EAAE,SAAS;KACpC;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,KAAK,EAAE,oDAAoD;QAC3D,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC7B,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACtB,sBAAsB,EAAE,6BAA6B;QACrD,wBAAwB,EAAE,SAAS;KACpC;CACO,CAAC;AAEX,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,2BAA2B,GAC/B,kFAAkF;IAClF,iFAAiF;IACjF,gCAAgC,CAAC;AAEnC,SAAS,SAAS,CAChB,GAAW,EACX,UAAkB,EAClB,SAAiB,EACjB,OAAgB,EAChB,QAAgB;IAEhB,0FAA0F;IAC1F,4EAA4E;IAC5E,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED;0CAC0C;AAC1C,MAAM,OAAO,aAAa;IACP,OAAO,GAAyB,EAAE,CAAC;IACnC,KAAK,CAAe;IAErC,YAAY,OAA2C;QACrD,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,uDAAuD;IACvD,MAAM,CACJ,SAAiB,EACjB,OAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtE,MAAM,KAAK,GAAuB,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,WAAW;QACT,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;YAChF,MAAM,QAAQ,GAAG,SAAS,CACxB,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,OAAO,EACb,QAAQ,CACT,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+FAA+F;IAC/F,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAC9B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,MAA8D;QAChF,OAAO,CACL,IAAI,CAAC,WAAW,EAAE;YAClB,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YACrC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAClC,CAAC;IACJ,CAAC;CACF;AAaD;;;;;;;;;GASG;AACH,MAAM,OAAO,iBAAiB;IACX,QAAQ,CAAqD;IACrE,KAAK,CAAgB;IACb,KAAK,CAAe;IAErC;;;OAGG;IACK,eAAe,GAAuC,IAAI,GAAG,EAAE,CAAC;IAExE,8DAA8D;IACrD,aAAa,CAAiC;IAEvD,YAAY,OAAwB;QAClC,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,gBAAgB,CAAC;QACvD,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAEtD,2DAA2D;QAC3D,MAAM,QAAQ,GAA8C,EAAE,CAAC;QAC/D,MAAM,MAAM,GAA0B,EAAE,CAAC;QACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,IAAI,MAAM,IAAI,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;IAC9B,CAAC;IAED,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAE5E;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,KAAmD;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAEzB,uEAAuE;QACvE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC;QAE3C,gCAAgC;QAChC,MAAM,WAAW,GAAwB,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAiB,EAAE,CAAC;QAErC,KAAK,MAAM,eAAe,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5C,yDAAyD;YACzD,IAAI,MAAM,IAAI,eAAe,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,eAAe,CAAC;gBAC5B,WAAW,CAAC,IAAI,CAAC;oBACf,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,MAAM,EAAE,aAAa;oBACrB,UAAU,EAAE,CAAC;oBACb,cAAc,EAAE,EAAE;oBAClB,cAAc,EAAE,GAAG;iBACpB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC;YAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACtF,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAE7B,+EAA+E;YAC/E,IACE,UAAU,CAAC,MAAM,KAAK,SAAS;gBAC/B,UAAU,CAAC,aAAa,KAAK,SAAS;gBACtC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,SAAS,EAC3C,CAAC;gBACD,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,MAAM,IAAI,GAAG,SAAS,CACpB,IAAI,CAAC,QAAQ;aACV,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EACxB,WAAW,CACZ,CAAC;QAEF,gCAAgC;QAChC,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,IAAI,CAAC,QAAQ;aACV,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EACxB,WAAW,CACZ,CAAC;QAEF,kEAAkE;QAClE,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEhF,OAAO;YACL,WAAW,EAAE,GAAG;YAChB,kBAAkB,EAAE,WAAW;YAC/B,WAAW;YACX,IAAI;YACJ,gBAAgB;SACjB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,SAAS,CACP,SAA8B,EAC9B,OAA0B;QAE1B,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ;aAChC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAEzB,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,aAAa;aACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACpB,CAAC;QAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CACpC,CAAC;QACF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACrC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CACjC,CAAC;QAEF,MAAM,oBAAoB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CACpC,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QACtE,oDAAoD;QACpD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,GAAG;YACvD,CAAC,CAAC,CAAC,CAAC;QAEN,OAAO;YACL,SAAS;YACT,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE;YACzB,UAAU,EAAE,2BAA2B;YACvC,QAAQ;YACR,IAAI;YACJ,YAAY,EAAE,oBAAoB;YAClC,UAAU;SACX,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAEpE,eAAe,CACrB,OAA0B,EAC1B,WAAmB,EACnB,UAAkB,EAClB,KAAmD,EACnD,GAAW;QAEX,iEAAiE;QACjE,MAAM,aAAa,GAAc,EAAE,CAAC;QACpC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,QAAQ;gBAAE,aAAa,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAChD,CAAC;QAED,qEAAqE;QACrE,gFAAgF;QAChF,IAAI,aAAkC,CAAC;QACvC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,IACE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;gBACtD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,EAC/D,CAAC;gBACD,aAAa,GAAG,OAAO,CAAC;gBACxB,MAAM;YACR,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,YAAiC,CAAC;QACtC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;gBACpC,IACE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;oBACrD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,EAC9D,CAAC;oBACD,YAAY,GAAG,OAAO,CAAC;oBACvB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,wCAAwC;QACxC,mFAAmF;QACnF,oFAAoF;QACpF,IAAI,MAAqB,CAAC;QAC1B,IAAI,UAAkB,CAAC;QAEvB,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,GAAG,SAAS,CAAC;YACnB,0FAA0F;YAC1F,UAAU,GAAG,GAAG,CAAC;QACnB,CAAC;aAAM,IAAI,YAAY,EAAE,CAAC;YACxB,sFAAsF;YACtF,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CACpD,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CACrC,CAAC,MAAM,CAAC;YACT,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;YACxF,sFAAsF;YACtF,gFAAgF;YAChF,MAAM,GAAG,cAAc,KAAK,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,0EAA0E;YAC1E,6CAA6C;YAC7C,MAAM,GAAG,aAAa,CAAC;YACvB,UAAU,GAAG,CAAC,CAAC;QACjB,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,6BAA6B;QAC7B,MAAM,cAAc,GAAqB,EAAE,CAAC;QAC5C,MAAM,eAAe,GAAG,aAAa,IAAI,YAAY,CAAC;QACtD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;YAC7D,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,MAAM;YACN,UAAU;YACV,cAAc;YACd,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,cAAc,EAAE,GAAG;SACpB,CAAC;IACJ,CAAC;CACF;AAED,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAC7B,OAA0B,EAC1B,aAAsB,EACtB,GAAW;IAEX,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,mBAAmB,EAAE,aAAa,CAAC,EAAE;QACrC,iBAAiB,EAAE,aAAa,CAAC,OAAO;QACxC,UAAU,EAAE,GAAG;QACf,WAAW,EACT,WAAW,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,KAAK,yBAAyB;YACjE,IAAI,aAAa,CAAC,EAAE,iBAAiB,aAAa,CAAC,OAAO,IAAI;YAC9D,GAAG,aAAa,CAAC,WAAW,EAAE;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,QAAsC,EACtC,WAAyC;IAEzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAoB,EAAE,CAAC;IAEjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU;YAAE,SAAS;QAE1B,IACE,UAAU,CAAC,MAAM,KAAK,aAAa;YACnC,UAAU,CAAC,MAAM,KAAK,SAAS;YAC/B,UAAU,CAAC,MAAM,KAAK,kBAAkB,EACxC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,YAAY,EAAE,OAAO,CAAC,KAAK;gBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,eAAe,EACb,UAAU,CAAC,MAAM,KAAK,SAAS;oBAC7B,CAAC,CAAC,4BAA4B,UAAU,CAAC,aAAa,EAAE,EAAE,IAAI,SAAS,IAAI;wBACzE,sBAAsB,UAAU,CAAC,aAAa,EAAE,OAAO,IAAI,GAAG,sBAAsB;oBACtF,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,kBAAkB;wBACxC,CAAC,CAAC,+CAA+C;4BAC/C,KAAK,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,0CAA0C;4BACnF,uDAAuD;wBACzD,CAAC,CAAC,oCAAoC;4BACpC,KAAK,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B;4BACvE,sDAAsD,OAAO,CAAC,sBAAsB,KAAK;4BACzF,wCAAwC;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAsC,EACtC,WAAyC;IAEzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAElE,mDAAmD;IACnD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU;YAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAAqC,EAAE,CAAC;IAEpD,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;QACtC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,KAAK,SAAS,CAC/C,CAAC,MAAM,CAAC;QACT,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC;QACvC,kBAAkB;QAClB,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/E,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAChG,CAAC;IAED,OAAO,MAA0E,CAAC;AACpF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,GAAG;QACnB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}

package/dist/core/compliance/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Compliance & Audit module (#18 — "The Inspector") — public surface.
+ * Composes engine-agent findings (#65/#66/#67/#84) into a continuous compliance
+ * posture, tamper-evident evidence vault, drift alerts, and audit-ready packs.
+ * Spec: blueprint/agents/18-compliance-audit.md.
+ *
+ * DISCLAIMER: NOT legal advice. See AuditEvidencePack.disclaimer.
+ */
+export type { AgentFindingsBatch, AuditEvidencePack, ComplianceControl, ComplianceFramework, ComplianceGap, CompliancePosture, ControlEvaluation, ControlStatus, DriftAlert, EvidenceVaultEntry, FrameworkSummary, LinkedEvidence, } from './types.js';
+export { ComplianceAuditor, EvidenceVault, DEFAULT_CONTROLS, buildDriftAlert, buildGaps, buildFrameworkSummary, type AuditorOptions, } from './auditor.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/compliance/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../core/compliance/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,SAAS,CAAC;AAEjB,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,KAAK,cAAc,GACpB,MAAM,WAAW,CAAC"}

package/dist/core/compliance/index.js

@@ -0,0 +1,10 @@
+/**
+ * Compliance & Audit module (#18 — "The Inspector") — public surface.
+ * Composes engine-agent findings (#65/#66/#67/#84) into a continuous compliance
+ * posture, tamper-evident evidence vault, drift alerts, and audit-ready packs.
+ * Spec: blueprint/agents/18-compliance-audit.md.
+ *
+ * DISCLAIMER: NOT legal advice. See AuditEvidencePack.disclaimer.
+ */
+export { ComplianceAuditor, EvidenceVault, DEFAULT_CONTROLS, buildDriftAlert, buildGaps, buildFrameworkSummary, } from './auditor.js';
+//# sourceMappingURL=index.js.map

package/dist/core/compliance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../core/compliance/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,qBAAqB,GAEtB,MAAM,WAAW,CAAC"}