@connexum/ai-governance 1.0.0-beta.11

package/dist/agents/compliance-agent-templates/types.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Tier 8.7 — ComplianceAgentTemplate generator contract.
+ *
+ * Architectural correction (Thomas directive, 2026-05-15):
+ *   A ComplianceAgentTemplate is NOT a data object describing report
+ *   sections. It is a GENERATOR that emits an MD-file bundle structurally
+ *   conforming to our existing CXNI single-MD Claude Code sub-agent
+ *   pattern (see `/root/.claude/agents/_template-new-agent.md`).
+ *
+ *   Each template produces:
+ *     1. ONE primary agent MD file (`.claude/agents/<pack>-compliance-agent.md`)
+ *        following the 9 mandatory sections (Mandatory Startup Protocol /
+ *        Identity / Soul / Token Economics / Responsibilities / Authority
+ *        Tiers / Boundaries / Projects / Kanban) + V2 Governance Compliance
+ *        footer.
+ *     2. PACK-SPECIFIC skill files (`.claude/skills/compliance/<pack>-*.md`)
+ *        covering governance dos/don'ts, the heartbeat cycle (load-bearing
+ *        for cadenced compliance reporting), reporting composition, and
+ *        broker usage.
+ *     3. SHARED skill copies (`.claude/skills/_shared/*.md`) the agent loads
+ *        at startup. Only included if the customer's .claude/ tree doesn't
+ *        already have them.
+ *     4. A customer-specific GOVERNANCE.md at the project root.
+ *
+ *   The customer extracts this tarball into their project root; the files
+ *   land at the expected `.claude/...` paths and the agent becomes a working
+ *   Claude Code sub-agent that Claude Code recognises natively via the
+ *   frontmatter `identifier:` field.
+ *
+ * @connexum/ai-governance — Tier 8.7
+ */
+/** Scope kinds a compliance agent can read (read-only). */
+export type ScopeKind = 'database' | 'codebase' | 'audit-chain' | 'document-store' | 'object-store';
+/** Cadence options mirroring scheduled-report-routes.ts:35. */
+export type ReportCadence = 'weekly' | 'monthly' | 'quarterly' | 'annual';
+/**
+ * Input handed to a template generator at spawn time.
+ * Mirrors what the spawn endpoint already collects.
+ */
+export interface ComplianceAgentSpawnInput {
+    /** The pack id (matches registry-expanded.ts `id` exactly). */
+    packId: string;
+    /** Tier 8.7 agent id assigned at spawn (e.g., agent_hipaa_acme_...). */
+    agentId: string;
+    /** Tenant org id (from JWT `claims.org`). */
+    orgId: string;
+    /** Location string supplied by ORG_ADMIN at spawn. */
+    location: string;
+    /** Department string supplied by ORG_ADMIN at spawn. */
+    department: string;
+    /** License key issued for this agent (used in setup instructions). */
+    licenseKey: string;
+    /** Connexum gov-server base URL the agent posts back to. */
+    govServerUrl?: string;
+}
+/**
+ * One file in the generated MD bundle.
+ *
+ * `path` is RELATIVE to the customer's project root (e.g.,
+ * `.claude/agents/hipaa-compliance-agent.md`). The tarball builder
+ * preserves the path verbatim so extraction into the project root
+ * lands files at the expected `.claude/...` locations.
+ *
+ * `mode` is an octal POSIX permission (defaults to 0o644). Use 0o444
+ * for files the agent must never rewrite (Authority Tiers, Boundaries).
+ */
+export interface GeneratedFile {
+    path: string;
+    content: string;
+    mode?: number;
+}
+/**
+ * A ComplianceAgentTemplate is a PURE generator function.
+ *
+ * Same `spawnInput` MUST produce a byte-identical bundle — auditors
+ * verify the bundle hash against the audit-chain entry at spawn time.
+ * Non-determinism (timestamps, random IDs) is the caller's responsibility.
+ */
+export type ComplianceAgentTemplate = (spawnInput: ComplianceAgentSpawnInput) => GeneratedFile[];
+/**
+ * Lightweight metadata about a template. Lets the tarball builder and
+ * the dashboard surface what the agent IS without invoking the generator.
+ * Every template module exports both `generate` and `metadata`.
+ */
+export interface ComplianceAgentTemplateMetadata {
+    packId: string;
+    templateVersion: string;
+    cadences: ReportCadence[];
+    requiredScopeKinds: ScopeKind[];
+    displayName: string;
+    shortDescription: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/agents/compliance-agent-templates/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/agents/compliance-agent-templates/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,2DAA2D;AAC3D,MAAM,MAAM,SAAS,GACjB,UAAU,GACV,UAAU,GACV,aAAa,GACb,gBAAgB,GAChB,cAAc,CAAC;AAEnB,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE1E;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG,CACpC,UAAU,EAAE,yBAAyB,KAClC,aAAa,EAAE,CAAC;AAErB;;;;GAIG;AACH,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,kBAAkB,EAAE,SAAS,EAAE,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;CAC1B"}

package/dist/agents/compliance-agent-templates/types.js

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * Tier 8.7 — ComplianceAgentTemplate generator contract.
+ *
+ * Architectural correction (Thomas directive, 2026-05-15):
+ *   A ComplianceAgentTemplate is NOT a data object describing report
+ *   sections. It is a GENERATOR that emits an MD-file bundle structurally
+ *   conforming to our existing CXNI single-MD Claude Code sub-agent
+ *   pattern (see `/root/.claude/agents/_template-new-agent.md`).
+ *
+ *   Each template produces:
+ *     1. ONE primary agent MD file (`.claude/agents/<pack>-compliance-agent.md`)
+ *        following the 9 mandatory sections (Mandatory Startup Protocol /
+ *        Identity / Soul / Token Economics / Responsibilities / Authority
+ *        Tiers / Boundaries / Projects / Kanban) + V2 Governance Compliance
+ *        footer.
+ *     2. PACK-SPECIFIC skill files (`.claude/skills/compliance/<pack>-*.md`)
+ *        covering governance dos/don'ts, the heartbeat cycle (load-bearing
+ *        for cadenced compliance reporting), reporting composition, and
+ *        broker usage.
+ *     3. SHARED skill copies (`.claude/skills/_shared/*.md`) the agent loads
+ *        at startup. Only included if the customer's .claude/ tree doesn't
+ *        already have them.
+ *     4. A customer-specific GOVERNANCE.md at the project root.
+ *
+ *   The customer extracts this tarball into their project root; the files
+ *   land at the expected `.claude/...` paths and the agent becomes a working
+ *   Claude Code sub-agent that Claude Code recognises natively via the
+ *   frontmatter `identifier:` field.
+ *
+ * @connexum/ai-governance — Tier 8.7
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/agents/compliance-agent-templates/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/agents/compliance-agent-templates/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG"}

package/dist/audit/audit-integrity.d.ts

@@ -0,0 +1,88 @@
+/**
+ * AuditIntegrity -- Tamper-evident audit logs with hash chaining.
+ *
+ * Each log entry includes a SHA-256 hash of itself + the previous entry's hash,
+ * creating an immutable chain. Any modification or deletion is detectable.
+ *
+ * Required by:
+ *   - SOC 2 CC7.2: Monitoring of system components
+ *   - HIPAA 164.312(b): Audit controls
+ *   - PCI DSS Req 10: Track and monitor access
+ *   - ISO 27001 8.15: Logging
+ *
+ * Format per line (JSONL):
+ *   { ...entry, _seq: N, _prevHash: "abc...", _hash: "def..." }
+ *
+ * @connexum/ai-governance
+ */
+export interface AuditIntegrityConfig {
+    /** Directory for tamper-evident logs */
+    logDir: string;
+    /** Log file prefix (default: 'audit-chain') */
+    prefix?: string;
+    /** Maximum entries per file before rotation (default: 10000) */
+    maxEntriesPerFile?: number;
+}
+export interface ChainedEntry {
+    /** The actual log data */
+    data: Record<string, unknown>;
+    /** Sequence number within this file */
+    _seq: number;
+    /** SHA-256 hash of the previous entry (empty string for first entry) */
+    _prevHash: string;
+    /** SHA-256 hash of this entry (data + _seq + _prevHash) */
+    _hash: string;
+}
+export interface ChainVerification {
+    valid: boolean;
+    totalEntries: number;
+    /** First broken entry index (-1 if all valid) */
+    brokenAt: number;
+    /** Files verified */
+    files: string[];
+    errors: string[];
+}
+export declare class AuditIntegrity {
+    private config;
+    private currentFile;
+    private currentSeq;
+    private lastHash;
+    constructor(config: AuditIntegrityConfig);
+    /**
+     * Append a tamper-evident entry to the audit log.
+     */
+    append(data: Record<string, unknown>): ChainedEntry;
+    /**
+     * Verify the integrity of all audit log files.
+     * Checks that every entry's hash matches its content + previous hash.
+     */
+    verify(): ChainVerification;
+    /**
+     * Read all entries from all log files.
+     */
+    readAll(): ChainedEntry[];
+    /**
+     * Read entries from the most recent N entries.
+     */
+    readRecent(limit?: number): ChainedEntry[];
+    /**
+     * Get the current log file path.
+     */
+    getLogFile(): string;
+    /**
+     * Get statistics about the audit chain.
+     */
+    getStats(): {
+        files: number;
+        totalEntries: number;
+        currentSeq: number;
+        lastHash: string;
+    };
+    private computeEntryHash;
+    private getCurrentLogFile;
+    private rotate;
+    private initializeFromExisting;
+    private listLogFiles;
+    private readLines;
+}
+//# sourceMappingURL=audit-integrity.d.ts.map

package/dist/audit/audit-integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-integrity.d.ts","sourceRoot":"","sources":["../../src/audit/audit-integrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAiC;IAC/C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,QAAQ,CAAc;gBAElB,MAAM,EAAE,oBAAoB;IAexC;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;IAqCnD;;;OAGG;IACH,MAAM,IAAI,iBAAiB;IA2D3B;;OAEG;IACH,OAAO,IAAI,YAAY,EAAE;IAkBzB;;OAEG;IACH,UAAU,CAAC,KAAK,GAAE,MAAW,GAAG,YAAY,EAAE;IAK9C;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;OAEG;IACH,QAAQ,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IAgBzF,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,MAAM;IAWd,OAAO,CAAC,sBAAsB;IAuC9B,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,SAAS;CAUlB"}

package/dist/audit/audit-integrity.js

@@ -0,0 +1,284 @@
+"use strict";
+/**
+ * AuditIntegrity -- Tamper-evident audit logs with hash chaining.
+ *
+ * Each log entry includes a SHA-256 hash of itself + the previous entry's hash,
+ * creating an immutable chain. Any modification or deletion is detectable.
+ *
+ * Required by:
+ *   - SOC 2 CC7.2: Monitoring of system components
+ *   - HIPAA 164.312(b): Audit controls
+ *   - PCI DSS Req 10: Track and monitor access
+ *   - ISO 27001 8.15: Logging
+ *
+ * Format per line (JSONL):
+ *   { ...entry, _seq: N, _prevHash: "abc...", _hash: "def..." }
+ *
+ * @connexum/ai-governance
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditIntegrity = void 0;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+class AuditIntegrity {
+    config;
+    currentFile;
+    currentSeq = 0;
+    lastHash = '';
+    constructor(config) {
+        this.config = {
+            prefix: 'audit-chain',
+            maxEntriesPerFile: 10000,
+            ...config,
+        };
+        if (!fs.existsSync(config.logDir)) {
+            fs.mkdirSync(config.logDir, { recursive: true });
+        }
+        this.currentFile = this.getCurrentLogFile();
+        this.initializeFromExisting();
+    }
+    /**
+     * Append a tamper-evident entry to the audit log.
+     */
+    append(data) {
+        // Add timestamp if not present
+        if (!data.timestamp) {
+            data.timestamp = new Date().toISOString();
+        }
+        this.currentSeq++;
+        // Check if rotation needed
+        if (this.currentSeq > this.config.maxEntriesPerFile) {
+            this.rotate();
+        }
+        const entry = {
+            data,
+            _seq: this.currentSeq,
+            _prevHash: this.lastHash,
+            _hash: '', // Computed below
+        };
+        // Compute hash of the entry (excluding _hash itself)
+        entry._hash = this.computeEntryHash(entry);
+        this.lastHash = entry._hash;
+        // Write to file
+        try {
+            fs.appendFileSync(this.currentFile, JSON.stringify(entry) + '\n');
+        }
+        catch (err) {
+            process.stderr.write(`[AUDIT INTEGRITY CRITICAL] Failed to write audit entry: ${err.message}\n`);
+            throw new Error(`Audit write failure: ${err.message}`);
+        }
+        return entry;
+    }
+    /**
+     * Verify the integrity of all audit log files.
+     * Checks that every entry's hash matches its content + previous hash.
+     */
+    verify() {
+        const files = this.listLogFiles();
+        const result = {
+            valid: true,
+            totalEntries: 0,
+            brokenAt: -1,
+            files,
+            errors: [],
+        };
+        let prevHash = '';
+        let globalSeq = 0;
+        for (const file of files) {
+            const lines = this.readLines(file);
+            for (let i = 0; i < lines.length; i++) {
+                globalSeq++;
+                result.totalEntries++;
+                try {
+                    const entry = JSON.parse(lines[i]);
+                    // Verify previous hash chain
+                    if (entry._prevHash !== prevHash) {
+                        result.valid = false;
+                        if (result.brokenAt === -1)
+                            result.brokenAt = globalSeq;
+                        result.errors.push(`Entry ${globalSeq} (file: ${path.basename(file)}, seq: ${entry._seq}): ` +
+                            `prevHash mismatch. Expected ${prevHash.slice(0, 16)}, got ${entry._prevHash.slice(0, 16)}`);
+                    }
+                    // Verify self-hash
+                    const expectedHash = this.computeEntryHash(entry);
+                    if (entry._hash !== expectedHash) {
+                        result.valid = false;
+                        if (result.brokenAt === -1)
+                            result.brokenAt = globalSeq;
+                        result.errors.push(`Entry ${globalSeq} (file: ${path.basename(file)}, seq: ${entry._seq}): ` +
+                            `hash mismatch. Data may have been tampered.`);
+                    }
+                    prevHash = entry._hash;
+                }
+                catch (err) {
+                    result.valid = false;
+                    if (result.brokenAt === -1)
+                        result.brokenAt = globalSeq;
+                    result.errors.push(`Entry ${globalSeq} (file: ${path.basename(file)}): ` +
+                        `Parse error: ${err.message}`);
+                }
+            }
+        }
+        return result;
+    }
+    /**
+     * Read all entries from all log files.
+     */
+    readAll() {
+        const files = this.listLogFiles();
+        const entries = [];
+        for (const file of files) {
+            const lines = this.readLines(file);
+            for (const line of lines) {
+                try {
+                    entries.push(JSON.parse(line));
+                }
+                catch {
+                    // Skip malformed
+                }
+            }
+        }
+        return entries;
+    }
+    /**
+     * Read entries from the most recent N entries.
+     */
+    readRecent(limit = 50) {
+        const all = this.readAll();
+        return all.slice(-limit);
+    }
+    /**
+     * Get the current log file path.
+     */
+    getLogFile() {
+        return this.currentFile;
+    }
+    /**
+     * Get statistics about the audit chain.
+     */
+    getStats() {
+        const files = this.listLogFiles();
+        let totalEntries = 0;
+        for (const file of files) {
+            totalEntries += this.readLines(file).length;
+        }
+        return {
+            files: files.length,
+            totalEntries,
+            currentSeq: this.currentSeq,
+            lastHash: this.lastHash,
+        };
+    }
+    // --- Private helpers ---
+    computeEntryHash(entry) {
+        // Hash everything except _hash itself
+        const hashInput = JSON.stringify({
+            data: entry.data,
+            _seq: entry._seq,
+            _prevHash: entry._prevHash,
+        });
+        return crypto.createHash('sha256').update(hashInput).digest('hex');
+    }
+    getCurrentLogFile() {
+        const date = new Date().toISOString().split('T')[0];
+        return path.join(this.config.logDir, `${this.config.prefix}-${date}.jsonl`);
+    }
+    rotate() {
+        // Start a new file with a timestamp suffix
+        const timestamp = Date.now();
+        this.currentFile = path.join(this.config.logDir, `${this.config.prefix}-${new Date().toISOString().split('T')[0]}-${timestamp}.jsonl`);
+        this.currentSeq = 0;
+        // lastHash carries forward to maintain chain across files
+    }
+    initializeFromExisting() {
+        const files = this.listLogFiles();
+        if (files.length === 0)
+            return;
+        // Read the last file's last entry to get chain state
+        const lastFile = files[files.length - 1];
+        const lines = this.readLines(lastFile);
+        if (lines.length === 0)
+            return;
+        try {
+            const lastEntry = JSON.parse(lines[lines.length - 1]);
+            // Guard: legacy flat entries (pre-fix) parse as valid JSON but lack
+            // _hash/_seq. Treat missing or non-string/non-number fields as a fresh
+            // chain start rather than inheriting undefined state.
+            if (typeof lastEntry._hash !== 'string' || typeof lastEntry._seq !== 'number') {
+                this.lastHash = '';
+                this.currentSeq = 0;
+                return;
+            }
+            this.lastHash = lastEntry._hash;
+            this.currentSeq = lastEntry._seq;
+            // If last file is today's file, continue in it
+            if (lastFile === this.currentFile) {
+                // Already set
+            }
+            else {
+                // Today's file is new, seq resets but hash continues
+                this.currentSeq = 0;
+            }
+        }
+        catch {
+            // Corrupted last entry -- start fresh chain
+            this.lastHash = '';
+            this.currentSeq = 0;
+        }
+    }
+    listLogFiles() {
+        if (!fs.existsSync(this.config.logDir))
+            return [];
+        return fs.readdirSync(this.config.logDir)
+            .filter(f => f.startsWith(this.config.prefix) && f.endsWith('.jsonl'))
+            .sort()
+            .map(f => path.join(this.config.logDir, f));
+    }
+    readLines(file) {
+        try {
+            return fs.readFileSync(file, 'utf-8')
+                .trim()
+                .split('\n')
+                .filter(Boolean);
+        }
+        catch {
+            return [];
+        }
+    }
+}
+exports.AuditIntegrity = AuditIntegrity;
+//# sourceMappingURL=audit-integrity.js.map

package/dist/audit/audit-integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-integrity.js","sourceRoot":"","sources":["../../src/audit/audit-integrity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,+CAAiC;AACjC,uCAAyB;AACzB,2CAA6B;AAgC7B,MAAa,cAAc;IACjB,MAAM,CAAiC;IACvC,WAAW,CAAS;IACpB,UAAU,GAAW,CAAC,CAAC;IACvB,QAAQ,GAAW,EAAE,CAAC;IAE9B,YAAY,MAA4B;QACtC,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM,EAAE,aAAa;YACrB,iBAAiB,EAAE,KAAK;YACxB,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5C,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAA6B;QAClC,+BAA+B;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,2BAA2B;QAC3B,IAAI,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,GAAiB;YAC1B,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,KAAK,EAAE,EAAE,EAAE,iBAAiB;SAC7B,CAAC;QAEF,qDAAqD;QACrD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;QAE5B,gBAAgB;QAChB,IAAI,CAAC;YACH,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2DAA4D,GAAa,CAAC,OAAO,IAAI,CACtF,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,wBAAyB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,MAAM;QACJ,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,MAAM,GAAsB;YAChC,KAAK,EAAE,IAAI;YACX,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,CAAC,CAAC;YACZ,KAAK;YACL,MAAM,EAAE,EAAE;SACX,CAAC;QAEF,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,SAAS,EAAE,CAAC;gBACZ,MAAM,CAAC,YAAY,EAAE,CAAC;gBAEtB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAiB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBAEjD,6BAA6B;oBAC7B,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;wBACjC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;wBACrB,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;4BAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;wBACxD,MAAM,CAAC,MAAM,CAAC,IAAI,CAChB,SAAS,SAAS,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,KAAK;4BACzE,+BAA+B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAC5F,CAAC;oBACJ,CAAC;oBAED,mBAAmB;oBACnB,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;oBAClD,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;wBACjC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;wBACrB,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;4BAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;wBACxD,MAAM,CAAC,MAAM,CAAC,IAAI,CAChB,SAAS,SAAS,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,KAAK;4BACzE,6CAA6C,CAC9C,CAAC;oBACJ,CAAC;oBAED,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;gBACzB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;oBACrB,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;wBAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;oBACxD,MAAM,CAAC,MAAM,CAAC,IAAI,CAChB,SAAS,SAAS,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK;wBACrD,gBAAiB,GAAa,CAAC,OAAO,EAAE,CACzC,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,OAAO,GAAmB,EAAE,CAAC;QAEnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,QAAgB,EAAE;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,YAAY,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAC9C,CAAC;QACD,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,YAAY;YACZ,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED,0BAA0B;IAElB,gBAAgB,CAAC,KAAmB;QAC1C,sCAAsC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IAEO,iBAAiB;QACvB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,QAAQ,CAAC,CAAC;IAC9E,CAAC;IAEO,MAAM;QACZ,2CAA2C;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAC1B,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,QAAQ,CACrF,CAAC;QACF,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,0DAA0D;IAC5D,CAAC;IAEO,sBAAsB;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/B,qDAAqD;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/B,IAAI,CAAC;YACH,MAAM,SAAS,GAAiB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAEpE,oEAAoE;YACpE,uEAAuE;YACvE,sDAAsD;YACtD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9E,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;gBACnB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC;YAChC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC;YAEjC,+CAA+C;YAC/C,IAAI,QAAQ,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClC,cAAc;YAChB,CAAC;iBAAM,CAAC;gBACN,qDAAqD;gBACrD,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;YAC5C,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAClD,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;aACtC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;aACrE,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAEO,SAAS,CAAC,IAAY;QAC5B,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;iBAClC,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAtQD,wCAsQC"}

package/dist/audit/chain-tamper-detector.d.ts

@@ -0,0 +1,115 @@
+/**
+ * ChainTamperDetector -- P1-TAMPER-A
+ *
+ * Periodic full-chain re-verification worker. Runs independently of agent
+ * activity so dormant periods are not unobserved windows. Emits signed
+ * liveness attestations on success and CRITICAL events on failure.
+ *
+ * Events emitted:
+ *   chain.verified      -- every interval on success
+ *   chain.tamper.detected -- on any failure (CRITICAL severity)
+ *   chain.agent.paused  -- when pauseAgentsOnTamper=true and tamper fires
+ *
+ * Config floors (strictest-wins):
+ *   HIPAA / HITECH binding: intervalMs floor = 60 000 ms
+ *   SOC 2 binding:          intervalMs floor = 300 000 ms
+ *   Dev (intervalMs === 0): disables the loop
+ *
+ * @connexum/ai-governance P1-TAMPER-A
+ */
+import type { AuditIntegrity } from './audit-integrity.js';
+import type { EventBus } from './event-bus.js';
+export interface ChainTamperDetectorConfig {
+    auditIntegrity: AuditIntegrity;
+    eventBus: EventBus;
+    /**
+     * How often to re-verify the full chain (ms).
+     * 0 disables the loop (dev only).
+     * HIPAA/HITECH pack floor: 60 000 ms.
+     * Default production: 300 000 ms.
+     */
+    intervalMs: number;
+    /**
+     * Emit chain.verified liveness attestations on success.
+     * Default true; HIPAA/HITECH binding forces true.
+     */
+    emitLivenessAttestations: boolean;
+    /**
+     * If true, pause all governed agents when tamper is detected.
+     * Agents remain paused until a T2 reviewer appends chain.cleared.
+     * HIPAA/HITECH default: true.
+     */
+    pauseAgentsOnTamper: boolean;
+    /**
+     * Stable detector id used in events. Defaults to 'chain-tamper-detector'.
+     */
+    detectorId?: string;
+    /**
+     * HMAC secret for signing liveness attestation events (TRUST_ANCHOR_HMAC).
+     * Required when emitLivenessAttestations is true.
+     */
+    hmacSecret?: string;
+}
+export interface ChainVerification {
+    valid: boolean;
+    chainHash: string;
+    eventCount: number;
+    verifiedAt: string;
+    /** First broken entry index (-1 if valid) */
+    brokenAt: number;
+    firstBadEventId?: string;
+    expectedHash?: string;
+    observedHash?: string;
+}
+/** HIPAA/HITECH pack floor: 60 seconds */
+export declare const HIPAA_INTERVAL_FLOOR_MS = 60000;
+/** SOC 2 pack floor: 300 seconds */
+export declare const SOC2_INTERVAL_FLOOR_MS = 300000;
+export declare class ChainTamperDetector {
+    private readonly cfg;
+    private timer;
+    private paused;
+    constructor(config: ChainTamperDetectorConfig);
+    /**
+     * Begin the periodic verification loop.
+     * Silently skips starting if intervalMs === 0 (dev mode).
+     */
+    start(): void;
+    /**
+     * Stop the verification loop cleanly.
+     */
+    stop(): void;
+    /**
+     * Run a verification cycle on-demand (used by AuditNarrativeGenerator
+     * and the on-boot guard).
+     */
+    verifyNow(): Promise<ChainVerification>;
+    /**
+     * Check whether agents are currently paused due to detected tampering.
+     */
+    isPaused(): boolean;
+    /**
+     * Clear the paused state (called when a T2 reviewer appends chain.cleared).
+     */
+    clearPause(): void;
+    private _runCycle;
+    private _hmacSign;
+    private _emitVerified;
+    private _emitTamperDetected;
+    private _emitAgentPaused;
+    private _emit;
+}
+/**
+ * Resolve the effective interval given a requested value and active pack IDs.
+ * HIPAA/HITECH floor: 60 000 ms.
+ * SOC 2 floor: 300 000 ms.
+ * Any attempt to set an interval above the pack floor is silently clamped down.
+ *
+ * @throws PolicyWeakeningRefusedError if requestedMs exceeds the pack floor
+ *         and the caller explicitly opted into strict mode.
+ */
+export declare function resolveChainVerificationInterval(requestedMs: number, activePackIds: string[]): number;
+export declare class PolicyWeakeningRefusedError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=chain-tamper-detector.d.ts.map

package/dist/audit/chain-tamper-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-tamper-detector.d.ts","sourceRoot":"","sources":["../../src/audit/chain-tamper-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAM/C,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,cAAc,CAAC;IAC/B,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,oCAAoC;AACpC,eAAO,MAAM,sBAAsB,SAAU,CAAC;AAM9C,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAsC;IAC1D,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,MAAM,CAAkB;gBAEpB,MAAM,EAAE,yBAAyB;IAQ7C;;;OAGG;IACH,KAAK,IAAI,IAAI;IAYb;;OAEG;IACH,IAAI,IAAI,IAAI;IAOZ;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC;IA0B7C;;OAEG;IACH,QAAQ,IAAI,OAAO;IAInB;;OAEG;IACH,UAAU,IAAI,IAAI;YAQJ,SAAS;IAgBvB,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,aAAa;IAerB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,KAAK;CAcd;AAMD;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EAAE,GACtB,MAAM,CAwBR;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B"}