@connexum/ai-governance 1.0.0-beta.11

package/dist/audit/report-templates/hipaa-security-incident.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hipaa-security-incident.js","sourceRoot":"","sources":["../../../src/audit/report-templates/hipaa-security-incident.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;AAIH,MAAM,oBAAoB,GAAG;;;;;;CAM5B,CAAC,IAAI,EAAE,CAAC;AAEI,QAAA,gCAAgC,GAAmB;IAC9D,UAAU,EAAE,gCAAgC;IAC5C,IAAI,EAAE,uDAAuD;IAC7D,SAAS,EAAE,OAAO;IAClB,uBAAuB,EAAE;QACvB,oBAAoB;QACpB,2BAA2B;QAC3B,oBAAoB;KACrB;IACD,cAAc,EAAE,KAAK;IACrB,mBAAmB,EAAE,IAAI;IAEzB,QAAQ,EAAE;QACR;YACE,EAAE,EAAE,kCAAkC;YACtC,KAAK,EAAE,kEAAkE;YACzE,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;EAiBpB,oBAAoB;;;;CAIrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,kEAAkE;YACzE,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;;EAmBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,KAAK,EAAE,yDAAyD;YAChE,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;EAepB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,yCAAyC;YAChD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;EAapB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,KAAK,EAAE,0DAA0D;YACjE,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;EAYpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;KACF;CACF,CAAC"}

package/dist/audit/report-templates/index.d.ts

@@ -0,0 +1,86 @@
+/**
+ * P4-AIR-02: Per-Framework Report Templates -- barrel export
+ *
+ * Eight shipping templates covering SOC 2, HIPAA (breach + security),
+ * EU AI Act Annex IV, DORA ICT major incident, PCI DSS, GDPR, and
+ * ISO 42001.
+ *
+ * Each template implements the ReportTemplate interface and is registered
+ * in a compile-time map keyed by templateId.
+ *
+ * Spec: P4-AIR-02 AC 4-6
+ *
+ * @connexum/ai-governance
+ */
+export interface TemplateSectionSpec {
+    /** Stable section identifier within this template */
+    id: string;
+    /** Human-readable section title for the rendered report */
+    title: string;
+    /**
+     * LLM prompt template (> 200 chars) that the AuditNarrativeGenerator
+     * fills with audit-chain context. Must instruct the model NOT to make
+     * unbacked claims and to cite event IDs from the provided list only.
+     */
+    promptTemplate: string;
+    /**
+     * 'required' -- UncitedClaimError fires on any AI-generated claim without
+     * a cited chain event. 'optional' -- citations are encouraged but the
+     * rendered section is accepted without them (for procedural/statutory text).
+     */
+    citationRequirement: 'required' | 'optional';
+}
+/**
+ * ReportTemplate -- the shape every framework template must satisfy.
+ *
+ * Exported as part of @connexum/ai-governance/reporting (AC 24).
+ */
+export interface ReportTemplate {
+    /** Stable template ID. Naming convention: tpl-<framework>-<variant>-v<n> */
+    templateId: string;
+    /** Human-readable report name */
+    name: string;
+    /** Pack ID this template is scoped to (matches CompliancePack.id) */
+    framework: string;
+    /**
+     * Audit event types that must have at least one occurrence in the
+     * reporting window. validateEvidence() throws MissingEvidenceError
+     * if any type has zero occurrences.
+     */
+    requiredAuditEventTypes: string[];
+    /** Five to ten sections, each driven by an LLM prompt template */
+    sections: TemplateSectionSpec[];
+    /** Canonical artefact output format */
+    artefactFormat: 'pdf' | 'html' | 'both';
+    /**
+     * When true, the rendered report must carry a legal-review watermark
+     * and the API response sets legalReviewPending: true until a legal
+     * reviewer approves it.
+     */
+    legalReviewRequired: boolean;
+}
+export { type FrameworkPromptSection, type FrameworkPromptSpec, HIPAA_PROMPT_SPEC, HITECH_PROMPT_SPEC, SOC2_PROMPT_SPEC, ISO27001_PROMPT_SPEC, EU_AI_ACT_PROMPT_SPEC, DORA_PROMPT_SPEC, PCI_DSS_PROMPT_SPEC, GDPR_PROMPT_SPEC, FRAMEWORK_PROMPT_REGISTRY, } from './prompts/index.js';
+export { SOC2_TYPE_II_TEMPLATE } from './soc2-type-ii.js';
+export { HIPAA_BREACH_NOTIFICATION_TEMPLATE } from './hipaa-breach-notification.js';
+export { HIPAA_SECURITY_INCIDENT_TEMPLATE } from './hipaa-security-incident.js';
+export { EU_AI_ACT_ANNEX_IV_TEMPLATE } from './eu-ai-act-annex-iv.js';
+export { DORA_ICT_MAJOR_INCIDENT_TEMPLATE } from './dora-ict-major-incident.js';
+export { PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE } from './pci-dss-annual-attestation.js';
+export { GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE } from './gdpr-data-subject-rights.js';
+export { ISO_42001_AMS_TEMPLATE } from './iso-42001-ams.js';
+import type { AuditChainEvent } from '../narrative-types.js';
+export declare const REPORT_TEMPLATE_REGISTRY: ReadonlyMap<string, ReportTemplate>;
+/**
+ * Verify that every required audit event type for a template has at least
+ * one occurrence in the supplied event set.
+ *
+ * Throws MissingEvidenceError (fail-closed) before any LLM call is made.
+ * Callers should invoke this immediately after loading events from the
+ * audit chain and before passing events to AuditNarrativeGenerator.
+ *
+ * @param templateId - Identifies the template whose requirements to check
+ * @param events     - Events retrieved from the audit chain for the window
+ * @throws MissingEvidenceError if any required type has zero occurrences
+ */
+export declare function validateEvidence(templateId: string, events: AuditChainEvent[]): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/report-templates/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/report-templates/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,mBAAmB,EAAE,UAAU,GAAG,UAAU,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,kEAAkE;IAClE,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,uCAAuC;IACvC,cAAc,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IACxC;;;;OAIG;IACH,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAMD,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAM5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,kCAAkC,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EAAE,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAc5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAUrE,CAAC;AAML;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,eAAe,EAAE,GACxB,IAAI,CAyBN"}

package/dist/audit/report-templates/index.js

@@ -0,0 +1,114 @@
+"use strict";
+/**
+ * P4-AIR-02: Per-Framework Report Templates -- barrel export
+ *
+ * Eight shipping templates covering SOC 2, HIPAA (breach + security),
+ * EU AI Act Annex IV, DORA ICT major incident, PCI DSS, GDPR, and
+ * ISO 42001.
+ *
+ * Each template implements the ReportTemplate interface and is registered
+ * in a compile-time map keyed by templateId.
+ *
+ * Spec: P4-AIR-02 AC 4-6
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REPORT_TEMPLATE_REGISTRY = exports.ISO_42001_AMS_TEMPLATE = exports.GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE = exports.PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE = exports.DORA_ICT_MAJOR_INCIDENT_TEMPLATE = exports.EU_AI_ACT_ANNEX_IV_TEMPLATE = exports.HIPAA_SECURITY_INCIDENT_TEMPLATE = exports.HIPAA_BREACH_NOTIFICATION_TEMPLATE = exports.SOC2_TYPE_II_TEMPLATE = exports.FRAMEWORK_PROMPT_REGISTRY = exports.GDPR_PROMPT_SPEC = exports.PCI_DSS_PROMPT_SPEC = exports.DORA_PROMPT_SPEC = exports.EU_AI_ACT_PROMPT_SPEC = exports.ISO27001_PROMPT_SPEC = exports.SOC2_PROMPT_SPEC = exports.HITECH_PROMPT_SPEC = exports.HIPAA_PROMPT_SPEC = void 0;
+exports.validateEvidence = validateEvidence;
+// ---------------------------------------------------------------------------
+// Per-framework narrative prompt specs (P4-AIR-02)
+// ---------------------------------------------------------------------------
+var index_js_1 = require("./prompts/index.js");
+Object.defineProperty(exports, "HIPAA_PROMPT_SPEC", { enumerable: true, get: function () { return index_js_1.HIPAA_PROMPT_SPEC; } });
+Object.defineProperty(exports, "HITECH_PROMPT_SPEC", { enumerable: true, get: function () { return index_js_1.HITECH_PROMPT_SPEC; } });
+Object.defineProperty(exports, "SOC2_PROMPT_SPEC", { enumerable: true, get: function () { return index_js_1.SOC2_PROMPT_SPEC; } });
+Object.defineProperty(exports, "ISO27001_PROMPT_SPEC", { enumerable: true, get: function () { return index_js_1.ISO27001_PROMPT_SPEC; } });
+Object.defineProperty(exports, "EU_AI_ACT_PROMPT_SPEC", { enumerable: true, get: function () { return index_js_1.EU_AI_ACT_PROMPT_SPEC; } });
+Object.defineProperty(exports, "DORA_PROMPT_SPEC", { enumerable: true, get: function () { return index_js_1.DORA_PROMPT_SPEC; } });
+Object.defineProperty(exports, "PCI_DSS_PROMPT_SPEC", { enumerable: true, get: function () { return index_js_1.PCI_DSS_PROMPT_SPEC; } });
+Object.defineProperty(exports, "GDPR_PROMPT_SPEC", { enumerable: true, get: function () { return index_js_1.GDPR_PROMPT_SPEC; } });
+Object.defineProperty(exports, "FRAMEWORK_PROMPT_REGISTRY", { enumerable: true, get: function () { return index_js_1.FRAMEWORK_PROMPT_REGISTRY; } });
+// ---------------------------------------------------------------------------
+// Individual template exports
+// ---------------------------------------------------------------------------
+var soc2_type_ii_js_1 = require("./soc2-type-ii.js");
+Object.defineProperty(exports, "SOC2_TYPE_II_TEMPLATE", { enumerable: true, get: function () { return soc2_type_ii_js_1.SOC2_TYPE_II_TEMPLATE; } });
+var hipaa_breach_notification_js_1 = require("./hipaa-breach-notification.js");
+Object.defineProperty(exports, "HIPAA_BREACH_NOTIFICATION_TEMPLATE", { enumerable: true, get: function () { return hipaa_breach_notification_js_1.HIPAA_BREACH_NOTIFICATION_TEMPLATE; } });
+var hipaa_security_incident_js_1 = require("./hipaa-security-incident.js");
+Object.defineProperty(exports, "HIPAA_SECURITY_INCIDENT_TEMPLATE", { enumerable: true, get: function () { return hipaa_security_incident_js_1.HIPAA_SECURITY_INCIDENT_TEMPLATE; } });
+var eu_ai_act_annex_iv_js_1 = require("./eu-ai-act-annex-iv.js");
+Object.defineProperty(exports, "EU_AI_ACT_ANNEX_IV_TEMPLATE", { enumerable: true, get: function () { return eu_ai_act_annex_iv_js_1.EU_AI_ACT_ANNEX_IV_TEMPLATE; } });
+var dora_ict_major_incident_js_1 = require("./dora-ict-major-incident.js");
+Object.defineProperty(exports, "DORA_ICT_MAJOR_INCIDENT_TEMPLATE", { enumerable: true, get: function () { return dora_ict_major_incident_js_1.DORA_ICT_MAJOR_INCIDENT_TEMPLATE; } });
+var pci_dss_annual_attestation_js_1 = require("./pci-dss-annual-attestation.js");
+Object.defineProperty(exports, "PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE", { enumerable: true, get: function () { return pci_dss_annual_attestation_js_1.PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE; } });
+var gdpr_data_subject_rights_js_1 = require("./gdpr-data-subject-rights.js");
+Object.defineProperty(exports, "GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE", { enumerable: true, get: function () { return gdpr_data_subject_rights_js_1.GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE; } });
+var iso_42001_ams_js_1 = require("./iso-42001-ams.js");
+Object.defineProperty(exports, "ISO_42001_AMS_TEMPLATE", { enumerable: true, get: function () { return iso_42001_ams_js_1.ISO_42001_AMS_TEMPLATE; } });
+// ---------------------------------------------------------------------------
+// Registry -- all 8 templates keyed by templateId
+// ---------------------------------------------------------------------------
+const soc2_type_ii_js_2 = require("./soc2-type-ii.js");
+const hipaa_breach_notification_js_2 = require("./hipaa-breach-notification.js");
+const hipaa_security_incident_js_2 = require("./hipaa-security-incident.js");
+const eu_ai_act_annex_iv_js_2 = require("./eu-ai-act-annex-iv.js");
+const dora_ict_major_incident_js_2 = require("./dora-ict-major-incident.js");
+const pci_dss_annual_attestation_js_2 = require("./pci-dss-annual-attestation.js");
+const gdpr_data_subject_rights_js_2 = require("./gdpr-data-subject-rights.js");
+const iso_42001_ams_js_2 = require("./iso-42001-ams.js");
+const narrative_types_js_1 = require("../narrative-types.js");
+exports.REPORT_TEMPLATE_REGISTRY = new Map([
+    [soc2_type_ii_js_2.SOC2_TYPE_II_TEMPLATE.templateId, soc2_type_ii_js_2.SOC2_TYPE_II_TEMPLATE],
+    [hipaa_breach_notification_js_2.HIPAA_BREACH_NOTIFICATION_TEMPLATE.templateId, hipaa_breach_notification_js_2.HIPAA_BREACH_NOTIFICATION_TEMPLATE],
+    [hipaa_security_incident_js_2.HIPAA_SECURITY_INCIDENT_TEMPLATE.templateId, hipaa_security_incident_js_2.HIPAA_SECURITY_INCIDENT_TEMPLATE],
+    [eu_ai_act_annex_iv_js_2.EU_AI_ACT_ANNEX_IV_TEMPLATE.templateId, eu_ai_act_annex_iv_js_2.EU_AI_ACT_ANNEX_IV_TEMPLATE],
+    [dora_ict_major_incident_js_2.DORA_ICT_MAJOR_INCIDENT_TEMPLATE.templateId, dora_ict_major_incident_js_2.DORA_ICT_MAJOR_INCIDENT_TEMPLATE],
+    [pci_dss_annual_attestation_js_2.PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE.templateId, pci_dss_annual_attestation_js_2.PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE],
+    [gdpr_data_subject_rights_js_2.GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE.templateId, gdpr_data_subject_rights_js_2.GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE],
+    [iso_42001_ams_js_2.ISO_42001_AMS_TEMPLATE.templateId, iso_42001_ams_js_2.ISO_42001_AMS_TEMPLATE],
+]);
+// ---------------------------------------------------------------------------
+// validateEvidence -- pre-LLM guard (AC 16)
+// ---------------------------------------------------------------------------
+/**
+ * Verify that every required audit event type for a template has at least
+ * one occurrence in the supplied event set.
+ *
+ * Throws MissingEvidenceError (fail-closed) before any LLM call is made.
+ * Callers should invoke this immediately after loading events from the
+ * audit chain and before passing events to AuditNarrativeGenerator.
+ *
+ * @param templateId - Identifies the template whose requirements to check
+ * @param events     - Events retrieved from the audit chain for the window
+ * @throws MissingEvidenceError if any required type has zero occurrences
+ */
+function validateEvidence(templateId, events) {
+    const template = exports.REPORT_TEMPLATE_REGISTRY.get(templateId);
+    if (!template) {
+        throw new Error(`Unknown templateId: "${templateId}"`);
+    }
+    const presentTypes = new Set(events.map((e) => e.type));
+    // Support prefix wildcards: 'security:incident:*' matches any type starting
+    // with 'security:incident:'
+    const missing = [];
+    for (const required of template.requiredAuditEventTypes) {
+        const isWildcard = required.endsWith(':*');
+        if (isWildcard) {
+            const prefix = required.slice(0, -1); // strip trailing '*'
+            const found = [...presentTypes].some((t) => t.startsWith(prefix));
+            if (!found)
+                missing.push(required);
+        }
+        else {
+            if (!presentTypes.has(required))
+                missing.push(required);
+        }
+    }
+    if (missing.length > 0) {
+        throw new narrative_types_js_1.MissingEvidenceError(missing, template.framework);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/audit/report-templates/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/report-templates/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAiIH,4CA4BC;AAtGD,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,+CAY4B;AAT1B,6GAAA,iBAAiB,OAAA;AACjB,8GAAA,kBAAkB,OAAA;AAClB,4GAAA,gBAAgB,OAAA;AAChB,gHAAA,oBAAoB,OAAA;AACpB,iHAAA,qBAAqB,OAAA;AACrB,4GAAA,gBAAgB,OAAA;AAChB,+GAAA,mBAAmB,OAAA;AACnB,4GAAA,gBAAgB,OAAA;AAChB,qHAAA,yBAAyB,OAAA;AAG3B,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,qDAA0D;AAAjD,wHAAA,qBAAqB,OAAA;AAC9B,+EAAoF;AAA3E,kJAAA,kCAAkC,OAAA;AAC3C,2EAAgF;AAAvE,8IAAA,gCAAgC,OAAA;AACzC,iEAAsE;AAA7D,oIAAA,2BAA2B,OAAA;AACpC,2EAAgF;AAAvE,8IAAA,gCAAgC,OAAA;AACzC,iFAAsF;AAA7E,oJAAA,mCAAmC,OAAA;AAC5C,6EAAkF;AAAzE,gJAAA,iCAAiC,OAAA;AAC1C,uDAA4D;AAAnD,0HAAA,sBAAsB,OAAA;AAE/B,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,uDAA0D;AAC1D,iFAAoF;AACpF,6EAAgF;AAChF,mEAAsE;AACtE,6EAAgF;AAChF,mFAAsF;AACtF,+EAAkF;AAClF,yDAA4D;AAE5D,8DAA6D;AAEhD,QAAA,wBAAwB,GACnC,IAAI,GAAG,CAAC;IACN,CAAC,uCAAqB,CAAC,UAAU,EAAE,uCAAqB,CAAC;IACzD,CAAC,iEAAkC,CAAC,UAAU,EAAE,iEAAkC,CAAC;IACnF,CAAC,6DAAgC,CAAC,UAAU,EAAE,6DAAgC,CAAC;IAC/E,CAAC,mDAA2B,CAAC,UAAU,EAAE,mDAA2B,CAAC;IACrE,CAAC,6DAAgC,CAAC,UAAU,EAAE,6DAAgC,CAAC;IAC/E,CAAC,mEAAmC,CAAC,UAAU,EAAE,mEAAmC,CAAC;IACrF,CAAC,+DAAiC,CAAC,UAAU,EAAE,+DAAiC,CAAC;IACjF,CAAC,yCAAsB,CAAC,UAAU,EAAE,yCAAsB,CAAC;CAC5D,CAAC,CAAC;AAEL,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAC9B,UAAkB,EAClB,MAAyB;IAEzB,MAAM,QAAQ,GAAG,gCAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,GAAG,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAExD,4EAA4E;IAC5E,4BAA4B;IAC5B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,uBAAuB,EAAE,CAAC;QACxD,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB;YAC3D,MAAM,KAAK,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,yCAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/dist/audit/report-templates/iso-42001-ams.d.ts

@@ -0,0 +1,36 @@
+/**
+ * ISO 42001 AI Management System Evidence Template
+ *
+ * ISO/IEC 42001:2023 -- Information technology. AI management system (AIMS).
+ * Requirements for organisations providing or using AI systems to manage AI
+ * responsibly and ethically. Aligns with the PDCA (Plan-Do-Check-Act) cycle
+ * common to all ISO management-system standards.
+ *
+ * This template generates evidence documentation for the major clauses of
+ * ISO 42001 as observed through the AI governance audit chain.
+ *
+ * Regulatory references:
+ *   ISO/IEC 42001:2023, Clause 4 -- Context of the organisation
+ *   ISO/IEC 42001:2023, Clause 5 -- Leadership
+ *   ISO/IEC 42001:2023, Clause 6 -- Planning
+ *   ISO/IEC 42001:2023, Clause 7 -- Support
+ *   ISO/IEC 42001:2023, Clause 8 -- Operation
+ *   ISO/IEC 42001:2023, Clause 9 -- Performance evaluation
+ *   ISO/IEC 42001:2023, Clause 10 -- Improvement
+ *   ISO/IEC 42001:2023, Annex A -- Reference control objectives (AI-specific)
+ *   ISO/IEC TR 24028 -- Trustworthiness in AI
+ *   ISO/IEC 42006:2024 -- Requirements for certification bodies for AI
+ *
+ * Required audit event types:
+ *   agent:registered       -- AI system inventory (Clause 8 operation)
+ *   policy:snapshot        -- AIMS policy documentation (Clause 5 leadership)
+ *   governance:verdict     -- Control effectiveness evidence (Clause 9)
+ *   retention:job-completed -- Records management (Clause 7.5 documented information)
+ *
+ * Spec: P4-AIR-02 item 8
+ *
+ * @connexum/ai-governance
+ */
+import type { ReportTemplate } from './index.js';
+export declare const ISO_42001_AMS_TEMPLATE: ReportTemplate;
+//# sourceMappingURL=iso-42001-ams.d.ts.map

package/dist/audit/report-templates/iso-42001-ams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iso-42001-ams.d.ts","sourceRoot":"","sources":["../../../src/audit/report-templates/iso-42001-ams.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAWjD,eAAO,MAAM,sBAAsB,EAAE,cAyNpC,CAAC"}

package/dist/audit/report-templates/iso-42001-ams.js

@@ -0,0 +1,262 @@
+"use strict";
+/**
+ * ISO 42001 AI Management System Evidence Template
+ *
+ * ISO/IEC 42001:2023 -- Information technology. AI management system (AIMS).
+ * Requirements for organisations providing or using AI systems to manage AI
+ * responsibly and ethically. Aligns with the PDCA (Plan-Do-Check-Act) cycle
+ * common to all ISO management-system standards.
+ *
+ * This template generates evidence documentation for the major clauses of
+ * ISO 42001 as observed through the AI governance audit chain.
+ *
+ * Regulatory references:
+ *   ISO/IEC 42001:2023, Clause 4 -- Context of the organisation
+ *   ISO/IEC 42001:2023, Clause 5 -- Leadership
+ *   ISO/IEC 42001:2023, Clause 6 -- Planning
+ *   ISO/IEC 42001:2023, Clause 7 -- Support
+ *   ISO/IEC 42001:2023, Clause 8 -- Operation
+ *   ISO/IEC 42001:2023, Clause 9 -- Performance evaluation
+ *   ISO/IEC 42001:2023, Clause 10 -- Improvement
+ *   ISO/IEC 42001:2023, Annex A -- Reference control objectives (AI-specific)
+ *   ISO/IEC TR 24028 -- Trustworthiness in AI
+ *   ISO/IEC 42006:2024 -- Requirements for certification bodies for AI
+ *
+ * Required audit event types:
+ *   agent:registered       -- AI system inventory (Clause 8 operation)
+ *   policy:snapshot        -- AIMS policy documentation (Clause 5 leadership)
+ *   governance:verdict     -- Control effectiveness evidence (Clause 9)
+ *   retention:job-completed -- Records management (Clause 7.5 documented information)
+ *
+ * Spec: P4-AIR-02 item 8
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ISO_42001_AMS_TEMPLATE = void 0;
+const CITATION_INSTRUCTION = `
+MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
+audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
+event IDs from the AVAILABLE EVENTS list. If evidence is absent for an ISO
+42001 clause requirement, write "Evidence not available in audit chain; the
+organisation must supplement with documented information per ISO 42001 Clause
+7.5." Never invent event IDs.
+`.trim();
+exports.ISO_42001_AMS_TEMPLATE = {
+    templateId: 'tpl-iso-42001-ams-v1',
+    name: 'ISO 42001 AI Management System Evidence Report',
+    framework: 'iso-42001',
+    requiredAuditEventTypes: [
+        'agent:registered',
+        'policy:snapshot',
+        'governance:verdict',
+        'retention:job-completed',
+    ],
+    artefactFormat: 'both',
+    legalReviewRequired: false,
+    sections: [
+        {
+            id: 'iso42001-clause4-context',
+            title: 'Clause 4: Context of the Organisation',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the Clause 4 (Context of the Organisation) section for an ISO
+42001:2023 AI Management System evidence report.
+
+ISO 42001 Clause 4 requires the organisation to:
+  4.1 Understand the organisation and its context (internal/external factors)
+  4.2 Understand the needs of interested parties
+  4.3 Determine the scope of the AI management system
+  4.4 AI management system
+  4.5 AI policy (reference to leadership commitment)
+
+Using ONLY the audit-chain events provided, describe:
+1. The AI systems in scope: agent:registered events during the review period
+   establishing which AI agents are within the AIMS boundary.
+2. The governance policy framework: policy:snapshot events establishing that
+   a documented AI policy is in place and was current during the period.
+3. Evidence that the scope includes all relevant AI agent types (different
+   registration categories observed in the chain).
+4. External context: LLM provider diversity as evidenced by governance verdicts
+   from different provider adapters.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs aligned with ISO 42001 clause language.
+`.trim(),
+        },
+        {
+            id: 'iso42001-clause6-planning',
+            title: 'Clause 6: Planning -- Risks and AI Impact Assessment',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the Clause 6 (Planning) section for an ISO 42001:2023 AI
+Management System evidence report.
+
+ISO 42001 Clause 6 requires:
+  6.1 Actions to address risks and opportunities
+  6.1.2 AI risk assessment -- identification of AI-specific risks
+  6.1.3 AI risk treatment
+  6.2 AI objectives and planning to achieve them
+  6.3 Planning of changes
+
+For AI governance, risk planning is evidenced through:
+  - Compliance pack bindings (which risk domains are actively governed)
+  - Policy configurations (how risks are addressed in the governance policy)
+  - Change management: how AI system changes are planned and approved
+
+Using ONLY the audit-chain events provided, describe:
+1. AI risk events identified during the period (anomalies, denials, violations)
+   demonstrating that risk identification is ongoing and effective.
+2. Risk treatment effectiveness: the ratio of denied vs. allowed actions as an
+   indicator of policy-based risk treatment.
+3. Policy changes during the period and their planning/approval evidence.
+4. Any unmitigated risks (recurring violation patterns without remediation events).
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'iso42001-clause8-operation',
+            title: 'Clause 8: Operation -- AI System Lifecycle Management',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the Clause 8 (Operation) section for an ISO 42001:2023 AI
+Management System evidence report.
+
+ISO 42001 Clause 8 requires:
+  8.2 AI risk assessment (operational application)
+  8.3 AI risk treatment (operational controls)
+  8.4 Documentation of AI systems (system register)
+  8.5 Human oversight of AI systems
+  8.6 Responsibilities related to AI systems
+
+Annex A (control objectives) includes:
+  A.3.2 -- AI system lifecycle documentation
+  A.5.1 -- Policies for AI development and use
+  A.6.1 -- Responsible AI use policies
+  A.8.1 -- AI system impact assessment
+
+Using ONLY the audit-chain events provided, describe:
+1. AI system register: agent:registered events constituting the operational AI
+   system inventory maintained by the governance platform.
+2. Human oversight evidence: approval events demonstrating Clause 8.5 controls
+   were exercised, including escalation events.
+3. Operational risk controls: governance verdict events showing active enforcement.
+4. Any AI system lifecycle events (decommissions, version changes) evidenced in
+   the chain.
+
+${CITATION_INSTRUCTION}
+
+Write 4-6 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'iso42001-clause9-evaluation',
+            title: 'Clause 9: Performance Evaluation -- Monitoring and Audit',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the Clause 9 (Performance Evaluation) section for an ISO
+42001:2023 AI Management System evidence report.
+
+ISO 42001 Clause 9 requires:
+  9.1 Monitoring, measurement, analysis, and evaluation
+  9.2 Internal audit of the AI management system
+  9.3 Management review
+
+Clause 9.1 requires the organisation to determine:
+  (a) What needs to be monitored and measured
+  (b) Methods for monitoring and measurement
+  (c) When monitoring is performed and results analysed
+  (d) Who performs the monitoring
+
+Using ONLY the audit-chain events provided, describe:
+1. Monitoring coverage: volume and types of governance events captured during
+   the period demonstrating continuous monitoring.
+2. Key metrics: total verdicts, deny rate, approval rate, escalation rate,
+   anomaly detection rate -- calculated from chain event evidence.
+3. Evidence of management review: high-level approval or sign-off events
+   suggesting leadership engagement with AI governance data.
+4. Audit trail completeness: retention:job-completed events confirming that
+   audit records were managed and retained.
+5. Any monitoring gaps: time periods with no governance events (potential
+   monitoring failures or agent inactivity).
+
+${CITATION_INSTRUCTION}
+
+Write 4-6 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'iso42001-clause10-improvement',
+            title: 'Clause 10: Improvement -- Corrective Actions',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the Clause 10 (Improvement) section for an ISO 42001:2023 AI
+Management System evidence report.
+
+ISO 42001 Clause 10 requires:
+  10.1 Continual improvement of the AIMS
+  10.2 Nonconformity and corrective action (identify and address root causes)
+
+Clause 10.2 requires the organisation to:
+  (a) React to nonconformities and take action to control and correct
+  (b) Evaluate the need for actions to eliminate root causes
+  (c) Implement needed actions
+  (d) Review effectiveness of corrective actions
+  (e) Update risks and opportunities
+  (f) Make changes to the AIMS if necessary
+
+Using ONLY the audit-chain events provided, describe:
+1. Nonconformities identified during the period: policy violations, anomalies,
+   and governance denials that indicate AIMS gaps.
+2. Corrective actions: policy changes (policy:snapshot events) made in response
+   to observed nonconformities.
+3. Evidence of corrective action effectiveness: whether violation rates decreased
+   after policy updates.
+4. Continual improvement indicators: new capabilities registered, policy
+   refinements, approval workflow improvements evidenced in the chain.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'iso42001-annex-a-controls',
+            title: 'Annex A Reference Controls Evidence',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the Annex A Reference Controls section for an ISO 42001:2023
+AI Management System evidence report.
+
+ISO 42001 Annex A defines control objectives across seven domains:
+  A.3 -- Policies
+  A.4 -- Internal organisation
+  A.5 -- Resources
+  A.6 -- Assessing impacts of AI systems
+  A.7 -- AI system lifecycle
+  A.8 -- Data for AI systems
+  A.9 -- Information for interested parties about AI systems
+  A.10 -- Responsible use of AI
+
+For each domain, provide evidence from the audit chain:
+1. A.3 (Policies): policy:snapshot events confirming documented, version-controlled AI policies.
+2. A.6 (Impact assessment): governance verdict patterns demonstrating ongoing impact monitoring.
+3. A.7 (Lifecycle): agent:registered events and decommission events covering the full AI lifecycle.
+4. A.9 (Transparency): evidence that governance events are recorded for disclosure to stakeholders.
+5. A.10 (Responsible use): human approval events demonstrating responsible oversight controls.
+
+For Annex A controls without audit-chain evidence, note that the organisation
+must maintain documentary evidence outside the AI governance platform.
+
+${CITATION_INSTRUCTION}
+
+Write 4-6 formal paragraphs.
+`.trim(),
+        },
+    ],
+};
+//# sourceMappingURL=iso-42001-ams.js.map

package/dist/audit/report-templates/iso-42001-ams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iso-42001-ams.js","sourceRoot":"","sources":["../../../src/audit/report-templates/iso-42001-ams.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;;;AAIH,MAAM,oBAAoB,GAAG;;;;;;;CAO5B,CAAC,IAAI,EAAE,CAAC;AAEI,QAAA,sBAAsB,GAAmB;IACpD,UAAU,EAAE,sBAAsB;IAClC,IAAI,EAAE,gDAAgD;IACtD,SAAS,EAAE,WAAW;IACtB,uBAAuB,EAAE;QACvB,kBAAkB;QAClB,iBAAiB;QACjB,oBAAoB;QACpB,yBAAyB;KAC1B;IACD,cAAc,EAAE,MAAM;IACtB,mBAAmB,EAAE,KAAK;IAE1B,QAAQ,EAAE;QACR;YACE,EAAE,EAAE,0BAA0B;YAC9B,KAAK,EAAE,uCAAuC;YAC9C,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;EAqBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,KAAK,EAAE,sDAAsD;YAC7D,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;;;;EAwBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,KAAK,EAAE,uDAAuD;YAC9D,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;EA0BpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,KAAK,EAAE,0DAA0D;YACjE,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,+BAA+B;YACnC,KAAK,EAAE,8CAA8C;YACrD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;EA0BpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,KAAK,EAAE,qCAAqC;YAC5C,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;;;;EAwBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;KACF;CACF,CAAC"}

package/dist/audit/report-templates/pci-dss-annual-attestation.d.ts

@@ -0,0 +1,33 @@
+/**
+ * PCI DSS Annual Attestation Digest Template
+ *
+ * Generates a 12-month evidence digest supporting the Annual Report on
+ * Compliance (ROC) or Self-Assessment Questionnaire (SAQ). This template
+ * produces the AI-governance evidence layer -- not a substitute for the
+ * full QSA-validated ROC, but the section documenting AI agent controls
+ * within the Cardholder Data Environment (CDE).
+ *
+ * The 12-month window is structural and enforced at render time.
+ * Approval events must be scoped to security-reviewer tier per PCI DSS
+ * Requirements 6, 8, and 12 change-approval obligations.
+ *
+ * Regulatory references:
+ *   PCI DSS v4.0.1 -- Payment Card Industry Data Security Standard
+ *   PCI DSS v4.0.1 Requirement 1: Network Security Controls
+ *   PCI DSS v4.0.1 Requirement 6: Secure Systems and Software (change management)
+ *   PCI DSS v4.0.1 Requirement 8: Identify Users and Authenticate Access
+ *   PCI DSS v4.0.1 Requirement 10: Log and Monitor All Access to System Components
+ *   PCI DSS v4.0.1 Requirement 12: Support Information Security with Policies
+ *   PCI SSC Guidance on AI Tools in the CDE (2024)
+ *
+ * Required audit event types:
+ *   governance:verdict -- enforcement decisions (Req. 10 logging)
+ *   approval:decided   -- change approvals (Req. 6 + 12, security-reviewer tier)
+ *
+ * Spec: P4-AIR-02 item 6
+ *
+ * @connexum/ai-governance
+ */
+import type { ReportTemplate } from './index.js';
+export declare const PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE: ReportTemplate;
+//# sourceMappingURL=pci-dss-annual-attestation.d.ts.map

package/dist/audit/report-templates/pci-dss-annual-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pci-dss-annual-attestation.d.ts","sourceRoot":"","sources":["../../../src/audit/report-templates/pci-dss-annual-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAiBjD,eAAO,MAAM,mCAAmC,EAAE,cAoKjD,CAAC"}