@connexum/ai-governance 1.0.0-beta.11

package/dist/audit/report-templates/prompts/soc2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"soc2.js","sourceRoot":"","sources":["../../../../src/audit/report-templates/prompts/soc2.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAKU,QAAA,gBAAgB,GAAwB;IACnD,WAAW,EAAE,MAAM;IACnB,aAAa,EAAE,eAAe;IAC9B,OAAO,EAAE,sDAAsD;IAC/D,QAAQ,EAAE;QACR;YACE,SAAS,EAAE,8BAA8B;YACzC,OAAO,EAAE,yBAAyB;YAClC,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;YAC9D,eAAe,EAAE;gBACf,uEAAuE;gBACvE,gEAAgE;gBAChE,oEAAoE;gBACpE,qDAAqD;gBACrD,gEAAgE;aACjE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,iFAAiF;gBACjF,iFAAiF;gBACjF,mFAAmF;gBACnF,kFAAkF;gBAClF,2EAA2E;SAC9E;QACD;YACE,SAAS,EAAE,wBAAwB;YACnC,OAAO,EAAE,mCAAmC;YAC5C,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;YAC5D,eAAe,EAAE;gBACf,iEAAiE;gBACjE,2EAA2E;gBAC3E,wEAAwE;aACzE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,gFAAgF;gBAChF,uFAAuF;gBACvF,uFAAuF;gBACvF,0DAA0D;SAC7D;QACD;YACE,SAAS,EAAE,yBAAyB;YACpC,OAAO,EAAE,0CAA0C;YACnD,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC3D,eAAe,EAAE;gBACf,8DAA8D;gBAC9D,8EAA8E;gBAC9E,4DAA4D;gBAC5D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,yEAAyE;aAC1E;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,oFAAoF;gBACpF,8EAA8E;gBAC9E,iFAAiF;gBACjF,kFAAkF;gBAClF,gFAAgF;gBAChF,wCAAwC;SAC3C;QACD;YACE,SAAS,EAAE,4BAA4B;YACvC,OAAO,EAAE,uBAAuB;YAChC,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;YAC9D,eAAe,EAAE;gBACf,0DAA0D;gBAC1D,wDAAwD;gBACxD,8DAA8D;gBAC9D,oDAAoD;gBACpD,iEAAiE;aAClE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,+EAA+E;gBAC/E,wFAAwF;gBACxF,qFAAqF;gBACrF,2EAA2E;gBAC3E,8EAA8E;SACjF;QACD;YACE,SAAS,EAAE,0BAA0B;YACrC,OAAO,EAAE,qBAAqB;YAC9B,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;YAC9D,eAAe,EAAE;gBACf,oFAAoF;gBACpF,gEAAgE;aACjE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,8EAA8E;gBAC9E,wFAAwF;gBACxF,iFAAiF;gBACjF,kFAAkF;gBAClF,6BAA6B;SAChC;KACF;CACF,CAAC"}

package/dist/audit/report-templates/soc2-type-ii.d.ts

@@ -0,0 +1,23 @@
+/**
+ * SOC 2 Type II Evidence Report Template
+ *
+ * Covers all five Trust Services Criteria (TSC): Security (CC), Availability
+ * (A), Confidentiality (C), Processing Integrity (PI), and Privacy (P).
+ *
+ * SOC 2 Type II attestations require evidence of operating effectiveness
+ * over a defined review period (AICPA AT-C 205). Every section in this
+ * template requires citations -- uncited claims are rejected before the
+ * rendered artefact is returned.
+ *
+ * Regulatory references:
+ *   AICPA Trust Services Criteria 2017 (TSC CC6.1-CC9.2)
+ *   AICPA AT-C Section 205 -- Examination Engagements
+ *   COSO Internal Control -- Integrated Framework 2013
+ *
+ * Spec: P4-AIR-02 item 1
+ *
+ * @connexum/ai-governance
+ */
+import type { ReportTemplate } from './index.js';
+export declare const SOC2_TYPE_II_TEMPLATE: ReportTemplate;
+//# sourceMappingURL=soc2-type-ii.d.ts.map

package/dist/audit/report-templates/soc2-type-ii.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"soc2-type-ii.d.ts","sourceRoot":"","sources":["../../../src/audit/report-templates/soc2-type-ii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAUjD,eAAO,MAAM,qBAAqB,EAAE,cA4JnC,CAAC"}

package/dist/audit/report-templates/soc2-type-ii.js

@@ -0,0 +1,187 @@
+"use strict";
+/**
+ * SOC 2 Type II Evidence Report Template
+ *
+ * Covers all five Trust Services Criteria (TSC): Security (CC), Availability
+ * (A), Confidentiality (C), Processing Integrity (PI), and Privacy (P).
+ *
+ * SOC 2 Type II attestations require evidence of operating effectiveness
+ * over a defined review period (AICPA AT-C 205). Every section in this
+ * template requires citations -- uncited claims are rejected before the
+ * rendered artefact is returned.
+ *
+ * Regulatory references:
+ *   AICPA Trust Services Criteria 2017 (TSC CC6.1-CC9.2)
+ *   AICPA AT-C Section 205 -- Examination Engagements
+ *   COSO Internal Control -- Integrated Framework 2013
+ *
+ * Spec: P4-AIR-02 item 1
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SOC2_TYPE_II_TEMPLATE = void 0;
+const CITATION_INSTRUCTION = `
+MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
+audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
+event IDs from the AVAILABLE EVENTS list supplied in context. If the available
+events do not support a claim, write "Insufficient evidence in the audit window
+to support this assertion." Never fabricate event IDs or invent facts.
+`.trim();
+exports.SOC2_TYPE_II_TEMPLATE = {
+    templateId: 'tpl-soc2-type-ii-v1',
+    name: 'SOC 2 Type II Evidence Report',
+    framework: 'soc2',
+    requiredAuditEventTypes: [
+        'governance:verdict',
+        'approval:decided',
+        'agent:registered',
+    ],
+    artefactFormat: 'pdf',
+    legalReviewRequired: true,
+    sections: [
+        {
+            id: 'soc2-cc6-logical-access',
+            title: 'CC6: Logical and Physical Access Controls',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the CC6 (Logical and Physical Access Controls) section of a
+SOC 2 Type II evidence report for an AI governance platform.
+
+TSC Reference: CC6.1 (prior to granting access), CC6.2 (credentials management),
+CC6.3 (access removal), CC6.6 (network controls), CC6.7 (transmission encryption),
+CC6.8 (malware protection).
+
+Using ONLY the audit-chain events provided, describe:
+1. How AI agent access is granted, provisioned, and revoked (cite registration
+   and de-registration events from the chain).
+2. Evidence that the governance runtime enforced deny decisions for out-of-scope
+   tool invocations during the review period.
+3. Any access anomalies or policy violations detected and the enforcement actions
+   taken.
+4. Quantify: number of access-control events, deny rate, and any escalations.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs suitable for a Type II auditor package. Do not
+include the word "draft" -- this is the authoritative evidence narrative.
+`.trim(),
+        },
+        {
+            id: 'soc2-cc7-monitoring',
+            title: 'CC7: System Operations and Monitoring',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the CC7 (System Operations) section of a SOC 2 Type II report.
+
+TSC Reference: CC7.1 (detection and monitoring), CC7.2 (evaluation of security
+events), CC7.3 (response), CC7.4 (recovery), CC7.5 (post-incident review).
+
+Using ONLY the audit-chain events provided, describe:
+1. Continuous monitoring controls active during the review period, including
+   anomaly detection and circuit-breaker enforcement.
+2. Security events detected, their severity classification, and the response
+   actions taken.
+3. Evidence that monitoring controls operated continuously throughout the period
+   with no material gaps.
+4. Mean time to detect (MTTD) and mean time to respond (MTTR) where evidence
+   permits calculation.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs. Quantify where possible.
+`.trim(),
+        },
+        {
+            id: 'soc2-cc8-change-management',
+            title: 'CC8: Change Management',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the CC8 (Change Management) section of a SOC 2 Type II report.
+
+TSC Reference: CC8.1 (infrastructure and software changes authorised, tested,
+documented, and approved prior to implementation).
+
+Using ONLY the audit-chain events provided, describe:
+1. Evidence that AI agent policy changes (policy snapshots) were recorded and
+   version-controlled in the audit chain.
+2. Approval workflow events confirming that changes requiring human review
+   received documented approvals before taking effect.
+3. Any change failures, rollbacks, or emergency changes and the associated
+   approvals or post-hoc authorisations.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'soc2-cc9-risk-mitigation',
+            title: 'CC9: Risk Mitigation',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the CC9 (Risk Mitigation) section of a SOC 2 Type II report.
+
+TSC Reference: CC9.1 (risk mitigation activities), CC9.2 (vendor and business
+partner risk).
+
+Using ONLY the audit-chain events provided, describe:
+1. Automated risk-mitigation controls enforced by the governance runtime
+   (circuit breakers, approval gates, suspension events).
+2. Evidence of vendor or LLM provider governance: which adapters were active,
+   any provider-specific policy overrides applied.
+3. How the platform's HITL (human-in-the-loop) controls ensure that AI agent
+   risk is continuously mitigated.
+
+${CITATION_INSTRUCTION}
+
+Write 3-5 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'soc2-a1-availability',
+            title: 'A1: Availability',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the A1 (Availability) section of a SOC 2 Type II report.
+
+TSC Reference: A1.1 (capacity planning), A1.2 (environmental threats),
+A1.3 (recovery and continuity testing).
+
+Using ONLY the audit-chain events provided, describe:
+1. Evidence that the governance runtime remained operational throughout the
+   review period (uptime evidence from event timestamps).
+2. Any service interruptions, their duration, and recovery actions taken.
+3. Rate-limiting and circuit-breaker events that demonstrate the system
+   protected availability by preventing runaway agent behaviour.
+
+${CITATION_INSTRUCTION}
+
+Write 3-4 formal paragraphs.
+`.trim(),
+        },
+        {
+            id: 'soc2-pi1-processing-integrity',
+            title: 'PI1: Processing Integrity',
+            citationRequirement: 'required',
+            promptTemplate: `
+You are drafting the PI1 (Processing Integrity) section of a SOC 2 Type II report.
+
+TSC Reference: PI1.1 (complete, valid, accurate, timely processing), PI1.2
+(outputs are complete, accurate, and distributed to authorised parties).
+
+Using ONLY the audit-chain events provided, describe:
+1. Evidence that AI agent governance decisions (ALLOW/DENY/REQUIRE_APPROVAL)
+   were recorded completely and with integrity in the tamper-evident chain.
+2. Any detected chain-integrity violations or hash mismatches and their
+   resolution.
+3. Completeness of audit records relative to agent activity during the window.
+
+${CITATION_INSTRUCTION}
+
+Write 3-4 formal paragraphs.
+`.trim(),
+        },
+    ],
+};
+//# sourceMappingURL=soc2-type-ii.js.map

package/dist/audit/report-templates/soc2-type-ii.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"soc2-type-ii.js","sourceRoot":"","sources":["../../../src/audit/report-templates/soc2-type-ii.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AAIH,MAAM,oBAAoB,GAAG;;;;;;CAM5B,CAAC,IAAI,EAAE,CAAC;AAEI,QAAA,qBAAqB,GAAmB;IACnD,UAAU,EAAE,qBAAqB;IACjC,IAAI,EAAE,+BAA+B;IACrC,SAAS,EAAE,MAAM;IACjB,uBAAuB,EAAE;QACvB,oBAAoB;QACpB,kBAAkB;QAClB,kBAAkB;KACnB;IACD,cAAc,EAAE,KAAK;IACrB,mBAAmB,EAAE,IAAI;IAEzB,QAAQ,EAAE;QACR;YACE,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,2CAA2C;YAClD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;;EAiBpB,oBAAoB;;;;CAIrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uCAAuC;YAC9C,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;;;EAgBpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,KAAK,EAAE,wBAAwB;YAC/B,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;EAcpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,KAAK,EAAE,sBAAsB;YAC7B,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;;EAcpB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,kBAAkB;YACzB,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;EAapB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;QACD;YACE,EAAE,EAAE,+BAA+B;YACnC,KAAK,EAAE,2BAA2B;YAClC,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EAAE;;;;;;;;;;;;;EAapB,oBAAoB;;;CAGrB,CAAC,IAAI,EAAE;SACH;KACF;CACF,CAAC"}

package/dist/audit/reporting-exports.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @connexum/ai-governance/reporting -- Public SDK subpath export
+ *
+ * Exports the AI audit reporting surface: narrative generator, types,
+ * errors, provenance helpers, and the render/seal functions.
+ *
+ * Usage:
+ *   import { AuditNarrativeGenerator, renderNarrativeReport } from '@connexum/ai-governance/reporting';
+ *
+ * Spec: P4-AIR-01 AC 24
+ *
+ * @connexum/ai-governance
+ */
+export { AuditNarrativeGenerator, sealProvenanceToChain, renderNarrativeReport, verifyProvenanceSignature, } from './narrative-generator.js';
+export type { NarrativeReport, NarrativeSection, AiProvenance, SectionSignature, AuditChainRef, ReviewerIdentity, AuditChainReader, AuditChainWriter, AuditChainEvent, AuditEventCategory, ISO8601, } from './narrative-types.js';
+export { UncitedClaimError, MissingEvidenceError, MissingProvenanceError, } from './narrative-types.js';
+export type { NarrativeGeneratorConfig, GenerateRequest, } from './narrative-generator.js';
+export type { ReportTemplate, TemplateSectionSpec } from './report-templates/index.js';
+export { REPORT_TEMPLATE_REGISTRY, validateEvidence, SOC2_TYPE_II_TEMPLATE, HIPAA_BREACH_NOTIFICATION_TEMPLATE, HIPAA_SECURITY_INCIDENT_TEMPLATE, EU_AI_ACT_ANNEX_IV_TEMPLATE, DORA_ICT_MAJOR_INCIDENT_TEMPLATE, PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE, GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE, ISO_42001_AMS_TEMPLATE, } from './report-templates/index.js';
+//# sourceMappingURL=reporting-exports.d.ts.map

package/dist/audit/reporting-exports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporting-exports.d.ts","sourceRoot":"","sources":["../../src/audit/reporting-exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,OAAO,GACR,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAG9B,YAAY,EACV,wBAAwB,EACxB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAMlC,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,kCAAkC,EAClC,gCAAgC,EAChC,2BAA2B,EAC3B,gCAAgC,EAChC,mCAAmC,EACnC,iCAAiC,EACjC,sBAAsB,GACvB,MAAM,6BAA6B,CAAC"}

package/dist/audit/reporting-exports.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * @connexum/ai-governance/reporting -- Public SDK subpath export
+ *
+ * Exports the AI audit reporting surface: narrative generator, types,
+ * errors, provenance helpers, and the render/seal functions.
+ *
+ * Usage:
+ *   import { AuditNarrativeGenerator, renderNarrativeReport } from '@connexum/ai-governance/reporting';
+ *
+ * Spec: P4-AIR-01 AC 24
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ISO_42001_AMS_TEMPLATE = exports.GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE = exports.PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE = exports.DORA_ICT_MAJOR_INCIDENT_TEMPLATE = exports.EU_AI_ACT_ANNEX_IV_TEMPLATE = exports.HIPAA_SECURITY_INCIDENT_TEMPLATE = exports.HIPAA_BREACH_NOTIFICATION_TEMPLATE = exports.SOC2_TYPE_II_TEMPLATE = exports.validateEvidence = exports.REPORT_TEMPLATE_REGISTRY = exports.MissingProvenanceError = exports.MissingEvidenceError = exports.UncitedClaimError = exports.verifyProvenanceSignature = exports.renderNarrativeReport = exports.sealProvenanceToChain = exports.AuditNarrativeGenerator = void 0;
+// Core generator + helpers
+var narrative_generator_js_1 = require("./narrative-generator.js");
+Object.defineProperty(exports, "AuditNarrativeGenerator", { enumerable: true, get: function () { return narrative_generator_js_1.AuditNarrativeGenerator; } });
+Object.defineProperty(exports, "sealProvenanceToChain", { enumerable: true, get: function () { return narrative_generator_js_1.sealProvenanceToChain; } });
+Object.defineProperty(exports, "renderNarrativeReport", { enumerable: true, get: function () { return narrative_generator_js_1.renderNarrativeReport; } });
+Object.defineProperty(exports, "verifyProvenanceSignature", { enumerable: true, get: function () { return narrative_generator_js_1.verifyProvenanceSignature; } });
+// Errors
+var narrative_types_js_1 = require("./narrative-types.js");
+Object.defineProperty(exports, "UncitedClaimError", { enumerable: true, get: function () { return narrative_types_js_1.UncitedClaimError; } });
+Object.defineProperty(exports, "MissingEvidenceError", { enumerable: true, get: function () { return narrative_types_js_1.MissingEvidenceError; } });
+Object.defineProperty(exports, "MissingProvenanceError", { enumerable: true, get: function () { return narrative_types_js_1.MissingProvenanceError; } });
+var index_js_1 = require("./report-templates/index.js");
+Object.defineProperty(exports, "REPORT_TEMPLATE_REGISTRY", { enumerable: true, get: function () { return index_js_1.REPORT_TEMPLATE_REGISTRY; } });
+Object.defineProperty(exports, "validateEvidence", { enumerable: true, get: function () { return index_js_1.validateEvidence; } });
+Object.defineProperty(exports, "SOC2_TYPE_II_TEMPLATE", { enumerable: true, get: function () { return index_js_1.SOC2_TYPE_II_TEMPLATE; } });
+Object.defineProperty(exports, "HIPAA_BREACH_NOTIFICATION_TEMPLATE", { enumerable: true, get: function () { return index_js_1.HIPAA_BREACH_NOTIFICATION_TEMPLATE; } });
+Object.defineProperty(exports, "HIPAA_SECURITY_INCIDENT_TEMPLATE", { enumerable: true, get: function () { return index_js_1.HIPAA_SECURITY_INCIDENT_TEMPLATE; } });
+Object.defineProperty(exports, "EU_AI_ACT_ANNEX_IV_TEMPLATE", { enumerable: true, get: function () { return index_js_1.EU_AI_ACT_ANNEX_IV_TEMPLATE; } });
+Object.defineProperty(exports, "DORA_ICT_MAJOR_INCIDENT_TEMPLATE", { enumerable: true, get: function () { return index_js_1.DORA_ICT_MAJOR_INCIDENT_TEMPLATE; } });
+Object.defineProperty(exports, "PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE", { enumerable: true, get: function () { return index_js_1.PCI_DSS_ANNUAL_ATTESTATION_TEMPLATE; } });
+Object.defineProperty(exports, "GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE", { enumerable: true, get: function () { return index_js_1.GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE; } });
+Object.defineProperty(exports, "ISO_42001_AMS_TEMPLATE", { enumerable: true, get: function () { return index_js_1.ISO_42001_AMS_TEMPLATE; } });
+//# sourceMappingURL=reporting-exports.js.map

package/dist/audit/reporting-exports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporting-exports.js","sourceRoot":"","sources":["../../src/audit/reporting-exports.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,2BAA2B;AAC3B,mEAKkC;AAJhC,iIAAA,uBAAuB,OAAA;AACvB,+HAAA,qBAAqB,OAAA;AACrB,+HAAA,qBAAqB,OAAA;AACrB,mIAAA,yBAAyB,OAAA;AAkB3B,SAAS;AACT,2DAI8B;AAH5B,uHAAA,iBAAiB,OAAA;AACjB,0HAAA,oBAAoB,OAAA;AACpB,4HAAA,sBAAsB,OAAA;AAcxB,wDAWqC;AAVnC,oHAAA,wBAAwB,OAAA;AACxB,4GAAA,gBAAgB,OAAA;AAChB,iHAAA,qBAAqB,OAAA;AACrB,8HAAA,kCAAkC,OAAA;AAClC,4HAAA,gCAAgC,OAAA;AAChC,uHAAA,2BAA2B,OAAA;AAC3B,4HAAA,gCAAgC,OAAA;AAChC,+HAAA,mCAAmC,OAAA;AACnC,6HAAA,iCAAiC,OAAA;AACjC,kHAAA,sBAAsB,OAAA"}

package/dist/audit/webhook-delivery.d.ts

@@ -0,0 +1,119 @@
+/**
+ * WebhookDelivery -- HTTP POST delivery for EventBus events.
+ *
+ * Forwards governance events to external SIEM/webhook endpoints
+ * with retry logic, HMAC signing, and dead-letter queue.
+ *
+ * Supports:
+ *   - Splunk HEC, Datadog, Elastic SIEM, generic webhook
+ *   - HMAC-SHA256 request signing
+ *   - Exponential backoff retry (3 attempts)
+ *   - Dead-letter queue for failed deliveries
+ *   - Event filtering by type
+ *
+ * @connexum/ai-governance
+ */
+import type { EventPayload, EventType } from './event-bus';
+export interface WebhookEndpoint {
+    /** Unique name for this endpoint */
+    name: string;
+    /** Destination URL (HTTPS required in production) */
+    url: string;
+    /** HMAC secret for request signing */
+    secret?: string;
+    /** Event types to forward (empty = all) */
+    eventTypes?: EventType[];
+    /** Custom headers to include */
+    headers?: Record<string, string>;
+    /** Format: 'json' (default), 'splunk-hec', 'syslog' (RFC 5424), or 'elastic' (NDJSON _bulk). */
+    format?: 'json' | 'splunk-hec' | 'syslog' | 'elastic';
+    /** Whether this endpoint is active */
+    enabled?: boolean;
+    /**
+     * F-NEW-CRIT-6 (2026-05-02): for `format: 'elastic'`, the
+     * Elasticsearch index to write into. Required when format is
+     * 'elastic'; ignored otherwise. Defaults to 'connexum-governance'
+     * if omitted to make typical deployments work without extra config.
+     */
+    elasticIndex?: string;
+}
+export interface WebhookDeliveryConfig {
+    /** Registered webhook endpoints */
+    endpoints: WebhookEndpoint[];
+    /** Directory for dead-letter queue */
+    dlqDir: string;
+    /** Max retry attempts (default: 3) */
+    maxRetries?: number;
+    /** Base retry delay in ms (default: 1000, doubles each retry) */
+    retryDelayMs?: number;
+    /** Request timeout in ms (default: 10000) */
+    timeoutMs?: number;
+    /** Allow HTTP (non-TLS) endpoints (default: false, for testing only) */
+    allowInsecure?: boolean;
+}
+export interface DeliveryResult {
+    endpoint: string;
+    success: boolean;
+    statusCode?: number;
+    attempts: number;
+    error?: string;
+    deliveredAt?: string;
+}
+export interface DeadLetterEntry {
+    event: EventPayload;
+    endpoint: string;
+    error: string;
+    attempts: number;
+    failedAt: string;
+}
+export declare class WebhookDelivery {
+    private config;
+    private dlqFile;
+    private statsDelivered;
+    private statsFailed;
+    constructor(config: WebhookDeliveryConfig);
+    /**
+     * Deliver an event to all matching endpoints.
+     */
+    deliver(event: EventPayload): Promise<DeliveryResult[]>;
+    /**
+     * Get dead-letter queue entries.
+     */
+    getDLQ(limit?: number): DeadLetterEntry[];
+    /**
+     * Retry all dead-letter queue entries.
+     */
+    retryDLQ(): Promise<DeliveryResult[]>;
+    /**
+     * Get delivery statistics.
+     */
+    getStats(): {
+        delivered: number;
+        failed: number;
+        dlqSize: number;
+        endpoints: number;
+    };
+    /**
+     * Add an endpoint at runtime.
+     */
+    addEndpoint(endpoint: WebhookEndpoint): void;
+    /**
+     * Remove an endpoint by name.
+     */
+    removeEndpoint(name: string): boolean;
+    private deliverToEndpoint;
+    private formatBody;
+    /**
+     * T-066: Format event as RFC 5424 syslog message.
+     *
+     * Format: <PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROCID MSGID [SD-ID SD-PARAMS] MSG
+     *
+     * Facility: 16 (local0), Severity mapped from event type.
+     */
+    private formatSyslog;
+    private syslogSeverity;
+    private escapeSyslog;
+    private sendRequest;
+    private writeDLQ;
+}
+//# sourceMappingURL=webhook-delivery.d.ts.map

package/dist/audit/webhook-delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-delivery.d.ts","sourceRoot":"","sources":["../../src/audit/webhook-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI3D,MAAM,WAAW,eAAe;IAC9B,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtD,sCAAsC;IACtC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,WAAW,CAAa;gBAEpB,MAAM,EAAE,qBAAqB;IAgBzC;;OAEG;IACG,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IA6B7D;;OAEG;IACH,MAAM,CAAC,KAAK,GAAE,MAAY,GAAG,eAAe,EAAE;IAoB9C;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAuB3C;;OAEG;IACH,QAAQ,IAAI;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAiBrF;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAI5C;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;YASvB,iBAAiB;IA8C/B,OAAO,CAAC,UAAU;IA+ClB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IAwBpB,OAAO,CAAC,cAAc;IAmBtB,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,WAAW;IAoDnB,OAAO,CAAC,QAAQ;CAejB"}